Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

noprinters: add missing items & add to profile.template #4827

Merged
merged 2 commits into from
Jan 8, 2022
Merged

noprinters: add missing items & add to profile.template #4827

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1271645
noprinters: add missing items from new command checklist
kmk3 Jan 5, 2022
58b58cf
profile.template: add noprinters
kmk3 Jan 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion contrib/vim/syntax/firejail.vim
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ syn match fjVar /\v\$\{(CFG|DESKTOP|DOCUMENTS|DOWNLOADS|HOME|MUSIC|PATH|PICTURES
" Generate list with: { rg -o 'strn?cmp\(ptr, "([^"]+) "' -r '$1' src/firejail/profile.c; echo private-lib; } | grep -vEx '(include|ignore|caps\.drop|caps\.keep|protocol|seccomp|seccomp\.drop|seccomp\.keep|env|rmenv|net|ip)' | sort -u | tr $'\n' '|' # private-lib is special-cased in the code and doesn't match the regex; grep-ed patterns are handled later with 'syn match nextgroup=' directives (except for include which is special-cased as a fjCommandNoCond keyword)
syn match fjCommand /\v(bind|blacklist|blacklist-nolog|cgroup|cpu|defaultgw|dns|hostname|hosts-file|ip6|iprange|join-or-start|mac|mkdir|mkfile|mtu|name|netfilter|netfilter6|netmask|nice|noblacklist|noexec|nowhitelist|overlay-named|private|private-bin|private-cwd|private-etc|private-home|private-lib|private-opt|private-srv|read-only|read-write|rlimit-as|rlimit-cpu|rlimit-fsize|rlimit-nofile|rlimit-nproc|rlimit-sigpending|timeout|tmpfs|veth-name|whitelist|xephyr-screen) / skipwhite contained
" Generate list with: rg -o 'strn?cmp\(ptr, "([^ "]*[^ ])"' -r '$1' src/firejail/profile.c | grep -vEx '(include|rlimit|quiet)' | sed -e 's/\./\\./' | sort -u | tr $'\n' '|' # include/rlimit are false positives, quiet is special-cased below
syn match fjCommand /\v(allow-debuggers|allusers|apparmor|caps|deterministic-exit-code|deterministic-shutdown|disable-mnt|ipc-namespace|keep-config-pulse|keep-dev-shm|keep-var-tmp|machine-id|memory-deny-write-execute|netfilter|no3d|noautopulse|nodbus|nodvd|nogroups|noinput|nonewprivs|noroot|nosound|notv|nou2f|novideo|overlay|overlay-tmpfs|private|private-cache|private-cwd|private-dev|private-lib|private-tmp|seccomp|seccomp\.32|seccomp\.block-secondary|tracelog|writable-etc|writable-run-user|writable-var|writable-var-log|x11)$/ contained
syn match fjCommand /\v(allow-debuggers|allusers|apparmor|caps|deterministic-exit-code|deterministic-shutdown|disable-mnt|ipc-namespace|keep-config-pulse|keep-dev-shm|keep-var-tmp|machine-id|memory-deny-write-execute|netfilter|no3d|noautopulse|nodbus|nodvd|nogroups|noinput|nonewprivs|noprinters|noroot|nosound|notv|nou2f|novideo|overlay|overlay-tmpfs|private|private-cache|private-cwd|private-dev|private-lib|private-tmp|seccomp|seccomp\.32|seccomp\.block-secondary|tracelog|writable-etc|writable-run-user|writable-var|writable-var-log|x11)$/ contained
syn match fjCommand /ignore / nextgroup=fjCommand,fjCommandNoCond skipwhite contained
syn match fjCommand /caps\.drop / nextgroup=fjCapability,fjAll skipwhite contained
syn match fjCommand /caps\.keep / nextgroup=fjCapability skipwhite contained
Expand Down
1 change: 1 addition & 0 deletions etc/templates/profile.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,7 @@ include globals.local
#nogroups
#noinput
#nonewprivs
#noprinters
#noroot
#nosound
#notv
Expand Down
1 change: 1 addition & 0 deletions src/firejail/usage.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,7 @@ static char *usage_str =
" --nogroups - disable supplementary groups.\n"
" --noinput - disable input devices.\n"
" --nonewprivs - sets the NO_NEW_PRIVS prctl.\n"
" --noprinters - disable printers.\n"
" --noprofile - do not use a security profile.\n"
#ifdef HAVE_USERNS
" --noroot - install a user namespace with only the current user.\n"
Expand Down
3 changes: 3 additions & 0 deletions src/man/firejail-profile.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -489,6 +489,9 @@ Sets the NO_NEW_PRIVS prctl. This ensures that child processes
cannot acquire new privileges using execve(2); in particular,
this means that calling a suid binary (or one with file capabilities)
does not result in an increase of privilege.
.TP
\fBnoprinters
Disable printers.
#ifdef HAVE_USERNS
.TP
\fBnoroot
Expand Down
4 changes: 4 additions & 0 deletions src/man/firejail.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1633,6 +1633,10 @@ this means that calling a suid binary (or one with file capabilities)
does not result in an increase of privilege. This option
is enabled by default if seccomp filter is activated.

.TP
\fB\-\-noprinters
Disable printers.

.TP
\fB\-\-noprofile
Do not use a security profile.
Expand Down
1 change: 1 addition & 0 deletions src/zsh_completion/_firejail.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,6 +123,7 @@ _firejail_args=(
'--nogroups[disable supplementary groups]'
'--noinput[disable input devices]'
'--nonewprivs[sets the NO_NEW_PRIVS prctl]'
'--noprinters[disable printers]'
'--nosound[disable sound system]'
'--nou2f[disable U2F devices]'
'--novideo[disable video devices]'
Expand Down