nslookup, host profiles

5 files changed, 118 insertions, 1 deletions

diff --git a/etc/dig.profile b/etc/dig.profile
index 0e1598406..e6b7e46d9 100644
--- a/etc/dig.profile
+++ b/etc/dig.profile
@@ -8,6 +8,7 @@ include dig.local
 include globals.local
 
 noblacklist ${HOME}/.digrc
+noblacklist ${PATH}/dig
 
 blacklist /tmp/.X11-unix
 
@@ -48,7 +49,6 @@ tracelog
 disable-mnt
 private
 private-bin bash,dig,sh
-private-cache
 private-dev
 # Uncomment the next line (or put 'private-lib' in your dig.local) on non Debian/Ubuntu OS (see issue #3038)
 #private-lib
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index 6f9149dee..6ff83964d 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -469,3 +469,18 @@ blacklist ${HOME}/sent
 
 # kernel configuration
 blacklist /proc/config.gz
+
+# prevent DNS malware attempting to communicate with the server
+# using regular DNS tools
+blacklist ${PATH}/dig
+blacklist ${PATH}/kdig
+blacklist ${PATH}/nslookup
+blacklist ${PATH}/host
+blacklist ${PATH}/dlint
+blacklist ${PATH}/dnswalk
+blacklist ${PATH}/dns2tcp
+blacklist ${PATH}/iodine
+blacklist ${PATH}/knsupdate
+
+
+
diff --git a/etc/host.profile b/etc/host.profile
new file mode 100644
index 000000000..7e2012597
--- /dev/null
+++ b/etc/host.profile
@@ -0,0 +1,49 @@
+# Firejail profile for dig
+# Description: DNS lookup utility
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include host.local
+# Persistent global definitions
+include globals.local
+
+noblacklist ${PATH}/host
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include disable-xdg.inc
+
+include whitelist-usr-share-common.inc
+include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+ipc-namespace
+machine-id
+netfilter
+no3d
+nodbus
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+nou2f
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+tracelog
+
+disable-mnt
+private
+private-bin bash,host,sh
+private-dev
+private-tmp
+
+memory-deny-write-execute
diff --git a/etc/nslookup.profile b/etc/nslookup.profile
new file mode 100644
index 000000000..40897a3a8
--- /dev/null
+++ b/etc/nslookup.profile
@@ -0,0 +1,49 @@
+# Firejail profile for dig
+# Description: DNS lookup utility
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include nslookup.local
+# Persistent global definitions
+include globals.local
+
+noblacklist ${PATH}/nslookup
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include disable-xdg.inc
+
+include whitelist-usr-share-common.inc
+include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+ipc-namespace
+machine-id
+netfilter
+no3d
+nodbus
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+nou2f
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+tracelog
+
+disable-mnt
+private
+private-bin bash,nslookup,sh
+private-dev
+private-tmp
+
+memory-deny-write-execute
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index c27f78d0f..c2401ee32 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -149,6 +149,7 @@ desktopeditors
 devhelp
 dex2jar
 dia
+dig
 digikam
 dillo
 dino
@@ -305,6 +306,7 @@ hashcat
 hedgewars
 hexchat
 highlight
+host
 hugin
 icecat
 icedove
@@ -468,6 +470,7 @@ nitroshare-nmh
 nitroshare-send
 nitroshare-ui
 nomacs
+nslookup
 nylas
 nyx
 obs
@@ -481,6 +484,7 @@ ooviewdoc
 open-invaders
 openarena
 opencity
+openclonk
 openoffice.org
 openshot
 openshot-qt