From 90feb1888d69de4d797e3b401457a9002d7afbfe Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Fri, 17 Mar 2023 16:12:18 -0400 Subject: firejail: update 0.9.72 refresh patch Signed-off-by: Armin Kuster --- .../firejail/exclude_seccomp_util_compiles.patch | 20 +++---- recipes-security/Firejail/firejail_0.9.70.bb | 63 --------------------- recipes-security/Firejail/firejail_0.9.72.bb | 64 ++++++++++++++++++++++ 3 files changed, 74 insertions(+), 73 deletions(-) delete mode 100644 recipes-security/Firejail/firejail_0.9.70.bb create mode 100644 recipes-security/Firejail/firejail_0.9.72.bb diff --git a/recipes-security/Firejail/firejail/exclude_seccomp_util_compiles.patch b/recipes-security/Firejail/firejail/exclude_seccomp_util_compiles.patch index a32720a..7e70692 100644 --- a/recipes-security/Firejail/firejail/exclude_seccomp_util_compiles.patch +++ b/recipes-security/Firejail/firejail/exclude_seccomp_util_compiles.patch @@ -5,28 +5,28 @@ There are some files that need to run to generate the appropriate files we are currently doing this on the target. Signed-off-by: Armin Kuster -Index: git/Makefile.in +Index: git/Makefile =================================================================== ---- git.orig/Makefile.in -+++ git/Makefile.in -@@ -34,7 +34,6 @@ MYDIRS = src/lib $(MAN_SRC) $(COMPLETION +--- git.orig/Makefile ++++ git/Makefile +@@ -18,7 +18,6 @@ MYDIRS = src/lib $(MAN_SRC) $(COMPLETION MYLIBS = src/libpostexecseccomp/libpostexecseccomp.so src/libtrace/libtrace.so src/libtracelog/libtracelog.so COMPLETIONS = src/zsh_completion/_firejail src/bash_completion/firejail.bash_completion MANPAGES = firejail.1 firemon.1 firecfg.1 firejail-profile.5 firejail-login.5 firejail-users.5 jailcheck.1 -SECCOMP_FILTERS = seccomp seccomp.debug seccomp.32 seccomp.block_secondary seccomp.mdwx seccomp.mdwx.32 ALL_ITEMS = $(APPS) $(SBOX_APPS) $(SBOX_APPS_NON_DUMPABLE) $(MYLIBS) - .PHONY: all_items $(ALL_ITEMS) -@@ -52,7 +51,7 @@ $(MANPAGES): src/man + .PHONY: all +@@ -43,7 +42,7 @@ $(MANPAGES): src/man config.mk man: $(MANPAGES) -filters: $(SECCOMP_FILTERS) $(SBOX_APPS_NON_DUMPABLE) -+filters: $(SBOX_APPS_NON_DUMPABLE) ++filters: $(SBOX_APPS_NON_DUMPABLE) seccomp: src/fseccomp/fseccomp src/fsec-optimize/fsec-optimize src/fseccomp/fseccomp default seccomp src/fsec-optimize/fsec-optimize seccomp -@@ -81,7 +80,6 @@ clean: +@@ -72,7 +71,6 @@ clean: done $(MAKE) -C test clean rm -f $(MANPAGES) $(MANPAGES:%=%.gz) firejail*.rpm @@ -34,12 +34,12 @@ Index: git/Makefile.in rm -f test/utils/index.html* rm -f test/utils/wget-log rm -f test/utils/firejail-test-file* -@@ -119,7 +117,7 @@ endif +@@ -110,7 +108,7 @@ endif # libraries and plugins install -m 0755 -d $(DESTDIR)$(libdir)/firejail install -m 0755 -t $(DESTDIR)$(libdir)/firejail src/firecfg/firejail-welcome.sh - install -m 0644 -t $(DESTDIR)$(libdir)/firejail $(MYLIBS) $(SECCOMP_FILTERS) -+ install -m 0644 -t $(DESTDIR)$(libdir)/firejail $(MYLIBS) ++ install -m 0644 -t $(DESTDIR)$(libdir)/firejail $(MYLIBS) install -m 0755 -t $(DESTDIR)$(libdir)/firejail $(SBOX_APPS) install -m 0755 -t $(DESTDIR)$(libdir)/firejail src/profstats/profstats # plugins w/o read permission (non-dumpable) diff --git a/recipes-security/Firejail/firejail_0.9.70.bb b/recipes-security/Firejail/firejail_0.9.70.bb deleted file mode 100644 index 35f7b07..0000000 --- a/recipes-security/Firejail/firejail_0.9.70.bb +++ /dev/null @@ -1,63 +0,0 @@ -# -# Copyright 2022 Armin Kuster -# -SUMMARY = "Linux namespaces and seccomp-bpf sandbox" -DESCRIPTION = "Firejail is a SUID sandbox program that reduces the risk of security breaches \ -by restricting the running environment of untrusted applications using Linux namespaces, \ -seccomp-bpf and Linux capabilities." - -LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" -LICENSE = "GPL-2.0-only" - -SRCREV = "b4b08d21cd95725c9d55dfdb6987fcc6d7893247" -SRC_URI = "git://github.com/netblue30/firejail.git;protocol=https;branch=master \ - file://exclude_seccomp_util_compiles.patch \ - " - -DEPENDS = "libseccomp" - -S = "${WORKDIR}/git" - -inherit autotools-brokensep pkgconfig bash-completion features_check - -REQUIRED_DISTRO_FEATURES = "seccomp" - -PACKAGECONFIG ?= "" -PACKAGECONFIG += "${@bb.utils.contains('DISTRO_FEATURES', 'apparmor', 'apparmor', '', d)}" -PACKAGECONFIG += "${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'selinux', '', d)}" -PACKAGECONFIG += "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11', '', d)}" - -PACKAGECONFIG[apparmor] = "--enable-apparmor, --disable-apparmor, apparmor, apparmor" -PACKAGECONFIG[selinux] = "--enable-selinux, --disable-selinux, libselinux" -PACKAGECONFIG[x11] = " --enable-x11, --disable-x11, " -PACKAGECONFIG[dbusproxy] = ", --disable-dbusproxy, " -PACKAGECONFIG[notmpfs] = ", --disable-usertmpfs ," -PACKAGECONFIG[nofiretunnel] = ", --disable-firetunnel , " -PACKAGECONFIG[noprivatehome] = ", --disable-private-home, " -PACKAGECONFIG[nochroot] = ", --disable-chroot, " -PACKAGECONFIG[nonetwork] = ", --disable-network, " -PACKAGECONFIG[nouserns] = ", --disable-userns, " -PACKAGECONFIG[nofiletransfer] = ", --disable-file-transfer, " -PACKAGECONFIG[nosuid] = ", --disable-suid, " - -EXTRA_OECONF = "--disable-man --enable-busybox-workaround" - -PACKAGES:append = " ${PN}-vim ${PN}-zsh" - -FILES:${PN}-vim = "${datadir}/vim/" -FILES:${PN}-zsh = "${datadir}/zsh/" - -pkg_postinst_ontarget:${PN} () { - ${libdir}/${BPN}/fseccomp default ${libdir}/${BPN}/seccomp - ${libdir}/${BPN}/fsec-optimize ${libdir}/${BPN}/seccomp - ${libdir}/${BPN}/fseccomp default ${libdir}/${BPN}/seccomp.debug allow-debuggers - ${libdir}/${BPN}/fsec-optimize ${libdir}/${BPN}/seccomp.debug - ${libdir}/${BPN}/fseccomp secondary 32 ${libdir}/${BPN}/seccomp.32 - ${libdir}/${BPN}/fsec-optimize ${libdir}/${BPN}/seccomp.32 - ${libdir}/${BPN}/fseccomp secondary block ${libdir}/${BPN}/seccomp.block_secondary - ${libdir}/${BPN}/fseccomp memory-deny-write-execute ${libdir}/${BPN}/seccomp.mdwx -} - -COMPATIBLE_MACHINE:mips64 = "(!.*mips64).*" - -RDEPENDS:${PN} = "bash" diff --git a/recipes-security/Firejail/firejail_0.9.72.bb b/recipes-security/Firejail/firejail_0.9.72.bb new file mode 100644 index 0000000..12a3105 --- /dev/null +++ b/recipes-security/Firejail/firejail_0.9.72.bb @@ -0,0 +1,64 @@ +# +# Copyright 2022 Armin Kuster +# +SUMMARY = "Linux namespaces and seccomp-bpf sandbox" +DESCRIPTION = "Firejail is a SUID sandbox program that reduces the risk of security breaches \ +by restricting the running environment of untrusted applications using Linux namespaces, \ +seccomp-bpf and Linux capabilities." + +LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" +LICENSE = "GPL-2.0-only" + +SRCREV = "2551bc71f14052344666f3ca2ad67f5b798020b9" +SRC_URI = "git://github.com/netblue30/firejail.git;protocol=https;branch=master \ + file://exclude_seccomp_util_compiles.patch \ + " + +DEPENDS = "libseccomp" + +S = "${WORKDIR}/git" + +inherit autotools-brokensep pkgconfig bash-completion features_check + +REQUIRED_DISTRO_FEATURES = "seccomp" + +PACKAGECONFIG ?= "" +PACKAGECONFIG += "${@bb.utils.contains('DISTRO_FEATURES', 'apparmor', 'apparmor', '', d)}" +PACKAGECONFIG += "${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'selinux', '', d)}" +PACKAGECONFIG += "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11', '', d)}" + +PACKAGECONFIG[apparmor] = "--enable-apparmor, --disable-apparmor, apparmor, apparmor" +PACKAGECONFIG[selinux] = "--enable-selinux, --disable-selinux, libselinux" +PACKAGECONFIG[x11] = " --enable-x11, --disable-x11, " +PACKAGECONFIG[dbusproxy] = ", --disable-dbusproxy, " +PACKAGECONFIG[notmpfs] = ", --disable-usertmpfs ," +PACKAGECONFIG[nofiretunnel] = ", --disable-firetunnel , " +PACKAGECONFIG[noprivatehome] = ", --disable-private-home, " +PACKAGECONFIG[nochroot] = ", --disable-chroot, " +PACKAGECONFIG[nonetwork] = ", --disable-network, " +PACKAGECONFIG[nouserns] = ", --disable-userns, " +PACKAGECONFIG[nofiletransfer] = ", --disable-file-transfer, " +PACKAGECONFIG[nosuid] = ", --disable-suid, " + +EXTRA_OECONF = "--disable-man --enable-busybox-workaround" + +PACKAGES:append = " ${PN}-vim ${PN}-zsh" + +FILES:${PN}-vim = "${datadir}/vim/" +FILES:${PN}-zsh = "${datadir}/zsh/" +FILES:${PN}-dev = "${datadir}/gtksourceview-5/" + +pkg_postinst_ontarget:${PN} () { + ${libdir}/${BPN}/fseccomp default ${libdir}/${BPN}/seccomp + ${libdir}/${BPN}/fsec-optimize ${libdir}/${BPN}/seccomp + ${libdir}/${BPN}/fseccomp default ${libdir}/${BPN}/seccomp.debug allow-debuggers + ${libdir}/${BPN}/fsec-optimize ${libdir}/${BPN}/seccomp.debug + ${libdir}/${BPN}/fseccomp secondary 32 ${libdir}/${BPN}/seccomp.32 + ${libdir}/${BPN}/fsec-optimize ${libdir}/${BPN}/seccomp.32 + ${libdir}/${BPN}/fseccomp secondary block ${libdir}/${BPN}/seccomp.block_secondary + ${libdir}/${BPN}/fseccomp memory-deny-write-execute ${libdir}/${BPN}/seccomp.mdwx +} + +COMPATIBLE_MACHINE:mips64 = "(!.*mips64).*" + +RDEPENDS:${PN} = "bash" -- cgit v1.2.3-54-g00ecf