added dnscrypt-proxy and unbound profiles

6 files changed, 54 insertions, 0 deletions

diff --git a/Makefile.in b/Makefile.in
index 461fa4086..d9343d149 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -113,6 +113,8 @@ realinstall:
         install -c -m 0644 etc/wine.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 etc/disable-devel.inc $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 etc/conkeror.profile $(DESTDIR)/$(sysconfdir)/firejail/.
+        install -c -m 0644 etc/unbound.profile $(DESTDIR)/$(sysconfdir)/firejail/.
+        install -c -m 0644 etc/dnscrypt-proxy.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         bash -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
         # man pages
         rm -f firejail.1.gz
diff --git a/README.md b/README.md
index ecae2d38a..eb4a1c21b 100644
--- a/README.md
+++ b/README.md
@@ -32,5 +32,34 @@ Usage: https://l3net.wordpress.com/projects/firejail/firejail-usage/
 
 FAQ: https://l3net.wordpress.com/projects/firejail/firejail-faq/
 
+## Development version 0.9.35
 
+### Firefox whitelists:
+
+The current whitelist of files and directories for Firefox is as follows:
+`````
+whitelist ~/.mozilla (0.9.34)
+whitelist ~/Downloads (0.9.34)
+whitelist ~/Загрузки (new in 0.9.35)
+whitelist ~/dwhelper (0.9.34)
+whitelist ~/.zotero (0.9.34)
+whitelist ~/.lastpass (0.9.34)
+whitelist ~/.gtkrc-2.0 (0.9.34)
+whitelist ~/.config/gtk-3.0 (new in 0.9.35)
+whitelist ~/.vimperatorrc (0.9.34)
+whitelist ~/.vimperator (0.9.34)
+whitelist ~/.pentadactylrc (0.9.34)
+whitelist ~/.pentadactyl (0.9.34)
+
+# common
+whitelist ~/.fonts (0.9.34)
+whitelist ~/.fonts.d (0.9.34)
+whitelist ~/.fontconfig (0.9.34)
+whitelist ~/.fonts.conf (0.9.34)
+whitelist ~/.fonts.conf.d (0.9.34)
+`````
+If you are using a plugin or extension that requires other directories, please open a new issue: https://github.com/netblue30/firejail/issues
+
+### New security profiles:
+New profiles introduced in this version: unbound, dnscrypt-proxy
 
diff --git a/RELNOTES b/RELNOTES
index 46231ed6d..0513f72c7 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,4 +1,9 @@
 firejail (0.9.34) baseline; urgency=low
+  * added  unbound and dnscrypt-proxy profiles
+  * bugfixes
+ -- netblue30 <netblue30@yahoo.com>  ongoing development
+
+firejail (0.9.34) baseline; urgency=low
   * added --ignore option
   * added --protocol option
   * support dual i386/amd64 seccomp filters
diff --git a/etc/dnscrypt-proxy.profile b/etc/dnscrypt-proxy.profile
new file mode 100644
index 000000000..e0c5c93a3
--- /dev/null
+++ b/etc/dnscrypt-proxy.profile
@@ -0,0 +1,8 @@
+# security profile for dnscrypt-proxy
+noblacklist /sbin
+noblacklist /usr/sbin
+include /etc/firejail/disable-mgmt.inc
+private
+private-dev
+seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open
+
diff --git a/etc/unbound.profile b/etc/unbound.profile
new file mode 100644
index 000000000..4dd00178b
--- /dev/null
+++ b/etc/unbound.profile
@@ -0,0 +1,8 @@
+# security profile for unbound (https://unbound.net)
+noblacklist /sbin
+noblacklist /usr/sbin
+include /etc/firejail/disable-mgmt.inc
+private
+private-dev
+seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open
+
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index 579e6caad..60f375cb6 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -39,3 +39,5 @@
 /etc/firejail/wine.profile
 /etc/firejail/disable-devel.inc
 /etc/firejail/conkeror.profile
+/etc/firejail/unbound.profile
+/etc/firejail/dnscrypt-proxy.profile