Harden more profiles

27 files changed, 48 insertions, 4 deletions

diff --git a/etc/bleachbit.profile b/etc/bleachbit.profile
index 7ea55f505..fe08de40e 100644
--- a/etc/bleachbit.profile
+++ b/etc/bleachbit.profile
@@ -9,6 +9,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+ipc-namespace
 net none
 netfilter
 no3d
diff --git a/etc/bless.profile b/etc/bless.profile
index 869f13cc0..f4b5c2e2f 100644
--- a/etc/bless.profile
+++ b/etc/bless.profile
@@ -17,6 +17,7 @@ include /etc/firejail/disable-devel.inc
 
 #Options
 caps.drop all
+ipc-namespace
 net none
 netfilter
 no3d
diff --git a/etc/chromium.profile b/etc/chromium.profile
index 995c0001b..071c8a18a 100644
--- a/etc/chromium.profile
+++ b/etc/chromium.profile
@@ -8,12 +8,8 @@ noblacklist ~/.cache/chromium
 noblacklist ~/.pki
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
-
 # chromium is distributed with a perl script on Arch
 # include /etc/firejail/disable-devel.inc
-#
-
-netfilter
 
 whitelist ${DOWNLOADS}
 mkdir ~/.config/chromium
@@ -27,3 +23,14 @@ whitelist ~/.pki
 whitelist ~/.config/chromium-flags.conf
 
 include /etc/firejail/whitelist-common.inc
+
+ipc-namespace
+netfilter
+nogroups
+shell none
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/dino.profile b/etc/dino.profile
index 3de858618..5f587ef8a 100644
--- a/etc/dino.profile
+++ b/etc/dino.profile
@@ -16,6 +16,7 @@ whitelist ${HOME}/.local/share/dino
 include /etc/firejail/whitelist-common.inc
 
 caps.drop all
+ipc-namespace
 netfilter
 no3d
 nogroups
diff --git a/etc/eog.profile b/etc/eog.profile
index 7c2cd557c..32ceebb1d 100644
--- a/etc/eog.profile
+++ b/etc/eog.profile
@@ -11,6 +11,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+ipc-namespace
 net none
 netfilter
 no3d
diff --git a/etc/evince.profile b/etc/evince.profile
index ae50425b9..508a0d1a5 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -11,6 +11,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+ipc-namespace
 netfilter
 #net none - creates some problems on some distributions
 no3d
diff --git a/etc/evolution.profile b/etc/evolution.profile
index 04bf480ff..6fe58cbf9 100644
--- a/etc/evolution.profile
+++ b/etc/evolution.profile
@@ -20,6 +20,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+ipc-namespace
 netfilter
 no3d
 nogroups
diff --git a/etc/file-roller.profile b/etc/file-roller.profile
index a3f687651..6bc74c79d 100644
--- a/etc/file-roller.profile
+++ b/etc/file-roller.profile
@@ -9,6 +9,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+ipc-namespace
 net none
 netfilter
 no3d
diff --git a/etc/firefox.profile b/etc/firefox.profile
index 4d96c05c8..0013062a5 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -16,7 +16,9 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 
 caps.drop all
+ipc-namespace
 netfilter
+nogroups
 nonewprivs
 noroot
 protocol unix,inet,inet6,netlink
diff --git a/etc/gedit.profile b/etc/gedit.profile
index 07bdb1bbe..2c429c808 100644
--- a/etc/gedit.profile
+++ b/etc/gedit.profile
@@ -14,6 +14,7 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+ipc-namespace
 netfilter
 net none
 no3d
diff --git a/etc/gimp.profile b/etc/gimp.profile
index 5f8ccb4fb..59d88e9ec 100644
--- a/etc/gimp.profile
+++ b/etc/gimp.profile
@@ -9,6 +9,7 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+ipc-namespace
 netfilter
 net none
 nogroups
diff --git a/etc/gnome-calculator.profile b/etc/gnome-calculator.profile
index e9366f07d..28f0d646c 100644
--- a/etc/gnome-calculator.profile
+++ b/etc/gnome-calculator.profile
@@ -16,6 +16,7 @@ include /etc/firejail/whitelist-common.inc
 
 #Options
 caps.drop all
+ipc-namespace
 netfilter
 #net none                                     
 no3d
diff --git a/etc/hexchat.profile b/etc/hexchat.profile
index d24f492d8..18cbcea5c 100644
--- a/etc/hexchat.profile
+++ b/etc/hexchat.profile
@@ -12,6 +12,7 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 
 caps.drop all
+ipc-namespace
 netfilter
 no3d
 nogroups
diff --git a/etc/jd-gui.profile b/etc/jd-gui.profile
index 6ff618187..61841e2c5 100644
--- a/etc/jd-gui.profile
+++ b/etc/jd-gui.profile
@@ -16,6 +16,7 @@ include /etc/firejail/disable-devel.inc
 
 #Options
 caps.drop all
+ipc-namespace
 net none
 netfilter
 no3d
diff --git a/etc/lollypop.profile b/etc/lollypop.profile
index e84118b9e..d6d2cdd73 100644
--- a/etc/lollypop.profile
+++ b/etc/lollypop.profile
@@ -17,6 +17,7 @@ include /etc/firejail/disable-devel.inc
 
 #Options
 caps.drop all
+ipc-namespace
 netfilter
 no3d
 nogroups
diff --git a/etc/multimc5.profile b/etc/multimc5.profile
index 12a7646ae..4b561405b 100644
--- a/etc/multimc5.profile
+++ b/etc/multimc5.profile
@@ -25,6 +25,7 @@ include /etc/firejail/whitelist-common.inc
 
 #Options
 caps.drop all
+ipc-namespace
 netfilter
 nogroups
 nonewprivs
diff --git a/etc/mumble.profile b/etc/mumble.profile
index c5c6a4d1a..19d7a131a 100644
--- a/etc/mumble.profile
+++ b/etc/mumble.profile
@@ -17,6 +17,7 @@ whitelist ${HOME}/.local/share/data/Mumble
 include /etc/firejail/whitelist-common.inc
 
 caps.drop all
+ipc-namespace
 netfilter
 no3d
 nonewprivs
diff --git a/etc/pdfsam.profile b/etc/pdfsam.profile
index dfe463c98..db8aacaa5 100644
--- a/etc/pdfsam.profile
+++ b/etc/pdfsam.profile
@@ -14,6 +14,7 @@ include /etc/firejail/disable-devel.inc
 
 #Options
 caps.drop all
+ipc-namespace
 net none
 netfilter
 no3d
diff --git a/etc/pithos.profile b/etc/pithos.profile
index c25b5772b..f599283fb 100644
--- a/etc/pithos.profile
+++ b/etc/pithos.profile
@@ -16,6 +16,7 @@ include /etc/firejail/whitelist-common.inc
 
 #Options
 caps.drop all
+ipc-namespace
 netfilter
 no3d
 nogroups
diff --git a/etc/polari.profile b/etc/polari.profile
index 834a8b3d6..db5fc9487 100644
--- a/etc/polari.profile
+++ b/etc/polari.profile
@@ -23,7 +23,18 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
+nosound
 protocol unix,inet,inet6
 seccomp
+shell none
+tracelog
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/ssh.profile b/etc/ssh.profile
index 425841399..f9750972f 100644
--- a/etc/ssh.profile
+++ b/etc/ssh.profile
@@ -13,6 +13,7 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+ipc-namespace
 netfilter
 no3d
 nogroups
diff --git a/etc/steam.profile b/etc/steam.profile
index 536588e4b..eef91a0d5 100644
--- a/etc/steam.profile
+++ b/etc/steam.profile
@@ -11,6 +11,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+ipc-namespace
 netfilter
 nogroups
 nonewprivs
diff --git a/etc/totem.profile b/etc/totem.profile
index fadfbb00b..d280296f0 100644
--- a/etc/totem.profile
+++ b/etc/totem.profile
@@ -12,6 +12,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+ipc-namespace
 netfilter
 nogroups
 nonewprivs
diff --git a/etc/vlc.profile b/etc/vlc.profile
index 21282dfbd..5d759ffd4 100644
--- a/etc/vlc.profile
+++ b/etc/vlc.profile
@@ -11,6 +11,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+ipc-namespace
 netfilter
 # nogroups
 nonewprivs
diff --git a/etc/wget.profile b/etc/wget.profile
index 3ba97d95d..52c8b68a1 100644
--- a/etc/wget.profile
+++ b/etc/wget.profile
@@ -9,6 +9,7 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+ipc-namespace
 netfilter
 no3d
 nogroups
diff --git a/etc/wireshark.profile b/etc/wireshark.profile
index dc224b31c..45ccfb89a 100644
--- a/etc/wireshark.profile
+++ b/etc/wireshark.profile
@@ -17,6 +17,7 @@ include /etc/firejail/disable-passwdmgr.inc
 #noroot 
 #protocol unix,inet,inet6,netlink
 
+ipc-namespace
 netfilter
 no3d
 nogroups
diff --git a/etc/xonotic.profile b/etc/xonotic.profile
index 6bfb26484..0bf372fc6 100644
--- a/etc/xonotic.profile
+++ b/etc/xonotic.profile
@@ -22,6 +22,7 @@ include /etc/firejail/whitelist-common.inc
 
 #Options
 caps.drop all
+ipc-namespace
 netfilter
 nogroups
 nonewprivs