disable-shell.inc #3411
disable-shell.inc #3411
Conversation
|
Initially I wanted to add it to disable-interpreters.inc, but to many program require allow-shell.inc. I think it is better to add it as an own disable-*.inc |
👍, we should also note that |
… private-bin line without bash/sh except profiles with redirect profiles.
etc/profile-a-l/aria2c.profile
Outdated
| @@ -19,6 +19,7 @@ include disable-exec.inc | |||
| include disable-interpreters.inc | |||
| include disable-passwdmgr.inc | |||
| include disable-programs.inc | |||
| include disable-shell.inc | |||
There was a problem hiding this comment.
Aria2 supports on-download-complete=foo and we don't know what a user might put in a shell script. Perhaps we can add a comment, but the safest would be to not include disable-shell.inc here I guess. What do you think?
| @@ -16,6 +16,7 @@ include disable-exec.inc | |||
| include disable-interpreters.inc | |||
| include disable-passwdmgr.inc | |||
| include disable-programs.inc | |||
| include disable-shell.inc | |||
There was a problem hiding this comment.
More a FYI, this package has been removed from AUR a while back, due to incompatibilities with pacman. So perhaps we can drop this profile. But the include would be fine regardless.
|
@rusty-snake how does this compare to |
|
firejail will fail to start a program in a sandbox for profiles with disable-shell but w/o |
To disable-shell.inc. Interactive shells can be executed from certain development-related programs (such as IDEs) and the shells themselves are not blocked by default, but this shell startup directory currently is. To avoid running a shell without access to potentially needed startup files, only blacklist /etc/profile.d when interactive shells are also blocked. Note that /etc/profile.d should only be of concern to interactive shells, so a profile that includes both disable-shell.inc and allow-bin-sh.inc (which likely means that it needs access to only non-interactive shells) should not be affected by the blacklisting. Relates to netblue30#3411 netblue30#5159.
No description provided.