harden pandoc & shellcheck

2 files changed, 4 insertions, 0 deletions

diff --git a/etc/pandoc.profile b/etc/pandoc.profile
index 788324855..8c9c1e818 100644
--- a/etc/pandoc.profile
+++ b/etc/pandoc.profile
@@ -45,6 +45,7 @@ disable-mnt
 private-bin context,latex,mktexfmt,pandoc,pdflatex,pdfroff,prince,weasyprint,wkhtmltopdf
 private-cache
 private-dev
+rivate-etc alternatives,texlive
 private-tmp
 
 memory-deny-write-execute
diff --git a/etc/shellcheck.profile b/etc/shellcheck.profile
index da5b4258b..2fcd69d3b 100644
--- a/etc/shellcheck.profile
+++ b/etc/shellcheck.profile
@@ -21,6 +21,7 @@ include whitelist-var-common.inc
 
 caps.drop all
 ipc-namespace
+machine-id
 net none
 no3d
 nodbus
@@ -35,8 +36,10 @@ novideo
 protocol unix
 seccomp
 shell none
+tracelog
 x11 none
 
+private-cache
 private-dev
 private-tmp