Awesome Privacy

Recent Commits

• Kelvin M. Klann (26 Feb 26)

  bugfix: add localhost lines to /etc/hosts (#7079) Currently only the sandbox hostname is mapped to the default IP addresses in /etc/hosts. Default hosts file: $ cat /etc/hosts # Static table lookup for hostnames. # See hosts(5) for details. 127.0.0.1 localhost ::1 localhost Before: $ firejail --quiet --noprofile --hostname=foo cat /etc/hosts # Static table lookup for hostnames. # See hosts(5) for details. 127.0.0.1 foo ::1 foo After: $ firejail --quiet --noprofile --hostname=foo cat /etc/hosts # Static table lookup for hostnames. # See hosts(5) for details. 127.0.0.1 foo 127.0.0.1 localhost ::1 foo ::1 localhost This is a follow-up to #7077. Fixes #7048. Reported-by: @liloman

• netblue30 (25 Feb 26)

  RELNOTES and some more testing

• Kelvin M. Klann (25 Feb 26)

  bugfix: map sandbox hostname to ipv6 in /etc/hosts (#7077) Currently it is only mapped to ipv4, so add an ipv6 line. Default hosts file: $ cat /etc/hosts # Static table lookup for hostnames. # See hosts(5) for details. 127.0.0.1 localhost ::1 localhost Before: $ firejail --quiet --noprofile --hostname=foo cat /etc/hosts # Static table lookup for hostnames. # See hosts(5) for details. 127.0.0.1 foo ::1 localhost After: $ firejail --quiet --noprofile --hostname=foo cat /etc/hosts # Static table lookup for hostnames. # See hosts(5) for details. 127.0.0.1 foo ::1 foo Related commits: * 6f164f415 ("--keep-hostname part 2 (#7048)", 2026-02-03) Relates to #7048. Reported-by: @liloman

• Kelvin M. Klann (22 Feb 26)

  main.c: move --keep-hostname right after --hostname This is already the case in profile.c. Relates to #7069.

• Kelvin M. Klann (22 Feb 26)

  Fix misc whitespace Command used to check for whitespace errors: $ git diff --check 0.9.78..

• netblue30 (22 Feb 26)

  hide/unhide pid1 fix

• Kelvin M. Klann (21 Feb 26)

  Merge pull request #7074 from kmk3/improve-config-disabled-msgs modif: improve feature disabled warning/error messages

• Kelvin M. Klann (20 Feb 26)

  modif: improve feature disabled warning/error messages Ensure that each message includes the relevant command that triggered the message, the path to firejail.config and the source location for the command (in the case of profiles). Also, make sure to print the exact feature name from firejail.config and put it in quotes. Before: $ firejail --noprofile --netfilter /bin/true Error: networking feature is disabled in Firejail configuration file /etc/firejail/firejail.config $ firejail /bin/true Reading profile /etc/firejail/default.profile [...] Warning: networking feature is disabled in Firejail configuration file After: $ firejail --noprofile --netfilter /bin/true Error: 'network' feature is disabled in /etc/firejail/firejail.config: --netfilter $ firejail /bin/true Reading profile /etc/firejail/default.profile [...] Warning: /etc/firejail/default.profile:32: ignoring command because 'network' feature is disabled in /etc/firejail/firejail.config: netfilter Commands used to search and replace: $ perl -pi -e ' s/exit_err_feature\("bind"\)/exit_err_feature(argv[i], CFG_BIND)/; s/exit_err_feature\("chroot"\)/exit_err_feature(argv[i], CFG_CHROOT)/; s/exit_err_feature\("file transfer"\)/exit_err_feature(argv[i], CFG_FILE_TRANSFER)/; s/exit_err_feature\("join"\)/exit_err_feature(argv[i], CFG_JOIN)/; s/exit_err_feature\("networking"\)/exit_err_feature(argv[i], CFG_NETWORK)/; s/exit_err_feature\("noroot"\)/exit_err_feature(argv[i], CFG_USERNS)/; s/exit_err_feature\("private-bin"\)/exit_err_feature(argv[i], CFG_PRIVATE_BIN)/; s/exit_err_feature\("private-cache"\)/exit_err_feature(argv[i], CFG_PRIVATE_CACHE)/; s/exit_err_feature\("private-etc"\)/exit_err_feature(argv[i], CFG_PRIVATE_ETC)/; s/exit_err_feature\("private-home"\)/exit_err_feature(argv[i], CFG_PRIVATE_HOME)/; s/exit_err_feature\("private-lib"\)/exit_err_feature(argv[i], CFG_PRIVATE_LIB)/; s/exit_err_feature\("private-opt"\)/exit_err_feature(argv[i], CFG_PRIVATE_OPT)/; s/exit_err_feature\("private-srv"\)/exit_err_feature(argv[i], CFG_PRIVATE_SRV)/; s/exit_err_feature\("seccomp"\)/exit_err_feature(argv[i], CFG_SECCOMP)/; s/exit_err_feature\("seccomp-error-action"\)/exit_err_feature(argv[i], CFG_SECCOMP_ERROR_ACTION)/; s/exit_err_feature\("tracelog"\)/exit_err_feature(argv[i], CFG_TRACELOG)/; s/exit_err_feature\("x11"\)/exit_err_feature(argv[i], CFG_X11)/; ' src/firejail/main.c $ perl -pi -e ' s/warning_feature_disabled\("bind"\)/warning_feature_disabled(fname, lineno, ptr, CFG_BIND)/; s/warning_feature_disabled\("join"\)/warning_feature_disabled(fname, lineno, ptr, CFG_JOIN)/; s/warning_feature_disabled\("networking"\)/warning_feature_disabled(fname, lineno, ptr, CFG_NETWORK)/; s/warning_feature_disabled\("noroot"\)/warning_feature_disabled(fname, lineno, ptr, CFG_USERNS)/; s/warning_feature_disabled\("private-bin"\)/warning_feature_disabled(fname, lineno, ptr, CFG_PRIVATE_BIN)/; s/warning_feature_disabled\("private-cache"\)/warning_feature_disabled(fname, lineno, ptr, CFG_PRIVATE_CACHE)/; s/warning_feature_disabled\("private-etc"\)/warning_feature_disabled(fname, lineno, ptr, CFG_PRIVATE_ETC)/; s/warning_feature_disabled\("private-home"\)/warning_feature_disabled(fname, lineno, ptr, CFG_PRIVATE_HOME)/; s/warning_feature_disabled\("private-lib"\)/warning_feature_disabled(fname, lineno, ptr, CFG_PRIVATE_LIB)/; s/warning_feature_disabled\("private-opt"\)/warning_feature_disabled(fname, lineno, ptr, CFG_PRIVATE_OPT)/; s/warning_feature_disabled\("private-srv"\)/warning_feature_disabled(fname, lineno, ptr, CFG_PRIVATE_SRV)/; s/warning_feature_disabled\("seccomp"\)/warning_feature_disabled(fname, lineno, ptr, CFG_SECCOMP)/; s/warning_feature_disabled\("seccomp-error-action"\)/warning_feature_disabled(fname, lineno, ptr, CFG_SECCOMP_ERROR_ACTION)/; s/warning_feature_disabled\("tracelog"\)/warning_feature_disabled(fname, lineno, ptr, CFG_TRACELOG)/; s/warning_feature_disabled\("x11"\)/warning_feature_disabled(fname, lineno, ptr, CFG_X11)/; ' src/firejail/profile.c Relates to #6456 #7073. Reported-by: @YASOONA Reported-by: @ginto37

• Kelvin M. Klann (21 Feb 26)

  checkcfg.c: move feature warning/error functions into it The following functions are used for a similar purpose and print similar messages, so move them into the same file to make it easier to keep them in sync: * `exit_err_feature()` * `warning_feature_disabled()`

• Kelvin M. Klann (21 Feb 26)

  main.c: add noreturn attribute to exit_err_feature() See also commit ce1b25483 ("annotate some functions as non-returning (#3574)", 2020-08-08).

• Kelvin M. Klann (20 Feb 26)

  checkcfg.c: add cfgstr map of CFG enum and config name This is similar to `opstr[]` in src/firejail/fs.c. Example: cfgstr[CFG_NONE]; // "none" Related commits: * dba9dff9c ("streamline remounting (ro,rw,noexec)", 2019-06-17)

• Kelvin M. Klann (20 Feb 26)

  checkcfg.c: sort PARSE_YESNO section

• Kelvin M. Klann (20 Feb 26)

  firejail.h: sort CFG enum

• Kelvin M. Klann (20 Feb 26)

  firejail.h: add CFG_NONE to CFG enum To make it easier to add new elements and sort them. This is similar to `DEV_NONE` in the `DEV_TYPE` enum in `src/firejail/fs_dev.c`. Related commits: * be00aa351 ("--notv for #1446", 2017-08-10)

• Kelvin M. Klann (20 Feb 26)

  profile.c: remove redundant arg_quiet checks `fwarning()` in `warning_feature_disabled()` already checks for `arg_quiet`. Related commits: * 05e976834 ("redirect all warnings to fwarning function and control the output with --quiet", 2017-04-13) * 88eadbf31 ("seccomp: allow defining separate filters for 32-bit arch", 2020-03-14)

• netblue (19 Feb 26)

  moving gettimeofday from @obsolate group to @default-keep

• Kelvin M. Klann (19 Feb 26)

  build: fix discarded const qualifier compiler warnings (#7068) Fix the following `-Wdiscarded-qualifiers` warnings: $ pacman -Q gcc glibc gcc 15.2.1+r604+g0b99615a8aef-1 glibc 2.43+r5+g856c426a7534-1 $ ./configure >/dev/null && make clean >/dev/null && make >/dev/null ../../src/firejail/dbus.c: In function ‘dbus_check_call_rule’: ../../src/firejail/dbus.c:123:26: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] 123 | char *name_end = strchr(rule, '='); | ^~~~~~ ../../src/firejail/env.c: In function ‘env_store’: ../../src/firejail/env.c:161:21: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] 161 | char *ptr = strchr(str, '='); | ^~~~~~ ../../src/firejail/env.c:178:30: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] 178 | char *ptr2 = strchr(env->name, '='); | ^~~~~~ ../../src/firejail/profile.c: In function ‘profile_read’: ../../src/firejail/profile.c:1753:29: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] 1753 | char *ptr = strstr(base, ".local"); | ^~~~~~ ../../src/firejail/profile.c:1769:29: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] 1769 | char *tmp = strrchr(fname, '/'); | ^~~~~~~ ../../src/firejail/profile.c:1778:29: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] 1778 | char *tmp = strrchr(fname, '/'); | ^~~~~~~ ../../src/fcopy/main.c: In function ‘duplicate_file’: ../../src/fcopy/main.c:433:21: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] 433 | char *ptr = (arg_follow_link)? strrchr(src, '/'): strrchr(rsrc, '/'); | ^ ../../src/fcopy/main.c: In function ‘duplicate_link’: ../../src/fcopy/main.c:457:21: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] 457 | char *ptr = strrchr(src, '/'); | ^~~~~~~ ../../src/fnet/interface.c: In function ‘net_if_ip6’: ../../src/fnet/interface.c:341:18: warning: assignment discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] 341 | if ((ptr = strchr(addr6, '/'))) { | ^ Note: Only the following instances actually modify the pointed-to value: * src/firejail/env.c:178 * src/fnet/interface.c:341

• Kelvin M. Klann (19 Feb 26)

  profiles: add keep-hostname to noprofile.profile Related to this, trying to open xorg programs stopped working on Arch recently (even with `--profile=noprofile`), producing the following error[1]: $ /usr/local/bin/thunderbird [...] Authorization required, but no authorization protocol specified Error: cannot open display: :0 Parent is shutting down, bye... The programs work if `--keep-hostname` is used. The workaround was found quickly, but mostly by luck and guesswork, as needing to use a profile command when even `--profile=noprofile` does not work is counterintuitive and unexpected. Related commits: * cc8b019b5 ("--keep-hostname part 1 (#7048)", 2026-02-03) * e31d872a5 ("profiles: add keep-hostname to profile.template", 2026-02-11) Relates to #7062. [1] https://github.com/netblue30/firejail/issues/7062#issue-3943568845

• Kelvin M. Klann (18 Feb 26)

  Merge pull request #7065 from kmk3/docs-seccomp-add-debug-syscalls docs: man: clarify --debug-syscalls for seccomp

• Kelvin M. Klann (17 Feb 26)

  docs: man: clarify --debug-syscalls Clarify that the numbers and names in the syscall mapping come directly from the Linux kernel. Relates to #7063. Reported-by: @cobratbq

• Kelvin M. Klann (17 Feb 26)

  docs: man: mention --debug-syscalls for seccomp Some syscalls have multiple versions, which may lead to confusion as to which is the correct syscall name. For example, `uname` has two older obsolete versions (see `uname(2)`): * `__NR_oldolduname` * `__NR_olduname` * `__NR_uname` But only the most recent one is exposed by the syscall map for the `x86_64` architecture: $ firejail --debug-syscalls | grep uname 63 - uname Mention `--debug-syscalls` / `--debug-syscalls32` as a way to find the proper syscall names to be used with `--seccomp` / `--seccomp.32`. Relates to #7063. Reported-by: @cobratbq

• Kelvin M. Klann (17 Feb 26)

  docs: man: format misc seccomp text This is a follow-up to commit 45e221442 ("docs: man: fix arch for syscall map in seccomp example (#7064)", 2026-02-17).

• pierretom (17 Feb 26)

  docs: man: fix arch for syscall map in seccomp example (#7064) `mount`: i386 -> 21 x32 -> 165 x86_64 -> 165

• Kelvin M. Klann (15 Feb 26)

  profiles: firefox: add new ~/.config/mozilla dir (#7061) Default directories in Firefox 146 and earlier: * ~/.cache/mozilla # cache files * ~/.mozilla # config and data In Firefox 147[1]: * ~/.cache/mozilla # cache files * ~/.config/mozilla # config and data Note that the new location apparently contains the same files as in the former location (including settings, bookmarks, extensions, etc). That is, even though the new directory resides in `$XDG_CONFIG_HOME` / ~/.config, it is not solely used for program configuration as described in the XDG Base Directory specification[2] and `$XDG_DATA_HOME` / ~/.local/share/mozilla is seemingly not used at all (see also the discussion in the bug tracker[3]). Commands used to search and replace: $ perl -pi -e 's/(.* )(\${HOME}\/\.mozilla)(.*)/$1\${HOME}\/.config\/mozilla$3\n$1$2$3/' \ -- \ etc/inc/*.inc \ etc/profile*/*.profile \ Note: The entries in the following profiles were sorted manually: * etc/inc/disable-common.inc * etc/inc/disable-programs.inc * etc/profile-a-l/keepassxc.profile * etc/profile-a-l/krunner.profile * etc/profile-m-z/seamonkey.profile Relates to #7040. [1] https://www.firefox.com/en-US/firefox/147.0/releasenotes/ [2] https://specifications.freedesktop.org/basedir/latest/ [3] https://bugzilla.mozilla.org/show_bug.cgi?id=259356

• Kelvin M. Klann (11 Feb 26)

  profiles: fix allowing netcat (#7059) disable-common.inc has these lines: blacklist ${PATH}/nc blacklist ${PATH}/nc.openbsd blacklist ${PATH}/nc.traditional blacklist ${PATH}/ncat With openbsd-netcat on Artix, `/usr/bin/nc.openbsd` is symlinked to `/usr/bin/nc`: $ pacman -Fl gnu-netcat openbsd-netcat | grep bin/nc gnu-netcat usr/bin/nc openbsd-netcat usr/bin/nc openbsd-netcat usr/bin/nc.openbsd $ realpath /usr/bin/nc.openbsd /usr/bin/nc So `noblacklist ${PATH}/nc` is not enough, as `blacklist ${PATH}/nc.openbsd` will follow the symlink to `/usr/bin/nc` and still blacklist it. To prevent `/usr/bin/nc` from being blacklisted, `noblacklist ${PATH}/nc.openbsd` is also needed in this case. To ensure that netcat is allowed, always `noblacklist` all netcat paths. Fixes #6911.

• Kelvin M. Klann (11 Feb 26)

  profiles: add keep-hostname to profile.template Put it together with the other `keep-` commands. And move it to the allow section in libreoffice.profile. Related commits: * cc8b019b5 ("--keep-hostname part 1 (#7048)", 2026-02-03) * fbc94070e ("adding keep-hostname to libreoffice.profile", 2026-02-11). Relates to #7048.

• netblue30 (11 Feb 26)

  adding keep-hostname to libreoffice.profile

• netblue30 (11 Feb 26)

  adding apparmor profiles for --nettrace option

• netblue30 (08 Feb 26)

  Merge pull request #7055 from pierretom/patch17 add a new option `--debug-syscall-groups` - part 2

• netblue30 (08 Feb 26)

  merges