Merge pull request #1367 from SpotComms/mh

Harden profiles

114 files changed, 640 insertions, 424 deletions

diff --git a/etc/0ad.profile b/etc/0ad.profile
index a564d0a09..9f33af806 100644
--- a/etc/0ad.profile
+++ b/etc/0ad.profile
@@ -38,3 +38,6 @@ tracelog
 private-dev
 private-tmp
 disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/2048-qt.profile b/etc/2048-qt.profile
index 0dc54e675..2f3efe743 100644
--- a/etc/2048-qt.profile
+++ b/etc/2048-qt.profile
@@ -7,24 +7,27 @@ include /etc/firejail/2048-qt.local
 
 noblacklist ~/.config/xiaoyong
 noblacklist ~/.config/2048-qt
+
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+#ipc-namespace
 netfilter
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+nosound
+novideo
+protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
-nosound
+
+private-dev
+private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/Thunar.profile b/etc/Thunar.profile
index ed8a37add..30db6f023 100644
--- a/etc/Thunar.profile
+++ b/etc/Thunar.profile
@@ -17,19 +17,13 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+no3d
 nogroups
 nonewprivs
 noroot
 nosound
+novideo
 protocol unix
 seccomp
 shell none
 tracelog
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
diff --git a/etc/Xephyr.profile b/etc/Xephyr.profile
index 4b14b8ad2..22c0202ee 100644
--- a/etc/Xephyr.profile
+++ b/etc/Xephyr.profile
@@ -21,7 +21,6 @@ private
 
 caps.drop all
 # Xephyr needs to be allowed access to the abstract Unix socket namespace.
-#net none
 nogroups
 nonewprivs
 # In noroot mode, Xephyr cannot create a socket in the real /tmp/.X11-unix.
diff --git a/etc/Xvfb.profile b/etc/Xvfb.profile
index 46f06871c..8eba82db1 100644
--- a/etc/Xvfb.profile
+++ b/etc/Xvfb.profile
@@ -22,7 +22,6 @@ private
 
 caps.drop all
 # Xvfb needs to be allowed access to the abstract Unix socket namespace.
-#net none
 nogroups
 nonewprivs
 # In noroot mode, Xvfb cannot create a socket in the real /tmp/.X11-unix.
diff --git a/etc/akregator.profile b/etc/akregator.profile
index 10279890e..ed79f0e94 100644
--- a/etc/akregator.profile
+++ b/etc/akregator.profile
@@ -5,28 +5,30 @@ include /etc/firejail/globals.local
 # Persistent customizations should go in a .local file.
 include /etc/firejail/akregator.local
 
-################################
-# Generic GUI application profile
-################################
 noblacklist ${HOME}/.config/akregatorrc
 noblacklist ${HOME}/.local/share/akregator
+
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+#ipc-namespace
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
+#nosound
+novideo
 protocol unix,inet,inet6
 seccomp
+shell none
+
+private-dev
+private-tmp
+disable-mnt
 
-#
-# depending on your usage, you can enable some of the commands below:
-#
-# nogroups
-# shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/atool.profile b/etc/atool.profile
index a66b4b1c5..49637aa21 100644
--- a/etc/atool.profile
+++ b/etc/atool.profile
@@ -12,6 +12,7 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 nogroups
 nonewprivs
 noroot
@@ -19,8 +20,6 @@ nosound
 novideo
 protocol unix
 seccomp
-netfilter
-net none
 no3d
 shell none
 tracelog
diff --git a/etc/audacity.profile b/etc/audacity.profile
index 5b38d84e8..7c2072960 100644
--- a/etc/audacity.profile
+++ b/etc/audacity.profile
@@ -16,7 +16,6 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 #ipc-namespace
 net none
-netfilter
 no3d
 nogroups
 nonewprivs
diff --git a/etc/bitlbee.profile b/etc/bitlbee.profile
index 055be09a1..2ecc0c425 100644
--- a/etc/bitlbee.profile
+++ b/etc/bitlbee.profile
@@ -9,13 +9,23 @@ include /etc/firejail/bitlbee.local
 noblacklist /sbin
 noblacklist /usr/sbin
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 netfilter
+no3d
 nonewprivs
 private
 private-dev
 protocol unix,inet,inet6
 seccomp
 nosound
+novideo
 read-write /var/lib/bitlbee
+
+private-dev
+private-tmp
+disable-mnt
+
+noexec /tmp
diff --git a/etc/bleachbit.profile b/etc/bleachbit.profile
index 345dd119a..f2553cd9c 100644
--- a/etc/bleachbit.profile
+++ b/etc/bleachbit.profile
@@ -14,7 +14,6 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 #ipc-namespace
 net none
-netfilter
 no3d
 nogroups
 nonewprivs
@@ -30,5 +29,6 @@ shell none
 # private-tmp
 # private-etc
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/blender.profile b/etc/blender.profile
index 6ee874ad0..b9757913d 100644
--- a/etc/blender.profile
+++ b/etc/blender.profile
@@ -7,25 +7,21 @@ include /etc/firejail/blender.local
 
 noblacklist ~/.config/blender
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+nogroups
 nonewprivs
 noroot
 protocol unix,inet,inet6,netlink
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
 
-# blender uses the sound system
-# nosound
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/bless.profile b/etc/bless.profile
index c9ccfc02e..25881fa3d 100644
--- a/etc/bless.profile
+++ b/etc/bless.profile
@@ -22,7 +22,6 @@ include /etc/firejail/disable-devel.inc
 caps.drop all
 #ipc-namespace
 net none
-netfilter
 no3d
 nogroups
 nonewprivs
diff --git a/etc/brasero.profile b/etc/brasero.profile
index d013e0b8e..cafb9f39a 100644
--- a/etc/brasero.profile
+++ b/etc/brasero.profile
@@ -15,7 +15,6 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 #ipc-namespace
-net none
 nogroups
 nonewprivs
 noroot
@@ -31,5 +30,6 @@ tracelog
 # private-etc fonts
 # private-tmp
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/caja.profile b/etc/caja.profile
index 3a098379b..a724e76b1 100644
--- a/etc/caja.profile
+++ b/etc/caja.profile
@@ -21,12 +21,12 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 nogroups
 nonewprivs
 noroot
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/cherrytree.profile b/etc/cherrytree.profile
index 0ac71ca3c..b1acd78f2 100644
--- a/etc/cherrytree.profile
+++ b/etc/cherrytree.profile
@@ -9,18 +9,28 @@ include /etc/firejail/cherrytree.local
 noblacklist /usr/bin/python2*
 noblacklist /usr/lib/python3*
 noblacklist ${HOME}/.config/cherrytree
+
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+#ipc-namespace
 netfilter
+no3d
 nogroups
 nonewprivs
 noroot
 nosound
 novideo
-seccomp
 protocol unix,inet,inet6,netlink
+seccomp
+shell none
 tracelog
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/clipit.profile b/etc/clipit.profile
index b671b253b..b44041cbf 100644
--- a/etc/clipit.profile
+++ b/etc/clipit.profile
@@ -8,26 +8,25 @@ include /etc/firejail/clipit.local
 noblacklist ${HOME}/.local/share/clipit
 noblacklist ${HOME}/.config/clipit
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
+nosound
 novideo
-protocol unix,inet,inet6
+protocol unix
 seccomp
+shell none
 
+private-dev
+private-tmp
+disable-mnt
 
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
-shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
-nosound
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/cvlc.profile b/etc/cvlc.profile
index a52d62f83..921d505a9 100644
--- a/etc/cvlc.profile
+++ b/etc/cvlc.profile
@@ -27,3 +27,5 @@ tracelog
 #private-bin vlc,cvlc,nvlc,rvlc,qvlc,svlc
 private-dev
 private-tmp
+
+memory-deny-write-execute
diff --git a/etc/darktable.profile b/etc/darktable.profile
index 29630a746..eca2ae6c5 100644
--- a/etc/darktable.profile
+++ b/etc/darktable.profile
@@ -8,23 +8,24 @@ include /etc/firejail/darktable.local
 noblacklist ~/.cache/darktable
 noblacklist ~/.config/darktable
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+#ipc-namespace
 netfilter
+nogroups
 nonewprivs
 noroot
+nosound
+novideo
 protocol unix,inet,inet6
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-# nogroups
 shell none
-# private-bin program
-# private-etc none
-# private-dev
+
+private-dev
 private-tmp
-nosound
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/dia.profile b/etc/dia.profile
index 4e009afd7..71d8a249b 100644
--- a/etc/dia.profile
+++ b/etc/dia.profile
@@ -7,23 +7,25 @@ include /etc/firejail/dia.local
 
 noblacklist ~/.dia
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
+nosound
 novideo
-protocol unix,inet,inet6
+protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
+
 private-dev
 private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/digikam.profile b/etc/digikam.profile
index fd19953a0..d81d00ed3 100644
--- a/etc/digikam.profile
+++ b/etc/digikam.profile
@@ -31,3 +31,6 @@ shell none
 # private-etc none
 # private-dev - prevents libdc1394 loading; this lib is used to connect to a camera device
 private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/display.profile b/etc/display.profile
index 7cde8bd54..c2c46cba3 100644
--- a/etc/display.profile
+++ b/etc/display.profile
@@ -12,14 +12,13 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-seccomp
-protocol unix
-netfilter
 net none
 nonewprivs
-noroot
 nogroups
+noroot
 nosound
+protocol unix
+seccomp
 shell none
 x11 xorg
 
diff --git a/etc/dragon.profile b/etc/dragon.profile
index d099f1d9d..47d2c593a 100644
--- a/etc/dragon.profile
+++ b/etc/dragon.profile
@@ -27,3 +27,6 @@ private-bin dragon
 private-dev
 private-tmp
 # private-etc
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/dropbox.profile b/etc/dropbox.profile
index f1d7fad82..2319b337b 100644
--- a/etc/dropbox.profile
+++ b/etc/dropbox.profile
@@ -9,16 +9,10 @@ include /etc/firejail/dropbox.local
 noblacklist ~/.config/autostart
 noblacklist ~/.dropbox-dist
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
-caps
-nonewprivs
-noroot
-novideo
-protocol unix,inet,inet6
-seccomp
-
 mkdir ~/Dropbox
 whitelist ~/Dropbox
 mkdir ~/.dropbox
@@ -28,3 +22,20 @@ whitelist ~/.dropbox-dist
 
 mkfile ~/.config/autostart/dropbox.desktop
 whitelist ~/.config/autostart/dropbox.desktop
+
+caps.drop all
+netfilter
+no3d
+nogroups
+nonewprivs
+noroot
+nosound
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+private-dev
+private-tmp
+
+noexec /tmp
diff --git a/etc/enchant.profile b/etc/enchant.profile
index 9e2dee045..554ed5e28 100644
--- a/etc/enchant.profile
+++ b/etc/enchant.profile
@@ -14,13 +14,13 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 nogroups
 nonewprivs
 noroot
 nosound
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/engrampa.profile b/etc/engrampa.profile
index 081a5f6b0..605643472 100644
--- a/etc/engrampa.profile
+++ b/etc/engrampa.profile
@@ -12,6 +12,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 nogroups
 nonewprivs
 noroot
@@ -19,7 +20,6 @@ nosound
 novideo
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/eog.profile b/etc/eog.profile
index 3abaaacef..e272a1935 100644
--- a/etc/eog.profile
+++ b/etc/eog.profile
@@ -19,7 +19,6 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 #ipc-namespace
 net none
-netfilter
 no3d
 nogroups
 nonewprivs
@@ -35,5 +34,6 @@ private-dev
 private-etc fonts
 private-tmp
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/evince.profile b/etc/evince.profile
index 6719244da..9f1ebbf76 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -16,7 +16,6 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 #ipc-namespace
 netfilter
-#net none - creates some problems on some distributions
 no3d
 nogroups
 nonewprivs
@@ -34,5 +33,6 @@ private-etc fonts
 # evince needs access to /tmp/mozilla* to work in firefox
 # private-tmp
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/exiftool.profile b/etc/exiftool.profile
index aba484718..e69a6206e 100644
--- a/etc/exiftool.profile
+++ b/etc/exiftool.profile
@@ -17,14 +17,13 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+net none
 nogroups
 nonewprivs
 noroot
 nosound
 protocol unix
 seccomp
-netfilter
-net none
 no3d
 shell none
 tracelog
diff --git a/etc/feh.profile b/etc/feh.profile
index f71999155..8f40a0c3e 100644
--- a/etc/feh.profile
+++ b/etc/feh.profile
@@ -12,7 +12,6 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-netfilter
 net none
 nogroups
 nonewprivs
diff --git a/etc/file-roller.profile b/etc/file-roller.profile
index 72d00b4ce..15d8d36c6 100644
--- a/etc/file-roller.profile
+++ b/etc/file-roller.profile
@@ -14,7 +14,6 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 #ipc-namespace
 net none
-netfilter
 no3d
 nogroups
 nonewprivs
@@ -31,5 +30,6 @@ tracelog
 private-dev
 # private-etc fonts
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/file.profile b/etc/file.profile
index 915bf1088..51e35007f 100644
--- a/etc/file.profile
+++ b/etc/file.profile
@@ -13,7 +13,6 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 hostname file
-netfilter
 net none
 no3d
 nogroups
diff --git a/etc/flowblade.profile b/etc/flowblade.profile
index 7f29a8719..f8d45424f 100644
--- a/etc/flowblade.profile
+++ b/etc/flowblade.profile
@@ -8,13 +8,23 @@ include /etc/firejail/flowblade.local
 # FlowBlade profile
 noblacklist ${HOME}/.flowblade
 noblacklist ${HOME}/.config/flowblade
+
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+nogroups
 nonewprivs
 noroot
 protocol unix,inet,inet6,netlink
 seccomp
+shell none
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/fontforge.profile b/etc/fontforge.profile
index 967a617e2..e8e3df62b 100644
--- a/etc/fontforge.profile
+++ b/etc/fontforge.profile
@@ -6,23 +6,25 @@ include /etc/firejail/globals.local
 include /etc/firejail/fontforge.local
 
 noblacklist ${HOME}/.FontForge
+
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+nosound
+novideo
+protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
+
 private-dev
 private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/franz.profile b/etc/franz.profile
index c68b47d80..c5e019947 100644
--- a/etc/franz.profile
+++ b/etc/franz.profile
@@ -13,14 +13,6 @@ include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 
-caps.drop all
-netfilter
-nonewprivs
-noroot
-protocol unix,inet,inet6,netlink
-seccomp
-#tracelog
-
 whitelist ${DOWNLOADS}
 mkdir ~/.config/Franz
 whitelist ~/.config/Franz
@@ -30,3 +22,21 @@ mkdir ~/.pki
 whitelist ~/.pki
 
 include /etc/firejail/whitelist-common.inc
+
+caps.drop all
+#ipc-namespace
+netfilter
+nogroups
+nonewprivs
+noroot
+protocol unix,inet,inet6,netlink
+seccomp
+shell none
+#tracelog
+
+private-dev
+private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/geany.profile b/etc/geany.profile
index 7e0c6d2ad..083e9423f 100644
--- a/etc/geany.profile
+++ b/etc/geany.profile
@@ -12,17 +12,15 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
+nosound
+novideo
 protocol unix,inet,inet6
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
+
 private-dev
 private-tmp
diff --git a/etc/gedit.profile b/etc/gedit.profile
index d871a9bed..3e78d939e 100644
--- a/etc/gedit.profile
+++ b/etc/gedit.profile
@@ -18,7 +18,6 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 #ipc-namespace
-netfilter
 net none
 no3d
 nogroups
diff --git a/etc/gimp.profile b/etc/gimp.profile
index da521aa6c..0fe462912 100644
--- a/etc/gimp.profile
+++ b/etc/gimp.profile
@@ -12,7 +12,6 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-netfilter
 net none
 nogroups
 nonewprivs
diff --git a/etc/globaltime.profile b/etc/globaltime.profile
index 5662dba69..b9b2c008d 100644
--- a/etc/globaltime.profile
+++ b/etc/globaltime.profile
@@ -7,22 +7,25 @@ include /etc/firejail/globaltime.local
 
 noblacklist ${HOME}/.config/globaltime
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
+nosound
+novideo
 protocol unix,inet,inet6
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
+
 private-dev
-# private-tmp
+private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/gnome-books.profile b/etc/gnome-books.profile
index af6da6cd4..e36294930 100644
--- a/etc/gnome-books.profile
+++ b/etc/gnome-books.profile
@@ -16,6 +16,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 no3d
 nogroups
 nonewprivs
@@ -24,7 +25,6 @@ nosound
 novideo
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/gnome-calculator.profile b/etc/gnome-calculator.profile
index e64f62b70..40328e5c3 100644
--- a/etc/gnome-calculator.profile
+++ b/etc/gnome-calculator.profile
@@ -30,11 +30,13 @@ protocol unix,inet,inet6
 seccomp
 shell none
 
+private
 private-bin gnome-calculator
 private-dev
 #private-etc fonts
 private-tmp
 disable-mnt
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/gnome-documents.profile b/etc/gnome-documents.profile
index 5d2a90b64..2d70bf7ef 100644
--- a/etc/gnome-documents.profile
+++ b/etc/gnome-documents.profile
@@ -17,6 +17,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 no3d
 nogroups
 nonewprivs
@@ -25,7 +26,6 @@ nosound
 novideo
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/gnome-music.profile b/etc/gnome-music.profile
index abdb6bfb5..8b569e563 100644
--- a/etc/gnome-music.profile
+++ b/etc/gnome-music.profile
@@ -14,6 +14,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 no3d
 nogroups
 nonewprivs
@@ -21,7 +22,6 @@ noroot
 novideo
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/gnome-photos.profile b/etc/gnome-photos.profile
index 93823d0f4..ed9dc0a03 100644
--- a/etc/gnome-photos.profile
+++ b/etc/gnome-photos.profile
@@ -17,13 +17,13 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 nogroups
 nonewprivs
 noroot
 nosound
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/goobox.profile b/etc/goobox.profile
index 0ba059365..129d17ae7 100644
--- a/etc/goobox.profile
+++ b/etc/goobox.profile
@@ -12,12 +12,12 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 nogroups
 nonewprivs
 noroot
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/google-chrome-beta.profile b/etc/google-chrome-beta.profile
index 3b884bd64..22a2e8f88 100644
--- a/etc/google-chrome-beta.profile
+++ b/etc/google-chrome-beta.profile
@@ -16,8 +16,6 @@ include /etc/firejail/disable-programs.inc
 # include /etc/firejail/disable-devel.inc
 #
 
-netfilter
-
 whitelist ${DOWNLOADS}
 mkdir ~/.config/google-chrome-beta
 whitelist ~/.config/google-chrome-beta
@@ -26,3 +24,16 @@ whitelist ~/.cache/google-chrome-beta
 mkdir ~/.pki
 whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
+
+caps.keep sys_chroot,sys_admin
+#ipc-namespace
+netfilter
+nogroups
+shell none
+
+private-dev
+#private-tmp - problems with multiple browser sessions
+#disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/google-chrome-unstable.profile b/etc/google-chrome-unstable.profile
index 18bcb94a6..0675d7b49 100644
--- a/etc/google-chrome-unstable.profile
+++ b/etc/google-chrome-unstable.profile
@@ -16,8 +16,6 @@ include /etc/firejail/disable-programs.inc
 # include /etc/firejail/disable-devel.inc
 #
 
-netfilter
-
 whitelist ${DOWNLOADS}
 mkdir ~/.config/google-chrome-unstable
 whitelist ~/.config/google-chrome-unstable
@@ -26,3 +24,16 @@ whitelist ~/.cache/google-chrome-unstable
 mkdir ~/.pki
 whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
+
+caps.keep sys_chroot,sys_admin
+#ipc-namespace
+netfilter
+nogroups
+shell none
+
+private-dev
+#private-tmp - problems with multiple browser sessions
+#disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/google-chrome.profile b/etc/google-chrome.profile
index 84e0c6cdc..e6fceadec 100644
--- a/etc/google-chrome.profile
+++ b/etc/google-chrome.profile
@@ -16,9 +16,6 @@ include /etc/firejail/disable-programs.inc
 # include /etc/firejail/disable-devel.inc
 #
 
-caps.keep sys_chroot,sys_admin
-netfilter
-
 whitelist ${DOWNLOADS}
 mkdir ~/.config/google-chrome
 whitelist ~/.config/google-chrome
@@ -27,3 +24,16 @@ whitelist ~/.cache/google-chrome
 mkdir ~/.pki
 whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
+
+caps.keep sys_chroot,sys_admin
+#ipc-namespace
+netfilter
+nogroups
+shell none
+
+private-dev
+#private-tmp - problems with multiple browser sessions
+#disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/google-play-music-desktop-player.profile b/etc/google-play-music-desktop-player.profile
index ed6b11002..c373cc34c 100644
--- a/etc/google-play-music-desktop-player.profile
+++ b/etc/google-play-music-desktop-player.profile
@@ -13,13 +13,25 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
+#whitelist ~/.pulse
+#whitelist ~/.config/pulse
+whitelist ~/.config/Google Play Music Desktop Player
+
 caps.drop all
+#ipc-namespace
+netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-netfilter
+novideo
 protocol unix,inet,inet6,netlink
 seccomp
+shell none
 
-#whitelist ~/.pulse
-#whitelist ~/.config/pulse
-whitelist ~/.config/Google Play Music Desktop Player
+private-dev
+private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/guayadeque.profile b/etc/guayadeque.profile
index 5b3bc11f2..86f3d7838 100644
--- a/etc/guayadeque.profile
+++ b/etc/guayadeque.profile
@@ -24,3 +24,6 @@ shell none
 private-bin guayadeque
 private-dev
 private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/gucharmap.profile b/etc/gucharmap.profile
index 929888e88..4d6237067 100644
--- a/etc/gucharmap.profile
+++ b/etc/gucharmap.profile
@@ -5,25 +5,27 @@ include /etc/firejail/globals.local
 # Persistent customizations should go in a .local file.
 include /etc/firejail/gucharmap.local
 
-private
-#include /etc/firejail/disable-common.inc
-#include /etc/firejail/disable-programs.inc
-#include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+nosound
+novideo
+protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
-nosound
+
+private
+private-dev
+private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/gwenview.profile b/etc/gwenview.profile
index 97227186a..047d2e32e 100644
--- a/etc/gwenview.profile
+++ b/etc/gwenview.profile
@@ -32,3 +32,6 @@ private-dev
 
 # Experimental:
 #private-etc X11
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/handbrake.profile b/etc/handbrake.profile
index 0f3f32250..ccff63708 100644
--- a/etc/handbrake.profile
+++ b/etc/handbrake.profile
@@ -7,24 +7,23 @@ include /etc/firejail/handbrake.local
 
 noblacklist ~/.config/ghb
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+nogroups
 nonewprivs
 noroot
-# netlink required!
+nosound
+novideo
 protocol unix,inet,inet6,netlink
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
-#private-dev
+
+private-dev
 private-tmp
-nosound
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/highlight.profile b/etc/highlight.profile
index 58e7f89f5..fefbcc55d 100644
--- a/etc/highlight.profile
+++ b/etc/highlight.profile
@@ -12,14 +12,13 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+net none
 nogroups
 nonewprivs
 noroot
 nosound
 protocol unix
 seccomp
-netfilter
-net none
 no3d
 shell none
 tracelog
diff --git a/etc/hugin.profile b/etc/hugin.profile
index 97a9cb1fd..26e696f0d 100644
--- a/etc/hugin.profile
+++ b/etc/hugin.profile
@@ -6,24 +6,25 @@ include /etc/firejail/globals.local
 include /etc/firejail/hugin.local
 
 noblacklist ${HOME}/.hugin
+
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+nosound
+novideo
+protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
+
 private-dev
 private-tmp
-nosound
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/icecat.profile b/etc/icecat.profile
index 7684cedbe..600263a2a 100644
--- a/etc/icecat.profile
+++ b/etc/icecat.profile
@@ -48,3 +48,6 @@ include /etc/firejail/whitelist-common.inc
 
 # experimental features
 #private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/img2txt.profile b/etc/img2txt.profile
index 00d172f55..2ea359e72 100644
--- a/etc/img2txt.profile
+++ b/etc/img2txt.profile
@@ -12,14 +12,13 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+net none
 nogroups
 nonewprivs
 noroot
 nosound
 protocol unix
 seccomp
-netfilter
-net none
 shell none
 tracelog
 
diff --git a/etc/inkscape.profile b/etc/inkscape.profile
index 0a9d409b9..af1be565b 100644
--- a/etc/inkscape.profile
+++ b/etc/inkscape.profile
@@ -8,6 +8,7 @@ include /etc/firejail/inkscape.local
 # inkscape
 noblacklist ${HOME}/.inkscape
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
@@ -17,11 +18,13 @@ nogroups
 nonewprivs
 noroot
 nosound
+novideo
 protocol unix
 seccomp
-
-noexec ${HOME}
-noexec /tmp
+shell none
 
 private-dev
 private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/jd-gui.profile b/etc/jd-gui.profile
index 32b43cdf1..9cb845b50 100644
--- a/etc/jd-gui.profile
+++ b/etc/jd-gui.profile
@@ -22,7 +22,6 @@ include /etc/firejail/disable-devel.inc
 caps.drop all
 #ipc-namespace
 net none
-netfilter
 no3d
 nogroups
 nonewprivs
diff --git a/etc/kate.profile b/etc/kate.profile
index 832f3614f..97372f752 100644
--- a/etc/kate.profile
+++ b/etc/kate.profile
@@ -19,13 +19,13 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 nogroups
 nonewprivs
 noroot
 nosound
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/kcalc.profile b/etc/kcalc.profile
index 0ea5dbcb3..1d425cf47 100644
--- a/etc/kcalc.profile
+++ b/etc/kcalc.profile
@@ -5,27 +5,27 @@ include /etc/firejail/globals.local
 # Persistent customizations should go in a .local file.
 include /etc/firejail/kcalc.local
 
-################################
-# Generic GUI application profile
-################################
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+nosound
+novideo
+protocol unix
 seccomp
+shell none
 
-#
-# depending on your usage, you can enable some of the commands below:
-#
 private
-nogroups
-shell none
-# private-bin program
-# private-etc none
 private-dev
 private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/keepassxc.profile b/etc/keepassxc.profile
index 4a5503944..3ab4115e6 100644
--- a/etc/keepassxc.profile
+++ b/etc/keepassxc.profile
@@ -16,7 +16,6 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
-# To use KeePassHTTP, comment out `net none`
 caps.drop all
 #ipc-namespace
 net none
@@ -35,5 +34,6 @@ private-dev
 private-etc fonts,ld.so.cache
 private-tmp
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/kino.profile b/etc/kino.profile
index b37569340..bb37d56ab 100644
--- a/etc/kino.profile
+++ b/etc/kino.profile
@@ -5,28 +5,26 @@ include /etc/firejail/globals.local
 # Persistent customizations should go in a .local file.
 include /etc/firejail/kino.local
 
-################################
-# Generic GUI application profile
-################################
 noblacklist ~/.kinorc
 noblacklist ~/.kino-history
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+novideo
+protocol unix
 seccomp
+shell none
+
+private-dev
+private-tmp
 
-#
-# depending on your usage, you can enable some of the commands below:
-#
-# nogroups
-# shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/knotes.profile b/etc/knotes.profile
index e7da44215..b1883112c 100644
--- a/etc/knotes.profile
+++ b/etc/knotes.profile
@@ -14,13 +14,13 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 nogroups
 nonewprivs
 noroot
 nosound
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/ktorrent.profile b/etc/ktorrent.profile
index 59c2827cd..c19f1c5ef 100644
--- a/etc/ktorrent.profile
+++ b/etc/ktorrent.profile
@@ -5,16 +5,15 @@ include /etc/firejail/globals.local
 # Persistent customizations should go in a .local file.
 include /etc/firejail/ktorrent.local
 
-################################
-# Generic GUI application profile
-################################
 noblacklist ~/.config/ktorrentrc
 noblacklist ~/.local/share/ktorrent
 noblacklist ~/.kde/share/config/ktorrentrc
 noblacklist ~/.kde4/share/config/ktorrentrc
 noblacklist ~/.kde/share/apps/ktorrent
 noblacklist ~/.kde4/share/apps/ktorrent
+
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
@@ -36,17 +35,18 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
+nosound
+novideo
 protocol unix,inet,inet6
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
+
 private-dev
-# private-tmp
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/kwrite.profile b/etc/kwrite.profile
index 1c4d09f67..7ac881f6a 100644
--- a/etc/kwrite.profile
+++ b/etc/kwrite.profile
@@ -19,13 +19,13 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 nogroups
 nonewprivs
 noroot
 #nosound - KWrite is using ALSA!
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/leafpad.profile b/etc/leafpad.profile
index 5ae025d6d..fc2cc7e09 100644
--- a/etc/leafpad.profile
+++ b/etc/leafpad.profile
@@ -6,24 +6,25 @@ include /etc/firejail/globals.local
 include /etc/firejail/leafpad.local
 
 noblacklist ${HOME}/.config/leafpad
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+nosound
+novideo
+protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
-nosound
+
+private-dev
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/less.profile b/etc/less.profile
index 9d4eb3fcf..f8c26879e 100644
--- a/etc/less.profile
+++ b/etc/less.profile
@@ -21,5 +21,6 @@ blacklist /tmp/.X11-unix
 
 private-dev
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/liferea.profile b/etc/liferea.profile
index 92b3b8f88..f11137cdd 100644
--- a/etc/liferea.profile
+++ b/etc/liferea.profile
@@ -20,10 +20,28 @@ noblacklist ~/.cache/liferea
 mkdir ~/.cache/liferea
 whitelist ~/.cache/liferea
 
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-common.inc
-include /etc/firejail/default.profile
 
+caps.drop all
+#ipc-namespace
+netfilter
+#no3d
 nogroups
+nonewprivs
+noroot
+#nosound
+novideo
+protocol unix,inet,inet6
+seccomp
 shell none
+
 private-dev
 private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/luminance-hdr.profile b/etc/luminance-hdr.profile
index 6ee118f76..f73c83cbd 100644
--- a/etc/luminance-hdr.profile
+++ b/etc/luminance-hdr.profile
@@ -7,7 +7,9 @@ include /etc/firejail/luminance-hdr.local
 
 # luminance-hdr
 noblacklist ${HOME}/.config/Luminance
+
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
@@ -18,13 +20,14 @@ nogroups
 nonewprivs
 noroot
 nosound
+novideo
 protocol unix
 seccomp
 shell none
 tracelog
 
-noexec ${HOME}
-noexec /tmp
-
 private-tmp
 private-dev
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/lximage-qt.profile b/etc/lximage-qt.profile
index 28e674ebf..42996af04 100644
--- a/etc/lximage-qt.profile
+++ b/etc/lximage-qt.profile
@@ -6,24 +6,26 @@ include /etc/firejail/globals.local
 include /etc/firejail/lximage-qt.local
 
 noblacklist .config/lximage-qt
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+nosound
+novideo
+protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below: 
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
-nosound
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/lxmusic.profile b/etc/lxmusic.profile
index fd5136578..eac72c6db 100644
--- a/etc/lxmusic.profile
+++ b/etc/lxmusic.profile
@@ -7,24 +7,25 @@ include /etc/firejail/lxmusic.local
 
 noblacklist ~/.cache/xmms2
 noblacklist ~/.config/xmms2
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+novideo
+protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
-# nosound
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/mate-calc.profile b/etc/mate-calc.profile
index 76593df0b..e083e8b88 100644
--- a/etc/mate-calc.profile
+++ b/etc/mate-calc.profile
@@ -6,24 +6,27 @@ include /etc/firejail/globals.local
 include /etc/firejail/mate-calc.local
 
 noblacklist ${HOME}/.config/mate-calc
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+nosound
+novideo
+protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below: 
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
-nosound
+
+private-dev
+private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/mate-color-select.profile b/etc/mate-color-select.profile
index 6db3dd624..74fe4bd69 100644
--- a/etc/mate-color-select.profile
+++ b/etc/mate-color-select.profile
@@ -3,27 +3,29 @@ include /etc/firejail/globals.local
 
 # This file is overwritten during software install.
 # Persistent customizations should go in a .local file.
-include /etc/firejail/default.local
+include /etc/firejail/mate-color-select.local
 
-private
-#include /etc/firejail/disable-common.inc
-#include /etc/firejail/disable-programs.inc
-#include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+nosound
+novideo
+protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
-nosound
+
+private
+private-dev
+private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/mate-dictionary.profile b/etc/mate-dictionary.profile
index fc4c1c425..4fe0795d2 100644
--- a/etc/mate-dictionary.profile
+++ b/etc/mate-dictionary.profile
@@ -6,24 +6,27 @@ include /etc/firejail/globals.local
 include /etc/firejail/mate-dictionary.local
 
 noblacklist ${HOME}/.config/mate/mate-dictionary
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
+nosound
+novideo
 protocol unix,inet,inet6
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
-nosound
+
+private-dev
+private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/mediainfo.profile b/etc/mediainfo.profile
index 59cb080d3..8758d66b9 100644
--- a/etc/mediainfo.profile
+++ b/etc/mediainfo.profile
@@ -12,15 +12,14 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-nogroups
+net none
 nonewprivs
+nogroups
 noroot
 nosound
 no3d
 protocol unix
 seccomp
-netfilter
-net none
 shell none
 tracelog
 
diff --git a/etc/meld.profile b/etc/meld.profile
index bc4cd8356..503f6d07c 100644
--- a/etc/meld.profile
+++ b/etc/meld.profile
@@ -16,7 +16,6 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 #ipc-namespace
 net none
-netfilter
 no3d
 nogroups
 nonewprivs
diff --git a/etc/mumble.profile b/etc/mumble.profile
index 7303ac65a..a2104957d 100644
--- a/etc/mumble.profile
+++ b/etc/mumble.profile
@@ -35,5 +35,6 @@ private-bin mumble
 private-tmp
 disable-mnt
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/mupdf.profile b/etc/mupdf.profile
index e6652e688..ca61edfdd 100644
--- a/etc/mupdf.profile
+++ b/etc/mupdf.profile
@@ -12,14 +12,13 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+net none
 nogroups
 nonewprivs
 noroot
 nosound
 protocol unix
 seccomp
-netfilter
-net none
 shell none
 tracelog
 
diff --git a/etc/nautilus.profile b/etc/nautilus.profile
index ef3203eb5..4f2f50d9f 100644
--- a/etc/nautilus.profile
+++ b/etc/nautilus.profile
@@ -22,12 +22,12 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 nogroups
 nonewprivs
 noroot
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/nemo.profile b/etc/nemo.profile
index 1d9124d19..5e6f4936f 100644
--- a/etc/nemo.profile
+++ b/etc/nemo.profile
@@ -16,18 +16,15 @@ include /etc/firejail/disable-devel.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
+nosound
+novideo
 protocol unix,inet,inet6
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
-# nosound
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/odt2txt.profile b/etc/odt2txt.profile
index abec7dde2..8cfadd9ac 100644
--- a/etc/odt2txt.profile
+++ b/etc/odt2txt.profile
@@ -12,14 +12,13 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+net none
 nogroups
 nonewprivs
 noroot
 nosound
 protocol unix
 seccomp
-netfilter
-net none
 no3d
 shell none
 tracelog
diff --git a/etc/okular.profile b/etc/okular.profile
index 982f524fa..578f01915 100644
--- a/etc/okular.profile
+++ b/etc/okular.profile
@@ -35,3 +35,6 @@ tracelog
 # private-etc fonts,X11
 private-dev
 private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/openshot.profile b/etc/openshot.profile
index bc4ccc46a..25c803512 100644
--- a/etc/openshot.profile
+++ b/etc/openshot.profile
@@ -8,13 +8,23 @@ include /etc/firejail/openshot.local
 # OpenShot profile
 noblacklist ${HOME}/.openshot
 noblacklist ${HOME}/.openshot_qt
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nogroups
 nonewprivs
 noroot
 protocol unix,inet,inet6,netlink
 seccomp
+shell none
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/orage.profile b/etc/orage.profile
index ea577f873..c9977d002 100644
--- a/etc/orage.profile
+++ b/etc/orage.profile
@@ -7,24 +7,27 @@ include /etc/firejail/orage.local
 
 noblacklist ${HOME}/.config/orage
 noblacklist ${HOME}/.local/share/orage
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+nosound
+novideo
+protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below: 
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
+
 private-dev
-# private-tmp
+private-tmp
+disable-mnt
 
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/pcmanfm.profile b/etc/pcmanfm.profile
index 68d002f2d..654904f17 100644
--- a/etc/pcmanfm.profile
+++ b/etc/pcmanfm.profile
@@ -15,21 +15,13 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-netfilter
-nogroups
+net none
+no3d
 nonewprivs
 noroot
 nosound
+novideo
 protocol unix
 seccomp
 shell none
 tracelog
-
-#
-# depending on your usage, you can enable some of the commands below: 
-#
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
-
diff --git a/etc/pdfsam.profile b/etc/pdfsam.profile
index b46ac9294..2465be252 100644
--- a/etc/pdfsam.profile
+++ b/etc/pdfsam.profile
@@ -20,7 +20,6 @@ include /etc/firejail/disable-devel.inc
 caps.drop all
 #ipc-namespace
 net none
-netfilter
 no3d
 nogroups
 nonewprivs
diff --git a/etc/pdftotext.profile b/etc/pdftotext.profile
index a6b2b2f78..e5dab840f 100644
--- a/etc/pdftotext.profile
+++ b/etc/pdftotext.profile
@@ -12,14 +12,13 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+net none
 nogroups
 nonewprivs
 noroot
 nosound
 protocol unix
 seccomp
-netfilter
-net none
 no3d
 shell none
 tracelog
diff --git a/etc/peek.profile b/etc/peek.profile
index bac3e0a99..811eb701b 100644
--- a/etc/peek.profile
+++ b/etc/peek.profile
@@ -29,5 +29,6 @@ shell none
 private-dev
 private-tmp
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/psi-plus.profile b/etc/psi-plus.profile
index e3ffad9a1..9500731fe 100644
--- a/etc/psi-plus.profile
+++ b/etc/psi-plus.profile
@@ -8,7 +8,9 @@ include /etc/firejail/psi-plus.local
 # Firejail profile for Psi+
 noblacklist ${HOME}/.config/psi+
 noblacklist ${HOME}/.local/share/psi+
+
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
@@ -20,10 +22,22 @@ whitelist ~/.local/share/psi+
 mkdir ~/.cache/psi+
 whitelist ~/.cache/psi+
 
+include /etc/firejail/whitelist-common.inc
+
 caps.drop all
 netfilter
+no3d
+nogroups
+nonewprivs
 noroot
+novideo
 protocol unix,inet,inet6
 seccomp
+shell none
 
-include /etc/firejail/whitelist-common.inc
+private-dev
+private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/qemu-launcher.profile b/etc/qemu-launcher.profile
index bc92e50ea..f6458de86 100644
--- a/etc/qemu-launcher.profile
+++ b/etc/qemu-launcher.profile
@@ -23,3 +23,5 @@ shell none
 tracelog
 
 private-tmp
+
+noexec /tmp
diff --git a/etc/qemu-system-x86_64.profile b/etc/qemu-system-x86_64.profile
index 907de5e8f..fdfd7ab72 100644
--- a/etc/qemu-system-x86_64.profile
+++ b/etc/qemu-system-x86_64.profile
@@ -21,3 +21,5 @@ shell none
 tracelog
 
 private-tmp
+
+noexec /tmp
diff --git a/etc/qlipper.profile b/etc/qlipper.profile
index a5ef53112..d57856c1a 100644
--- a/etc/qlipper.profile
+++ b/etc/qlipper.profile
@@ -6,26 +6,27 @@ include /etc/firejail/globals.local
 include /etc/firejail/qlipper.local
 
 noblacklist ${HOME}/.config/Qlipper
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+nosound
+novideo
+protocol unix
 seccomp
+shell none
 
+private-dev
+private-tmp
+disable-mnt
 
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
-shell none
-# private-bin program
-# private-etc none
-# private-dev
-# private-tmp
-nosound
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/quiterss.profile b/etc/quiterss.profile
index c8112f064..aa17693cd 100644
--- a/etc/quiterss.profile
+++ b/etc/quiterss.profile
@@ -42,3 +42,6 @@ private-dev
 disable-mnt
 
 include /etc/firejail/whitelist-common.inc
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/ranger.profile b/etc/ranger.profile
index 7103f821d..ab0545aaf 100644
--- a/etc/ranger.profile
+++ b/etc/ranger.profile
@@ -18,7 +18,6 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-netfilter
 net none
 nogroups
 nonewprivs
@@ -27,5 +26,4 @@ protocol unix
 seccomp
 nosound
 
-private-tmp
 private-dev
diff --git a/etc/ristretto.profile b/etc/ristretto.profile
index ca4b1a64d..3d3491658 100644
--- a/etc/ristretto.profile
+++ b/etc/ristretto.profile
@@ -10,22 +10,24 @@ noblacklist ~/.Steam
 noblacklist ~/.steam
 
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+nosound
+novideo
+protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
+
 private-dev
-# private-tmp
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/skype.profile b/etc/skype.profile
index 8b97c7152..7c7a4eb17 100644
--- a/etc/skype.profile
+++ b/etc/skype.profile
@@ -7,17 +7,22 @@ include /etc/firejail/skype.local
 
 # Skype profile
 noblacklist ${HOME}/.Skype
+
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 
 caps.drop all
 netfilter
+nogroups
 nonewprivs
 noroot
 protocol unix,inet,inet6
 seccomp
+shell none
 
+private-dev
 private-tmp
 disable-mnt
 
diff --git a/etc/skypeforlinux.profile b/etc/skypeforlinux.profile
index 71bc1b9a6..a2f693945 100644
--- a/etc/skypeforlinux.profile
+++ b/etc/skypeforlinux.profile
@@ -7,16 +7,22 @@ include /etc/firejail/skypeforlinux.local
 
 # skypeforlinux profile
 noblacklist ${HOME}/.config/skypeforlinux
+
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+nogroups
+nonewprivs
 noroot
-seccomp
 protocol unix,inet,inet6,netlink
+seccomp
+shell none
 
+private-dev
 private-tmp
 disable-mnt
 
diff --git a/etc/ssh.profile b/etc/ssh.profile
index e592841a1..466abdc88 100644
--- a/etc/ssh.profile
+++ b/etc/ssh.profile
@@ -31,5 +31,6 @@ tracelog
 private-dev
 #private-tmp #Breaks when exiting
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/strings.profile b/etc/strings.profile
index af49feb04..a83e3a801 100644
--- a/etc/strings.profile
+++ b/etc/strings.profile
@@ -18,3 +18,5 @@ shell none
 tracelog
 private-dev
 blacklist /tmp/.X11-unix
+
+memory-deny-write-execute
diff --git a/etc/synfigstudio.profile b/etc/synfigstudio.profile
index ffabdef76..bcb42f624 100644
--- a/etc/synfigstudio.profile
+++ b/etc/synfigstudio.profile
@@ -8,19 +8,25 @@ include /etc/firejail/synfigstudio.local
 # synfigstudio
 noblacklist ${HOME}/.config/synfig
 noblacklist ${HOME}/.synfig
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nogroups
 nonewprivs
 noroot
+nosound
+novideo
 protocol unix
 seccomp
-
-noexec ${HOME}
-noexec /tmp
+shell none
 
 private-dev
 private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/tracker.profile b/etc/tracker.profile
index f2c91be86..b87bebf43 100644
--- a/etc/tracker.profile
+++ b/etc/tracker.profile
@@ -15,6 +15,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 nogroups
 nonewprivs
 noroot
@@ -22,7 +23,6 @@ nosound
 no3d
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/transmission-cli.profile b/etc/transmission-cli.profile
index 0502bbfb4..5b7e6e7c8 100644
--- a/etc/transmission-cli.profile
+++ b/etc/transmission-cli.profile
@@ -28,3 +28,5 @@ tracelog
 private-tmp
 private-dev
 private-etc none
+
+memory-deny-write-execute
diff --git a/etc/transmission-gtk.profile b/etc/transmission-gtk.profile
index 84d01179c..7f85aa69c 100644
--- a/etc/transmission-gtk.profile
+++ b/etc/transmission-gtk.profile
@@ -34,3 +34,5 @@ tracelog
 private-bin transmission-gtk
 private-dev
 private-tmp
+
+memory-deny-write-execute
diff --git a/etc/transmission-show.profile b/etc/transmission-show.profile
index 8d1e1eac2..743f9ff4f 100644
--- a/etc/transmission-show.profile
+++ b/etc/transmission-show.profile
@@ -15,7 +15,6 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-netfilter
 net none
 nonewprivs
 noroot
diff --git a/etc/vivaldi.profile b/etc/vivaldi.profile
index 25d78439d..fab620499 100644
--- a/etc/vivaldi.profile
+++ b/etc/vivaldi.profile
@@ -14,7 +14,6 @@ include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 
-netfilter
 
 whitelist ${DOWNLOADS}
 mkdir ~/.config/vivaldi
@@ -22,3 +21,16 @@ whitelist ~/.config/vivaldi
 mkdir ~/.cache/vivaldi
 whitelist ~/.cache/vivaldi
 include /etc/firejail/whitelist-common.inc
+
+caps.keep sys_chroot,sys_admin
+#ipc-namespace
+netfilter
+nogroups
+shell none
+
+private-dev
+#private-tmp - problems with multiple browser sessions
+#disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/vlc.profile b/etc/vlc.profile
index b36e844ff..34f4aa5ff 100644
--- a/etc/vlc.profile
+++ b/etc/vlc.profile
@@ -27,5 +27,6 @@ private-bin vlc,cvlc,nvlc,rvlc,qvlc,svlc
 private-dev
 private-tmp
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/vym.profile b/etc/vym.profile
index 4139ea901..d3058fa64 100644
--- a/etc/vym.profile
+++ b/etc/vym.profile
@@ -6,25 +6,27 @@ include /etc/firejail/globals.local
 include /etc/firejail/vym.local
 
 noblacklist ./.config/InSilmaril
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-# no network connectivity
+nosound
+novideo
 protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin vym
-# private-etc none
+
 private-dev
 private-tmp
-nosound
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/xfburn.profile b/etc/xfburn.profile
index 7a6d620cf..7bfeba2b1 100644
--- a/etc/xfburn.profile
+++ b/etc/xfburn.profile
@@ -14,13 +14,13 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 nogroups
 nonewprivs
 noroot
 nosound
 protocol unix
 seccomp
-netfilter
 shell none
 tracelog
 
diff --git a/etc/xfce4-dict.profile b/etc/xfce4-dict.profile
index 4e466352d..08ae17a55 100644
--- a/etc/xfce4-dict.profile
+++ b/etc/xfce4-dict.profile
@@ -6,24 +6,27 @@ include /etc/firejail/globals.local
 include /etc/firejail/xfce4-dict.local
 
 noblacklist ${HOME}/.config/xfce4-dict
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
+nosound
+novideo
 protocol unix,inet,inet6
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below: 
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
+
 private-dev
-# private-tmp
+private-tmp
+disable-mnt
 
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/xfce4-notes.profile b/etc/xfce4-notes.profile
index 737bb0a23..e3215d6ea 100644
--- a/etc/xfce4-notes.profile
+++ b/etc/xfce4-notes.profile
@@ -8,23 +8,27 @@ include /etc/firejail/xfce4-notes.local
 noblacklist ${HOME}/.config/xfce4/xfce4-notes.rc
 noblacklist ${HOME}/.config/xfce4/xfce4-notes.gtkrc
 noblacklist ${HOME}/.local/share/notes
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6
+nosound
+novideo
+protocol unix
 seccomp
-
-#
-# depending on your usage, you can enable some of the commands below:
-#
-nogroups
 shell none
-# private-bin program
-# private-etc none
+
 private-dev
-# private-tmp
+private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/xonotic.profile b/etc/xonotic.profile
index 611c7b379..957636124 100644
--- a/etc/xonotic.profile
+++ b/etc/xonotic.profile
@@ -30,6 +30,7 @@ netfilter
 nogroups
 nonewprivs
 noroot
+novideo
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/xpdf.profile b/etc/xpdf.profile
index 5b3018ce8..ce8cd2459 100644
--- a/etc/xpdf.profile
+++ b/etc/xpdf.profile
@@ -9,17 +9,26 @@ include /etc/firejail/xpdf.local
 # xpdf application profile
 ################################
 noblacklist ${HOME}/.xpdfrc
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+no3d
+nogroups
 nonewprivs
 noroot
+nosound
+novideo
 protocol unix
-shell none
 seccomp
+shell none
 
 private-dev
 private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/xpra.profile b/etc/xpra.profile
index a41ee2613..c8bb3ef52 100644
--- a/etc/xpra.profile
+++ b/etc/xpra.profile
@@ -23,7 +23,6 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 # xpra needs to be allowed access to the abstract Unix socket namespace.
-#net none
 nogroups
 nonewprivs
 # In noroot mode, xpra cannot create a socket in the real /tmp/.X11-unix.
diff --git a/etc/zathura.profile b/etc/zathura.profile
index 18afe3bfa..502e066c8 100644
--- a/etc/zathura.profile
+++ b/etc/zathura.profile
@@ -14,7 +14,6 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-netfilter
 net none
 nogroups
 nonewprivs