Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Must-fix bugs for release 0.9.64 #3618

Closed
netblue30 opened this issue Sep 1, 2020 · 10 comments
Closed

Must-fix bugs for release 0.9.64 #3618

netblue30 opened this issue Sep 1, 2020 · 10 comments
Milestone

Comments

@netblue30
Copy link
Owner

netblue30 commented Sep 1, 2020

Start adding here bugs that need to be fixed before we release it. We have a lot of new functionality (SELinux, DBus, DHCP etc.), not to mention tones of new profiles. We'll go with a two weeks test release - maybe with not all the fixes in - followed by the real release. There will be at least another release before Debian goes in lockdown February next year. A new Firetools release will go in parallel - fixes to accommodate DBus handling are currently in.

The release will be the new base for LTS branch. The idea is to have both mainline and LTS from the same source code.

Milestone page: https://github.com/netblue30/firejail/milestone/1

Anything missing, put them directly in the milestone page.

@rusty-snake
Copy link
Collaborator

rusty-snake commented Sep 1, 2020

whitelist/blacklist replacement - #3447 - if not a full fix, at least we need to have an idea where we are going with it.

I would not go for such a big (maybe breaking) change short before a release. However, if we have a (mostly) finish draft what we change, we can add a "warning" it the relnotes.

As I said here, I'm fine with making this a breaking change + releasing it as a firejail 1.0 if we have a option/script which changes custom profiles.

@netblue30
Copy link
Owner Author

@rusty-snake - can you to edit directly in the first post?

As I said here, I'm fine with making this a breaking change + releasing it as a firejail 1.0 if we have a option/script which changes custom profiles.

That's an interesting idea! Most users are customizing the profiles, but we don't need to break anything. We can leave whitelist/blacklist in as aliases for some time in parallel with the new names.

@smitsohu
Copy link
Collaborator

smitsohu commented Sep 1, 2020

  1. It might be good if options like ls, tree, top and so on could replace control characters, similar to what we already do in other places. Otherwise this opens up some opportunities for a rogue sandbox, for example it could use carriage return to hide what is really going on. The coreutils ls and procps ps, top and so on are already doing the same.

  2. Ideally sbox would not just close stdin if it cannot open the null device. In the beginning only Firejail code was run in an sbox and all was fine, but nowadays an increasing amount of code that is not controlled by the project is executed in these minimal sandboxes as well. If applications are not prepared to run with their stdin closed unexpected things can happen.

Not sure if these qualify as mustfix or should wait.

@reinerh
Copy link
Collaborator

reinerh commented Sep 1, 2020

I've created a milestone to track all issues mentioned in in this thread:
https://github.com/netblue30/firejail/milestone/1

@reinerh reinerh added this to the 0.9.64 milestone Sep 1, 2020
@reinerh
Copy link
Collaborator

reinerh commented Sep 2, 2020

Btw. before releasing it, it would be nice to have a release candidate.
I could upload this to Debian/experimental to let it perform test builds on all architectures, and already run the test suite.

@reinerh
Copy link
Collaborator

reinerh commented Oct 5, 2020

0.9.64-rc1 is now available in Debian/experimental, if someone wants to test it.

@reinerh
Copy link
Collaborator

reinerh commented Oct 5, 2020

There are some "random" build errors related to manpage preprocessing.
There seems to be a race between this part in the main Makefile:

$(MANPAGES): $(wildcard src/man/*.man)

and the actual generation of the *.man files.

I'll have a look at it tomorrow, if no one beats me to it.

@rusty-snake
Copy link
Collaborator

I saw they a few days ago on my new laptop, but never on my "old" laptop. Since my new laptop has more cores then my old one, it could be a race. The interesting thing is that manpages got installed always.

@reinerh
Copy link
Collaborator

reinerh commented Oct 6, 2020

Build failure should be addressed in 1329aff.
I'll attempt another upload.

@rusty-snake
Copy link
Collaborator

To migrate your custom additions in ~/.config/firejail, you can use this script.

#!/bin/bash
sed -i -E \
        -e "/^nodbus$/c\\dbus-user none\ndbus-system none" \
        -e "/^ignore nodbus$/c\\ignore dbus-user\nignore dbus-system" \
        ~/.config/firejail/*

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants