Unify all profiles

1 files changed, 31 insertions, 35 deletions

diff --git a/etc/icecat.profile b/etc/icecat.profile
index 600263a2a..b8b267dff 100644
--- a/etc/icecat.profile
+++ b/etc/icecat.profile
@@ -1,53 +1,49 @@
-# Persistent global definitions go here
-include /etc/firejail/globals.local
-
-# This file is overwritten during software install.
-# Persistent customizations should go in a .local file.
+# Firejail profile for icecat
+# This file is overwritten after every install/update
+# Persistent local customizations
 include /etc/firejail/icecat.local
+# Persistent global definitions
+include /etc/firejail/globals.local
 
-# Firejail profile for GNU Icecat
-noblacklist ~/.mozilla
 noblacklist ~/.cache/mozilla
+noblacklist ~/.mozilla
 noblacklist ~/.pki
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-programs.inc
 
-caps.drop all
-netfilter
-nonewprivs
-noroot
-protocol unix,inet,inet6,netlink
-seccomp
-tracelog
-
-whitelist ${DOWNLOADS}
-mkdir ~/.mozilla
-whitelist ~/.mozilla
 mkdir ~/.cache/mozilla/icecat
+mkdir ~/.mozilla
+whitelist ${DOWNLOADS}
+whitelist ~/.cache/gnome-mplayer/plugin
 whitelist ~/.cache/mozilla/icecat
-whitelist ~/dwhelper
-whitelist ~/.zotero
-whitelist ~/.vimperatorrc
-whitelist ~/.vimperator
-whitelist ~/.pentadactylrc
-whitelist ~/.pentadactyl
-whitelist ~/.keysnail.js
 whitelist ~/.config/gnome-mplayer
-whitelist ~/.cache/gnome-mplayer/plugin
-whitelist ~/.pki
+whitelist ~/.config/pipelight-silverlight5.1
+whitelist ~/.config/pipelight-widevine
+whitelist ~/.keysnail.js
 whitelist ~/.lastpass
-
-# silverlight
+whitelist ~/.mozilla
+whitelist ~/.pentadactyl
+whitelist ~/.pentadactylrc
+whitelist ~/.pki
+whitelist ~/.vimperator
+whitelist ~/.vimperatorrc
 whitelist ~/.wine-pipelight
 whitelist ~/.wine-pipelight64
-whitelist ~/.config/pipelight-widevine
-whitelist ~/.config/pipelight-silverlight5.1
-
+whitelist ~/.zotero
+whitelist ~/dwhelper
 include /etc/firejail/whitelist-common.inc
 
-# experimental features
-#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse
+caps.drop all
+netfilter
+nonewprivs
+noroot
+protocol unix,inet,inet6,netlink
+seccomp
+tracelog
+
+# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse
 
 noexec ${HOME}
 noexec /tmp