Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add profile for npm #3866

Merged
merged 11 commits into from
Jan 8, 2021
Merged

Add profile for npm #3866

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
7a5326c
Add profile for npm
Jan 3, 2021
061a621
Apply suggestions from code review
aidalgol Jan 4, 2021
0e257c6
Remove empty line
aidalgol Jan 4, 2021
135da4d
Add npm files to add-common-devel
Jan 4, 2021
e07deac
Remove extra blank line
Jan 4, 2021
2f45760
Add common whitelist includes to npm profile
Jan 4, 2021
977e7cb
Tighten npm profile
Jan 4, 2021
16f3bd3
Remove whitelist-common.inc from npm profile
Jan 4, 2021
94a1f1c
Fix inverted commands
aidalgol Jan 6, 2021
3a85ff6
Fixes for whitelisting
Jan 7, 2021
cfb1866
Add login.defs to npm profile's private-etc
Jan 8, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions etc/inc/allow-common-devel.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,7 @@ noblacklist ${HOME}/.cargo/registry
noblacklist ${HOME}/.cargo/.crates.toml
noblacklist ${HOME}/.cargo/.crates2.json
noblacklist ${HOME}/.cargo/.package-cache

# npm
noblacklist ${HOME}/.npm
noblacklist ${HOME}/.npmrc
6 changes: 6 additions & 0 deletions etc/inc/allow-nodejs.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include allow-nodejs.local

noblacklist ${PATH}/node
noblacklist /usr/include/node
2 changes: 2 additions & 0 deletions etc/inc/disable-programs.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -758,6 +758,8 @@ blacklist ${HOME}/.neverball
blacklist ${HOME}/.newsbeuter
blacklist ${HOME}/.newsboat
blacklist ${HOME}/.nicotine
blacklist ${HOME}/.npm
blacklist ${HOME}/.npmrc
rusty-snake marked this conversation as resolved.
Show resolved Hide resolved
blacklist ${HOME}/.nv
blacklist ${HOME}/.nylas-mail
blacklist ${HOME}/.openarena
Expand Down
57 changes: 57 additions & 0 deletions etc/profile-m-z/npm.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
# Firejail profile for npm
# Description: The Node.js Package Manager
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might be good to add quiet here to avoid making npm's already pretty verbose output even noisier.

# This file is overwritten after every install/update
# Persistent local customizations
include npm.local
# Persistent global definitions
include globals.local

blacklist /tmp/.X11-unix
blacklist ${RUNUSER}

noblacklist ${HOME}/.npm
noblacklist ${HOME}/.npmrc

noblacklist ${PATH}/bash
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why only allow these from disable-shell.inc? IMHO it would make more sense to drop these individual paths and remove 'include disable-shell.inc' below.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If just /bin/sh is needed?

Copy link
Contributor Author

@aidalgol aidalgol Jan 6, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my use of this profile, /bin/sh was insufficient, as some packages seemed to use /bin/bash. The other shells do not seem to be used anywhere near as commonly for build scripts, if ever.

noblacklist ${PATH}/dash
noblacklist ${PATH}/sh

ignore noexec ${HOME}

include disable-common.inc
include disable-exec.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-shell.inc
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See earlier comment.

include disable-xdg.inc

include whitelist-common.inc
aidalgol marked this conversation as resolved.
Show resolved Hide resolved
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

caps.drop all
ipc-namespace
machine-id
netfilter
no3d
nodvd
nogroups
nonewprivs
noroot
nosound
notv
nou2f
novideo
protocol unix,inet,inet6,netlink
seccomp
seccomp.block-secondary
shell none

disable-mnt
private-dev
private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,xdg
aidalgol marked this conversation as resolved.
Show resolved Hide resolved
private-tmp

dbus-user none
dbus-system none