mupdf refactoring cfr. https://github.com/netblue30/firejail/discussions/4993 (#5042)

* refactor mupdf

* refactor mupdf

* refactor mupdf

* refactor mupdf

* add mupdf-gl blacklist

* move history file back to mupdf-gl

* refactor mupdf-gl

* add no3d to mupdf.profile

* add suggestions from review

* drop unix from protocol [accumulates]

* fix protocol

4 files changed, 8 insertions, 3 deletions

diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc
index 2e2f6c429..32f4cb81f 100644
--- a/etc/inc/disable-common.inc
+++ b/etc/inc/disable-common.inc
@@ -13,6 +13,7 @@ blacklist-nolog ${HOME}/.*_history_*
 blacklist-nolog ${HOME}/.adobe
 blacklist-nolog ${HOME}/.ammonite/history
 blacklist-nolog ${HOME}/.cache/greenclip*
+blacklist-nolog ${HOME}/.cache/mupdf.history
 blacklist-nolog ${HOME}/.histfile
 blacklist-nolog ${HOME}/.history
 blacklist-nolog ${HOME}/.kde/share/apps/klipper
diff --git a/etc/profile-m-z/mupdf-gl.profile b/etc/profile-m-z/mupdf-gl.profile
index be94a9083..c5d94c371 100644
--- a/etc/profile-m-z/mupdf-gl.profile
+++ b/etc/profile-m-z/mupdf-gl.profile
@@ -7,7 +7,10 @@ include mupdf-gl.local
 # added by included profile
 #include globals.local
 
+noblacklist ${HOME}/.cache/mupdf.history
 noblacklist ${HOME}/.mupdf.history
 
+ignore no3d
+
 # Redirect
 include mupdf.profile
diff --git a/etc/profile-m-z/mupdf-x11.profile b/etc/profile-m-z/mupdf-x11.profile
index 256201d0c..547aa4f2f 100644
--- a/etc/profile-m-z/mupdf-x11.profile
+++ b/etc/profile-m-z/mupdf-x11.profile
@@ -7,8 +7,5 @@ include mupdf-x11.local
 # added by included profile
 #include globals.local
 
-memory-deny-write-execute
-read-only ${HOME}
-
 # Redirect
 include mupdf.profile
diff --git a/etc/profile-m-z/mupdf.profile b/etc/profile-m-z/mupdf.profile
index 22cb83cc4..7a1f62858 100644
--- a/etc/profile-m-z/mupdf.profile
+++ b/etc/profile-m-z/mupdf.profile
@@ -21,6 +21,7 @@ apparmor
 caps.drop all
 machine-id
 net none
+no3d
 nodvd
 nogroups
 noinput
@@ -41,3 +42,6 @@ private-tmp
 
 dbus-user none
 dbus-system none
+
+memory-deny-write-execute
+read-only ${HOME}