Aisleriot fixes + add profile for FeedReader

5 files changed, 53 insertions, 9 deletions

diff --git a/README.md b/README.md
index 9e61e5633..df436721e 100644
--- a/README.md
+++ b/README.md
@@ -148,4 +148,4 @@ QMediathekView, aria2c, Authenticator, checkbashisms, devilspie, devilspie2, eas
 bsdcat, bsdcpio, bsdtar, lzmadec, lbunzip2, lbzcat, lbzip2, lzcat, lzcmp, lzdiff, lzegrep, lzfgrep, lzgrep,
 lzless, lzma, lzmainfo, lzmore, unlzma, unxz, xzcat, xzcmp, xzdiff, xzegrep, xzfgrep, xzgrep, xzless, xzmore,
 lzip, artha, nitroshare, nitroshare-cli, nitroshare-nmh, nirtoshare-send, nitroshare-ui, mencoder, gnome-pie,
-masterpdfeditor, QOwnNotes, aisleriot, Mendeley
+masterpdfeditor, QOwnNotes, aisleriot, Mendeley, feedreader
diff --git a/RELNOTES b/RELNOTES
index 4e2e22acf..6d2582a59 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -11,6 +11,7 @@ firejail (0.9.56.1) baseline; urgency=low
   * new profiles: lzip, artha, nitroshare, nitroshare-cli, nitroshare-nmh
   * new profiles: nirtoshare-send, nitroshare-ui, mencoder, gnome-pie
   * new profiles: masterpdfeditor, QOwnNotes, aisleriot, Mendeley
+  * new profiles: feedreader
  -- netblue30 <netblue30@yahoo.com>  Thu, 11 Oct 2018 08:00:00 -0500
 
 firejail (0.9.56) baseline; urgency=low
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 4ef0f2f53..796af28f0 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -408,6 +408,7 @@ blacklist ${HOME}/.local/share/dolphin
 blacklist ${HOME}/.local/share/emailidentities
 blacklist ${HOME}/.local/share/epiphany
 blacklist ${HOME}/.local/share/evolution
+blacklist ${HOME}/.local/share/feedreader
 blacklist ${HOME}/.local/share/feral-interactive
 blacklist ${HOME}/.local/share/gajim
 blacklist ${HOME}/.local/share/geary
@@ -568,6 +569,7 @@ blacklist ${HOME}/.cache/dolphin
 blacklist ${HOME}/.cache/epiphany
 blacklist ${HOME}/.cache/evolution
 blacklist ${HOME}/.cache/falkon
+blacklist ${HOME}/.cache/feedreader
 blacklist ${HOME}/.cache/fossamail
 blacklist ${HOME}/.cache/gajim
 blacklist ${HOME}/.cache/geeqie
diff --git a/etc/feedreader.profile b/etc/feedreader.profile
new file mode 100644
index 000000000..44ed475bc
--- /dev/null
+++ b/etc/feedreader.profile
@@ -0,0 +1,45 @@
+# Firejail profile for feedreader
+# Description: RSS client
+# This file is overwritten after every install/update
+# Persistent local customizations
+include feedreader.local
+# Persistent global definitions
+include globals.local
+
+noblacklist ${HOME}/.cache/feedreader
+noblacklist ${HOME}/.local/share/feedreader
+
+include disable-common.inc
+include disable-devel.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+
+mkdir ${HOME}/.cache/feedreader
+mkdir ${HOME}/.local/share/feedreader
+whitelist ${HOME}/.cache/feedreader
+whitelist ${HOME}/.local/share/feedreader
+include whitelist-common.inc
+include whitelist-var-common.inc
+
+caps.drop all
+netfilter
+# no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+# nosound
+notv
+nou2f
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+disable-mnt
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/sol.profile b/etc/sol.profile
index c0ad3c739..e5a356f68 100644
--- a/etc/sol.profile
+++ b/etc/sol.profile
@@ -15,13 +15,12 @@ include disable-xdg.inc
 # all necessary files in $HOME are in whitelist-common.inc
 include whitelist-common.inc
 include whitelist-var-common.inc
-net none
 
 caps.drop all
-# ipc-namespace
-# netfilter
+ipc-namespace
+net none
 # no3d
-# nodbus
+nodbus
 nodvd
 nogroups
 nonewprivs
@@ -35,12 +34,9 @@ seccomp
 shell none
 
 disable-mnt
-# private
 private-bin sol
-# private-cache
+private-cache
 private-dev
-# private-etc none
-# private-lib
 private-tmp
 
 memory-deny-write-execute