added lxterminal profile

3 files changed, 22 insertions, 0 deletions

diff --git a/Makefile.in b/Makefile.in
index c4b3d238a..f5e52979f 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -137,6 +137,7 @@ realinstall:
         install -c -m 0644 .etc/uget-gtk.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 .etc/mupen64plus.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 .etc/disable-terminals.inc $(DESTDIR)/$(sysconfdir)/firejail/.
+        install -c -m 0644 .etc/lxterminal.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         bash -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
         rm -fr .etc
         # man pages
diff --git a/etc/lxterminal.profile b/etc/lxterminal.profile
new file mode 100644
index 000000000..a614a8dbf
--- /dev/null
+++ b/etc/lxterminal.profile
@@ -0,0 +1,19 @@
+# lxterminal (LXDE) profile
+
+include /etc/firejail/disable-mgmt.inc
+include /etc/firejail/disable-secret.inc
+include /etc/firejail/disable-common.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+caps.drop all
+seccomp
+protocol unix,inet,inet6
+netfilter
+
+#noroot - somehow this breaks on Debian Jessie!
+
+# lxterminal is a single-instence program
+# blacklist any existing lxterminal socket in order to force a second process instance
+blacklist /tmp/.lxterminal-socket*
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index 3adb5201d..27e65c5e6 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -62,3 +62,5 @@
 /etc/firejail/Mathematica.profile
 /etc/firejail/uget-gtk.profile
 /etc/firejail/mupen64plus.profile
+/etc/disable-terminals.inc
+/etc/lxterminal.profile