added dnsmasq profile

6 files changed, 19 insertions, 2 deletions

diff --git a/Makefile.in b/Makefile.in
index 581402283..701e2856f 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -159,6 +159,7 @@ realinstall:
         install -c -m 0644 .etc/openbox.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 .etc/dillo.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 .etc/cmus.profile $(DESTDIR)/$(sysconfdir)/firejail/.
+        install -c -m 0644 .etc/dnsmasq.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
         sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/firejail.config ]; then install -c -m 0644 etc/firejail.config $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
         rm -fr .etc
diff --git a/README b/README
index 3b5ae1e76..e1cd0b068 100644
--- a/README
+++ b/README
@@ -66,6 +66,7 @@ creideiki (https://github.com/creideiki)
         - make the sandbox process reap all children
 curiosity-seeker (https://github.com/curiosity-seeker)
         - tightening unbound and dnscrypt-proxy profiles
+        - dnsmasq profile
 sinkuu (https://github.com/sinkuu)
         - blacklisting kwalletd
         - fix symlink invocation for programs placing symlinks in $PATH
diff --git a/README.md b/README.md
index e29c01d9a..c7adf3056 100644
--- a/README.md
+++ b/README.md
@@ -281,5 +281,5 @@ $ man firejail-profile
 
 ## New security profiles
 lxterminal, Epiphany, cherrytree, Polari, Vivaldi, Atril, qutebrowser, SlimJet, Battle for Wesnoth, Hedgewars, qTox,
-OpenSSH client, OpenBox window manager, Dillo, cmus.
+OpenSSH client, OpenBox window manager, Dillo, cmus, dnsmasq.
 
diff --git a/RELNOTES b/RELNOTES
index c58911620..3b287ed0c 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -16,7 +16,7 @@ firejail (0.9.40-rc1) baseline; urgency=low
   * disable STUN/WebRTC in default netfilter configuration
   * new profiles: lxterminal, Epiphany, cherrytree, Polari, Vivaldi, Atril
   * new profiles: qutebrowser, SlimJet, Battle for Wesnoth, Hedgewars
-  * new profiles: qTox, OpenSSH client, OpenBox, Dillo, cmus
+  * new profiles: qTox, OpenSSH client, OpenBox, Dillo, cmus, dnsmasq
   * build rpm packages using "make rpms"
   * bugfixes
  -- netblue30 <netblue30@yahoo.com>  Sun, 3 Apr 2016 08:00:00 -0500
diff --git a/etc/dnsmasq.profile b/etc/dnsmasq.profile
new file mode 100644
index 000000000..9ec66b8c5
--- /dev/null
+++ b/etc/dnsmasq.profile
@@ -0,0 +1,14 @@
+# dnsmasq profile
+noblacklist /sbin
+noblacklist /usr/sbin
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-mgmt.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-secret.inc
+include /etc/firejail/disable-terminals.inc
+caps
+seccomp
+protocol unix,inet,inet6,netlink
+netfilter
+private
+private-dev
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index aef20ed1f..ec6928074 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -79,3 +79,4 @@
 /etc/firejail/disable-passwdmgr.inc
 /etc/firejail/dillo.profile
 /etc/firejail/cmus.profile
+/etc/firejail/dnsmasq.profile