netblue30 / firejail

Linux namespaces and seccomp-bpf sandbox
https://firejail.wordpress.com
GNU General Public License v2.0
5.83k stars 568 forks source link

profiles: replace x11 socket blacklist with disable-X11.inc #6286

Closed kmk3 closed 8 months ago

kmk3 commented 8 months ago

Replace all occurrences of blacklist /tmp/.X11-unix with include disable-X11.inc, which blacklists more X11-related files.

Commands used to search and replace:

$ git grep -Ilz '^blacklist /tmp/.X11-unix' -- \
  etc/profile*/*.profile | xargs -0 perl -0 -pi -e '\
    s/\nblacklist \/tmp\/.X11-unix\n/\n/; \
    s/(\ninclude disable-xdg.inc\n)/\ninclude disable-X11.inc$1/; \
    s/(\ninclude disable-[^Xx\n]+\n)(\n|# )/$1include disable-X11.inc\n$2/'

Note: The following files were also edited manually:

Relates to #4462 #4854 #5544.

kmk3 commented 8 months ago

Note: I did not manage to call include disable-X11.inc from the code itself without errors, so I left just the main profile search/replace for this PR.