Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add profile for luarocks #4596

Draft
wants to merge 13 commits into
base: master
Choose a base branch
from
Draft

Add profile for luarocks #4596

Changes from 1 commit
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
990ffbb
Add profile for luarocks
matu3ba Oct 7, 2021
eb7dab0
use allow-lua as its smaller.
matu3ba Oct 8, 2021
4e670d2
remove disable-write-mnt
matu3ba Oct 8, 2021
5df4c63
shortening (default-disabled) private-etc
matu3ba Oct 8, 2021
f6f0021
remove private-bin and s/allow/whitelist
matu3ba Oct 8, 2021
65242d9
add luarocks to firecfg.config
matu3ba Oct 8, 2021
4c5ca65
fix allow-lua.inc and disable-interpreters.inc
matu3ba Oct 8, 2021
161df63
add seccomp.block-secondary
matu3ba Oct 8, 2021
29ef011
update luarocks profile
matu3ba Oct 8, 2021
e610d2e
Merge branch 'luarocks' of github.com:matu3ba/firejail into luarocks
matu3ba Oct 8, 2021
f3e9ea0
update luarocks profile
matu3ba Oct 8, 2021
ce1b231
add whitelist-var-common and whitelist-run-common
matu3ba Oct 8, 2021
1d1f524
fix order
matu3ba Oct 8, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
remove private-bin and s/allow/whitelist
  • Loading branch information
@matu3ba
matu3ba committed Oct 8, 2021
commit f6f002193947ac01175768280e7aa350fe30d952
25 changes: 12 additions & 13 deletions etc/profile-a-l/luarocks.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,19 +21,19 @@ include disable-programs.inc
#include disable-shell.inc
matu3ba marked this conversation as resolved.
Show resolved Hide resolved
include disable-xdg.inc

allow ${HOME}/.netrc
allow ${HOME}/.config/pkcs11
allow ${HOME}/.wget-hsts
allow ${HOME}/.cache/luarocks
allow ${HOME}/luarocks/cmd/external
allow ${HOME}/.nix-profile/bin
allow ${HOME}/.luarocks
allow ${HOME}/.config/luarocks
whitelist ${HOME}/.netrc
whitelist ${HOME}/.config/pkcs11
whitelist ${HOME}/.wget-hsts
Copy link
Collaborator

@rusty-snake rusty-snake Oct 8, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this necessary?

edit: this line: whitelist ${HOME}/.wget-hsts

whitelist ${HOME}/.cache/luarocks
whitelist ${HOME}/luarocks/cmd/external
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing else from ~/luarocks required?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The answer to this question depends on "Needs discussion: Do we want to firecfg build-systems/package-managers by default? (related: #4519)".
To what degree does firejail want to allow invoking build systems or running stuff from a package manager (which sounds like bad security practice).

whitelist ${HOME}/.nix-profile/bin
whitelist ${HOME}/.luarocks
whitelist ${HOME}/.config/luarocks
Comment on lines +28 to +35
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing mkdir/mkfile for some of them.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing blacklist/noblacklist/read-only for some of them.

Comment on lines +28 to +35
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needs discussion: Missing wc.

Comment on lines +28 to +35
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needs discussion: Do we want to use whitelisting for package-managers/build-systems by default.


allow /usr/share/ca-certificates
allow /usr/share/p11-kit
allow /usr/share/terminfo
allow /usr/share/lua
whitelist /usr/share/ca-certificates
whitelist /usr/share/p11-kit
whitelist /usr/share/terminfo
whitelist /usr/share/lua
matu3ba marked this conversation as resolved.
Show resolved Hide resolved

# apparmor
caps.drop all
Expand All @@ -56,7 +56,6 @@ shell none
tracelog

disable-mnt
#private-bin md5sum,chmod,unzip,wget,gcc,bash,lua,luarocks
private-cache
private-dev
#private-etc alternatives,ca-certificates,crypto-policies,luarocks,pki,ssl
Expand Down