Hardening compressors (#2594)

* Harden atool

* Harden cpio

* Fix ordering in private-* options

* Harden gzip

* Harden tar

* Harden bsdtar

* Harden+ tar

* Harden+ gzip

* Harden+ cpio

* Create bzip2.profile

* Description for bunzip2

* Add bzip2/bunzip2 to firecfg

1 files changed, 10 insertions, 0 deletions

diff --git a/etc/cpio.profile b/etc/cpio.profile
index f63e0a552..b6f7e7f9f 100644
--- a/etc/cpio.profile
+++ b/etc/cpio.profile
@@ -13,14 +13,21 @@ noblacklist /sbin
 noblacklist /usr/sbin
 
 include disable-common.inc
+# include disable-devel.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
+apparmor
 caps.drop all
+hostname cpio
+ipc-namespace
+machine-id
 net none
 no3d
 nodbus
 nodvd
+nogroups
 nonewprivs
 nosound
 notv
@@ -30,4 +37,7 @@ seccomp
 shell none
 tracelog
 
+private-cache
 private-dev
+
+memory-deny-write-execute