harden konversation and kwrite, minor fixes

author: smitsohu <smitsohu@gmail.com> 2018-03-18 02:03:32 +0100
committer: smitsohu <smitsohu@gmail.com> 2018-03-18 02:03:32 +0100
commit: 2f3419a1f79536b453dc0e33b2a1bbe908a299a2 (patch)
tree: 474c69786a41cfcaf3bc811c5f3cfd45cbb44499
parent: asunder profile (diff)
download: firejail-2f3419a1f79536b453dc0e33b2a1bbe908a299a2.tar.gz
firejail-2f3419a1f79536b453dc0e33b2a1bbe908a299a2.tar.zst
firejail-2f3419a1f79536b453dc0e33b2a1bbe908a299a2.zip
5 files changed, 6 insertions, 4 deletions
diff --git a/etc/gwenview.profile b/etc/gwenview.profile
index 58e059087..d79b72152 100644
--- a/etc/gwenview.profile
+++ b/etc/gwenview.profile
@@ -39,7 +39,7 @@ tracelog
 private-bin gwenview,gimp*,kbuildsycoca4,kdeinit4
 private-dev
-private-etc fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,machine-id,xdg
+private-etc fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,machine-id,pulse,xdg
 # memory-deny-write-execute
 noexec ${HOME}
diff --git a/etc/kate.profile b/etc/kate.profile
index 43f38d7e6..a3d2be6b2 100644
--- a/etc/kate.profile
+++ b/etc/kate.profile
@@ -37,7 +37,7 @@ seccomp
 shell none
 tracelog
-# private-bin kate
+# private-bin kate,kbuildsycoca4,kdeinit4
 private-dev
 # private-etc fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg
 private-tmp
diff --git a/etc/kdenlive.profile b/etc/kdenlive.profile
index 424ad767e..5c770856a 100644
--- a/etc/kdenlive.profile
+++ b/etc/kdenlive.profile
@@ -29,7 +29,7 @@ shell none
 private-bin kdenlive,kdenlive_render,dbus-launch,melt,ffmpeg,ffplay,ffprobe,dvdauthor,genisoimage,vlc,xine,kdeinit5,kshell5,kdeinit5_shutdown,kdeinit5_wrapper,kdeinit4,kshell4,kdeinit4_shutdown,kdeinit4_wrapper
 private-dev
-# private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,xdg,X11
+# private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,xdg,X11
 # noexec ${HOME}
 noexec /tmp
diff --git a/etc/konversation.profile b/etc/konversation.profile
index db91940e2..356d2f314 100644
--- a/etc/konversation.profile
+++ b/etc/konversation.profile
@@ -26,8 +26,10 @@ notv
 novideo
 protocol unix,inet,inet6
 seccomp
+shell none
 tracelog
+private-bin konversation,kbuildsycoca4
 private-dev
 private-tmp
diff --git a/etc/kwrite.profile b/etc/kwrite.profile
index 6e8e33cb3..a785f3541 100644
--- a/etc/kwrite.profile
+++ b/etc/kwrite.profile
@@ -40,7 +40,7 @@ tracelog
 private-bin kwrite,kbuildsycoca4,kdeinit4
 private-dev
-# private-etc fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg
+private-etc fonts,kde4rc,kde5rc,ld.so.cache,machine-id,pulse,xdg
 private-tmp
 join-or-start kwrite
author	smitsohu <smitsohu@gmail.com>	2018-03-18 02:03:32 +0100
committer	smitsohu <smitsohu@gmail.com>	2018-03-18 02:03:32 +0100
commit	2f3419a1f79536b453dc0e33b2a1bbe908a299a2 (patch)
tree	474c69786a41cfcaf3bc811c5f3cfd45cbb44499
parent	asunder profile (diff)
download	firejail-2f3419a1f79536b453dc0e33b2a1bbe908a299a2.tar.gz firejail-2f3419a1f79536b453dc0e33b2a1bbe908a299a2.tar.zst firejail-2f3419a1f79536b453dc0e33b2a1bbe908a299a2.zip

diff --git a/etc/gwenview.profile b/etc/gwenview.profile index 58e059087..d79b72152 100644 --- a/etc/gwenview.profile +++ b/etc/gwenview.profile
@@ -39,7 +39,7 @@ tracelog
39		39
40	private-bin gwenview,gimp*,kbuildsycoca4,kdeinit4	40	private-bin gwenview,gimp*,kbuildsycoca4,kdeinit4
41	private-dev	41	private-dev
42	private-etc fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,machine-id,xdg	42	private-etc fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,machine-id,pulse,xdg
43		43
44	# memory-deny-write-execute	44	# memory-deny-write-execute
45	noexec ${HOME}	45	noexec ${HOME}


diff --git a/etc/kate.profile b/etc/kate.profile index 43f38d7e6..a3d2be6b2 100644 --- a/etc/kate.profile +++ b/etc/kate.profile
@@ -37,7 +37,7 @@ seccomp
37	shell none	37	shell none
38	tracelog	38	tracelog
39		39
40	# private-bin kate	40	# private-bin kate,kbuildsycoca4,kdeinit4
41	private-dev	41	private-dev
42	# private-etc fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg	42	# private-etc fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg
43	private-tmp	43	private-tmp


diff --git a/etc/kdenlive.profile b/etc/kdenlive.profile index 424ad767e..5c770856a 100644 --- a/etc/kdenlive.profile +++ b/etc/kdenlive.profile
@@ -29,7 +29,7 @@ shell none
29		29
30	private-bin kdenlive,kdenlive_render,dbus-launch,melt,ffmpeg,ffplay,ffprobe,dvdauthor,genisoimage,vlc,xine,kdeinit5,kshell5,kdeinit5_shutdown,kdeinit5_wrapper,kdeinit4,kshell4,kdeinit4_shutdown,kdeinit4_wrapper	30	private-bin kdenlive,kdenlive_render,dbus-launch,melt,ffmpeg,ffplay,ffprobe,dvdauthor,genisoimage,vlc,xine,kdeinit5,kshell5,kdeinit5_shutdown,kdeinit5_wrapper,kdeinit4,kshell4,kdeinit4_shutdown,kdeinit4_wrapper
31	private-dev	31	private-dev
32	# private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,xdg,X11	32	# private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,xdg,X11
33		33
34	# noexec ${HOME}	34	# noexec ${HOME}
35	noexec /tmp	35	noexec /tmp


diff --git a/etc/konversation.profile b/etc/konversation.profile index db91940e2..356d2f314 100644 --- a/etc/konversation.profile +++ b/etc/konversation.profile
@@ -26,8 +26,10 @@ notv
26	novideo	26	novideo
27	protocol unix,inet,inet6	27	protocol unix,inet,inet6
28	seccomp	28	seccomp
		29	shell none
29	tracelog	30	tracelog
30		31
		32	private-bin konversation,kbuildsycoca4
31	private-dev	33	private-dev
32	private-tmp	34	private-tmp
33		35


diff --git a/etc/kwrite.profile b/etc/kwrite.profile index 6e8e33cb3..a785f3541 100644 --- a/etc/kwrite.profile +++ b/etc/kwrite.profile
@@ -40,7 +40,7 @@ tracelog
40		40
41	private-bin kwrite,kbuildsycoca4,kdeinit4	41	private-bin kwrite,kbuildsycoca4,kdeinit4
42	private-dev	42	private-dev
43	# private-etc fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg	43	private-etc fonts,kde4rc,kde5rc,ld.so.cache,machine-id,pulse,xdg
44	private-tmp	44	private-tmp
45		45
46	join-or-start kwrite	46	join-or-start kwrite