Skip to content

Commit

Permalink
allow printing in evince
Browse files Browse the repository at this point in the history
  • Loading branch information
@netblue30
netblue30 committed Feb 22, 2022
1 parent a74f48f commit f347e88
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion etc/profile-a-l/evince.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ noblacklist ${DOCUMENTS}

blacklist /usr/libexec

include allow-bin-sh.inc
include disable-common.inc
include disable-devel.inc
include disable-exec.inc
Expand Down Expand Up @@ -51,7 +52,7 @@ seccomp.block-secondary
shell none
tracelog

private-bin evince,evince-previewer,evince-thumbnailer
private-bin evince,evince-previewer,evince-thumbnailer,bash,dash,sh

This comment has been minimized.

Sign in to view

Copy link
@rusty-snake

rusty-snake Feb 22, 2022

Collaborator

private-bin follows symlinks, just sh should work.

This comment has been minimized.

Sign in to view

Copy link
@netblue30

netblue30 Feb 22, 2022

Author Owner

OOPS! I'll fix it, thanks.

This comment has been minimized.

Sign in to view

Copy link
@kmk3

kmk3 Feb 22, 2022

Collaborator

@rusty-snake on Feb 22:

private-bin follows symlinks, just sh should work.

IIRC keeping bash and dash avoids breakage until #4790 is fixed (e.g.: by
making shell none the default).

This comment has been minimized.

Sign in to view

Copy link
@rusty-snake

rusty-snake Feb 22, 2022

Collaborator

But then we should add zsh,fish,... as well, too all profile, we shouldn't?

And shell none is set by evince.profile.

This comment has been minimized.

Sign in to view

Copy link
@kmk3

kmk3 Feb 22, 2022

Collaborator

@rusty-snake on Feb 22:

But then we should add zsh,fish,... as well, too all profile, we
shouldn't?

And shell none is set by evince.profile.

Sorry, I didn't think of checking that.

Interestingly, it seems that every profile with private-bin sh already has
shell none or is a redirect profile:

$ git show --pretty='%h %ai %s' -s
30e5c1240 2022-02-22 09:43:51 -0500 evince fix
$ git grep -l 'private-bin .*,sh' -- etc | while read -r f
  do grep -Fq 'shell none' "$f" || printf '%s\n' "$f"; done
etc/profile-a-l/cachy-browser.profile
etc/profile-a-l/cyberfox.profile
etc/profile-a-l/discord-common.profile
etc/profile-a-l/firedragon.profile
etc/profile-a-l/firefox.profile
etc/profile-a-l/freetube.profile
etc/profile-a-l/librewolf.profile
etc/profile-a-l/lyx.profile
etc/profile-m-z/slack.profile
etc/profile-m-z/teams-for-linux.profile
etc/profile-m-z/waterfox.profile
etc/profile-m-z/wire-desktop.profile

All of the above are redirect profiles and they end up including one of the
following profiles:

  • electron.profile
  • firefox-common.profile
  • latex-common.profile

All of which have shell none. So currently there seems to be no issue either
way.

This comment has been minimized.

Sign in to view

Copy link
@rusty-snake

rusty-snake Feb 22, 2022 •
edited
Loading

Collaborator 
$ ls /etc/firejail/*.profile | wc -l
1187
$ grep -L "^shell none" $(grep -L "^# Redirect" /etc/firejail/*.profile) | wc -l
57

And the most of them (if not all) should have it too.

This comment has been minimized.

Sign in to view

Copy link
@kmk3

kmk3 Feb 22, 2022 •
edited
Loading

Collaborator

Unrelated to the above discussion but still related to private-bin, note that
this commit was breaking CI because private-bin is not sorted:

/~https://github.com/netblue30/firejail/runs/5289541411?check_suite_focus=true

Which is now fixed by commit 30e5c12 ("evince fix", 2022-02-22).
private-cache
private-dev
private-etc alternatives,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd
Expand Down

0 comments on commit f347e88

Please sign in to comment.