aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLibravatar glitsj16 <glitsj16@users.noreply.github.com>2020-04-21 20:58:34 +0000
committerLibravatar GitHub <noreply@github.com>2020-04-21 20:58:34 +0000
commitb7bcc70d20a71daf5ba6dff670bbf90e7a09d2e4 (patch)
tree609778557c185bb7fabef76ac05a694f875d4f09
parentupdate issue template + add ICEauthority to wruc (diff)
downloadfirejail-b7bcc70d20a71daf5ba6dff670bbf90e7a09d2e4.tar.gz
firejail-b7bcc70d20a71daf5ba6dff670bbf90e7a09d2e4.tar.zst
firejail-b7bcc70d20a71daf5ba6dff670bbf90e7a09d2e4.zip
file managers refactoring (#3375)
* refactor caja.profile * refactor dolphin.profile * Create file-manager-common.profile * refactor nautilus.profile * refactor nemo.profile * refactor pcmanfm.profile * refactor ranger.profile * refactor Thunar.profile
Diffstat
-rw-r--r--etc/profile-a-l/caja.profile34
-rw-r--r--etc/profile-a-l/dolphin.profile34
-rw-r--r--etc/profile-a-l/file-manager-common.profile49
-rw-r--r--etc/profile-m-z/Thunar.profile27
-rw-r--r--etc/profile-m-z/nautilus.profile35
-rw-r--r--etc/profile-m-z/nemo.profile32
-rw-r--r--etc/profile-m-z/pcmanfm.profile29
-rw-r--r--etc/profile-m-z/ranger.profile38
8 files changed, 70 insertions, 208 deletions
diff --git a/etc/profile-a-l/caja.profile b/etc/profile-a-l/caja.profile
index 7bf901ae3..1af102ca8 100644
--- a/etc/profile-a-l/caja.profile
+++ b/etc/profile-a-l/caja.profile
@@ -9,35 +9,7 @@ include globals.local
9# Caja is started by systemd on most systems. Therefore it is not firejailed by default. Since there 9# Caja is started by systemd on most systems. Therefore it is not firejailed by default. Since there
10# is already a caja process running on MATE desktops firejail will have no effect. 10# is already a caja process running on MATE desktops firejail will have no effect.
11 11
12noblacklist ${HOME}/.local/share/Trash 12# Put 'ignore noroot' in your caja.local if you use MPV+Vulkan (see issue #3012)
13# noblacklist ${HOME}/.config/caja - disable-programs.inc is disabled, see below
14# noblacklist ${HOME}/.local/share/caja-python
15 13
16# Allow python (blacklisted by disable-interpreters.inc) 14# Redirect
17include allow-python2.inc 15include file-manager-common.profile
18include allow-python3.inc
19
20include disable-common.inc
21include disable-devel.inc
22include disable-interpreters.inc
23include disable-passwdmgr.inc
24# include disable-programs.inc
25
26allusers
27caps.drop all
28netfilter
29nodvd
30nogroups
31nonewprivs
32noroot
33notv
34novideo
35protocol unix
36seccomp
37shell none
38tracelog
39
40# caja needs to be able to start arbitrary applications so we cannot blacklist their files
41# private-bin caja
42# private-dev
43# private-tmp
diff --git a/etc/profile-a-l/dolphin.profile b/etc/profile-a-l/dolphin.profile
index d264470af..e0300a577 100644
--- a/etc/profile-a-l/dolphin.profile
+++ b/etc/profile-a-l/dolphin.profile
@@ -6,37 +6,9 @@ include dolphin.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9noblacklist ${HOME}/.local/share/Trash 9# Put 'ignore noroot' in your dolphin.local if you use MPV+Vulkan (see issue #3012)
10# noblacklist ${HOME}/.cache/dolphin - disable-programs.inc is disabled, see below
11# noblacklist ${HOME}/.config/dolphinrc
12# noblacklist ${HOME}/.local/share/dolphin
13 10
14# Allow lua (blacklisted by disable-interpreters.inc) 11# Redirect
15include allow-lua.inc 12include file-manager-common.profile
16
17include disable-common.inc
18include disable-devel.inc
19include disable-interpreters.inc
20include disable-passwdmgr.inc
21# dolphin needs to be able to start arbitrary applications so we cannot blacklist their files
22# include disable-programs.inc
23
24allusers
25caps.drop all
26# net none
27netfilter
28nodvd
29nogroups
30nonewprivs
31# Comment the next line (or put 'ignore noroot' in your dolphin.local) if you use MPV+Vulkan (see issue #3012)
32noroot
33notv
34novideo
35protocol unix,inet,inet6,netlink
36seccomp
37shell none
38
39private-dev
40# private-tmp
41 13
42join-or-start dolphin 14join-or-start dolphin
diff --git a/etc/profile-a-l/file-manager-common.profile b/etc/profile-a-l/file-manager-common.profile
new file mode 100644
index 000000000..8551e713d
--- /dev/null
+++ b/etc/profile-a-l/file-manager-common.profile
@@ -0,0 +1,49 @@
1# Firejail profile for file managers
2# Description: Common profile for GUI file managers
3# This file is overwritten after every install/update
4# Persistent local customizations
5include file-manager-common.local
6# Persistent global definitions
7# added by caller profile
8#include globals.local
9
10# File managers need to be able to see everything under ${HOME}
11# and be able to start arbitrary applications
12
13ignore noexec ${HOME}
14
15# Allow lua (blacklisted by disable-interpreters.inc)
16include allow-lua.inc
17
18# Allow perl
19include allow-perl.inc
20
21# Allow python (blacklisted by disable-interpreters.inc)
22include allow-python2.inc
23include allow-python3.inc
24
25#include disable-common.inc
26include disable-devel.inc
27include disable-interpreters.inc
28include disable-passwdmgr.inc
29# include disable-programs.inc
30
31allusers
32caps.drop all
33netfilter
34nodvd
35nogroups
36nonewprivs
37noroot
38notv
39nou2f
40novideo
41protocol unix,inet,inet6,netlink
42seccomp
43shell none
44tracelog
45
46private-dev
47
48#dbus-user none
49#dbus-system none
diff --git a/etc/profile-m-z/Thunar.profile b/etc/profile-m-z/Thunar.profile
index 761440ccc..28acb414b 100644
--- a/etc/profile-m-z/Thunar.profile
+++ b/etc/profile-m-z/Thunar.profile
@@ -6,28 +6,7 @@ include Thunar.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9noblacklist ${HOME}/.local/share/Trash 9# Put 'ignore noroot' in your pcmanfm.local if you use MPV+Vulkan (see issue #3012)
10noblacklist ${HOME}/.config/Thunar
11noblacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml
12 10
13include disable-common.inc 11# Redirect
14include disable-devel.inc 12include file-manager-common.profile
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17# include disable-programs.inc
18
19allusers
20caps.drop all
21netfilter
22no3d
23nodvd
24nogroups
25nonewprivs
26noroot
27nosound
28notv
29novideo
30protocol unix
31seccomp
32shell none
33tracelog
diff --git a/etc/profile-m-z/nautilus.profile b/etc/profile-m-z/nautilus.profile
index e003488de..e54bea228 100644
--- a/etc/profile-m-z/nautilus.profile
+++ b/etc/profile-m-z/nautilus.profile
@@ -9,36 +9,7 @@ include globals.local
9# Nautilus is started by systemd on most systems. Therefore it is not firejailed by default. Since there 9# Nautilus is started by systemd on most systems. Therefore it is not firejailed by default. Since there
10# is already a nautilus process running on gnome desktops firejail will have no effect. 10# is already a nautilus process running on gnome desktops firejail will have no effect.
11 11
12noblacklist ${HOME}/.config/nautilus 12# Put 'ignore noroot' in your nautilus.local if you use MPV+Vulkan (see issue #3012)
13noblacklist ${HOME}/.local/share/Trash
14noblacklist ${HOME}/.local/share/nautilus
15noblacklist ${HOME}/.local/share/nautilus-python
16 13
17# Allow python (blacklisted by disable-interpreters.inc) 14# Redirect
18include allow-python2.inc 15include file-manager-common.profile
19include allow-python3.inc
20
21include disable-common.inc
22include disable-devel.inc
23include disable-interpreters.inc
24include disable-passwdmgr.inc
25# include disable-programs.inc
26
27allusers
28caps.drop all
29netfilter
30nodvd
31nogroups
32nonewprivs
33noroot
34notv
35novideo
36protocol unix
37seccomp
38shell none
39tracelog
40
41# nautilus needs to be able to start arbitrary applications so we cannot blacklist their files
42# private-bin nautilus
43# private-dev
44# private-tmp
diff --git a/etc/profile-m-z/nemo.profile b/etc/profile-m-z/nemo.profile
index 6a62a3a0c..1b3333e8c 100644
--- a/etc/profile-m-z/nemo.profile
+++ b/etc/profile-m-z/nemo.profile
@@ -6,33 +6,7 @@ include nemo.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9noblacklist ${HOME}/.config/nemo 9# Put 'ignore noroot' in your nemo.local if you use MPV+Vulkan (see issue #3012)
10noblacklist ${HOME}/.local/share/Trash
11noblacklist ${HOME}/.local/share/nemo
12noblacklist ${HOME}/.local/share/nemo-python
13
14# Allow python (blacklisted by disable-interpreters.inc)
15include allow-python2.inc
16include allow-python3.inc
17
18include disable-common.inc
19include disable-devel.inc
20include disable-exec.inc
21include disable-interpreters.inc
22include disable-passwdmgr.inc
23
24allusers
25caps.drop all
26netfilter
27no3d
28nodvd
29nogroups
30nonewprivs
31noroot
32nosound
33notv
34novideo
35protocol unix,inet,inet6
36seccomp
37shell none
38 10
11# Redirect
12include file-manager-common.profile
diff --git a/etc/profile-m-z/pcmanfm.profile b/etc/profile-m-z/pcmanfm.profile
index 4e53f9d6e..5718ab164 100644
--- a/etc/profile-m-z/pcmanfm.profile
+++ b/etc/profile-m-z/pcmanfm.profile
@@ -6,30 +6,7 @@ include pcmanfm.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9noblacklist ${HOME}/.local/share/Trash 9# Put 'ignore noroot' in your pcmanfm.local if you use MPV+Vulkan (see issue #3012)
10# noblacklist ${HOME}/.config/libfm - disable-programs.inc is disabled, see below
11# noblacklist ${HOME}/.config/pcmanfm
12 10
13include disable-common.inc 11# Redirect
14include disable-devel.inc 12include file-manager-common.profile
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17# include disable-programs.inc
18
19allusers
20caps.drop all
21# net none - see issue #1467, computer:/// location broken
22no3d
23nodvd
24nonewprivs
25noroot
26nosound
27notv
28novideo
29protocol unix
30seccomp
31shell none
32tracelog
33
34# dbus-user none
35# dbus-system none
diff --git a/etc/profile-m-z/ranger.profile b/etc/profile-m-z/ranger.profile
index af033af1a..8b3fe97d8 100644
--- a/etc/profile-m-z/ranger.profile
+++ b/etc/profile-m-z/ranger.profile
@@ -6,39 +6,7 @@ include ranger.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9noblacklist ${HOME}/.config/nano 9# Put 'ignore noroot' in your ranger.local if you use MPV+Vulkan (see issue #3012)
10noblacklist ${HOME}/.config/ranger
11noblacklist ${HOME}/.nanorc
12 10
13# Allow python (blacklisted by disable-interpreters.inc) 11# Redirect
14include allow-python2.inc 12include file-manager-common.profile
15include allow-python3.inc
16
17# Allow perl
18include allow-perl.inc
19
20include disable-common.inc
21include disable-devel.inc
22include disable-interpreters.inc
23include disable-passwdmgr.inc
24include disable-programs.inc
25
26allusers
27caps.drop all
28net none
29nodvd
30nogroups
31nonewprivs
32noroot
33nosound
34notv
35nou2f
36novideo
37protocol unix
38seccomp
39#x11 none
40
41private-dev
42
43dbus-user none
44dbus-system none
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-05 00:11:02 +0000