aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLibravatar kortewegdevries <kortewegdevries@protonmail.ch>2020-09-03 08:01:15 +0000
committerLibravatar GitHub <noreply@github.com>2020-09-03 08:01:15 +0000
commit7df28c1edeb50f6b856331ba65da05afae7ae81f (patch)
tree85578561dc3716bb4f836edf80dc6de25c113d2b
parentbringing in awk preprocessor from rusty-snake (diff)
downloadfirejail-7df28c1edeb50f6b856331ba65da05afae7ae81f.tar.gz
firejail-7df28c1edeb50f6b856331ba65da05afae7ae81f.tar.zst
firejail-7df28c1edeb50f6b856331ba65da05afae7ae81f.zip
New profiles for balsa,trojita,kube (#3603)
* Added minecraft-launcher-profile Initial * Changed minecraft-launcher profile Added space,tracelog,nodvd * New profiles for balsa,trojita,kube * Switch to whitelisting * Enable gpg,firefox uniformity between other clients * Hyperlinks * Fix Co-authored-by: kortewegdevries <k0rtic_dv@aol.com>
Diffstat
-rw-r--r--etc/inc/disable-programs.inc9
-rw-r--r--etc/profile-a-l/balsa.profile78
-rw-r--r--etc/profile-a-l/kube.profile81
-rw-r--r--etc/profile-m-z/trojita.profile63
-rw-r--r--src/firecfg/firecfg.config3
5 files changed, 234 insertions, 0 deletions
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index 1264caf30..e22a9ae3a 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -37,6 +37,7 @@ blacklist ${HOME}/.VirtualBox
37blacklist ${HOME}/.WebStorm* 37blacklist ${HOME}/.WebStorm*
38blacklist ${HOME}/.Wolfram Research 38blacklist ${HOME}/.Wolfram Research
39blacklist ${HOME}/.ZAP 39blacklist ${HOME}/.ZAP
40blacklist ${HOME}/.abook
40blacklist ${HOME}/.aMule 41blacklist ${HOME}/.aMule
41blacklist ${HOME}/.android 42blacklist ${HOME}/.android
42blacklist ${HOME}/.anydesk 43blacklist ${HOME}/.anydesk
@@ -49,6 +50,7 @@ blacklist ${HOME}/.asunder_album_title
49blacklist ${HOME}/.atom 50blacklist ${HOME}/.atom
50blacklist ${HOME}/.attic 51blacklist ${HOME}/.attic
51blacklist ${HOME}/.audacity-data 52blacklist ${HOME}/.audacity-data
53blacklist ${HOME}/.balsa
52blacklist ${HOME}/.bcast5 54blacklist ${HOME}/.bcast5
53blacklist ${HOME}/.bibletime 55blacklist ${HOME}/.bibletime
54blacklist ${HOME}/.bitcoin 56blacklist ${HOME}/.bitcoin
@@ -209,6 +211,7 @@ blacklist ${HOME}/.config/evince
209blacklist ${HOME}/.config/evolution 211blacklist ${HOME}/.config/evolution
210blacklist ${HOME}/.config/falkon 212blacklist ${HOME}/.config/falkon
211blacklist ${HOME}/.config/filezilla 213blacklist ${HOME}/.config/filezilla
214blacklist ${HOME}/.config/flaska.net
212blacklist ${HOME}/.config/flowblade 215blacklist ${HOME}/.config/flowblade
213blacklist ${HOME}/.config/font-manager 216blacklist ${HOME}/.config/font-manager
214blacklist ${HOME}/.config/freecol 217blacklist ${HOME}/.config/freecol
@@ -278,6 +281,7 @@ blacklist ${HOME}/.config/konversation.notifyrc
278blacklist ${HOME}/.config/kritarc 281blacklist ${HOME}/.config/kritarc
279blacklist ${HOME}/.config/ktorrentrc 282blacklist ${HOME}/.config/ktorrentrc
280blacklist ${HOME}/.config/ktouch2rc 283blacklist ${HOME}/.config/ktouch2rc
284blacklist ${HOME}/.config/kube
281blacklist ${HOME}/.config/kwriterc 285blacklist ${HOME}/.config/kwriterc
282blacklist ${HOME}/.config/leafpad 286blacklist ${HOME}/.config/leafpad
283blacklist ${HOME}/.config/libreoffice 287blacklist ${HOME}/.config/libreoffice
@@ -354,6 +358,7 @@ blacklist ${HOME}/.config/rtv
354blacklist ${HOME}/.config/scribus 358blacklist ${HOME}/.config/scribus
355blacklist ${HOME}/.config/scribusrc 359blacklist ${HOME}/.config/scribusrc
356blacklist ${HOME}/.config/sinew.in 360blacklist ${HOME}/.config/sinew.in
361blacklist ${HOME}/.config/sink
357blacklist ${HOME}/.config/skypeforlinux 362blacklist ${HOME}/.config/skypeforlinux
358blacklist ${HOME}/.config/slimjet 363blacklist ${HOME}/.config/slimjet
359blacklist ${HOME}/.config/smplayer 364blacklist ${HOME}/.config/smplayer
@@ -636,6 +641,7 @@ blacklist ${HOME}/.local/share/krita
636blacklist ${HOME}/.local/share/ktorrent 641blacklist ${HOME}/.local/share/ktorrent
637blacklist ${HOME}/.local/share/ktorrentrc 642blacklist ${HOME}/.local/share/ktorrentrc
638blacklist ${HOME}/.local/share/ktouch 643blacklist ${HOME}/.local/share/ktouch
644blacklist ${HOME}/.local/share/kube
639blacklist ${HOME}/.local/share/kwrite 645blacklist ${HOME}/.local/share/kwrite
640blacklist ${HOME}/.local/share/kxmlgui5/* 646blacklist ${HOME}/.local/share/kxmlgui5/*
641blacklist ${HOME}/.local/share/liferea 647blacklist ${HOME}/.local/share/liferea
@@ -678,6 +684,7 @@ blacklist ${HOME}/.local/share/rhythmbox
678blacklist ${HOME}/.local/share/rtv 684blacklist ${HOME}/.local/share/rtv
679blacklist ${HOME}/.local/share/scribus 685blacklist ${HOME}/.local/share/scribus
680blacklist ${HOME}/.local/share/signal-cli 686blacklist ${HOME}/.local/share/signal-cli
687blacklist ${HOME}/.local/share/sink
681blacklist ${HOME}/.local/share/smuxi 688blacklist ${HOME}/.local/share/smuxi
682blacklist ${HOME}/.local/share/spotify 689blacklist ${HOME}/.local/share/spotify
683blacklist ${HOME}/.local/share/steam 690blacklist ${HOME}/.local/share/steam
@@ -868,6 +875,7 @@ blacklist ${HOME}/.cache/epiphany
868blacklist ${HOME}/.cache/evolution 875blacklist ${HOME}/.cache/evolution
869blacklist ${HOME}/.cache/falkon 876blacklist ${HOME}/.cache/falkon
870blacklist ${HOME}/.cache/feedreader 877blacklist ${HOME}/.cache/feedreader
878blacklist ${HOME}/.cache/flaska.net/trojita
871blacklist ${HOME}/.cache/font-manager 879blacklist ${HOME}/.cache/font-manager
872blacklist ${HOME}/.cache/fossamail 880blacklist ${HOME}/.cache/fossamail
873blacklist ${HOME}/.cache/fractal 881blacklist ${HOME}/.cache/fractal
@@ -907,6 +915,7 @@ blacklist ${HOME}/.cache/krunnerbookmarkrunnerfirefoxdbfile.sqlite*
907blacklist ${HOME}/.cache/kscreenlocker_greet 915blacklist ${HOME}/.cache/kscreenlocker_greet
908blacklist ${HOME}/.cache/ksmserver-logout-greeter 916blacklist ${HOME}/.cache/ksmserver-logout-greeter
909blacklist ${HOME}/.cache/ksplashqml 917blacklist ${HOME}/.cache/ksplashqml
918blacklist ${HOME}/.cache/kube
910blacklist ${HOME}/.cache/kwin 919blacklist ${HOME}/.cache/kwin
911blacklist ${HOME}/.cache/libgweather 920blacklist ${HOME}/.cache/libgweather
912blacklist ${HOME}/.cache/liferea 921blacklist ${HOME}/.cache/liferea
diff --git a/etc/profile-a-l/balsa.profile b/etc/profile-a-l/balsa.profile
new file mode 100644
index 000000000..a401ac592
--- /dev/null
+++ b/etc/profile-a-l/balsa.profile
@@ -0,0 +1,78 @@
1# Firejail profile for balsa
2# Description: GNOME mail client
3# This file is overwritten after every install/update
4# Persistent local customizations
5include balsa.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.balsa
10noblacklist ${HOME}/.gnupg
11noblacklist ${HOME}/.mozilla
12noblacklist ${HOME}/mail
13noblacklist /var/mail
14noblacklist /var/spool/mail
15
16include disable-common.inc
17include disable-devel.inc
18include disable-exec.inc
19include disable-interpreters.inc
20include disable-passwdmgr.inc
21include disable-programs.inc
22include disable-shell.inc
23include disable-xdg.inc
24
25mkdir ${HOME}/.balsa
26mkdir ${HOME}/.gnupg
27mkdir ${HOME}/mail
28whitelist ${HOME}/.balsa
29whitelist ${HOME}/.gnupg
30whitelist ${HOME}/.mozilla/firefox/profiles.ini
31whitelist ${HOME}/mail
32whitelist ${RUNUSER}/gnupg
33whitelist /usr/share/balsa
34whitelist /usr/share/gnupg
35whitelist /usr/share/gnupg2
36whitelist /var/mail
37whitelist /var/spool/mail
38include whitelist-common.inc
39include whitelist-runuser-common.inc
40include whitelist-usr-share-common.inc
41include whitelist-var-common.inc
42
43apparmor
44caps.drop all
45netfilter
46no3d
47nodvd
48nogroups
49nonewprivs
50noroot
51nosound
52notv
53nou2f
54novideo
55protocol unix,inet,inet6
56seccomp
57shell none
58tracelog
59
60# disable-mnt
61# Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg
62# Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile.
63private-bin balsa,balsa-ab
64private-cache
65private-dev
66private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,mailname,passwd,pki,resolv.conf,selinux,ssl,xdg
67private-tmp
68writable-run-user
69writable-var
70
71dbus-user filter
72dbus-user.own org.desktop.Balsa
73dbus-user.talk ca.desrt.dconf
74dbus-user.talk org.freedesktop.secrets
75dbus-user.talk org.freedesktop.Notifications
76dbus-system none
77
78read-only ${HOME}/.mozilla/firefox/profiles.ini
diff --git a/etc/profile-a-l/kube.profile b/etc/profile-a-l/kube.profile
new file mode 100644
index 000000000..cf3a69fd7
--- /dev/null
+++ b/etc/profile-a-l/kube.profile
@@ -0,0 +1,81 @@
1# Firejail profile for kube
2# Description: Qt mail client
3# This file is overwritten after every install/update
4# Persistent local customizations
5include kube.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.gnupg
10noblacklist ${HOME}/.mozilla
11noblacklist ${HOME}/.cache/kube
12noblacklist ${HOME}/.config/kube
13noblacklist ${HOME}/.config/sink
14noblacklist ${HOME}/.local/share/kube
15noblacklist ${HOME}/.local/share/sink
16
17include disable-common.inc
18include disable-devel.inc
19include disable-exec.inc
20include disable-interpreters.inc
21include disable-passwdmgr.inc
22include disable-programs.inc
23include disable-shell.inc
24include disable-xdg.inc
25
26mkdir ${HOME}/.gnupg
27mkdir ${HOME}/.cache/kube
28mkdir ${HOME}/.config/kube
29mkdir ${HOME}/.config/sink
30mkdir ${HOME}/.local/share/kube
31mkdir ${HOME}/.local/share/sink
32whitelist ${HOME}/.gnupg
33whitelist ${HOME}/.mozilla/firefox/profiles.ini
34whitelist ${HOME}/.cache/kube
35whitelist ${HOME}/.config/kube
36whitelist ${HOME}/.config/sink
37whitelist ${HOME}/.local/share/kube
38whitelist ${HOME}/.local/share/sink
39whitelist ${RUNUSER}/gnupg
40whitelist /usr/share/kube
41whitelist /usr/share/gnupg
42whitelist /usr/share/gnupg2
43include whitelist-common.inc
44include whitelist-runuser-common.inc
45include whitelist-usr-share-common.inc
46include whitelist-var-common.inc
47
48apparmor
49caps.drop all
50netfilter
51no3d
52nodvd
53nogroups
54nonewprivs
55noroot
56nosound
57notv
58nou2f
59novideo
60protocol unix,inet,inet6
61seccomp
62shell none
63tracelog
64
65# disable-mnt
66# Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg
67# Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile.
68private-bin kube,sink_synchronizer
69private-cache
70private-dev
71private-etc alternatives,ca-certificates,crypto-policies,fonts,gcrypt,gtk-2.0,gtk-3.0,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg
72private-tmp
73writable-run-user
74
75dbus-user filter
76dbus-user.talk ca.desrt.dconf
77dbus-user.talk org.freedesktop.secrets
78dbus-user.talk org.freedesktop.Notifications
79dbus-system none
80
81read-only ${HOME}/.mozilla/firefox/profiles.ini
diff --git a/etc/profile-m-z/trojita.profile b/etc/profile-m-z/trojita.profile
new file mode 100644
index 000000000..a8641af85
--- /dev/null
+++ b/etc/profile-m-z/trojita.profile
@@ -0,0 +1,63 @@
1# Firejail profile for trojita
2# Description: Qt mail client
3# This file is overwritten after every install/update
4# Persistent local customizations
5include trojita.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.abook
10noblacklist ${HOME}/.mozilla
11noblacklist ${HOME}/.cache/flaska.net/trojita
12noblacklist ${HOME}/.config/flaska.net
13
14include disable-common.inc
15include disable-devel.inc
16include disable-exec.inc
17include disable-interpreters.inc
18include disable-passwdmgr.inc
19include disable-programs.inc
20include disable-shell.inc
21include disable-xdg.inc
22
23mkdir ${HOME}/.abook
24mkdir ${HOME}/.cache/flaska.net/trojita
25mkdir ${HOME}/.config/flaska.net
26whitelist ${HOME}/.abook
27whitelist ${HOME}/.mozilla/firefox/profiles.ini
28whitelist ${HOME}/.cache/flaska.net/trojita
29whitelist ${HOME}/.config/flaska.net
30include whitelist-common.inc
31include whitelist-runuser-common.inc
32include whitelist-usr-share-common.inc
33include whitelist-var-common.inc
34
35apparmor
36caps.drop all
37netfilter
38no3d
39nodvd
40nogroups
41nonewprivs
42noroot
43nosound
44notv
45nou2f
46novideo
47protocol unix,inet,inet6,netlink
48seccomp
49shell none
50tracelog
51
52# disable-mnt
53# Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile.
54private-bin trojita
55private-cache
56private-dev
57private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg
58private-tmp
59
60dbus-user none
61dbus-system none
62
63read-only ${HOME}/.mozilla/firefox/profiles.ini
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 54c568f27..5e0ca8de4 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -70,6 +70,7 @@ autokey-shell
70aweather 70aweather
71baloo_file 71baloo_file
72baloo_filemetadata_temp_extractor 72baloo_filemetadata_temp_extractor
73balsa
73baobab 74baobab
74barrier 75barrier
75basilisk 76basilisk
@@ -405,6 +406,7 @@ krita
405# krunner 406# krunner
406ktorrent 407ktorrent
407ktouch 408ktouch
409kube
408# kwin_x11 410# kwin_x11
409kwrite 411kwrite
410leafpad 412leafpad
@@ -748,6 +750,7 @@ transmission-remote-cli
748transmission-remote-gtk 750transmission-remote-gtk
749transmission-show 751transmission-show
750tremulous 752tremulous
753trojita
751truecraft 754truecraft
752tshark 755tshark
753tuxguitar 756tuxguitar
generated by cgit v1.2.3-54-g00ecf (git 2.45.1) at 2024-06-01 23:39:45 +0000