{"action":"created","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/866","repository_url":"https://api.github.com/repos/netblue30/firejail","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/866/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/866/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/866/events","html_url":"https://github.com/netblue30/firejail/pull/866","id":184009368,"number":866,"title":"blacklisted common suid programms","user":{"login":"valoq","id":22596494,"avatar_url":"https://avatars.githubusercontent.com/u/22596494?v=3","gravatar_id":"","url":"https://api.github.com/users/valoq","html_url":"https://github.com/valoq","followers_url":"https://api.github.com/users/valoq/followers","following_url":"https://api.github.com/users/valoq/following{/other_user}","gists_url":"https://api.github.com/users/valoq/gists{/gist_id}","starred_url":"https://api.github.com/users/valoq/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/valoq/subscriptions","organizations_url":"https://api.github.com/users/valoq/orgs","repos_url":"https://api.github.com/users/valoq/repos","events_url":"https://api.github.com/users/valoq/events{/privacy}","received_events_url":"https://api.github.com/users/valoq/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-10-19T16:19:32Z","updated_at":"2016-10-21T15:54:14Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/netblue30/firejail/pulls/866","html_url":"https://github.com/netblue30/firejail/pull/866","diff_url":"https://github.com/netblue30/firejail/pull/866.diff","patch_url":"https://github.com/netblue30/firejail/pull/866.patch"},"body":"Blacklisting common suid programs closes a significant attack vektor.\r\nSo far I have experienced no problems regarding this change."},"comment":{"url":"https://api.github.com/repos/netblue30/firejail/issues/comments/255415059","html_url":"https://github.com/netblue30/firejail/pull/866#issuecomment-255415059","issue_url":"https://api.github.com/repos/netblue30/firejail/issues/866","id":255415059,"user":{"login":"Fred-Barclay","id":11165995,"avatar_url":"https://avatars.githubusercontent.com/u/11165995?v=3","gravatar_id":"","url":"https://api.github.com/users/Fred-Barclay","html_url":"https://github.com/Fred-Barclay","followers_url":"https://api.github.com/users/Fred-Barclay/followers","following_url":"https://api.github.com/users/Fred-Barclay/following{/other_user}","gists_url":"https://api.github.com/users/Fred-Barclay/gists{/gist_id}","starred_url":"https://api.github.com/users/Fred-Barclay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Fred-Barclay/subscriptions","organizations_url":"https://api.github.com/users/Fred-Barclay/orgs","repos_url":"https://api.github.com/users/Fred-Barclay/repos","events_url":"https://api.github.com/users/Fred-Barclay/events{/privacy}","received_events_url":"https://api.github.com/users/Fred-Barclay/received_events","type":"User","site_admin":false},"created_at":"2016-10-21T15:54:14Z","updated_at":"2016-10-21T15:54:14Z","body":"@valoq I see what you are talking about: they were blacklisted under \"system management\" as well as under \"disable common suid programms\". It's definitely a good call to not have them blacklisted twice in the same profile. :wink:\r\nActually, though, what I was talking about was that firejail itself blocked some of these (like mount, umount, fusemount, and su/sudo) by default, and I think it would be better to not blacklist them again here. You can see this if you run `firejail --debug`.\r\n\r\nNow the other suid programmes you blacklist that *aren't* already blacklisted I think are great! Let's definitely include them! :smile: Personally I would prefer them to be blacklisted by firejail itself rather than through a profile (the same way that mount, sudo, and so on are blacklisted) but that's a job for another day. "}}
{"actor":{"display_login":"Fred-Barclay"}}