Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New profile: loupe #6327

Merged
merged 1 commit into from
May 1, 2024
Merged

New profile: loupe #6327

merged 1 commit into from
May 1, 2024

Conversation

SkewedZeppelin
Copy link
Collaborator

@SkewedZeppelin SkewedZeppelin commented Apr 30, 2024

works but can be improved

loupe opens each image in its own sandbox using bwrap if available

largely copy/pasted from eo-common

Copy link
Collaborator

@glitsj16 glitsj16 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nitpicks

Copy link
Collaborator

@glitsj16 glitsj16 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Signed-off-by: Tavi <tavi@divested.dev>
@SkewedZeppelin SkewedZeppelin merged commit 9a0db13 into netblue30:master May 1, 2024
8 checks passed
@SkewedZeppelin
Copy link
Collaborator Author

Merged, thanks @glitsj16!

kmk3 added a commit to kmk3/firejail that referenced this pull request May 8, 2024
The profile currently does not include disable-common nor makes
`${HOME}` read-only, so the program can simply write to ~/.bashrc
directly[1].

This amends commit 9a0db13 ("profiles: add loupe", 2024-04-30) /
PR netblue30#6327.

[1] netblue30#6327 (review)
kmk3 added a commit to kmk3/firejail that referenced this pull request May 8, 2024
The profile currently does not include disable-common nor makes
`${HOME}` read-only, so the program can simply write to ~/.bashrc
directly[1].

disable-common.inc was commented due to it apparently breaking bwrap.
As discovered by @glitsj16, it seems that allowing the bwrap binary is
enough to make it work (and that apparmor breaks loupe)[2].

So disable apparmor, allow bwrap and include disable-common.inc, plus
other hardening by @glitsj16.

This amends commit 9a0db13 ("profiles: add loupe", 2024-04-30) /
PR netblue30#6327.

[1] netblue30#6327 (review)
[2] netblue30#6333 (comment)
kmk3 added a commit that referenced this pull request May 12, 2024
The profile currently does not include disable-common nor makes
`${HOME}` read-only, so the program can simply write to ~/.bashrc
directly[1].

disable-common.inc was commented due to it apparently breaking bwrap.
As discovered by @glitsj16, it seems that allowing the bwrap binary is
enough to make it work (and that apparmor breaks loupe)[2].

So disable apparmor, allow bwrap and include disable-common.inc, plus
other hardening by @glitsj16.

This amends commit 9a0db13 ("profiles: add loupe", 2024-04-30) /
PR #6327.

[1] #6327 (review)
[2] #6333 (comment)
@kmk3 kmk3 changed the title profiles: add loupe New profile: loupe Oct 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants