Merge pull request #406 from avoidr/cmus.profile

add cmus.profile

5 files changed, 22 insertions, 1 deletions

diff --git a/Makefile.in b/Makefile.in
index c9e2e54f8..581402283 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -158,6 +158,7 @@ realinstall:
         install -c -m 0644 .etc/ssh.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 .etc/openbox.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 .etc/dillo.profile $(DESTDIR)/$(sysconfdir)/firejail/.
+        install -c -m 0644 .etc/cmus.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
         sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/firejail.config ]; then install -c -m 0644 etc/firejail.config $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
         rm -fr .etc
diff --git a/README b/README
index b672a4ab8..c242faa85 100644
--- a/README
+++ b/README
@@ -99,6 +99,7 @@ avoidr (https://github.com/avoidr)
         - blacklist ncat, manpage fixes,
         - hostname support in profile file
         - Google Chrome profile rework
+        - added cmus profile
 Bruno Nova (https://github.com/brunonova)
         - whitelist fix
         - bash arguments fix
diff --git a/README.md b/README.md
index bcf0ab771..d5e3f8b7d 100644
--- a/README.md
+++ b/README.md
@@ -283,5 +283,5 @@ $ man firejail-profile
 
 ## New security profiles
 lxterminal, Epiphany, cherrytree, Polari, Vivaldi, Atril, qutebrowser, SlimJet, Battle for Wesnoth, Hedgewars, qTox,
-OpenSSH client, OpenBox window manager, Dillo.
+OpenSSH client, OpenBox window manager, Dillo, cmus.
 
diff --git a/etc/cmus.profile b/etc/cmus.profile
new file mode 100644
index 000000000..bfefd3100
--- /dev/null
+++ b/etc/cmus.profile
@@ -0,0 +1,18 @@
+# cmus profile
+noblacklist ${HOME}/.config/cmus
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+
+caps.drop all
+seccomp
+protocol unix,inet,inet6
+netfilter
+noroot
+
+private-bin cmus
+private-etc group
+shell none
+noroot
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index 4137f247d..aef20ed1f 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -78,3 +78,4 @@
 /etc/firejail/disable-programs.inc
 /etc/firejail/disable-passwdmgr.inc
 /etc/firejail/dillo.profile
+/etc/firejail/cmus.profile