diff options
author | glitsj16 <glitsj16@users.noreply.github.com> | 2023-10-18 22:47:07 +0000 |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-10-18 22:47:07 +0000 |
commit | 17590553045f40e8c7628608c8330b72412fd7f4 (patch) | |
tree | a1c5d0888101865866492269f5f194ce0ecffc3c | |
parent | steam.profile: Allow Baba Is You (#6054) (diff) | |
download | firejail-17590553045f40e8c7628608c8330b72412fd7f4.tar.gz firejail-17590553045f40e8c7628608c8330b72412fd7f4.tar.zst firejail-17590553045f40e8c7628608c8330b72412fd7f4.zip |
profiles: exchange private-opt with a whitelist (#6021)
* profiles: drop private-opt (existing whitelist)
* profiles: replace private-opt with whitelist
In most profiles.
Kept private-opt for enpass (~85MB), mate-dictionary (<20MB),
minecraft-launcher (~1.6MB) and ppsspp (~44MB). The only app I couldn't
check: xmr-stak.
* docs: note potential issues with private-opt
25 files changed, 42 insertions, 26 deletions
diff --git a/etc/profile-a-l/bitwarden.profile b/etc/profile-a-l/bitwarden.profile index 56bb871e7..1572ca572 100644 --- a/etc/profile-a-l/bitwarden.profile +++ b/etc/profile-a-l/bitwarden.profile | |||
@@ -17,6 +17,7 @@ include disable-shell.inc | |||
17 | 17 | ||
18 | mkdir ${HOME}/.config/Bitwarden | 18 | mkdir ${HOME}/.config/Bitwarden |
19 | whitelist ${HOME}/.config/Bitwarden | 19 | whitelist ${HOME}/.config/Bitwarden |
20 | whitelist /opt/Bitwarden | ||
20 | 21 | ||
21 | machine-id | 22 | machine-id |
22 | no3d | 23 | no3d |
@@ -24,7 +25,6 @@ nosound | |||
24 | 25 | ||
25 | ?HAS_APPIMAGE: ignore private-dev | 26 | ?HAS_APPIMAGE: ignore private-dev |
26 | private-etc @tls-ca | 27 | private-etc @tls-ca |
27 | private-opt Bitwarden | ||
28 | 28 | ||
29 | # Redirect | 29 | # Redirect |
30 | include electron-common.profile | 30 | include electron-common.profile |
diff --git a/etc/profile-a-l/discord-canary.profile b/etc/profile-a-l/discord-canary.profile index 245b07b8d..b67729301 100644 --- a/etc/profile-a-l/discord-canary.profile +++ b/etc/profile-a-l/discord-canary.profile | |||
@@ -9,9 +9,10 @@ noblacklist ${HOME}/.config/discordcanary | |||
9 | 9 | ||
10 | mkdir ${HOME}/.config/discordcanary | 10 | mkdir ${HOME}/.config/discordcanary |
11 | whitelist ${HOME}/.config/discordcanary | 11 | whitelist ${HOME}/.config/discordcanary |
12 | whitelist /opt/DiscordCanary | ||
13 | whitelist /opt/discord-canary | ||
12 | 14 | ||
13 | private-bin discord-canary,DiscordCanary | 15 | private-bin discord-canary,DiscordCanary |
14 | private-opt discord-canary,DiscordCanary | ||
15 | 16 | ||
16 | # Redirect | 17 | # Redirect |
17 | include discord-common.profile | 18 | include discord-common.profile |
diff --git a/etc/profile-a-l/discord-ptb.profile b/etc/profile-a-l/discord-ptb.profile index 265bf5615..a657c52b5 100644 --- a/etc/profile-a-l/discord-ptb.profile +++ b/etc/profile-a-l/discord-ptb.profile | |||
@@ -9,9 +9,10 @@ noblacklist ${HOME}/.config/discordptb | |||
9 | 9 | ||
10 | mkdir ${HOME}/.config/discordptb | 10 | mkdir ${HOME}/.config/discordptb |
11 | whitelist ${HOME}/.config/discordptb | 11 | whitelist ${HOME}/.config/discordptb |
12 | whitelist /opt/DiscordPTB | ||
13 | whitelist /opt/discord | ||
12 | 14 | ||
13 | private-bin discord-ptb,DiscordPTB | 15 | private-bin discord-ptb,DiscordPTB |
14 | private-opt discord-ptb,DiscordPTB | ||
15 | 16 | ||
16 | # Redirect | 17 | # Redirect |
17 | include discord-common.profile | 18 | include discord-common.profile |
diff --git a/etc/profile-a-l/discord.profile b/etc/profile-a-l/discord.profile index 02d1c65cd..a4fcae5b8 100644 --- a/etc/profile-a-l/discord.profile +++ b/etc/profile-a-l/discord.profile | |||
@@ -9,9 +9,10 @@ noblacklist ${HOME}/.config/discord | |||
9 | 9 | ||
10 | mkdir ${HOME}/.config/discord | 10 | mkdir ${HOME}/.config/discord |
11 | whitelist ${HOME}/.config/discord | 11 | whitelist ${HOME}/.config/discord |
12 | whitelist /opt/Discord | ||
13 | whitelist /opt/discord | ||
12 | 14 | ||
13 | private-bin discord,Discord | 15 | private-bin discord,Discord |
14 | private-opt discord,Discord | ||
15 | 16 | ||
16 | # Redirect | 17 | # Redirect |
17 | include discord-common.profile | 18 | include discord-common.profile |
diff --git a/etc/profile-a-l/electron-mail.profile b/etc/profile-a-l/electron-mail.profile index 766fe523b..544756877 100644 --- a/etc/profile-a-l/electron-mail.profile +++ b/etc/profile-a-l/electron-mail.profile | |||
@@ -18,6 +18,7 @@ include disable-shell.inc | |||
18 | 18 | ||
19 | mkdir ${HOME}/.config/electron-mail | 19 | mkdir ${HOME}/.config/electron-mail |
20 | whitelist ${HOME}/.config/electron-mail | 20 | whitelist ${HOME}/.config/electron-mail |
21 | whitelist /opt/ElectronMail | ||
21 | 22 | ||
22 | # The lines below are needed to find the default Firefox profile name, to allow | 23 | # The lines below are needed to find the default Firefox profile name, to allow |
23 | # opening links in an existing instance of Firefox (note that it still fails if | 24 | # opening links in an existing instance of Firefox (note that it still fails if |
@@ -29,7 +30,6 @@ machine-id | |||
29 | nosound | 30 | nosound |
30 | 31 | ||
31 | private-etc @tls-ca,@x11 | 32 | private-etc @tls-ca,@x11 |
32 | private-opt ElectronMail | ||
33 | 33 | ||
34 | dbus-user filter | 34 | dbus-user filter |
35 | dbus-user.talk org.freedesktop.Notifications | 35 | dbus-user.talk org.freedesktop.Notifications |
diff --git a/etc/profile-a-l/element-desktop.profile b/etc/profile-a-l/element-desktop.profile index 7b4994a85..1af2884b6 100644 --- a/etc/profile-a-l/element-desktop.profile +++ b/etc/profile-a-l/element-desktop.profile | |||
@@ -15,8 +15,6 @@ mkdir ${HOME}/.config/Element | |||
15 | whitelist ${HOME}/.config/Element | 15 | whitelist ${HOME}/.config/Element |
16 | whitelist /opt/Element | 16 | whitelist /opt/Element |
17 | 17 | ||
18 | private-opt Element | ||
19 | |||
20 | dbus-user filter | 18 | dbus-user filter |
21 | dbus-user.talk org.freedesktop.Notifications | 19 | dbus-user.talk org.freedesktop.Notifications |
22 | dbus-user.talk org.freedesktop.secrets | 20 | dbus-user.talk org.freedesktop.secrets |
diff --git a/etc/profile-a-l/gitter.profile b/etc/profile-a-l/gitter.profile index e3cf87c87..54f2923ba 100644 --- a/etc/profile-a-l/gitter.profile +++ b/etc/profile-a-l/gitter.profile | |||
@@ -18,6 +18,7 @@ mkdir ${HOME}/.config/Gitter | |||
18 | whitelist ${DOWNLOADS} | 18 | whitelist ${DOWNLOADS} |
19 | whitelist ${HOME}/.config/autostart | 19 | whitelist ${HOME}/.config/autostart |
20 | whitelist ${HOME}/.config/Gitter | 20 | whitelist ${HOME}/.config/Gitter |
21 | whitelist /opt/Gitter | ||
21 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
22 | 23 | ||
23 | caps.drop all | 24 | caps.drop all |
@@ -37,7 +38,6 @@ seccomp | |||
37 | disable-mnt | 38 | disable-mnt |
38 | private-bin bash,env,gitter | 39 | private-bin bash,env,gitter |
39 | private-etc @tls-ca | 40 | private-etc @tls-ca |
40 | private-opt Gitter | ||
41 | private-dev | 41 | private-dev |
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
diff --git a/etc/profile-a-l/google-earth.profile b/etc/profile-a-l/google-earth.profile index 4af6ce36b..1087b3d6e 100644 --- a/etc/profile-a-l/google-earth.profile +++ b/etc/profile-a-l/google-earth.profile | |||
@@ -18,6 +18,7 @@ mkdir ${HOME}/.config/Google | |||
18 | mkdir ${HOME}/.googleearth | 18 | mkdir ${HOME}/.googleearth |
19 | whitelist ${HOME}/.config/Google | 19 | whitelist ${HOME}/.config/Google |
20 | whitelist ${HOME}/.googleearth | 20 | whitelist ${HOME}/.googleearth |
21 | whitelist /opt/google | ||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
22 | 23 | ||
23 | caps.drop all | 24 | caps.drop all |
@@ -37,6 +38,5 @@ seccomp | |||
37 | disable-mnt | 38 | disable-mnt |
38 | private-bin bash,dirname,google-earth,grep,ls,sed,sh | 39 | private-bin bash,dirname,google-earth,grep,ls,sed,sh |
39 | private-dev | 40 | private-dev |
40 | private-opt google | ||
41 | 41 | ||
42 | restrict-namespaces | 42 | restrict-namespaces |
diff --git a/etc/profile-a-l/linuxqq.profile b/etc/profile-a-l/linuxqq.profile index 6ca8b8103..e900c0914 100644 --- a/etc/profile-a-l/linuxqq.profile +++ b/etc/profile-a-l/linuxqq.profile | |||
@@ -17,6 +17,7 @@ mkdir ${HOME}/.config/QQ | |||
17 | whitelist ${HOME}/.config/QQ | 17 | whitelist ${HOME}/.config/QQ |
18 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | 18 | whitelist ${HOME}/.mozilla/firefox/profiles.ini |
19 | whitelist ${DESKTOP} | 19 | whitelist ${DESKTOP} |
20 | whitelist /opt/QQ | ||
20 | 21 | ||
21 | ignore apparmor | 22 | ignore apparmor |
22 | noprinters | 23 | noprinters |
@@ -24,7 +25,6 @@ noprinters | |||
24 | # If you don't need/want to save anything to disk you can add `private` to your linuxqq.local. | 25 | # If you don't need/want to save anything to disk you can add `private` to your linuxqq.local. |
25 | #private | 26 | #private |
26 | private-etc @tls-ca,@x11,host.conf,os-release | 27 | private-etc @tls-ca,@x11,host.conf,os-release |
27 | private-opt QQ | ||
28 | 28 | ||
29 | dbus-user filter | 29 | dbus-user filter |
30 | dbus-user.talk org.freedesktop.Notifications | 30 | dbus-user.talk org.freedesktop.Notifications |
diff --git a/etc/profile-m-z/microsoft-edge-beta.profile b/etc/profile-m-z/microsoft-edge-beta.profile index 6843c11c7..e07bbe6e5 100644 --- a/etc/profile-m-z/microsoft-edge-beta.profile +++ b/etc/profile-m-z/microsoft-edge-beta.profile | |||
@@ -14,10 +14,7 @@ mkdir ${HOME}/.cache/microsoft-edge-beta | |||
14 | mkdir ${HOME}/.config/microsoft-edge-beta | 14 | mkdir ${HOME}/.config/microsoft-edge-beta |
15 | whitelist ${HOME}/.cache/microsoft-edge-beta | 15 | whitelist ${HOME}/.cache/microsoft-edge-beta |
16 | whitelist ${HOME}/.config/microsoft-edge-beta | 16 | whitelist ${HOME}/.config/microsoft-edge-beta |
17 | |||
18 | whitelist /opt/microsoft/msedge-beta | 17 | whitelist /opt/microsoft/msedge-beta |
19 | # private-opt might break the file-copy-limit, see #5307 | ||
20 | #private-opt microsoft | ||
21 | 18 | ||
22 | # Redirect | 19 | # Redirect |
23 | include chromium-common.profile | 20 | include chromium-common.profile |
diff --git a/etc/profile-m-z/mullvad-browser.profile b/etc/profile-m-z/mullvad-browser.profile index cdbb0ae9c..6706386aa 100644 --- a/etc/profile-m-z/mullvad-browser.profile +++ b/etc/profile-m-z/mullvad-browser.profile | |||
@@ -79,7 +79,6 @@ disable-mnt | |||
79 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mullvad-browser,mv,python*,rm,sed,sh,tail,tar,tclsh,test,update-desktop-database,xmessage,xz,zenity | 79 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mullvad-browser,mv,python*,rm,sed,sh,tail,tar,tclsh,test,update-desktop-database,xmessage,xz,zenity |
80 | private-dev | 80 | private-dev |
81 | private-etc @tls-ca | 81 | private-etc @tls-ca |
82 | #private-opt mullvad-browser # can cause slow startup | ||
83 | private-tmp | 82 | private-tmp |
84 | 83 | ||
85 | blacklist ${PATH}/curl | 84 | blacklist ${PATH}/curl |
diff --git a/etc/profile-m-z/notable.profile b/etc/profile-m-z/notable.profile index 9fbbf94c0..4bd3d45ac 100644 --- a/etc/profile-m-z/notable.profile +++ b/etc/profile-m-z/notable.profile | |||
@@ -14,11 +14,12 @@ include globals.local | |||
14 | noblacklist ${HOME}/.config/Notable | 14 | noblacklist ${HOME}/.config/Notable |
15 | noblacklist ${HOME}/.notable | 15 | noblacklist ${HOME}/.notable |
16 | 16 | ||
17 | whitelist /opt/Notable | ||
18 | |||
17 | net none | 19 | net none |
18 | nosound | 20 | nosound |
19 | 21 | ||
20 | ?HAS_APPIMAGE: ignore private-dev | 22 | ?HAS_APPIMAGE: ignore private-dev |
21 | private-opt Notable | ||
22 | 23 | ||
23 | dbus-user filter | 24 | dbus-user filter |
24 | dbus-user.talk ca.desrt.dconf | 25 | dbus-user.talk ca.desrt.dconf |
diff --git a/etc/profile-m-z/nuclear.profile b/etc/profile-m-z/nuclear.profile index 57fba2693..6d1e3cd8a 100644 --- a/etc/profile-m-z/nuclear.profile +++ b/etc/profile-m-z/nuclear.profile | |||
@@ -14,12 +14,12 @@ include disable-shell.inc | |||
14 | 14 | ||
15 | mkdir ${HOME}/.config/nuclear | 15 | mkdir ${HOME}/.config/nuclear |
16 | whitelist ${HOME}/.config/nuclear | 16 | whitelist ${HOME}/.config/nuclear |
17 | whitelist /opt/nuclear | ||
17 | 18 | ||
18 | no3d | 19 | no3d |
19 | 20 | ||
20 | #private-bin nuclear | 21 | #private-bin nuclear |
21 | private-etc @tls-ca,@x11,host.conf,mime.types | 22 | private-etc @tls-ca,@x11,host.conf,mime.types |
22 | private-opt nuclear | ||
23 | 23 | ||
24 | # Redirect | 24 | # Redirect |
25 | include electron-common.profile | 25 | include electron-common.profile |
diff --git a/etc/profile-m-z/ocenaudio.profile b/etc/profile-m-z/ocenaudio.profile index 830483bd4..3fe5a4712 100644 --- a/etc/profile-m-z/ocenaudio.profile +++ b/etc/profile-m-z/ocenaudio.profile | |||
@@ -25,6 +25,7 @@ whitelist ${HOME}/.cache/ocenaudio | |||
25 | whitelist ${HOME}/.local/share/ocenaudio | 25 | whitelist ${HOME}/.local/share/ocenaudio |
26 | whitelist ${DOWNLOADS} | 26 | whitelist ${DOWNLOADS} |
27 | whitelist ${MUSIC} | 27 | whitelist ${MUSIC} |
28 | whitelist /opt/ocenaudio | ||
28 | include whitelist-common.inc | 29 | include whitelist-common.inc |
29 | include whitelist-run-common.inc | 30 | include whitelist-run-common.inc |
30 | include whitelist-runuser-common.inc | 31 | include whitelist-runuser-common.inc |
@@ -54,7 +55,6 @@ private-bin ocenaudio,ocenvst | |||
54 | private-cache | 55 | private-cache |
55 | private-dev | 56 | private-dev |
56 | private-etc @tls-ca,@x11,mime.types | 57 | private-etc @tls-ca,@x11,mime.types |
57 | private-opt ocenaudio | ||
58 | private-tmp | 58 | private-tmp |
59 | 59 | ||
60 | dbus-user none | 60 | dbus-user none |
diff --git a/etc/profile-m-z/palemoon.profile b/etc/profile-m-z/palemoon.profile index ab4e24595..8917a9bc5 100644 --- a/etc/profile-m-z/palemoon.profile +++ b/etc/profile-m-z/palemoon.profile | |||
@@ -12,6 +12,7 @@ mkdir ${HOME}/.cache/moonchild productions/pale moon | |||
12 | mkdir ${HOME}/.moonchild productions | 12 | mkdir ${HOME}/.moonchild productions |
13 | whitelist ${HOME}/.cache/moonchild productions/pale moon | 13 | whitelist ${HOME}/.cache/moonchild productions/pale moon |
14 | whitelist ${HOME}/.moonchild productions | 14 | whitelist ${HOME}/.moonchild productions |
15 | whitelist /opt/palemoon | ||
15 | whitelist /usr/share/moonchild productions | 16 | whitelist /usr/share/moonchild productions |
16 | whitelist /usr/share/palemoon | 17 | whitelist /usr/share/palemoon |
17 | 18 | ||
@@ -22,7 +23,6 @@ ignore seccomp | |||
22 | #private-bin palemoon | 23 | #private-bin palemoon |
23 | # private-etc must first be enabled in firefox-common.profile | 24 | # private-etc must first be enabled in firefox-common.profile |
24 | #private-etc palemoon | 25 | #private-etc palemoon |
25 | #private-opt palemoon | ||
26 | 26 | ||
27 | restrict-namespaces | 27 | restrict-namespaces |
28 | ignore restrict-namespaces | 28 | ignore restrict-namespaces |
diff --git a/etc/profile-m-z/spotify.profile b/etc/profile-m-z/spotify.profile index c893a92fb..63c2c5086 100644 --- a/etc/profile-m-z/spotify.profile +++ b/etc/profile-m-z/spotify.profile | |||
@@ -26,6 +26,7 @@ whitelist ${HOME}/.cache/spotify | |||
26 | whitelist ${HOME}/.config/spotify | 26 | whitelist ${HOME}/.config/spotify |
27 | whitelist ${HOME}/.config/spotify-adblock | 27 | whitelist ${HOME}/.config/spotify-adblock |
28 | whitelist ${HOME}/.local/share/spotify | 28 | whitelist ${HOME}/.local/share/spotify |
29 | whitelist /opt/spotify | ||
29 | include whitelist-common.inc | 30 | include whitelist-common.inc |
30 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
31 | 32 | ||
@@ -48,7 +49,6 @@ private-bin bash,cat,dirname,find,grep,head,rm,sh,spotify,tclsh,touch,zenity | |||
48 | private-dev | 49 | private-dev |
49 | # If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local. | 50 | # If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local. |
50 | private-etc @tls-ca,host.conf,spotify-adblock | 51 | private-etc @tls-ca,host.conf,spotify-adblock |
51 | private-opt spotify | ||
52 | private-srv none | 52 | private-srv none |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
diff --git a/etc/profile-m-z/thunderbird-beta.profile b/etc/profile-m-z/thunderbird-beta.profile index 46a1e57c8..e01a9d2d8 100644 --- a/etc/profile-m-z/thunderbird-beta.profile +++ b/etc/profile-m-z/thunderbird-beta.profile | |||
@@ -6,7 +6,7 @@ include thunderbird-beta.local | |||
6 | # added by included profile | 6 | # added by included profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | private-opt thunderbird-beta | 9 | whitelist /opt/thunderbird-beta |
10 | 10 | ||
11 | # Redirect | 11 | # Redirect |
12 | include thunderbird.profile | 12 | include thunderbird.profile |
diff --git a/etc/profile-m-z/torbrowser-launcher.profile b/etc/profile-m-z/torbrowser-launcher.profile index 20ebddb69..b9fdcf92c 100644 --- a/etc/profile-m-z/torbrowser-launcher.profile +++ b/etc/profile-m-z/torbrowser-launcher.profile | |||
@@ -62,7 +62,6 @@ disable-mnt | |||
62 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mv,python*,rm,sed,sh,tail,tar,tclsh,test,tor-browser,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity | 62 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mv,python*,rm,sed,sh,tail,tar,tclsh,test,tor-browser,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity |
63 | private-dev | 63 | private-dev |
64 | private-etc @tls-ca | 64 | private-etc @tls-ca |
65 | #private-opt tor-browser # can cause slow startup | ||
66 | private-tmp | 65 | private-tmp |
67 | 66 | ||
68 | dbus-user none | 67 | dbus-user none |
diff --git a/etc/profile-m-z/tutanota-desktop.profile b/etc/profile-m-z/tutanota-desktop.profile index 55e4a4392..f0a0cacaf 100644 --- a/etc/profile-m-z/tutanota-desktop.profile +++ b/etc/profile-m-z/tutanota-desktop.profile | |||
@@ -22,6 +22,7 @@ mkdir ${HOME}/.config/tuta_integration | |||
22 | mkdir ${HOME}/.config/tutanota-desktop | 22 | mkdir ${HOME}/.config/tutanota-desktop |
23 | whitelist ${HOME}/.config/tuta_integration | 23 | whitelist ${HOME}/.config/tuta_integration |
24 | whitelist ${HOME}/.config/tutanota-desktop | 24 | whitelist ${HOME}/.config/tutanota-desktop |
25 | whitelist /opt/tutanota-desktop | ||
25 | 26 | ||
26 | # The lines below are needed to find the default Firefox profile name, to allow | 27 | # The lines below are needed to find the default Firefox profile name, to allow |
27 | # opening links in an existing instance of Firefox (note that it still fails if | 28 | # opening links in an existing instance of Firefox (note that it still fails if |
@@ -34,7 +35,6 @@ nosound | |||
34 | 35 | ||
35 | ?HAS_APPIMAGE: ignore private-dev | 36 | ?HAS_APPIMAGE: ignore private-dev |
36 | private-etc @tls-ca | 37 | private-etc @tls-ca |
37 | private-opt tutanota-desktop | ||
38 | 38 | ||
39 | dbus-user filter | 39 | dbus-user filter |
40 | dbus-user.talk org.freedesktop.Notifications | 40 | dbus-user.talk org.freedesktop.Notifications |
diff --git a/etc/profile-m-z/twitch.profile b/etc/profile-m-z/twitch.profile index e2b8de12b..55106d622 100644 --- a/etc/profile-m-z/twitch.profile +++ b/etc/profile-m-z/twitch.profile | |||
@@ -16,10 +16,10 @@ include disable-shell.inc | |||
16 | 16 | ||
17 | mkdir ${HOME}/.config/Twitch | 17 | mkdir ${HOME}/.config/Twitch |
18 | whitelist ${HOME}/.config/Twitch | 18 | whitelist ${HOME}/.config/Twitch |
19 | whitelist /opt/Twitch | ||
19 | 20 | ||
20 | private-bin electron,electron[0-9],electron[0-9][0-9],twitch | 21 | private-bin electron,electron[0-9],electron[0-9][0-9],twitch |
21 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types | 22 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types |
22 | private-opt Twitch | ||
23 | 23 | ||
24 | # Redirect | 24 | # Redirect |
25 | include electron-common.profile | 25 | include electron-common.profile |
diff --git a/etc/profile-m-z/xmr-stak.profile b/etc/profile-m-z/xmr-stak.profile index b8bf0ae96..06f0b5833 100644 --- a/etc/profile-m-z/xmr-stak.profile +++ b/etc/profile-m-z/xmr-stak.profile | |||
@@ -16,6 +16,7 @@ include disable-shell.inc | |||
16 | include disable-xdg.inc | 16 | include disable-xdg.inc |
17 | 17 | ||
18 | mkdir ${HOME}/.xmr-stak | 18 | mkdir ${HOME}/.xmr-stak |
19 | whitelist /opt/cuda | ||
19 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
20 | 21 | ||
21 | caps.drop all | 22 | caps.drop all |
@@ -39,7 +40,6 @@ private-bin xmr-stak | |||
39 | private-dev | 40 | private-dev |
40 | private-etc @tls-ca | 41 | private-etc @tls-ca |
41 | #private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend | 42 | #private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend |
42 | private-opt cuda | ||
43 | private-tmp | 43 | private-tmp |
44 | 44 | ||
45 | memory-deny-write-execute | 45 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/youtube.profile b/etc/profile-m-z/youtube.profile index bee309986..0fb87f747 100644 --- a/etc/profile-m-z/youtube.profile +++ b/etc/profile-m-z/youtube.profile | |||
@@ -15,10 +15,10 @@ include disable-shell.inc | |||
15 | 15 | ||
16 | mkdir ${HOME}/.config/Youtube | 16 | mkdir ${HOME}/.config/Youtube |
17 | whitelist ${HOME}/.config/Youtube | 17 | whitelist ${HOME}/.config/Youtube |
18 | whitelist /opt/Youtube | ||
18 | 19 | ||
19 | private-bin electron,electron[0-9],electron[0-9][0-9],youtube | 20 | private-bin electron,electron[0-9],electron[0-9][0-9],youtube |
20 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types | 21 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types |
21 | private-opt Youtube | ||
22 | 22 | ||
23 | # Redirect | 23 | # Redirect |
24 | include electron-common.profile | 24 | include electron-common.profile |
diff --git a/etc/profile-m-z/youtubemusic-nativefier.profile b/etc/profile-m-z/youtubemusic-nativefier.profile index e98d84329..e5ece41bc 100644 --- a/etc/profile-m-z/youtubemusic-nativefier.profile +++ b/etc/profile-m-z/youtubemusic-nativefier.profile | |||
@@ -12,10 +12,10 @@ include disable-shell.inc | |||
12 | 12 | ||
13 | mkdir ${HOME}/.config/youtubemusic-nativefier-040164 | 13 | mkdir ${HOME}/.config/youtubemusic-nativefier-040164 |
14 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 | 14 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 |
15 | whitelist /opt/youtubemusic-nativefier | ||
15 | 16 | ||
16 | private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier | 17 | private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier |
17 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types | 18 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types |
18 | private-opt youtubemusic-nativefier | ||
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
21 | include electron-common.profile | 21 | include electron-common.profile |
diff --git a/etc/templates/profile.template b/etc/templates/profile.template index 9329fe297..6299d42cd 100644 --- a/etc/templates/profile.template +++ b/etc/templates/profile.template | |||
@@ -196,6 +196,13 @@ include globals.local | |||
196 | # Extra: gai.conf,proxychains.conf | 196 | # Extra: gai.conf,proxychains.conf |
197 | # Qt: Trolltech.conf | 197 | # Qt: Trolltech.conf |
198 | ##private-lib LIBS | 198 | ##private-lib LIBS |
199 | ## Note: private-opt copies the entire path(s) to RAM, which may break | ||
200 | ## file-copy-limit in firejail.config (see firejail(1)). | ||
201 | ## For sizeable apps (if in doubt, do this): | ||
202 | ## - never use 'private-opt NAME' | ||
203 | ## - place 'whitelist /opt/NAME' in the whitelist section above | ||
204 | ## For acceptable apps: | ||
205 | ## - use 'private-opt NAME' | ||
199 | ##private-opt NAME | 206 | ##private-opt NAME |
200 | #private-tmp | 207 | #private-tmp |
201 | ##writable-etc | 208 | ##writable-etc |
diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in index 19fc94ebd..ee4adf5b8 100644 --- a/src/man/firejail.1.in +++ b/src/man/firejail.1.in | |||
@@ -2263,6 +2263,18 @@ All modifications are discarded when the sandbox is closed. | |||
2263 | Example: | 2263 | Example: |
2264 | .br | 2264 | .br |
2265 | $ firejail --private-opt=firefox /opt/firefox/firefox | 2265 | $ firejail --private-opt=firefox /opt/firefox/firefox |
2266 | .br | ||
2267 | |||
2268 | .br | ||
2269 | Note: Program installations in /opt tend to be relatively large and private-opt | ||
2270 | copies the entire path(s) into RAM, which may significantly increase RAM usage | ||
2271 | and break \fBfile-copy-limit\fR in firejail.config. | ||
2272 | Therefore, in general it is recommended to use "whitelist /opt/PATH" instead of | ||
2273 | "private-opt PATH". | ||
2274 | For details, see | ||
2275 | .UR https://github.com/netblue30/firejail/discussions/5307 | ||
2276 | #5307 | ||
2277 | .UE | ||
2266 | 2278 | ||
2267 | .TP | 2279 | .TP |
2268 | \fB\-\-private-srv=file,directory | 2280 | \fB\-\-private-srv=file,directory |