-
Notifications
You must be signed in to change notification settings - Fork 578
/
Copy pathRELNOTES
1355 lines (1279 loc) · 68.6 KB
/
RELNOTES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
firejail (0.9.73) baseline; urgency=low
* work in progress
* security: fix sscanf rv checks (CodeQL) (#6184)
* feature: private-etc rework: improve handling of /etc/resolv.conf and add
private-etc groups (#6400 #5518 #5608 #5609 #5629 #5638 #5641 #5642 #5643
#5650 #5681 #5737 #5844 #5989 #6016 #6104 #5655 #6435 #6514 #6515)
* feature: Add "keep-shell-rc" command and option (#1127 #5634)
* feature: Print the argument when failing with "too long arguments" (#5677)
* feature: a random hostname is assigned to each sandbox unless
overwritten using --hostname command
* feature: add IPv6 support for --net.print option
* feature: QUIC (HTTP/3) support in --nettrace
* feature: add seccomp filters for --restrict-namespaces
* feature: stats support for --nettrace
* feature: add doas support in firecfg and jailcheck (#5899 #5900)
* feature: firecfg: add firecfg.d & add ignore command (#2097 #5245 #5876
#6153 #6268)
* feature: expand simple macros in more commands (--chroot= --netfilter=
--netfilter6= --trace=) (#6032 #6109)
* feature: add Landlock support (#5269 #6078 #6115 #6125 #6187 #6195 #6200
#6228 #6260 #6302 #6305)
* feature: add support for comm, coredump, and prctl procevents in firemon
(#6414 #6415)
* feature: add notpm command & keep tpm devices in private-dev (#6379 #6390)
* feature: fshaper.sh: support tc on NixOS (#6426 #6431)
* feature: add aarch64 syscalls (#5821 #6574)
* feature: add --disable-sandbox-check configure flag (#6592)
* modif: Stop forwarding own double-dash to the shell (#5599 #5600)
* modif: Prevent sandbox name (--name=) and host name (--hostname=)
from containing only digits (#5578 #5741)
* modif: Escape control characters of the command line (#5613)
* modif: Allow mostly only ASCII letters and digits for sandbox name
(--name=) and host name (--hostname=) (#5708 #5856)
* modif: make private-lib a configure-time option, disabled by default (see
--enable-private-lib) (#5727 #5732)
* modif: Improve --version/--help & print version on startup (#5829 #6172)
* modif: improve errExit error messages (#5871)
* modif: drop deprecated 'shell' option references (#5894)
* modif: keep pipewire group unless nosound is used (#5992 #5993)
* modif: fcopy: use lstat when copying directory (#5378 #5957)
* modif: private-dev: keep /dev/kfd unless no3d is used (#6380)
* modif: keep /sys/module/nvidia* if prop driver and no no3d (#6372 #6387)
* modif: clarify error messages in profile.c (#6605)
* removal: firemon: remove --interface option (it duplicates the firejail
--net.print= option) (0e48f9933)
* removal: remove support for LTS and firetunnel (db09546f2)
* bugfix: fix --hostname and --hosts-file commands
* bugfix: fix examples in firejail-local AppArmor profile (#5717)
* bugfix: arp.c: ensure positive timeout on select(2) (#5806)
* bugfix: Wrong syscall names for s390_pci_mmio_read and s390_pci_mmio_write
(#5965 #5976)
* bugfix: firejail --ls reports wrong file sizes for large files (#5982
#6086)
* bugfix: fix startup race condition for /run/firejail directory (#6307)
* bugfix: fix various resource leaks (#6367)
* bugfix: profstats: fix restrict-namespaces max count (#6369)
* bugfix: remove --noautopulse from --help and zsh comp (#6401)
* bugfix: parse --debug before using it (#6579)
* bugfix: fix possible memory leak in fs_home.c (#6598)
* build: auto-generate syntax files (#5627)
* build: mark all phony targets as such (#5637)
* build: mkdeb.sh: pass all arguments to ./configure (#5654)
* build: deb: enable apparmor by default & remove deb-apparmor (#5668)
* build: Fix whitespace and add .editorconfig (#5674)
* build: remove for loop initial declarations to fix building with old
compilers (#5778)
* build: enable compiler warnings by default (#5842)
* build: remove -mretpoline and NO_EXTRA_CFLAGS (#5859)
* build: disable all built-in implicit make rules (#5864)
* build: organize and standardize make vars and targets (#5866)
* build: fix seccomp filters and man pages always being rebuilt when running
make (#5156 #5898)
* build: fix hardcoded make & remove unnecessary distclean targets (#5911)
* build: dist and asc improvements (#5916)
* build: fix some shellcheck issues & use config.sh in more scripts (#5927)
* build: firecfg.config sorting improvements (#5942)
* build: codespell improvements (#5955)
* build: add missing makefile dep & syntax improvements (#5956)
* build: sort.py: use case-sensitive sorting (#6070)
* build: mkrpm.sh: append instead of override configure args (#6126)
* build: use CPPFLAGS instead of INCLUDE in compile targets (#6159)
* build: use full paths on compile/link targets (#6158)
* build: automatically generate header dependencies (#6164)
* build: improve main clean target (#6186)
* build: mkrpm.sh improvements (#6196)
* build: move errExit macro into inline function (#6217)
* build: allow overriding certain tools & sync targets with CI (#6222)
* build: reduce hardcoding and inconsistencies (#6230)
* build: sort.py: filter empty and duplicate items (#6261)
* build: fix "warning: "_FORTIFY_SOURCE" redefined" (#6282 #6283)
* build: sort.py: add -h/-i/-n/-- options (#6290 #6339 #6562)
* build: add strip target and simplify install targets (#6342)
* build: remove clean dependency from cppcheck targets (#6343)
* build: allow overriding common tools (#6354)
* build: standardize install commands (#6366)
* build: improve reliability/portability of date command usage (#6403 #6404)
* build: sort.py: strip whitespace in profiles (#6556)
* build: sort.py: fix whitespace in entire profile (#6593)
* build: sort.py: quote diff lines (#6594)
* ci: always update the package db before installing packages (#5742)
* ci: fix codeql unable to download its own bundle (#5783)
* ci: split configure/build/install commands on gitlab (#5784)
* ci: fix swapped name/email arguments in debian_ci (#5795)
* ci: formatting and misc improvements (#5802)
* ci: run for every branch instead of just master (#5815)
* ci: upgrade debian:stretch to debian:buster (#5818)
* ci: standardize apt-get update/install & misc improvements (#5857)
* ci: Update step-security/harden-runner and update allowed endpoints (#5953)
* ci: whitelist paths, reorganize workflows & speed-up tests (#5960)
* ci: fix dependabot duplicated workflow runs (#5984)
* ci: allow running workflows manually (#6026)
* ci: add timeout limits (#6178)
* ci: make dependabot updates monthly and bump PR limit (#6338)
* contrib/syntax: remove 'text/plain' from firejail-profile.lang.in (#6057
#6059)
* contrib/vim: match profile files more broadly (#5850)
* test: split individual test groups in github workflows
* test: add chroot, appimage and network tests in github workflows
* docs: remove apparmor options in --help when building without apparmor
support (#5589)
* docs: fix typos (#5693)
* docs: markdown formatting and misc improvements (#5757)
* docs: add uninstall instructions to README.md (#5812)
* docs: add precedence info to manpage & fix noblacklist example (#6358
#6359)
* docs: bug_report.md: use absolute path in 'steps to reproduce' (#6382)
* docs: man: format and sort some private- items (#6398)
* docs: man: improve blacklist/whitelist examples with spaces (#6425)
* docs: add build_issue.md issue template (#6423)
* docs: man: sort commands (firejail.1) (#6451)
* docs: man: fix bold in command TPs (#6472)
* docs: man: fix wrong escapes (#6474)
* docs: github: streamline environment in issue templates (#6471 #6607)
* docs: fix typos of --enable-selinux configure option (#6526)
* docs: clarify intro and build section in README (#6524)
* docs: clarify that other tools may not be in PPA (#6407)
* docs: use GitHub issues as the bug reporting address (#6525)
* legal: selinux.c: Split Copyright notice & use same license as upstream
(#5667)
* profiles: qutebrowser: fix links not opening in the existing instance
(#5601 #5618)
* profiles: clarify userns comments (#5686)
* profiles: bulk rename electron to electron-common (#5700)
* profiles: streamline seccomp socket comment (#5735)
* profiles: drop hostname option from all profiles (#5702)
* profiles: move read-only config entries to disable-common.inc (#5763)
* profiles: standardize on just "GTK" on comments (#5794)
* profiles: bleachbit: allow erasing Trash contents (#5337 #5902)
* profiles: improvements to profiles using private (#5946)
* profiles: standardize commented code and eol comments (#5987)
* profiles: disable-common: add more suid programs (#6049 #6051 #6052)
* profiles: replace private-opt with whitelist & document private-opt issues
(#6021)
* profiles: drop paths already in wusc (#6218)
* profiles: deny access to ~/.config/autostart (#6257)
* profiles: replace x11 socket blacklist with disable-X11.inc (#6286)
* profiles: sort blacklist sections (#6289)
* profiles: rename disable-X11.inc to disable-x11.inc (#6294)
* profiles: add allow-nodejs.inc to profile.template (#6298)
* profiles: add allow-php.inc to profile.template (#6299)
* profiles: clarify and add opengl-game to profile.template (#6300)
* profiles: allow-ssh: allow /etc/ssh/ssh_revoked_hosts (#6308 #6309)
* profiles: libreoffice: support signing documents with GPG (#6352 #6353)
* profiles: blacklist i3 IPC socket & dir except for i3 itself (#6361)
* profiles: librewolf: add new dbus name (io.gitlab.firefox) (#6413 #6473)
* profiles: nextcloud: fix access to ~/Nextcloud (#5877 #6478)
* profiles: ssh: add ${RUNUSER}/gvfsd-sftp (#5816 #6479)
* profiles: firecfg: disable text editors (#6002 #6477)
* profiles: browsers: centralize/sync/improve comments (#6486)
* profiles: keepassxc: add new socket location (#5447 #6391)
* profiles: signal-desktop: allow org.freedesktop.secrets (#6498)
* profiles: firefox-common: allow org.freedesktop.portal.Documents (#6444
#6499)
* profiles: keepassxc: allow access to ssh-agent socket (#3314 #6531)
* profiles: firecfg.config: disable dnsmasq (#6533)
* profiles: game-launchers: disable nou2f (#6534)
* profiles: anki: fix opening, allow media & add to firecfg (#6544 #6545)
* profiles: wget: allow ~/.local/share/wget (#6542)
* profiles: wget: unify wget2 into wget profile (#6551)
* profiles: tesseract: disable private-tmp to fix ocrmypdf (#6550 #6552)
* profiles: ensure allow-lua where mpv is allowed (#6555)
* profiles: video-players: add missing /usr/share paths (#6557)
* profiles: clamav: add /etc/clamav (#6565)
* profiles: lutris: add comment for gamescope workaround (#6192)
* profiles: disable-common: add bubblejail paths (#6571)
* profiles: fix misc in kmail/transmission-qt & add kontact.profile (#5905)
* profiles: misc changes and self-ref fixes in ghostwriter/peek (#5648)
* profiles: firecfg: fix sha384sum & add b2sum/cksum (#6578)
* profiles: refactor com.github.johnfactotum.Foliate into foliate.profile
(#6582)
* profiles: anki: fix dark mode detection & misc changes (#6581)
* new profiles: fix-qdf, qpdf, zlib-flate, standard-notes, url-eater
-- netblue30 <[email protected]> Mon, 17 Jan 2023 09:00:00 -0500
firejail (0.9.72) baseline; urgency=low
* feature: On failing to remount a fuse filesystem, give warning instead of
erroring out (#5240 #5242)
* feature: Update syscall tables and seccomp groups (#5188)
* feature: improve force-nonewprivs security guarantees (#5217 #5271)
* feature: add support for restricting the creation of Linux namespaces
(--restrict-namespaces, --restrict-namespaces=), implemented as a seccomp
filter for both 64 and 32 bit architectures (#4939 #5259)
* feature: add support for custom AppArmor profiles (--apparmor=) (#5274
#5316 #5317 #5475)
* feature: add support for ICMP in nettrace
* feature: add --dnstrace, --icmptrace, and --snitrace commands
* feature: Add basic gtksourceview language-spec (file type detection/syntax
highlighting for profiles) (#5502)
* feature: add restrict-namespaces to (almost) all applicable profiles (#5440
#5537)
* feature: add support for netlock in profile files
* modif: removed --cgroup= command (#5190 #5200)
* modif: set --shell=none as the default (#5190)
* modif: removed --shell= command (#5190 #5196 #5209)
* modif: disabled firetunnel by default in configure.ac (#5190)
* modif: disabled chroot by default in /etc/firejail/firejail.config (#5190)
* modif: disabled private-lib by default in /etc/firejail/firejail.config
(#5190 #5216)
* modif: disabled tracelog by default in /etc/firejail/firejail.config
(#5190)
* modif: removed grsecurity support
* modif: stop hiding blacklisted files in /etc by default and add a new
etc-hide-blacklisted option to firejail.config that enables the previous
behavior (disabled by default) (#5010 #5230 #5591 #5595)
* bugfix: Flood of seccomp audit log entries (#5207)
* bugfix: --netlock does not work (Error: no valid sandbox) (#5312)
* build: deduplicate configure-time vars into new config files (#5140 #5284)
* build: fix file mode of shell scripts (644 -> 755) (#5206)
* build: reduce autoconf input files from 32 to 2 (#5219)
* build: add dist build directory to .gitignore (#5248)
* build: add autoconf auto-generation comment to input files (#5251)
* build: Add files make uninstall forgot to remove (#5283)
* build: add and use TARNAME instead of NAME for paths (#5310)
* build: only install ids.config when --enable-ids is set (#5356 #5357)
* build: Remove deprecated syntax and modernize shell test scripts (#5370)
* build: Fix musl warnings (#5421 #5431)
* build: sort.py improvements (#5429)
* build: deduplicate makefiles (#5478)
* build: fix formatting and misc in configure (#5488)
* build: actually set LDFLAGS/LIBS & stop overriding CFLAGS/LDFLAGS (#5504)
* build: make shell commands more portable in firejail.vim (#5577)
* ci: bump ubuntu to 22.04 and use newer compilers / analyzers (#5275)
* ci: ignore git-related paths and the project license (#5249)
* ci: Harden GitHub Actions (StepSecurity) (#5439)
* ci: sort and ignore more paths (#5481)
* ci: whitelist needed endpoints and block access to sudo (#5485)
* docs: fix typos (#5189 #5349)
* docs: mention risk of SUID binaries and also firejail-users(5) (#5288
#5290)
* docs: set vim filetype on man pages for syntax highlighting (#5296)
* docs: note that blacklist/whitelist follow symlinks (#5344)
* docs: Add IRC channel info to README.md (#5361)
* docs: man: Note that some commands can be disabled in firejail.config
(#5366)
* docs: Add gist note to bug_report.md (#5398)
* docs: clarify that --appimage should appear before --profile (#5402 #5451)
* docs: add more Firefox examples to the firejail-local AppArmor profile
(#5493)
* docs: Fix broken Restrict-DBus wiki link on profile.template (#5554)
* docs: Remove invalid --profile-path from --help (#5585 #5586)
* new profiles: gdu, makedeb, gtk-lbry-viewer, lbry-viewer, tuir, chafa,
* new profiles: godot3, cinelerra-gg, tesseract, avidemux3_qt5,
* new profiles: avidemux3_cli, avidemux3_jobs_qt5, ssmtp, chatterino,
* new profiles: linuxqq, qq, electron-hardened.inc.profile,
-- netblue30 <[email protected]> Mon, 16 Jan 2023 09:00:00 -0500
firejail (0.9.70) baseline; urgency=low
* security: CVE-2022-31214 - root escalation in --join logic
Reported by Matthias Gerstner, working exploit code was provided to our
development team. In the same time frame, the problem was independently
reported by Birk Blechschmidt. Full working exploit code was also provided.
* feature: enable shell tab completion with --tab (#4936)
* feature: disable user profiles at compile time (#4990)
* feature: Allow resolution of .local names with avahi-daemon in the apparmor
profile (#5088)
* feature: always log seccomp errors (#5110)
* feature: firecfg --guide, guided user configuration (#5111)
* feature: --oom, kernel OutOfMemory-killer (#5122)
* modif: --ids feature needs to be enabled at compile time (#5155)
* modif: --nettrace only available to root user
* rework: whitelist restructuring (#4985)
* rework: firemon, speed up and lots of fixes
* bugfix: --private-cwd not expanding macros, broken hyperrogue (#4910)
* bugfix: nogroups + wrc prints confusing messages (#4930 #4933)
* bugfix: openSUSE Leap - whitelist-run-common.inc (#4954)
* bugfix: fix printing in evince (#5011)
* bugfix: gcov: fix gcov functions always declared as dummy (#5028)
* bugfix: Stop warning on safe supplementary group clean (#5114)
* build: remove ultimately unused INSTALL and RANLIB check macros (#5133)
* build: mkdeb.sh.in: pass remaining arguments to ./configure (#5154)
* ci: replace centos (EOL) with almalinux (#4912)
* ci: fix --version not printing compile-time features (#5147)
* ci: print version after install & fix apparmor support on build_apparmor
(#5148)
* docs: Refer to firejail.config in configuration files (#4916)
* docs: firejail.config: add warning about allow-tray (#4946)
* docs: mention that the protocol command accumulates (#5043)
* docs: mention inconsistent homedir bug involving --private=dir (#5052)
* docs: mention capabilities(7) on --caps (#5078)
* new profiles: onionshare, onionshare-cli, opera-developer, songrec
* new profiles: node-gyp, npx, semver, ping-hardened
* removed profiles: nvm
-- netblue30 <[email protected]> Thu, 9 Jun 2022 09:00:00 -0500
firejail (0.9.68) baseline; urgency=low
* security: on Ubuntu, the PPA is now recommended over the distro package
(see README.md) (#4748)
* security: bugfix: private-cwd leaks access to the entire filesystem
(#4780); reported by Hugo Osvaldo Barrera
* feature: remove (some) environment variables with auth-tokens (#4157)
* feature: ALLOW_TRAY condition (#4510 #4599)
* feature: add basic Firejail support to AppArmor base abstraction (#3226
#4628)
* feature: intrusion detection system (--ids-init, --ids-check)
* feature: deterministic shutdown command (--deterministic-exit-code,
--deterministic-shutdown) (#928 #3042 #4635)
* feature: noprinters command (#4607 #4827)
* feature: network monitor (--nettrace)
* feature: network locker (--netlock) (#4848)
* feature: whitelist-ro profile command (#4740)
* feature: disable pipewire with --nosound (#4855)
* feature: Unset TMP if it doesn't exist inside of sandbox (#4151)
* feature: Allow apostrophe in whitelist and blacklist (#4614)
* feature: AppImage support in --build command (#4878)
* modifs: exit code: distinguish fatal signals by adding 128 (#4533)
* modifs: firecfg.config is now installed to /etc/firejail/ (#408 #4669)
* modifs: close file descriptors greater than 2 (--keep-fd) (#4845)
* modifs: nogroups now stopped causing certain system groups to be dropped,
which are now controlled by the relevant "no" options instead (such as
nosound -> drop audio group), which fixes device access issues on systems
not using (e)logind (such as with seatd) (#4632 #4725 #4732 #4851)
* removal: --disable-whitelist at compile time
* removal: whitelist=yes/no in /etc/firejail/firejail.config
* bugfix: Fix sndio support (#4362 #4365)
* bugfix: Error mounting tmpfs (MS_REMOUNT flag not being cleared) (#4387)
* bugfix: --build clears the environment (#4460 #4467)
* bugfix: firejail hangs with net parameter (#3958 #4476)
* bugfix: Firejail does not work with a custom hosts file (#2758 #4560)
* bugfix: --tracelog and --trace override /etc/ld.so.preload (#4558 #4586)
* bugfix: PATH_MAX is undeclared on musl libc (#4578 #4579 #4583 #4606)
* bugfix: firejail symlinks are not skipped with private-bin + globs (#4626)
* bugfix: Firejail rejects empty arguments (#4395)
* bugfix: firecfg does not work with symlinks (discord.desktop) (#4235)
* bugfix: Seccomp list output goes to stdout instead of stderr (#4328)
* bugfix: private-etc does not work with symlinks (#4887)
* bugfix: Hardware key not detected on keepassxc (#4883)
* build: allow building with address sanitizer (#4594)
* build: Stop linking pthread (#4695)
* build: Configure cleanup and improvements (#4712)
* ci: add profile checks for sorting disable-programs.inc and
firecfg.config and for the required arguments in private-etc (#2739 #4643)
* ci: pin GitHub actions to SHAs and use Dependabot to update them (#4774)
* docs: Add new command checklist to CONTRIBUTING.md (#4413)
* docs: Rework bug report issue template and add both a question and a
feature request template (#4479 #4515 #4561)
* docs: fix contradictory descriptions of machine-id ("preserves" vs
"spoofs") (#4689)
* docs: Document that private-bin and private-etc always accumulate (#4078)
* new includes: whitelist-run-common.inc (#4288), disable-X11.inc (#4462)
* new includes: disable-proc.inc (#4521)
* removed includes: disable-passwordmgr.inc (#4454 #4461)
* new profiles: microsoft-edge-beta, clion-eap, lifeograph, zim
* new profiles: io.github.lainsce.Notejot, rednotebook, gallery-dl
* new profiles: yt-dlp, goldendict, goldendict, bundle, cmake
* new profiles: make, meson, pip, codium, telnet, ftp, OpenStego
* new profiles: imv, retroarch, torbrowser, CachyBrowser,
* new profiles: notable, RPCS3, wget2, raincat, conitop, 1passwd,
* new profiles: Seafile, neovim, com.github.tchx84.Flatseal
-- netblue30 <[email protected]> Sun, 6 Feb 2022 09:00:00 -0500
firejail (0.9.66) baseline; urgency=low
* deprecated --audit options, replaced by jailcheck utility
* deprecated follow-symlink-as-user from firejail.config
* new firejail.config settings: private-bin, private-etc
* new firejail.config settings: private-opt, private-srv
* new firejail.config settings: whitelist-disable-topdir
* new firejail.config settings: seccomp-filter-add
* removed kcmp syscall from seccomp default filter
* rename --noautopulse to keep-config-pulse
* filtering environment variables
* zsh completion
* command line: --mkdir, --mkfile
* --protocol now accumulates
* Jolla/SailfishOS patches
* private-lib rework
* whitelist rework
* jailtest utility for testing running sandboxes
* capabilities list update
* faccessat2 syscall support
* --private-dev keeps /dev/input
* added --noinput to disable /dev/input
* add support for subdirs in --private-etc
* compile time: --enable-force-nonewprivs
* compile time: --disable-output
* compile time: --enable-lts
* subdirs support in private-etc
* input devices support in private-dev, --no-input
* support trailing comments on profile lines
* new profiles: vmware-view, display-im6.q16, ipcalc, ipcalc-ng
* ebook-convert, ebook-edit, ebook-meta, ebook-polish, lzop,
* avidemux, calligragemini, vmware-player, vmware-workstation
* gget, com.github.phase1geo.minder, nextcloud-desktop, pcsxr
* PPSSPPSDL, openmw, openmw-launcher, jami-gnome, PCSX2, sum
* bcompare, b2sum, cksum, md5sum, sha1sum, sha224sum, sha256sum
* sha384sum, sha512sum, librewold-nightly, Quodlibet, tmux, sway
* alienarena, alienarena-wrapper, ballbuster, ballbuster-wrapper,
* colorful, colorful-wrapper, gl-117, gl-117-wrapper, glaxium,
* glaxium-wrapper, pinball, pinball-wrapper, etr-wrapper, firedragon
* neverball-wrapper, neverputt-wrapper, supertuxkart-wrapper, neochat,
* cargo, LibreCAD, blobby, funnyboat, pipe-viewer, gtk-pipe-viewer
* links2, xlinks2, googler, ddgr, tin
-- netblue30 <[email protected]> Mon, 28 Jun 2021 09:00:00 -0500
firejail (0.9.64.4) baseline; urgency=low
* disabled overlayfs, pending multiple fixes (CVE-2021-26910)
-- netblue30 <[email protected]> Sun, 7 Feb 2021 09:00:00 -0500
firejail (0.9.64.2) baseline; urgency=low
* allow --tmpfs inside $HOME for unprivileged users
* --disable-usertmpfs compile time option
* allow AF_BLUETOOTH via --protocol=bluetooth
* Setup guide for new users: contrib/firejail-welcome.sh
* implement netns in profiles
* added nolocal6.net IPv6 network filter
* new profiles: spectacle, chromium-browser-privacy, gtk-straw-viewer
* new profiles: gtk-youtube-viewer, gtk2-youtube-viewer, gtk3-youtube-viewer
* new profiles: straw-viewer, lutris, dolphin-emu, authenticator-rs, servo
* new profiles: npm, marker, yarn, lsar, unar, agetpkg, mdr, shotwell, qnapi
* new profiles: guvcview, pkglog, kdiff3, CoyIM
-- netblue30 <[email protected]> Tue, 26 Jan 2021 09:00:00 -0500
firejail (0.9.64) baseline; urgency=low
* replaced --nowrap option with --wrap in firemon
* The blocking action of seccomp filters has been changed from
killing the process to returning EPERM to the caller. To get the
previous behaviour, use --seccomp-error-action=kill or
syscall:kill syntax when constructing filters, or override in
/etc/firejail/firejail.config file.
* Fine-grained D-Bus sandboxing with xdg-dbus-proxy.
xdg-dbus-proxy must be installed, if not D-Bus access will be allowed.
With this version nodbus is deprecated, in favor of dbus-user none and
dbus-system none and will be removed in a future version.
* DHCP client support
* firecfg only fix dektop-files if started with sudo
* SELinux labeling support
* custom 32-bit seccomp filter support
* restrict ${RUNUSER} in several profiles
* blacklist shells such as bash in several profiles
* whitelist globbing
* mkdir and mkfile support for /run/user directory
* support ignore for include
* --include on the command line
* splitting up media players whitelists in whitelist-players.inc
* new condition: HAS_NOSOUND
* new profiles: gfeeds, firefox-x11, tvbrowser, rtv, clipgrab, muraster
* new profiles: gnome-passwordsafe, bibtex, gummi, latex, mupdf-x11-curl
* new profiles: pdflatex, tex, wpp, wpspdf, wps, et, multimc, mupdf-x11
* new profiles: gnome-hexgl, com.github.johnfactotum.Foliate, mupdf-gl, mutool
* new profiles: desktopeditors, impressive, planmaker18, planmaker18free
* new profiles: presentations18, presentations18free, textmaker18, teams
* new profiles: textmaker18free, xournal, gnome-screenshot, ripperX
* new profiles: sound-juicer, com.github.dahenson.agenda, gnome-pomodoro
* new profiles: gnome-todo, x2goclient, iagno, kmplayer, penguin-command
* new profiles: frogatto, gnome-mines, gnome-nibbles, lightsoff, warmux
* new profiles: ts3client_runscript.sh, ferdi, abiword, four-in-a-row
* new profiles: gnome-mahjongg, gnome-robots, gnome-sudoku, gnome-taquin
* new profiles: gnome-tetravex, blobwars, gravity-beams-and-evaporating-stars
* new profiles: hyperrogue, jumpnbump-menu, jumpnbump, magicor, mindless
* new profiles: mirrormagic, mrrescue, scorched3d-wrapper, scorchwentbonkers
* new profiles: seahorse-adventures, wordwarvi, xbill, gnome-klotski
* new profiles: swell-foop, fdns, five-or-more, steam-runtime
* new profiles: nicotine, plv, mocp, apostrophe, quadrapassel, dino-im
* new profiles: hitori, bijiben, gnote, gnubik, ZeGrapher, xonotic-sdl-wrapper
* new profiles: gapplication, openarena_ded, element-desktop, cawbird
* new profiles: freetube, strawberry, jitsi-meet-desktop
* new profiles: homebank, mattermost-desktop, newsflash, com.gitlab.newsflash
* new profiles: sushi, xfce4-screenshooter, org.gnome.NautilusPreviewer, lyx
* new profiles: minitube, nuclear, mtpaint, minecraft-launcher, gnome-calendar
* new profiles: vmware, git-cola, otter-browser, kazam, menulibre, musictube
* new profiles: onboard, fractal, mirage, quaternion, spectral, man, psi
* new profiles: smuxi-frontend-gnome, balsa, kube, trojita, youtube
* new profiles: youtubemusic-nativefier, cola, dbus-send, notify-send
* new profiles: qrencode, ytmdesktop, twitch
* new profiles: xournalpp, chromium-freeworld, equalx
-- netblue30 <[email protected]> Wed, 21 Oct 2020 08:00:00 -0500
firejail (0.9.62) baseline; urgency=low
* added file-copy-limit in /etc/firejail/firejail.config
* profile templates (/usr/share/doc/firejail)
* allow-debuggers support in profiles
* several seccomp enhancements
* compiler flags autodetection
* move chroot entirely from path based to file descriptor based mounts
* whitelisting /usr/share in a large number of profiles
* new scripts in contrib: gdb-firejail.sh and sort.py
* enhancement: whitelist /usr/share in some profiles
* added signal mediation to apparmor profile
* new conditions: HAS_X11, HAS_NET
* new profiles: qgis, klatexformula, klatexformula_cmdl, links, xlinks
* new profiles: pandoc, teams-for-linux, OpenArena, gnome-sound-recorder
* new profiles: godot, tcpdump, tshark, newsbeuter, keepassxc-cli
* new profiles: keepassxc-proxy, rhythmbox-client, jerry, zeal, mpg123
* new profiles: conplay, mpg123.bin, mpg123-alsa, mpg123-id3dump, out123
* new profiles: mpg123-jack, mpg123-nas, mpg123-openal, mpg123-oss
* new profiles: mpg123-portaudio, mpg123-pulse, mpg123-strip, pavucontrol-qt
* new profiles: gnome-characters, gnome-character-map, rsync, Whalebird,
* new profiles: tor-browser (AUR), Zulip, tb-starter-wrapper, bzcat,
* new profiles: kiwix-desktop, bzcat, zstd, pzstd, zstdcat, zstdgrep, zstdless
* new profiles: zstdmt, unzstd, i2p, ar, gnome-latex, pngquant, kalgebra
* new profiles: kalgebramobile, signal-cli, amuled, kfind, profanity
* new profiles: audio-recorder, cameramonitor, ddgtk, drawio, unf, gmpc
* new profiles: electron-mail, gist, gist-paste
-- netblue30 <[email protected]> Sat, 28 Dec 2019 08:00:00 -0500
firejail (0.9.60) baseline; urgency=low
* security bug reported by Austin Morton:
Seccomp filters are copied into /run/firejail/mnt, and are writable
within the jail. A malicious process can modify files from inside the
jail. Processes that are later joined to the jail will not have seccomp
filters applied.
* memory-deny-write-execute now also blocks memfd_create
* add private-cwd option to control working directory within jail
* blocking system D-Bus socket with --nodbus
* bringing back Centos 6 support
* drop support for flatpak/snap packages
* new profiles: crow, nyx, mypaint, celluoid, nano, transgui, mpdris2
* new profiles: sysprof, simplescreenrecorder, geekbench, xfce4-mixer
* new profiles: pavucontrol, d-feet, seahorse, secret-tool, gnome-keyring
* new profiles: regextester, hardinfo, gnome-system-log, gnome-nettool
* new profiles: netactview, redshift, devhelp, assogiate, subdownloader
* new profiles: font-manager, exfalso, gconf-editor, dconf-editor
* new profiles: sysprof-cli, seahorse-tool, secret-tool, dconf, gsettings
* new profiles: code-oss, pragha, Maelstrom, ostrichriders, bzflag
* new profiles: freeciv, lincity-ng, megaglest, openttd, crawl, crawl-tiles
* new profiles: teeworlds, torcs, tremulous, warsow, lugaru, manaplus
* new profiles: pioneer, scorched3d, widelands, freemind, kid3, kid3-qt
* new profiles: kid3-cli, nomacs, freecol, opencity, openclonk, slashem
* new profiles: vultureseye, vulturesclaw, anki, cheese, utox, mp3splt
* new profiles: oggsplt, flacsplt, gramps, newsboat, freeoffice-planmaker
* new profiles: autokey-gtk, autokey-qt, autokey-run, autokey-shell
* new profiles: freeoffice-presentations, freeoffice-textmaker, mp3wrap
* new profiles: inkview, meteo-qt, mp3splt-gtk, ktouch, yelp, cantata
-- netblue30 <[email protected]> Sun, 26 May 2019 08:00:00 -0500
firejail (0.9.58,2) baseline; urgency=low
* cgroup flag in /etc/firejail/firejail.config file
* name-change flag in /etc/firejail.config file
* --name rework
* new profiles: klavaro, vscodium
* browser profiles fixes
* various other bugfixes
-- netblue30 <[email protected]> Fri, 8 Feb 2019 08:00:00 -0500
firejail (0.9.58) baseline; urgency=low
* --disable-mnt rework
* --net.print command
* GitLab CI/CD integration: disto specific builds
* profile parser enhancements and conditional handling support
for HAS_APPIMAGE, HAS_NODBUS, BROWSER_DISABLE_U2F
* profile name support
* added explicit nonewprivs support to join option
* new profiles: QMediathekView, aria2c, Authenticator, checkbashisms
* new profiles: devilspie, devilspie2, easystroke, github-desktop, min
* new profiles: bsdcat, bsdcpio, bsdtar, lzmadec, lbunzip2, lbzcat
* new profiles: lbzip2, lzcat, lzcmp, lzdiff, lzegrep, lzfgrep, lzgrep
* new profiles: lzless, lzma, lzmainfo, lzmore, unlzma, unxz, xzcat
* new profiles: xzcmp, xzdiff, xzegrep, xzfgrep, xzgrep, xzless, xzmore
* new profiles: lzip, artha, nitroshare, nitroshare-cli, nitroshare-nmh
* new profiles: nirtoshare-send, nitroshare-ui, mencoder, gnome-pie
* new profiles: masterpdfeditor, QOwnNotes, aisleriot, Mendeley
* new profiles: feedreader, ocenaudio, mpsyt, thunderbird-wayland
* new profiles: supertuxkart, ghostwriter, gajim-history-manager
* bugfixes
-- netblue30 <[email protected]> Sat, 26 Jan 2019 08:00:00 -0500
firejail (0.9.56) baseline; urgency=low
* modif: removed CFG_CHROOT_DESKTOP configuration option
* modif: removed compile time --enable-network=restricted
* modif: removed compile time --disable-bind
* modif: --net=none allowed even if networking was disabled at compile
time or at run time
* modif: allow system users to run the sandbox
* support wireless devices in --net option
* support tap devices in --net option (tunneling support)
* allow IP address configuration if the parent interface specified
by --net is not configured (--netmask)
* support for firetunnel utility
* disable U2F devices (--nou2f)
* add --private-cache to support private ~/.cache
* support full paths in private-lib
* globbing support in private-lib
* support for local user directories in firecfg (--bindir)
* new profiles: ms-excel, ms-office, ms-onenote, ms-outlook, ms-powerpoint,
* new profiles: ms-skype, ms-word, riot-desktop, gnome-mpv, snox, gradio,
* new profiles: standardnotes-desktop, shellcheck, patch, flameshot,
* new profiles: rview, rvim, vimcat, vimdiff, vimpager, vimtutor, xxd,
* new profiles: Beaker, electrum, clamtk, pybitmessage, dig, whois,
* new profiles: jdownloader, Fluxbox, Blackbox, Awesome, i3
* new profiles: start-tor-browser.desktop
-- netblue30 <[email protected]> Tue, 18 Sep 2018 08:00:00 -0500
firejail (0.9.54) baseline; urgency=low
* modif: --force removed
* modif: --csh, --zsh removed
* modif: --debug-check-filename removed
* modif: --git-install and --git-uninstall removed
* modif: support for private-bin, private-lib and shell none has been
disabled while running AppImage archives in order to be able to use
our regular profile files with AppImages.
* modif: restrictions for /proc, /sys and /run/user directories
are moved from AppArmor profile into firejail executable
* modif: unifying Chromium and Firefox browsers profiles.
All users of Firefox-based browsers who use addons and plugins
that read/write from ${HOME} will need to uncomment the includes for
firefox-common-addons.inc in firefox-common.profile.
* modif: split disable-devel.inc into disable-devel and
disable-interpreters.inc
* Firejail user access database (/etc/firejail/firejail.users,
man firejail-users)
* add --noautopulse to disable automatic ~/.config/pulse (for complex setups)
* Spectre mitigation patch for gcc and clang compiler
* D-Bus handling (--nodbus)
* AppArmor support for overlayfs and chroot sandboxes
* AppArmor support for AppImages
* Enable AppArmor by default for a large number of programs
* firejail --apparmor.print option
* firemon --apparmor option
* apparmor yes/no flag in /etc/firejail/firejail.config
* seccomp syscall list update for glibc 2.26-10
* seccomp disassembler for --seccomp.print option
* seccomp machine code optimizer for default seccomp filters
* IPv6 DNS support
* whitelist support for overlay and chroot sandboxes
* private-dev support for overlay and chroot sandboxes
* private-tmp support for overlay and chroot sandboxes
* added sandbox name support in firemon
* firemon/prctl enhancements
* noblacklist support for /sys/module directory
* whitelist support for /sys/module directory
* new profiles: basilisk, Tor Browser language packs, PlayOnLinux, sylpheed,
* new profiles: discord-canary, pycharm-community, pycharm-professional,
* new profiles: pdfchain, tilp, vivaldi-snapshot, bitcoin-qt, kaffeine,
* new profiles: falkon, gnome-builder, asunder, VS Code, gnome-recipes,
* new profiles: akonadi_controle, evince-previewer, evince-thumbnailer,
* new profiles: blender-2.8, thunderbird-beta, ncdu, gnome-logs, gcloud,
* new profiles: musixmatch, gunzip, bunzip2, enchant-lsmod, enchant-lsmod-2,
* new profiles: enchant, enchant-2, Discord, acat, adiff, als, apack,
* new profiles: arepack, aunpack profiles, ppsspp, scallion, clion,
* new profiles: baloo_filemetadata_temp_extractor, AnyDesk, webstorm, xmind,
* new profiles: qmmp, sayonara
-- netblue30 <[email protected]> Wed, 16 May 2018 08:00:00 -0500
firejail (0.9.52) baseline; urgency=low
* modif: --allow-private-blacklists was deprecated; blacklisting,
read-only, read-write, tmpfs and noexec are allowed in
private home directories
* modif: remount-proc-sys deprecated from firejail.config
* modif: follow-symlink-private-bin deprecated from firejail.config
* modif: --profile-path was deprecated
* enhancement: support Firejail user config directory in firecfg
* enhancement: disable DBus activation in firecfg
* enhancement; enumerate root directories in apparmor profile
* enhancement: /etc and /usr/share whitelisting support
* enhancement: globbing support for --private-bin
* feature: systemd-resolved integration
* feature: whitelisting /var directory in most profiles
* feature: GTK2, GTK3 and Qt4 private-lib support
* feature: --debug-private-lib
* feature: test deployment of private-lib for the following
applications: evince, galculator, gnome-calculator,
leafpad, mousepad, transmission-gtk, xcalc, xmr-stak-cpu,
atril, mate-color-select, tar, file, strings, gpicview,
eom, eog, gedit, pluma
* feature: --writable-run-user
* feature: --rlimit-as
* feature: --rlimit-cpu
* feature: --timeout
* feature: profile build tool (--build)
* feature: --netfilter.print
* feature: --netfilter6.print
* feature: netfilter template support
* new profiles: upstreamed many profiles from the following sources:
https://github.com/chiraag-nataraj/firejail-profiles,
https://github.com/nyancat18/fe,
https://aur.archlinux.org/packages/firejail-profiles.
* new profiles: terasology, surf, rocketchat, clamscan, clamdscan,
clamdtop, freshclam, xmr-stak-cpu, amule, ardour4, ardour5,
brackets, calligra, calligraauthor, calligraconverter, calligraflow,
calligraplan, calligraplanwork, calligrasheets, calligrastage,
calligrawords, cin, dooble, dooble-qt4, fetchmail, freecad, freecadcmd,
google-earth,imagej, karbon, kdenlive, krita, linphone, lmms, macrofusion,
mpd, natron, Natron, ricochet, shotcut, teamspeak3, tor, tor-browser-en,
Viber, x-terminal-emulator, zart, conky, arch-audit, ffmpeg, bluefish,
cinelerra, openshot-qt, pinta, uefitool, aosp, pdfmod, gnome-ring,
xcalc, zaproxy, kopete, cliqz, signal-desktop, kget, nheko, Enpass,
kwin_x11, krunner, ping, bsdtar, makepkg (Arch), archaudit-report
cower (Arch), kdeinit4
-- netblue30 <[email protected]> Thu, 7 Dec 2017 08:00:00 -0500
firejail (0.9.50) baseline; urgency=low
* modif: --output split in two commands, --output and --output-stderr
* feature: per-profile disable-mnt (--disable-mnt)
* feature: per-profile support to set X11 Xephyr screen size (--xephyr-screen)
* feature: private /lib directory (--private-lib)
* feature: disable CDROM/DVD drive (--nodvd)
* feature: disable DVB devices (--notv)
* feature: --profile.print
* enhancement: print all seccomp filters under --debug
* enhancement: /proc/sys mounting
* enhancement: rework IP address assignment for --net options
* enhancement: support for newer Xpra versions (2.1+) -
set xpra-attach yes in /etc/firejail/firejail.config
* enhancement: all profiles use a standard layout style
* enhancement: create /usr/local for firecfg if the directory doesn't exist
* enhancement: allow full paths in --private-bin
* seccomp feature: --memory-deny-write-execute
* seccomp feature: seccomp post-exec
* seccomp feature: block secondary architecture (--seccomp.block_secondary)
* seccomp feature: seccomp syscall groups
* seccomp enhancement: print all seccomp filters under --debug
* seccomp enhancement: default seccomp list update
* new profiles: curl, mplayer2, SMPlayer, Calibre, ebook-viewer, KWrite,
* new profiles: Geary, Liferea, peek, silentarmy, IntelliJ IDEA,
* new profiles: Android Studio, electron, riot-web, Extreme Tux Racer,
* new profiles: Frozen Bubble, Open Invaders, Pingus, Simutrans, SuperTux
* new profiles: telegram-desktop, arm, rambox, apktool, baobab, dex2jar, gitg,
* new profiles: hashcat, obs, picard, remmina, sdat2img, soundconverter
* new profiles: truecraft, gnome-twitch, tuxguitar, musescore, neverball
* new profiles: sqlitebrowse, Yandex Browser, minetest
* bugfixes
-- netblue30 <[email protected]> Sat, 30 Sep 2017 08:00:00 -0500
firejail (0.9.50~rc1) baseline; urgency=low
* release pending!
* modif: --output split in two commands, --output and --output-stderr
* feature: per-profile disable-mnt (--disable-mnt)
* feature: per-profile support to set X11 Xephyr screen size (--xephyr-screen)
* feature: private /lib directory (--private-lib)
* feature: disable CDROM/DVD drive (--nodvd)
* feature: disable DVB devices (--notv)
* feature: --profile.print
* enhancement: print all seccomp filters under --debug
* enhancement: /proc/sys mounting
* enhancement: rework IP address assignment for --net options
* enhancement: support for newer Xpra versions (2.1+) -
set xpra-attach yes in /etc/firejail/firejail.config
* enhancement: all profiles use a standard layout style
* enhancement: create /usr/local for firecfg if the directory doesn't exist
* enhancement: allow full paths in --private-bin
* seccomp feature: --memory-deny-write-execute
* seccomp feature: seccomp post-exec
* seccomp feature: block secondary architecture (--seccomp.block_secondary)
* seccomp feature: seccomp syscall groups
* seccomp enhancement: print all seccomp filters under --debug
* seccomp enhancement: default seccomp list update
* new profiles: curl, mplayer2, SMPlayer, Calibre, ebook-viewer, KWrite,
* new profiles: Geary, Liferea, peek, silentarmy, IntelliJ IDEA,
* new profiles: Android Studio, electron, riot-web, Extreme Tux Racer,
* new profiles: Frozen Bubble, Open Invaders, Pingus, Simutrans, SuperTux
* new profiles: telegram-desktop, arm, rambox, apktool, baobab, dex2jar, gitg,
* new profiles: hashcat, obs, picard, remmina, sdat2img, soundconverter
* new profiles: truecraft, gnome-twitch, tuxguitar, musescore, neverball
* new profiles: sqlitebrowse, Yandex Browser, minetest
* bugfixes
-- netblue30 <[email protected]> Mon, 12 Jun 2017 20:00:00 -0500
firejail (0.9.48) baseline; urgency=low
* modifs: whitelisted Transmission, Deluge, qBitTorrent, KTorrent;
please use ~/Downloads directory for saving files
* modifs: AppArmor made optional; a warning is printed on the screen
if the sandbox fails to load the AppArmor profile
* feature: --novideo
* feature: drop discretionary access control capabilities for
root sandboxes
* feature: added /etc/firejail/globals.local for global customizations
* feature: profile support in overlayfs mode
* new profiles: vym, darktable, Waterfox, digiKam, Catfish, HandBrake
* bugfixes
-- netblue30 <[email protected]> Mon, 12 Jun 2017 08:00:00 -0500
firejail (0.9.46) baseline; urgency=low
* security: split most of networking code in a separate executable
* security: split seccomp filter code configuration in a separate executable
* security: split file copying in private option in a separate executable
* feature: disable gnupg and systemd directories under /run/user
* feature: test coverage (gcov) support
* feature: allow root user access to /dev/shm (--noblacklist=/dev/shm)
* feature: private /opt directory (--private-opt, profile support)
* feature: private /srv directory (--private-srv, profile support)
* feature: spoof machine-id (--machine-id, profile support)
* feature: allow blacklists under --private (--allow-private-blacklist,
profile support)
* feature: user-defined /etc/hosts file (--hosts-file, profile support)
* feature: support for the real /var/log directory (--writable-var-log,
profile support)
* feature: config support for firejail prompt in terminals
* feature: AppImage type 2 support
* feature: pass command line arguments to appimages
* feature: allow non-seccomp setup for OverlayFS sandboxes - more work to come
* feature: added a number of Python scripts for handling sandboxes
* feature: allow local customization using .local files under /etc/firejail
* feature: follow-symlink-as-user runtime config option in
/etc/firejail/firejail.config
* feature: follow-symlink-private-bin option in /etc/firejail/firejail.config
* feature: xvfb X11 server support (--x11=xvfb)
* feature: allow /tmp directory in mkdir and mkfile profile commands
* feature: implemented --noblacklist command, profile support
* feature: config support to disable access to /mnt and /media (disable-mnt)
* feature: config support to disable join (join)
* feature: disabled Go, Rust, and OpenSSL in disable-devel.conf
* feature: support overlay, overlay-named and overlay-tmpfs in profile files
* feature: allow PulseAudio sockets in --private-tmp
* feature: --fix-sound support in firecfg
* feature: added support for sandboxing Xpra, Xvfb and Xephyr in
independent sandboxes when started with firejail --x11
* feature: enable automatic X server sandboxing for --x11=xpra
and --x11=xephyr
* feature: support for Xpra extra params in firejail config file
* new profiles: xiphos, Tor Browser Bundle, display (imagemagick), Wire,
* new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma,
* new profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator,
* new profiles: Gnome Contacts, JD-GUI, Lollypop, MultiMC5, PDFSam, Pithos,
* new profiles: Xonotic, wireshark, keepassx2, QupZilla, FossaMail,
* new profiles: Uzbl browser, iridium browser, Thunar, Geeqie, Engrampa,
* new profiles: Scribus, mousepad, gpicview, keepassxc, cvlc, MediathekView,
* new profiles: baloo_file, Nylas, dino, BibleTime, viewnior, Kodi, viking,
* new profiles: youtube-dl, meld, Arduino, Akregator, KCalc, KTorrent,
* new profiles: Orage Globaltime, Orage Clendar, xfce4-notes, xfce4-dict,
* new profiles: Ristretto, PCManFM, Dia, FontForge, Geany, Hugin,
* new profiles: mate-calc, mate-dictionary, mate-color-select, caja,
* new profiles: galculator, Nemo, gnome-font-viewer, gucharmap, knotes
* new profiles: clipit, leafpad, lximage-qt, lxmusic, qlipper, Xvfb, Xephyr
* new profiles: Blender, 2048-qt
* bugfixes
-- netblue30 <[email protected]> Sun, 14 May 2017 08:00:00 -0500
firejail (0.9.44.10) baseline; urgency=low
* security: when using --x11=xorg and --net, incorrect processing of
the return code of /usr/bin/xauth could end up in starting the
sandbox without X11 security extension installed. Problem found/fixed
by Zack Weinberg
* bugfix: ~/.pki directory whitelisted and later blacklisted. This affects
most browsers, and disables the custom certificates installed by the user
* bugfix: firecfg config fix
* bugfix: gajim security profile fix
* bugfix: man page fix
* bugfix: force-nonewprivs fix for /etc/firejail/firejail.config
* bugfix: xephyr-extra-params fix for /etc/firejail/firejail.config
* bugfix: memory corruption in noblacklist processing
* bugfix: --quiet fix for Arch and Fedora systems
* bugfix: updated Keepass(x) profiles
* bugfix: firemon --nowrap problem
* bugfix: document firemon --nowrap in man page and in --help option
* bugfix: bash completion for --noblacklist command
* bugfix: vlc profile fix
* bugfix: fixed handling of .local profile files when the software is
installed in ~/.local directory
* bugfix: temporarily remove private-tmp from all profiles, until a fix for
.Xauthority file handling in KDE becomes available
* maintenance: --output cleanup
* maintenance: updated copyright statement in all files
-- netblue30 <[email protected]> Sat, 18 Mar 2017 10:00:00 -0500
firejail (0.9.44.8) baseline; urgency=low
* bugfix: fix broken PulseAudio support
-- netblue30 <[email protected]> Wed, 18 Jan 2017 10:00:00 -0500
firejail (0.9.44.6) baseline; urgency=low
* security: new fix for CVE-2017-5180 reported by Sebastian Krahmer last week,
new CVE code assigned after release: CVE-2017-5940
* security: major cleanup of file copying code
* security: tightening the rules for --chroot and --overlay features
* bugfix: ported Gentoo compile patch
* bugfix: Nvidia drivers bug in --private-dev
* bugfix: fix ASSERT_PERMS_FD macro
* feature: allow local customization using .local files under /etc/firejail
backported from our development branch
* feature: spoof machine-id backported from our development branch
-- netblue30 <[email protected]> Sun, 15 Jan 2017 10:00:00 -0500
firejail (0.9.44.4) baseline; urgency=low
* security: --bandwidth root shell found by Martin Carpenter (CVE-2017-5207)
* security: disabled --allow-debuggers when running on kernel
versions prior to 4.8; a kernel bug in ptrace system call
allows a full bypass of seccomp filter; problem reported by Lizzie Dixon
(CVE-2017-5206)
* security: root exploit found by Sebastian Krahmer (CVE-2017-5180)
-- netblue30 <[email protected]> Sat, 7 Jan 2017 10:00:00 -0500
firejail (0.9.44.2) baseline; urgency=low
* security: overwrite /etc/resolv.conf found by Martin Carpenter (CVE-2016-10118)
* security: TOCTOU exploit for --get and --put found by Daniel Hodson
* security: invalid environment exploit found by Martin Carpenter (CVE-2016-10122)
* security: several security enhancements
* bugfix: crashing VLC by pressing Ctrl-O
* bugfix: use user configured icons in KDE
* bugfix: mkdir and mkfile are not applied to private directories
* bugfix: cannot open files on Deluge running under KDE
* bugfix: --private=dir where dir is the user home directory
* bugfix: cannot start Vivaldi browser
* bugfix: cannot start mupdf
* bugfix: ssh profile problems
* bugfix: --quiet
* bugfix: quiet in git profile
* bugfix: memory corruption
-- netblue30 <[email protected]> Fri, 2 Dec 2016 08:00:00 -0500
firejail (0.9.44) baseline; urgency=low
* CVE-2016-9016 submitted by Aleksey Manevich
* modifs: removed man firejail-config
* modifs: --private-tmp whitelists /tmp/.X11-unix directory
* modifs: Nvidia drivers added to --private-dev
* modifs: /srv supported by --whitelist
* feature: allow user access to /sys/fs (--noblacklist=/sys/fs)
* feature: support starting/joining sandbox is a single command
(--join-or-start)
* feature: X11 detection support for --audit
* feature: assign a name to the interface connected to the bridge
(--veth-name)
* feature: all user home directories are visible (--allusers)
* feature: add files to sandbox container (--put)
* feature: blocking x11 (--x11=block)
* feature: X11 security extension (--x11=xorg)
* feature: disable 3D hardware acceleration (--no3d)
* feature: x11 xpra, x11 xephyr, x11 block, allusers, no3d profile commands
* feature: move files in sandbox (--put)
* feature: accept wildcard patterns in user name field of restricted
shell login feature
* new profiles: qpdfview, mupdf, Luminance HDR, Synfig Studio, Gimp, Inkscape
* new profiles: feh, ranger, zathura, 7z, keepass, keepassx,
* new profiles: claws-mail, mutt, git, emacs, vim, xpdf, VirtualBox, OpenShot
* new profiles: Flowblade, Eye of GNOME (eog), Evolution
* bugfixes
-- netblue30 <[email protected]> Fri, 21 Oct 2016 08:00:00 -0500
firejail (0.9.42) baseline; urgency=low
* security: --whitelist deleted files, submitted by Vasya Novikov
* security: disable x32 ABI in seccomp, submitted by Jann Horn
* security: tighten --chroot, submitted by Jann Horn
* security: terminal sandbox escape, submitted by Stephan Sokolow
* security: several TOCTOU fixes submitted by Aleksey Manevich
* modifs: bringing back --private-home option
* modifs: deprecated --user option, please use "sudo -u username firejail"
* modifs: allow symlinks in home directory for --whitelist option
* modifs: Firejail prompt is enabled by env variable FIREJAIL_PROMPT="yes"
* modifs: recursive mkdir
* modifs: include /dev/snd in --private-dev
* modifs: seccomp filter update
* modifs: release archives moved to .xz format
* feature: AppImage support (--appimage)
* feature: AppArmor support (--apparmor)
* feature: Ubuntu snap support (/etc/firejail/snap.profile)
* feature: Sandbox auditing support (--audit)
* feature: remove environment variable (--rmenv)
* feature: noexec support (--noexec)
* feature: clean local overlay storage directory (--overlay-clean)
* feature: store and reuse overlay (--overlay-named)
* feature: allow debugging inside the sandbox with gdb and strace
(--allow-debuggers)
* feature: mkfile profile command
* feature: quiet profile command
* feature: x11 profile command
* feature: option to fix desktop files (firecfg --fix)
* compile time: Busybox support (--enable-busybox-workaround)
* compile time: disable overlayfs (--disable-overlayfs)
* compile time: disable whitelisting (--disable-whitelist)
* compile time: disable global config (--disable-globalcfg)
* run time: enable/disable overlayfs (overlayfs yes/no)
* run time: enable/disable quiet as default (quiet-by-default yes/no)
* run time: user-defined network filter (netfilter-default)
* run time: enable/disable whitelisting (whitelist yes/no)
* run time: enable/disable remounting of /proc and /sys
(remount-proc-sys yes/no)
* run time: enable/disable chroot desktop features (chroot-desktop yes/no)
* profiles: Gitter, gThumb, mpv, Franz messenger, LibreOffice
* profiles: pix, audacity, xz, xzdec, gzip, cpio, less
* profiles: Atom Beta, Atom, jitsi, eom, uudeview
* profiles: tar (gtar), unzip, unrar, file, skypeforlinux,
* profiles: inox, Slack, gnome-chess. Gajim IM client, DOSBox
* bugfixes
-- netblue30 <[email protected]> Thu, 8 Sept 2016 08:00:00 -0500
firejail (0.9.40) baseline; urgency=low
* added --nice option
* added --x11 option
* added --x11=xpra option
* added --x11=xephyr option
* added --cpu.print option
* added filetransfer options --ls and --get
* added --writable-etc and --writable-var options
* added --read-only option
* added mkdir, ipc-namespace, and nosound profile commands
* added net, ip, defaultgw, ip6, mac, mtu and iprange profile commands
* --version also prints compile options
* --output option also redirects stderr
* added compile-time option to restrict --net= to root only
* run time config support, man firejail-config
* added firecfg utility
* AppArmor fixes
* default seccomp filter update