pool/firejail
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
c320ca99e4
firejail/firejail.spec

75 lines
2.1 KiB
RPMSpec
Raw Normal View History

Accepting request 397032 from home:tiwai:firejail This is a request for a new package "firejail". It's a lightweight sandbox using namespace and seccomp. Let me know if Virtualization doesn't fit as the devel project for such a program. OBS-URL: https://build.opensuse.org/request/show/397032 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=1
2016-05-24 07:12:25 +02:00
#
# spec file for package firejail
#
Accepting request 522777 from home:avindra - Update to version 0.9.50: * New features: - per-profile disable-mnt (--disable-mnt) - per-profile support to set X11 Xephyr screen size (--xephyr-screen) - private /lib directory (--private-lib) - disable CDROM/DVD drive (--nodvd) - disable DVB devices (--notv) - --profile.print * modif: --output split in two commands, --output and --output-stderr * set xpra-attach yes in /etc/firejail/firejail.config * Enhancements: - print all seccomp filters under --debug - /proc/sys mounting - rework IP address assingment for --net options - support for newer Xpra versions (2.1+) - - all profiles use a standard layout style - create /usr/local for firecfg if the directory doesn't exist - allow full paths in --private-bin * New seccomp features: - --memory-deny-write-execute - seccomp post-exec - block secondary architecture (--seccomp.block_secondary) - seccomp syscall groups - print all seccomp filters under --debug - default seccomp list update * new profiles: curl, mplayer2, SMPlayer, Calibre, ebook-viewer, KWrite, Geary, Liferea, peek, silentarmy, IntelliJ IDEA, Android Studio, electron, riot-web, Extreme Tux Racer, Frozen Bubble, Open Invaders, Pingus, Simutrans, SuperTux telegram-desktop, arm, rambox, apktool, baobab, dex2jar, gitg, hashcat, obs, picard, remmina, sdat2img, soundconverter truecraft, gnome-twitch, tuxguitar, musescore, neverball sqlitebrowse, Yandex Browser, minetest OBS-URL: https://build.opensuse.org/request/show/522777 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=8
2017-09-13 11:08:57 +02:00
# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
Accepting request 397032 from home:tiwai:firejail This is a request for a new package "firejail". It's a lightweight sandbox using namespace and seccomp. Let me know if Virtualization doesn't fit as the devel project for such a program. OBS-URL: https://build.opensuse.org/request/show/397032 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=1
2016-05-24 07:12:25 +02:00
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
#
Name: firejail
Accepting request 522777 from home:avindra - Update to version 0.9.50: * New features: - per-profile disable-mnt (--disable-mnt) - per-profile support to set X11 Xephyr screen size (--xephyr-screen) - private /lib directory (--private-lib) - disable CDROM/DVD drive (--nodvd) - disable DVB devices (--notv) - --profile.print * modif: --output split in two commands, --output and --output-stderr * set xpra-attach yes in /etc/firejail/firejail.config * Enhancements: - print all seccomp filters under --debug - /proc/sys mounting - rework IP address assingment for --net options - support for newer Xpra versions (2.1+) - - all profiles use a standard layout style - create /usr/local for firecfg if the directory doesn't exist - allow full paths in --private-bin * New seccomp features: - --memory-deny-write-execute - seccomp post-exec - block secondary architecture (--seccomp.block_secondary) - seccomp syscall groups - print all seccomp filters under --debug - default seccomp list update * new profiles: curl, mplayer2, SMPlayer, Calibre, ebook-viewer, KWrite, Geary, Liferea, peek, silentarmy, IntelliJ IDEA, Android Studio, electron, riot-web, Extreme Tux Racer, Frozen Bubble, Open Invaders, Pingus, Simutrans, SuperTux telegram-desktop, arm, rambox, apktool, baobab, dex2jar, gitg, hashcat, obs, picard, remmina, sdat2img, soundconverter truecraft, gnome-twitch, tuxguitar, musescore, neverball sqlitebrowse, Yandex Browser, minetest OBS-URL: https://build.opensuse.org/request/show/522777 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=8
2017-09-13 11:08:57 +02:00
Version: 0.9.50
Accepting request 397032 from home:tiwai:firejail This is a request for a new package "firejail". It's a lightweight sandbox using namespace and seccomp. Let me know if Virtualization doesn't fit as the devel project for such a program. OBS-URL: https://build.opensuse.org/request/show/397032 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=1
2016-05-24 07:12:25 +02:00
Release: 0
Summary: Linux namepaces sandbox program
License: GPL-2.0
Group: Productivity/Security
Accepting request 400690 from home:tiwai:branches:Virtualization - Update to version 0.9.40: * Added firecfg utility * New options: -nice, -cpu.print, -writable-etc, -writable-var, -read-only * X11 support: -x11 option (-x11=xpra, -x11=xephr) * Filetransfer options: –ls and –get * Added mkdir, ipc-namespace, and nosound profile commands * added net, ip, defaultgw, ip6, mac, mtu and iprange profile commands * Run time config support, man firejail-config * AppArmor fixes * Default seccomp filter update * Disable STUN/WebRTC in default netfilter configuration * Lots of new profiles OBS-URL: https://build.opensuse.org/request/show/400690 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=2
2016-06-08 19:13:02 +02:00
Url: https://firejail.wordpress.com/
Accepting request 431498 from home:tiwai:branches:Virtualization - Update to version 0.9.42: Security fixes: * –whitelist deleted files * disable x32 ABI in seccomp * tighten –chroot * terminal sandbox escape * several TOCTOU fixes Behavior changes: * bringing back –private-home option * deprecated –user option, please use “sudo -u username firejail” * allow symlinks in home directory for –whitelist option * Firejail prompt is enabled by env variable FIREJAIL_PROMPT=”yes” * recursive mkdir * include /dev/snd in –private-dev * seccomp filter update * release archives moved to .xz format New features: * AppImage support (–appimage) * AppArmor support (–apparmor) * Ubuntu snap support (/etc/firejail/snap.profile) * Sandbox auditing support (–audit) * remove environment variable (–rmenv) * noexec support (–noexec) * clean local overlay storage directory (–overlay-clean) * store and reuse overlay (–overlay-named) * allow debugging inside the sandbox with gdb and strace (–allow-debuggers) * mkfile profile command * quiet profile command * x11 profile command * option to fix desktop files (firecfg –fix) OBS-URL: https://build.opensuse.org/request/show/431498 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=3
2016-10-13 10:58:49 +02:00
Source0: %{name}-%{version}.tar.xz
Accepting request 397032 from home:tiwai:firejail This is a request for a new package "firejail". It's a lightweight sandbox using namespace and seccomp. Let me know if Virtualization doesn't fit as the devel project for such a program. OBS-URL: https://build.opensuse.org/request/show/397032 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=1
2016-05-24 07:12:25 +02:00
Source1: %{name}.rpmlintrc
BuildRequires: gcc-c++
Accepting request 522777 from home:avindra - Update to version 0.9.50: * New features: - per-profile disable-mnt (--disable-mnt) - per-profile support to set X11 Xephyr screen size (--xephyr-screen) - private /lib directory (--private-lib) - disable CDROM/DVD drive (--nodvd) - disable DVB devices (--notv) - --profile.print * modif: --output split in two commands, --output and --output-stderr * set xpra-attach yes in /etc/firejail/firejail.config * Enhancements: - print all seccomp filters under --debug - /proc/sys mounting - rework IP address assingment for --net options - support for newer Xpra versions (2.1+) - - all profiles use a standard layout style - create /usr/local for firecfg if the directory doesn't exist - allow full paths in --private-bin * New seccomp features: - --memory-deny-write-execute - seccomp post-exec - block secondary architecture (--seccomp.block_secondary) - seccomp syscall groups - print all seccomp filters under --debug - default seccomp list update * new profiles: curl, mplayer2, SMPlayer, Calibre, ebook-viewer, KWrite, Geary, Liferea, peek, silentarmy, IntelliJ IDEA, Android Studio, electron, riot-web, Extreme Tux Racer, Frozen Bubble, Open Invaders, Pingus, Simutrans, SuperTux telegram-desktop, arm, rambox, apktool, baobab, dex2jar, gitg, hashcat, obs, picard, remmina, sdat2img, soundconverter truecraft, gnome-twitch, tuxguitar, musescore, neverball sqlitebrowse, Yandex Browser, minetest OBS-URL: https://build.opensuse.org/request/show/522777 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=8
2017-09-13 11:08:57 +02:00
BuildRequires: libapparmor-devel
Accepting request 397032 from home:tiwai:firejail This is a request for a new package "firejail". It's a lightweight sandbox using namespace and seccomp. Let me know if Virtualization doesn't fit as the devel project for such a program. OBS-URL: https://build.opensuse.org/request/show/397032 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=1
2016-05-24 07:12:25 +02:00
Requires(pre): permissions
%description
Firejail is a SUID sandbox program that reduces the risk of security
breaches by restricting the running environment of untrusted applications
using Linux namespaces and seccomp-bpf. It includes sandbox profiles for
many existing applications like Iceweasel/Mozilla Firefox and Chromium.
Accepting request 522777 from home:avindra - Update to version 0.9.50: * New features: - per-profile disable-mnt (--disable-mnt) - per-profile support to set X11 Xephyr screen size (--xephyr-screen) - private /lib directory (--private-lib) - disable CDROM/DVD drive (--nodvd) - disable DVB devices (--notv) - --profile.print * modif: --output split in two commands, --output and --output-stderr * set xpra-attach yes in /etc/firejail/firejail.config * Enhancements: - print all seccomp filters under --debug - /proc/sys mounting - rework IP address assingment for --net options - support for newer Xpra versions (2.1+) - - all profiles use a standard layout style - create /usr/local for firecfg if the directory doesn't exist - allow full paths in --private-bin * New seccomp features: - --memory-deny-write-execute - seccomp post-exec - block secondary architecture (--seccomp.block_secondary) - seccomp syscall groups - print all seccomp filters under --debug - default seccomp list update * new profiles: curl, mplayer2, SMPlayer, Calibre, ebook-viewer, KWrite, Geary, Liferea, peek, silentarmy, IntelliJ IDEA, Android Studio, electron, riot-web, Extreme Tux Racer, Frozen Bubble, Open Invaders, Pingus, Simutrans, SuperTux telegram-desktop, arm, rambox, apktool, baobab, dex2jar, gitg, hashcat, obs, picard, remmina, sdat2img, soundconverter truecraft, gnome-twitch, tuxguitar, musescore, neverball sqlitebrowse, Yandex Browser, minetest OBS-URL: https://build.opensuse.org/request/show/522777 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=8
2017-09-13 11:08:57 +02:00
Firejail also expands the restricted shell facility found in bash by adding
Accepting request 397032 from home:tiwai:firejail This is a request for a new package "firejail". It's a lightweight sandbox using namespace and seccomp. Let me know if Virtualization doesn't fit as the devel project for such a program. OBS-URL: https://build.opensuse.org/request/show/397032 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=1
2016-05-24 07:12:25 +02:00
Linux namespace support. It supports sandboxing specific users upon login.
%prep
%setup -q
%build
Accepting request 431498 from home:tiwai:branches:Virtualization - Update to version 0.9.42: Security fixes: * –whitelist deleted files * disable x32 ABI in seccomp * tighten –chroot * terminal sandbox escape * several TOCTOU fixes Behavior changes: * bringing back –private-home option * deprecated –user option, please use “sudo -u username firejail” * allow symlinks in home directory for –whitelist option * Firejail prompt is enabled by env variable FIREJAIL_PROMPT=”yes” * recursive mkdir * include /dev/snd in –private-dev * seccomp filter update * release archives moved to .xz format New features: * AppImage support (–appimage) * AppArmor support (–apparmor) * Ubuntu snap support (/etc/firejail/snap.profile) * Sandbox auditing support (–audit) * remove environment variable (–rmenv) * noexec support (–noexec) * clean local overlay storage directory (–overlay-clean) * store and reuse overlay (–overlay-named) * allow debugging inside the sandbox with gdb and strace (–allow-debuggers) * mkfile profile command * quiet profile command * x11 profile command * option to fix desktop files (firecfg –fix) OBS-URL: https://build.opensuse.org/request/show/431498 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=3
2016-10-13 10:58:49 +02:00
%configure --docdir=%{_docdir}/%{name} \
--enable-apparmor
Accepting request 397032 from home:tiwai:firejail This is a request for a new package "firejail". It's a lightweight sandbox using namespace and seccomp. Let me know if Virtualization doesn't fit as the devel project for such a program. OBS-URL: https://build.opensuse.org/request/show/397032 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=1
2016-05-24 07:12:25 +02:00
make %{?_smp_mflags} VERBOSE=1
%install
Accepting request 522777 from home:avindra - Update to version 0.9.50: * New features: - per-profile disable-mnt (--disable-mnt) - per-profile support to set X11 Xephyr screen size (--xephyr-screen) - private /lib directory (--private-lib) - disable CDROM/DVD drive (--nodvd) - disable DVB devices (--notv) - --profile.print * modif: --output split in two commands, --output and --output-stderr * set xpra-attach yes in /etc/firejail/firejail.config * Enhancements: - print all seccomp filters under --debug - /proc/sys mounting - rework IP address assingment for --net options - support for newer Xpra versions (2.1+) - - all profiles use a standard layout style - create /usr/local for firecfg if the directory doesn't exist - allow full paths in --private-bin * New seccomp features: - --memory-deny-write-execute - seccomp post-exec - block secondary architecture (--seccomp.block_secondary) - seccomp syscall groups - print all seccomp filters under --debug - default seccomp list update * new profiles: curl, mplayer2, SMPlayer, Calibre, ebook-viewer, KWrite, Geary, Liferea, peek, silentarmy, IntelliJ IDEA, Android Studio, electron, riot-web, Extreme Tux Racer, Frozen Bubble, Open Invaders, Pingus, Simutrans, SuperTux telegram-desktop, arm, rambox, apktool, baobab, dex2jar, gitg, hashcat, obs, picard, remmina, sdat2img, soundconverter truecraft, gnome-twitch, tuxguitar, musescore, neverball sqlitebrowse, Yandex Browser, minetest OBS-URL: https://build.opensuse.org/request/show/522777 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=8
2017-09-13 11:08:57 +02:00
%make_install
Accepting request 397032 from home:tiwai:firejail This is a request for a new package "firejail". It's a lightweight sandbox using namespace and seccomp. Let me know if Virtualization doesn't fit as the devel project for such a program. OBS-URL: https://build.opensuse.org/request/show/397032 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=1
2016-05-24 07:12:25 +02:00
%post
/sbin/ldconfig
%set_permissions %{_bindir}/firejail
%verifyscript
%verify_permissions -e %{_bindir}/firejail
%postun -p /sbin/ldconfig
%files
%verify(not user group mode) %{_bindir}/firejail
Accepting request 400690 from home:tiwai:branches:Virtualization - Update to version 0.9.40: * Added firecfg utility * New options: -nice, -cpu.print, -writable-etc, -writable-var, -read-only * X11 support: -x11 option (-x11=xpra, -x11=xephr) * Filetransfer options: –ls and –get * Added mkdir, ipc-namespace, and nosound profile commands * added net, ip, defaultgw, ip6, mac, mtu and iprange profile commands * Run time config support, man firejail-config * AppArmor fixes * Default seccomp filter update * Disable STUN/WebRTC in default netfilter configuration * Lots of new profiles OBS-URL: https://build.opensuse.org/request/show/400690 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=2
2016-06-08 19:13:02 +02:00
%{_bindir}/firecfg
Accepting request 397032 from home:tiwai:firejail This is a request for a new package "firejail". It's a lightweight sandbox using namespace and seccomp. Let me know if Virtualization doesn't fit as the devel project for such a program. OBS-URL: https://build.opensuse.org/request/show/397032 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=1
2016-05-24 07:12:25 +02:00
%{_bindir}/firemon
%{_datadir}/bash-completion
%{_libdir}/%{name}
%doc %{_docdir}/%{name}
%{_mandir}/man1/*
%{_mandir}/man5/*
%dir %{_sysconfdir}/%{name}
%config %{_sysconfdir}/%{name}/*
Accepting request 522777 from home:avindra - Update to version 0.9.50: * New features: - per-profile disable-mnt (--disable-mnt) - per-profile support to set X11 Xephyr screen size (--xephyr-screen) - private /lib directory (--private-lib) - disable CDROM/DVD drive (--nodvd) - disable DVB devices (--notv) - --profile.print * modif: --output split in two commands, --output and --output-stderr * set xpra-attach yes in /etc/firejail/firejail.config * Enhancements: - print all seccomp filters under --debug - /proc/sys mounting - rework IP address assingment for --net options - support for newer Xpra versions (2.1+) - - all profiles use a standard layout style - create /usr/local for firecfg if the directory doesn't exist - allow full paths in --private-bin * New seccomp features: - --memory-deny-write-execute - seccomp post-exec - block secondary architecture (--seccomp.block_secondary) - seccomp syscall groups - print all seccomp filters under --debug - default seccomp list update * new profiles: curl, mplayer2, SMPlayer, Calibre, ebook-viewer, KWrite, Geary, Liferea, peek, silentarmy, IntelliJ IDEA, Android Studio, electron, riot-web, Extreme Tux Racer, Frozen Bubble, Open Invaders, Pingus, Simutrans, SuperTux telegram-desktop, arm, rambox, apktool, baobab, dex2jar, gitg, hashcat, obs, picard, remmina, sdat2img, soundconverter truecraft, gnome-twitch, tuxguitar, musescore, neverball sqlitebrowse, Yandex Browser, minetest OBS-URL: https://build.opensuse.org/request/show/522777 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=8
2017-09-13 11:08:57 +02:00
%{_sysconfdir}/apparmor.d
Accepting request 397032 from home:tiwai:firejail This is a request for a new package "firejail". It's a lightweight sandbox using namespace and seccomp. Let me know if Virtualization doesn't fit as the devel project for such a program. OBS-URL: https://build.opensuse.org/request/show/397032 OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=1
2016-05-24 07:12:25 +02:00
%changelog
Reference in New Issue Copy Permalink