Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New profile: irssi #6549

Merged
merged 13 commits into from
Dec 17, 2024
Merged

New profile: irssi #6549

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
c8f9a60
add irssi
gcb Jul 14, 2024
b3a2b2e
Merge branch 'netblue30:master' into gcb-patch-1
gcb Nov 18, 2024
6e3b817
reviewer suggestion
gcb Nov 18, 2024
dc3bad9
reviewer suggestion
gcb Nov 18, 2024
b2d2934
reviewer suggestion
gcb Nov 18, 2024
d74e17a
address reviewer comments
gcb Nov 18, 2024
ce307dd
default whitelists
gcb Nov 18, 2024
2c05009
reviewer improvements
gcb Nov 18, 2024
0a5466f
no tpm,input
gcb Nov 19, 2024
a27ffa4
irssi programs, reviewer comments
gcb Nov 19, 2024
7dacdf9
Update etc/inc/disable-programs.inc
kmk3 Nov 19, 2024
c19692f
profiles: irssi: improve description
kmk3 Nov 25, 2024
f83f81b
profiles: irssi: improve allow-perl comment
kmk3 Nov 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions etc/inc/disable-programs.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -777,6 +777,7 @@ blacklist ${HOME}/.i2p
blacklist ${HOME}/.icedove
blacklist ${HOME}/.imagej
blacklist ${HOME}/.inkscape
blacklist ${HOME}/.irssi
blacklist ${HOME}/.itch
blacklist ${HOME}/.ivy2
blacklist ${HOME}/.jack-server
Expand Down
58 changes: 58 additions & 0 deletions etc/profile-a-l/irssi.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
# Firejail profile for irssi
gcb marked this conversation as resolved.
Show resolved Hide resolved
# Description: TUI IRC client
# This file is overwritten after every install/update
# Persistent local customizations
include irssi.local
# Persistent global definitions
include globals.local

noblacklist ${HOME}/.irssi

# Add the next line to irssi.local if you use perl scripting.
#include allow-perl.inc

blacklist ${RUNUSER}/wayland-*

gcb marked this conversation as resolved.
Show resolved Hide resolved
include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-xdg.inc

mkdir ${HOME}/.irssi
whitelist ${HOME}/.irssi
include whitelist-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

caps.drop all
netfilter
no3d
nodvd
nogroups
noinput
nonewprivs
noprinters
noroot
nosound
notpm
notv
nou2f
novideo
protocol unix,inet,inet6
seccomp
gcb marked this conversation as resolved.
Show resolved Hide resolved
seccomp.block-secondary

disable-mnt
gcb marked this conversation as resolved.
Show resolved Hide resolved
private-cache
private-dev
Copy link
Collaborator

@kmk3 kmk3 Nov 25, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
private-dev
private-dev
private-etc @network,@tls-ca

Does it work with private-etc?

Note: The @group syntax only exists in firejail-git.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had installed -git to test with the notpm line, but now i'm back to my distro version and did not test private-etc. I will test with -git later on and report. But I don't see why not.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

instead I ran it now in debugger, also watching lsof for the pid, and nothing on etc is ever touched. I think it is OK.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

instead I ran it now in debugger, also watching lsof for the pid, and
nothing on etc is ever touched. I think it is OK.

Can you test connecting to a server in firejail-git to make sure?

It seems strange that nothing on /etc would be accessed (such as TLS-related
paths).

What is the output of trace.txt in the following?

firejail --trace=trace.txt --profile=irssi /usr/bin/irssi

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My bad. My irssi profile is very uncommon. Retested this with a clean irssi profile, and indeed, it does break dns as expected.

with private-etc: Irssi: Unable to connect server irc.freenode.net port 6667 [Temporary failure in name resolution]

without: resolves names fine.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My bad. My irssi profile is very uncommon. Retested this with a clean irssi
profile, and indeed, it does break dns as expected.

with private-etc: Irssi: Unable to connect server irc.freenode.net port 6667
[Temporary failure in name resolution]

without: resolves names fine.

Strange, what program do you use to manage dns?

On what distribution name/version?

Also, could you retest with the current irssi.profile in firejail-git (there is
one new change) and post the output of trace.txt?

private-tmp

dbus-user none
dbus-system none

restrict-namespaces
1 change: 1 addition & 0 deletions src/firecfg/firecfg.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -449,6 +449,7 @@ ipcalc
ipcalc-ng
iridium
iridium-browser
irssi
jami
jd-gui
jdownloader
Expand Down