firejail/firejail.spec
Sebastian Wagner 02185620d8 - remove patches fix-internet-access.patch and fix-CVE-2022-31214.patch
as they are integrated upstream
- update to version 0.9.70:
 - security: CVE-2022-31214 - root escalation in --join logic
 - Reported by Matthias Gerstner, working exploit code was provided to our
 - development team. In the same time frame, the problem was independently
 - reported by Birk Blechschmidt. Full working exploit code was also provided.
 - feature: enable shell tab completion with --tab (#4936)
 - feature: disable user profiles at compile time (#4990)
 - feature: Allow resolution of .local names with avahi-daemon in the apparmor
 - profile (#5088)
 - feature: always log seccomp errors (#5110)
 - feature: firecfg --guide, guided user configuration (#5111)
 - feature: --oom, kernel OutOfMemory-killer (#5122)
 - modif: --ids feature needs to be enabled at compile time (#5155)
 - modif: --nettrace only available to root user
 - rework: whitelist restructuring (#4985)
 - rework: firemon, speed up and lots of fixes
 - bugfix: --private-cwd not expanding macros, broken hyperrogue (#4910)
 - bugfix: nogroups + wrc prints confusing messages (#4930 #4933)
 - bugfix: openSUSE Leap - whitelist-run-common.inc (#4954)
 - bugfix: fix printing in evince (#5011)
 - bugfix: gcov: fix gcov functions always declared as dummy (#5028)
 - bugfix: Stop warning on safe supplementary group clean (#5114)
 - build: remove ultimately unused INSTALL and RANLIB check macros (#5133)
 - build: mkdeb.sh.in: pass remaining arguments to ./configure (#5154)
 - ci: replace centos (EOL) with almalinux (#4912)
 - ci: fix --version not printing compile-time features (#5147)
 - ci: print version after install & fix apparmor support on build_apparmor
 - (#5148)

OBS-URL: https://build.opensuse.org/package/show/Virtualization/firejail?expand=0&rev=47
2022-06-14 20:25:23 +00:00

128 lines
4.0 KiB
RPMSpec

#
# spec file for package firejail
#
# Copyright (c) 2022 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
Name: firejail
Version: 0.9.70
Release: 0
Summary: Linux namepaces sandbox program
License: GPL-2.0-only
Group: Productivity/Security
URL: https://firejail.wordpress.com
Source0: https://github.com/netblue30/%{name}/releases/download/%{version}/%{name}-%{version}.tar.xz
Source1: https://github.com/netblue30/%{name}/releases/download/%{version}/%{name}-%{version}.tar.xz.asc
# https://firejail.wordpress.com/download-2/
Source2: %{name}.keyring
BuildRequires: fdupes
BuildRequires: gcc-c++
BuildRequires: libapparmor-devel
Requires(post): permissions
Requires(pre): shadow
%description
Firejail is a SUID sandbox program that reduces the risk of security
breaches by restricting the running environment of untrusted applications
using Linux namespaces and seccomp-bpf. It includes sandbox profiles for
many existing applications like Iceweasel/Mozilla Firefox and Chromium.
Firejail also expands the restricted shell facility found in bash by adding
Linux namespace support. It supports sandboxing specific users upon login.
%package bash-completion
Summary: Firejail Bash completion
Group: System/Shells
Requires: %{name} = %{version}
Requires: bash-completion
Supplements: (%{name} and bash-completion)
%description bash-completion
Optional dependency offering bash completion for firejail
%package zsh-completion
Summary: Firejail zsh completion
Group: System/Shells
Requires: %{name} = %{version}
Requires: zsh
Supplements: (%{name} and zsh)
%description zsh-completion
Optional dependency offering zsh completion for firejail
%prep
%setup -q
sed -i '1s/^#!\/usr\/bin\/env /#!\/usr\/bin\//' contrib/fj-mkdeb.py contrib/fjclip.py contrib/fjdisplay.py contrib/fjresize.py contrib/sort.py contrib/fix_private-bin.py contrib/jail_prober.py
%build
%configure --docdir=%{_docdir}/%{name} \
--enable-apparmor
%make_build
%pre
getent group firejail >/dev/null || groupadd -r firejail
exit 0
%install
%make_install
rm %{buildroot}%{_docdir}/firejail/COPYING
%fdupes -s %{buildroot}
%post
%set_permissions %{_bindir}/firejail
%verifyscript
%verify_permissions -e %{_bindir}/firejail
%files
%license COPYING
%attr(4750,root,firejail) %verify(not user group mode) %{_bindir}/firejail
%{_bindir}/firecfg
%{_bindir}/firemon
%{_bindir}/jailcheck
%{_libdir}/%{name}
%doc %{_docdir}/%{name}
%{_mandir}/man1/*
%{_mandir}/man5/*
%dir %{_sysconfdir}/%{name}
%config %{_sysconfdir}/%{name}/*
%config %{_sysconfdir}/apparmor.d/firejail-default
%config %{_sysconfdir}/apparmor.d/local/firejail-default
%dir %{_sysconfdir}/apparmor.d
%dir %{_sysconfdir}/apparmor.d/local
%dir %{_sysconfdir}/apparmor.d/abstractions
%dir %{_sysconfdir}/apparmor.d/abstractions/base.d
%dir %{_datadir}/vim
%dir %{_datadir}/vim/vimfiles
%dir %{_datadir}/vim/vimfiles/ftdetect
%dir %{_datadir}/vim/vimfiles/syntax
%{_datadir}/vim/vimfiles/ftdetect/firejail.vim
%{_datadir}/vim/vimfiles/syntax/firejail.vim
%files bash-completion
%license COPYING
%dir %{_datadir}/bash-completion
%dir %{_datadir}/bash-completion/completions
%{_datadir}/bash-completion/completions/*
%files zsh-completion
%license COPYING
%dir %{_datarootdir}/zsh
%dir %{_datarootdir}/zsh/site-functions/
%{_datadir}/zsh/site-functions/_firejail
/etc/apparmor.d/abstractions/base.d/firejail-base
%changelog