Hardening compressors (#2594)

* Harden atool

* Harden cpio

* Fix ordering in private-* options

* Harden gzip

* Harden tar

* Harden bsdtar

* Harden+ tar

* Harden+ gzip

* Harden+ cpio

* Create bzip2.profile

* Description for bunzip2

* Add bzip2/bunzip2 to firecfg

8 files changed, 65 insertions, 3 deletions

diff --git a/etc/atool.profile b/etc/atool.profile
index c82108cef..b17498e9d 100644
--- a/etc/atool.profile
+++ b/etc/atool.profile
@@ -18,15 +18,21 @@ noblacklist /usr/share/perl*
 
 include disable-common.inc
 # include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
+apparmor
 caps.drop all
-netfilter
+hostname atool
+ipc-namespace
+machine-id
 net none
+netfilter
 no3d
 nodvd
+nodbus
 nogroups
 nonewprivs
 noroot
@@ -39,9 +45,11 @@ seccomp
 shell none
 tracelog
 
+# private-bin atool,perl
 private-cache
-# private-bin atool
 private-dev
 # without login.defs atool complains and uses UID/GID 1000 by default
 private-etc alternatives,passwd,group,login.defs
 private-tmp
+
+memory-deny-write-execute
diff --git a/etc/bsdtar.profile b/etc/bsdtar.profile
index b6b673976..f964438bc 100644
--- a/etc/bsdtar.profile
+++ b/etc/bsdtar.profile
@@ -10,16 +10,20 @@ blacklist /tmp/.X11-unix
 
 include disable-common.inc
 # include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
+apparmor
 caps.drop all
 hostname bsdtar
 ipc-namespace
+machine-id
 netfilter
 no3d
 nodvd
+nodbus
 nogroups
 nonewprivs
 # noroot
@@ -34,5 +38,8 @@ tracelog
 
 # support compressed archives
 private-bin sh,bash,bsdcat,bsdcpio,bsdtar,gtar,compress,gzip,lzma,xz,bzip2,lbzip2,lzip,lzop,lz4,libarchive
+private-cache
 private-dev
 private-etc alternatives,passwd,group,localtime
+
+memory-deny-write-execute
diff --git a/etc/bunzip2.profile b/etc/bunzip2.profile
index 82c0f6ed6..ff86cbdfc 100644
--- a/etc/bunzip2.profile
+++ b/etc/bunzip2.profile
@@ -1,4 +1,5 @@
 # Firejail profile for bunzip2
+# Description: A high-quality data compression program
 # This file is overwritten after every install/update
 # Persistent local customizations
 include bunzip2.local
diff --git a/etc/bzip2.profile b/etc/bzip2.profile
new file mode 100644
index 000000000..0f2fdd35a
--- /dev/null
+++ b/etc/bzip2.profile
@@ -0,0 +1,11 @@
+# Firejail profile for bzip2
+# Description: A high-quality data compression program
+# This file is overwritten after every install/update
+# Persistent local customizations
+include bzip2.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+# Redirect
+include gzip.profile
diff --git a/etc/cpio.profile b/etc/cpio.profile
index f63e0a552..b6f7e7f9f 100644
--- a/etc/cpio.profile
+++ b/etc/cpio.profile
@@ -13,14 +13,21 @@ noblacklist /sbin
 noblacklist /usr/sbin
 
 include disable-common.inc
+# include disable-devel.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
+apparmor
 caps.drop all
+hostname cpio
+ipc-namespace
+machine-id
 net none
 no3d
 nodbus
 nodvd
+nogroups
 nonewprivs
 nosound
 notv
@@ -30,4 +37,7 @@ seccomp
 shell none
 tracelog
 
+private-cache
 private-dev
+
+memory-deny-write-execute
diff --git a/etc/gzip.profile b/etc/gzip.profile
index 49c43a49c..27e262f87 100644
--- a/etc/gzip.profile
+++ b/etc/gzip.profile
@@ -9,11 +9,20 @@ include globals.local
 
 blacklist /tmp/.X11-unix
 
+include disable-exec.inc
+include disable-interpreters.inc
+
 ignore noroot
+
+apparmor
+hostname gzip
+ipc-namespace
+machine-id
 net none
 no3d
 nodbus
 nodvd
+nogroups
 nosound
 notv
 nou2f
@@ -21,6 +30,9 @@ novideo
 shell none
 tracelog
 
+private-cache
 private-dev
 
+memory-deny-write-execute
+
 include default.profile
diff --git a/etc/tar.profile b/etc/tar.profile
index e1cfe9c80..14fc00d21 100644
--- a/etc/tar.profile
+++ b/etc/tar.profile
@@ -10,12 +10,20 @@ include tar.local
 
 blacklist /tmp/.X11-unix
 
-hostname tar
+include disable-exec.inc
+include disable-interpreters.inc
+
 ignore noroot
+
+apparmor
+hostname tar
+ipc-namespace
+machine-id
 net none
 no3d
 nodbus
 nodvd
+nogroups
 nosound
 notv
 nou2f
@@ -25,10 +33,13 @@ tracelog
 
 # support compressed archives
 private-bin sh,bash,tar,gtar,compress,gzip,lzma,xz,bzip2,lbzip2,lzip,lzop
+private-cache
 private-dev
 private-etc alternatives,passwd,group,localtime
 private-lib libfakeroot
 
+memory-deny-write-execute
+
 # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic)
 writable-var
 
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 87c427f72..f1be8bfd9 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -68,6 +68,8 @@ brackets
 brasero
 brave
 brave-browser
+bunzip2
+bzip2
 calibre
 calligra
 calligraauthor