hardenings for various profiles (#3160)

* harden devilspie

* harden devilspie2

* harden curl

* harden wget

* harden curl

* harden dig

* harden claws-mail

* harden dnscrypt-proxy

* harden dnscrypt-proxy

* harden dnscrypt-proxy

* harden exfalso

* refactor easystroke as whitelist profile

* refactor enchant as whitelist profile

* safeguard ${DOCUMENTS}

Thanks @rusty-snake for the suggestion.

* drop x11-none

Thanks @rusty-snake for catching this.

* drop x11 none

Thanks @rusty-snake for saving the bacon...

* drop x11 none

Thanks @rusty-snake for catching this.

* drop x11 none

Thanks @rusty-snake for preventing breakage!

* drop ipc-namespace

Better safe than sorry...

1 files changed, 4 insertions, 1 deletions

diff --git a/etc/dig.profile b/etc/dig.profile
index af71ff17f..054e4891d 100644
--- a/etc/dig.profile
+++ b/etc/dig.profile
@@ -9,6 +9,8 @@ include globals.local
 
 noblacklist ${HOME}/.digrc
 
+blacklist /tmp/.X11-unix
+
 include disable-common.inc
 # include disable-devel.inc
 include disable-exec.inc
@@ -24,7 +26,7 @@ include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 caps.drop all
-# ipc-namespace
+ipc-namespace
 machine-id
 netfilter
 no3d
@@ -40,6 +42,7 @@ novideo
 protocol unix,inet,inet6
 seccomp
 shell none
+tracelog
 
 disable-mnt
 private