Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

hardening some profiles #3505

Merged
merged 2 commits into from
Jul 9, 2020
+76 −17
Merged

hardening some profiles #3505

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
90e69f9
hardening some profiles
rusty-snake Jul 9, 2020
fde010f
followup
rusty-snake Jul 9, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,4 +196,4 @@ gnome-screenshot, ripperX, sound-juicer, iagno, com.github.dahenson.agenda, gnom
penguin-command, x2goclient, frogatto, gnome-mines, gnome-nibbles, lightsoff, ts3client_runscript.sh, warmux, ferdi, abiword,
four-in-a-row, gnome-mahjongg, gnome-robots, gnome-sudoku, gnome-taquin, gnome-tetravex, blobwars, gravity-beams-and-evaporating-stars,
hyperrogue, jumpnbump-menu, jumpnbump, magicor, mindless, mirrormagic, mrrescue, scorched3d-wrapper, scorchwentbonkers,
seahorse-adventures, wordwarvi, xbill, gnome-klotski, five-or-more, swell-foop, fdns, jitsi-meet-desktop, nicontine, steam-runtime, apostrophe, quadrapassel, dino-im, strawberry, hitori, bijiben, gnote, gnubik, ZeGrapher, gapplication
seahorse-adventures, wordwarvi, xbill, gnome-klotski, five-or-more, swell-foop, fdns, jitsi-meet-desktop, nicontine, steam-runtime, apostrophe, quadrapassel, dino-im, strawberry, hitori, bijiben, gnote, gnubik, ZeGrapher, gapplication, xonotic-sdl-wrapper, openarena_ded
3 changes: 2 additions & 1 deletion RELNOTES
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,8 @@ firejail (0.9.63) baseline; urgency=low
* new profiles: seahorse-adventures, wordwarvi, xbill, gnome-klotski
* new profiles: swell-foop, fdns, five-or-more, steam-runtime, jitsi-meet-desktop
* new profiles: nicotine, plv, mocp, apostrophe, quadrapassel, dino-im, strawberry
* new profiles: hitori, bijiben, gnote, gnubik, ZeGrapher, gapplication
* new profiles: hitori, bijiben, gnote, gnubik, ZeGrapher, xonotic-sdl-wrapper
* new profiles: gapplication, openarena_ded
-- netblue30 <netblue30@yahoo.com> Tue, 21 Apr 2020 08:00:00 -0500

firejail (0.9.62) baseline; urgency=low
Expand Down
15 changes: 12 additions & 3 deletions etc/profile-a-l/flameshot.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ include flameshot.local
include globals.local

noblacklist ${PICTURES}
noblacklist ${HOME}/.config/Dharkael

include disable-common.inc
include disable-devel.inc
Expand All @@ -18,7 +19,13 @@ include disable-programs.inc
include disable-shell.inc
include disable-xdg.inc

#whitelist ${PICTURES}
#whitelist ${HOME}/.config/Dharkael
whitelist /usr/share/flameshot
#include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

caps.drop all
ipc-namespace
Expand All @@ -35,13 +42,15 @@ novideo
protocol unix,inet,inet6
seccomp
shell none
tracelog

disable-mnt
private-bin flameshot
private-cache
private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.conf,pki,resolv.conf,ssl
private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.conf,machine-id,pki,resolv.conf,ssl
private-dev
private-tmp

# dbus-user none
# dbus-system none
dbus-user filter
dbus-user.own org.dharkael.Flameshot
dbus-system none
1 change: 1 addition & 0 deletions etc/profile-a-l/frogatto.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ mkdir ${HOME}/.frogatto
whitelist ${HOME}/.frogatto
whitelist /usr/share/frogatto
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

Expand Down
1 change: 1 addition & 0 deletions etc/profile-a-l/ghostwriter.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ whitelist /usr/share/ghostwriter
whitelist /usr/share/mozilla-dicts
whitelist /usr/share/texlive
whitelist /usr/share/pandoc*
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc

apparmor
Expand Down
2 changes: 2 additions & 0 deletions etc/profile-a-l/gnome-latex.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,3 +49,5 @@ private-cache
private-dev
# passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed
private-etc alternatives,dconf,fonts,gtk-3.0,latexmk.conf,login.defs,passwd,texlive

dbus-system none
11 changes: 11 additions & 0 deletions etc/profile-a-l/keepassxc.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,17 @@ include disable-programs.inc
include disable-shell.inc
include disable-xdg.inc

# You can enable whitelisting for keepassxc by uncommenting (or adding to you keepassxc.local) the following lines.
# If you do so, you MUST store your database under ${HOME}/Documents/KeePassXC/foo.kdbx
#mkdir ${HOME}/Documents/KeePassXC
#whitelist ${HOME}/Documents/KeePassXC
# Needed for KeePassXC-Browser
#mkfile ${HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json
#whitelist ${HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json
#mkdir ${HOME}/.config/keepassxc
#whitelist ${HOME}/.config/keepassxc
#include whitelist-common.inc

whitelist /usr/share/keepassxc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
Expand Down
3 changes: 3 additions & 0 deletions etc/profile-m-z/minetest.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ include minetest.local
# Persistent global definitions
include globals.local

# In order to save in-game screenshots to a persistent location edit ~/.minetest/minetest.conf:
# screenshot_path = /home/<USER>/.minetest/screenshots

noblacklist ${HOME}/.cache/minetest
noblacklist ${HOME}/.minetest

Expand Down
27 changes: 16 additions & 11 deletions etc/profile-m-z/openarena.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,30 +16,35 @@ include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc

mkdir ${HOME}/.openarena
whitelist ${HOME}/.openarena
whitelist /usr/share/openarena
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.in
include whitelist-var-common.inc

apparmor
caps.drop all
# ipc-namespace
# netfilter
# nodvd
# nogroups
netfilter
nodvd
nogroups
nonewprivs
noroot
notv
# nou2f
nou2f
novideo
protocol unix,inet,inet6,netlink
seccomp
shell none
# tracelog
tracelog

# disable-mnt
# private-bin openarena
disable-mnt
private-bin bash,cut,glxinfo,grep,head,openarena,openarena_ded,quake3,zenity
private-cache
private-dev
# private-etc drirc,machine-id,openal,passwd,selinux,udev,xdg
private-etc drirc,machine-id,openal,passwd,selinux,udev,xdg
private-tmp

# dbus-user none
# dbus-system none
dbus-user none
dbus-system none
5 changes: 5 additions & 0 deletions etc/profile-m-z/openarena_ded.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
# Firejail profile alias for openarena
# This file is overwritten after every install/update

# Redirect
include openarena.profile
3 changes: 3 additions & 0 deletions etc/profile-m-z/tremulous.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,10 @@ include disable-xdg.inc

mkdir ${HOME}/.tremulous
whitelist ${HOME}/.tremulous
whitelist /usr/share/tremulous
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

caps.drop all
Expand Down
6 changes: 6 additions & 0 deletions etc/profile-m-z/xonotic-sdl-wrapper.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# Firejail profile alias for xonotic
# This file is overwritten after every install/update
include xonotic-sdl-wrapper.local

# Redirect
include xonotic.profile
12 changes: 11 additions & 1 deletion etc/profile-m-z/xonotic.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,12 +14,17 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc

mkdir ${HOME}/.xonotic
whitelist ${HOME}/.xonotic
whitelist /usr/share/xonotic
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
netfilter
nodvd
Expand All @@ -32,12 +37,17 @@ novideo
protocol unix,inet,inet6
seccomp
shell none
tracelog

disable-mnt
private-bin bash,blind-id,darkplaces-glx,darkplaces-sdl,dirname,grep,ldd,netstat,ps,readlink,sh,uname,xonotic,xonotic-glx,xonotic-linux32-dedicated,xonotic-linux32-glx,xonotic-linux32-sdl,xonotic-linux64-dedicated,xonotic-linux64-glx,xonotic-linux64-sdl,xonotic-sdl
private-cache
private-bin basename,bash,blind-id,cut,darkplaces-glx,darkplaces-sdl,dirname,glxinfo,grep,head,ldd,netstat,ps,readlink,sed,sh,uname,xonotic,xonotic-glx,xonotic-linux32-dedicated,xonotic-linux32-glx,xonotic-linux32-sdl,xonotic-linux64-dedicated,xonotic-linux64-glx,xonotic-linux64-sdl,xonotic-sdl,xonotic-sdl-wrapper,zenity
private-dev
private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl
private-tmp

dbus-user none
dbus-system none

read-only ${HOME}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the benefit of this since it is already whitelisted?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Placing files under $HOME which are then executed. Sure, this is mitigated by disable-interpreters and disable-exec but as long as there are no drawback with a ro $HOME, we can add it.

read-write ${HOME}/.xonotic
2 changes: 2 additions & 0 deletions src/firecfg/firecfg.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -522,6 +522,7 @@ ooffice
ooviewdoc
open-invaders
openarena
openarena_ded
opencity
openclonk
openoffice.org
Expand Down Expand Up @@ -783,6 +784,7 @@ xmr-stak
xonotic
xonotic-glx
xonotic-sdl
xonotic-sdl-wrapper
xournal
xpdf
xplayer
Expand Down