various little profile fixes and enhancements (#1442)

* add novideo

* add novideo

* add novideo

* put noexec last

* blacklist Clementine configuration and database

* blacklist Clementine configuration and database

* add novideo

* add novideo, permit access to ~/.java

* add novideo

* spoof machine-id

* mimeapps.list is already in whitelist-common.inc

* ~/.local/share/applications is already read-only

see disable-common.inc

* mimeapps.list is already in whitelist-common.inc

* ~/.local/share/applications is already read-only

see disable-common.inc

* drop machine-id option

private-etc hides it anyway

11 files changed, 11 insertions, 6 deletions

diff --git a/etc/ark.profile b/etc/ark.profile
index 7c8574973..4884b4a0f 100644
--- a/etc/ark.profile
+++ b/etc/ark.profile
@@ -18,6 +18,7 @@ nogroups
 nonewprivs
 noroot
 nosound
+novideo
 protocol unix
 seccomp
 shell none
diff --git a/etc/audacious.profile b/etc/audacious.profile
index 15bf6c013..0300f6777 100644
--- a/etc/audacious.profile
+++ b/etc/audacious.profile
@@ -17,6 +17,7 @@ caps.drop all
 netfilter
 nonewprivs
 noroot
+novideo
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/baloo_file.profile b/etc/baloo_file.profile
index 9c2909b0f..66c552dd6 100644
--- a/etc/baloo_file.profile
+++ b/etc/baloo_file.profile
@@ -36,6 +36,6 @@ noexec /tmp
 
 # Make home directory read-only and allow writing only to ~/.local/share
 # Note: Baloo will not be able to update the "first run" key in its configuration files.
-# noexec     ${HOME}/.local/share
 # read-only  ${HOME}
 # read-write ${HOME}/.local/share
+# noexec     ${HOME}/.local/share
diff --git a/etc/clementine.profile b/etc/clementine.profile
index 13a14af3b..adcf9414a 100644
--- a/etc/clementine.profile
+++ b/etc/clementine.profile
@@ -5,6 +5,7 @@ include /etc/firejail/clementine.local
 # Persistent global definitions
 include /etc/firejail/globals.local
 
+noblacklist ~/.config/Clementine
 
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index c67a0b378..0868fa10b 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -32,6 +32,7 @@ blacklist ${HOME}/.config/akregatorrc
 blacklist ${HOME}/.config/Atom
 blacklist ${HOME}/.config/Audaciousrc
 blacklist ${HOME}/.config/Brackets
+blacklist ${HOME}/.config/Clementine
 blacklist ${HOME}/.config/Cryptocat
 blacklist ${HOME}/.config/Franz
 blacklist ${HOME}/.config/Gitter
diff --git a/etc/geary.profile b/etc/geary.profile
index 3f9faf058..353d00124 100644
--- a/etc/geary.profile
+++ b/etc/geary.profile
@@ -13,7 +13,6 @@ noblacklist ~/.local/share/geary
 
 mkdir ~/.gnupg
 mkdir ~/.local/share/geary
-whitelist ~/.config/mimeapps.list
 whitelist ~/.gnupg
 whitelist ~/.local/share/applications
 whitelist ~/.local/share/geary
@@ -22,7 +21,6 @@ include /etc/firejail/whitelist-common.inc
 ignore private-tmp
 
 read-only ~/.config/mimeapps.list
-read-only ~/.local/share/applications
 
 # allow browsers
 include /etc/firejail/firefox.profile
diff --git a/etc/gwenview.profile b/etc/gwenview.profile
index 0f2be604b..0bc47d301 100644
--- a/etc/gwenview.profile
+++ b/etc/gwenview.profile
@@ -23,6 +23,7 @@ caps.drop all
 nogroups
 nonewprivs
 noroot
+novideo
 protocol unix
 seccomp
 shell none
diff --git a/etc/mediathekview.profile b/etc/mediathekview.profile
index 5e980909b..bebe95a72 100644
--- a/etc/mediathekview.profile
+++ b/etc/mediathekview.profile
@@ -6,6 +6,7 @@ include /etc/firejail/mediathekview.local
 include /etc/firejail/globals.local
 
 noblacklist ~/.config/vlc
+noblacklist ~/.java
 noblacklist ~/.mediathek3
 
 include /etc/firejail/disable-common.inc
@@ -17,6 +18,7 @@ caps.drop all
 netfilter
 nonewprivs
 noroot
+novideo
 protocol unix,inet,inet6
 seccomp
 tracelog
diff --git a/etc/okular.profile b/etc/okular.profile
index 331b625b8..cf747417c 100644
--- a/etc/okular.profile
+++ b/etc/okular.profile
@@ -26,6 +26,7 @@ nogroups
 nonewprivs
 noroot
 nosound
+novideo
 protocol unix
 seccomp
 shell none
diff --git a/etc/scribus.profile b/etc/scribus.profile
index 7e117dcd1..2ccb5126b 100644
--- a/etc/scribus.profile
+++ b/etc/scribus.profile
@@ -5,7 +5,7 @@ include /etc/firejail/scribus.local
 # Persistent global definitions
 include /etc/firejail/globals.local
 
-# Support for PDF readers (Scribus 1.5 and higher)
+# Support for PDF readers comes with Scribus 1.5 and higher
 noblacklist ~/.config/okularpartrc
 noblacklist ~/.config/okularrc
 noblacklist ~/.config/scribus
@@ -30,6 +30,7 @@ caps.drop all
 nonewprivs
 noroot
 nosound
+novideo
 protocol unix
 seccomp
 tracelog
diff --git a/etc/thunderbird.profile b/etc/thunderbird.profile
index d3b7ee871..c3dc0366b 100644
--- a/etc/thunderbird.profile
+++ b/etc/thunderbird.profile
@@ -18,7 +18,6 @@ mkdir ~/.gnupg
 mkdir ~/.icedove
 mkdir ~/.thunderbird
 whitelist ~/.cache/thunderbird
-whitelist ~/.config/mimeapps.list
 whitelist ~/.gnupg
 whitelist ~/.icedove
 whitelist ~/.local/share/applications
@@ -28,7 +27,6 @@ include /etc/firejail/whitelist-common.inc
 ignore private-tmp
 
 read-only ~/.config/mimeapps.list
-read-only ~/.local/share/applications
 
 # allow browsers
 include /etc/firejail/firefox.profile