Skip to content

Commit 780aea3

Browse files
glitsj16glitsj16
authored
docs: man: sort commands (firejail.1) (#6451)
Sort commands in firejail.1.in and sync the result with firejail-profile.5.in. * Commands: `--dbus-system.*`, `--dbus-user.*`, `--icmptrace`, `--ip=none`, `memory-deny-write-execute`, `--noinput` Relates to #3190 #3406 #4209.
1 parent 05d7aaa commit 780aea3

File tree

2 files changed

+105
-103
lines changed

2 files changed

+105
-103
lines changed

‎src/man/firejail-profile.5.in

+30-30
Original file line numberDiff line numberDiff line change
@@ -668,41 +668,41 @@ Enable filtered access to the system DBus. Filters can be specified with the dbu
668668
\fBdbus-system none
669669
Disable access to the system DBus. Once access is disabled, it cannot be relaxed to filtering.
670670
.TP
671+
\fBdbus-system.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
672+
Allow the application to receive broadcast signals from the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus.
673+
.TP
674+
\fBdbus-system.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
675+
Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus.
676+
.TP
671677
\fBdbus-system.own org.gnome.ghex.*
672678
Allow the application to own the name org.gnome.ghex and all names underneath in on the system DBus.
673679
.TP
674-
\fBdbus-system.talk org.freedesktop.Notifications
675-
Allow the application to talk to the name org.freedesktop.Notifications on the system DBus.
676-
.TP
677680
\fBdbus-system.see org.freedesktop.Notifications
678681
Allow the application to see but not talk to the name org.freedesktop.Notifications on the system DBus.
679682
.TP
680-
\fBdbus-system.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
681-
Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus.
682-
.TP
683-
\fBdbus-system.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
684-
Allow the application to receive broadcast signals from the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus.
683+
\fBdbus-system.talk org.freedesktop.Notifications
684+
Allow the application to talk to the name org.freedesktop.Notifications on the system DBus.
685685
.TP
686686
\fBdbus-user filter
687687
Enable filtered access to the session DBus. Filters can be specified with the dbus-user.talk and dbus-user.own commands.
688688
.TP
689689
\fBdbus-user none
690690
Disable access to the session DBus. Once access is disabled, it cannot be relaxed to filtering.
691691
.TP
692+
\fBdbus-user.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
693+
Allow the application to receive broadcast signals from the the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus.
694+
.TP
695+
\fBdbus-user.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
696+
Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus.
697+
.TP
692698
\fBdbus-user.own org.gnome.ghex.*
693699
Allow the application to own the name org.gnome.ghex and all names underneath in on the session DBus.
694700
.TP
695-
\fBdbus-user.talk org.freedesktop.Notifications
696-
Allow the application to talk to the name org.freedesktop.Notifications on the session DBus.
697-
.TP
698701
\fBdbus-user.see org.freedesktop.Notifications
699702
Allow the application to see but not talk to the name org.freedesktop.Notifications on the session DBus.
700703
.TP
701-
\fBdbus-user.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
702-
Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus.
703-
.TP
704-
\fBdbus-user.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
705-
Allow the application to receive broadcast signals from the the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus.
704+
\fBdbus-user.talk org.freedesktop.Notifications
705+
Allow the application to talk to the name org.freedesktop.Notifications on the session DBus.
706706
.TP
707707
\fBnodbus \fR(deprecated)
708708
Disable D-Bus access (both system and session buses). Equivalent to dbus-system none and dbus-user none.
@@ -866,20 +866,6 @@ net eth0
866866
.br
867867
ip 10.10.20.56
868868

869-
.TP
870-
\fBip none
871-
No IP address and no default gateway are configured for the last interface
872-
defined by a net command. Use this option
873-
in case you intend to start an external DHCP client in the sandbox.
874-
.br
875-
876-
.br
877-
Example:
878-
.br
879-
net eth0
880-
.br
881-
ip none
882-
883869
.TP
884870
\fBip dhcp
885871
Acquire an IP address and default gateway for the last interface defined by a
@@ -907,6 +893,20 @@ If your DHCP server requires leases to be explicitly released, consider running
907893
a DHCP client and releasing the lease manually in conjunction with the
908894
net none command.
909895

896+
.TP
897+
\fBip none
898+
No IP address and no default gateway are configured for the last interface
899+
defined by a net command. Use this option
900+
in case you intend to start an external DHCP client in the sandbox.
901+
.br
902+
903+
.br
904+
Example:
905+
.br
906+
net eth0
907+
.br
908+
ip none
909+
910910
.TP
911911
\fBip6 address
912912
Assign IPv6 addresses to the last network interface defined by a net command.

‎src/man/firejail.1.in

+75-73
Original file line numberDiff line numberDiff line change
@@ -611,8 +611,9 @@ Example:
611611
$ firejail --dbus-user=filter --dbus-user.own=org.gnome.ghex.*
612612

613613
.TP
614-
\fB\-\-dbus-user.talk=name
615-
Allows the application to talk to the specified well-known name on the session DBus.
614+
\fB\-\-dbus-user.see=name
615+
Allows the application to see, but not talk to the specified well-known name on
616+
the session DBus.
616617
The name may have a .* suffix to match all names underneath it, including itself
617618
(e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but
618619
not "foobar").
@@ -621,14 +622,13 @@ not "foobar").
621622
.br
622623
Example:
623624
.br
624-
$ firejail --dbus-user=filter --dbus-user.talk=\\
625+
$ firejail --dbus-user=filter --dbus-user.see=\\
625626
.br
626627
org.freedesktop.Notifications
627628

628629
.TP
629-
\fB\-\-dbus-user.see=name
630-
Allows the application to see, but not talk to the specified well-known name on
631-
the session DBus.
630+
\fB\-\-dbus-user.talk=name
631+
Allows the application to talk to the specified well-known name on the session DBus.
632632
The name may have a .* suffix to match all names underneath it, including itself
633633
(e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but
634634
not "foobar").
@@ -637,7 +637,7 @@ not "foobar").
637637
.br
638638
Example:
639639
.br
640-
$ firejail --dbus-user=filter --dbus-user.see=\\
640+
$ firejail --dbus-user=filter --dbus-user.talk=\\
641641
.br
642642
org.freedesktop.Notifications
643643
#endif
@@ -888,6 +888,32 @@ Example:
888888
.br
889889
$ firejail \-\-hosts-file=~/myhosts firefox
890890

891+
.TP
892+
\fB\-\-icmptrace[=name|pid]
893+
Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes
894+
created with \-\-net are supported. This option is only available when running the sandbox as root.
895+
.br
896+
897+
.br
898+
Without a name/pid, Firejail will monitor the main system network namespace.
899+
.br
900+
901+
.br
902+
Example
903+
.br
904+
$ sudo firejail --icmptrace
905+
.br
906+
20:53:54 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0
907+
.br
908+
20:53:54 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0
909+
.br
910+
20:53:55 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0
911+
.br
912+
20:53:55 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0
913+
.br
914+
20:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable
915+
.br
916+
891917
#ifdef HAVE_IDS
892918
.TP
893919
\fB\-\-ids-check
@@ -924,32 +950,6 @@ $ firejail --ignore=seccomp --ignore=caps firefox
924950
$ firejail \-\-ignore="net eth0" firefox
925951
#endif
926952

927-
.TP
928-
\fB\-\-icmptrace[=name|pid]
929-
Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes
930-
created with \-\-net are supported. This option is only available when running the sandbox as root.
931-
.br
932-
933-
.br
934-
Without a name/pid, Firejail will monitor the main system network namespace.
935-
.br
936-
937-
.br
938-
Example
939-
.br
940-
$ sudo firejail --icmptrace
941-
.br
942-
20:53:54 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0
943-
.br
944-
20:53:54 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0
945-
.br
946-
20:53:55 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0
947-
.br
948-
20:53:55 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0
949-
.br
950-
20:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable
951-
.br
952-
953953
.TP
954954
\fB\-\-\include=file.profile
955955
Include a profile file before the regular profiles are used.
@@ -983,23 +983,6 @@ Example:
983983
.br
984984
$ firejail \-\-net=eth0 \-\-ip=10.10.20.56 firefox
985985

986-
.TP
987-
\fB\-\-ip=none
988-
No IP address and no default gateway are configured for the last interface
989-
defined by a \-\-net option. Use this option
990-
in case you intend to start an external DHCP client in the sandbox.
991-
.br
992-
993-
.br
994-
Example:
995-
.br
996-
$ firejail \-\-net=eth0 \-\-\ip=none
997-
.br
998-
999-
.br
1000-
If the corresponding interface doesn't have an IP address configured, this
1001-
option is enabled by default.
1002-
1003986
.TP
1004987
\fB\-\-ip=dhcp
1005988
Acquire an IP address and default gateway for the last interface defined by a
@@ -1025,6 +1008,23 @@ If your DHCP server requires leases to be explicitly released, consider running
10251008
a DHCP client and releasing the lease manually in conjunction with the
10261009
\-\-net=none option.
10271010

1011+
.TP
1012+
\fB\-\-ip=none
1013+
No IP address and no default gateway are configured for the last interface
1014+
defined by a \-\-net option. Use this option
1015+
in case you intend to start an external DHCP client in the sandbox.
1016+
.br
1017+
1018+
.br
1019+
Example:
1020+
.br
1021+
$ firejail \-\-net=eth0 \-\-\ip=none
1022+
.br
1023+
1024+
.br
1025+
If the corresponding interface doesn't have an IP address configured, this
1026+
option is enabled by default.
1027+
10281028
.TP
10291029
\fB\-\-ip6=address
10301030
Assign IPv6 addresses to the last network interface defined by a \-\-net option.
@@ -1323,6 +1323,21 @@ Example:
13231323
.br
13241324
$ firejail \-\-machine-id
13251325

1326+
.TP
1327+
\fB\-\-memory-deny-write-execute
1328+
Install a seccomp filter to block attempts to create memory mappings
1329+
that are both writable and executable, to change mappings to be
1330+
executable, or to create executable shared memory. The filter examines
1331+
the arguments of mmap, mmap2, mprotect, pkey_mprotect, memfd_create
1332+
and shmat system calls and returns error EPERM to the process (or
1333+
kills it or log the attempt, see \-\-seccomp-error-action below) if necessary.
1334+
.br
1335+
1336+
.br
1337+
Note: shmat is not implemented
1338+
as a system call on some platforms including i386, and it cannot be
1339+
handled by seccomp-bpf.
1340+
13261341
.TP
13271342
\fB\-\-mkdir=dirname
13281343
Create a directory in user home. Parent directories are created as needed.
@@ -1343,20 +1358,6 @@ Example:
13431358
.br
13441359
$ firejail --mkfile=~/work/project/readme
13451360

1346-
.TP
1347-
\fB\-\-memory-deny-write-execute
1348-
Install a seccomp filter to block attempts to create memory mappings
1349-
that are both writable and executable, to change mappings to be
1350-
executable, or to create executable shared memory. The filter examines
1351-
the arguments of mmap, mmap2, mprotect, pkey_mprotect, memfd_create
1352-
and shmat system calls and returns error EPERM to the process (or
1353-
kills it or log the attempt, see \-\-seccomp-error-action below) if necessary.
1354-
.br
1355-
1356-
.br
1357-
Note: shmat is not implemented
1358-
as a system call on some platforms including i386, and it cannot be
1359-
handled by seccomp-bpf.
13601361
#ifdef HAVE_NETWORK
13611362
.TP
13621363
\fB\-\-mtu=number
@@ -1792,15 +1793,6 @@ Example:
17921793
.br
17931794
$ firejail \-\-nodvd
17941795
.TP
1795-
\fB\-\-noinput
1796-
Disable input devices.
1797-
.br
1798-
1799-
.br
1800-
Example:
1801-
.br
1802-
$ firejail \-\-noinput
1803-
.TP
18041796
\fB\-\-noexec=dirname_or_filename
18051797
Remount directory or file noexec, nodev and nosuid. File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
18061798
.br
@@ -1844,6 +1836,16 @@ uid=1000(netblue) gid=1000(netblue) groups=1000(netblue)
18441836
.br
18451837
$
18461838

1839+
.TP
1840+
\fB\-\-noinput
1841+
Disable input devices.
1842+
.br
1843+
1844+
.br
1845+
Example:
1846+
.br
1847+
$ firejail \-\-noinput
1848+
18471849
.TP
18481850
\fB\-\-nonewprivs
18491851
Sets the NO_NEW_PRIVS prctl. This ensures that child processes

0 commit comments

Comments
 (0)