harden kde

and whitelist kioslaverc because we don't know if kdeinit
will run outside or inside the sandbox.

1 files changed, 3 insertions, 0 deletions

diff --git a/etc/ark.profile b/etc/ark.profile
index ba9cb1134..404206992 100644
--- a/etc/ark.profile
+++ b/etc/ark.profile
@@ -5,6 +5,8 @@ include /etc/firejail/ark.local
 # Persistent global definitions
 include /etc/firejail/globals.local
 
+# blacklist /run/user/*/bus
+
 noblacklist ~/.config/arkrc
 
 include /etc/firejail/disable-common.inc
@@ -15,6 +17,7 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
 
 caps.drop all
+# net none
 netfilter
 nodvd
 nogroups