New profile: Quodlibet #3983

Bundy01 · 2021-02-13T15:17:26Z

No description provided.

rusty-snake

Looks good so far, some nitpicks and future hardening suggestion below.

It should also be added to firecfg.config so that firecfg creates symlinks for it.

rusty-snake · 2021-02-13T15:19:02Z

etc/profile-m-z/quodlibet.profile

+noblacklist ${HOME}/.cache/quodlibet
+noblacklist ${HOME}/.config/quodlibet
+noblacklist ${HOME}/.quodlibet


Add blacklists in disable-programs.inc

etc/profile-m-z/quodlibet.profile

Bundy01 · 2021-02-13T17:31:43Z

add read-only ${HOME} ?
I don't know.

Breaks pulseaudio, remove.
What should I remove, because on my side it's functional.

Does it need D-Bus access or can be add dbus-user none?
Quodlibet needs to communicate with my DE (Cinnamon).

etc/profile-m-z/quodlibet.profile

Bundy01 · 2021-02-13T19:34:07Z

Sorry, I don't know how to use sort.py :(

rusty-snake · 2021-02-13T19:40:03Z

python3 /path/to/sort.py /path/to/quodlibet.profile

However this gave me the idea to print the fixed lines when running in the check in GitHub Actions, so everyone can just copy it from there if they can't use it for any reasons. PR will come.

Bundy01 · 2021-02-13T19:51:54Z

python3 /path/to/sort.py /path/to/quodlibet.profile

Thanks.

glitsj16 · 2021-02-14T04:59:21Z

More a reminder note than anything else. We already have a profile for exfalso, which is part of the quodlibet sources IIRC. In that context it might be worthwhile to consider refactoring this (or exfalso.profile) as a redirect. If it's too much trouble in this PR, we can always look at it later.

Bundy01 · 2021-02-15T23:11:39Z

Hello,
sorry for the late response. I can try to rewrite Exfalso's profile which redirects to Quodlibet but it will take me a few days to test the changes.

glitsj16 · 2021-02-16T02:54:53Z

@Bundy01 Great! Take your time. I've been using exfalso for ages and can always test from this side to assist.

Bundy01 · 2021-02-18T16:06:50Z

I would like to add private-lib in quodlibet's profile but I'm breaking my teeth on it. Help would be welcome, otherwise I finished the profile.

glitsj16 · 2021-02-18T18:26:26Z

I would like to add private-lib in quodlibet's profile but I'm breaking my teeth on it. Help would be welcome, otherwise I finished the profile.

Can you show us what you've put together already? Sidenote: private-lib is notoriously difficult with media players. They can have a busload of extra plugins to support extra formats etcetera. IMO that's the main reason why none of our player apps like amarok, ffmpeg, mpv, mplayer, vlc, totem, ... has private-lib. So don't worry about it too much. But we can give it a try.

rusty-snake · 2021-02-18T18:31:01Z

Quodlibet is written in python. We can not add private-lib until #3236 is fixed, because it will not work for every system/distro.

Bundy01 · 2021-02-18T18:40:41Z

Ok, so much for private-lib.
Here are the profiles I modified, if it suits you I do the PR.

# Firejail profile for quodlibet
# Description: Music player and music library manager
# This file is overwritten after every install/update
# Persistent local customizations
include quodlibet.local
# Persistent global definitions
include globals.local

noblacklist ${MUSIC}

# Allow python (blacklisted by disable-interpreters.inc)
include allow-python2.inc
include allow-python3.inc

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-write-mnt.inc
include disable-xdg.inc

mkdir ${HOME}/.cache/quodlibet
mkdir ${HOME}/.config/quodlibet
mkdir ${HOME}/.quodlibet

whitelist ${MUSIC}
whitelist ${HOME}/.cache/quodlibet
whitelist ${HOME}/.config/quodlibet
whitelist ${HOME}/.quodlibet

include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
ipc-namespace
netfilter
no3d
nodvd
nogroups
nonewprivs
noroot
notv
nou2f
novideo
protocol unix,inet,inet6
seccomp
seccomp.block-secondary
shell none
tracelog

private-bin exfalso,operon,python*,quodlibet,sh
private-cache
private-dev
private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pki,pulse,resolv.conf,ssl
private-tmp

dbus-system none

#memory-deny-write-execute - breaks on Arch (see issue #1803)

# Firejail profile for exfalso
# Description: GTK audio tag editor
# This file is overwritten after every install/update
# Persistent local customizations
include exfalso.local
# Persistent global definitions
include globals.local

private-lib libatk-1.0.so.*,libgdk-3.so.*,libgdk_pixbuf-2.0.so.*,libgirepository-1.0.so.*,libgstreamer-1.0.so.*,libgtk-3.so.*,libgtksourceview-3.0.so.*,libpango-1.0.so.*,libpython*,libreadline.so.*,libsoup-2.4.so.*,libssl.so.1.*,python2*,python3*

dbus-user none

include quodlibet.profile

rusty-snake · 2021-02-18T18:54:07Z

Remove ipc-namespace, it may cause issues under X11
The mdwe note can be removed too.
We could add include allow-bin-sh.inc with include disable-shell.inc too.

etc/profile-a-l/exfalso.profile

rusty-snake · 2021-02-21T10:25:59Z

etc/profile-m-z/quodlibet.profile

+mkdir ${HOME}/.config/quodlibet
+mkdir ${HOME}/.quodlibet
+
+whitelist ${MUSIC}


Suggested change

whitelist ${MUSIC}

whitelist ${MUSIC}

whitelist ${DOWNLOADS}

I liked the idea of allowing only the MUSIC folder, but I'll make the changes.

I remarked it because exfalso had it, and without it we break something that was working w/o significant security win. Alternative we could add/keep whitelist ${DOWNLOADS} only in exfalso.

glitsj16 · 2021-02-23T00:56:01Z

etc/profile-a-l/exfalso.profile

-private-bin exfalso,python*
-private-cache
-private-dev
-private-etc alternatives,fonts,group,passwd


The private-etc that is included from quodlibet.profile does not have group and passwd. Did you test exfalso with these removed? If not we should keep this line intact.

Hi,
for private-etc, I quickly tested exfalso without any apparent problem, hence my modification. If I need to, I can add the problem line.
Is there anything else to expect because I would like it to be the last PR :)
Thanks for the answer.

rusty-snake · 2021-04-06T14:07:24Z

@Bundy01 @glitsj16 what's the state here?

Bundy01 · 2021-04-06T23:29:35Z

@rusty-snake:
On my side, it's OK.

etc/profile-m-z/quodlibet.profile

glitsj16 · 2021-04-07T02:37:53Z

etc/profile-m-z/quodlibet.profile

+mkdir ${HOME}/.quodlibet
+
+whitelist ${MUSIC}
+whitelist ${DOWNLOADS}


Put whitelist ${DOWNLOADS} above whitelist ${MUSIC} to keep things alphabetically ordered.

glitsj16

See my newly added comments.

Bundy01 · 2021-04-13T17:10:19Z

Hi,
I was not able to use sort.py with the command: python3 /path/to/sort.py /path/to/profile :(

Edit: the output of the command: sort.py: checking 1 profile...
python version: Python 3.9.2

rusty-snake

Just some blank lines.

I was not able to use sort.py with the command: python3 /path/to/sort.py /path/to/profile :(

What was the error? What shows python3 --version? However the sort.py CI is passing for your latest commit.

etc/profile-m-z/quodlibet.profile

rusty-snake · 2021-04-13T17:14:09Z

etc/profile-m-z/quodlibet.profile

+
+

Suggested change

remove both, don't know why only shows 31 in the suggestion.

@rusty-snake: Do you suggest I remove the space between mkdir and whitelist?

yes.

Do it now or I merge it anyway.

etc/profile-m-z/quodlibet.profile

glitsj16

Unblocking this so it can be merged when @rusty-snake is happy with it. We can always work out any kinks later.

rusty-snake · 2021-04-14T16:29:51Z

@glitsj16 FYI you can dismiss your review if you don't want to block a PR but also don't want to approve it.
IDK why this is hidden behind 3 clicks.

rusty-snake · 2021-04-14T16:33:14Z

merged, thanks.

glitsj16 · 2021-04-14T16:46:28Z

FYI you can dismiss your review if you don't want to block a PR but also don't want to approve it. IDK why this is hidden behind 3 clicks.

@rusty-snake Aha, I didn't see that option. Good to know, thanks for the info! Glad to see this merged, now I can start to double-check all my local overrides for exfalso. Thanks @Bundy01 for pursuing this!

rusty-snake reviewed Feb 13, 2021

View reviewed changes

etc/profile-m-z/quodlibet.profile Outdated Show resolved Hide resolved

rusty-snake reviewed Feb 13, 2021

View reviewed changes

etc/profile-m-z/quodlibet.profile Outdated Show resolved Hide resolved

Bundy01 force-pushed the master branch from 74b5f54 to 1fa57d0 Compare February 18, 2021 19:55

rusty-snake reviewed Feb 21, 2021

View reviewed changes

etc/profile-a-l/exfalso.profile Show resolved Hide resolved

rusty-snake reviewed Feb 21, 2021

View reviewed changes

etc/profile-a-l/exfalso.profile Outdated Show resolved Hide resolved

rusty-snake reviewed Feb 21, 2021

View reviewed changes

Bundy01 force-pushed the master branch from 1fa57d0 to fe471e5 Compare February 21, 2021 14:12

glitsj16 requested changes Feb 23, 2021

View reviewed changes

Bundy01 force-pushed the master branch from fe471e5 to 2a2aaf3 Compare March 3, 2021 15:36

glitsj16 reviewed Apr 7, 2021

View reviewed changes

etc/profile-m-z/quodlibet.profile Show resolved Hide resolved

glitsj16 reviewed Apr 7, 2021

View reviewed changes

glitsj16 requested changes Apr 7, 2021

View reviewed changes

New profile: Quodlibet

cd61741

Bundy01 force-pushed the master branch from 2a2aaf3 to cd61741 Compare April 13, 2021 17:03

rusty-snake reviewed Apr 13, 2021

View reviewed changes

New profile: Quodlibet

6bf269c

glitsj16 approved these changes Apr 13, 2021

View reviewed changes

rusty-snake merged commit 25c2e81 into netblue30:master Apr 14, 2021

matu3ba mentioned this pull request Oct 7, 2021

luarocks matu3ba/firejail#1

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New profile: Quodlibet #3983

New profile: Quodlibet #3983

Bundy01 commented Feb 13, 2021

rusty-snake left a comment

rusty-snake Feb 13, 2021

Bundy01 commented Feb 13, 2021

Bundy01 commented Feb 13, 2021

rusty-snake commented Feb 13, 2021

Bundy01 commented Feb 13, 2021

glitsj16 commented Feb 14, 2021 •

edited

Loading

Bundy01 commented Feb 15, 2021

glitsj16 commented Feb 16, 2021

Bundy01 commented Feb 18, 2021

glitsj16 commented Feb 18, 2021

rusty-snake commented Feb 18, 2021

Bundy01 commented Feb 18, 2021 •

edited

Loading

rusty-snake commented Feb 18, 2021

rusty-snake Feb 21, 2021

Bundy01 Feb 21, 2021

rusty-snake Feb 21, 2021

glitsj16 Feb 23, 2021

Bundy01 Feb 26, 2021

rusty-snake commented Apr 6, 2021

Bundy01 commented Apr 6, 2021

glitsj16 Apr 7, 2021

glitsj16 left a comment

Bundy01 commented Apr 13, 2021 •

edited

Loading

rusty-snake left a comment

rusty-snake Apr 13, 2021 •

edited

Loading

Bundy01 Apr 14, 2021

rusty-snake Apr 14, 2021

glitsj16 left a comment

rusty-snake commented Apr 14, 2021

rusty-snake commented Apr 14, 2021

glitsj16 commented Apr 14, 2021

New profile: Quodlibet #3983

New profile: Quodlibet #3983

Conversation

Bundy01 commented Feb 13, 2021

rusty-snake left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Bundy01 commented Feb 13, 2021

Bundy01 commented Feb 13, 2021

rusty-snake commented Feb 13, 2021

Bundy01 commented Feb 13, 2021

glitsj16 commented Feb 14, 2021 • edited Loading

Bundy01 commented Feb 15, 2021

glitsj16 commented Feb 16, 2021

Bundy01 commented Feb 18, 2021

glitsj16 commented Feb 18, 2021

rusty-snake commented Feb 18, 2021

Bundy01 commented Feb 18, 2021 • edited Loading

rusty-snake commented Feb 18, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rusty-snake commented Apr 6, 2021

Bundy01 commented Apr 6, 2021

Choose a reason for hiding this comment

glitsj16 left a comment

Choose a reason for hiding this comment

Bundy01 commented Apr 13, 2021 • edited Loading

rusty-snake left a comment

Choose a reason for hiding this comment

rusty-snake Apr 13, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

glitsj16 left a comment

Choose a reason for hiding this comment

rusty-snake commented Apr 14, 2021

rusty-snake commented Apr 14, 2021

glitsj16 commented Apr 14, 2021

glitsj16 commented Feb 14, 2021 •

edited

Loading

Bundy01 commented Feb 18, 2021 •

edited

Loading

Bundy01 commented Apr 13, 2021 •

edited

Loading

rusty-snake Apr 13, 2021 •

edited

Loading