Add gconf + redirect profiles (#2528)

* Create gconf.profile * Update gconf-editor.profile * Create gconf-merge-schema.profile * Create gconf-merge-tree.profile * Create gconfpkg.profile * Create gconftool-2.profile * Create gsettings-data-convert.profile * Create gsettings-schema-convert.profile * Allow python2 in gconf.profile
author: glitsj16 <glitsj16@users.noreply.github.com> 2019-03-06 06:06:14 +0000
committer: GitHub <noreply@github.com> 2019-03-06 06:06:14 +0000
commit: d745b31d4e738a9f9c137bad7807a4b81505e65c (patch)
tree: f94a26e6f58eec6f71e6aadd73fbc87f9b27e47c
parent: Fix #2518 -- noexec HOME breaks discord (blank screen only) (diff)
download: firejail-d745b31d4e738a9f9c137bad7807a4b81505e65c.tar.gz
firejail-d745b31d4e738a9f9c137bad7807a4b81505e65c.tar.zst
firejail-d745b31d4e738a9f9c137bad7807a4b81505e65c.zip
8 files changed, 133 insertions, 41 deletions
diff --git a/etc/gconf-editor.profile b/etc/gconf-editor.profile
index 20cc5c36f..e9756f8af 100644
--- a/etc/gconf-editor.profile
+++ b/etc/gconf-editor.profile
@@ -4,46 +4,9 @@
 # Persistent local customizations
 include gconf-editor.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
-noblacklist ${HOME}/.config/gconf
-include disable-common.inc
+# Redirect
-include disable-devel.inc
+include gconf.profile
-include disable-interpreters.inc
-include disable-passwdmgr.inc
-include disable-programs.inc
-include disable-xdg.inc
-whitelist ${HOME}/.config/gconf
-include whitelist-common.inc
-apparmor
-caps.drop all
-machine-id
-net none
-no3d
-nodvd
-nogroups
-nonewprivs
-noroot
-nosound
-notv
-nou2f
-novideo
-protocol unix
-seccomp
-shell none
-tracelog
-disable-mnt
-private-bin gconf-editor
-private-cache
-private-dev
-private-etc alternatives,fonts
-private-lib
-private-tmp
-memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gconf-merge-schema.profile b/etc/gconf-merge-schema.profile
new file mode 100644
index 000000000..411b7b815
--- /dev/null
+++ b/etc/gconf-merge-schema.profile
@@ -0,0 +1,12 @@
+# Firejail profile for gconf-merge-schema
+# Description: An obsolete configuration database system (CLI utility)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gconf-merge-schema.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+# Redirect
+include gconf.profile
diff --git a/etc/gconf-merge-tree.profile b/etc/gconf-merge-tree.profile
new file mode 100644
index 000000000..66a4226ca
--- /dev/null
+++ b/etc/gconf-merge-tree.profile
@@ -0,0 +1,12 @@
+# Firejail profile for gconf-merge-tree
+# Description: An obsolete configuration database system (CLI utility)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gconf-merge-tree.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+# Redirect
+include gconf.profile
diff --git a/etc/gconf.profile b/etc/gconf.profile
new file mode 100644
index 000000000..94af21833
--- /dev/null
+++ b/etc/gconf.profile
@@ -0,0 +1,57 @@
+# Firejail profile for gconf
+# Description: An obsolete configuration database system
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gconf.local
+# Persistent global definitions
+include globals.local
+noblacklist ${HOME}/.config/gconf
+# Allow python2 (blacklisted by disable-interpreters.inc)
+noblacklist ${PATH}/python2*
+#noblacklist ${PATH}/python3*
+noblacklist /usr/lib/python2*
+#noblacklist /usr/lib/python3*
+include disable-common.inc
+include disable-devel.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include disable-xdg.inc
+mkdir ${HOME}/.config/gconf
+whitelist ${HOME}/.config/gconf
+include whitelist-common.inc
+apparmor
+caps.drop all
+ipc-namespace
+machine-id
+net none
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+nou2f
+novideo
+protocol unix
+seccomp
+shell none
+tracelog
+disable-mnt
+private-bin gconf-editor,gconf-merge-*,gconfpkg,gconftool-2,gsettings-*-convert,python2*
+private-cache
+private-dev
+private-etc alternatives,fonts,gconf
+private-lib libpython*,python2*
+private-tmp
+memory-deny-write-execute
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/gconfpkg.profile b/etc/gconfpkg.profile
new file mode 100644
index 000000000..1793ce072
--- /dev/null
+++ b/etc/gconfpkg.profile
@@ -0,0 +1,12 @@
+# Firejail profile for gconfpkg
+# Description: An obsolete configuration database system (CLI utility)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gconfpkg.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+# Redirect
+include gconf.profile
diff --git a/etc/gconftool-2.profile b/etc/gconftool-2.profile
new file mode 100644
index 000000000..59a2242a7
--- /dev/null
+++ b/etc/gconftool-2.profile
@@ -0,0 +1,12 @@
+# Firejail profile for gconftool-2
+# Description: An obsolete configuration database system (CLI utility)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gconftool-2.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+# Redirect
+include gconf.profile
diff --git a/etc/gsettings-data-convert.profile b/etc/gsettings-data-convert.profile
new file mode 100644
index 000000000..21a232440
--- /dev/null
+++ b/etc/gsettings-data-convert.profile
@@ -0,0 +1,12 @@
+# Firejail profile for gsettings-data-convert
+# Description: An obsolete configuration database system (CLI utility)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gsettings-data-convert.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+# Redirect
+include gconf.profile
diff --git a/etc/gsettings-schema-convert.profile b/etc/gsettings-schema-convert.profile
new file mode 100644
index 000000000..2dbf4fb44
--- /dev/null
+++ b/etc/gsettings-schema-convert.profile
@@ -0,0 +1,12 @@
+# Firejail profile for gsettings-schema-convert
+# Description: An obsolete configuration database system (CLI utility)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gsettings-schema-convert.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+# Redirect
+include gconf.profile
author	glitsj16 <glitsj16@users.noreply.github.com>	2019-03-06 06:06:14 +0000
committer	GitHub <noreply@github.com>	2019-03-06 06:06:14 +0000
commit	d745b31d4e738a9f9c137bad7807a4b81505e65c (patch)
tree	f94a26e6f58eec6f71e6aadd73fbc87f9b27e47c
parent	Fix #2518 -- noexec HOME breaks discord (blank screen only) (diff)
download	firejail-d745b31d4e738a9f9c137bad7807a4b81505e65c.tar.gz firejail-d745b31d4e738a9f9c137bad7807a4b81505e65c.tar.zst firejail-d745b31d4e738a9f9c137bad7807a4b81505e65c.zip

diff --git a/etc/gconf-editor.profile b/etc/gconf-editor.profile index 20cc5c36f..e9756f8af 100644 --- a/etc/gconf-editor.profile +++ b/etc/gconf-editor.profile
@@ -4,46 +4,9 @@
4	# Persistent local customizations	4	# Persistent local customizations
5	include gconf-editor.local	5	include gconf-editor.local
6	# Persistent global definitions	6	# Persistent global definitions
7	include globals.local	7	# added by included profile
		8	#include globals.local
8		9
9	noblacklist ${HOME}/.config/gconf
10		10
11	include disable-common.inc	11	# Redirect
12	include disable-devel.inc	12	include gconf.profile
13	include disable-interpreters.inc
14	include disable-passwdmgr.inc
15	include disable-programs.inc
16	include disable-xdg.inc
17
18	whitelist ${HOME}/.config/gconf
19	include whitelist-common.inc
20
21	apparmor
22	caps.drop all
23	machine-id
24	net none
25	no3d
26	nodvd
27	nogroups
28	nonewprivs
29	noroot
30	nosound
31	notv
32	nou2f
33	novideo
34	protocol unix
35	seccomp
36	shell none
37	tracelog
38
39	disable-mnt
40	private-bin gconf-editor
41	private-cache
42	private-dev
43	private-etc alternatives,fonts
44	private-lib
45	private-tmp
46
47	memory-deny-write-execute
48	noexec ${HOME}
49	noexec /tmp


diff --git a/etc/gconf-merge-schema.profile b/etc/gconf-merge-schema.profile new file mode 100644 index 000000000..411b7b815 --- /dev/null +++ b/etc/gconf-merge-schema.profile
@@ -0,0 +1,12 @@
		1	# Firejail profile for gconf-merge-schema
		2	# Description: An obsolete configuration database system (CLI utility)
		3	# This file is overwritten after every install/update
		4	# Persistent local customizations
		5	include gconf-merge-schema.local
		6	# Persistent global definitions
		7	# added by included profile
		8	#include globals.local
		9
		10
		11	# Redirect
		12	include gconf.profile


diff --git a/etc/gconf-merge-tree.profile b/etc/gconf-merge-tree.profile new file mode 100644 index 000000000..66a4226ca --- /dev/null +++ b/etc/gconf-merge-tree.profile
@@ -0,0 +1,12 @@
		1	# Firejail profile for gconf-merge-tree
		2	# Description: An obsolete configuration database system (CLI utility)
		3	# This file is overwritten after every install/update
		4	# Persistent local customizations
		5	include gconf-merge-tree.local
		6	# Persistent global definitions
		7	# added by included profile
		8	#include globals.local
		9
		10
		11	# Redirect
		12	include gconf.profile


diff --git a/etc/gconf.profile b/etc/gconf.profile new file mode 100644 index 000000000..94af21833 --- /dev/null +++ b/etc/gconf.profile
@@ -0,0 +1,57 @@
		1	# Firejail profile for gconf
		2	# Description: An obsolete configuration database system
		3	# This file is overwritten after every install/update
		4	# Persistent local customizations
		5	include gconf.local
		6	# Persistent global definitions
		7	include globals.local
		8
		9	noblacklist ${HOME}/.config/gconf
		10
		11	# Allow python2 (blacklisted by disable-interpreters.inc)
		12	noblacklist ${PATH}/python2*
		13	#noblacklist ${PATH}/python3*
		14	noblacklist /usr/lib/python2*
		15	#noblacklist /usr/lib/python3*
		16
		17	include disable-common.inc
		18	include disable-devel.inc
		19	include disable-interpreters.inc
		20	include disable-passwdmgr.inc
		21	include disable-programs.inc
		22	include disable-xdg.inc
		23
		24	mkdir ${HOME}/.config/gconf
		25	whitelist ${HOME}/.config/gconf
		26	include whitelist-common.inc
		27
		28	apparmor
		29	caps.drop all
		30	ipc-namespace
		31	machine-id
		32	net none
		33	no3d
		34	nodvd
		35	nogroups
		36	nonewprivs
		37	noroot
		38	nosound
		39	notv
		40	nou2f
		41	novideo
		42	protocol unix
		43	seccomp
		44	shell none
		45	tracelog
		46
		47	disable-mnt
		48	private-bin gconf-editor,gconf-merge-,gconfpkg,gconftool-2,gsettings--convert,python2*
		49	private-cache
		50	private-dev
		51	private-etc alternatives,fonts,gconf
		52	private-lib libpython,python2
		53	private-tmp
		54
		55	memory-deny-write-execute
		56	noexec ${HOME}
		57	noexec /tmp


diff --git a/etc/gconfpkg.profile b/etc/gconfpkg.profile new file mode 100644 index 000000000..1793ce072 --- /dev/null +++ b/etc/gconfpkg.profile
@@ -0,0 +1,12 @@
		1	# Firejail profile for gconfpkg
		2	# Description: An obsolete configuration database system (CLI utility)
		3	# This file is overwritten after every install/update
		4	# Persistent local customizations
		5	include gconfpkg.local
		6	# Persistent global definitions
		7	# added by included profile
		8	#include globals.local
		9
		10
		11	# Redirect
		12	include gconf.profile


diff --git a/etc/gconftool-2.profile b/etc/gconftool-2.profile new file mode 100644 index 000000000..59a2242a7 --- /dev/null +++ b/etc/gconftool-2.profile
@@ -0,0 +1,12 @@
		1	# Firejail profile for gconftool-2
		2	# Description: An obsolete configuration database system (CLI utility)
		3	# This file is overwritten after every install/update
		4	# Persistent local customizations
		5	include gconftool-2.local
		6	# Persistent global definitions
		7	# added by included profile
		8	#include globals.local
		9
		10
		11	# Redirect
		12	include gconf.profile


diff --git a/etc/gsettings-data-convert.profile b/etc/gsettings-data-convert.profile new file mode 100644 index 000000000..21a232440 --- /dev/null +++ b/etc/gsettings-data-convert.profile
@@ -0,0 +1,12 @@
		1	# Firejail profile for gsettings-data-convert
		2	# Description: An obsolete configuration database system (CLI utility)
		3	# This file is overwritten after every install/update
		4	# Persistent local customizations
		5	include gsettings-data-convert.local
		6	# Persistent global definitions
		7	# added by included profile
		8	#include globals.local
		9
		10
		11	# Redirect
		12	include gconf.profile


diff --git a/etc/gsettings-schema-convert.profile b/etc/gsettings-schema-convert.profile new file mode 100644 index 000000000..2dbf4fb44 --- /dev/null +++ b/etc/gsettings-schema-convert.profile
@@ -0,0 +1,12 @@
		1	# Firejail profile for gsettings-schema-convert
		2	# Description: An obsolete configuration database system (CLI utility)
		3	# This file is overwritten after every install/update
		4	# Persistent local customizations
		5	include gsettings-schema-convert.local
		6	# Persistent global definitions
		7	# added by included profile
		8	#include globals.local
		9
		10
		11	# Redirect
		12	include gconf.profile