Merge branch 'master' of https://github.com/netblue30/firejail

206 files changed, 504 insertions, 236 deletions

diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 000000000..28ee1c436
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,17 @@
+If you make a PR for new profiles or changeing profiles please do the following:
+ - The ordering of options follow the rules descripted in [/usr/share/doc/firejail/profile.template](https://github.com/netblue30/firejail/blob/master/etc/templates/profile.template).  
+   Hint: The profile-template is very new, if you install firejail with your package-manager, it maybe missing, therefore, and to follow the latest rules, it is recommended to use the template from the repository.
+ - Order the arguments of options alphabetical, you can easy do this with the [sort.py](https://github.com/netblue30/firejail/tree/master/contrib/sort.py).  
+ The path to it depends on your distro:
+ 
+   | Distro | Path |
+   | ------ | ---- |
+   | Arch/Fedora | `/lib64/firejail/sort.py` |
+   | Debian/Ubuntu/Mint | `/usr/lib/x86_64-linux-gnu/firejail/sort.py` |
+   | local git clone | `contrib/sort.py` |
+
+   Note also that the sort.py script exists only since firejail `0.9.61`.
+
+If you have no idea how to do one of these, you can open the PR anyway.
+
+See also [CONTRIBUTING.md](/CONTRIBUTING.md).
diff --git a/Makefile.in b/Makefile.in
index 9d0dd69b1..9d21419bc 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -115,6 +115,7 @@ ifeq ($(HAVE_CONTRIB_INSTALL),yes)
         install -c -m 0755 contrib/fjdisplay.py $(DESTDIR)/$(libdir)/firejail/.
         install -c -m 0755 contrib/fjresize.py $(DESTDIR)/$(libdir)/firejail/.
         install -c -m 0755 contrib/fj-mkdeb.py $(DESTDIR)/$(libdir)/firejail/.
+        install -c -m 0755 contrib/sort.py $(DESTDIR)/$(libdir)/firejail/.
 endif
         # documents
         install -m 0755 -d $(DESTDIR)/$(DOCDIR)
diff --git a/README b/README
index 4d488dbae..55edc0ebe 100644
--- a/README
+++ b/README
@@ -23,9 +23,11 @@ $ git clone https://github.com/netblue30/firejail.git
 $ cd firejail
 $ ./configure && make && sudo make install-strip
 
-On Debian/Ubuntu you will need to install git and a compiler:
+On Debian/Ubuntu you will need to install git and gcc compiler. AppArmor
+development libraries and pkg-config are required when using --apparmor
+./configure option:
 
-$ sudo apt-get install build-essential
+$ sudo apt-get install git build-essential libapparmor-dev pkg-config
 
 
 
diff --git a/README.md b/README.md
index 46370e6a5..e1a79120a 100644
--- a/README.md
+++ b/README.md
@@ -45,9 +45,11 @@ $ git clone https://github.com/netblue30/firejail.git
 $ cd firejail
 $ ./configure && make && sudo make install-strip
 `````
-On Debian/Ubuntu you will need to install git and a compiler:
+On Debian/Ubuntu you will need to install git and gcc compiler. AppArmor
+development libraries and pkg-config are required when using --apparmor
+./configure option:
 `````
-$ sudo apt-get install git build-essential
+$ sudo apt-get install git build-essential libapparmor-dev pkg-config
 `````
 
 
@@ -113,4 +115,5 @@ We also keep a list of profile fixes for previous released versions in [etc-fixe
 
 ## New profiles:
 
-klatexformula, klatexformula_cmdl, links, pandoc, qgis, teams-for-linux, xlinks, OpenArena, gnome-sound-recorder, godot, tcpdump, tshark, keepassxc-cli, keepassxc-proxy, newsbeuter, rhythmbox-client
+klatexformula, klatexformula_cmdl, links, pandoc, qgis, teams-for-linux, xlinks, OpenArena, gnome-sound-recorder, godot, tcpdump, tshark, keepassxc-cli, keepassxc-proxy, newsbeuter, rhythmbox-client,
+jerry
diff --git a/RELNOTES b/RELNOTES
index 0a3a0a011..a00a27b32 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -4,7 +4,7 @@ firejail (0.9.61) baseline; urgency=low
   * new profiles: qgis, klatexformula, klatexformula_cmdl, links, xlinks
   * new profiles: pandoc, teams-for-linux, OpenArena, gnome-sound-recorder
   * new profiles: godot, tcpdump, tshark, newsbeuter, keepassxc-cli
-  * new profiles: keepassxc-proxy, rhythmbox-client
+  * new profiles: keepassxc-proxy, rhythmbox-client, jerry
  -- netblue30 <netblue30@yahoo.com>  Sat, 1 Jun 2019 08:00:00 -0500
 
 firejail (0.9.60) baseline; urgency=low
diff --git a/configure b/configure
index 6102a470e..fda292896 100755
--- a/configure
+++ b/configure
@@ -642,6 +642,7 @@ HAVE_GLOBALCFG
 HAVE_CHROOT
 HAVE_SECCOMP
 HAVE_PRIVATE_HOME
+HAVE_FIRETUNNEL
 HAVE_OVERLAYFS
 EXTRA_LDFLAGS
 EXTRA_CFLAGS
@@ -681,7 +682,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -706,6 +706,7 @@ ac_user_opts='
 enable_option_checking
 enable_apparmor
 enable_overlayfs
+enable_firetunnel
 enable_private_home
 enable_seccomp
 enable_chroot
@@ -773,7 +774,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1026,15 +1026,6 @@ do
   | -silent | --silent | --silen | --sile | --sil)
     silent=yes ;;
 
-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
     ac_prev=sbindir ;;
   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1172,7 +1163,7 @@ fi
 for ac_var in   exec_prefix prefix bindir sbindir libexecdir datarootdir \
                 datadir sysconfdir sharedstatedir localstatedir includedir \
                 oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-                libdir localedir mandir runstatedir
+                libdir localedir mandir
 do
   eval ac_val=\$$ac_var
   # Remove trailing slashes.
@@ -1325,7 +1316,6 @@ Fine tuning of the installation directories:
   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
   --libdir=DIR            object code libraries [EPREFIX/lib]
   --includedir=DIR        C header files [PREFIX/include]
   --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -1357,6 +1347,7 @@ Optional Features:
   --enable-FEATURE[=ARG]  include FEATURE [ARG=yes]
   --enable-apparmor       enable apparmor
   --disable-overlayfs     disable overlayfs
+  --disable-firetunnel    disable firetunnel
   --disable-private-home  disable private home feature
   --disable-seccomp       disable seccomp
   --disable-chroot        disable chroot
@@ -3191,6 +3182,78 @@ else
   :
 fi
 
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -fstack-clash-protection" >&5
+$as_echo_n "checking whether C compiler accepts -fstack-clash-protection... " >&6; }
+if ${ax_cv_check_cflags___fstack_clash_protection+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -fstack-clash-protection"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+  ax_cv_check_cflags___fstack_clash_protection=yes
+else
+  ax_cv_check_cflags___fstack_clash_protection=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___fstack_clash_protection" >&5
+$as_echo "$ax_cv_check_cflags___fstack_clash_protection" >&6; }
+if test "x$ax_cv_check_cflags___fstack_clash_protection" = xyes; then :
+  HAVE_SPECTRE="yes" && EXTRA_CFLAGS+=" -fstack-clash-protection"
+
+else
+  :
+fi
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -fstack-protector-strong" >&5
+$as_echo_n "checking whether C compiler accepts -fstack-protector-strong... " >&6; }
+if ${ax_cv_check_cflags___fstack_protector_strong+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -fstack-protector-strong"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+  ax_cv_check_cflags___fstack_protector_strong=yes
+else
+  ax_cv_check_cflags___fstack_protector_strong=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___fstack_protector_strong" >&5
+$as_echo "$ax_cv_check_cflags___fstack_protector_strong" >&6; }
+if test "x$ax_cv_check_cflags___fstack_protector_strong" = xyes; then :
+  HAVE_SPECTRE="yes" && EXTRA_CFLAGS+=" -fstack-protector-strong"
+
+else
+  :
+fi
+
 
 HAVE_APPARMOR=""
 # Check whether --enable-apparmor was given.
@@ -3323,8 +3386,8 @@ if test "x$enable_apparmor" = "xyes"; then :
         HAVE_APPARMOR="-DHAVE_APPARMOR"
 
 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for AA" >&5
-$as_echo_n "checking for AA... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libapparmor" >&5
+$as_echo_n "checking for libapparmor... " >&6; }
 
 if test -n "$AA_CFLAGS"; then
     pkg_cv_AA_CFLAGS="$AA_CFLAGS"
@@ -3364,7 +3427,7 @@ fi
 
 
 if test $pkg_failed = yes; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 
 if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@@ -3391,7 +3454,7 @@ Alternatively, you may set the environment variables AA_CFLAGS
 and AA_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details." "$LINENO" 5
 elif test $pkg_failed = untried; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
         { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
@@ -3433,6 +3496,19 @@ if test "x$enable_overlayfs" != "xno"; then :
 
 fi
 
+HAVE_FIRETUNNEL=""
+# Check whether --enable-firetunnel was given.
+if test "${enable_firetunnel+set}" = set; then :
+  enableval=$enable_firetunnel;
+fi
+
+if test "x$enable_firetunnel" != "xno"; then :
+
+        HAVE_FIRETUNNEL="-DHAVE_FIRETUNNEL"
+
+
+fi
+
 HAVE_PRIVATEHOME=""
 # Check whether --enable-private-home was given.
 if test "${enable_private_home+set}" = set; then :
@@ -5280,6 +5356,7 @@ echo "   whitelisting: $HAVE_WHITELIST"
 echo "   private home support: $HAVE_PRIVATE_HOME"
 echo "   file transfer support: $HAVE_FILE_TRANSFER"
 echo "   overlayfs support: $HAVE_OVERLAYFS"
+echo "   firetunnel support: $HAVE_FIRETUNNEL"
 echo "   busybox workaround: $BUSYBOX_WORKAROUND"
 echo "   Spectre compiler patch: $HAVE_SPECTRE"
 echo "   EXTRA_LDFLAGS: $EXTRA_LDFLAGS"
diff --git a/configure.ac b/configure.ac
index c3ca7d912..27dcb39c5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,3 +1,16 @@
+#
+# Note:
+#
+# If for any reason autoconf fails, run "autoreconf -i --install " and try again.
+# This is how the error looks like on Arch Linux:
+#        ./configure: line 3064: syntax error near unexpected token `newline'
+#        ./configure: line 3064: `AX_CHECK_COMPILE_FLAG('
+#
+# We rely solely on autoconf, without automake. Apparently, in this case
+# the macros from m4 directory are not picked up by default by automake.
+# "autoreconf -i --install" seems to fix the problem.
+#
+
 AC_PREREQ([2.68])
 AC_INIT(firejail, 0.9.61, netblue30@yahoo.com, , https://firejail.wordpress.com)
 AC_CONFIG_SRCDIR([src/firejail/main.c])
@@ -17,6 +30,14 @@ AX_CHECK_COMPILE_FLAG(
     [-mretpoline],
     [HAVE_SPECTRE="yes" && EXTRA_CFLAGS+=" -mretpoline"]
 )
+AX_CHECK_COMPILE_FLAG(
+    [-fstack-clash-protection],
+    [HAVE_SPECTRE="yes" && EXTRA_CFLAGS+=" -fstack-clash-protection"]
+)
+AX_CHECK_COMPILE_FLAG(
+    [-fstack-protector-strong],
+    [HAVE_SPECTRE="yes" && EXTRA_CFLAGS+=" -fstack-protector-strong"]
+)
 
 HAVE_APPARMOR=""
 AC_ARG_ENABLE([apparmor],
@@ -39,6 +60,14 @@ AS_IF([test "x$enable_overlayfs" != "xno"], [
         AC_SUBST(HAVE_OVERLAYFS)
 ])
 
+HAVE_FIRETUNNEL=""
+AC_ARG_ENABLE([firetunnel],
+    AS_HELP_STRING([--disable-firetunnel], [disable firetunnel]))
+AS_IF([test "x$enable_firetunnel" != "xno"], [
+        HAVE_FIRETUNNEL="-DHAVE_FIRETUNNEL"
+        AC_SUBST(HAVE_FIRETUNNEL)
+])
+
 HAVE_PRIVATEHOME=""
 AC_ARG_ENABLE([private-home],
     AS_HELP_STRING([--disable-private-home], [disable private home feature]))
@@ -186,6 +215,7 @@ echo "   whitelisting: $HAVE_WHITELIST"
 echo "   private home support: $HAVE_PRIVATE_HOME"
 echo "   file transfer support: $HAVE_FILE_TRANSFER"
 echo "   overlayfs support: $HAVE_OVERLAYFS"
+echo "   firetunnel support: $HAVE_FIRETUNNEL"
 echo "   busybox workaround: $BUSYBOX_WORKAROUND"
 echo "   Spectre compiler patch: $HAVE_SPECTRE"
 echo "   EXTRA_LDFLAGS: $EXTRA_LDFLAGS"
diff --git a/contrib/sort.py b/contrib/sort.py
new file mode 100755
index 000000000..d0fcabac2
--- /dev/null
+++ b/contrib/sort.py
@@ -0,0 +1,115 @@
+#!/usr/bin/env python3
+"""
+Sort the items of multi-item options in profiles, the following options are supported:
+  private-bin, private-etc, private-lib, caps.drop, caps.keep, seccomp.drop, seccomp.drop, protocol
+
+Usage:
+    $ ./sort.py /path/to/profile [ /path/to/profile2 /path/to/profile3 ... ]
+Keep in mind that this will overwrite your profile(s).
+
+Examples:
+    $ ./sort.py MyAwesomeProfile.profile
+    $ ./sort.py new_profile.profile second_new_profile.profile
+    $ ./sort.py ~/.config/firejail/*.{profile,inc,local}
+    $ sudo ./sort.py /etc/firejail/*.{profile,inc,local}
+
+Exit-Codes:
+  0: No Error; No Profile Fixed.
+  1: Error, one or more profiles were not processed correctly.
+  101: No Error; One or more profile were fixed.
+"""
+
+# Requirements:
+#  python >= 3.6
+from sys import argv
+
+def sort_alphabetical(raw_items):
+    items = raw_items.split(",")
+    items.sort(key=lambda s: s.casefold())
+    return ",".join(items)
+
+def sort_protocol(protocols):
+    """sort the given protocole into this scheme: unix,inet,inet6,netlink,packet"""
+    # shortcut for common protocol lines
+    if protocols in ("unix", "unix,inet,inet6"):
+        return protocols
+    fixed_protocols = ""
+    present_protocols = {
+        "unix": False,
+        "inet": False,
+        "inet6": False,
+        "netlink": False,
+        "packet": False,
+    }
+    for protocol in protocols.split(","):
+        if protocol == "unix":
+            present_protocols["unix"] = True
+        elif protocol == "inet":
+            present_protocols["inet"] = True
+        elif protocol == "inet6":
+            present_protocols["inet6"] = True
+        elif protocol == "netlink":
+            present_protocols["netlink"] = True
+        elif protocol == "packet":
+            present_protocols["packet"] = True
+    if present_protocols["unix"]:
+        fixed_protocols += "unix,"
+    if present_protocols["inet"]:
+        fixed_protocols += "inet,"
+    if present_protocols["inet6"]:
+        fixed_protocols += "inet6,"
+    if present_protocols["netlink"]:
+        fixed_protocols += "netlink,"
+    if present_protocols["packet"]:
+        fixed_protocols += "packet,"
+    return fixed_protocols[:-1]
+
+def fix_profile(filename):
+    with open(filename, "r+") as profile:
+        lines = profile.read().split("\n")
+        was_fixed = False
+        fixed_profile = []
+        for line in lines:
+            if line[:12] in ("private-bin ", "private-etc ", "private-lib "):
+                fixed_line = f"{line[:12]}{sort_alphabetical(line[12:])}"
+            elif line[:13] in ("seccomp.drop ", "seccomp.keep "):
+                fixed_line = f"{line[:13]}{sort_alphabetical(line[13:])}"
+            elif line[:10] in ("caps.drop ", "caps.keep "):
+                fixed_line = f"{line[:10]}{sort_alphabetical(line[10:])}"
+            elif line[:8] == "protocol":
+                fixed_line = f"protocol {sort_protocol(line[9:])}"
+            else:
+                fixed_line = line
+            if fixed_line != line:
+                was_fixed = True
+            fixed_profile.append(fixed_line)
+        if was_fixed:
+            profile.seek(0)
+            profile.truncate()
+            profile.write("\n".join(fixed_profile))
+            profile.flush()
+            print(f"[ Fixed ] {filename}")
+            return 101
+        return 0
+
+def main(args):
+    exit_code = 0
+    for filename in args:
+        try:
+            if exit_code not in (1, 101):
+                exit_code = fix_profile(filename)
+            else:
+                fix_profile(filename)
+        except FileNotFoundError:
+            print(f"[ Error ] Can't find {filename}")
+            exit_code = 1
+        except PermissionError:
+            print(f"[ Error ] Can't read/write {filename}")
+            exit_code = 1
+        except:
+            print(f"[ Error ] An error occurred while processing {filename}")
+            exit_code = 1
+    return exit_code
+
+if __name__ == "__main__":
+    exit(main(argv[1:]))
diff --git a/etc/Builder.profile b/etc/Builder.profile
index 128e0dfe3..54b437441 100644
--- a/etc/Builder.profile
+++ b/etc/Builder.profile
@@ -1,7 +1,6 @@
 # Firejail profile for gnome-builder
 # This file is overwritten after every install/update
 
-
 # Temporary fix for https://github.com/netblue30/firejail/issues/2624
 # Redirect
 include gnome-builder.profile
diff --git a/etc/Cheese.profile b/etc/Cheese.profile
index 4bfce53a9..5bb5064f0 100644
--- a/etc/Cheese.profile
+++ b/etc/Cheese.profile
@@ -1,7 +1,6 @@
 # Firejail profile for cheese
 # This file is overwritten after every install/update
 
-
 # Temporary fix for https://github.com/netblue30/firejail/issues/2624
 # Redirect
 include cheese.profile
diff --git a/etc/Cyberfox.profile b/etc/Cyberfox.profile
index 2fb21e3cf..26a4348c9 100644
--- a/etc/Cyberfox.profile
+++ b/etc/Cyberfox.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for cyberfox
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cyberfox.profile
diff --git a/etc/Discord.profile b/etc/Discord.profile
index 9a8957265..3f274b21c 100644
--- a/etc/Discord.profile
+++ b/etc/Discord.profile
@@ -5,7 +5,6 @@ include Discord.local
 # Persistent global definitions
 include globals.local
 
-
 noblacklist ${HOME}/.config/discord
 
 mkdir ${HOME}/.config/discord
@@ -14,5 +13,5 @@ whitelist ${HOME}/.config/discord
 private-bin Discord
 private-opt Discord
 
-#Redirect
+# Redirect
 include discord-common.profile
diff --git a/etc/DiscordCanary.profile b/etc/DiscordCanary.profile
index 0624ff949..d24e73ed8 100644
--- a/etc/DiscordCanary.profile
+++ b/etc/DiscordCanary.profile
@@ -5,7 +5,6 @@ include DiscordCanary.local
 # Persistent global definitions
 include globals.local
 
-
 noblacklist ${HOME}/.config/discordcanary
 
 mkdir ${HOME}/.config/discordcanary
@@ -14,5 +13,5 @@ whitelist ${HOME}/.config/discordcanary
 private-bin DiscordCanary
 private-opt DiscordCanary
 
-#Redirect
+# Redirect
 include discord-common.profile
diff --git a/etc/Documents.profile b/etc/Documents.profile
index c965c55a8..171ab4357 100644
--- a/etc/Documents.profile
+++ b/etc/Documents.profile
@@ -1,7 +1,6 @@
 # Firejail profile for gnome-documents
 # This file is overwritten after every install/update
 
-
 # Temporary fix for https://github.com/netblue30/firejail/issues/2624
 # Redirect
 include gnome-documents.profile
diff --git a/etc/FossaMail.profile b/etc/FossaMail.profile
index 55fd43515..9e1f61421 100644
--- a/etc/FossaMail.profile
+++ b/etc/FossaMail.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for fossamail
 # This file is overwritten after every install/update
 
-
 # Redirect
 include fossamail.profile
diff --git a/etc/Gitter.profile b/etc/Gitter.profile
index 53e66d108..a8bcb6a54 100644
--- a/etc/Gitter.profile
+++ b/etc/Gitter.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for Gitter
 # This file is overwritten after every install/update
 
-
 # Redirect
 include gitter.profile
diff --git a/etc/Logs.profile b/etc/Logs.profile
index f82722ed4..431439f17 100644
--- a/etc/Logs.profile
+++ b/etc/Logs.profile
@@ -1,7 +1,6 @@
 # Firejail profile for gnome-logs
 # This file is overwritten after every install/update
 
-
 # Temporary fix for https://github.com/netblue30/firejail/issues/2624
 # Redirect
 include gnome-logs.profile
diff --git a/etc/Maps.profile b/etc/Maps.profile
index b3fc03e38..c52d2f2da 100644
--- a/etc/Maps.profile
+++ b/etc/Maps.profile
@@ -1,7 +1,6 @@
 # Firejail profile for gnome-maps
 # This file is overwritten after every install/update
 
-
 # Temporary fix for https://github.com/netblue30/firejail/issues/2624
 # Redirect
 include gnome-maps.profile
diff --git a/etc/Natron.profile b/etc/Natron.profile
index aadd68c5c..42c22bf67 100644
--- a/etc/Natron.profile
+++ b/etc/Natron.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for natron
 # This file is overwritten after every install/update
 
-
 # Redirect
 include natron.profile
diff --git a/etc/PPSSPPQt.profile b/etc/PPSSPPQt.profile
new file mode 100644
index 000000000..c5592f99c
--- /dev/null
+++ b/etc/PPSSPPQt.profile
@@ -0,0 +1,9 @@
+# Firejail profile for PPSSPPQt
+# This file is overwritten after every install/update
+# Persistent local customizations
+include PPSSPPQt.local
+# added by included profile
+#include globals.local
+
+# Redirect
+include ppsspp.profile
diff --git a/etc/Telegram.profile b/etc/Telegram.profile
index 51e4d9765..310e0237e 100644
--- a/etc/Telegram.profile
+++ b/etc/Telegram.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for telegram
 # This file is overwritten after every install/update
 
-
 # Redirect
 include telegram.profile
diff --git a/etc/VirtualBox.profile b/etc/VirtualBox.profile
index 5fe8f1c57..4c99ae9a3 100644
--- a/etc/VirtualBox.profile
+++ b/etc/VirtualBox.profile
@@ -2,6 +2,5 @@
 # Description: x86 virtualization solution
 # This file is overwritten after every install/update
 
-
 # Redirect
 include virtualbox.profile
diff --git a/etc/abrowser.profile b/etc/abrowser.profile
index 010247c6b..2e6e8f1af 100644
--- a/etc/abrowser.profile
+++ b/etc/abrowser.profile
@@ -16,6 +16,5 @@ whitelist ${HOME}/.mozilla
 # private-etc must first be enabled in firefox-common.profile
 #private-etc abrowser
 
-
 # Redirect
 include firefox-common.profile
diff --git a/etc/ardour4.profile b/etc/ardour4.profile
index 5c22b57d0..4ad8dd456 100644
--- a/etc/ardour4.profile
+++ b/etc/ardour4.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for ardour5
 # This file is overwritten after every install/update
 
-
 # Redirect
 include ardour5.profile
diff --git a/etc/atom-beta.profile b/etc/atom-beta.profile
index 36baee5c4..c0ee2c492 100644
--- a/etc/atom-beta.profile
+++ b/etc/atom-beta.profile
@@ -2,5 +2,9 @@
 # This file is overwritten after every install/update
 # Persistent local customizations
 include atom-beta.local
-# Profile redirect
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+# Redirect
 include atom.profile
diff --git a/etc/atril-previewer.profile b/etc/atril-previewer.profile
index 3f24acefa..7f4697357 100644
--- a/etc/atril-previewer.profile
+++ b/etc/atril-previewer.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include atril-previewer.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include atril.profile
diff --git a/etc/atril-thumbnailer.profile b/etc/atril-thumbnailer.profile
index de4a52514..8f6129ea6 100644
--- a/etc/atril-thumbnailer.profile
+++ b/etc/atril-thumbnailer.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include atril-thumbnailer.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include atril.profile
diff --git a/etc/autokey-gtk.profile b/etc/autokey-gtk.profile
index 86168ba0d..7e398fc6b 100644
--- a/etc/autokey-gtk.profile
+++ b/etc/autokey-gtk.profile
@@ -7,5 +7,5 @@ include autokey-gtk.local
 # added by included profile
 #include globals.local
 
-#Redirect
+# Redirect
 include autokey-common.profile
diff --git a/etc/autokey-qt.profile b/etc/autokey-qt.profile
index f3877d829..1a2365681 100644
--- a/etc/autokey-qt.profile
+++ b/etc/autokey-qt.profile
@@ -7,5 +7,5 @@ include autokey-qt.local
 # added by included profile
 #include globals.local
 
-#Redirect
+# Redirect
 include autokey-common.profile
diff --git a/etc/autokey-run.profile b/etc/autokey-run.profile
index b70239022..dca1f4548 100644
--- a/etc/autokey-run.profile
+++ b/etc/autokey-run.profile
@@ -7,5 +7,5 @@ include autokey-run.local
 # added by included profile
 #include globals.local
 
-#Redirect
+# Redirect
 include autokey-common.profile
diff --git a/etc/autokey-shell.profile b/etc/autokey-shell.profile
index 5745fce77..def5809c2 100644
--- a/etc/autokey-shell.profile
+++ b/etc/autokey-shell.profile
@@ -7,5 +7,5 @@ include autokey-shell.local
 # added by included profile
 #include globals.local
 
-#Redirect
+# Redirect
 include autokey-common.profile
diff --git a/etc/baloo_filemetadata_temp_extractor.profile b/etc/baloo_filemetadata_temp_extractor.profile
index 94496ede8..ff10e9965 100644
--- a/etc/baloo_filemetadata_temp_extractor.profile
+++ b/etc/baloo_filemetadata_temp_extractor.profile
@@ -4,7 +4,8 @@ quiet
 # Persistent local customizations
 include baloo_filemetadata_temp_extractor.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 ignore read-write
 read-only ${HOME}
diff --git a/etc/beaker.profile b/etc/beaker.profile
index d18429408..21eeac4b3 100644
--- a/etc/beaker.profile
+++ b/etc/beaker.profile
@@ -3,7 +3,8 @@
 # Persistent local customizations
 include beaker.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 noblacklist ${HOME}/.config/Beaker Browser
 
diff --git a/etc/blender-2.8.profile b/etc/blender-2.8.profile
index 9da0cb921..b7242c443 100644
--- a/etc/blender-2.8.profile
+++ b/etc/blender-2.8.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for blender
 # This file is overwritten after every install/update
 
-
 # Redirect
 include blender.profile
diff --git a/etc/bsdcat.profile b/etc/bsdcat.profile
index e95dfdf2d..5271ee5d6 100644
--- a/etc/bsdcat.profile
+++ b/etc/bsdcat.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for bsdtar
 # This file is overwritten after every install/update
 
-
 # Redirect
 include bsdtar.profile
diff --git a/etc/bsdcpio.profile b/etc/bsdcpio.profile
index e95dfdf2d..5271ee5d6 100644
--- a/etc/bsdcpio.profile
+++ b/etc/bsdcpio.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for bsdtar
 # This file is overwritten after every install/update
 
-
 # Redirect
 include bsdtar.profile
diff --git a/etc/calligraauthor.profile b/etc/calligraauthor.profile
index b9c06a588..7804a3b97 100644
--- a/etc/calligraauthor.profile
+++ b/etc/calligraauthor.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for calligra
 # This file is overwritten after every install/update
 
-
 # Redirect
 include calligra.profile
diff --git a/etc/calligraconverter.profile b/etc/calligraconverter.profile
index b9c06a588..7804a3b97 100644
--- a/etc/calligraconverter.profile
+++ b/etc/calligraconverter.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for calligra
 # This file is overwritten after every install/update
 
-
 # Redirect
 include calligra.profile
diff --git a/etc/calligraflow.profile b/etc/calligraflow.profile
index b9c06a588..7804a3b97 100644
--- a/etc/calligraflow.profile
+++ b/etc/calligraflow.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for calligra
 # This file is overwritten after every install/update
 
-
 # Redirect
 include calligra.profile
diff --git a/etc/calligraplan.profile b/etc/calligraplan.profile
index b9c06a588..7804a3b97 100644
--- a/etc/calligraplan.profile
+++ b/etc/calligraplan.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for calligra
 # This file is overwritten after every install/update
 
-
 # Redirect
 include calligra.profile
diff --git a/etc/calligraplanwork.profile b/etc/calligraplanwork.profile
index b9c06a588..7804a3b97 100644
--- a/etc/calligraplanwork.profile
+++ b/etc/calligraplanwork.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for calligra
 # This file is overwritten after every install/update
 
-
 # Redirect
 include calligra.profile
diff --git a/etc/calligrasheets.profile b/etc/calligrasheets.profile
index b9c06a588..7804a3b97 100644
--- a/etc/calligrasheets.profile
+++ b/etc/calligrasheets.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for calligra
 # This file is overwritten after every install/update
 
-
 # Redirect
 include calligra.profile
diff --git a/etc/calligrastage.profile b/etc/calligrastage.profile
index b9c06a588..7804a3b97 100644
--- a/etc/calligrastage.profile
+++ b/etc/calligrastage.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for calligra
 # This file is overwritten after every install/update
 
-
 # Redirect
 include calligra.profile
diff --git a/etc/calligrawords.profile b/etc/calligrawords.profile
index b9c06a588..7804a3b97 100644
--- a/etc/calligrawords.profile
+++ b/etc/calligrawords.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for calligra
 # This file is overwritten after every install/update
 
-
 # Redirect
 include calligra.profile
diff --git a/etc/chromium-browser.profile b/etc/chromium-browser.profile
index b2c6f58fd..f83052d9a 100644
--- a/etc/chromium-browser.profile
+++ b/etc/chromium-browser.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for chromium
 # This file is overwritten after every install/update
 
-
 # Redirect
 include chromium.profile
diff --git a/etc/chromium-common.profile b/etc/chromium-common.profile
index ba6f9d88c..7b88e417a 100644
--- a/etc/chromium-common.profile
+++ b/etc/chromium-common.profile
@@ -3,7 +3,7 @@
 # Persistent local customizations
 include chromium-common.local
 # Persistent global definitions
-# already included by caller profile
+# added by caller profile
 #include globals.local
 
 # noexec ${HOME} breaks DRM binaries.
diff --git a/etc/cinelerra.profile b/etc/cinelerra.profile
index 26f782384..88a65037e 100644
--- a/etc/cinelerra.profile
+++ b/etc/cinelerra.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for cin
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cin.profile
diff --git a/etc/clamdscan.profile b/etc/clamdscan.profile
index df78d8c4c..4c6c56c5f 100644
--- a/etc/clamdscan.profile
+++ b/etc/clamdscan.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for clamav
 # This file is overwritten after every install/update
 
-
 # Redirect
 include clamav.profile
diff --git a/etc/clamdtop.profile b/etc/clamdtop.profile
index df78d8c4c..4c6c56c5f 100644
--- a/etc/clamdtop.profile
+++ b/etc/clamdtop.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for clamav
 # This file is overwritten after every install/update
 
-
 # Redirect
 include clamav.profile
diff --git a/etc/clamscan.profile b/etc/clamscan.profile
index df78d8c4c..4c6c56c5f 100644
--- a/etc/clamscan.profile
+++ b/etc/clamscan.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for clamav
 # This file is overwritten after every install/update
 
-
 # Redirect
 include clamav.profile
diff --git a/etc/clocks.profile b/etc/clocks.profile
index dd234ce44..da50e7d49 100644
--- a/etc/clocks.profile
+++ b/etc/clocks.profile
@@ -1,7 +1,6 @@
 # Firejail profile for gnome-clocks
 # This file is overwritten after every install/update
 
-
 # Temporary fix for https://github.com/netblue30/firejail/issues/2624
 # Redirect
 include gnome-clocks.profile
diff --git a/etc/cryptocat.profile b/etc/cryptocat.profile
index 7a9039ea4..69aa39de2 100644
--- a/etc/cryptocat.profile
+++ b/etc/cryptocat.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for Cryptocat
 # This file is overwritten after every install/update
 
-
 # Redirect
 include Cryptocat.profile
diff --git a/etc/curl.profile b/etc/curl.profile
index 76beee46a..d8282b972 100644
--- a/etc/curl.profile
+++ b/etc/curl.profile
@@ -17,8 +17,11 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 
 caps.drop all
+ipc-namespace
+machine-id
 netfilter
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
@@ -27,7 +30,7 @@ nosound
 notv
 nou2f
 novideo
-protocol unix,inet,inet6
+protocol inet,inet6
 seccomp
 shell none
 
diff --git a/etc/cvlc.profile b/etc/cvlc.profile
index 1070b602c..56c0d965c 100644
--- a/etc/cvlc.profile
+++ b/etc/cvlc.profile
@@ -3,7 +3,8 @@
 # Persistent local customizations
 include cvlc.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 # cvlc doesn't like private-bin
 ignore private-bin
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index fb7e02d0b..679a8c0a0 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -151,6 +151,7 @@ blacklist ${HOME}/.config/digikam
 blacklist ${HOME}/.config/digikamrc
 blacklist ${HOME}/.config/discord
 blacklist ${HOME}/.config/discordcanary
+blacklist ${HOME}/.config/dkl
 blacklist ${HOME}/.config/dnox
 blacklist ${HOME}/.config/dolphinrc
 blacklist ${HOME}/.config/dragonplayerrc
diff --git a/etc/discord-canary.profile b/etc/discord-canary.profile
index 12b5433b2..3e9dacd1e 100644
--- a/etc/discord-canary.profile
+++ b/etc/discord-canary.profile
@@ -5,7 +5,6 @@ include discord-canary.local
 # Persistent global definitions
 include globals.local
 
-
 noblacklist ${HOME}/.config/discordcanary
 
 mkdir ${HOME}/.config/discordcanary
@@ -14,5 +13,5 @@ whitelist ${HOME}/.config/discordcanary
 private-bin discord-canary
 private-opt discord-canary
 
-#Redirect
+# Redirect
 include discord-common.profile
diff --git a/etc/discord-common.profile b/etc/discord-common.profile
index 82dd0475c..a6e730937 100644
--- a/etc/discord-common.profile
+++ b/etc/discord-common.profile
@@ -3,7 +3,7 @@
 # Persistent local customizations
 include discord-common.local
 # Persistent global definitions
-# already included by caller profile
+# added by caller profile
 #include globals.local
 
 include disable-common.inc
diff --git a/etc/discord.profile b/etc/discord.profile
index 62c4a5658..8ef02a30f 100644
--- a/etc/discord.profile
+++ b/etc/discord.profile
@@ -5,7 +5,6 @@ include discord.local
 # Persistent global definitions
 include globals.local
 
-
 noblacklist ${HOME}/.config/discord
 
 mkdir ${HOME}/.config/discord
@@ -14,5 +13,5 @@ whitelist ${HOME}/.config/discord
 private-bin discord
 private-opt discord
 
-#Redirect
+# Redirect
 include discord-common.profile
diff --git a/etc/dnscrypt-proxy.profile b/etc/dnscrypt-proxy.profile
index ae248f2e8..169b23f5f 100644
--- a/etc/dnscrypt-proxy.profile
+++ b/etc/dnscrypt-proxy.profile
@@ -13,19 +13,24 @@ blacklist /tmp/.X11-unix
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
 caps.keep ipc_lock,net_bind_service,setgid,setuid,sys_chroot
+ipc-namespace
+machine-id
 no3d
+nodbus
 nodvd
 nonewprivs
 nosound
 notv
 nou2f
 novideo
+protocol inet,inet6
 seccomp.drop _sysctl,acct,add_key,adjtimex,clock_adjtime,delete_module,fanotify_init,finit_module,get_mempolicy,init_module,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioperm,iopl,kcmp,kexec_file_load,kexec_load,keyctl,lookup_dcookie,mbind,migrate_pages,modify_ldt,mount,move_pages,open_by_handle_at,perf_event_open,perf_event_open,pivot_root,process_vm_readv,process_vm_writev,ptrace,remap_file_pages,request_key,set_mempolicy,swapoff,swapon,sysfs,syslog,umount2,uselib,vmsplice
 
 disable-mnt
diff --git a/etc/dooble-qt4.profile b/etc/dooble-qt4.profile
index 075a24c92..70a21e11c 100644
--- a/etc/dooble-qt4.profile
+++ b/etc/dooble-qt4.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for dooble
 # This file is overwritten after every install/update
 
-
 # Redirect
 include dooble.profile
diff --git a/etc/eo-common.profile b/etc/eo-common.profile
index 2a65de5e1..f4b263f50 100644
--- a/etc/eo-common.profile
+++ b/etc/eo-common.profile
@@ -4,7 +4,7 @@
 # Persistent local customizations
 include eo-common.local
 # Persistent global definitions
-# already included by caller profile
+# added by caller profile
 #include globals.local
 
 noblacklist ${HOME}/.local/share/Trash
diff --git a/etc/evince-previewer.profile b/etc/evince-previewer.profile
index bd1ea6aa9..3857d6f7b 100644
--- a/etc/evince-previewer.profile
+++ b/etc/evince-previewer.profile
@@ -6,6 +6,5 @@ include evince-previewer.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include evince.profile
diff --git a/etc/evince-thumbnailer.profile b/etc/evince-thumbnailer.profile
index d11d4e1e1..080a04a52 100644
--- a/etc/evince-thumbnailer.profile
+++ b/etc/evince-thumbnailer.profile
@@ -6,6 +6,5 @@ include evince-thumbnailer.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include evince.profile
diff --git a/etc/ffplay.profile b/etc/ffplay.profile
index 00da400bd..b42cc29bc 100644
--- a/etc/ffplay.profile
+++ b/etc/ffplay.profile
@@ -9,6 +9,5 @@ include ffplay.local
 
 private-bin ffplay
 
-
 # Redirect
 include ffmpeg.profile
diff --git a/etc/ffprobe.profile b/etc/ffprobe.profile
index 166cc8b46..bd8643206 100644
--- a/etc/ffprobe.profile
+++ b/etc/ffprobe.profile
@@ -9,6 +9,5 @@ include ffprobe.local
 
 private-bin ffprobe
 
-
 # Redirect
 include ffmpeg.profile
diff --git a/etc/firefox-beta.profile b/etc/firefox-beta.profile
index ee158703d..fa8bbb1f5 100644
--- a/etc/firefox-beta.profile
+++ b/etc/firefox-beta.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include firefox-beta.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include firefox.profile
diff --git a/etc/firefox-common.profile b/etc/firefox-common.profile
index 961b338e7..6ad4a9bc2 100644
--- a/etc/firefox-common.profile
+++ b/etc/firefox-common.profile
@@ -3,7 +3,7 @@
 # Persistent local customizations
 include firefox-common.local
 # Persistent global definitions
-# already included by caller profile
+# added by caller profile
 #include globals.local
 
 # noexec ${HOME} breaks DRM binaries.
diff --git a/etc/firefox-developer-edition.profile b/etc/firefox-developer-edition.profile
index 56a0485cb..8c7ca3887 100644
--- a/etc/firefox-developer-edition.profile
+++ b/etc/firefox-developer-edition.profile
@@ -4,8 +4,8 @@
 # Persistent local customizations
 include firefox-developer-edition.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include firefox.profile
diff --git a/etc/firefox-esr.profile b/etc/firefox-esr.profile
index 0ba04d9c1..6c1d77986 100644
--- a/etc/firefox-esr.profile
+++ b/etc/firefox-esr.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include firefox-esr.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include firefox.profile
diff --git a/etc/firefox-nightly.profile b/etc/firefox-nightly.profile
index 6f3838e33..96d2bf898 100644
--- a/etc/firefox-nightly.profile
+++ b/etc/firefox-nightly.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include firefox-nightly.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include firefox.profile
diff --git a/etc/firefox-wayland.profile b/etc/firefox-wayland.profile
index e47ca32f9..068da5ee3 100644
--- a/etc/firefox-wayland.profile
+++ b/etc/firefox-wayland.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include firefox-wayland.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include firefox.profile
diff --git a/etc/fossamail.profile b/etc/fossamail.profile
index e821f6f65..2d700d336 100644
--- a/etc/fossamail.profile
+++ b/etc/fossamail.profile
@@ -3,7 +3,8 @@
 # Persistent local customizations
 include fossamail.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 noblacklist ${HOME}/.cache/fossamail
 noblacklist ${HOME}/.fossamail
diff --git a/etc/freecadcmd.profile b/etc/freecadcmd.profile
index d98b05e65..44bf62cfe 100644
--- a/etc/freecadcmd.profile
+++ b/etc/freecadcmd.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for freecad
 # This file is overwritten after every install/update
 
-
 # Redirect
 include freecad.profile
diff --git a/etc/gconf-editor.profile b/etc/gconf-editor.profile
index e9756f8af..1b84bf536 100644
--- a/etc/gconf-editor.profile
+++ b/etc/gconf-editor.profile
@@ -7,6 +7,5 @@ include gconf-editor.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include gconf.profile
diff --git a/etc/gconf-merge-schema.profile b/etc/gconf-merge-schema.profile
index 411b7b815..619f801b0 100644
--- a/etc/gconf-merge-schema.profile
+++ b/etc/gconf-merge-schema.profile
@@ -7,6 +7,5 @@ include gconf-merge-schema.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include gconf.profile
diff --git a/etc/gconf-merge-tree.profile b/etc/gconf-merge-tree.profile
index 66a4226ca..2f6bfe5e5 100644
--- a/etc/gconf-merge-tree.profile
+++ b/etc/gconf-merge-tree.profile
@@ -7,6 +7,5 @@ include gconf-merge-tree.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include gconf.profile
diff --git a/etc/gconfpkg.profile b/etc/gconfpkg.profile
index 1793ce072..5bfc1250a 100644
--- a/etc/gconfpkg.profile
+++ b/etc/gconfpkg.profile
@@ -7,6 +7,5 @@ include gconfpkg.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include gconf.profile
diff --git a/etc/gconftool-2.profile b/etc/gconftool-2.profile
index 59a2242a7..947e4252f 100644
--- a/etc/gconftool-2.profile
+++ b/etc/gconftool-2.profile
@@ -7,6 +7,5 @@ include gconftool-2.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include gconf.profile
diff --git a/etc/ghb.profile b/etc/ghb.profile
index 1cb09ddde..1e7ce2350 100644
--- a/etc/ghb.profile
+++ b/etc/ghb.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for handbrake
 # This file is overwritten after every install/update
 
-
 # Redirect
 include handbrake.profile
diff --git a/etc/gimp-2.10.profile b/etc/gimp-2.10.profile
index d42307710..dbf49ac22 100644
--- a/etc/gimp-2.10.profile
+++ b/etc/gimp-2.10.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for gimp
 # This file is overwritten after every install/update
 
-
 # Redirect
 include gimp.profile
diff --git a/etc/gimp-2.8.profile b/etc/gimp-2.8.profile
index d42307710..dbf49ac22 100644
--- a/etc/gimp-2.8.profile
+++ b/etc/gimp-2.8.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for gimp
 # This file is overwritten after every install/update
 
-
 # Redirect
 include gimp.profile
diff --git a/etc/google-chrome-stable.profile b/etc/google-chrome-stable.profile
index 55868e0b7..a456e8d61 100644
--- a/etc/google-chrome-stable.profile
+++ b/etc/google-chrome-stable.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for google-chrome
 # This file is overwritten after every install/update
 
-
 # Redirect
 include google-chrome.profile
diff --git a/etc/google-earth-pro.profile b/etc/google-earth-pro.profile
index d62319fa2..c1f919769 100644
--- a/etc/google-earth-pro.profile
+++ b/etc/google-earth-pro.profile
@@ -1,4 +1,7 @@
-# Redirect
-include google-earth.profile
+# Firejail profile alias for google-earth
+# This file is overwritten after every install/update
 
 private-bin google-earth-pro
+
+# Redirect
+include google-earth.profile
diff --git a/etc/gsettings-data-convert.profile b/etc/gsettings-data-convert.profile
index 21a232440..6f1d43939 100644
--- a/etc/gsettings-data-convert.profile
+++ b/etc/gsettings-data-convert.profile
@@ -7,6 +7,5 @@ include gsettings-data-convert.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include gconf.profile
diff --git a/etc/gsettings-schema-convert.profile b/etc/gsettings-schema-convert.profile
index 2dbf4fb44..5c8b0e2e2 100644
--- a/etc/gsettings-schema-convert.profile
+++ b/etc/gsettings-schema-convert.profile
@@ -7,6 +7,5 @@ include gsettings-schema-convert.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include gconf.profile
diff --git a/etc/gtar.profile b/etc/gtar.profile
index 12acb8356..2391c121b 100644
--- a/etc/gtar.profile
+++ b/etc/gtar.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for tar
 # This file is overwritten after every install/update
 
-
 # Redirect
 include tar.profile
diff --git a/etc/handbrake-gtk.profile b/etc/handbrake-gtk.profile
index 1cb09ddde..1e7ce2350 100644
--- a/etc/handbrake-gtk.profile
+++ b/etc/handbrake-gtk.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for handbrake
 # This file is overwritten after every install/update
 
-
 # Redirect
 include handbrake.profile
diff --git a/etc/icedove.profile b/etc/icedove.profile
index a66309bf1..19690cd5a 100644
--- a/etc/icedove.profile
+++ b/etc/icedove.profile
@@ -3,7 +3,8 @@
 # Persistent local customizations
 include icedove.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 # Users have icedove set to open a browser by clicking a link in an email
 # We are not allowed to blacklist browser-specific directories
diff --git a/etc/iceweasel.profile b/etc/iceweasel.profile
index 24a2f4cc3..badd2648a 100644
--- a/etc/iceweasel.profile
+++ b/etc/iceweasel.profile
@@ -3,7 +3,8 @@
 # Persistent local customizations
 include iceweasel.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 # private-etc must first be enabled in firefox-common.profile
 #private-etc iceweasel
diff --git a/etc/idea.profile b/etc/idea.profile
index d56dceb71..4e43bb629 100644
--- a/etc/idea.profile
+++ b/etc/idea.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include idea.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include idea.sh.profile
diff --git a/etc/ideaIC.profile b/etc/ideaIC.profile
index b960b08e5..7e1778f58 100644
--- a/etc/ideaIC.profile
+++ b/etc/ideaIC.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include ideaIC.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include idea.sh.profile
diff --git a/etc/inkview.profile b/etc/inkview.profile
index 6c0127f37..4f88b0258 100644
--- a/etc/inkview.profile
+++ b/etc/inkview.profile
@@ -3,6 +3,9 @@
 # This file is overwritten after every install/update
 # Persistent local customizations
 include inkview.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
 
 # Redirect
 include inkscape.profile
diff --git a/etc/iridium-browser.profile b/etc/iridium-browser.profile
index 0a6418d5c..c7ee64d56 100644
--- a/etc/iridium-browser.profile
+++ b/etc/iridium-browser.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for iridium
 # This file is overwritten after every install/update
 
-
 # Redirect
 include iridium.profile
diff --git a/etc/jdownloader.profile b/etc/jdownloader.profile
index 037d92338..b5f892a9d 100644
--- a/etc/jdownloader.profile
+++ b/etc/jdownloader.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include jdownloader.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include JDownloader.profile
diff --git a/etc/jerry.profile b/etc/jerry.profile
new file mode 100644
index 000000000..f6bfb9953
--- /dev/null
+++ b/etc/jerry.profile
@@ -0,0 +1,41 @@
+# Firejail profile for jerry
+# Description: Chess GUI
+# This file is overwritten after every install/update
+# Persistent local customizations
+include jerry.local
+# Persistent global definitions
+include globals.local
+
+noblacklist ${HOME}/.config/dkl
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include disable-xdg.inc
+
+caps.drop all
+machine-id
+net none
+no3d
+nodbus
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix
+seccomp
+shell none
+tracelog
+
+private-bin bash,jerry,sh,stockfish
+private-dev
+private-etc fonts,gtk-2.0,gtk-3.0
+private-tmp
+
+memory-deny-write-execute
diff --git a/etc/karbon.profile b/etc/karbon.profile
index e9e3c2a69..3b2e93b0a 100644
--- a/etc/karbon.profile
+++ b/etc/karbon.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for krita
 # This file is overwritten after every install/update
 
-
 # Redirect
 include krita.profile
diff --git a/etc/keepass2.profile b/etc/keepass2.profile
index 9e33e08db..aef236ccc 100644
--- a/etc/keepass2.profile
+++ b/etc/keepass2.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for keepass
 # This file is overwritten after every install/update
 
-
 # Redirect
 include keepass.profile
diff --git a/etc/keepassxc-cli.profile b/etc/keepassxc-cli.profile
index 6f657e7de..925609384 100644
--- a/etc/keepassxc-cli.profile
+++ b/etc/keepassxc-cli.profile
@@ -7,6 +7,5 @@ include keepassxc-cli.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include keepassxc.profile
diff --git a/etc/keepassxc-proxy.profile b/etc/keepassxc-proxy.profile
index 79666aee2..b2b6763ee 100644
--- a/etc/keepassxc-proxy.profile
+++ b/etc/keepassxc-proxy.profile
@@ -6,6 +6,5 @@ include keepassxc-proxy.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include keepassxc.profile
diff --git a/etc/knotes.profile b/etc/knotes.profile
index e7ea04873..ababfcdb1 100644
--- a/etc/knotes.profile
+++ b/etc/knotes.profile
@@ -4,7 +4,8 @@
 # Persistent local customizations
 include knotes.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 # knotes has problems launching akonadi in debian and ubuntu.
 # one solution is to have akonadi already running when knotes is started
@@ -12,6 +13,5 @@ include globals.local
 noblacklist ${HOME}/.config/knotesrc
 noblacklist ${HOME}/.local/share/knotes
 
-
 # Redirect
 include kmail.profile
diff --git a/etc/lbunzip2.profile b/etc/lbunzip2.profile
index ec9a8f546..338d8c8bb 100644
--- a/etc/lbunzip2.profile
+++ b/etc/lbunzip2.profile
@@ -2,6 +2,5 @@
 # Description: GNU compression utilities
 # This file is overwritten after every install/update
 
-
 # Redirect
 include gzip.profile
diff --git a/etc/lbzcat.profile b/etc/lbzcat.profile
index ec9a8f546..338d8c8bb 100644
--- a/etc/lbzcat.profile
+++ b/etc/lbzcat.profile
@@ -2,6 +2,5 @@
 # Description: GNU compression utilities
 # This file is overwritten after every install/update
 
-
 # Redirect
 include gzip.profile
diff --git a/etc/lbzip2.profile b/etc/lbzip2.profile
index ec9a8f546..338d8c8bb 100644
--- a/etc/lbzip2.profile
+++ b/etc/lbzip2.profile
@@ -2,6 +2,5 @@
 # Description: GNU compression utilities
 # This file is overwritten after every install/update
 
-
 # Redirect
 include gzip.profile
diff --git a/etc/lobase.profile b/etc/lobase.profile
index ea0f84631..8348a57fe 100644
--- a/etc/lobase.profile
+++ b/etc/lobase.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for libreoffice
 # This file is overwritten after every install/update
 
-
 # Redirect
 include libreoffice.profile
diff --git a/etc/localc.profile b/etc/localc.profile
index ea0f84631..8348a57fe 100644
--- a/etc/localc.profile
+++ b/etc/localc.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for libreoffice
 # This file is overwritten after every install/update
 
-
 # Redirect
 include libreoffice.profile
diff --git a/etc/lodraw.profile b/etc/lodraw.profile
index ea0f84631..8348a57fe 100644
--- a/etc/lodraw.profile
+++ b/etc/lodraw.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for libreoffice
 # This file is overwritten after every install/update
 
-
 # Redirect
 include libreoffice.profile
diff --git a/etc/loffice.profile b/etc/loffice.profile
index ea0f84631..8348a57fe 100644
--- a/etc/loffice.profile
+++ b/etc/loffice.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for libreoffice
 # This file is overwritten after every install/update
 
-
 # Redirect
 include libreoffice.profile
diff --git a/etc/lofromtemplate.profile b/etc/lofromtemplate.profile
index ea0f84631..8348a57fe 100644
--- a/etc/lofromtemplate.profile
+++ b/etc/lofromtemplate.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for libreoffice
 # This file is overwritten after every install/update
 
-
 # Redirect
 include libreoffice.profile
diff --git a/etc/loimpress.profile b/etc/loimpress.profile
index ea0f84631..8348a57fe 100644
--- a/etc/loimpress.profile
+++ b/etc/loimpress.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for libreoffice
 # This file is overwritten after every install/update
 
-
 # Redirect
 include libreoffice.profile
diff --git a/etc/lomath.profile b/etc/lomath.profile
index ea0f84631..8348a57fe 100644
--- a/etc/lomath.profile
+++ b/etc/lomath.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for libreoffice
 # This file is overwritten after every install/update
 
-
 # Redirect
 include libreoffice.profile
diff --git a/etc/loweb.profile b/etc/loweb.profile
index ea0f84631..8348a57fe 100644
--- a/etc/loweb.profile
+++ b/etc/loweb.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for libreoffice
 # This file is overwritten after every install/update
 
-
 # Redirect
 include libreoffice.profile
diff --git a/etc/lowriter.profile b/etc/lowriter.profile
index ea0f84631..8348a57fe 100644
--- a/etc/lowriter.profile
+++ b/etc/lowriter.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for libreoffice
 # This file is overwritten after every install/update
 
-
 # Redirect
 include libreoffice.profile
diff --git a/etc/lrunzip.profile b/etc/lrunzip.profile
index 96aeee770..72abec8bb 100644
--- a/etc/lrunzip.profile
+++ b/etc/lrunzip.profile
@@ -7,6 +7,5 @@ include lrunzip.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lrz.profile b/etc/lrz.profile
index 03de48104..c1f928bde 100644
--- a/etc/lrz.profile
+++ b/etc/lrz.profile
@@ -7,6 +7,5 @@ include lrz.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lrzcat.profile b/etc/lrzcat.profile
index 6d95c41a0..edcd7f8cd 100644
--- a/etc/lrzcat.profile
+++ b/etc/lrzcat.profile
@@ -7,6 +7,5 @@ include lrzcat.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lrzip.profile b/etc/lrzip.profile
index 148d23393..a69096e28 100644
--- a/etc/lrzip.profile
+++ b/etc/lrzip.profile
@@ -7,6 +7,5 @@ include lrzip.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lrztar.profile b/etc/lrztar.profile
index 90327c2bb..54b04b4ec 100644
--- a/etc/lrztar.profile
+++ b/etc/lrztar.profile
@@ -7,6 +7,5 @@ include lrztar.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lrzuntar.profile b/etc/lrzuntar.profile
index 6aa91cabd..f21169b24 100644
--- a/etc/lrzuntar.profile
+++ b/etc/lrzuntar.profile
@@ -7,6 +7,5 @@ include lrzuntar.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lzcat.profile b/etc/lzcat.profile
index 748dad2e3..f7410b928 100644
--- a/etc/lzcat.profile
+++ b/etc/lzcat.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lzcmp.profile b/etc/lzcmp.profile
index 748dad2e3..f7410b928 100644
--- a/etc/lzcmp.profile
+++ b/etc/lzcmp.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lzdiff.profile b/etc/lzdiff.profile
index 748dad2e3..f7410b928 100644
--- a/etc/lzdiff.profile
+++ b/etc/lzdiff.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lzegrep.profile b/etc/lzegrep.profile
index 748dad2e3..f7410b928 100644
--- a/etc/lzegrep.profile
+++ b/etc/lzegrep.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lzfgrep.profile b/etc/lzfgrep.profile
index 748dad2e3..f7410b928 100644
--- a/etc/lzfgrep.profile
+++ b/etc/lzfgrep.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lzgrep.profile b/etc/lzgrep.profile
index 748dad2e3..f7410b928 100644
--- a/etc/lzgrep.profile
+++ b/etc/lzgrep.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lzip.profile b/etc/lzip.profile
index 748dad2e3..f7410b928 100644
--- a/etc/lzip.profile
+++ b/etc/lzip.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lzless.profile b/etc/lzless.profile
index 748dad2e3..f7410b928 100644
--- a/etc/lzless.profile
+++ b/etc/lzless.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lzma.profile b/etc/lzma.profile
index 748dad2e3..f7410b928 100644
--- a/etc/lzma.profile
+++ b/etc/lzma.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lzmadec.profile b/etc/lzmadec.profile
index 9ba22601b..0c5ec1b09 100644
--- a/etc/lzmadec.profile
+++ b/etc/lzmadec.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include xzdec.profile
diff --git a/etc/lzmainfo.profile b/etc/lzmainfo.profile
index 748dad2e3..f7410b928 100644
--- a/etc/lzmainfo.profile
+++ b/etc/lzmainfo.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/lzmore.profile b/etc/lzmore.profile
index 748dad2e3..f7410b928 100644
--- a/etc/lzmore.profile
+++ b/etc/lzmore.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/masterpdfeditor4.profile b/etc/masterpdfeditor4.profile
index 5612fdaa4..84e78171f 100644
--- a/etc/masterpdfeditor4.profile
+++ b/etc/masterpdfeditor4.profile
@@ -7,6 +7,5 @@ include masterpdfeditor4.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include masterpdfeditor.profile
diff --git a/etc/masterpdfeditor5.profile b/etc/masterpdfeditor5.profile
index 8669ceb11..057d343dd 100644
--- a/etc/masterpdfeditor5.profile
+++ b/etc/masterpdfeditor5.profile
@@ -7,6 +7,5 @@ include masterpdfeditor5.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include masterpdfeditor.profile
diff --git a/etc/mate-calculator.profile b/etc/mate-calculator.profile
index 442acf8ff..bb438f5f0 100644
--- a/etc/mate-calculator.profile
+++ b/etc/mate-calculator.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for mate-calc
 # This file is overwritten after every install/update
 
-
 # Redirect
 include mate-calc.profile
diff --git a/etc/mathematica.profile b/etc/mathematica.profile
index 5f29181cd..964060350 100644
--- a/etc/mathematica.profile
+++ b/etc/mathematica.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for Mathematica
 # This file is overwritten after every install/update
 
-
 # Redirect
 include Mathematica.profile
diff --git a/etc/mp3wrap.profile b/etc/mp3wrap.profile
index 2e7d97f72..9e48f7807 100644
--- a/etc/mp3wrap.profile
+++ b/etc/mp3wrap.profile
@@ -1,6 +1,9 @@
 # Firejail profile for mp3wrap
 # This file is overwritten after every install/update
 include mp3wrap.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
 
 # Redirect
 include mp3splt.profile
diff --git a/etc/ms-excel.profile b/etc/ms-excel.profile
index e103baf19..db24e8f9b 100644
--- a/etc/ms-excel.profile
+++ b/etc/ms-excel.profile
@@ -3,7 +3,8 @@
 # Persistent local customizations
 include ms-excel.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 noblacklist ${HOME}/.cache/ms-excel-online
 private-bin ms-excel
diff --git a/etc/ms-onenote.profile b/etc/ms-onenote.profile
index 1259d55c8..9ea0637bd 100644
--- a/etc/ms-onenote.profile
+++ b/etc/ms-onenote.profile
@@ -3,7 +3,8 @@
 # Persistent local customizations
 include ms-onenote.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 noblacklist ${HOME}/.cache/ms-onenote-online
 private-bin ms-onenote
diff --git a/etc/ms-outlook.profile b/etc/ms-outlook.profile
index a9fadc2c1..fc3e7c009 100644
--- a/etc/ms-outlook.profile
+++ b/etc/ms-outlook.profile
@@ -3,7 +3,8 @@
 # Persistent local customizations
 include ms-outlook.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 noblacklist ${HOME}/.cache/ms-outlook-online
 private-bin ms-outlook
diff --git a/etc/ms-powerpoint.profile b/etc/ms-powerpoint.profile
index 4c096de4e..dadcd5b1e 100644
--- a/etc/ms-powerpoint.profile
+++ b/etc/ms-powerpoint.profile
@@ -3,7 +3,8 @@
 # Persistent local customizations
 include ms-powerpoint.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 noblacklist ${HOME}/.cache/ms-powerpoint-online
 private-bin ms-powerpoint
diff --git a/etc/ms-word.profile b/etc/ms-word.profile
index f21e987d4..5a617a893 100644
--- a/etc/ms-word.profile
+++ b/etc/ms-word.profile
@@ -3,7 +3,8 @@
 # Persistent local customizations
 include ms-word.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 noblacklist ${HOME}/.cache/ms-word-online
 private-bin ms-word
diff --git a/etc/neverputt.profile b/etc/neverputt.profile
new file mode 100644
index 000000000..93fb14e07
--- /dev/null
+++ b/etc/neverputt.profile
@@ -0,0 +1,9 @@
+# Firejail profile for neverputt
+# This file is overwritten after every install/update
+# Persistent local customizations
+include neverputt.local
+# added by included profile
+#include globals.local
+
+# Redirect
+include neverball.profile
diff --git a/etc/nitroshare-cli.profile b/etc/nitroshare-cli.profile
index 5ee683711..d9cb2edc5 100644
--- a/etc/nitroshare-cli.profile
+++ b/etc/nitroshare-cli.profile
@@ -2,6 +2,5 @@
 # Description: Network File Transfer Application
 # This file is overwritten after every install/update
 
-
 # Redirect
 include nitroshare.profile
diff --git a/etc/nitroshare-nmh.profile b/etc/nitroshare-nmh.profile
index 5ee683711..d9cb2edc5 100644
--- a/etc/nitroshare-nmh.profile
+++ b/etc/nitroshare-nmh.profile
@@ -2,6 +2,5 @@
 # Description: Network File Transfer Application
 # This file is overwritten after every install/update
 
-
 # Redirect
 include nitroshare.profile
diff --git a/etc/nitroshare-send.profile b/etc/nitroshare-send.profile
index 5ee683711..d9cb2edc5 100644
--- a/etc/nitroshare-send.profile
+++ b/etc/nitroshare-send.profile
@@ -2,6 +2,5 @@
 # Description: Network File Transfer Application
 # This file is overwritten after every install/update
 
-
 # Redirect
 include nitroshare.profile
diff --git a/etc/nitroshare-ui.profile b/etc/nitroshare-ui.profile
index 5ee683711..d9cb2edc5 100644
--- a/etc/nitroshare-ui.profile
+++ b/etc/nitroshare-ui.profile
@@ -2,6 +2,5 @@
 # Description: Network File Transfer Application
 # This file is overwritten after every install/update
 
-
 # Redirect
 include nitroshare.profile
diff --git a/etc/oggsplt.profile b/etc/oggsplt.profile
index 456412c30..5aedadde9 100644
--- a/etc/oggsplt.profile
+++ b/etc/oggsplt.profile
@@ -1,6 +1,9 @@
 # Firejail profile for oggsplt
 # This file is overwritten after every install/update
 include oggsplt.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
 
 # Redirect
 include mp3splt.profile
diff --git a/etc/openshot-qt.profile b/etc/openshot-qt.profile
index b86073b41..2f886d2ac 100644
--- a/etc/openshot-qt.profile
+++ b/etc/openshot-qt.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for openshot
 # This file is overwritten after every install/update
 
-
 # Redirect
 include openshot.profile
diff --git a/etc/qt-faststart.profile b/etc/qt-faststart.profile
index 51bc1b298..cf459472a 100644
--- a/etc/qt-faststart.profile
+++ b/etc/qt-faststart.profile
@@ -9,6 +9,5 @@ include qt-faststart.local
 
 private-bin qt-faststart
 
-
 # Redirect
 include ffmpeg.profile
diff --git a/etc/riot-desktop.profile b/etc/riot-desktop.profile
index fececd850..e91d25196 100644
--- a/etc/riot-desktop.profile
+++ b/etc/riot-desktop.profile
@@ -4,7 +4,8 @@
 # Persistent local customizations
 include riot-desktop.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 # Redirect
 include riot-web.profile
diff --git a/etc/riot-web.profile b/etc/riot-web.profile
index c9f597626..b930adf2b 100644
--- a/etc/riot-web.profile
+++ b/etc/riot-web.profile
@@ -4,7 +4,8 @@
 # Persistent local customizations
 include riot-web.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 noblacklist ${HOME}/.config/Riot
 
diff --git a/etc/rnano.profile b/etc/rnano.profile
index 89c1663c4..565c957e0 100644
--- a/etc/rnano.profile
+++ b/etc/rnano.profile
@@ -4,8 +4,8 @@
 # Persistent local customizations
 include rnano.local
 # Persistent global definitions
+# added by included profile
 #include globals.local
 
-
 # Redirect
 include nano.profile
diff --git a/etc/rocketchat.profile b/etc/rocketchat.profile
index 8170c62e7..a574e4e8b 100644
--- a/etc/rocketchat.profile
+++ b/etc/rocketchat.profile
@@ -3,7 +3,8 @@
 # Persistent local customizations
 include rocketchat.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 noblacklist ${HOME}/.config/Rocket.Chat
 
diff --git a/etc/runenpass.sh.profile b/etc/runenpass.sh.profile
index 794c38d6e..64432c171 100644
--- a/etc/runenpass.sh.profile
+++ b/etc/runenpass.sh.profile
@@ -1,6 +1,5 @@
 # Firejail alias profile for enpass
 # This file is overwritten after every install/update
 
-
 # Redirect
 include enpass.profile
diff --git a/etc/rview.profile b/etc/rview.profile
index b3a6bfbdc..fb72a00de 100644
--- a/etc/rview.profile
+++ b/etc/rview.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include rview.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include vim.profile
diff --git a/etc/rvim.profile b/etc/rvim.profile
index 5481dfe43..7c6465d3c 100644
--- a/etc/rvim.profile
+++ b/etc/rvim.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include rvim.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include vim.profile
diff --git a/etc/seamonkey-bin.profile b/etc/seamonkey-bin.profile
index e420d8124..532294950 100644
--- a/etc/seamonkey-bin.profile
+++ b/etc/seamonkey-bin.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for seamonkey
 # This file is overwritten after every install/update
 
-
 # Redirect
 include seamonkey.profile
diff --git a/etc/soffice.profile b/etc/soffice.profile
index ea0f84631..8348a57fe 100644
--- a/etc/soffice.profile
+++ b/etc/soffice.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for libreoffice
 # This file is overwritten after every install/update
 
-
 # Redirect
 include libreoffice.profile
diff --git a/etc/ssh-agent.profile b/etc/ssh-agent.profile
index 9af747b62..55df45a87 100644
--- a/etc/ssh-agent.profile
+++ b/etc/ssh-agent.profile
@@ -19,6 +19,7 @@ include disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodbus
 nodvd
 nonewprivs
 noroot
diff --git a/etc/ssh.profile b/etc/ssh.profile
index ce0e54a0d..7a9bb5abe 100644
--- a/etc/ssh.profile
+++ b/etc/ssh.profile
@@ -22,6 +22,7 @@ caps.drop all
 ipc-namespace
 netfilter
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/start-tor-browser.desktop.profile b/etc/start-tor-browser.desktop.profile
index d5d7a17e4..9c3175ad7 100644
--- a/etc/start-tor-browser.desktop.profile
+++ b/etc/start-tor-browser.desktop.profile
@@ -2,6 +2,9 @@
 # This file is overwritten after every install/update
 # Persistent local customizations
 include start-tor-browser.desktop.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
 
 noblacklist ${HOME}/.tor-browser-*
 noblacklist ${HOME}/.tor-browser_*
diff --git a/etc/steam-native.profile b/etc/steam-native.profile
index 1419a10b5..47608ad28 100644
--- a/etc/steam-native.profile
+++ b/etc/steam-native.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for steam
 # This file is overwritten after every install/update
 
-
 # Redirect
 include steam.profile
diff --git a/etc/studio.sh.profile b/etc/studio.sh.profile
index c69297e29..79e879f36 100644
--- a/etc/studio.sh.profile
+++ b/etc/studio.sh.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for Android Studio
 # This file is overwritten after every install/update
 
-
 # Redirect
 include android-studio.profile
diff --git a/etc/sysprof-cli.profile b/etc/sysprof-cli.profile
index 62672b22b..935c7e9ca 100644
--- a/etc/sysprof-cli.profile
+++ b/etc/sysprof-cli.profile
@@ -15,6 +15,5 @@ private-lib
 
 memory-deny-write-execute
 
-
 # Redirect
 include sysprof.profile
diff --git a/etc/telegram-desktop.profile b/etc/telegram-desktop.profile
index ef60bdc8c..0cfa7114b 100644
--- a/etc/telegram-desktop.profile
+++ b/etc/telegram-desktop.profile
@@ -2,6 +2,5 @@
 # Description: Official Telegram Desktop client
 # This file is overwritten after every install/update
 
-
 # Redirect
 include telegram.profile
diff --git a/etc/thunar.profile b/etc/thunar.profile
index 0c7a048c4..19993016a 100644
--- a/etc/thunar.profile
+++ b/etc/thunar.profile
@@ -2,6 +2,5 @@
 # Description: Modern file manager for Xfce
 # This file is overwritten after every install/update
 
-
 # Redirect
 include Thunar.profile
diff --git a/etc/transmission-create.profile b/etc/transmission-create.profile
index 7aea44c3b..9b84bc33a 100644
--- a/etc/transmission-create.profile
+++ b/etc/transmission-create.profile
@@ -7,6 +7,5 @@ include transmission-create.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include transmission-cli.profile
diff --git a/etc/transmission-edit.profile b/etc/transmission-edit.profile
index 5bc81c231..07990aa15 100644
--- a/etc/transmission-edit.profile
+++ b/etc/transmission-edit.profile
@@ -7,6 +7,5 @@ include transmission-edit.local
 # added by included profile
 #include globals.local
 
-
 # Redirect
 include transmission-cli.profile
diff --git a/etc/transmission-remote-cli.profile b/etc/transmission-remote-cli.profile
index 7b7a47f14..98b875fc5 100644
--- a/etc/transmission-remote-cli.profile
+++ b/etc/transmission-remote-cli.profile
@@ -21,6 +21,5 @@ include whitelist-var-common.inc
 # private-bin python*
 private-etc fonts
 
-
 # Redirect
 include transmission-remote.profile
diff --git a/etc/transmission-remote-gtk.profile b/etc/transmission-remote-gtk.profile
index 3ead56008..b7173def5 100644
--- a/etc/transmission-remote-gtk.profile
+++ b/etc/transmission-remote-gtk.profile
@@ -16,6 +16,5 @@ include whitelist-var-common.inc
 
 private-etc fonts
 
-
 # Redirect
 include transmission-remote.profile
diff --git a/etc/udiskie.profile b/etc/udiskie.profile
index 8cc443bff..f6e85d60e 100644
--- a/etc/udiskie.profile
+++ b/etc/udiskie.profile
@@ -41,5 +41,5 @@ private-bin awk,cut,dbus-send,egrep,file,grep,head,python*,readlink,sed,sh,udisk
 # private-bin thunar
 private-cache
 private-dev
-private-etc alternatives,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,xdg
+private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,xdg
 private-tmp
diff --git a/etc/unbound.profile b/etc/unbound.profile
index e152ee7ea..7d1c36d2f 100644
--- a/etc/unbound.profile
+++ b/etc/unbound.profile
@@ -13,6 +13,7 @@ blacklist /tmp/.X11-unix
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -22,13 +23,18 @@ whitelist /var/lib/unbound
 whitelist /var/run
 
 caps.keep net_admin,net_bind_service,setgid,setuid,sys_chroot,sys_resource
+ipc-namespace
+machine-id
+netfilter
 no3d
+nodbus
 nodvd
 nonewprivs
 nosound
 notv
 nou2f
 novideo
+protocol inet,inet6
 seccomp.drop _sysctl,acct,add_key,adjtimex,clock_adjtime,delete_module,fanotify_init,finit_module,get_mempolicy,init_module,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioperm,iopl,kcmp,kexec_file_load,kexec_load,keyctl,lookup_dcookie,mbind,migrate_pages,modify_ldt,mount,move_pages,open_by_handle_at,perf_event_open,perf_event_open,pivot_root,process_vm_readv,process_vm_writev,ptrace,remap_file_pages,request_key,set_mempolicy,swapoff,swapon,sysfs,syslog,umount2,uselib,vmsplice
 
 disable-mnt
diff --git a/etc/unlzma.profile b/etc/unlzma.profile
index 748dad2e3..f7410b928 100644
--- a/etc/unlzma.profile
+++ b/etc/unlzma.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/unxz.profile b/etc/unxz.profile
index 748dad2e3..f7410b928 100644
--- a/etc/unxz.profile
+++ b/etc/unxz.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/vimcat.profile b/etc/vimcat.profile
index a8f7758e0..73b76b5ab 100644
--- a/etc/vimcat.profile
+++ b/etc/vimcat.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include vimcat.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include vim.profile
diff --git a/etc/vimdiff.profile b/etc/vimdiff.profile
index 53a5c6224..f09faf1d6 100644
--- a/etc/vimdiff.profile
+++ b/etc/vimdiff.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include vimdiff.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include vim.profile
diff --git a/etc/vimpager.profile b/etc/vimpager.profile
index ef2c20ef1..af7703752 100644
--- a/etc/vimpager.profile
+++ b/etc/vimpager.profile
@@ -4,8 +4,8 @@
 # Persistent local customizations
 include vimpager.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include vim.profile
diff --git a/etc/vimtutor.profile b/etc/vimtutor.profile
index 7330d6da2..b9584cc49 100644
--- a/etc/vimtutor.profile
+++ b/etc/vimtutor.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include vimtutor.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include vim.profile
diff --git a/etc/vivaldi-beta.profile b/etc/vivaldi-beta.profile
index bee5d6be6..5de5682a3 100644
--- a/etc/vivaldi-beta.profile
+++ b/etc/vivaldi-beta.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for vivaldi
 # This file is overwritten after every install/update
 
-
 # Redirect
 include vivaldi.profile
diff --git a/etc/vivaldi-stable.profile b/etc/vivaldi-stable.profile
index bee5d6be6..5de5682a3 100644
--- a/etc/vivaldi-stable.profile
+++ b/etc/vivaldi-stable.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for vivaldi
 # This file is overwritten after every install/update
 
-
 # Redirect
 include vivaldi.profile
diff --git a/etc/vscodium.profile b/etc/vscodium.profile
index 954510113..b4728fb72 100644
--- a/etc/vscodium.profile
+++ b/etc/vscodium.profile
@@ -1,7 +1,6 @@
 # Firejail profile alias for Visual Studio Code
 # This file is overwritten after every install/update
 
-
 noblacklist ${HOME}/.VSCodium
 
 # Redirect
diff --git a/etc/weechat-curses.profile b/etc/weechat-curses.profile
index 4e9d6826c..4719b9788 100644
--- a/etc/weechat-curses.profile
+++ b/etc/weechat-curses.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for weechat
 # This file is overwritten after every install/update
 
-
 # Redirect
 include weechat.profile
diff --git a/etc/wireshark-gtk.profile b/etc/wireshark-gtk.profile
index 14978013d..3e2e1807e 100644
--- a/etc/wireshark-gtk.profile
+++ b/etc/wireshark-gtk.profile
@@ -2,6 +2,5 @@
 # Description: Network protocol analyzer
 # This file is overwritten after every install/update
 
-
 # Redirect
 include wireshark.profile
diff --git a/etc/wireshark-qt.profile b/etc/wireshark-qt.profile
index 14978013d..3e2e1807e 100644
--- a/etc/wireshark-qt.profile
+++ b/etc/wireshark-qt.profile
@@ -2,6 +2,5 @@
 # Description: Network protocol analyzer
 # This file is overwritten after every install/update
 
-
 # Redirect
 include wireshark.profile
diff --git a/etc/xlinks.profile b/etc/xlinks.profile
index ad1511791..7987af280 100644
--- a/etc/xlinks.profile
+++ b/etc/xlinks.profile
@@ -3,6 +3,9 @@
 # This file is overwritten after every install/update
 # Persistent local customizations
 include xlinks.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
 
 noblacklist /tmp/.X11-unix
 noblacklist ${HOME}/.links
diff --git a/etc/xonotic-glx.profile b/etc/xonotic-glx.profile
index 8a44fb587..abb91e1ec 100644
--- a/etc/xonotic-glx.profile
+++ b/etc/xonotic-glx.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for xonotic
 # This file is overwritten after every install/update
 
-
 # Redirect
 include xonotic.profile
diff --git a/etc/xonotic-sdl.profile b/etc/xonotic-sdl.profile
index 8a44fb587..abb91e1ec 100644
--- a/etc/xonotic-sdl.profile
+++ b/etc/xonotic-sdl.profile
@@ -1,6 +1,5 @@
 # Firejail profile alias for xonotic
 # This file is overwritten after every install/update
 
-
 # Redirect
 include xonotic.profile
diff --git a/etc/xplayer-audio-preview.profile b/etc/xplayer-audio-preview.profile
index 78252c134..0559b8183 100644
--- a/etc/xplayer-audio-preview.profile
+++ b/etc/xplayer-audio-preview.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include xplayer-audio-preview.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include xplayer.profile
diff --git a/etc/xplayer-video-thumbnailer.profile b/etc/xplayer-video-thumbnailer.profile
index ac8986c69..6b2878476 100644
--- a/etc/xplayer-video-thumbnailer.profile
+++ b/etc/xplayer-video-thumbnailer.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include xplayer-video-thumbnailer.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include xplayer.profile
diff --git a/etc/xreader-previewer.profile b/etc/xreader-previewer.profile
index 2d7e7644c..6e1dcb5d2 100644
--- a/etc/xreader-previewer.profile
+++ b/etc/xreader-previewer.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include xreader-previewer.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include xreader.profile
diff --git a/etc/xreader-thumbnailer.profile b/etc/xreader-thumbnailer.profile
index d463787e6..a6925fcde 100644
--- a/etc/xreader-thumbnailer.profile
+++ b/etc/xreader-thumbnailer.profile
@@ -3,8 +3,8 @@
 # Persistent local customizations
 include xreader-thumbnailer.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include xreader.profile
diff --git a/etc/xxd.profile b/etc/xxd.profile
index f5072da75..569f194d3 100644
--- a/etc/xxd.profile
+++ b/etc/xxd.profile
@@ -4,8 +4,8 @@
 # Persistent local customizations
 include xxd.local
 # Persistent global definitions
-include globals.local
-
+# added by included profile
+#include globals.local
 
 # Redirect
 include vim.profile
diff --git a/etc/xz.profile b/etc/xz.profile
index 748dad2e3..f7410b928 100644
--- a/etc/xz.profile
+++ b/etc/xz.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/xzcat.profile b/etc/xzcat.profile
index 748dad2e3..f7410b928 100644
--- a/etc/xzcat.profile
+++ b/etc/xzcat.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/xzcmp.profile b/etc/xzcmp.profile
index 748dad2e3..f7410b928 100644
--- a/etc/xzcmp.profile
+++ b/etc/xzcmp.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/xzdiff.profile b/etc/xzdiff.profile
index 748dad2e3..f7410b928 100644
--- a/etc/xzdiff.profile
+++ b/etc/xzdiff.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/xzegrep.profile b/etc/xzegrep.profile
index 748dad2e3..f7410b928 100644
--- a/etc/xzegrep.profile
+++ b/etc/xzegrep.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/xzfgrep.profile b/etc/xzfgrep.profile
index 748dad2e3..f7410b928 100644
--- a/etc/xzfgrep.profile
+++ b/etc/xzfgrep.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/xzgrep.profile b/etc/xzgrep.profile
index 748dad2e3..f7410b928 100644
--- a/etc/xzgrep.profile
+++ b/etc/xzgrep.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/xzless.profile b/etc/xzless.profile
index 748dad2e3..f7410b928 100644
--- a/etc/xzless.profile
+++ b/etc/xzless.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/etc/xzmore.profile b/etc/xzmore.profile
index 748dad2e3..f7410b928 100644
--- a/etc/xzmore.profile
+++ b/etc/xzmore.profile
@@ -2,6 +2,5 @@
 # Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
-
 # Redirect
 include cpio.profile
diff --git a/src/common.mk.in b/src/common.mk.in
index b9af977ae..1b6ad91a5 100644
--- a/src/common.mk.in
+++ b/src/common.mk.in
@@ -20,6 +20,7 @@ HAVE_WHITELIST=@HAVE_WHITELIST@
 HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
 HAVE_APPARMOR=@HAVE_APPARMOR@
 HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
+HAVE_FIRETUNNEL=@HAVE_FIRETUNNEL@
 HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
 HAVE_GCOV=@HAVE_GCOV@
 
@@ -28,7 +29,7 @@ C_FILE_LIST       = $(sort $(wildcard *.c))
 OBJS = $(C_FILE_LIST:.c=.o)
 BINOBJS =  $(foreach file, $(OBJS), $file)
 
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"'  $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
+CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"'  $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_FIRETUNNEL) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
 LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
 EXTRA_CFLAGS +=@EXTRA_CFLAGS@
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index b4efa3add..10293cb8f 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -20,6 +20,7 @@ Maelstrom
 Maps
 Mathematica
 Natron
+PPSSPPQt
 QMediathekView
 QOwnNotes
 Telegram
@@ -288,6 +289,7 @@ iridium
 iridium-browser
 jd-gui
 jdownloader
+jerry
 jitsi
 k3b
 kaffeine
@@ -402,6 +404,7 @@ netactview
 nethack
 netsurf
 neverball
+neverputt
 newsbeuter
 newsboat
 nheko
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 7ca72bf30..b11d795a9 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -278,6 +278,14 @@ void print_compiletime_support(void) {
 #endif
                 );
 
+        printf("\t- firetunnel support is %s\n",
+#ifdef HAVE_FIRETUNNEL
+                "enabled"
+#else
+                "disabled"
+#endif
+                );
+
         printf("\t- networking support is %s\n",
 #ifdef HAVE_NETWORK
                 "enabled"
diff --git a/src/firejail/main.c b/src/firejail/main.c
index c50ed4dc4..2403cafa1 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1498,6 +1498,7 @@ int main(int argc, char **argv) {
                                 exit_err_feature("overlayfs");
                 }
 #endif
+#ifdef HAVE_FIRETUNNEL
                 else if (strcmp(argv[i], "--tunnel") == 0) {
                         // try to connect to the default client side of the tunnel
                         // if this fails, try the default server side of the tunnel
@@ -1523,7 +1524,7 @@ int main(int argc, char **argv) {
                                 exit(1);
                         }
                 }
-
+#endif
                 else if (strncmp(argv[i], "--profile=", 10) == 0) {
                         // multiple profile files are allowed!
 
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 69a9a7bee..3beef3986 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -310,7 +310,7 @@ void x11_start_xvfb(int argc, char **argv) {
 
         if (arg_debug) {
                 size_t i = 0;
-                printf("\n*** Stating xvfb client:");
+                printf("\n*** Starting xvfb client:");
                 while (jail_argv[i]!=NULL) {
                         printf(" \"%s\"", jail_argv[i]);
                         i++;
@@ -838,7 +838,7 @@ void x11_start_xpra_old(int argc, char **argv, int display, char *display_str) {
 
                         if (arg_debug) {
                                 if (n == 10)
-                                        printf("failed to stop xpra server gratefully\n");
+                                        printf("failed to stop xpra server gracefully\n");
                                 else
                                         printf("xpra server successfully stopped in %d secs\n", n);
                         }
@@ -1023,6 +1023,7 @@ void x11_start_xpra(int argc, char **argv) {
         if (!program_in_path("xpra")) {
                 fprintf(stderr, "\nError: Xpra program was not found in /usr/bin directory, please install it:\n");
                 fprintf(stderr, "   Debian/Ubuntu/Mint: sudo apt-get install xpra\n");
+                fprintf(stderr, "   Arch: sudo pacman -S xpra\n");
                 exit(0);
         }
 
@@ -1056,6 +1057,8 @@ void x11_start(int argc, char **argv) {
                 fprintf(stderr, "\nError: Xpra or Xephyr not found in /usr/bin directory, please install one of them:\n");
                 fprintf(stderr, "   Debian/Ubuntu/Mint: sudo apt-get install xpra\n");
                 fprintf(stderr, "   Debian/Ubuntu/Mint: sudo apt-get install xserver-xephyr\n");
+                fprintf(stderr, "   Arch: sudo pacman -S xpra\n");
+                fprintf(stderr, "   Arch: sudo pacman -S xorg-server-xephyr\n");
                 exit(0);
         }
 }
@@ -1087,7 +1090,8 @@ void x11_xorg(void) {
         struct stat s;
         if (stat("/usr/bin/xauth", &s) == -1) {
                 fprintf(stderr, "Error: xauth utility not found in /usr/bin. Please install it:\n"
-                        "   Debian/Ubuntu/Mint: sudo apt-get install xauth\n");
+                        "   Debian/Ubuntu/Mint: sudo apt-get install xauth\n"
+                        "   Arch: sudo pacman -S xorg-xauth\n");
                 exit(1);
         }
         if (s.st_uid != 0 && s.st_gid != 0) {
@@ -1128,8 +1132,14 @@ void x11_xorg(void) {
 #ifdef HAVE_GCOV
                 __gcov_flush();
 #endif
-                execlp("/usr/bin/xauth", "/usr/bin/xauth", "-v", "-f", tmpfname,
+                if (arg_debug) {
+                        execlp("/usr/bin/xauth", "/usr/bin/xauth", "-v", "-f", tmpfname,
                         "generate", display, "MIT-MAGIC-COOKIE-1", "untrusted", NULL);
+                }
+                else {
+                        execlp("/usr/bin/xauth", "/usr/bin/xauth", "-f", tmpfname,
+                        "generate", display, "MIT-MAGIC-COOKIE-1", "untrusted", NULL);
+                }
 
                 _exit(127);
         }
diff --git a/test/compile/compile.sh b/test/compile/compile.sh
index adacab616..e662b4d30 100755
--- a/test/compile/compile.sh
+++ b/test/compile/compile.sh
@@ -3,7 +3,7 @@
 arr[1]="TEST 1: standard compilation"
 arr[2]="TEST 2: compile seccomp disabled"
 arr[3]="TEST 3: compile chroot disabled"
-arr[4]="deprecated: TEST 4: compile bind disabled"
+arr[4]="TEST 4: compile firetunnel disabled"
 arr[5]="TEST 5: compile user namespace disabled"
 arr[6]="TEST 6: compile network disabled"
 arr[7]="TEST 7: compile X11 disabled"
@@ -108,6 +108,24 @@ cp output-make om3
 rm output-configure output-make
 
 #*****************************************************************
+# TEST 4
+#*****************************************************************
+# - disable firetunnel configuration
+#*****************************************************************
+print_title "${arr[4]}"
+# seccomp
+cd firejail
+make distclean
+./configure --prefix=/usr --disable-firetunnel  --enable-fatal-warnings 2>&1 | tee ../output-configure
+make -j4 2>&1 | tee ../output-make
+cd ..
+grep Warning output-configure output-make > ./report-test4
+grep Error output-configure output-make >> ./report-test4
+cp output-configure oc4
+cp output-make om4
+rm output-configure output-make
+
+#*****************************************************************
 # TEST 5
 #*****************************************************************
 # - disable user namespace configuration