RELNOTES

firejail (0.9.73) baseline; urgency=low
  * work in progress
  * security: fix sscanf rv checks (CodeQL) (#6184)
  * feature: Add "keep-shell-rc" command and option (#1127 #5634)
  * feature: Print the argument when failing with "too long arguments" (#5677)
  * feature: a random hostname is assigned to each sandbox unless
    overwritten using --hostname command
  * feature: add IPv6 support for --net.print option
  * feature: QUIC (HTTP/3) support in --nettrace
  * feature: add seccomp filters for --restrict-namespaces
  * feature: stats support for --nettrace
  * feature: add doas support in firecfg and jailcheck (#5899 #5900)
  * feature: firecfg: add firecfg.d & add ignore command (#2097 #5245 #5876
    #6153)
  * feature: expand simple macros in more commands (--chroot= --netfilter=
    --netfilter6= --trace=) (#6032 #6109)
  * feature: add Landlock support (#5269 #6078 #6115 #6125 #6187 #6195 #6200)
  * modif: Stop forwarding own double-dash to the shell (#5599 #5600)
  * modif: Prevent sandbox name (--name=) and host name (--hostname=)
    from containing only digits (#5578 #5741)
  * modif: Escape control characters of the command line (#5613)
  * modif: Allow mostly only ASCII letters and digits for sandbox name
    (--name=) and host name (--hostname=) (#5708 #5856)
  * modif: remove firemon --interface option (duplicating --net.print option)
  * modif: make private-lib a configure-time option, disabled by default (see
    --enable-private-lib) (#5727 #5732)
  * modif: Improve --version/--help & print version on startup (#5829 #6172)
  * modif: improve errExit error messages (#5871)
  * modif: drop deprecated 'shell' option references (#5894)
  * modif: keep pipewire group unless nosound is used (#5992 #5993)
  * removal: LTS and FIRETUNNEL support
  * bugfix: qutebrowser: links will not open in the existing instance (#5601
    #5618)
  * bugfix: fix --hostname and --hosts-file commands
  * bugfix: arp.c: ensure positive timeout on select(2) (#5806)
  * bugfix: Wrong syscall names for s390_pci_mmio_read and s390_pci_mmio_write
    (#5965 #5976)
  * bugfix: firejail --ls reports wrong file sizes for large files (#5982
    #6086)
  * build: auto-generate syntax files (#5627)
  * build: mark all phony targets as such (#5637)
  * build: mkdeb.sh: pass all arguments to ./configure (#5654)
  * build: deb: enable apparmor by default & remove deb-apparmor (#5668)
  * build: Fix whitespace and add .editorconfig (#5674)
  * build: enable compiler warnings by default (#5842)
  * build: remove -mretpoline and NO_EXTRA_CFLAGS (#5859)
  * build: disable all built-in implicit make rules (#5864)
  * build: organize and standardize make vars and targets (#5866)
  * build: fix seccomp filters and man pages always being rebuilt when running
    make
  * build: simplify code related to man pages (#5898)
  * build: fix hardcoded make & remove unnecessary distclean targets (#5911)
  * build: dist and asc improvements (#5916)
  * build: fix some shellcheck issues & use config.sh in more scripts (#5927)
  * build: firecfg.config sorting improvements (#5942)
  * build: codespell improvements (#5955)
  * build: add missing makefile dep & syntax improvements (#5956)
  * build: sort.py: use case-sensitive sorting (#6070)
  * build: mkrpm.sh: append instead of override configure args (#6126)
  * build: use CPPFLAGS instead of INCLUDE in compile targets (#6159)
  * build: use full paths on compile/link targets (#6158)
  * build: automatically generate header dependencies (#6164)
  * build: improve main clean target (#6186)
  * build: mkrpm.sh improvements (#6196)
  * ci: always update the package db before installing packages (#5742)
  * ci: fix codeql unable to download its own bundle (#5783)
  * ci: split configure/build/install commands on gitlab (#5784)
  * ci: fix swapped name/email arguments in debian_ci (#5795)
  * ci: formatting and misc improvements (#5802)
  * ci: run for every branch instead of just master (#5815)
  * ci: upgrade debian:stretch to debian:buster (#5818)
  * ci: standardize apt-get update/install & misc improvements (#5857)
  * ci: whitelist paths, reorganize workflows & speed-up tests (#5960)
  * ci: fix dependabot duplicated workflow runs (#5984)
  * ci: allow running workflows manually (#6026)
  * ci: re-enable sort.py (#6104)
  * ci: add timeout limits (#6178)
  * contrib/syntax: remove 'text/plain' from firejail-profile.lang.in (#6057
    #6059)
  * contrib/vim: match profile files more broadly (#5850)
  * test: split individual test groups in github workflows
  * test: add chroot, appimage and network tests in github workflows
  * docs: remove apparmor options in --help when building without apparmor
    support (#5589)
  * docs: fix typos (#5693)
  * docs: markdown formatting and misc improvements (#5757)
  * docs: add uninstall instructions to README.md (#5812)
  * legal: selinux.c: Split Copyright notice & use same license as upstream
    (#5667)
  * profiles: standardize commented code and eol comments (#5987)
  * profiles: replace private-opt with whitelist & document private-opt issues
    (#6021)
  * new profiles: fix-qdf, qpdf, zlib-flate, standard-notes, url-eater
 -- netblue30 <netblue30@yahoo.com>  Mon, 17 Jan 2023 09:00:00 -0500

firejail (0.9.72) baseline; urgency=low
  * feature: On failing to remount a fuse filesystem, give warning instead of
    erroring out (#5240 #5242)
  * feature: Update syscall tables and seccomp groups (#5188)
  * feature: improve force-nonewprivs security guarantees (#5217 #5271)
  * feature: add support for restricting the creation of Linux namespaces
    (--restrict-namespaces, --restrict-namespaces=), implemented as a seccomp
    filter for both 64 and 32 bit architectures (#4939 #5259)
  * feature: add support for custom AppArmor profiles (--apparmor=) (#5274
    #5316 #5317 #5475)
  * feature: add support for ICMP in nettrace
  * feature: add --dnstrace, --icmptrace, and --snitrace commands
  * feature: Add basic gtksourceview language-spec (file type detection/syntax
    highlighting for profiles) (#5502)
  * feature: add restrict-namespaces to (almost) all applicable profiles (#5440
    #5537)
  * feature: add support for netlock in profile files
  * modif: removed --cgroup= command (#5190 #5200)
  * modif: set --shell=none as the default (#5190)
  * modif: removed --shell= command (#5190 #5196 #5209)
  * modif: disabled firetunnel by default in configure.ac (#5190)
  * modif: disabled chroot by default in /etc/firejail/firejail.config (#5190)
  * modif: disabled private-lib by default in /etc/firejail/firejail.config
    (#5190 #5216)
  * modif: disabled tracelog by default in /etc/firejail/firejail.config
    (#5190)
  * modif: removed grsecurity support
  * modif: stop hiding blacklisted files in /etc by default and add a new
    etc-hide-blacklisted option to firejail.config that enables the previous
    behavior (disabled by default) (#5010 #5230 #5591 #5595)
  * bugfix: Flood of seccomp audit log entries (#5207)
  * bugfix: --netlock does not work (Error: no valid sandbox) (#5312)
  * build: deduplicate configure-time vars into new config files (#5140 #5284)
  * build: fix file mode of shell scripts (644 -> 755) (#5206)
  * build: reduce autoconf input files from 32 to 2 (#5219)
  * build: add dist build directory to .gitignore (#5248)
  * build: add autoconf auto-generation comment to input files (#5251)
  * build: Add files make uninstall forgot to remove (#5283)
  * build: add and use TARNAME instead of NAME for paths (#5310)
  * build: only install ids.config when --enable-ids is set (#5356 #5357)
  * build: Remove deprecated syntax and modernize shell test scripts (#5370)
  * build: Fix musl warnings (#5421 #5431)
  * build: sort.py improvements (#5429)
  * build: deduplicate makefiles (#5478)
  * build: fix formatting and misc in configure (#5488)
  * build: actually set LDFLAGS/LIBS & stop overriding CFLAGS/LDFLAGS (#5504)
  * build: make shell commands more portable in firejail.vim (#5577)
  * ci: bump ubuntu to 22.04 and use newer compilers / analyzers (#5275)
  * ci: ignore git-related paths and the project license (#5249)
  * ci: Harden GitHub Actions (StepSecurity) (#5439)
  * ci: sort and ignore more paths (#5481)
  * ci: whitelist needed endpoints and block access to sudo (#5485)
  * docs: fix typos (#5189 #5349)
  * docs: mention risk of SUID binaries and also firejail-users(5) (#5288
    #5290)
  * docs: set vim filetype on man pages for syntax highlighting (#5296)
  * docs: note that blacklist/whitelist follow symlinks (#5344)
  * docs: Add IRC channel info to README.md (#5361)
  * docs: man: Note that some commands can be disabled in firejail.config
    (#5366)
  * docs: Add gist note to bug_report.md (#5398)
  * docs: clarify that --appimage should appear before --profile (#5402 #5451)
  * docs: add more Firefox examples to the firejail-local AppArmor profile
    (#5493)
  * docs: Fix broken Restrict-DBus wiki link on profile.template (#5554)
  * docs: Remove invalid --profile-path from --help (#5585 #5586)
  * new profiles: gdu, makedeb, gtk-lbry-viewer, lbry-viewer, tuir, chafa,
  * new profiles: godot3, cinelerra-gg, tesseract, avidemux3_qt5,
  * new profiles: avidemux3_cli, avidemux3_jobs_qt5, ssmtp, chatterino,
  * new profiles: linuxqq, qq, electron-hardened.inc.profile,
 -- netblue30 <netblue30@yahoo.com>  Mon, 16 Jan 2023 09:00:00 -0500

firejail (0.9.70) baseline; urgency=low
  * security: CVE-2022-31214 - root escalation in --join logic
    Reported by  Matthias Gerstner, working exploit code was provided to our
    development team. In the same time frame, the problem was independently
    reported by Birk Blechschmidt. Full working exploit code was also provided.
  * feature: enable shell tab completion with --tab (#4936)
  * feature: disable user profiles at compile time (#4990)
  * feature: Allow resolution of .local names with avahi-daemon in the apparmor
    profile (#5088)
  * feature: always log seccomp errors (#5110)
  * feature: firecfg --guide, guided user configuration (#5111)
  * feature: --oom, kernel OutOfMemory-killer (#5122)
  * modif: --ids feature needs to be enabled at compile time (#5155)
  * modif: --nettrace only available to root user
  * rework: whitelist restructuring (#4985)
  * rework: firemon, speed up and lots of fixes
  * bugfix: --private-cwd not expanding macros, broken hyperrogue (#4910)
  * bugfix: nogroups + wrc prints confusing messages (#4930 #4933)
  * bugfix: openSUSE Leap - whitelist-run-common.inc (#4954)
  * bugfix: fix printing in evince (#5011)
  * bugfix: gcov: fix gcov functions always declared as dummy (#5028)
  * bugfix: Stop warning on safe supplementary group clean (#5114)
  * build: remove ultimately unused INSTALL and RANLIB check macros (#5133)
  * build: mkdeb.sh.in: pass remaining arguments to ./configure (#5154)
  * ci: replace centos (EOL) with almalinux (#4912)
  * ci: fix --version not printing compile-time features (#5147)
  * ci: print version after install & fix apparmor support on build_apparmor
    (#5148)
  * docs: Refer to firejail.config in configuration files (#4916)
  * docs: firejail.config: add warning about allow-tray (#4946)
  * docs: mention that the protocol command accumulates (#5043)
  * docs: mention inconsistent homedir bug involving --private=dir (#5052)
  * docs: mention capabilities(7) on --caps (#5078)
  * new profiles: onionshare, onionshare-cli, opera-developer, songrec
  * new profiles: node-gyp, npx, semver, ping-hardened
  * removed profiles: nvm
 -- netblue30 <netblue30@yahoo.com>  Thu, 9 Jun 2022 09:00:00 -0500

firejail (0.9.68) baseline; urgency=low
  * security: on Ubuntu, the PPA is now recommended over the distro package
    (see README.md) (#4748)
  * security: bugfix: private-cwd leaks access to the entire filesystem
    (#4780); reported by Hugo Osvaldo Barrera
  * feature: remove (some) environment variables with auth-tokens (#4157)
  * feature: ALLOW_TRAY condition (#4510 #4599)
  * feature: add basic Firejail support to AppArmor base abstraction (#3226
    #4628)
  * feature: intrusion detection system (--ids-init, --ids-check)
  * feature: deterministic shutdown command (--deterministic-exit-code,
     --deterministic-shutdown) (#928 #3042 #4635)
  * feature: noprinters command (#4607 #4827)
  * feature: network monitor (--nettrace)
  * feature: network locker (--netlock) (#4848)
  * feature: whitelist-ro profile command (#4740)
  * feature: disable pipewire with --nosound (#4855)
  * feature: Unset TMP if it doesn't exist inside of sandbox (#4151)
  * feature: Allow apostrophe in whitelist and blacklist (#4614)
  * feature: AppImage support in --build command (#4878)
  * modifs: exit code: distinguish fatal signals by adding 128 (#4533)
  * modifs: firecfg.config is now installed to /etc/firejail/ (#408 #4669)
  * modifs: close file descriptors greater than 2 (--keep-fd) (#4845)
  * modifs: nogroups now stopped causing certain system groups to be dropped,
    which are now controlled by the relevant "no" options instead (such as
    nosound -> drop audio group), which fixes device access issues on systems
    not using (e)logind (such as with seatd) (#4632 #4725 #4732 #4851)
  * removal: --disable-whitelist at compile time
  * removal: whitelist=yes/no in /etc/firejail/firejail.config
  * bugfix: Fix sndio support (#4362 #4365)
  * bugfix: Error mounting tmpfs (MS_REMOUNT flag not being cleared) (#4387)
  * bugfix: --build clears the environment (#4460 #4467)
  * bugfix: firejail hangs with net parameter (#3958 #4476)
  * bugfix: Firejail does not work with a custom hosts file (#2758 #4560)
  * bugfix: --tracelog and --trace override /etc/ld.so.preload (#4558 #4586)
  * bugfix: PATH_MAX is undeclared on musl libc (#4578 #4579 #4583 #4606)
  * bugfix: firejail symlinks are not skipped with private-bin + globs (#4626)
  * bugfix: Firejail rejects empty arguments (#4395)
  * bugfix: firecfg does not work with symlinks (discord.desktop) (#4235)
  * bugfix: Seccomp list output goes to stdout instead of stderr (#4328)
  * bugfix: private-etc does not work with symlinks (#4887)
  * bugfix: Hardware key not detected on keepassxc (#4883)
  * build: allow building with address sanitizer (#4594)
  * build: Stop linking pthread (#4695)
  * build: Configure cleanup and improvements (#4712)
  * ci: add profile checks for sorting disable-programs.inc and
    firecfg.config and for the required arguments in private-etc (#2739 #4643)
  * ci: pin GitHub actions to SHAs and use Dependabot to update them (#4774)
  * docs: Add new command checklist to CONTRIBUTING.md (#4413)
  * docs: Rework bug report issue template and add both a question and a
    feature request template (#4479 #4515 #4561)
  * docs: fix contradictory descriptions of machine-id ("preserves" vs
    "spoofs") (#4689)
  * docs: Document that private-bin and private-etc always accumulate (#4078)
  * new includes: whitelist-run-common.inc (#4288), disable-X11.inc (#4462)
  * new includes: disable-proc.inc (#4521)
  * removed includes: disable-passwordmgr.inc (#4454 #4461)
  * new profiles: microsoft-edge-beta, clion-eap, lifeograph, zim
  * new profiles: io.github.lainsce.Notejot, rednotebook, gallery-dl
  * new profiles: yt-dlp, goldendict, goldendict, bundle, cmake
  * new profiles: make, meson, pip, codium, telnet, ftp, OpenStego
  * new profiles: imv, retroarch, torbrowser, CachyBrowser,
  * new profiles: notable, RPCS3, wget2, raincat, conitop, 1passwd,
  * new profiles: Seafile, neovim, com.github.tchx84.Flatseal
 -- netblue30 <netblue30@yahoo.com>  Sun, 6 Feb 2022 09:00:00 -0500

firejail (0.9.66) baseline; urgency=low
  * deprecated --audit options, replaced by jailcheck utility
  * deprecated follow-symlink-as-user from firejail.config
  * new firejail.config settings: private-bin, private-etc
  * new firejail.config settings: private-opt, private-srv
  * new firejail.config settings: whitelist-disable-topdir
  * new firejail.config settings: seccomp-filter-add
  * removed kcmp syscall from seccomp default filter
  * rename --noautopulse to keep-config-pulse
  * filtering environment variables
  * zsh completion
  * command line: --mkdir, --mkfile
  * --protocol now accumulates
  * Jolla/SailfishOS patches
  * private-lib rework
  * whitelist rework
  * jailtest utility for testing running sandboxes
  * capabilities list update
  * faccessat2 syscall support
  * --private-dev keeps /dev/input
  * added --noinput to disable /dev/input
  * add support for subdirs in --private-etc
  * compile time: --enable-force-nonewprivs
  * compile time: --disable-output
  * compile time: --enable-lts
  * subdirs support in private-etc
  * input devices support in private-dev, --no-input
  * support trailing comments on profile lines
  * new profiles: vmware-view, display-im6.q16, ipcalc, ipcalc-ng
  * ebook-convert, ebook-edit, ebook-meta, ebook-polish, lzop,
  * avidemux, calligragemini, vmware-player, vmware-workstation
  * gget, com.github.phase1geo.minder, nextcloud-desktop, pcsxr
  * PPSSPPSDL, openmw, openmw-launcher, jami-gnome, PCSX2, sum
  * bcompare, b2sum, cksum, md5sum, sha1sum, sha224sum, sha256sum
  * sha384sum, sha512sum, librewold-nightly, Quodlibet, tmux, sway
  * alienarena, alienarena-wrapper, ballbuster, ballbuster-wrapper,
  * colorful, colorful-wrapper, gl-117, gl-117-wrapper, glaxium,
  * glaxium-wrapper, pinball, pinball-wrapper, etr-wrapper, firedragon
  * neverball-wrapper, neverputt-wrapper, supertuxkart-wrapper, neochat,
  * cargo, LibreCAD, blobby, funnyboat, pipe-viewer, gtk-pipe-viewer
  * links2, xlinks2, googler, ddgr, tin
 -- netblue30 <netblue30@yahoo.com>  Mon, 28 Jun 2021 09:00:00 -0500

firejail (0.9.64.4) baseline; urgency=low
  * disabled overlayfs, pending multiple fixes (CVE-2021-26910)
 -- netblue30 <netblue30@yahoo.com>  Sun, 7 Feb 2021 09:00:00 -0500

firejail (0.9.64.2) baseline; urgency=low
  * allow --tmpfs inside $HOME for unprivileged users
  * --disable-usertmpfs compile time option
  * allow AF_BLUETOOTH via --protocol=bluetooth
  * Setup guide for new users: contrib/firejail-welcome.sh
  * implement netns in profiles
  * added nolocal6.net IPv6 network filter
  * new profiles: spectacle, chromium-browser-privacy, gtk-straw-viewer
  * new profiles: gtk-youtube-viewer, gtk2-youtube-viewer, gtk3-youtube-viewer
  * new profiles: straw-viewer, lutris, dolphin-emu, authenticator-rs, servo
  * new profiles: npm, marker, yarn, lsar, unar, agetpkg, mdr, shotwell, qnapi
  * new profiles: guvcview, pkglog, kdiff3, CoyIM
 -- netblue30 <netblue30@yahoo.com>  Tue, 26 Jan 2021 09:00:00 -0500

firejail (0.9.64) baseline; urgency=low
  * replaced --nowrap option with --wrap in firemon
  * The blocking action of seccomp filters has been changed from
    killing the process to returning EPERM to the caller. To get the
    previous behaviour, use --seccomp-error-action=kill or
    syscall:kill syntax when constructing filters, or override in
    /etc/firejail/firejail.config file.
  * Fine-grained D-Bus sandboxing with xdg-dbus-proxy.
    xdg-dbus-proxy must be installed, if not D-Bus access will be allowed.
    With this version nodbus is deprecated, in favor of dbus-user none and
    dbus-system none and will be removed in a future version.
  * DHCP client support
  * firecfg only fix dektop-files if started with sudo
  * SELinux labeling support
  * custom 32-bit seccomp filter support
  * restrict ${RUNUSER} in several profiles
  * blacklist shells such as bash in several profiles
  * whitelist globbing
  * mkdir and mkfile support for /run/user directory
  * support ignore for include
  * --include on the command line
  * splitting up media players whitelists in whitelist-players.inc
  * new condition: HAS_NOSOUND
  * new profiles: gfeeds, firefox-x11, tvbrowser, rtv, clipgrab, muraster
  * new profiles: gnome-passwordsafe, bibtex, gummi, latex, mupdf-x11-curl
  * new profiles: pdflatex, tex, wpp, wpspdf, wps, et, multimc, mupdf-x11
  * new profiles: gnome-hexgl, com.github.johnfactotum.Foliate, mupdf-gl, mutool
  * new profiles: desktopeditors, impressive, planmaker18, planmaker18free
  * new profiles: presentations18, presentations18free, textmaker18, teams
  * new profiles: textmaker18free, xournal, gnome-screenshot, ripperX
  * new profiles: sound-juicer, com.github.dahenson.agenda, gnome-pomodoro
  * new profiles: gnome-todo, x2goclient, iagno, kmplayer, penguin-command
  * new profiles: frogatto, gnome-mines, gnome-nibbles, lightsoff, warmux
  * new profiles: ts3client_runscript.sh, ferdi, abiword, four-in-a-row
  * new profiles: gnome-mahjongg, gnome-robots, gnome-sudoku, gnome-taquin
  * new profiles: gnome-tetravex, blobwars, gravity-beams-and-evaporating-stars
  * new profiles: hyperrogue, jumpnbump-menu, jumpnbump, magicor, mindless
  * new profiles: mirrormagic, mrrescue, scorched3d-wrapper, scorchwentbonkers
  * new profiles: seahorse-adventures, wordwarvi, xbill, gnome-klotski
  * new profiles: swell-foop, fdns, five-or-more, steam-runtime
  * new profiles: nicotine, plv, mocp, apostrophe, quadrapassel, dino-im
  * new profiles: hitori, bijiben, gnote, gnubik, ZeGrapher, xonotic-sdl-wrapper
  * new profiles: gapplication, openarena_ded, element-desktop, cawbird
  * new profiles: freetube, strawberry, jitsi-meet-desktop
  * new profiles: homebank, mattermost-desktop, newsflash, com.gitlab.newsflash
  * new profiles: sushi, xfce4-screenshooter, org.gnome.NautilusPreviewer, lyx
  * new profiles: minitube, nuclear, mtpaint, minecraft-launcher, gnome-calendar
  * new profiles: vmware, git-cola, otter-browser, kazam, menulibre, musictube
  * new profiles: onboard, fractal, mirage, quaternion, spectral, man, psi
  * new profiles: smuxi-frontend-gnome, balsa, kube, trojita, youtube
  * new profiles: youtubemusic-nativefier, cola, dbus-send, notify-send
  * new profiles: qrencode, ytmdesktop, twitch
  * new profiles: xournalpp, chromium-freeworld, equalx
 -- netblue30 <netblue30@yahoo.com>  Wed, 21 Oct 2020 08:00:00 -0500

firejail (0.9.62) baseline; urgency=low
  * added file-copy-limit in /etc/firejail/firejail.config
  * profile templates (/usr/share/doc/firejail)
  * allow-debuggers support in profiles
  * several seccomp enhancements
  * compiler flags autodetection
  * move chroot entirely from path based to file descriptor based mounts
  * whitelisting /usr/share in a large number of profiles
  * new scripts in contrib: gdb-firejail.sh and sort.py
  * enhancement: whitelist /usr/share in some profiles
  * added signal mediation to apparmor profile
  * new conditions: HAS_X11, HAS_NET
  * new profiles: qgis, klatexformula, klatexformula_cmdl, links, xlinks
  * new profiles: pandoc, teams-for-linux, OpenArena, gnome-sound-recorder
  * new profiles: godot, tcpdump, tshark, newsbeuter, keepassxc-cli
  * new profiles: keepassxc-proxy, rhythmbox-client, jerry, zeal, mpg123
  * new profiles: conplay, mpg123.bin, mpg123-alsa, mpg123-id3dump, out123
  * new profiles: mpg123-jack, mpg123-nas, mpg123-openal, mpg123-oss
  * new profiles: mpg123-portaudio, mpg123-pulse, mpg123-strip, pavucontrol-qt
  * new profiles: gnome-characters, gnome-character-map, rsync, Whalebird,
  * new profiles: tor-browser (AUR), Zulip, tb-starter-wrapper, bzcat,
  * new profiles: kiwix-desktop, bzcat, zstd, pzstd, zstdcat, zstdgrep, zstdless
  * new profiles: zstdmt, unzstd, i2p, ar, gnome-latex, pngquant, kalgebra
  * new profiles: kalgebramobile, signal-cli, amuled, kfind, profanity
  * new profiles: audio-recorder, cameramonitor, ddgtk, drawio, unf, gmpc
  * new profiles: electron-mail, gist, gist-paste
 -- netblue30 <netblue30@yahoo.com>  Sat, 28 Dec 2019 08:00:00 -0500

firejail (0.9.60) baseline; urgency=low
  * security bug reported by Austin Morton:
    Seccomp filters are copied into /run/firejail/mnt, and are writable
    within the jail. A malicious process can modify files from inside the
    jail. Processes that are later joined to the jail will not have seccomp
    filters applied.
  * memory-deny-write-execute now also blocks memfd_create
  * add private-cwd option to control working directory within jail
  * blocking system D-Bus socket with --nodbus
  * bringing back Centos 6 support
  * drop support for flatpak/snap packages
  * new profiles: crow, nyx, mypaint, celluoid, nano, transgui, mpdris2
  * new profiles: sysprof, simplescreenrecorder, geekbench, xfce4-mixer
  * new profiles: pavucontrol, d-feet, seahorse, secret-tool, gnome-keyring
  * new profiles: regextester, hardinfo, gnome-system-log, gnome-nettool
  * new profiles: netactview, redshift, devhelp, assogiate, subdownloader
  * new profiles: font-manager, exfalso, gconf-editor, dconf-editor
  * new profiles: sysprof-cli, seahorse-tool, secret-tool, dconf, gsettings
  * new profiles: code-oss, pragha, Maelstrom, ostrichriders, bzflag
  * new profiles: freeciv, lincity-ng, megaglest, openttd, crawl, crawl-tiles
  * new profiles: teeworlds, torcs, tremulous, warsow, lugaru, manaplus
  * new profiles: pioneer, scorched3d, widelands, freemind, kid3, kid3-qt
  * new profiles: kid3-cli, nomacs, freecol, opencity, openclonk, slashem
  * new profiles: vultureseye, vulturesclaw, anki, cheese, utox, mp3splt
  * new profiles: oggsplt, flacsplt, gramps, newsboat, freeoffice-planmaker
  * new profiles: autokey-gtk, autokey-qt, autokey-run, autokey-shell
  * new profiles: freeoffice-presentations, freeoffice-textmaker, mp3wrap
  * new profiles: inkview, meteo-qt, mp3splt-gtk, ktouch, yelp, cantata
 -- netblue30 <netblue30@yahoo.com>  Sun, 26 May 2019 08:00:00 -0500

firejail (0.9.58,2) baseline; urgency=low
  * cgroup flag in /etc/firejail/firejail.config file
  * name-change flag in /etc/firejail.config file
  * --name rework
  * new profiles: klavaro, vscodium
  * browser profiles fixes
  * various other bugfixes
 -- netblue30 <netblue30@yahoo.com>  Fri, 8 Feb 2019 08:00:00 -0500

firejail (0.9.58) baseline; urgency=low
  * --disable-mnt rework
  * --net.print command
  * GitLab CI/CD integration: disto specific builds
  * profile parser enhancements and conditional handling support
     for HAS_APPIMAGE, HAS_NODBUS, BROWSER_DISABLE_U2F
  * profile name support
  * added explicit nonewprivs support to join option
  * new profiles: QMediathekView, aria2c, Authenticator, checkbashisms
  * new profiles: devilspie, devilspie2, easystroke, github-desktop, min
  * new profiles: bsdcat, bsdcpio, bsdtar, lzmadec, lbunzip2, lbzcat
  * new profiles: lbzip2, lzcat, lzcmp, lzdiff, lzegrep, lzfgrep, lzgrep
  * new profiles: lzless, lzma, lzmainfo, lzmore, unlzma, unxz, xzcat
  * new profiles: xzcmp, xzdiff, xzegrep, xzfgrep, xzgrep, xzless, xzmore
  * new profiles: lzip, artha, nitroshare, nitroshare-cli, nitroshare-nmh
  * new profiles: nirtoshare-send, nitroshare-ui, mencoder, gnome-pie
  * new profiles: masterpdfeditor, QOwnNotes, aisleriot, Mendeley
  * new profiles: feedreader, ocenaudio, mpsyt, thunderbird-wayland
  * new profiles: supertuxkart, ghostwriter, gajim-history-manager
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Sat, 26 Jan 2019 08:00:00 -0500

firejail (0.9.56) baseline; urgency=low
  * modif: removed CFG_CHROOT_DESKTOP configuration option
  * modif: removed compile time --enable-network=restricted
  * modif: removed compile time --disable-bind
  * modif: --net=none allowed even if networking was disabled at compile
     time or at run time
  * modif: allow system users to run the sandbox
  * support wireless devices in --net option
  * support tap devices in --net option (tunneling support)
  * allow IP address configuration if the parent interface specified
     by --net is not configured (--netmask)
  * support for firetunnel utility
  * disable U2F devices (--nou2f)
  * add --private-cache to support private ~/.cache
  * support full paths in private-lib
  * globbing support in private-lib
  * support for local user directories in firecfg (--bindir)
  * new profiles: ms-excel, ms-office, ms-onenote, ms-outlook, ms-powerpoint,
  * new profiles: ms-skype, ms-word, riot-desktop, gnome-mpv, snox, gradio,
  * new profiles: standardnotes-desktop, shellcheck, patch, flameshot,
  * new profiles: rview, rvim, vimcat, vimdiff, vimpager, vimtutor, xxd,
  * new profiles: Beaker, electrum, clamtk, pybitmessage, dig, whois,
  * new profiles: jdownloader, Fluxbox, Blackbox, Awesome, i3
  * new profiles: start-tor-browser.desktop
 -- netblue30 <netblue30@yahoo.com>  Tue, 18 Sep 2018 08:00:00 -0500

firejail (0.9.54) baseline; urgency=low
  * modif: --force removed
  * modif: --csh, --zsh removed
  * modif: --debug-check-filename removed
  * modif: --git-install and --git-uninstall removed
  * modif: support for private-bin, private-lib and shell none has been
     disabled while running AppImage archives in order to be able to use
     our regular profile files with AppImages.
  * modif: restrictions for /proc, /sys and /run/user directories
     are moved from AppArmor profile into firejail executable
  * modif: unifying Chromium and Firefox browsers profiles.
     All users of Firefox-based browsers who use addons and plugins
     that read/write from ${HOME} will need to uncomment the includes for
     firefox-common-addons.inc in firefox-common.profile.
  * modif: split disable-devel.inc into disable-devel and
     disable-interpreters.inc
  * Firejail user access database (/etc/firejail/firejail.users,
     man firejail-users)
  * add --noautopulse to disable automatic ~/.config/pulse (for complex setups)
  * Spectre mitigation patch for gcc and clang compiler
  * D-Bus handling (--nodbus)
  * AppArmor support for overlayfs and chroot sandboxes
  * AppArmor support for AppImages
  * Enable AppArmor by default for a large number of programs
  * firejail --apparmor.print option
  * firemon --apparmor option
  * apparmor yes/no flag in /etc/firejail/firejail.config
  * seccomp syscall list update for glibc 2.26-10
  * seccomp disassembler for --seccomp.print option
  * seccomp machine code optimizer for default seccomp filters
  * IPv6 DNS support
  * whitelist support for overlay and chroot sandboxes
  * private-dev support for overlay and chroot sandboxes
  * private-tmp support for overlay and chroot sandboxes
  * added sandbox name support in firemon
  * firemon/prctl enhancements
  * noblacklist support for /sys/module directory
  * whitelist support for /sys/module directory
  * new profiles: basilisk, Tor Browser language packs, PlayOnLinux, sylpheed,
  * new profiles: discord-canary, pycharm-community, pycharm-professional,
  * new profiles: pdfchain, tilp, vivaldi-snapshot, bitcoin-qt, kaffeine,
  * new profiles: falkon, gnome-builder, asunder, VS Code, gnome-recipes,
  * new profiles: akonadi_controle, evince-previewer, evince-thumbnailer,
  * new profiles: blender-2.8, thunderbird-beta, ncdu, gnome-logs, gcloud,
  * new profiles: musixmatch, gunzip, bunzip2, enchant-lsmod, enchant-lsmod-2,
  * new profiles: enchant, enchant-2, Discord, acat, adiff, als, apack,
  * new profiles: arepack, aunpack profiles, ppsspp, scallion, clion,
  * new profiles: baloo_filemetadata_temp_extractor, AnyDesk, webstorm, xmind,
  * new profiles: qmmp, sayonara
 -- netblue30 <netblue30@yahoo.com>  Wed, 16 May 2018 08:00:00 -0500

firejail (0.9.52) baseline; urgency=low
  * modif: --allow-private-blacklists was deprecated; blacklisting,
    read-only, read-write, tmpfs and noexec are allowed in
    private home directories
  * modif: remount-proc-sys deprecated from firejail.config
  * modif: follow-symlink-private-bin deprecated from firejail.config
  * modif: --profile-path was deprecated
  * enhancement: support Firejail user config directory in firecfg
  * enhancement: disable DBus activation in firecfg
  * enhancement; enumerate root directories in apparmor profile
  * enhancement: /etc and /usr/share whitelisting support
  * enhancement: globbing support for --private-bin
  * feature: systemd-resolved integration
  * feature: whitelisting /var directory in most profiles
  * feature: GTK2, GTK3 and Qt4 private-lib support
  * feature: --debug-private-lib
  * feature: test deployment of private-lib for the following
    applications: evince, galculator, gnome-calculator,
    leafpad, mousepad, transmission-gtk, xcalc, xmr-stak-cpu,
    atril, mate-color-select, tar, file, strings, gpicview,
    eom, eog, gedit, pluma
  * feature: --writable-run-user
  * feature: --rlimit-as
  * feature: --rlimit-cpu
  * feature: --timeout
  * feature: profile build tool (--build)
  * feature: --netfilter.print
  * feature: --netfilter6.print
  * feature: netfilter template support
  * new profiles: upstreamed many profiles from the following sources:
     https://github.com/chiraag-nataraj/firejail-profiles,
     https://github.com/nyancat18/fe,
     https://aur.archlinux.org/packages/firejail-profiles.
  * new profiles: terasology, surf, rocketchat, clamscan, clamdscan,
      clamdtop, freshclam, xmr-stak-cpu, amule, ardour4, ardour5,
      brackets, calligra, calligraauthor, calligraconverter, calligraflow,
      calligraplan, calligraplanwork, calligrasheets, calligrastage,
      calligrawords, cin, dooble, dooble-qt4, fetchmail, freecad, freecadcmd,
      google-earth,imagej, karbon, kdenlive, krita, linphone, lmms, macrofusion,
      mpd, natron, Natron, ricochet, shotcut, teamspeak3, tor, tor-browser-en,
      Viber, x-terminal-emulator, zart, conky, arch-audit, ffmpeg, bluefish,
      cinelerra, openshot-qt, pinta, uefitool, aosp, pdfmod, gnome-ring,
      xcalc, zaproxy, kopete, cliqz, signal-desktop, kget, nheko, Enpass,
      kwin_x11, krunner, ping, bsdtar, makepkg (Arch), archaudit-report
      cower (Arch), kdeinit4
 -- netblue30 <netblue30@yahoo.com>  Thu, 7 Dec 2017 08:00:00 -0500

firejail (0.9.50) baseline; urgency=low
  * modif: --output split in two commands, --output and --output-stderr
  * feature: per-profile disable-mnt (--disable-mnt)
  * feature: per-profile support to set X11 Xephyr screen size (--xephyr-screen)
  * feature: private /lib directory (--private-lib)
  * feature: disable CDROM/DVD drive (--nodvd)
  * feature: disable DVB devices (--notv)
  * feature: --profile.print
  * enhancement: print all seccomp filters under --debug
  * enhancement: /proc/sys mounting
  * enhancement: rework IP address assignment for --net options
  * enhancement: support for newer Xpra versions (2.1+) -
     set xpra-attach yes in /etc/firejail/firejail.config
  * enhancement: all profiles use a standard layout style
  * enhancement: create /usr/local for firecfg if the directory doesn't exist
  * enhancement: allow full paths in --private-bin
  * seccomp feature: --memory-deny-write-execute
  * seccomp feature: seccomp post-exec
  * seccomp feature: block secondary architecture (--seccomp.block_secondary)
  * seccomp feature: seccomp syscall groups
  * seccomp enhancement: print all seccomp filters under --debug
  * seccomp enhancement: default seccomp list update
  * new profiles: curl, mplayer2, SMPlayer, Calibre, ebook-viewer, KWrite,
  * new profiles: Geary, Liferea, peek, silentarmy, IntelliJ IDEA,
  * new profiles: Android Studio, electron, riot-web, Extreme Tux Racer,
  * new profiles: Frozen Bubble, Open Invaders, Pingus, Simutrans, SuperTux
  * new profiles: telegram-desktop, arm, rambox, apktool, baobab, dex2jar, gitg,
  * new profiles: hashcat, obs, picard, remmina, sdat2img, soundconverter
  * new profiles: truecraft, gnome-twitch, tuxguitar, musescore, neverball
  * new profiles: sqlitebrowse, Yandex Browser, minetest
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Sat, 30 Sep 2017 08:00:00 -0500

firejail (0.9.50~rc1) baseline; urgency=low
  * release pending!
  * modif: --output split in two commands, --output and --output-stderr
  * feature: per-profile disable-mnt (--disable-mnt)
  * feature: per-profile support to set X11 Xephyr screen size (--xephyr-screen)
  * feature: private /lib directory (--private-lib)
  * feature: disable CDROM/DVD drive (--nodvd)
  * feature: disable DVB devices (--notv)
  * feature: --profile.print
  * enhancement: print all seccomp filters under --debug
  * enhancement: /proc/sys mounting
  * enhancement: rework IP address assignment for --net options
  * enhancement: support for newer Xpra versions (2.1+) -
     set xpra-attach yes in /etc/firejail/firejail.config
  * enhancement: all profiles use a standard layout style
  * enhancement: create /usr/local for firecfg if the directory doesn't exist
  * enhancement: allow full paths in --private-bin
  * seccomp feature: --memory-deny-write-execute
  * seccomp feature: seccomp post-exec
  * seccomp feature: block secondary architecture (--seccomp.block_secondary)
  * seccomp feature: seccomp syscall groups
  * seccomp enhancement: print all seccomp filters under --debug
  * seccomp enhancement: default seccomp list update
  * new profiles: curl, mplayer2, SMPlayer, Calibre, ebook-viewer, KWrite,
  * new profiles: Geary, Liferea, peek, silentarmy, IntelliJ IDEA,
  * new profiles: Android Studio, electron, riot-web, Extreme Tux Racer,
  * new profiles: Frozen Bubble, Open Invaders, Pingus, Simutrans, SuperTux
  * new profiles: telegram-desktop, arm, rambox, apktool, baobab, dex2jar, gitg,
  * new profiles: hashcat, obs, picard, remmina, sdat2img, soundconverter
  * new profiles: truecraft, gnome-twitch, tuxguitar, musescore, neverball
  * new profiles: sqlitebrowse, Yandex Browser, minetest
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Mon, 12 Jun 2017 20:00:00 -0500

firejail (0.9.48) baseline; urgency=low
  * modifs: whitelisted Transmission, Deluge, qBitTorrent, KTorrent;
    please use ~/Downloads directory for saving files
  * modifs: AppArmor made optional; a warning is printed on the screen
    if the sandbox fails to load the AppArmor profile
  * feature: --novideo
  * feature: drop discretionary access control capabilities for
    root sandboxes
  * feature: added /etc/firejail/globals.local for global customizations
  * feature: profile support in overlayfs mode
  * new profiles: vym, darktable, Waterfox, digiKam, Catfish, HandBrake
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Mon, 12 Jun 2017 08:00:00 -0500

firejail (0.9.46) baseline; urgency=low
  * security: split most of networking code in a separate executable
  * security: split seccomp filter code configuration in a separate executable
  * security: split file copying in private option in a separate executable
  * feature: disable gnupg and systemd directories under /run/user
  * feature: test coverage (gcov) support
  * feature: allow root user access to /dev/shm (--noblacklist=/dev/shm)
  * feature: private /opt directory (--private-opt, profile support)
  * feature: private /srv directory (--private-srv, profile support)
  * feature: spoof machine-id (--machine-id, profile support)
  * feature: allow blacklists under --private (--allow-private-blacklist,
    profile support)
  * feature: user-defined /etc/hosts file (--hosts-file, profile support)
  * feature: support for the real /var/log directory (--writable-var-log,
    profile support)
  * feature: config support for firejail prompt in terminals
  * feature: AppImage type 2 support
  * feature: pass command line arguments to appimages
  * feature: allow non-seccomp setup for OverlayFS sandboxes - more work to come
  * feature: added a number of Python scripts for handling sandboxes
  * feature: allow local customization using .local files under /etc/firejail
  * feature: follow-symlink-as-user runtime config option in
    /etc/firejail/firejail.config
  * feature: follow-symlink-private-bin option in /etc/firejail/firejail.config
  * feature: xvfb X11 server support (--x11=xvfb)
  * feature: allow /tmp directory in mkdir and mkfile profile commands
  * feature: implemented --noblacklist command, profile support
  * feature: config support to disable access to /mnt and /media (disable-mnt)
  * feature: config support to disable join (join)
  * feature: disabled Go, Rust, and OpenSSL in disable-devel.conf
  * feature: support overlay, overlay-named and overlay-tmpfs in profile files
  * feature: allow PulseAudio sockets in --private-tmp
  * feature: --fix-sound support in firecfg
  * feature: added support for sandboxing Xpra, Xvfb and Xephyr in
    independent sandboxes when started with firejail --x11
  * feature: enable automatic X server sandboxing for --x11=xpra
    and --x11=xephyr
  * feature: support for Xpra extra params in firejail config file
  * new profiles: xiphos, Tor Browser Bundle, display (imagemagick), Wire,
  * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma,
  * new profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator,
  * new profiles: Gnome Contacts, JD-GUI, Lollypop, MultiMC5, PDFSam, Pithos,
  * new profiles: Xonotic, wireshark, keepassx2, QupZilla, FossaMail,
  * new profiles: Uzbl browser, iridium browser, Thunar, Geeqie, Engrampa,
  * new profiles: Scribus, mousepad, gpicview, keepassxc, cvlc, MediathekView,
  * new profiles: baloo_file, Nylas, dino, BibleTime, viewnior, Kodi, viking,
  * new profiles: youtube-dl, meld, Arduino, Akregator, KCalc, KTorrent,
  * new profiles: Orage Globaltime, Orage Clendar, xfce4-notes, xfce4-dict,
  * new profiles: Ristretto, PCManFM, Dia, FontForge, Geany, Hugin,
  * new profiles: mate-calc, mate-dictionary, mate-color-select, caja,
  * new profiles: galculator, Nemo, gnome-font-viewer, gucharmap, knotes
  * new profiles: clipit, leafpad, lximage-qt, lxmusic, qlipper, Xvfb, Xephyr
  * new profiles: Blender, 2048-qt
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Sun, 14 May 2017 08:00:00 -0500

firejail (0.9.44.10) baseline; urgency=low
  * security: when using --x11=xorg and --net, incorrect processing of
    the return code of /usr/bin/xauth could end up in starting the
    sandbox without X11 security extension installed. Problem found/fixed
    by Zack Weinberg
  * bugfix: ~/.pki directory whitelisted and later blacklisted. This affects
    most browsers, and disables the custom certificates installed by the user
  * bugfix: firecfg config fix
  * bugfix: gajim security profile fix
  * bugfix: man page fix
  * bugfix: force-nonewprivs fix for /etc/firejail/firejail.config
  * bugfix: xephyr-extra-params fix for /etc/firejail/firejail.config
  * bugfix: memory corruption in noblacklist processing
  * bugfix: --quiet fix for Arch and Fedora systems
  * bugfix: updated Keepass(x) profiles
  * bugfix: firemon --nowrap problem
  * bugfix: document firemon --nowrap in man page and in --help option
  * bugfix: bash completion for --noblacklist command
  * bugfix: vlc profile fix
  * bugfix: fixed handling of .local profile files when the software is
    installed in ~/.local directory
  * bugfix: temporarily remove private-tmp from all profiles, until a fix for
    .Xauthority file handling in KDE becomes available
  * maintenance: --output cleanup
  * maintenance: updated copyright statement in all files
 -- netblue30 <netblue30@yahoo.com>  Sat, 18 Mar 2017 10:00:00 -0500

firejail (0.9.44.8) baseline; urgency=low
  * bugfix: fix broken PulseAudio support
 -- netblue30 <netblue30@yahoo.com>  Wed, 18 Jan 2017 10:00:00 -0500

firejail (0.9.44.6) baseline; urgency=low
  * security: new fix for CVE-2017-5180 reported by Sebastian Krahmer last week,
     new CVE code assigned after release: CVE-2017-5940
  * security: major cleanup of file copying code
  * security: tightening the rules for --chroot and --overlay features
  * bugfix: ported Gentoo compile patch
  * bugfix: Nvidia drivers bug in --private-dev
  * bugfix: fix ASSERT_PERMS_FD macro
  * feature: allow local customization using .local files under /etc/firejail
    backported from our development branch
  * feature: spoof machine-id backported from our development branch
 -- netblue30 <netblue30@yahoo.com>  Sun, 15 Jan 2017 10:00:00 -0500

firejail (0.9.44.4) baseline; urgency=low
  * security: --bandwidth root shell found by Martin Carpenter (CVE-2017-5207)
  * security: disabled --allow-debuggers when running on kernel
    versions prior to 4.8; a kernel bug in ptrace system call
    allows a full bypass of seccomp filter; problem reported by Lizzie Dixon
    (CVE-2017-5206)
  * security: root exploit found by Sebastian Krahmer (CVE-2017-5180)
 -- netblue30 <netblue30@yahoo.com>  Sat, 7 Jan 2017 10:00:00 -0500

firejail (0.9.44.2) baseline; urgency=low
  * security: overwrite /etc/resolv.conf found by Martin Carpenter (CVE-2016-10118)
  * security: TOCTOU exploit for --get and --put found by Daniel Hodson
  * security: invalid environment exploit found by Martin Carpenter (CVE-2016-10122)
  * security: several security enhancements
  * bugfix: crashing VLC by pressing Ctrl-O
  * bugfix: use user configured icons in KDE
  * bugfix: mkdir and mkfile are not applied to private directories
  * bugfix: cannot open files on Deluge running under KDE
  * bugfix: --private=dir where dir is the user home directory
  * bugfix: cannot start Vivaldi browser
  * bugfix: cannot start mupdf
  * bugfix: ssh profile problems
  * bugfix: --quiet
  * bugfix: quiet in git profile
  * bugfix: memory corruption
 -- netblue30 <netblue30@yahoo.com>  Fri, 2 Dec 2016 08:00:00 -0500

firejail (0.9.44) baseline; urgency=low
  * CVE-2016-9016 submitted by Aleksey Manevich
  * modifs: removed man firejail-config
  * modifs: --private-tmp whitelists /tmp/.X11-unix directory
  * modifs: Nvidia drivers added to --private-dev
  * modifs: /srv supported by --whitelist
  * feature: allow user access to /sys/fs (--noblacklist=/sys/fs)
  * feature: support starting/joining sandbox is a single command
    (--join-or-start)
  * feature: X11 detection support for --audit
  * feature: assign a name to the interface connected to the bridge
    (--veth-name)
  * feature: all user home directories are visible (--allusers)
  * feature: add files to sandbox container (--put)
  * feature: blocking x11 (--x11=block)
  * feature: X11 security extension (--x11=xorg)
  * feature: disable 3D hardware acceleration (--no3d)
  * feature: x11 xpra, x11 xephyr, x11 block, allusers, no3d profile commands
  * feature: move files in sandbox (--put)
  * feature: accept wildcard patterns in user name field of restricted
    shell login feature
  * new profiles: qpdfview, mupdf, Luminance HDR, Synfig Studio, Gimp, Inkscape
  * new profiles: feh, ranger, zathura, 7z, keepass, keepassx,
  * new profiles: claws-mail, mutt, git, emacs, vim, xpdf, VirtualBox, OpenShot
  * new profiles: Flowblade, Eye of GNOME (eog), Evolution
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Fri, 21 Oct 2016 08:00:00 -0500

firejail (0.9.42) baseline; urgency=low
  * security: --whitelist deleted files, submitted by Vasya Novikov
  * security: disable x32 ABI in seccomp, submitted by Jann Horn
  * security: tighten --chroot, submitted by Jann Horn
  * security: terminal sandbox escape, submitted by Stephan Sokolow
  * security: several TOCTOU fixes submitted by Aleksey Manevich
  * modifs: bringing back --private-home option
  * modifs: deprecated --user option, please use "sudo -u username firejail"
  * modifs: allow symlinks in home directory for --whitelist option
  * modifs: Firejail prompt is enabled by env variable FIREJAIL_PROMPT="yes"
  * modifs: recursive mkdir
  * modifs: include /dev/snd in --private-dev
  * modifs: seccomp filter update
  * modifs: release archives moved to .xz format
  * feature: AppImage support (--appimage)
  * feature: AppArmor support (--apparmor)
  * feature: Ubuntu snap support (/etc/firejail/snap.profile)
  * feature: Sandbox auditing support (--audit)
  * feature: remove environment variable (--rmenv)
  * feature: noexec support (--noexec)
  * feature: clean local overlay storage directory (--overlay-clean)
  * feature: store and reuse overlay (--overlay-named)
  * feature: allow debugging inside the sandbox with gdb and strace
         (--allow-debuggers)
  * feature: mkfile profile command
  * feature: quiet profile command
  * feature: x11 profile command
  * feature: option to fix desktop files (firecfg --fix)
  * compile time: Busybox support (--enable-busybox-workaround)
  * compile time: disable overlayfs (--disable-overlayfs)
  * compile time: disable whitelisting (--disable-whitelist)
  * compile time: disable global config (--disable-globalcfg)
  * run time: enable/disable overlayfs (overlayfs yes/no)
  * run time: enable/disable quiet as default (quiet-by-default yes/no)
  * run time: user-defined network filter (netfilter-default)
  * run time: enable/disable whitelisting (whitelist yes/no)
  * run time: enable/disable remounting of /proc and /sys
          (remount-proc-sys yes/no)
  * run time: enable/disable chroot desktop features (chroot-desktop yes/no)
  * profiles: Gitter, gThumb, mpv, Franz messenger, LibreOffice
  * profiles: pix, audacity, xz, xzdec, gzip, cpio, less
  * profiles: Atom Beta, Atom, jitsi, eom, uudeview
  * profiles: tar (gtar), unzip, unrar, file, skypeforlinux,
  * profiles: inox, Slack, gnome-chess. Gajim IM client, DOSBox
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Thu, 8 Sept 2016 08:00:00 -0500

firejail (0.9.40) baseline; urgency=low
  * added --nice option
  * added --x11 option
  * added --x11=xpra option
  * added --x11=xephyr option
  * added --cpu.print option
  * added filetransfer options --ls and --get
  * added --writable-etc and --writable-var options
  * added --read-only option
  * added mkdir, ipc-namespace, and nosound profile commands
  * added net, ip, defaultgw, ip6, mac, mtu and iprange profile commands
  * --version also prints compile options
  * --output option also redirects stderr
  * added compile-time option to restrict --net= to root only
  * run time config support, man firejail-config
  * added firecfg utility
  * AppArmor fixes
  * default seccomp filter update
  * disable STUN/WebRTC in default netfilter configuration
  * new profiles: lxterminal, Epiphany, cherrytree, Polari, Vivaldi, Atril
  * new profiles: qutebrowser, SlimJet, Battle for Wesnoth, Hedgewars
  * new profiles: qTox, OpenSSH client, OpenBox, Dillo, cmus, dnsmasq
  * new profiles: PaleMoon, Icedove, abrowser, 0ad, netsurf, Warzone2100
  * new profiles: okular, gwenview, Google-Play-Music-Desktop-Player
  * new profiles: Aweather, Stellarium, gpredict, quiterss, cyberfox
  * new profiles: generic Ubuntu snap application profile, xplayer
  * new profiles: xreader, xviewer, mcabber, Psi+, Corebird, Konversation
  * new profiles: Brave, Gitter
  * generic.profile renamed default.profile
  * build rpm packages using "make rpms"
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Sun, 29 May 2016 08:00:00 -0500

firejail (0.9.38.10) baseline; urgency=low
  * security: new fix for CVE-2017-5180 reported by Sebastian Krahmer last week
     new CVE code assigned after release: CVE-2017-5940
  * security: tightening the rules for --chroot
  * bugfix: ported Gentoo compile patch
  * bugfix: fix ASSERT_PERMS_FD macro
 -- netblue30 <netblue30@yahoo.com>  Sun, 15 Jan 2017 10:00:00 -0500

firejail (0.9.38.8) baseline; urgency=low
  * security: root exploit found by Sebastian Krahmer (CVE-2017-5180)
 -- netblue30 <netblue30@yahoo.com>  Sat, 7 Jan 2017 10:00:00 -0500

firejail (0.9.38.6) baseline; urgency=low
  * security: overwrite /etc/resolv.conf found by Martin Carpenter (CVE-2016-10118)
  * bugfix: crashing VLC by pressing Ctrl-O
 -- netblue30 <netblue30@yahoo.com>  Fri, 16 Dec 2016 10:00:00 -0500

firejail (0.9.38.4) baseline; urgency=low
  * CVE-2016-7545 submitted by Aleksey Manevich
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Mon, 10 Oct 2016 10:00:00 -0500

firejail (0.9.38.2) baseline; urgency=low
  * security: --whitelist deleted files, submitted by Vasya Novikov
  * security: disable x32 ABI, submitted by Jann Horn
  * security: tighten --chroot, submitted by Jann Horn
  * security: terminal sandbox escape, submitted by Stephan Sokolow
  * feature: clean local overlay storage directory (--overlay-clean)
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Tue, 23 Aug 2016 10:00:00 -0500

firejail (0.9.38) baseline; urgency=low
  * IPv6 support (--ip6 and --netfilter6)
  * --join command enhancement (--join-network, --join-filesystem)
  * added --user command
  * added --disable-network and --disable-userns compile time flags
  * Centos 6 support
  * symlink invocation
  * added KMail, Seamonkey, Telegram, Mathematica, uGet,
  *   and mupen64plus profiles
  * --chroot in user mode allowed only if seccomp support is available
  *   in current Linux kernel (CVE-2016-10123)
  * deprecated --private-home feature
  * the first protocol list installed takes precedence
  * --tmpfs option allowed only running as root (CVE-2016-10117)
  * added --private-tmp option
  * weak permissions (CVE-2016-10119, CVE-2016-10120, CVE-2016-10121)
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Tue, 2 Feb 2016 10:00:00 -0500

firejail (0.9.36) baseline; urgency=low
  * added unbound, dnscrypt-proxy, BitlBee, HexChat, WeeChat,
     parole and rtorrent profiles
  * Google Chrome profile rework
  * added google-chrome-stable profile
  * added google-chrome-beta profile
  * added google-chrome-unstable profile
  * Opera profile rework
  * added opera-beta profile
  * added --noblacklist option
  * added --profile-path option
  * added --force option
  * whitelist command enhancements
  * prevent user name enumeration
  * added /etc/firejail/nolocal.net network filter
  * added /etc/firejail/webserver.net network filter
  * blacklisting firejail configuration by default
  * allow default gateway configuration for --interface option
  * --debug enhancements: --debug-check-filenames, --debug-blacklists,
    --debug-whitelists
  * filesystem log
  * libtrace enhancements, tracing opendir call
  * added --tracelog option
  * added "name" command to profile files
  * added "hostname" command to profile files
  * added automated feature testing framework
  * Debian reproducible build
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Sun, 27 Dec 2015 09:00:00 -0500

firejail (0.9.34) baseline; urgency=low
  * added --ignore option
  * added --protocol option
  * support dual i386/amd64 seccomp filters
  * added Google Chrome profile
  * added Steam, Skype, Wine and Conkeror profiles
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Sat, 7 Nov 2015 08:00:00 -0500

firejail (0.9.32) baseline; urgency=low
  * added --interface option
  * added --mtu option
  * added --private-bin option
  * added --nosound option
  * added --hostname option
  * added --quiet option
  * added seccomp errno support
  * added FBReader default profile
  * added Spotify default profile
  * lots of default security profile changes
  * fixed a security problem on multi-user systems
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Wed, 21 Oct 2015 08:00:00 -0500


firejail (0.9.30) baseline; urgency=low
  * added a disable-history.inc profile as a result of Firefox PDF.js exploit;
    disable-history.inc included in all default profiles
  * Firefox PDF.js exploit (CVE-2015-4495) fixes
  * added --private-etc option
  * added --env option
  * added --whitelist option
  * support ${HOME} token in include directive in profile files
  * --private.keep is transitioned to --private-home
  * support ~ and blanks in blacklist option
  * support "net none" command in profile files
  * using /etc/firejail/generic.profile by default for user sessions
  * using /etc/firejail/server.profile by default for root sessions
  * added build --enable-fatal-warnings configure option
  * added persistence to --overlay option
  * added --overlay-tmpfs option
  * make install-strip implemented, make install renamed
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Mon, 14 Sept 2015 08:00:00 -0500

firejail (0.9.28) baseline; urgency=low
  * network scanning, --scan option
  * interface MAC address support, --mac option
  * IP address range, --iprange option
  * traffic shaping, --bandwidth option
  * reworked printing of network status at startup
  * man pages rework
  * added firejail-login man page
  * added GNU Icecat, FileZilla, Pidgin, XChat, Empathy, DeaDBeeF default
    profiles
  * added an /etc/firejail/disable-common.inc file to hold common directory
    blacklists
  * blacklist Opera and Chrome/Chromium config directories in profile files
  * support noroot option for profile files
  * enabled noroot in default profile files
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Sat, 1 Aug 2015 08:00:00 -0500

firejail (0.9.26) baseline; urgency=low
  * private dev directory
  * private.keep option for whitelisting home files in a new private directory
  * user namespaces support, noroot option
  * added Deluge and qBittorent profiles
  * bugfixes
 -- netblue30 <netblue30@yahoo.com>  Thu, 30 Apr 2015 08:00:00 -0500


firejail (0.9.24) baseline; urgency=low
  * whitelist and blacklist seccomp filters
  * doubledash option
  * --shell=none support
  * netfilter file support in profile files
  * dns server support in profile files
  * added --dns.print option
  * added default profiles for Audacious, Clementine, Gnome-MPlayer, Rhythmbox and Totem.
  * added --caps.drop=all in default profiles
  * new syscalls in default seccomp filter: sysfs, sysctl, adjtimex, kcmp
  *         clock_adjtime, lookup_dcookie, perf_event_open, fanotify_init
  * Bugfix: using /proc/sys/kernel/pid_max for the max number of pids
  * two build patches from Reiner Herman (tickets 11, 12)
  * man page patch from Reiner Herman (ticket 13)
  * output patch (ticket 15) from sshirokov

 -- netblue30 <netblue30@yahoo.com>  Sun, 5 Apr 2015 08:00:00 -0500

firejail (0.9.22) baseline; urgency=low
  * Replaced --noip option with --ip=none
  * Container stdout logging and log rotation
  * Added process_vm_readv, process_vm_writev and mknod to
  *    default seccomp blacklist
  * Added CAP_MKNOD to default caps blacklist
  * Blacklist and whitelist custom Linux capabilities filters
  * macvlan device driver support for --net option
  * DNS server support, --dns option
  * Netfilter support
  * Monitor network statistics, --netstats option
  * Added profile for Mozilla Thunderbird/Icedove
  * - --overlay support for Linux kernels 3.18+
  * Bugfix: preserve .Xauthority file in private mode (test with ssh -X)
  * Bugfix: check uid/gid for cgroup

 -- netblue30 <netblue30@yahoo.com>  Mon, 9 Mar 2015 09:00:00 -0500

firejail (0.9.20) baseline; urgency=low
  * utmp, btmp and wtmp enhancements
  *    create empty /var/log/wtmp and /var/log/btmp files in sandbox
  *    generate a new /var/run/utmp file in sandbox
  * CPU affinity, --cpu option
  * Linux control groups support, --cgroup option
  * Opera web browser support
  * VLC support
  * Added "empty" attribute to seccomp command to remove the default
  *    syscall list form seccomp blacklist
  * Added --nogroups option to disable supplementary groups for regular
  *   users. root user always runs without supplementary groups.
  * firemon enhancements
  *   display the command that started the sandbox
  *   added --caps option to display capabilities for all sandboxes
  *   added --cgroup option to display the control groups for all sandboxes
  *   added --cpu option to display CPU affinity for all sandboxes
  *   added --seccomp option to display seccomp setting for all sandboxes
  * New compile time options: --disable-chroot, --disable-bind
  * bugfixes

 -- netblue30 <netblue30@yahoo.com>  Mon, 02 Feb 2015 08:00:00 -0500

firejail (0.9.18) baseline; urgency=low
  * Support for tracing system, setuid, setgid, setfsuid, setfsgid syscalls
  * Support for tracing setreuid, setregid, setresuid, setresguid syscalls
  * Added profiles for transmission-gtk and transmission-qt
  * bugfixes

 -- netblue30 <netblue30@yahoo.com>  Fri, 25 Dec 2014 10:00:00 -0500

firejail (0.9.16) baseline; urgency=low
  * Configurable private home directory
  * Configurable default user shell
  * Software configuration support for --docdir and DESTDIR
  * Profile file support for include, caps, seccomp and private keywords
  * Dropbox profile file
  * Linux capabilities and seccomp filters enabled by default for Firefox,
  Midori, Evince and Dropbox
  * bugfixes

 -- netblue30 <netblue30@yahoo.com>  Tue, 4 Nov 2014 10:00:00 -0500

firejail (0.9.14) baseline; urgency=low
  * Linux capabilities and seccomp filters are automatically enabled in
    chroot mode (--chroot option) if the sandbox is started as regular user
  * Added support for user defined seccomp blacklists
  * Added syscall trace support
  * Added --tmpfs option
  * Added --balcklist option
  * Added --read-only option
  * Added --bind option
  * Logging enhancements
  * --overlay option was reactivated
  * Added firemon support to print the ARP table for each sandbox
  * Added firemon support to print the route table for each sandbox
  * Added firemon support to print interface information for each sandbox
  * bugfixes

 -- netblue30 <netblue30@yahoo.com>  Tue, 15 Oct 2014 10:00:00 -0500

firejail (0.9.12.2) baseline; urgency=low
  * Fix for pulseaudio problems
  * --overlay option was temporarily disabled in this build

 -- netblue30 <netblue30@yahoo.com>  Mon, 29 Sept 2014 07:00:00 -0500

firejail (0.9.12.1) baseline; urgency=low
  * Fix for pulseaudio problems
  * --overlay option was temporarily disabled in this build

 -- netblue30 <netblue30@yahoo.com>  Mon, 22 Sept 2014 09:00:00 -0500

firejail (0.9.12) baseline; urgency=low
  * Added capabilities support
  * Added support for CentOS 7
  * bugfixes

 -- netblue30 <netblue30@yahoo.com>  Mon, 15 Sept 2014 10:00:00 -0500

firejail (0.9.10) baseline; urgency=low
  * Disable /proc/kcore, /proc/kallsyms, /dev/port, /boot
  * Fixed --top option CPU utilization calculation
  * Implemented --tree option in firejail and firemon
  * Implemented --join=name option
  * Implemented --shutdown option
  * Preserve the current working directory if possible
  * Cppcheck and clang errors cleanup
  * Added a Chromium web browser profile

 -- netblue30 <netblue30@yahoo.com>  Thu, 28 Aug 2014 07:00:00 -0500

firejail (0.9.8.1) baseline; urgency=low
  * FIxed a number of bugs introduced in 0.9.8

 -- netblue30 <netblue30@yahoo.com>  Fri, 25 Jul 2014 07:25:00 -0500

firejail (0.9.8) baseline; urgency=low
  * Implemented nowrap mode for firejail --list command option
  * Added --top option in both firejail and firemon
  * seccomp filter support
  * Added pid support for firemon
  * bugfixes

 -- netblue30 <netblue30@yahoo.com>  Tue, 24 Jul 2014 08:51:00 -0500

firejail (0.9.6) baseline; urgency=low

  * Mounting tmpfs on top of /var/log, required by several server programs
  * Server fixes for /var/lib and /var/cache
  * Private mode fixes
  * csh and zsh default shell support
  * Chroot mode fixes
  * Added support for lighttpd, isc-dhcp-server, apache2, nginx, snmpd,

 -- netblue30 <netblue30@yahoo.com>  Sat, 7 Jun 2014 09:00:00 -0500

firejail (0.9.4) baseline; urgency=low

  * Fixed resolv.conf on Ubuntu systems using DHCP
  * Fixed resolv.conf on Debian systems using resolvconf package
  * Fixed /var/lock directory
  * Fixed /var/tmp directory
  * Fixed symbolic links in profile files
  * Added profiles for evince, midori

 -- netblue30 <netblue30@yahoo.com>  Sun, 4 May 2014 08:00:00 -0500

firejail (0.9.2) baseline; urgency=low

  * Checking IP address passed with --ip option using ARP; exit if the address
   is already present
  * Using a lock file during ARP address assignment in order to removed a race
   condition.
  * Several fixes to --private option; it also mounts a tmpfs filesystem on top
   of /tmp
  * Added user access check for profile file
  * Added --defaultgw option
  * Added support of --noip option; it is necessary for DHCP setups
  * Added syslog support
  * Added support for "tmpfs" and "read-only" profile commands
  * Added an expect-based testing framework for the project
  * Added bash completion support
  * Added support for multiple networks

 -- netblue30 <netblue30@yahoo.com>  Fri, 25 Apr 2014 08:00:00 -0500

firejail (0.9) baseline; urgency=low

  * First beta version

 -- netblue30 <netblue30@yahoo.com>  Sat, 12 Apr 2014 09:00:00 -0500