profile fixes (2)

23 files changed, 43 insertions, 26 deletions

diff --git a/etc/allow-ruby.inc b/etc/allow-ruby.inc
new file mode 100644
index 000000000..3165a981a
--- /dev/null
+++ b/etc/allow-ruby.inc
@@ -0,0 +1,2 @@
+noblacklist ${PATH}/ruby
+noblacklist /usr/lib/ruby
diff --git a/etc/anki.profile b/etc/anki.profile
index c349376ff..a0a79ef48 100644
--- a/etc/anki.profile
+++ b/etc/anki.profile
@@ -42,7 +42,8 @@ notv
 nou2f
 novideo
 protocol unix,inet,inet6
-seccomp
+# QtWebengine needs chroot to set up its own sandbox
+seccomp !chroot
 shell none
 tracelog
 
diff --git a/etc/artha.profile b/etc/artha.profile
index f1d30a415..e7278fe10 100644
--- a/etc/artha.profile
+++ b/etc/artha.profile
@@ -16,7 +16,7 @@ include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
-mkdir ${HOME}/.config/artha.conf
+mkfile ${HOME}/.config/artha.conf
 mkdir ${HOME}/.config/enchant
 whitelist ${HOME}/.config/artha.conf
 whitelist ${HOME}/.config/enchant
diff --git a/etc/baobab.profile b/etc/baobab.profile
index c419aa202..eb0064115 100644
--- a/etc/baobab.profile
+++ b/etc/baobab.profile
@@ -16,7 +16,7 @@ include disable-passwdmgr.inc
 caps.drop all
 net none
 no3d
-nodbus
+#nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/celluloid.profile b/etc/celluloid.profile
index d06eb7a65..ab68c7f13 100644
--- a/etc/celluloid.profile
+++ b/etc/celluloid.profile
@@ -41,7 +41,7 @@ tracelog
 
 private-bin celluloid,env,gnome-mpv,python*,youtube-dl
 private-cache
-private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,libva.conf,localtime,machine-id,pkcs11,pki,resolv.conf,selinux,ssl,xdg
+private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,ld.so.cache,libva.conf,localtime,machine-id,pkcs11,pki,resolv.conf,selinux,ssl,xdg
 private-dev
 private-tmp
 
diff --git a/etc/claws-mail.profile b/etc/claws-mail.profile
index 33c0a3369..1790b0b17 100644
--- a/etc/claws-mail.profile
+++ b/etc/claws-mail.profile
@@ -16,7 +16,7 @@ include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
-whitelist /usr/share/doc
+whitelist /usr/share/doc/claws-mail
 whitelist /usr/share/gnupg
 whitelist /usr/share/gnupg2
 include whitelist-usr-share-common.inc
diff --git a/etc/cmus.profile b/etc/cmus.profile
index 7e12a06de..fa1e5d722 100644
--- a/etc/cmus.profile
+++ b/etc/cmus.profile
@@ -27,4 +27,4 @@ seccomp
 shell none
 
 private-bin cmus
-private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,machine-id,pki,pulse,ssl
+private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,machine-id,pki,pulse,resolv.conf,ssl
diff --git a/etc/digikam.profile b/etc/digikam.profile
index 1b80981f7..e66434444 100644
--- a/etc/digikam.profile
+++ b/etc/digikam.profile
@@ -32,7 +32,8 @@ nonewprivs
 noroot
 notv
 protocol unix,inet,inet6,netlink
-seccomp
+# QtWebengine needs chroot to set up its own sandbox
+seccomp !chroot
 shell none
 
 # private-dev - prevents libdc1394 loading; this lib is used to connect to a camera device
diff --git a/etc/evince.profile b/etc/evince.profile
index ba68e45b4..143a347e6 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -47,7 +47,7 @@ tracelog
 private-bin evince,evince-previewer,evince-thumbnailer
 private-cache
 private-dev
-private-etc alternatives,fonts,group,machine-id,passwd
+private-etc alternatives,fonts,group,ld.so.cache,machine-id,passwd
 # private-lib might break two-page-view on some systems
-private-lib evince,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.*
+private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.*
 private-tmp
diff --git a/etc/exiftool.profile b/etc/exiftool.profile
index e455d32c7..e9c7d290a 100644
--- a/etc/exiftool.profile
+++ b/etc/exiftool.profile
@@ -17,6 +17,7 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 
 whitelist /usr/share/perl5
+whitelist /usr/share/perl-image-exiftool
 include whitelist-usr-share-common.inc
 
 apparmor
diff --git a/etc/freecad.profile b/etc/freecad.profile
index 079c85fb1..6f0f52a55 100644
--- a/etc/freecad.profile
+++ b/etc/freecad.profile
@@ -9,6 +9,10 @@ include globals.local
 noblacklist ${HOME}/.config/FreeCAD
 noblacklist ${DOCUMENTS}
 
+# Allow python (blacklisted by disable-interpreters.inc)
+include allow-python2.inc
+include allow-python3.inc
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -33,7 +37,7 @@ protocol unix
 seccomp
 shell none
 
-private-bin freecad,freecadcmd
+private-bin freecad,freecadcmd,python*
 private-cache
 private-dev
 private-tmp
diff --git a/etc/gedit.profile b/etc/gedit.profile
index 6d575e850..7dd6f270e 100644
--- a/etc/gedit.profile
+++ b/etc/gedit.profile
@@ -42,6 +42,6 @@ tracelog
 
 # private-bin gedit
 private-dev
-private-lib aspell,gconv,gedit,libgspell-1.so.*,libgtksourceview-3.0.so.*,libpeas-gtk-1.0.so.*,libreadline.so.*,libtinfo.so.*
+private-lib aspell,gconv,gedit,libgspell-1.so.*,libgtksourceview-*,libpeas-gtk-1.0.so.*,libreadline.so.*,libtinfo.so.*
 private-tmp
 
diff --git a/etc/hexchat.profile b/etc/hexchat.profile
index d032c93e6..835205f03 100644
--- a/etc/hexchat.profile
+++ b/etc/hexchat.profile
@@ -26,14 +26,12 @@ include whitelist-common.inc
 include whitelist-var-common.inc
 
 caps.drop all
-machine-id
 netfilter
 no3d
 nodvd
 nogroups
 nonewprivs
 noroot
-nosound
 notv
 nou2f
 novideo
diff --git a/etc/mpv.profile b/etc/mpv.profile
index 6e587fc6a..56cd66199 100644
--- a/etc/mpv.profile
+++ b/etc/mpv.profile
@@ -27,6 +27,7 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist /usr/share/vulkan
 include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
diff --git a/etc/mupdf.profile b/etc/mupdf.profile
index 673c9fd0b..99945bdc9 100644
--- a/etc/mupdf.profile
+++ b/etc/mupdf.profile
@@ -32,14 +32,13 @@ nou2f
 novideo
 protocol unix
 seccomp
-# seccomp.keep access,arch_prctl,brk,clone,close,connect,execve,exit_group,fchmod,fchown,fcntl,fstat,futex,getcwd,getpeername,getrlimit,getsockname,getsockopt,lseek,lstat,mlock,mmap,mprotect,mremap,munmap,nanosleep,open,poll,prctl,read,recvfrom,recvmsg,restart_syscall,rt_sigaction,rt_sigprocmask,select,sendmsg,set_robust_list,set_tid_address,setresgid,setresuid,shmat,shmctl,shmget,shutdown,socket,stat,sysinfo,uname,unshare,wait4,write,writev
 shell none
 tracelog
 
 # private-bin mupdf,rm,sh,tempfile
 private-dev
-private-etc alternatives,fonts
+private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload
 private-tmp
 
-memory-deny-write-execute
+# memory-deny-write-execute
 read-only ${HOME}
diff --git a/etc/musescore.profile b/etc/musescore.profile
index 9750a31f4..b3693c956 100644
--- a/etc/musescore.profile
+++ b/etc/musescore.profile
@@ -33,7 +33,8 @@ noroot
 notv
 novideo
 protocol unix,inet,inet6
-seccomp
+# QtWebengine needs chroot to set up its own sandbox
+seccomp !chroot
 shell none
 tracelog
 
diff --git a/etc/neverputt.profile b/etc/neverputt.profile
index 93fb14e07..d370d1218 100644
--- a/etc/neverputt.profile
+++ b/etc/neverputt.profile
@@ -5,5 +5,7 @@ include neverputt.local
 # added by included profile
 #include globals.local
 
+private-bin neverputt
+
 # Redirect
 include neverball.profile
diff --git a/etc/pavucontrol.profile b/etc/pavucontrol.profile
index 5bbe1386f..0ae9f08af 100644
--- a/etc/pavucontrol.profile
+++ b/etc/pavucontrol.profile
@@ -16,11 +16,12 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
-mkfile ${HOME}/.config/pavucontrol.ini
-whitelist ${HOME}/.config/pavucontrol.ini
+# whitelisting in ${HOME} is broken, see #3112
+#mkfile ${HOME}/.config/pavucontrol.ini
+#whitelist ${HOME}/.config/pavucontrol.ini
 whitelist /usr/share/pavucontrol
 whitelist /usr/share/pavucontrol-qt
-include whitelist-common.inc
+#include whitelist-common.inc
 include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
@@ -39,6 +40,7 @@ novideo
 protocol unix,inet,inet6
 seccomp
 shell none
+tracelog
 
 disable-mnt
 private-bin pavucontrol
@@ -48,4 +50,5 @@ private-etc alternatives,asound.conf,avahi,fonts,machine-id,pulse
 private-lib
 private-tmp
 
-#memory-deny-write-execute - breaks on Arch (see issue #1803)
+# mdwe is broken under Wayland, but works under Xorg.
+#memory-deny-write-execute
diff --git a/etc/psi-plus.profile b/etc/psi-plus.profile
index 087f90966..16fffe517 100644
--- a/etc/psi-plus.profile
+++ b/etc/psi-plus.profile
@@ -36,10 +36,10 @@ notv
 nou2f
 novideo
 protocol unix,inet,inet6
-seccomp
+# QtWebengine needs chroot to set up its own sandbox
+seccomp !chroot
 shell none
 
 disable-mnt
 private-dev
 private-tmp
-
diff --git a/etc/quassel.profile b/etc/quassel.profile
index a78d1edcd..c65089e20 100644
--- a/etc/quassel.profile
+++ b/etc/quassel.profile
@@ -19,7 +19,8 @@ nonewprivs
 noroot
 notv
 protocol unix,inet,inet6
-seccomp
+# QtWebengine needs chroot to set up its own sandbox
+seccomp !chroot
 
 private-cache
 private-tmp
diff --git a/etc/templates/profile.template b/etc/templates/profile.template
index dcf6dd201..7bfc3cf0d 100644
--- a/etc/templates/profile.template
+++ b/etc/templates/profile.template
@@ -87,6 +87,9 @@ include globals.local
 # Allow lua (blacklisted by disable-interpreters.inc)
 #include allow-lua.inc
 
+# Allow ruby (blacklisted by disable-interpreters.inc)
+#include allow-ruby.inc
+
 # Allows files commonly used by IDEs
 #include allow-common-devel.inc
 
diff --git a/etc/wget.profile b/etc/wget.profile
index 4bf354652..9c2cddb67 100644
--- a/etc/wget.profile
+++ b/etc/wget.profile
@@ -35,6 +35,6 @@ shell none
 
 # private-bin wget
 private-dev
-# private-etc alternatives,ca-certificates,crypto-policie,pki,resolv.conf,ssl
+# private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl
 # private-tmp
 
diff --git a/etc/youtube-dl.profile b/etc/youtube-dl.profile
index 74c07d96b..5fa72c9dc 100644
--- a/etc/youtube-dl.profile
+++ b/etc/youtube-dl.profile
@@ -56,7 +56,7 @@ tracelog
 private-bin env,ffmpeg,python*,youtube-dl
 private-cache
 private-dev
-private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,mime.types,pki,resolv.conf,ssl,youtube-dl.conf
+private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,ld.so.cache,mime.types,pki,resolv.conf,ssl,youtube-dl.conf
 private-tmp
 
 #memory-deny-write-execute - breaks on Arch (see issue #1803)