whitelisting ~/.fonts

9 files changed, 40 insertions, 3 deletions

diff --git a/Makefile.in b/Makefile.in
index 27ecce4fb..aeb1d34d0 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -111,6 +111,7 @@ realinstall:
         install -c -m 0644 etc/skype.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 etc/wine.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 etc/disable-devel.inc $(DESTDIR)/$(sysconfdir)/firejail/.
+        install -c -m 0644 etc/conkeror.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         bash -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
         # man pages
         rm -f firejail.1.gz
diff --git a/README b/README
index 9edc65b11..ffb28134b 100644
--- a/README
+++ b/README
@@ -18,6 +18,8 @@ License: GPL v2
 Firejail Authors:
 
 netblue30 (netblue30@yahoo.com)
+emacsomancer (https://github.com/emacsomancer)
+        - added profile for Conkeror browser
 Daan Bakker (https://github.com/dbakker)
         - protect shell startup files
 Duncan Overbruck (https://github.com/Duncaen)
diff --git a/RELNOTES b/RELNOTES
index 4a790707e..289b2ea70 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -2,7 +2,7 @@ firejail (0.9.34-rc1) baseline; urgency=low
   * added --ignore option
   * added --protocol option
   * support dual i386/amd64 seccomp filters
-  * added Steam, Skype and Wine profiles
+  * added Steam, Skype, Wine and Conkeror profiles
   * bugfixes
  -- netblue30 <netblue30@yahoo.com>  Thu, 29 Oct 2015 08:00:00 -0500
 
diff --git a/etc/chromium.profile b/etc/chromium.profile
index bba2f0e10..ee5600170 100644
--- a/etc/chromium.profile
+++ b/etc/chromium.profile
@@ -7,3 +7,10 @@ include /etc/firejail/disable-devel.inc
 netfilter
 whitelist ~/Downloads
 whitelist ~/.config/chromium
+
+# common
+whitelist ~/.fonts
+whitelist ~/.fonts.d
+whitelist ~/.fontconfig
+whitelist ~/.fonts.conf
+whitelist ~/.fonts.conf.d
diff --git a/etc/conkeror.profile b/etc/conkeror.profile
index e33edac0e..7c1384523 100644
--- a/etc/conkeror.profile
+++ b/etc/conkeror.profile
@@ -19,4 +19,10 @@ whitelist ~/.vimperator
 whitelist ~/.pentadactylrc
 whitelist ~/.pentadactyl
 whitelist ~/.conkerorrc
+
+# common
 whitelist ~/.fonts
+whitelist ~/.fonts.d
+whitelist ~/.fontconfig
+whitelist ~/.fonts.conf
+whitelist ~/.fonts.conf.d
diff --git a/etc/firefox.profile b/etc/firefox.profile
index 50d5c940b..d926474d0 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -19,3 +19,10 @@ whitelist ~/.vimperatorrc
 whitelist ~/.vimperator
 whitelist ~/.pentadactylrc
 whitelist ~/.pentadactyl
+
+# common
+whitelist ~/.fonts
+whitelist ~/.fonts.d
+whitelist ~/.fontconfig
+whitelist ~/.fonts.conf
+whitelist ~/.fonts.conf.d
diff --git a/etc/spotify.profile b/etc/spotify.profile
index 36d8f2b7a..f77f900cf 100644
--- a/etc/spotify.profile
+++ b/etc/spotify.profile
@@ -10,11 +10,16 @@ include /etc/firejail/disable-devel.inc
 whitelist ${HOME}/.config/spotify
 whitelist ${HOME}/.local/share/spotify
 whitelist ${HOME}/.cache/spotify
-# Whitelist the pulseaudio config, to allow PulseAudio workaround (Issue #69)
-whitelist ${HOME}/.config/pulse
 
 caps.drop all
 seccomp
 protocol unix,inet,inet6
 netfilter
 noroot
+
+# common
+whitelist ~/.fonts
+whitelist ~/.fonts.d
+whitelist ~/.fontconfig
+whitelist ~/.fonts.conf
+whitelist ~/.fonts.conf.d
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index 78f42b83e..6ba79f9c7 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -37,3 +37,4 @@
 /etc/firejail/steam.profile
 /etc/firejail/wine.profile
 /etc/firejail/disable-devel.inc
+/etc/firejail/conkeror.profile
diff --git a/todo b/todo
index 8d1211425..8dcb0acf9 100644
--- a/todo
+++ b/todo
@@ -54,3 +54,11 @@ cat <&3
 c) A list of attacks
 http://www.lanmaster53.com/2011/05/7-linux-shells-using-built-in-tools/
 
+8. SELinux
+
+Firefox selinux disabled (RedHat): http://danwalsh.livejournal.com/72697.html
+Firefox selinux enabled (Gentoo hardened): http://blog.siphos.be/2015/08/why-we-do-confine-firefox/
+"desktops are notoriously difficult to use a mandatory access control system on"
+
+9. blacklist .muttrc, contains passwords in clear text
+