Merge pull request #1864 from glitsj16/enchant

Update enchant profile

4 files changed, 37 insertions, 4 deletions

diff --git a/etc/enchant-2.profile b/etc/enchant-2.profile
new file mode 100644
index 000000000..ba7573289
--- /dev/null
+++ b/etc/enchant-2.profile
@@ -0,0 +1,9 @@
+# Firejail profile for enchant-2
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/enchant-2.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+# Redirect
+include /etc/firejail/enchant.profile
diff --git a/etc/enchant-lsmod-2.profile b/etc/enchant-lsmod-2.profile
new file mode 100644
index 000000000..1b646eef6
--- /dev/null
+++ b/etc/enchant-lsmod-2.profile
@@ -0,0 +1,9 @@
+# Firejail profile for enchant-lsmod-2
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/enchant-lsmod-2.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+# Redirect
+include /etc/firejail/enchant.profile
diff --git a/etc/enchant-lsmod.profile b/etc/enchant-lsmod.profile
new file mode 100644
index 000000000..3452b0421
--- /dev/null
+++ b/etc/enchant-lsmod.profile
@@ -0,0 +1,9 @@
+# Firejail profile for enchant-lsmod
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/enchant-lsmod.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+# Redirect
+include /etc/firejail/enchant.profile
diff --git a/etc/enchant.profile b/etc/enchant.profile
index 0e9ed3f22..29472313d 100644
--- a/etc/enchant.profile
+++ b/etc/enchant.profile
@@ -15,6 +15,8 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
@@ -27,7 +29,11 @@ seccomp
 shell none
 tracelog
 
-# private-bin enchant
-# private-dev
-# private-etc fonts
-# private-tmp
+# private-bin enchant, enchant-*
+private-dev
+private-etc none
+private-tmp
+
+# memory-deny-write-execute
+noexec ${HOME}
+noexec /tmp