Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Node.js stack refactoring #4255

Merged
merged 17 commits into from
May 8, 2021
Merged

Node.js stack refactoring #4255

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
5a86de6
Create node.profile
glitsj16 May 7, 2021
000a3f6
Create node-gyp.profile
glitsj16 May 7, 2021
65ce781
refactor npm as redirect
glitsj16 May 7, 2021
c493bad
Create npx.profile
glitsj16 May 7, 2021
65d01b9
Create nvm.profile
glitsj16 May 7, 2021
b56cb36
Create semver.profile
glitsj16 May 7, 2021
33905d8
refactor yarn as redirect
glitsj16 May 7, 2021
be51cf3
collect node.js stack configuration in common profile
glitsj16 May 7, 2021
2666c7a
add ~/.nvm to node section
glitsj16 May 7, 2021
f6ef2b2
account for node-gyp python dependency
glitsj16 May 7, 2021
678f3d8
read-only ~/.nvm for node.js stack
glitsj16 May 7, 2021
7d6f6f5
blacklist ~/.nvm for node.js stack
glitsj16 May 7, 2021
0f3088a
move env var comment cfr. profile.template
glitsj16 May 7, 2021
59eba46
Delete node-gyp.profile
glitsj16 May 7, 2021
65e2626
Delete npx.profile
glitsj16 May 7, 2021
5fa4e2a
Delete semver.profile
glitsj16 May 7, 2021
0a8a5fc
add node and nvm to new profiles section
glitsj16 May 7, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions etc/inc/allow-common-devel.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ noblacklist ${HOME}/.java
noblacklist ${HOME}/.node-gyp
noblacklist ${HOME}/.npm
noblacklist ${HOME}/.npmrc
noblacklist ${HOME}/.nvm
noblacklist ${HOME}/.yarn
noblacklist ${HOME}/.yarn-config
noblacklist ${HOME}/.yarncache
Expand Down
4 changes: 4 additions & 0 deletions etc/inc/allow-nodejs.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,3 +4,7 @@ include allow-nodejs.local

noblacklist ${PATH}/node
noblacklist /usr/include/node

# Allow python for node-gyp (blacklisted by disable-interpreters.inc)
include allow-python2.inc
include allow-python3.inc
1 change: 1 addition & 0 deletions etc/inc/disable-common.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,6 +338,7 @@ read-only ${HOME}/dotfiles
read-only ${HOME}/.gem
read-only ${HOME}/.luarocks
read-only ${HOME}/.npm-packages
read-only ${HOME}/.nvm
read-only ${HOME}/bin
read-only ${HOME}/.bin
read-only ${HOME}/.local/bin
Expand Down
1 change: 1 addition & 0 deletions etc/inc/disable-programs.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -816,6 +816,7 @@ blacklist ${HOME}/.node-gyp
blacklist ${HOME}/.npm
blacklist ${HOME}/.npmrc
blacklist ${HOME}/.nv
blacklist ${HOME}/.nvm
blacklist ${HOME}/.nylas-mail
blacklist ${HOME}/.openarena
blacklist ${HOME}/.opencity
Expand Down
15 changes: 15 additions & 0 deletions etc/profile-m-z/node-gyp.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
# Firejail profile for node-gyp
# Description: Node.js native addon build tool
quiet
# This file is overwritten after every install/update
# Persistent local customizations
include node-gyp.local
# Persistent global definitions
include globals.local

# Allow python (blacklisted by disable-interpreters.inc)
include allow-python2.inc
include allow-python3.inc

# Redirect
include nodejs-common.profile
11 changes: 11 additions & 0 deletions etc/profile-m-z/node.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# Firejail profile for node
# Description: Evented I/O for V8 javascript
quiet
# This file is overwritten after every install/update
# Persistent local customizations
include node.local
# Persistent global definitions
include globals.local

# Redirect
include nodejs-common.profile
49 changes: 45 additions & 4 deletions etc/profile-m-z/nodejs-common.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,20 @@ include nodejs-common.local
blacklist /tmp/.X11-unix
blacklist ${RUNUSER}

ignore read-only ${HOME}/.npm-packages
ignore read-only ${HOME}/.npmrc
ignore read-only ${HOME}/.nvm
ignore read-only ${HOME}/.yarnrc
Comment on lines +13 to +16
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe prefer read-write? IDK

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe prefer read-write? IDK

I agree that read-write sounds a lot more logical than the ignore blah construct. Just checked and I used it in git-cola, gnome-{logs,system-log} and yelp too apparently. Can't remember why OTOH but I'll change it after testing it gives the same result. That'll be over the weekend though, I'm clocking off for today. Thanks for the suggestions, much appreciated. And enjoy the weekend!

Copy link
Collaborator

@rusty-snake rusty-snake May 7, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FWIW: The only case where ignore read-only should be used instead of read-write are redirect profiles [and .locals] IMHO.


noblacklist ${HOME}/.node-gyp
noblacklist ${HOME}/.npm
noblacklist ${HOME}/.npmrc
noblacklist ${HOME}/.nvm
noblacklist ${HOME}/.yarn
noblacklist ${HOME}/.yarn-config
noblacklist ${HOME}/.yarncache
noblacklist ${HOME}/.yarnrc

ignore noexec ${HOME}

include allow-bin-sh.inc
Expand All @@ -21,6 +35,32 @@ include disable-programs.inc
include disable-shell.inc
include disable-xdg.inc

# If you want whitelisting, change ${HOME}/Projects below to your node projects directory
# and add the next lines to your nodejs-common.local.
#mkdir ${HOME}/.node-gyp
#mkdir ${HOME}/.npm
#mkdir ${HOME}/.npm-packages
#mkfile ${HOME}/.npmrc
#mkdir ${HOME}/.nvm
#mkdir ${HOME}/.yarn
#mkdir ${HOME}/.yarn-config
#mkdir ${HOME}/.yarncache
#mkfile ${HOME}/.yarnrc
#whitelist ${HOME}/.node-gyp
#whitelist ${HOME}/.npm
#whitelist ${HOME}/.npm-packages
#whitelist ${HOME}/.npmrc
#whitelist ${HOME}/.nvm
#whitelist ${HOME}/.yarn
#whitelist ${HOME}/.yarn-config
#whitelist ${HOME}/.yarncache
#whitelist ${HOME}/.yarnrc
#whitelist ${HOME}/Projects
#include whitelist-common.inc

whitelist /usr/share/doc/node
whitelist /usr/share/nvm
whitelist /usr/share/systemtap/tapset/node.stp
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
Expand All @@ -46,10 +86,11 @@ shell none

disable-mnt
private-dev
# May need to add `passwd` to `private-etc` below to enable debugging with some IDEs
private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,xdg
# May need to be commented out in order to enable debugging with some IDEs
private-tmp
private-etc alternatives,ca-certificates,crypto-policies,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,mime.types,nsswitch.conf,passwd,pki,protocols,resolv.conf,rpc,services,ssl,xdg
#private-tmp

dbus-user none
dbus-system none

# Add the next line to your nodejs-common.local if you prefer to disable gatsby telemetry.
#env GATSBY_TELEMETRY_DISABLED=1
18 changes: 0 additions & 18 deletions etc/profile-m-z/npm.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,23 +7,5 @@ include npm.local
# Persistent global definitions
include globals.local

ignore read-only ${HOME}/.npm-packages
ignore read-only ${HOME}/.npmrc

noblacklist ${HOME}/.node-gyp
noblacklist ${HOME}/.npm
noblacklist ${HOME}/.npmrc

# If you want whitelisting, change ${HOME}/Projects below to your npm projects directory
# and add the next lines to your npm.local.
#mkdir ${HOME}/.node-gyp
#mkdir ${HOME}/.npm
#mkfile ${HOME}/.npmrc
#whitelist ${HOME}/.node-gyp
#whitelist ${HOME}/.npm
#whitelist ${HOME}/.npmrc
#whitelist ${HOME}/Projects
#include whitelist-common.inc

# Redirect
include nodejs-common.profile
10 changes: 10 additions & 0 deletions etc/profile-m-z/npx.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
# Firejail profile for npx
# Description: Execute npm package binaries
quiet
# Persistent local customizations
include npx.local
# Persistent global definitions
include globals.local

# Redirect
include nodejs-common.profile
13 changes: 13 additions & 0 deletions etc/profile-m-z/nvm.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# Firejail profile for nvm
# Description: Node Version Manager - Simple bash script to manage multiple active node.js versions
quiet
# This file is overwritten after every install/update
# Persistent local customizations
include nvm.local
# Persistent global definitions
include globals.local

ignore noroot

# Redirect
include nodejs-common.profile
10 changes: 10 additions & 0 deletions etc/profile-m-z/semver.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
# Firejail profile for semver
rusty-snake marked this conversation as resolved.
Show resolved Hide resolved
# Description: The semantic version parser used by npm
quiet
# Persistent local customizations
include semver.local
# Persistent global definitions
include globals.local

# Redirect
include nodejs-common.profile
20 changes: 0 additions & 20 deletions etc/profile-m-z/yarn.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,25 +6,5 @@ include yarn.local
# Persistent global definitions
include globals.local

ignore read-only ${HOME}/.yarnrc

noblacklist ${HOME}/.yarn
noblacklist ${HOME}/.yarn-config
noblacklist ${HOME}/.yarncache
noblacklist ${HOME}/.yarnrc

# If you want whitelisting, change ${HOME}/Projects below to your yarn projects directory and
# add the next lines to you yarn.local.
#mkdir ${HOME}/.yarn
#mkdir ${HOME}/.yarn-config
#mkdir ${HOME}/.yarncache
#mkfile ${HOME}/.yarnrc
#whitelist ${HOME}/.yarn
#whitelist ${HOME}/.yarn-config
#whitelist ${HOME}/.yarncache
#whitelist ${HOME}/.yarnrc
#whitelist ${HOME}/Projects
#include whitelist-common.inc

# Redirect
include nodejs-common.profile