aboutsummaryrefslogtreecommitdiffstats
path: root/etc-fixes
diff options
context:
space:
mode:
authorLibravatar netblue30 <netblue30@yahoo.com>2018-05-13 12:23:16 -0400
committerLibravatar netblue30 <netblue30@yahoo.com>2018-05-13 12:23:16 -0400
commit92be701355d9c25e4c5fc0e80a15874fb1b69ea0 (patch)
tree45e28e86f273e50244e31278c862ee4e9c57f697 /etc-fixes
parentmoving to 0.9.54~rc3 (diff)
downloadfirejail-92be701355d9c25e4c5fc0e80a15874fb1b69ea0.tar.gz
firejail-92be701355d9c25e4c5fc0e80a15874fb1b69ea0.tar.zst
firejail-92be701355d9c25e4c5fc0e80a15874fb1b69ea0.zip
profile fixes for 0.9.52 (Ubuntu 18.04) in etc-fixes directory
Diffstat (limited to 'etc-fixes')
-rw-r--r--etc-fixes/0.9.52/firefox.profile96
-rw-r--r--etc-fixes/0.9.52/gedit.profile44
-rw-r--r--etc-fixes/0.9.52/libreoffice.profile36
3 files changed, 176 insertions, 0 deletions
diff --git a/etc-fixes/0.9.52/firefox.profile b/etc-fixes/0.9.52/firefox.profile
new file mode 100644
index 000000000..6b19b14df
--- /dev/null
+++ b/etc-fixes/0.9.52/firefox.profile
@@ -0,0 +1,96 @@
1# Firejail profile for firefox
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/firefox.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8noblacklist ${HOME}/.cache/mozilla
9noblacklist ${HOME}/.config/okularpartrc
10noblacklist ${HOME}/.config/okularrc
11noblacklist ${HOME}/.config/qpdfview
12noblacklist ${HOME}/.kde/share/apps/kget
13noblacklist ${HOME}/.kde/share/apps/okular
14noblacklist ${HOME}/.kde/share/config/kgetrc
15noblacklist ${HOME}/.kde/share/config/okularpartrc
16noblacklist ${HOME}/.kde/share/config/okularrc
17noblacklist ${HOME}/.kde4/share/apps/kget
18noblacklist ${HOME}/.kde4/share/apps/okular
19noblacklist ${HOME}/.kde4/share/config/kgetrc
20noblacklist ${HOME}/.kde4/share/config/okularpartrc
21noblacklist ${HOME}/.kde4/share/config/okularrc
22# noblacklist ${HOME}/.local/share/gnome-shell/extensions
23noblacklist ${HOME}/.local/share/okular
24noblacklist ${HOME}/.local/share/qpdfview
25noblacklist ${HOME}/.mozilla
26noblacklist ${HOME}/.pki
27
28include /etc/firejail/disable-common.inc
29include /etc/firejail/disable-devel.inc
30include /etc/firejail/disable-programs.inc
31
32mkdir ${HOME}/.cache/mozilla/firefox
33mkdir ${HOME}/.mozilla
34mkdir ${HOME}/.pki
35whitelist ${DOWNLOADS}
36whitelist ${HOME}/.cache/gnome-mplayer/plugin
37whitelist ${HOME}/.cache/mozilla/firefox
38whitelist ${HOME}/.config/gnome-mplayer
39whitelist ${HOME}/.config/okularpartrc
40whitelist ${HOME}/.config/okularrc
41whitelist ${HOME}/.config/pipelight-silverlight5.1
42whitelist ${HOME}/.config/pipelight-widevine
43whitelist ${HOME}/.config/qpdfview
44whitelist ${HOME}/.kde/share/apps/kget
45whitelist ${HOME}/.kde/share/apps/okular
46whitelist ${HOME}/.kde/share/config/kgetrc
47whitelist ${HOME}/.kde/share/config/okularpartrc
48whitelist ${HOME}/.kde/share/config/okularrc
49whitelist ${HOME}/.kde4/share/apps/kget
50whitelist ${HOME}/.kde4/share/apps/okular
51whitelist ${HOME}/.kde4/share/config/kgetrc
52whitelist ${HOME}/.kde4/share/config/okularpartrc
53whitelist ${HOME}/.kde4/share/config/okularrc
54whitelist ${HOME}/.keysnail.js
55whitelist ${HOME}/.lastpass
56whitelist ${HOME}/.local/share/gnome-shell/extensions
57whitelist ${HOME}/.local/share/okular
58whitelist ${HOME}/.local/share/qpdfview
59whitelist ${HOME}/.mozilla
60whitelist ${HOME}/.pentadactyl
61whitelist ${HOME}/.pentadactylrc
62whitelist ${HOME}/.pki
63whitelist ${HOME}/.vimperator
64whitelist ${HOME}/.vimperatorrc
65whitelist ${HOME}/.wine-pipelight
66whitelist ${HOME}/.wine-pipelight64
67whitelist ${HOME}/.zotero
68whitelist ${HOME}/dwhelper
69include /etc/firejail/whitelist-common.inc
70include /etc/firejail/whitelist-var-common.inc
71
72caps.drop all
73# machine-id breaks pulse audio; it should work fine in setups where sound is not required
74#machine-id
75netfilter
76nodvd
77nogroups
78nonewprivs
79noroot
80notv
81protocol unix,inet,inet6,netlink
82#seccomp - replaced with seccomp.drop for Firefox 60
83seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
84shell none
85#tracelog - disabled for Firefox 60
86
87disable-mnt
88# firefox requires a shell to launch on Arch.
89# private-bin firefox,which,sh,dbus-launch,dbus-send,env,bash
90private-dev
91# private-etc below works fine on most distributions. There are some problems on CentOS.
92# private-etc iceweasel,ca-certificates,ssl,machine-id,dconf,selinux,passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
93private-tmp
94
95noexec ${HOME}
96noexec /tmp
diff --git a/etc-fixes/0.9.52/gedit.profile b/etc-fixes/0.9.52/gedit.profile
new file mode 100644
index 000000000..2646233cf
--- /dev/null
+++ b/etc-fixes/0.9.52/gedit.profile
@@ -0,0 +1,44 @@
1# Firejail profile for gedit
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/gedit.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8# blacklist /run/user/*/bus - makes settings immutable
9
10noblacklist ${HOME}/.config/enchant
11noblacklist ${HOME}/.config/gedit
12noblacklist ${HOME}/.gitconfig
13
14include /etc/firejail/disable-common.inc
15# include /etc/firejail/disable-devel.inc
16include /etc/firejail/disable-passwdmgr.inc
17include /etc/firejail/disable-programs.inc
18
19include /etc/firejail/whitelist-var-common.inc
20
21caps.drop all
22# net none - makes settings immutable
23machine-id
24no3d
25nodvd
26nogroups
27nonewprivs
28noroot
29nosound
30notv
31novideo
32protocol unix
33seccomp
34shell none
35tracelog
36
37# private-bin gedit
38private-dev
39# private-etc fonts
40#private-lib gedit - disabled; problems when running "firejail gedit"; "firejail /usr/bin/gedit" works fine
41private-tmp
42
43noexec ${HOME}
44noexec /tmp
diff --git a/etc-fixes/0.9.52/libreoffice.profile b/etc-fixes/0.9.52/libreoffice.profile
new file mode 100644
index 000000000..bbc52ff5e
--- /dev/null
+++ b/etc-fixes/0.9.52/libreoffice.profile
@@ -0,0 +1,36 @@
1# Firejail profile for libreoffice
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/libreoffice.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8noblacklist ${HOME}/.java
9noblacklist /usr/local/sbin
10noblacklist ${HOME}/.config/libreoffice
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-passwdmgr.inc
15include /etc/firejail/disable-programs.inc
16
17include /etc/firejail/whitelist-var-common.inc
18
19caps.drop all
20machine-id
21netfilter
22nodvd
23nogroups
24#nonewprivs
25noroot
26notv
27#protocol unix,inet,inet6
28#seccomp
29shell none
30#tracelog
31
32private-dev
33private-tmp
34
35noexec ${HOME}
36noexec /tmp
generated by cgit v1.2.3-54-g00ecf (git 2.44.0) at 2024-05-03 11:03:03 +0000