diff options
author | 2017-05-18 09:55:59 -0400 | |
---|---|---|
committer | 2017-05-18 09:55:59 -0400 | |
commit | e1e7c3a0e63ee82f84fde989e73dff14044786eb (patch) | |
tree | c83bf8dbc5b4930492d23072e6d7bc16e420d4b8 /etc/disable-common.inc | |
parent | Merge pull request #1278 from Duncaen/seccomp (diff) | |
parent | rephrase (diff) | |
download | firejail-e1e7c3a0e63ee82f84fde989e73dff14044786eb.tar.gz firejail-e1e7c3a0e63ee82f84fde989e73dff14044786eb.tar.zst firejail-e1e7c3a0e63ee82f84fde989e73dff14044786eb.zip |
Merge pull request #1270 from SYN-cook/patch-1
completing noexec
Diffstat (limited to 'etc/disable-common.inc')
-rw-r--r-- | etc/disable-common.inc | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/etc/disable-common.inc b/etc/disable-common.inc index 1c1b298a9..7a5e8bf5b 100644 --- a/etc/disable-common.inc +++ b/etc/disable-common.inc | |||
@@ -181,19 +181,14 @@ read-only ${HOME}/.gem | |||
181 | read-only ${HOME}/.luarocks | 181 | read-only ${HOME}/.luarocks |
182 | read-only ${HOME}/.npm-packages | 182 | read-only ${HOME}/.npm-packages |
183 | 183 | ||
184 | ########################### | ||
185 | # The following block breaks trash functionality in file managers | 184 | # The following block breaks trash functionality in file managers |
186 | ########################## | ||
187 | # Make the contents of ~/.local read-only, | ||
188 | # except the commonly-used ~/.local/share, | ||
189 | # but including ~/.local/share/applications | ||
190 | #read-only ${HOME}/.local | 185 | #read-only ${HOME}/.local |
191 | #read-write ${HOME}/.local/share | 186 | #read-write ${HOME}/.local/share |
192 | #noexec ${HOME}/.local/share | 187 | #noexec ${HOME}/.local/share |
193 | read-only ${HOME}/.local/share/applications | 188 | blacklist ${HOME}/.local/share/Trash |
194 | blacklist ${HOME}/.local/share/Trash | ||
195 | |||
196 | 189 | ||
190 | # Write-protection for desktop entries | ||
191 | read-only ${HOME}/.local/share/applications | ||
197 | 192 | ||
198 | # top secret | 193 | # top secret |
199 | blacklist ${HOME}/.ecryptfs | 194 | blacklist ${HOME}/.ecryptfs |
@@ -296,3 +291,7 @@ blacklist ${PATH}/urxvtcd | |||
296 | # kernel files | 291 | # kernel files |
297 | blacklist /vmlinuz* | 292 | blacklist /vmlinuz* |
298 | blacklist /initrd* | 293 | blacklist /initrd* |
294 | |||
295 | # complement noexec ${HOME} and noexec /tmp | ||
296 | noexec ${HOME}/.config/pulse | ||
297 | noexec /tmp/.X11-unix | ||