Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add profile for authenticator-rs, improve falkon #3747

Merged
merged 4 commits into from
Dec 7, 2020
Merged

Add profile for authenticator-rs, improve falkon #3747

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1094e1a
Add profile for authenticator-rs, improve falkon, balsa
Nov 13, 2020
d93534b
Fix
Nov 19, 2020
9264e3d
Add private-tmp to falkon
Nov 23, 2020
4d21850
Revert balsa
Dec 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions etc/inc/disable-programs.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -584,6 +584,7 @@ blacklist ${HOME}/.local/share/agenda
blacklist ${HOME}/.local/share/apps/korganizer
blacklist ${HOME}/.local/share/aspyr-media
blacklist ${HOME}/.local/share/autokey
blacklist ${HOME}/.local/share/authenticator-rs
blacklist ${HOME}/.local/share/backintime
blacklist ${HOME}/.local/share/baloo
blacklist ${HOME}/.local/share/barrier
Expand Down
55 changes: 55 additions & 0 deletions etc/profile-a-l/authenticator-rs.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
# Firejail profile for authenticator-rs
# Description: Rust based 2FA authentication program
# This file is overwritten after every install/update
# Persistent local customizations
include authenticator-rs.local
# Persistent global definitions
include globals.local

noblacklist ${HOME}/.local/share/authenticator-rs

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-shell.inc
include disable-xdg.inc

mkdir ${HOME}/.local/share/authenticator-rs
whitelist ${HOME}/.local/share/authenticator-rs
whitelist ${DOWNLOADS}
whitelist /usr/share/uk.co.grumlimited.authenticator-rs
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
netfilter
no3d
nodvd
nogroups
nonewprivs
noroot
nosound
notv
nou2f
novideo
protocol unix,inet,inet6
seccomp
shell none
tracelog

disable-mnt
private-bin authenticator-rs
private-cache
private-dev
private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,pki,resolv.conf,ssl,xdg
private-tmp

dbus-user filter
dbus-user.own uk.co.grumlimited.authenticator-rs
rusty-snake marked this conversation as resolved.
Show resolved Hide resolved
dbus-system none
5 changes: 3 additions & 2 deletions etc/profile-a-l/balsa.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,10 +69,11 @@ writable-run-user
writable-var

dbus-user filter
dbus-user.own org.desktop.Balsa
dbus-user.talk ca.desrt.dconf
dbus-user.talk org.freedesktop.secrets
dbus-user.own org.desktop.Balsa
dbus-user.talk org.freedesktop.Notifications
dbus-user.talk org.freedesktop.secrets
rusty-snake marked this conversation as resolved.
Show resolved Hide resolved
dbus-user.talk org.gnome.Keyring.SystemPrompter
dbus-system none

read-only ${HOME}/.mozilla/firefox/profiles.ini
16 changes: 13 additions & 3 deletions etc/profile-a-l/falkon.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,29 +15,39 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc

mkdir ${HOME}/.cache/falkon
mkdir ${HOME}/.config/falkon
whitelist ${DOWNLOADS}
whitelist ${HOME}/.cache/falkon
whitelist ${HOME}/.config/falkon
whitelist /usr/share/falkon
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
netfilter
nodvd
nogroups
nonewprivs
noroot
notv
nou2f
?BROWSER_DISABLE_U2F: nou2f
rusty-snake marked this conversation as resolved.
Show resolved Hide resolved
protocol unix,inet,inet6,netlink
# blacklisting of chroot system calls breaks falkon
seccomp !chroot
# tracelog

private-dev
# private-etc alternatives,passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,adobe,mime.types,mailcap,asound.conf,pulse,machine-id,ca-certificates,ssl,pki,crypto-policies
disable-mnt
private-cache
?BROWSER_DISABLE_U2F: private-dev
private-etc adobe,alternatives,asound.conf,ati,ca-certificates,crypto-policies,dconf,drirc,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg
# private-tmp - interferes with the opening of downloaded files
bbhtt marked this conversation as resolved.
Show resolved Hide resolved

dbus-user filter
dbus-user.own org.kde.Falkon
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will probably break things such as plasma-browser-integation.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will comment both lines? I thought about it but I don't have a KDE system running.

dbus-system none
1 change: 1 addition & 0 deletions src/firecfg/firecfg.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ audacious
audacity
audio-recorder
authenticator
authenticator-rs
autokey-gtk
autokey-qt
autokey-run
Expand Down