aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLibravatar bbhtt <62639087+bbhtt@users.noreply.github.com>2020-12-28 13:10:15 +0000
committerLibravatar bbhtt <62639087+bbhtt@users.noreply.github.com>2020-12-28 13:10:15 +0000
commita8a8e33bc17263db763cd7bd803314f8d5dbd2c5 (patch)
treee6941abe0856b28a6f1b68c58ae88e8b4e68330a
parentshell autoselection fixup (diff)
downloadfirejail-a8a8e33bc17263db763cd7bd803314f8d5dbd2c5.tar.gz
firejail-a8a8e33bc17263db763cd7bd803314f8d5dbd2c5.tar.zst
firejail-a8a8e33bc17263db763cd7bd803314f8d5dbd2c5.zip
Add whitelisting to mutt; improve geary, new profile for neomutt
Diffstat
-rw-r--r--etc/inc/disable-programs.inc2
-rw-r--r--etc/profile-a-l/geary.profile61
-rw-r--r--etc/profile-m-z/mutt.profile75
-rw-r--r--etc/profile-m-z/neomutt.profile143
4 files changed, 268 insertions, 13 deletions
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index 07fefec8c..60b586ae2 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -316,11 +316,13 @@ blacklist ${HOME}/.config/mpd
316blacklist ${HOME}/.config/mps-youtube 316blacklist ${HOME}/.config/mps-youtube
317blacklist ${HOME}/.config/mpv 317blacklist ${HOME}/.config/mpv
318blacklist ${HOME}/.config/mupen64plus 318blacklist ${HOME}/.config/mupen64plus
319blacklist ${HOME}/.config/mutt
319blacklist ${HOME}/.config/mutter 320blacklist ${HOME}/.config/mutter
320blacklist ${HOME}/.config/mypaint 321blacklist ${HOME}/.config/mypaint
321blacklist ${HOME}/.config/nano 322blacklist ${HOME}/.config/nano
322blacklist ${HOME}/.config/nautilus 323blacklist ${HOME}/.config/nautilus
323blacklist ${HOME}/.config/nemo 324blacklist ${HOME}/.config/nemo
325blacklist ${HOME}/.config/neomutt
324blacklist ${HOME}/.config/netsurf 326blacklist ${HOME}/.config/netsurf
325blacklist ${HOME}/.config/newsbeuter 327blacklist ${HOME}/.config/newsbeuter
326blacklist ${HOME}/.config/newsflash 328blacklist ${HOME}/.config/newsflash
diff --git a/etc/profile-a-l/geary.profile b/etc/profile-a-l/geary.profile
index f4e5a392f..3f96d8b25 100644
--- a/etc/profile-a-l/geary.profile
+++ b/etc/profile-a-l/geary.profile
@@ -4,19 +4,21 @@
4# Persistent local customizations 4# Persistent local customizations
5include geary.local 5include geary.local
6# Persistent global definitions 6# Persistent global definitions
7# added by included profile 7include globals.local
8#include globals.local
9
10# Users have Geary set to open a browser by clicking a link in an email
11# We are not allowed to blacklist browser-specific directories
12
13ignore dbus-user filter
14ignore dbus-system none
15ignore private-tmp
16 8
17noblacklist ${HOME}/.cache/geary 9noblacklist ${HOME}/.cache/geary
18noblacklist ${HOME}/.config/geary 10noblacklist ${HOME}/.config/geary
19noblacklist ${HOME}/.local/share/geary 11noblacklist ${HOME}/.local/share/geary
12noblacklist ${HOME}/.mozilla
13
14include disable-common.inc
15include disable-devel.inc
16include disable-exec.inc
17include disable-interpreters.inc
18include disable-passwdmgr.inc
19include disable-programs.inc
20include disable-shell.inc
21include disable-xdg.inc
20 22
21mkdir ${HOME}/.cache/geary 23mkdir ${HOME}/.cache/geary
22mkdir ${HOME}/.config/geary 24mkdir ${HOME}/.config/geary
@@ -24,8 +26,43 @@ mkdir ${HOME}/.local/share/geary
24whitelist ${HOME}/.cache/geary 26whitelist ${HOME}/.cache/geary
25whitelist ${HOME}/.config/geary 27whitelist ${HOME}/.config/geary
26whitelist ${HOME}/.local/share/geary 28whitelist ${HOME}/.local/share/geary
29whitelist ${HOME}/.mozilla/firefox/profiles.ini
30whitelist ${DOWNLOADS}
27whitelist /usr/share/geary 31whitelist /usr/share/geary
32include whitelist-common.inc
33include whitelist-runuser-common.inc
34include whitelist-usr-share-common.inc
35include whitelist-var-common.inc
36
37apparmor
38caps.drop all
39netfilter
40no3d
41nodvd
42nogroups
43nonewprivs
44noroot
45nosound
46notv
47nou2f
48novideo
49protocol unix,inet,inet6
50seccomp
51shell none
52tracelog
53
54# disable-mnt
55# Add ignore private-bin to geary.local for hyperlink support
56private-bin geary
57private-cache
58private-dev
59private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg
60private-tmp
61
62dbus-user filter
63dbus-user.own org.gnome.Geary
64dbus-user.talk ca.desrt.dconf
65dbus-user.talk org.freedesktop.secrets
66dbus-system none
28 67
29# allow Mozilla browsers 68read-only ${HOME}/.mozilla/firefox/profiles.ini
30# Redirect
31include firefox.profile
diff --git a/etc/profile-m-z/mutt.profile b/etc/profile-m-z/mutt.profile
index 1ce12f54f..87e7c7f06 100644
--- a/etc/profile-m-z/mutt.profile
+++ b/etc/profile-m-z/mutt.profile
@@ -1,5 +1,6 @@
1# Firejail profile for mutt 1# Firejail profile for mutt
2# Description: Text-based mailreader supporting MIME, GPG, PGP and threading 2# Description: Text-based mailreader supporting MIME, GPG, PGP and threading
3quiet
3# This file is overwritten after every install/update 4# This file is overwritten after every install/update
4# Persistent local customizations 5# Persistent local customizations
5include mutt.local 6include mutt.local
@@ -10,13 +11,14 @@ noblacklist /var/mail
10noblacklist /var/spool/mail 11noblacklist /var/spool/mail
11noblacklist ${HOME}/.Mail 12noblacklist ${HOME}/.Mail
12noblacklist ${HOME}/.bogofilter 13noblacklist ${HOME}/.bogofilter
13noblacklist ${HOME}/.cache/mutt 14noblacklist ${HOME}/.config/mutt
14noblacklist ${HOME}/.config/nano 15noblacklist ${HOME}/.config/nano
15noblacklist ${HOME}/.elinks 16noblacklist ${HOME}/.elinks
16noblacklist ${HOME}/.emacs 17noblacklist ${HOME}/.emacs
17noblacklist ${HOME}/.emacs.d 18noblacklist ${HOME}/.emacs.d
18noblacklist ${HOME}/.gnupg 19noblacklist ${HOME}/.gnupg
19noblacklist ${HOME}/.mail 20noblacklist ${HOME}/.mail
21noblacklist ${HOME}/.mailcap
20noblacklist ${HOME}/.msmtprc 22noblacklist ${HOME}/.msmtprc
21noblacklist ${HOME}/.mutt 23noblacklist ${HOME}/.mutt
22noblacklist ${HOME}/.muttrc 24noblacklist ${HOME}/.muttrc
@@ -34,14 +36,77 @@ noblacklist ${HOME}/sent
34blacklist /tmp/.X11-unix 36blacklist /tmp/.X11-unix
35blacklist ${RUNUSER}/wayland-* 37blacklist ${RUNUSER}/wayland-*
36 38
39include allow-perl.inc
40include allow-python.inc
41
37include disable-common.inc 42include disable-common.inc
38include disable-devel.inc 43include disable-devel.inc
44include disable-exec.inc
39include disable-interpreters.inc 45include disable-interpreters.inc
40include disable-passwdmgr.inc 46include disable-passwdmgr.inc
41include disable-programs.inc 47include disable-programs.inc
48include disable-xdg.inc
42 49
50mkfile ${HOME}/.elinks
51mkfile ${HOME}/.emacs
52mkfile ${HOME}/.mailcap
53mkfile ${HOME}/.msmtprc
54mkfile ${HOME}/.muttrc
55mkfile ${HOME}/.nanorc
56mkfile ${HOME}/.signature
57mkfile ${HOME}/.vimrc
58mkfile ${HOME}/.viminfo
59mkfile ${HOME}/.vimrc
60mkfile ${HOME}/.w3m
61mkdir ${HOME}/.Mail
62mkdir ${HOME}/.bogofilter
63mkdir ${HOME}/.config/mutt
64mkdir ${HOME}/.config/nano
65mkdir ${HOME}/.emacs.d
66mkdir ${HOME}/.gnupg
67mkdir ${HOME}/.mail
68mkdir ${HOME}/.mutt
69mkdir ${HOME}/.vim
70mkdir ${HOME}/Mail
71mkdir ${HOME}/mail
72mkdir ${HOME}/postponed
73mkdir ${HOME}/sent
74whitelist ${HOME}/.Mail
75whitelist ${HOME}/.bogofilter
76whitelist ${HOME}/.config/mutt
77whitelist ${HOME}/.config/nano
78whitelist ${HOME}/.elinks
79whitelist ${HOME}/.emacs
80whitelist ${HOME}/.emacs.d
81whitelist ${HOME}/.gnupg
82whitelist ${HOME}/.mail
83whitelist ${HOME}/.mailcap
84whitelist ${HOME}/.msmtprc
85whitelist ${HOME}/.mutt
86whitelist ${HOME}/.muttrc
87whitelist ${HOME}/.nanorc
88whitelist ${HOME}/.signature
89whitelist ${HOME}/.vim
90whitelist ${HOME}/.viminfo
91whitelist ${HOME}/.vimrc
92whitelist ${HOME}/.w3m
93whitelist ${HOME}/Mail
94whitelist ${HOME}/mail
95whitelist ${HOME}/postponed
96whitelist ${HOME}/sent
97whitelist ${DOCUMENTS}
98whitelist ${DOWNLOADS}
99whitelist /usr/share/gnupg
100whitelist /usr/share/gnupg2
101whitelist /usr/share/mutt
102whitelist /var/mail
103whitelist /var/spool/mail
104include whitelist-common.inc
43include whitelist-runuser-common.inc 105include whitelist-runuser-common.inc
106include whitelist-usr-share-common.inc
107include whitelist-var-common.inc
44 108
109apparmor
45caps.drop all 110caps.drop all
46netfilter 111netfilter
47no3d 112no3d
@@ -56,7 +121,15 @@ novideo
56protocol unix,inet,inet6 121protocol unix,inet,inet6
57seccomp 122seccomp
58shell none 123shell none
124tracelog
59 125
126# disable-mnt
127private-cache
60private-dev 128private-dev
129private-etc alternatives,ca-certificates,crypto-policies,fonts,gai.conf,gcrypt,gnupg,gnutls,hostname,hosts,hosts.conf,mail,mailname,Mutt,Muttrc,Muttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,terminfo,xdg
130private-tmp
61writable-run-user 131writable-run-user
62writable-var 132writable-var
133
134dbus-user none
135dbus-system none
diff --git a/etc/profile-m-z/neomutt.profile b/etc/profile-m-z/neomutt.profile
new file mode 100644
index 000000000..d71dc618b
--- /dev/null
+++ b/etc/profile-m-z/neomutt.profile
@@ -0,0 +1,143 @@
1# Firejail profile for neomutt
2# Description: Mutt fork with advanced features and better documentation
3quiet
4# This file is overwritten after every install/update
5# Persistent local customizations
6include neomutt.local
7# Persistent global definitions
8include globals.local
9
10noblacklist /var/mail
11noblacklist /var/spool/mail
12noblacklist ${HOME}/.Mail
13noblacklist ${HOME}/.bogofilter
14noblacklist ${HOME}/.config/mutt
15noblacklist ${HOME}/.config/nano
16noblacklist ${HOME}/.config/neomutt
17noblacklist ${HOME}/.elinks
18noblacklist ${HOME}/.emacs
19noblacklist ${HOME}/.emacs.d
20noblacklist ${HOME}/.gnupg
21noblacklist ${HOME}/.mail
22noblacklist ${HOME}/.mailcap
23noblacklist ${HOME}/.msmtprc
24noblacklist ${HOME}/.mutt
25noblacklist ${HOME}/.muttrc
26noblacklist ${HOME}/.nanorc
27noblacklist ${HOME}/.neomutt
28noblacklist ${HOME}/.neomuttrc
29noblacklist ${HOME}/.signature
30noblacklist ${HOME}/.vim
31noblacklist ${HOME}/.viminfo
32noblacklist ${HOME}/.vimrc
33noblacklist ${HOME}/.w3m
34noblacklist ${HOME}/Mail
35noblacklist ${HOME}/mail
36noblacklist ${HOME}/postponed
37noblacklist ${HOME}/sent
38
39blacklist /tmp/.X11-unix
40blacklist ${RUNUSER}/wayland-*
41
42include allow-lua.inc
43
44include disable-common.inc
45include disable-devel.inc
46include disable-exec.inc
47include disable-interpreters.inc
48include disable-passwdmgr.inc
49include disable-programs.inc
50include disable-xdg.inc
51
52mkfile ${HOME}/.elinks
53mkfile ${HOME}/.emacs
54mkfile ${HOME}/.mailcap
55mkfile ${HOME}/.msmtprc
56mkfile ${HOME}/.muttrc
57mkfile ${HOME}/.nanorc
58mkfile ${HOME}/.neomuttrc
59mkfile ${HOME}/.signature
60mkfile ${HOME}/.vimrc
61mkfile ${HOME}/.viminfo
62mkfile ${HOME}/.vimrc
63mkfile ${HOME}/.w3m
64mkdir ${HOME}/.Mail
65mkdir ${HOME}/.bogofilter
66mkdir ${HOME}/.config/mutt
67mkdir ${HOME}/.config/nano
68mkdir ${HOME}/.config/neomutt
69mkdir ${HOME}/.emacs.d
70mkdir ${HOME}/.gnupg
71mkdir ${HOME}/.mail
72mkdir ${HOME}/.mutt
73mkdir ${HOME}/.neomutt
74mkdir ${HOME}/.vim
75mkdir ${HOME}/Mail
76mkdir ${HOME}/mail
77mkdir ${HOME}/postponed
78mkdir ${HOME}/sent
79whitelist ${HOME}/.Mail
80whitelist ${HOME}/.bogofilter
81whitelist ${HOME}/.config/mutt
82whitelist ${HOME}/.config/nano
83whitelist ${HOME}/.config/neomutt
84whitelist ${HOME}/.elinks
85whitelist ${HOME}/.emacs
86whitelist ${HOME}/.emacs.d
87whitelist ${HOME}/.gnupg
88whitelist ${HOME}/.mail
89whitelist ${HOME}/.mailcap
90whitelist ${HOME}/.msmtprc
91whitelist ${HOME}/.mutt
92whitelist ${HOME}/.muttrc
93whitelist ${HOME}/.nanorc
94whitelist ${HOME}/.neomutt
95whitelist ${HOME}/.neomuttrc
96whitelist ${HOME}/.signature
97whitelist ${HOME}/.vim
98whitelist ${HOME}/.viminfo
99whitelist ${HOME}/.vimrc
100whitelist ${HOME}/.w3m
101whitelist ${HOME}/Mail
102whitelist ${HOME}/mail
103whitelist ${HOME}/postponed
104whitelist ${HOME}/sent
105whitelist ${DOCUMENTS}
106whitelist ${DOWNLOADS}
107whitelist /usr/share/gnupg
108whitelist /usr/share/gnupg2
109whitelist /usr/share/neomutt
110whitelist /var/mail
111whitelist /var/spool/mail
112include whitelist-common.inc
113include whitelist-runuser-common.inc
114include whitelist-usr-share-common.inc
115include whitelist-var-common.inc
116
117apparmor
118caps.drop all
119netfilter
120no3d
121nodvd
122nogroups
123nonewprivs
124noroot
125nosound
126notv
127nou2f
128novideo
129protocol unix,inet,inet6
130seccomp
131shell none
132tracelog
133
134# disable-mnt
135private-cache
136private-dev
137private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,hostname,hosts,hosts.conf,mail,mailname,Mutt,Muttrc,Muttrc.d,neomuttrc,neomuttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,xdg
138private-tmp
139writable-run-user
140writable-var
141
142dbus-user none
143dbus-system none
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-22 06:48:18 +0000