fixes

2 files changed, 24 insertions, 5 deletions

diff --git a/README b/README
index f4fd52666..6ed82907f 100644
--- a/README
+++ b/README
@@ -47,6 +47,7 @@ Aleksey Manevich (https://github.com/manevich)
         - added --join-or-start command
         - CVE-2016-7545
 Fred-Barclay (https://github.com/Fred-Barclay)
+        - lots of profile fixes
         - added Vivaldi, Atril profiles
         - added PaleMoon profile
         - split Icedove and Thunderbird profiles
@@ -83,6 +84,7 @@ valoq (https://github.com/valoq)
         - cherrytree profile fixes
         - added support for /srv in --whitelist feature
         - Eye of GNOME and Evolution profiles
+        - blacklist suid binaries in disable-common.inc
 Rafael Cavalcanti (https://github.com/rccavalcanti)
         - chromium profile fixes for Arch Linux
 Deelvesh Bunjun (https://github.com/DeelveshBunjun)
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index 29de8cca9..3c0b2160c 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -137,6 +137,11 @@ blacklist /etc/gshadow+
 blacklist /etc/ssh
 blacklist /var/backup
 
+# system directories    
+blacklist /sbin
+blacklist /usr/sbin
+blacklist /usr/local/sbin
+
 # system management
 blacklist ${PATH}/umount
 blacklist ${PATH}/mount
@@ -149,11 +154,23 @@ blacklist ${PATH}/xev
 blacklist ${PATH}/strace
 blacklist ${PATH}/nc
 blacklist ${PATH}/ncat
-
-# system directories    
-blacklist /sbin
-blacklist /usr/sbin
-blacklist /usr/local/sbin
+blacklist ${PATH}/gpasswd
+blacklist ${PATH}/newgidmap
+blacklist ${PATH}/newgrp
+blacklist ${PATH}/newuidmap
+blacklist ${PATH}/pkexec
+blacklist ${PATH}/sg
+blacklist ${PATH}/rsh
+blacklist ${PATH}/rlogin
+blacklist ${PATH}/rcp
+blacklist ${PATH}/crontab
+blacklist ${PATH}/ksu
+blacklist ${PATH}/chsh
+blacklist ${PATH}/chfn
+blacklist ${PATH}/chage
+blacklist ${PATH}/expiry
+blacklist ${PATH}/ping
+blacklist ${PATH}/unix_chkpwd
 
 # prevent lxterminal connecting to an existing lxterminal session
 blacklist /tmp/.lxterminal-socket*