Skip to content

Commit

Permalink
More fixes for #3464
Browse files Browse the repository at this point in the history
Backporting fixes for Atom 1.48 to firejail 0.9.52, 0.9.58, and 0.9.60

Summary:
- remove nonewprivs, noroot, protocol, and seccomp
- update caps filter to keep sys_admin and sys_chroot

Without these changes Atom 1.48 breaks and refuses to start (due to
Electron sandboxing)
  • Loading branch information
Fred-Barclay committed Jun 13, 2020
1 parent cb67995 commit 5590695
Show file tree
Hide file tree
Showing 3 changed files with 104 additions and 0 deletions.
31 changes: 31 additions & 0 deletions etc-fixes/0.9.52/atom.profile
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
# Firejail profile for atom
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/atom.local
# Persistent global definitions
include /etc/firejail/globals.local

# blacklist /run/user/*/bus

noblacklist ${HOME}/.atom
noblacklist ${HOME}/.config/Atom

include /etc/firejail/disable-common.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

caps.keep sys_admin,sys_chroot
# net none
netfilter
nodvd
nogroups
nosound
notv
novideo
shell none

private-dev
private-tmp

noexec ${HOME}
noexec /tmp
36 changes: 36 additions & 0 deletions etc-fixes/0.9.58/atom.profile
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@

# Firejail profile for atom
# Description: A hackable text editor for the 21st Century
# This file is overwritten after every install/update
# Persistent local customizations
include atom.local
# Persistent global definitions
include globals.local

noblacklist ${HOME}/.atom
noblacklist ${HOME}/.config/Atom
noblacklist ${HOME}/.cargo/config
noblacklist ${HOME}/.cargo/registry

include disable-common.inc
include disable-passwdmgr.inc
include disable-programs.inc

caps.keep sys_admin,sys_chroot
# net none
netfilter
nodbus
nodvd
nogroups
nosound
notv
nou2f
novideo
shell none

private-cache
private-dev
private-tmp

noexec ${HOME}
noexec /tmp
37 changes: 37 additions & 0 deletions etc-fixes/0.9.60/atom.profile
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
# Firejail profile for atom
# Description: A hackable text editor for the 21st Century
# This file is overwritten after every install/update
# Persistent local customizations
include atom.local
# Persistent global definitions
include globals.local

noblacklist ${HOME}/.atom
noblacklist ${HOME}/.config/Atom
noblacklist ${HOME}/.config/git
noblacklist ${HOME}/.cargo/config
noblacklist ${HOME}/.cargo/registry
noblacklist ${HOME}/.gitconfig
noblacklist ${HOME}/.git-credentials
noblacklist ${HOME}/.pythonrc.py

include disable-common.inc
include disable-exec.inc
include disable-passwdmgr.inc
include disable-programs.inc

caps.keep sys_admin,sys_chroot
# net none
netfilter
nodbus
nodvd
nogroups
nosound
notv
nou2f
novideo
shell none

private-cache
private-dev
private-tmp

0 comments on commit 5590695

Please sign in to comment.