use 'x11 none' option

... instead of just blacklisting the X11 socket.

Systematically added to all profiles with 'net none' and
'blacklist /tmp/.X11-unix', and a few more

18 files changed, 18 insertions, 30 deletions

diff --git a/etc/7z.profile b/etc/7z.profile
index ee2b493f8..15e99e936 100644
--- a/etc/7z.profile
+++ b/etc/7z.profile
@@ -6,8 +6,6 @@ include 7z.local
 # Persistent global definitions
 include globals.local
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -33,5 +31,6 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 private-dev
diff --git a/etc/atool.profile b/etc/atool.profile
index 7bcfdb935..c9d950259 100644
--- a/etc/atool.profile
+++ b/etc/atool.profile
@@ -10,8 +10,6 @@ include globals.local
 # Allow perl (blacklisted by disable-interpreters.inc)
 include allow-perl.inc
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 # include disable-devel.inc
 include disable-exec.inc
@@ -40,6 +38,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 # private-bin atool,perl
 private-cache
diff --git a/etc/cpio.profile b/etc/cpio.profile
index 0bb45f5cd..17a765700 100644
--- a/etc/cpio.profile
+++ b/etc/cpio.profile
@@ -10,8 +10,6 @@ include globals.local
 noblacklist /sbin
 noblacklist /usr/sbin
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 # include disable-devel.inc
 include disable-exec.inc
@@ -36,6 +34,7 @@ novideo
 seccomp
 shell none
 tracelog
+x11 none
 
 private-cache
 private-dev
diff --git a/etc/exiftool.profile b/etc/exiftool.profile
index 52e090b89..e76a4ca4c 100644
--- a/etc/exiftool.profile
+++ b/etc/exiftool.profile
@@ -9,8 +9,6 @@ include globals.local
 # Allow perl (blacklisted by disable-interpreters.inc)
 include allow-perl.inc
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -37,6 +35,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 # To support exiftool in private-bin on Arch Linux (and derivatives), symlink /usr/bin/vendor_perl/exiftool to /usr/bin/exiftool and uncomment the below.
 # Users on non-Arch Linux distributions can safely uncomment (or put in exiftool.local) the line below to enable extra hardening.
diff --git a/etc/gzip.profile b/etc/gzip.profile
index 810684eae..38f6ee65e 100644
--- a/etc/gzip.profile
+++ b/etc/gzip.profile
@@ -7,8 +7,6 @@ include gzip.local
 # Persistent global definitions
 include globals.local
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -36,6 +34,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 private-cache
 private-dev
diff --git a/etc/highlight.profile b/etc/highlight.profile
index cae8e29d7..249d5cd17 100644
--- a/etc/highlight.profile
+++ b/etc/highlight.profile
@@ -6,8 +6,6 @@ include highlight.local
 # Persistent global definitions
 include globals.local
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 include disable-devel.inc
 include disable-interpreters.inc
@@ -30,6 +28,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 private-bin highlight
 private-cache
diff --git a/etc/less.profile b/etc/less.profile
index 720950432..e6366ad28 100644
--- a/etc/less.profile
+++ b/etc/less.profile
@@ -9,8 +9,6 @@ include globals.local
 
 noblacklist ${HOME}/.lesshst
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -36,6 +34,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 # The user can have a custom coloring script configured in ${HOME}/.lessfilter.
 # Enable private-bin and private-lib if you are not using any filter.
diff --git a/etc/mediainfo.profile b/etc/mediainfo.profile
index d2681f32d..02d4a937c 100644
--- a/etc/mediainfo.profile
+++ b/etc/mediainfo.profile
@@ -6,8 +6,6 @@ include mediainfo.local
 # Persistent global definitions
 include globals.local
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -34,6 +32,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 private-bin mediainfo
 private-cache
diff --git a/etc/odt2txt.profile b/etc/odt2txt.profile
index 3e1739bf9..719753c87 100644
--- a/etc/odt2txt.profile
+++ b/etc/odt2txt.profile
@@ -8,8 +8,6 @@ include globals.local
 
 noblacklist ${DOCUMENTS}
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 include disable-devel.inc
 include disable-interpreters.inc
@@ -33,6 +31,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 private-bin odt2txt
 private-cache
diff --git a/etc/patch.profile b/etc/patch.profile
index 9515bffdf..60cc1adbe 100644
--- a/etc/patch.profile
+++ b/etc/patch.profile
@@ -34,6 +34,7 @@ novideo
 protocol unix
 seccomp
 shell none
+x11 none
 
 private-bin patch,red
 private-dev
diff --git a/etc/pdftotext.profile b/etc/pdftotext.profile
index 87d7a87f1..c5016201d 100644
--- a/etc/pdftotext.profile
+++ b/etc/pdftotext.profile
@@ -7,8 +7,6 @@ include globals.local
 
 noblacklist ${DOCUMENTS}
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 include disable-devel.inc
 include disable-interpreters.inc
@@ -37,6 +35,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 private-bin pdftotext
 private-dev
diff --git a/etc/shellcheck.profile b/etc/shellcheck.profile
index b8974e416..da5b4258b 100644
--- a/etc/shellcheck.profile
+++ b/etc/shellcheck.profile
@@ -35,6 +35,7 @@ novideo
 protocol unix
 seccomp
 shell none
+x11 none
 
 private-dev
 private-tmp
diff --git a/etc/strings.profile b/etc/strings.profile
index ace0d9351..621e8e177 100644
--- a/etc/strings.profile
+++ b/etc/strings.profile
@@ -6,8 +6,6 @@ include strings.local
 # Persistent global definitions
 include globals.local
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -34,6 +32,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 #private
 private-bin strings
diff --git a/etc/tar.profile b/etc/tar.profile
index 7e1fa8b92..1232bb372 100644
--- a/etc/tar.profile
+++ b/etc/tar.profile
@@ -7,8 +7,6 @@ include tar.local
 # Persistent global definitions
 include globals.local
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -36,6 +34,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 # support compressed archives
 private-bin bash,bzip2,compress,gtar,gzip,lbzip2,lzip,lzma,lzop,sh,tar,xz
diff --git a/etc/unrar.profile b/etc/unrar.profile
index a2e101a58..428173e7d 100644
--- a/etc/unrar.profile
+++ b/etc/unrar.profile
@@ -7,8 +7,6 @@ include unrar.local
 # Persistent global definitions
 include globals.local
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -35,6 +33,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 private-bin unrar
 private-dev
diff --git a/etc/unzip.profile b/etc/unzip.profile
index 875fa6f98..94aee724d 100644
--- a/etc/unzip.profile
+++ b/etc/unzip.profile
@@ -10,8 +10,6 @@ include globals.local
 # GNOME Shell integration (chrome-gnome-shell)
 noblacklist ${HOME}/.local/share/gnome-shell
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -38,6 +36,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 private-bin unzip
 private-cache
diff --git a/etc/uudeview.profile b/etc/uudeview.profile
index 53fad0ba5..af6cd620f 100644
--- a/etc/uudeview.profile
+++ b/etc/uudeview.profile
@@ -32,6 +32,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 private-bin uudeview
 private-cache
diff --git a/etc/xzdec.profile b/etc/xzdec.profile
index 3adaa557c..93c288d6e 100644
--- a/etc/xzdec.profile
+++ b/etc/xzdec.profile
@@ -7,8 +7,6 @@ include xzdec.local
 # Persistent global definitions
 include globals.local
 
-blacklist /tmp/.X11-unix
-
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -34,5 +32,6 @@ protocol unix
 seccomp
 shell none
 tracelog
+x11 none
 
 private-dev