Firejail

Recent Commits

• Kelvin M. Klann(16 Sept 26)

  test: check for errors when running some app test files To catch typos in array items, each of which is used as a part of the .exp filename that is executed. Example: $ cd test/apps $ ./foo.exp bash: ./foo.exp: No such file or directory $ echo "$?" 127 Related commits: * 0b70db165 ("test/apps/apps.sh: fix typo of "loupe"", 2026-09-11) * 983a8b350 ("test/apps/apps.sh: fix typo of "pavucontrol"", 2026-09-11)

• Kelvin M. Klann(16 Sept 26)

  test: include .exp filename in some log messages

• Kelvin M. Klann(16 Sept 26)

  test/private-lib/private-lib.sh: add missing quotes for "$app" Fixes a shellcheck warning: $ shellcheck test/private-lib/private-lib.sh In test/private-lib/private-lib.sh line 7: [...] In test/private-lib/private-lib.sh line 36: ./$app.exp ^--^ SC2086 (info): Double quote to prevent globbing and word splitting. Did you mean: ./"$app".exp For more information: https://www.shellcheck.net/wiki/SC2086 -- Double quote to prevent globbing ... Added on commit 6b92f685e ("private-lib", 2017-10-10).

• Kelvin M. Klann(11 Sept 26)

  test/apps/apps.sh: remove some redundant comments The same words already appear in the nearby `echo` commands.

• Kelvin M. Klann(11 Sept 26)

  test/apps/apps.sh: deduplicate app test lines See also commit 027cb4f54 ("test/apps/apps.sh: add missing quotes for "$app"", 2026-09-11).

• Kelvin M. Klann(11 Sept 26)

  test/apps/apps.sh: add missing quotes for "$app" Fixes a shellcheck warning: $ shellcheck test/apps/apps.sh [...] In test/apps/apps.sh line 22: ./$app.exp ^--^ SC2086 (info): Double quote to prevent globbing and word splitting. Did you mean: ./"$app".exp For more information: https://www.shellcheck.net/wiki/SC2086 -- Double quote to prevent globbing ... Added on commit 5d78ff54a ("Removing time-reading syscalls from @clock group. It stops several networked programs such as firefox, or any other program that tries to access the time. For example: firejail sleep 10", 2026-01-25).

• Kelvin M. Klann(11 Sept 26)

  test/apps/apps.sh: fix typo of "quick" This amends commit 5d78ff54a ("Removing time-reading syscalls from @clock group. It stops several networked programs such as firefox, or any other program that tries to access the time. For example: firejail sleep 10", 2026-01-25).

• Kelvin M. Klann(11 Sept 26)

  test/apps/apps.sh: move lists of apps into applist.sh The lists of apps are getting quite long (currently 76 items in total), so move them to a dedicated file.

• Kelvin M. Klann(11 Sept 26)

  test: sort array items

• Kelvin M. Klann(11 Sept 26)

  test/apps/apps.sh: fix typo of "pavucontrol" Added on commit ca934a2cc ("disable by default some of the systemd tools, more cleanup, and more testing", 2026-02-04).

• Kelvin M. Klann(11 Sept 26)

  test/apps/apps.sh: fix typo of "loupe" Added on commit 805e5408a ("testing", 2026-06-30), broken on commit c4a99f41c ("more testing", 2026-07-03).

• Kelvin M. Klann(11 Sept 26)

  test: line-wrap array items For increased readability, such as when comparing diffs.

• Kelvin M. Klann(10 Sept 26)

  test/apps: deduplicate program name into var To avoid typos and to make it easier to create new files from the templates. This also makes it easier to compare .exp files in test/apps (especially the ones that follow the template), as it's common for the only difference to be the program name (and the arguments passed to firejail). Changes: * Set the program name in a new `$program` variable * Replace occurrences of the program name with `$program` Commands used to search and replace: perl -i -wpe ' $skipfile=1 if /^set program /; next if $skipfile; if (!$p && m|\[file exists /usr/bin/([^\$]+)\]|) { $p = $1; s/$p/\$program/g; s/^/set program $p\n\n/; next; } if ($p) { s/$p/\$program/g; } if (eof) { undef $skipfile; undef $p; } ' test/apps/*.exp Files left as is: * test/apps/pid1.exp * test/apps/seccomp-clock.exp * test/apps/tor-browser.exp * test/apps/warzone2100.exp * test/apps/x11-none.exp Related commits: * 18f5d335f ("test/apps: fix wrong program names in messages", 2026-06-29) * 832bb05b7 ("test/apps: fix capitalized program names in messages", 2026-07-01) * ae62c58a7 ("test/apps/pitivi.exp: fix unchanged template parts", 2026-07-01) Note: This is only done for the .exp files that have the `file exists` check, as this is a straightforward way of programmatically obtaining the correct program name across .exp files in test/apps.

• Kelvin M. Klann(10 Sept 26)

  test/apps: check program is installed in more .exp files Check that the program is installed in /usr/bin, for consistency with the templates and with the other .exp files in test/apps. Templates: * test/apps/template-cmd.exp * test/apps/template.exp Commands used to search for the relevant files: $ git grep -IL 'file exists /usr/bin/' -- 'test/apps/*.exp' Other relevant files changed: * test/apps/firefox-xephyr.exp * test/apps/xterm-xephyr.exp Files left as is: * test/apps/pid1.exp # does not test a specific app * test/apps/seccomp-clock.exp # does not test a specific app * test/apps/tor-browser.exp # does not use `/usr/bin/$program` * test/apps/warzone2100.exp # uses `which -a` * test/apps/x11-none.exp # does not test a specific app Misc: The installed program check in test/apps was first added on commit 2184909ca ("more make test-apps", 2026-01-28).

• Kelvin M. Klann(10 Sept 26)

  test: remove extraneous blank lines This mostly affects .exp files. Commands used to search and replace: $ git grep -Ilz . -- test | xargs -0 \ perl -0777 -pi -e 's/\n{3,}/\n\n/g'

• Kelvin M. Klann(10 Sept 26)

  test: fix indentation in .exp files Make them more consistent with the other `test/*/*.exp` files. This mostly affects test/apps. See also: * test/apps/template-cmd.exp * test/apps/template.exp Commands used to search and replace: $ perl -pi -e 's/ {8}/\t/g' test/fs/tmpfs-root.exp $ git grep -Ilz '^ ' -- 'test/**.exp' | xargs -0 \ perl -pi -e 's/^ /\t/g'

• Kelvin M. Klann(04 Sept 26)

  unchroot.pl: fix inconsistent indentation This amends commit 1cb8ef591 ("--chroot testing", 2015-10-31).

• Kelvin M. Klann(04 Sept 26)

  util.c: fix inconsistent indentation Related commits: * 0200db6b6 ("modif: keep plugdev group unless nou2f is used (#6664)", 2025-03-14) * d2da156ab ("modif: keep tss group if keep-dev-tpm is used (#6718)", 2025-04-26)

• Kelvin M. Klann(04 Sept 26)

  fnettrace/runprog.c: fix inconsistent indentation This amends commit c13331305 ("adding apparmor profiles for --nettrace option", 2026-02-11).

• Kelvin M. Klann(04 Sept 26)

  mkgcov.sh: fix inconsistent indentation Added on commit 0271544fe ("testing", 2026-01-16).

• Kelvin M. Klann(31 Aug 26)

  test/apps/apps.sh: fix inconsistent indentation Make it more consistent with the other `test/*/*.sh` files. Related commits: * 2184909ca ("more make test-apps", 2026-01-28) * c4a99f41c ("more testing", 2026-07-03)

• Kelvin M. Klann(10 Sept 26)

  test/apps/tor-browser.exp: use tor-browser in --name This amends commit 7ec3a886a ("test/apps: rename tor.exp to tor-browser.exp", 2026-09-10).

• Kelvin M. Klann(10 Sept 26)

  test/apps: rename tor.exp to tor-browser.exp To clarify that this tests the GUI browser, not the daemon. This amends commit efb9769e7 ("lutris profile fix, make test-apps", 2026-09-07).

• netblue30(07 Sept 26)

  lutris profile fix, make test-apps

• netblue30(06 Sept 26)

  add yt-dlp to make test-apps

• pierretom(03 Sept 26)

  add new syscall `fchroot` to the `@mount` and `@privileged` groups Also update etc/templates/syscalls.txt.

• pierretom(03 Sept 26)

  update all system call headers

• dependabot[bot](01 Sept 26)

  build(deps): bump step-security/harden-runner from 2.20.0 to 2.21.0 (#7240) Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.20.0 to 2.21.0. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/bf7454d06d71f1098171f2acdf0cd4708d7b5920...05e31511f85b41b11d1cf0ef85d0992719546e2c) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.21.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](01 Sept 26)

  build(deps): bump the codeql-actions group with 2 updates (#7239) Bumps the codeql-actions group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.3 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...cdf488f595d80d6e07e03d4674febd5ab45fa938) Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...cdf488f595d80d6e07e03d4674febd5ab45fa938) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Kelvin M. Klann(01 Sept 26)

  build: test: sync `DISTFILES_TEST` with `TESTS` (#7238) Standardize and deduplicate the test items by using the same test paths in `make dist` as the test targets in `$(TESTS)`. This should fix the errors caused by missing test files when running `make test` from the tarball. Added tests: * apparmor * appimage * chroot * firecfg * private-etc * seccompextra Removed tests: * private-lib This is a follow-up to #7223.