docs: clarify --noprofile and mention --profile=noprofile #6670
Conversation
kmk3
added
the
documentation
src/man/firejail.1.in
Outdated
| .TP | ||
| \fB\-\-noprofile | ||
| Do not use a security profile. | ||
| Do not load any security profile at all. |
There was a problem hiding this comment.
vs. "Do load an empty security profile."?
There was a problem hiding this comment.
vs. "Do load an empty security profile."?
Not sure what you mean, so I just reverted it.
Also added a note about profile debugging.
There was a problem hiding this comment.
No profile is equivalent to an empty profile. I'm not sure what is more clear to users.
src/man/firejail.1.in
Outdated
| .br | ||
| Example: | ||
| Note that certain restrictions are specified in the source code rather than in | ||
| profiles. |
There was a problem hiding this comment.
Maybe clarify that some restrictions are enabled by default and can be lifted with keep-*, writable-*, noblacklist, allow-*, ... and some are enabled unconditionally.
There was a problem hiding this comment.
Maybe clarify that some restrictions are enabled by default and can be lifted
withkeep-*,writable-*,noblacklist,allow-*, ...
For the sake of maintenance, I think it would be better in general to avoid
mirroring all the commands from noprofile.profile (other than in
profile.template).
Likewise, if there is to be a list of all other "allow" commands, I think it
would make more sense to put that in its own section rather than inside
the description of --noprofile.
But I added a note about the more generic ones ones: --noblacklist,
--nowhitelist and --ignore.
and some are enabled unconditionally.
Added a part about this.
Note that certain restrictions are applied even with `--noprofile` and that some of them can be lifted by using `--profile=noprofile`. Additionally, add a few cross-references for related commands.
kmk3
force-pushed
the
docs-clarify-noprofile
branch
from
32983f6 to
022efd9
Compare
|
Closing to clarify that the PR is not intended for merging in this state. |
2 participants
Note that certain restrictions are applied even with
--noprofileandthat some of them can be lifted by using
--profile=noprofile.Additionally, add a few cross-references for related commands.