aboutsummaryrefslogtreecommitdiffstats
path: root/etc/inc
diff options
context:
space:
mode:
authorLibravatar netblue30 <netblue30@yahoo.com>2020-04-21 08:24:28 -0400
committerLibravatar netblue30 <netblue30@yahoo.com>2020-04-21 08:24:28 -0400
commit018d75775eab4a0f045949a9d069c57686ca2686 (patch)
treeaac3a1a65cca0d4875795c55109a5c3e35efdefb /etc/inc
parentsmall fixes (diff)
downloadfirejail-018d75775eab4a0f045949a9d069c57686ca2686.tar.gz
firejail-018d75775eab4a0f045949a9d069c57686ca2686.tar.zst
firejail-018d75775eab4a0f045949a9d069c57686ca2686.zip
reorganize github etc directory
Diffstat (limited to 'etc/inc')
-rw-r--r--etc/inc/allow-common-devel.inc21
-rw-r--r--etc/inc/allow-gjs.inc11
-rw-r--r--etc/inc/allow-java.inc9
-rw-r--r--etc/inc/allow-lua.inc10
-rw-r--r--etc/inc/allow-perl.inc11
-rw-r--r--etc/inc/allow-php.inc7
-rw-r--r--etc/inc/allow-python2.inc9
-rw-r--r--etc/inc/allow-python3.inc10
-rw-r--r--etc/inc/allow-ruby.inc6
-rw-r--r--etc/inc/disable-common.inc497
-rw-r--r--etc/inc/disable-devel.inc68
-rw-r--r--etc/inc/disable-exec.inc11
-rw-r--r--etc/inc/disable-interpreters.inc64
-rw-r--r--etc/inc/disable-passwdmgr.inc18
-rw-r--r--etc/inc/disable-programs.inc877
-rw-r--r--etc/inc/disable-xdg.inc12
-rw-r--r--etc/inc/feh-network.inc4
-rw-r--r--etc/inc/firefox-common-addons.inc69
-rw-r--r--etc/inc/softmaker-common.inc50
-rw-r--r--etc/inc/whitelist-common.inc76
-rw-r--r--etc/inc/whitelist-runuser-common.inc11
-rw-r--r--etc/inc/whitelist-usr-share-common.inc61
-rw-r--r--etc/inc/whitelist-var-common.inc11
23 files changed, 1923 insertions, 0 deletions
diff --git a/etc/inc/allow-common-devel.inc b/etc/inc/allow-common-devel.inc
new file mode 100644
index 000000000..63174eda6
--- /dev/null
+++ b/etc/inc/allow-common-devel.inc
@@ -0,0 +1,21 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include allow-common-devel.local
4
5# Git
6noblacklist ${HOME}/.config/git
7noblacklist ${HOME}/.gitconfig
8noblacklist ${HOME}/.git-credentials
9
10# Java
11noblacklist ${HOME}/.gradle
12noblacklist ${HOME}/.java
13
14# Python
15noblacklist ${HOME}/.python-history
16noblacklist ${HOME}/.python_history
17noblacklist ${HOME}/.pythonhist
18
19# Rust
20noblacklist ${HOME}/.cargo/config
21noblacklist ${HOME}/.cargo/registry
diff --git a/etc/inc/allow-gjs.inc b/etc/inc/allow-gjs.inc
new file mode 100644
index 000000000..f4f9926cd
--- /dev/null
+++ b/etc/inc/allow-gjs.inc
@@ -0,0 +1,11 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include allow-gjs.local
4
5noblacklist ${PATH}/gjs
6noblacklist ${PATH}/gjs-console
7noblacklist /usr/lib/gjs
8noblacklist /usr/lib64/gjs
9noblacklist /usr/lib/libgjs*
10noblacklist /usr/lib64/libgjs*
11noblacklist /usr/lib64/libmozjs-*
diff --git a/etc/inc/allow-java.inc b/etc/inc/allow-java.inc
new file mode 100644
index 000000000..24d18fb77
--- /dev/null
+++ b/etc/inc/allow-java.inc
@@ -0,0 +1,9 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include allow-java.local
4
5noblacklist ${HOME}/.java
6noblacklist ${PATH}/java
7noblacklist /etc/java
8noblacklist /usr/lib/java
9noblacklist /usr/share/java
diff --git a/etc/inc/allow-lua.inc b/etc/inc/allow-lua.inc
new file mode 100644
index 000000000..9df8e8d32
--- /dev/null
+++ b/etc/inc/allow-lua.inc
@@ -0,0 +1,10 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include allow-lua.local
4
5noblacklist ${PATH}/lua*
6noblacklist /usr/include
7noblacklist /usr/lib/liblua*
8noblacklist /usr/lib/lua
9noblacklist /usr/share/lua
10noblacklist /usr/share/lua*
diff --git a/etc/inc/allow-perl.inc b/etc/inc/allow-perl.inc
new file mode 100644
index 000000000..f44e1e3cc
--- /dev/null
+++ b/etc/inc/allow-perl.inc
@@ -0,0 +1,11 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include allow-perl.local
4
5noblacklist ${PATH}/core_perl
6noblacklist ${PATH}/cpan*
7noblacklist ${PATH}/perl
8noblacklist ${PATH}/site_perl
9noblacklist ${PATH}/vendor_perl
10noblacklist /usr/lib/perl*
11noblacklist /usr/share/perl*
diff --git a/etc/inc/allow-php.inc b/etc/inc/allow-php.inc
new file mode 100644
index 000000000..a0950dc26
--- /dev/null
+++ b/etc/inc/allow-php.inc
@@ -0,0 +1,7 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include allow-php.local
4
5noblacklist ${PATH}/php*
6noblacklist /usr/lib/php*
7noblacklist /usr/share/php*
diff --git a/etc/inc/allow-python2.inc b/etc/inc/allow-python2.inc
new file mode 100644
index 000000000..b0525e2e1
--- /dev/null
+++ b/etc/inc/allow-python2.inc
@@ -0,0 +1,9 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include allow-python2.local
4
5noblacklist ${PATH}/python2*
6noblacklist /usr/include/python2*
7noblacklist /usr/lib/python2*
8noblacklist /usr/local/lib/python2*
9noblacklist /usr/share/python2*
diff --git a/etc/inc/allow-python3.inc b/etc/inc/allow-python3.inc
new file mode 100644
index 000000000..d968886b0
--- /dev/null
+++ b/etc/inc/allow-python3.inc
@@ -0,0 +1,10 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include allow-python3.local
4
5noblacklist ${PATH}/python3*
6noblacklist /usr/include/python3*
7noblacklist /usr/lib/python3*
8noblacklist /usr/lib64/python3*
9noblacklist /usr/local/lib/python3*
10noblacklist /usr/share/python3*
diff --git a/etc/inc/allow-ruby.inc b/etc/inc/allow-ruby.inc
new file mode 100644
index 000000000..a8c701219
--- /dev/null
+++ b/etc/inc/allow-ruby.inc
@@ -0,0 +1,6 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include allow-ruby.local
4
5noblacklist ${PATH}/ruby
6noblacklist /usr/lib/ruby
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc
new file mode 100644
index 000000000..92c6cd2a8
--- /dev/null
+++ b/etc/inc/disable-common.inc
@@ -0,0 +1,497 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include disable-common.local
4
5# The following block breaks trash functionality in file managers
6#read-only ${HOME}/.local
7#read-write ${HOME}/.local/share
8blacklist ${HOME}/.local/share/Trash
9
10# History files in $HOME and clipboard managers
11blacklist-nolog ${HOME}/.*_history
12blacklist-nolog ${HOME}/.adobe
13blacklist-nolog ${HOME}/.cache/greenclip*
14blacklist-nolog ${HOME}/.histfile
15blacklist-nolog ${HOME}/.history
16blacklist-nolog ${HOME}/.kde/share/apps/klipper
17blacklist-nolog ${HOME}/.kde4/share/apps/klipper
18blacklist-nolog ${HOME}/.local/share/fish/fish_history
19blacklist-nolog ${HOME}/.local/share/klipper
20blacklist-nolog ${HOME}/.macromedia
21blacklist-nolog ${HOME}/.mupdf.history
22blacklist-nolog ${HOME}/.python-history
23blacklist-nolog ${HOME}/.python_history
24blacklist-nolog ${HOME}/.pythonhist
25blacklist-nolog ${HOME}/.lesshst
26blacklist-nolog ${HOME}/.viminfo
27blacklist-nolog /tmp/clipmenu*
28
29# X11 session autostart
30# blacklist ${HOME}/.xpra - this will kill --x11=xpra cmdline option for all programs
31blacklist ${HOME}/.Xsession
32blacklist ${HOME}/.blackbox
33blacklist ${HOME}/.config/autostart
34blacklist ${HOME}/.config/autostart-scripts
35blacklist ${HOME}/.config/awesome
36blacklist ${HOME}/.config/i3
37blacklist ${HOME}/.config/lxsession/LXDE/autostart
38blacklist ${HOME}/.config/openbox
39blacklist ${HOME}/.config/plasma-workspace
40blacklist ${HOME}/.config/startupconfig
41blacklist ${HOME}/.config/startupconfigkeys
42blacklist ${HOME}/.fluxbox
43blacklist ${HOME}/.gnomerc
44blacklist ${HOME}/.kde/Autostart
45blacklist ${HOME}/.kde/env
46blacklist ${HOME}/.kde/share/autostart
47blacklist ${HOME}/.kde/share/config/startupconfig
48blacklist ${HOME}/.kde/share/config/startupconfigkeys
49blacklist ${HOME}/.kde/shutdown
50blacklist ${HOME}/.kde4/env
51blacklist ${HOME}/.kde4/Autostart
52blacklist ${HOME}/.kde4/share/autostart
53blacklist ${HOME}/.kde4/shutdown
54blacklist ${HOME}/.kde4/share/config/startupconfig
55blacklist ${HOME}/.kde4/share/config/startupconfigkeys
56blacklist ${HOME}/.local/share/autostart
57blacklist ${HOME}/.xinitrc
58blacklist ${HOME}/.xprofile
59blacklist ${HOME}/.xserverrc
60blacklist ${HOME}/.xsession
61blacklist ${HOME}/.xsessionrc
62blacklist /etc/X11/Xsession.d
63blacklist /etc/xdg/autostart
64read-only ${HOME}/.Xauthority
65
66# Session manager
67?HAS_X11: blacklist ${HOME}/.ICEauthority
68?HAS_X11: blacklist /tmp/.ICE-unix
69
70# KDE config
71blacklist ${HOME}/.config/khotkeysrc
72blacklist ${HOME}/.config/krunnerrc
73blacklist ${HOME}/.config/kscreenlockerrc
74blacklist ${HOME}/.config/ksslcertificatemanager
75blacklist ${HOME}/.config/kwalletrc
76blacklist ${HOME}/.config/kwinrc
77blacklist ${HOME}/.config/kwinrulesrc
78blacklist ${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc
79blacklist ${HOME}/.config/plasmashellrc
80blacklist ${HOME}/.config/plasmavaultrc
81blacklist ${HOME}/.kde/share/apps/kwin
82blacklist ${HOME}/.kde/share/apps/plasma
83blacklist ${HOME}/.kde/share/apps/solid
84blacklist ${HOME}/.kde/share/config/khotkeysrc
85blacklist ${HOME}/.kde/share/config/krunnerrc
86blacklist ${HOME}/.kde/share/config/kscreensaverrc
87blacklist ${HOME}/.kde/share/config/ksslcertificatemanager
88blacklist ${HOME}/.kde/share/config/kwalletrc
89blacklist ${HOME}/.kde/share/config/kwinrc
90blacklist ${HOME}/.kde/share/config/kwinrulesrc
91blacklist ${HOME}/.kde/share/config/plasma-desktop-appletsrc
92blacklist ${HOME}/.kde4/share/apps/kwin
93blacklist ${HOME}/.kde4/share/apps/plasma
94blacklist ${HOME}/.kde4/share/apps/solid
95blacklist ${HOME}/.kde4/share/config/khotkeysrc
96blacklist ${HOME}/.kde4/share/config/krunnerrc
97blacklist ${HOME}/.kde4/share/config/kscreensaverrc
98blacklist ${HOME}/.kde4/share/config/ksslcertificatemanager
99blacklist ${HOME}/.kde4/share/config/kwalletrc
100blacklist ${HOME}/.kde4/share/config/kwinrc
101blacklist ${HOME}/.kde4/share/config/kwinrulesrc
102blacklist ${HOME}/.kde4/share/config/plasma-desktop-appletsrc
103blacklist ${HOME}/.local/share/kglobalaccel
104blacklist ${HOME}/.local/share/kwin
105blacklist ${HOME}/.local/share/plasma
106blacklist ${HOME}/.local/share/plasmashell
107blacklist ${HOME}/.local/share/solid
108read-only ${HOME}/.cache/ksycoca5_*
109read-only ${HOME}/.config/*notifyrc
110read-only ${HOME}/.config/kdeglobals
111read-only ${HOME}/.config/kio_httprc
112read-only ${HOME}/.config/kiorc
113read-only ${HOME}/.config/kioslaverc
114read-only ${HOME}/.config/ksslcablacklist
115read-only ${HOME}/.kde/share/apps/konsole
116read-only ${HOME}/.kde/share/apps/kssl
117read-only ${HOME}/.kde/share/config/*notifyrc
118read-only ${HOME}/.kde/share/config/kdeglobals
119read-only ${HOME}/.kde/share/config/kio_httprc
120read-only ${HOME}/.kde/share/config/kioslaverc
121read-only ${HOME}/.kde/share/config/ksslcablacklist
122read-only ${HOME}/.kde/share/kde4/services
123read-only ${HOME}/.kde4/share/apps/konsole
124read-only ${HOME}/.kde4/share/apps/kssl
125read-only ${HOME}/.kde4/share/config/*notifyrc
126read-only ${HOME}/.kde4/share/config/kdeglobals
127read-only ${HOME}/.kde4/share/config/kio_httprc
128read-only ${HOME}/.kde4/share/config/kioslaverc
129read-only ${HOME}/.kde4/share/config/ksslcablacklist
130read-only ${HOME}/.kde4/share/kde4/services
131read-only ${HOME}/.local/share/konsole
132read-only ${HOME}/.local/share/kservices5
133read-only ${HOME}/.local/share/kssl
134
135# KDE sockets
136blacklist ${RUNUSER}/*.slave-socket
137blacklist ${RUNUSER}/kdeinit5__*
138blacklist ${RUNUSER}/kdesud_*
139?HAS_NODBUS: blacklist ${RUNUSER}/ksocket-*
140?HAS_NODBUS: blacklist /tmp/ksocket-*
141
142# gnome
143# contains extensions, last used times of applications, and notifications
144blacklist ${HOME}/.local/share/gnome-shell
145# no direct modification of dconf database
146read-only ${HOME}/.config/dconf
147
148# systemd
149blacklist ${HOME}/.config/systemd
150blacklist ${HOME}/.local/share/systemd
151blacklist /var/lib/systemd
152# blacklist /var/run/systemd
153# creates problems on Arch where /etc/resolv.conf is a symlink to /var/run/systemd/resolve/resolv.conf
154
155# openrc
156blacklist /etc/runlevels/
157blacklist /etc/init.d/
158blacklist /etc/rc.conf
159
160# VirtualBox
161blacklist ${HOME}/.VirtualBox
162blacklist ${HOME}/.config/VirtualBox
163blacklist ${HOME}/VirtualBox VMs
164
165# GNOME Boxes
166blacklist ${HOME}/.config/gnome-boxes
167blacklist ${HOME}/.local/share/gnome-boxes
168
169# libvirt
170blacklist ${HOME}/.cache/libvirt
171blacklist ${HOME}/.config/libvirt
172blacklist ${RUNUSER}/libvirt
173blacklist /var/cache/libvirt
174blacklist /var/lib/libvirt
175blacklist /var/log/libvirt
176
177# VeraCrypt
178blacklist ${HOME}/.VeraCrypt
179blacklist ${PATH}/veracrypt
180blacklist ${PATH}/veracrypt-uninstall.sh
181blacklist /usr/share/applications/veracrypt.*
182blacklist /usr/share/pixmaps/veracrypt.*
183blacklist /usr/share/veracrypt
184
185# TrueCrypt
186blacklist ${HOME}/.TrueCrypt
187blacklist ${PATH}/truecrypt
188blacklist ${PATH}/truecrypt-uninstall.sh
189blacklist /usr/share/applications/truecrypt.*
190blacklist /usr/share/pixmaps/truecrypt.*
191blacklist /usr/share/truecrypt
192
193# zuluCrypt
194blacklist ${HOME}/.zuluCrypt
195blacklist ${HOME}/.zuluCrypt-socket
196blacklist ${PATH}/zuluCrypt-cli
197blacklist ${PATH}/zuluMount-cli
198
199# var
200blacklist /var/cache/apt
201blacklist /var/cache/pacman
202blacklist /var/lib/apt
203blacklist /var/lib/clamav
204blacklist /var/lib/dkms
205blacklist /var/lib/mysql/mysql.sock
206blacklist /var/lib/mysqld/mysql.sock
207blacklist /var/lib/pacman
208blacklist /var/lib/upower
209# blacklist /var/log - a virtual /var/log directory (mostly empty) is build up by default for
210# every sandbox, unless --writable-var-log switch is activated
211blacklist /var/mail
212blacklist /var/opt
213blacklist /var/run/acpid.socket
214blacklist /var/run/docker.sock
215blacklist /var/run/minissdpd.sock
216blacklist /var/run/mysql/mysqld.sock
217blacklist /var/run/mysqld/mysqld.sock
218blacklist /var/run/rpcbind.sock
219blacklist /var/run/screens
220blacklist /var/spool/anacron
221blacklist /var/spool/cron
222blacklist /var/spool/mail
223
224# etc
225blacklist /etc/anacrontab
226blacklist /etc/cron*
227blacklist /etc/profile.d
228blacklist /etc/rc.local
229# rc1.d, rc2.d, ...
230blacklist /etc/rc?.d
231blacklist /etc/kernel*
232blacklist /etc/grub*
233blacklist /etc/dkms
234blacklist /etc/apparmor*
235blacklist /etc/selinux
236blacklist /etc/modules*
237blacklist /etc/logrotate*
238blacklist /etc/adduser.conf
239
240# Startup files
241read-only ${HOME}/.antigen
242read-only ${HOME}/.bash_aliases
243read-only ${HOME}/.bash_login
244read-only ${HOME}/.bash_logout
245read-only ${HOME}/.bash_profile
246read-only ${HOME}/.bashrc
247read-only ${HOME}/.config/environment.d
248read-only ${HOME}/.config/fish
249read-only ${HOME}/.csh_files
250read-only ${HOME}/.cshrc
251read-only ${HOME}/.forward
252read-only ${HOME}/.local/share/fish
253read-only ${HOME}/.login
254read-only ${HOME}/.logout
255read-only ${HOME}/.oh-my-zsh
256read-only ${HOME}/.pam_environment
257read-only ${HOME}/.pgpkey
258read-only ${HOME}/.plan
259read-only ${HOME}/.profile
260read-only ${HOME}/.project
261read-only ${HOME}/.tcshrc
262read-only ${HOME}/.zlogin
263read-only ${HOME}/.zlogout
264read-only ${HOME}/.zprofile
265read-only ${HOME}/.zsh.d
266read-only ${HOME}/.zsh_files
267read-only ${HOME}/.zshenv
268read-only ${HOME}/.zshrc
269read-only ${HOME}/.zshrc.local
270
271# Remote access
272read-only ${HOME}/.ssh/authorized_keys
273
274# Initialization files that allow arbitrary command execution
275read-only ${HOME}/.caffrc
276read-only ${HOME}/.cargo/env
277read-only ${HOME}/.dotfiles
278read-only ${HOME}/.emacs
279read-only ${HOME}/.emacs.d
280read-only ${HOME}/.exrc
281read-only ${HOME}/.gvimrc
282read-only ${HOME}/.homesick
283read-only ${HOME}/.iscreenrc
284read-only ${HOME}/.local/share/cool-retro-term
285read-only ${HOME}/.mailcap
286read-only ${HOME}/.msmtprc
287read-only ${HOME}/.mutt/muttrc
288read-only ${HOME}/.muttrc
289read-only ${HOME}/.nano
290read-only ${HOME}/.pythonrc.py
291read-only ${HOME}/.reportbugrc
292read-only ${HOME}/.tmux.conf
293read-only ${HOME}/.vim
294read-only ${HOME}/.viminfo
295read-only ${HOME}/.vimrc
296read-only ${HOME}/.xmonad
297read-only ${HOME}/.xscreensaver
298read-only ${HOME}/_exrc
299read-only ${HOME}/_gvimrc
300read-only ${HOME}/_vimrc
301read-only ${HOME}/dotfiles
302
303# Make directories commonly found in $PATH read-only
304read-only ${HOME}/.gem
305read-only ${HOME}/.luarocks
306read-only ${HOME}/.npm-packages
307read-only ${HOME}/bin
308read-only ${HOME}/.bin
309read-only ${HOME}/.local/bin
310read-only ${HOME}/.cargo/bin
311read-only ${HOME}/.cargo/env
312
313# Write-protection for desktop entries
314read-only ${HOME}/.config/menus
315read-only ${HOME}/.gnome/apps
316read-only ${HOME}/.local/share/applications
317
318# Write-protection for thumbnailer dir
319read-only ${HOME}/.local/share/thumbnailers
320
321# top secret
322blacklist ${HOME}/*.kdb
323blacklist ${HOME}/*.kdbx
324blacklist ${HOME}/*.key
325blacklist ${HOME}/.Private
326blacklist ${HOME}/.caff
327blacklist ${HOME}/.cargo/credentials
328blacklist ${HOME}/.cert
329blacklist ${HOME}/.config/keybase
330blacklist ${HOME}/.davfs2/secrets
331blacklist ${HOME}/.ecryptfs
332blacklist ${HOME}/.fetchmailrc
333blacklist ${HOME}/.fscrypt
334blacklist ${HOME}/.git-credential-cache
335blacklist ${HOME}/.git-credentials
336blacklist ${HOME}/.gnome2/keyrings
337blacklist ${HOME}/.gnupg
338blacklist ${HOME}/.config/hub
339blacklist ${HOME}/.kde/share/apps/kwallet
340blacklist ${HOME}/.kde4/share/apps/kwallet
341blacklist ${HOME}/.local/share/keyrings
342blacklist ${HOME}/.local/share/kwalletd
343blacklist ${HOME}/.local/share/plasma-vault
344blacklist ${HOME}/.msmtprc
345blacklist ${HOME}/.mutt
346blacklist ${HOME}/.muttrc
347blacklist ${HOME}/.netrc
348blacklist ${HOME}/.nyx
349blacklist ${HOME}/.pki
350blacklist ${HOME}/.local/share/pki
351blacklist ${HOME}/.smbcredentials
352blacklist ${HOME}/.ssh
353blacklist ${HOME}/.vaults
354blacklist /.fscrypt
355blacklist /etc/davfs2/secrets
356blacklist /etc/group+
357blacklist /etc/group-
358blacklist /etc/gshadow
359blacklist /etc/gshadow+
360blacklist /etc/gshadow-
361blacklist /etc/passwd+
362blacklist /etc/passwd-
363blacklist /etc/shadow
364blacklist /etc/shadow+
365blacklist /etc/shadow-
366blacklist /etc/ssh
367blacklist /home/.ecryptfs
368blacklist /home/.fscrypt
369blacklist /var/backup
370
371# cloud provider configuration
372blacklist ${HOME}/.aws
373blacklist ${HOME}/.boto
374blacklist ${HOME}/.config/gcloud
375blacklist ${HOME}/.kube
376blacklist ${HOME}/.passwd-s3fs
377blacklist ${HOME}/.s3cmd
378blacklist /etc/boto.cfg
379
380# system directories
381blacklist /sbin
382blacklist /usr/local/sbin
383blacklist /usr/sbin
384
385# system management
386blacklist ${PATH}/at
387blacklist ${PATH}/chage
388blacklist ${PATH}/chfn
389blacklist ${PATH}/chsh
390blacklist ${PATH}/crontab
391blacklist ${PATH}/evtest
392blacklist ${PATH}/expiry
393blacklist ${PATH}/fusermount
394blacklist ${PATH}/gksu
395blacklist ${PATH}/gksudo
396blacklist ${PATH}/gpasswd
397blacklist ${PATH}/kdesudo
398blacklist ${PATH}/ksu
399blacklist ${PATH}/mount
400blacklist ${PATH}/mount.ecryptfs_private
401blacklist ${PATH}/nc
402blacklist ${PATH}/ncat
403blacklist ${PATH}/newgidmap
404blacklist ${PATH}/newgrp
405blacklist ${PATH}/newuidmap
406blacklist ${PATH}/ntfs-3g
407blacklist ${PATH}/pkexec
408blacklist ${PATH}/procmail
409blacklist ${PATH}/sg
410blacklist ${PATH}/strace
411blacklist ${PATH}/su
412blacklist ${PATH}/sudo
413blacklist ${PATH}/umount
414blacklist ${PATH}/unix_chkpwd
415blacklist ${PATH}/xev
416blacklist ${PATH}/xinput
417
418# other SUID binaries
419blacklist /usr/lib/virtualbox
420blacklist /usr/lib64/virtualbox
421
422# prevent lxterminal connecting to an existing lxterminal session
423blacklist /tmp/.lxterminal-socket*
424# prevent tmux connecting to an existing session
425blacklist /tmp/tmux-*
426
427# disable terminals running as server resulting in sandbox escape
428blacklist ${PATH}/lxterminal
429blacklist ${PATH}/gnome-terminal
430blacklist ${PATH}/gnome-terminal.wrapper
431blacklist ${PATH}/lilyterm
432blacklist ${PATH}/mate-terminal
433blacklist ${PATH}/mate-terminal.wrapper
434blacklist ${PATH}/pantheon-terminal
435blacklist ${PATH}/roxterm
436blacklist ${PATH}/roxterm-config
437blacklist ${PATH}/terminix
438blacklist ${PATH}/tilix
439blacklist ${PATH}/urxvtc
440blacklist ${PATH}/urxvtcd
441blacklist ${PATH}/xfce4-terminal
442blacklist ${PATH}/xfce4-terminal.wrapper
443# blacklist ${PATH}/konsole
444# konsole doesn't seem to have this problem - last tested on Ubuntu 16.04
445
446# kernel files
447blacklist /initrd*
448blacklist /vmlinuz*
449
450# snapshot files
451blacklist /.snapshots
452
453# flatpak
454blacklist ${HOME}/.config/flatpak
455blacklist ${HOME}/.local/share/flatpak/app
456blacklist ${HOME}/.local/share/flatpak/appstream
457blacklist ${HOME}/.local/share/flatpak/db
458read-only ${HOME}/.local/share/flatpak/exports
459blacklist ${HOME}/.local/share/flatpak/oci
460blacklist ${HOME}/.local/share/flatpak/overrides
461blacklist ${HOME}/.local/share/flatpak/repo
462blacklist ${HOME}/.local/share/flatpak/runtime
463blacklist ${HOME}/.var
464blacklist ${RUNUSER}/app
465blacklist ${RUNUSER}/doc
466blacklist ${RUNUSER}/.dbus-proxy
467blacklist ${RUNUSER}/.flatpak
468blacklist ${RUNUSER}/.flatpak-helper
469blacklist /usr/share/flatpak
470blacklist /var/lib/flatpak
471# most of the time bwrap is SUID binary
472blacklist ${PATH}/bwrap
473
474# mail directories used by mutt
475blacklist ${HOME}/.Mail
476blacklist ${HOME}/.mail
477blacklist ${HOME}/.signature
478blacklist ${HOME}/Mail
479blacklist ${HOME}/mail
480blacklist ${HOME}/postponed
481blacklist ${HOME}/sent
482
483# kernel configuration
484blacklist /proc/config.gz
485
486# prevent DNS malware attempting to communicate with the server
487# using regular DNS tools
488blacklist ${PATH}/dig
489blacklist ${PATH}/kdig
490blacklist ${PATH}/nslookup
491blacklist ${PATH}/host
492blacklist ${PATH}/dlint
493blacklist ${PATH}/dnswalk
494blacklist ${PATH}/dns2tcp
495blacklist ${PATH}/iodine
496blacklist ${PATH}/knsupdate
497blacklist ${PATH}/resolvectl
diff --git a/etc/inc/disable-devel.inc b/etc/inc/disable-devel.inc
new file mode 100644
index 000000000..e1ba13380
--- /dev/null
+++ b/etc/inc/disable-devel.inc
@@ -0,0 +1,68 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include disable-devel.local
4
5# development tools
6
7# clang/llvm
8blacklist ${PATH}/clang*
9blacklist ${PATH}/lldb*
10blacklist ${PATH}/llvm*
11# see issue #2106 - it disables hardware acceleration in Firefox on Radeon GPU
12# blacklist /usr/lib/llvm*
13
14# GCC
15blacklist ${PATH}/as
16blacklist ${PATH}/cc
17blacklist ${PATH}/c++*
18blacklist ${PATH}/c8*
19blacklist ${PATH}/c9*
20blacklist ${PATH}/cpp*
21blacklist ${PATH}/g++*
22blacklist ${PATH}/gcc*
23blacklist ${PATH}/gdb
24blacklist ${PATH}/ld
25blacklist ${PATH}/*-gcc*
26blacklist ${PATH}/*-g++*
27blacklist ${PATH}/*-gcc*
28blacklist ${PATH}/*-g++*
29# seems to create problems on Gentoo
30#blacklist /usr/lib/gcc
31
32#Go
33blacklist ${PATH}/gccgo
34blacklist ${PATH}/go
35blacklist ${PATH}/gofmt
36
37# Java
38blacklist ${PATH}/java
39blacklist ${PATH}/javac
40blacklist /etc/java
41blacklist /usr/lib/java
42blacklist /usr/share/java
43
44#OpenSSL
45blacklist ${PATH}/openssl
46blacklist ${PATH}/openssl-1.0
47
48#Rust
49blacklist ${PATH}/rust-gdb
50blacklist ${PATH}/rust-lldb
51blacklist ${PATH}/rustc
52
53# tcc - Tiny C Compiler
54blacklist ${PATH}/tcc
55blacklist ${PATH}/x86_64-tcc
56blacklist /usr/lib/tcc
57
58# Valgrind
59blacklist ${PATH}/valgrind*
60blacklist /usr/lib/valgrind
61
62
63# Source-Code
64
65blacklist /usr/src
66blacklist /usr/local/src
67blacklist /usr/include
68blacklist /usr/local/include
diff --git a/etc/inc/disable-exec.inc b/etc/inc/disable-exec.inc
new file mode 100644
index 000000000..ee3391730
--- /dev/null
+++ b/etc/inc/disable-exec.inc
@@ -0,0 +1,11 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include disable-exec.local
4
5noexec ${HOME}
6noexec ${RUNUSER}
7noexec /dev/shm
8noexec /tmp
9# /var is noexec by default for unprivileged users
10# except there is a writable-var option, so just in case:
11noexec /var
diff --git a/etc/inc/disable-interpreters.inc b/etc/inc/disable-interpreters.inc
new file mode 100644
index 000000000..59e9c7de3
--- /dev/null
+++ b/etc/inc/disable-interpreters.inc
@@ -0,0 +1,64 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include disable-interpreters.local
4
5# gjs
6blacklist ${PATH}/gjs
7blacklist ${PATH}/gjs-console
8blacklist /usr/lib/gjs
9blacklist /usr/lib64/gjs
10blacklist /usr/lib/libgjs*
11blacklist /usr/lib64/libgjs*
12
13# Lua
14blacklist ${PATH}/lua*
15blacklist /usr/include/lua*
16blacklist /usr/lib/liblua*
17blacklist /usr/lib/lua
18blacklist /usr/share/lua*
19
20# mozjs
21blacklist /usr/lib64/libmozjs-*
22
23# Node.js
24blacklist ${PATH}/node
25blacklist /usr/include/node
26
27# nvm
28blacklist ${HOME}/.nvm
29
30# Perl
31blacklist ${PATH}/cpan*
32blacklist ${PATH}/core_perl
33blacklist ${PATH}/perl
34blacklist ${PATH}/site_perl
35blacklist ${PATH}/vendor_perl
36blacklist /usr/lib/perl*
37blacklist /usr/share/perl*
38
39# PHP
40blacklist ${PATH}/php*
41blacklist /usr/lib/php*
42blacklist /usr/share/php*
43
44# Ruby
45blacklist ${PATH}/ruby
46blacklist /usr/lib/ruby
47
48# Programs using python: deluge, firefox addons, filezilla, cherrytree, xchat, hexchat, libreoffice, scribus
49# Python 2
50blacklist ${PATH}/python2*
51blacklist /usr/include/python2*
52blacklist /usr/lib/python2*
53blacklist /usr/local/lib/python2*
54blacklist /usr/share/python2*
55
56# You will want to add noblacklist for python3 stuff in the firefox and/or chromium profiles if you use the Gnome connector (see Issue #2026)
57
58# Python 3
59blacklist ${PATH}/python3*
60blacklist /usr/include/python3*
61blacklist /usr/lib/python3*
62blacklist /usr/lib64/python3*
63blacklist /usr/local/lib/python3*
64blacklist /usr/share/python3*
diff --git a/etc/inc/disable-passwdmgr.inc b/etc/inc/disable-passwdmgr.inc
new file mode 100644
index 000000000..316378cb8
--- /dev/null
+++ b/etc/inc/disable-passwdmgr.inc
@@ -0,0 +1,18 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include disable-passwdmgr.local
4
5blacklist ${HOME}/.config/Bitwarden
6blacklist ${HOME}/.config/KeePass
7blacklist ${HOME}/.config/keepass
8blacklist ${HOME}/.config/keepassx
9blacklist ${HOME}/.config/keepassxc
10blacklist ${HOME}/.config/Sinew Software Systems
11blacklist ${HOME}/.fpm
12blacklist ${HOME}/.keepass
13blacklist ${HOME}/.keepassx
14blacklist ${HOME}/.keepassxc
15blacklist ${HOME}/.lastpass
16blacklist ${HOME}/.local/share/KeePass
17blacklist ${HOME}/.local/share/keepass
18blacklist ${HOME}/.password-store
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
new file mode 100644
index 000000000..9e6af8785
--- /dev/null
+++ b/etc/inc/disable-programs.inc
@@ -0,0 +1,877 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include disable-programs.local
4
5blacklist ${HOME}/Arduino
6blacklist ${HOME}/i2p
7blacklist ${HOME}/Monero/wallets
8blacklist ${HOME}/Nextcloud/Notes
9blacklist ${HOME}/SoftMaker
10blacklist ${HOME}/Standard Notes Backups
11blacklist ${HOME}/TeamSpeak3-Client-linux_x86
12blacklist ${HOME}/TeamSpeak3-Client-linux_amd64
13blacklist ${HOME}/hyperrogue.ini
14blacklist ${HOME}/mps
15blacklist ${HOME}/wallet.dat
16blacklist ${HOME}/.*coin
17blacklist ${HOME}/.8pecxstudios
18blacklist ${HOME}/.AndroidStudio*
19blacklist ${HOME}/.Atom
20blacklist ${HOME}/.CLion*
21blacklist ${HOME}/.FBReader
22blacklist ${HOME}/.FontForge
23blacklist ${HOME}/.IdeaIC*
24blacklist ${HOME}/.LuminanceHDR
25blacklist ${HOME}/.Mathematica
26blacklist ${HOME}/.Natron
27blacklist ${HOME}/.PlayOnLinux
28blacklist ${HOME}/.PyCharm*
29blacklist ${HOME}/.Sayonara
30blacklist ${HOME}/.Steam
31blacklist ${HOME}/.Steampath
32blacklist ${HOME}/.Steampid
33blacklist ${HOME}/.TelegramDesktop
34blacklist ${HOME}/.VSCodium
35blacklist ${HOME}/.ViberPC
36blacklist ${HOME}/.VirtualBox
37blacklist ${HOME}/.WebStorm*
38blacklist ${HOME}/.Wolfram Research
39blacklist ${HOME}/.ZAP
40blacklist ${HOME}/.aMule
41blacklist ${HOME}/.android
42blacklist ${HOME}/.anydesk
43blacklist ${HOME}/.arduino15
44blacklist ${HOME}/.aria2
45blacklist ${HOME}/.arm
46blacklist ${HOME}/.asunder_album_artist
47blacklist ${HOME}/.asunder_album_genre
48blacklist ${HOME}/.asunder_album_title
49blacklist ${HOME}/.atom
50blacklist ${HOME}/.attic
51blacklist ${HOME}/.audacity-data
52blacklist ${HOME}/.bcast5
53blacklist ${HOME}/.bibletime
54blacklist ${HOME}/.bitcoin
55blacklist ${HOME}/.bogofilter
56blacklist ${HOME}/.bzf
57blacklist ${HOME}/.cargo/registry
58blacklist ${HOME}/.cargo/config
59blacklist ${HOME}/.claws-mail
60blacklist ${HOME}/.cliqz
61blacklist ${HOME}/.clonk
62blacklist ${HOME}/.config/0ad
63blacklist ${HOME}/.config/2048-qt
64blacklist ${HOME}/.config/Atom
65blacklist ${HOME}/.config/Audaciousrc
66blacklist ${HOME}/.config/Authenticator
67blacklist ${HOME}/.config/Beaker Browser
68blacklist ${HOME}/.config/Bitcoin
69blacklist ${HOME}/.config/Bitwarden
70blacklist ${HOME}/.config/Brackets
71blacklist ${HOME}/.config/BraveSoftware
72blacklist ${HOME}/.config/Clementine
73blacklist ${HOME}/.config/Code
74blacklist ${HOME}/.config/Code - OSS
75blacklist ${HOME}/.config/Code Industry
76blacklist ${HOME}/.config/Cryptocat
77blacklist ${HOME}/.config/Debauchee/Barrier.conf
78blacklist ${HOME}/.config/Enox
79blacklist ${HOME}/.config/Ferdi
80blacklist ${HOME}/.config/Franz
81blacklist ${HOME}/.config/FreeCAD
82blacklist ${HOME}/.config/Fritzing
83blacklist ${HOME}/.config/GIMP
84blacklist ${HOME}/.config/GitHub Desktop
85blacklist ${HOME}/.config/Gitter
86blacklist ${HOME}/.config/Google
87blacklist ${HOME}/.config/Google Play Music Desktop Player
88blacklist ${HOME}/.config/Gpredict
89blacklist ${HOME}/.config/INRIA
90blacklist ${HOME}/.config/InSilmaril
91blacklist ${HOME}/.config/Jitsi Meet
92blacklist ${HOME}/.config/Kid3
93blacklist ${HOME}/.config/Kingsoft
94blacklist ${HOME}/.config/Luminance
95blacklist ${HOME}/.config/Meltytech
96blacklist ${HOME}/.config/Mendeley Ltd.
97blacklist ${HOME}/.config/Min
98blacklist ${HOME}/.config/Mousepad
99blacklist ${HOME}/.config/Mumble
100blacklist ${HOME}/.config/MusE
101blacklist ${HOME}/.config/MuseScore
102blacklist ${HOME}/.config/MusicBrainz
103blacklist ${HOME}/.config/Nathan Osman
104blacklist ${HOME}/.config/Nylas Mail
105blacklist ${HOME}/.config/PBE
106blacklist ${HOME}/.config/Philipp Schmieder
107blacklist ${HOME}/.config/QGIS
108blacklist ${HOME}/.config/QMediathekView
109blacklist ${HOME}/.config/Qlipper
110blacklist ${HOME}/.config/QuiteRss
111blacklist ${HOME}/.config/QuiteRssrc
112blacklist ${HOME}/.config/Rambox
113blacklist ${HOME}/.config/Riot
114blacklist ${HOME}/.config/Rocket.Chat
115blacklist ${HOME}/.config/Signal
116blacklist ${HOME}/.config/Sinew Software Systems
117blacklist ${HOME}/.config/Slack
118blacklist ${HOME}/.config/Standard Notes
119blacklist ${HOME}/.config/SubDownloader
120blacklist ${HOME}/.config/Thunar
121blacklist ${HOME}/.config/VirtualBox
122blacklist ${HOME}/.config/Wire
123blacklist ${HOME}/.config/Zeal
124blacklist ${HOME}/.config/abiword
125blacklist ${HOME}/.config/agenda
126blacklist ${HOME}/.config/akonadi*
127blacklist ${HOME}/.config/akregatorrc
128blacklist ${HOME}/.config/ardour4
129blacklist ${HOME}/.config/ardour5
130blacklist ${HOME}/.config/aria2
131blacklist ${HOME}/.config/arkrc
132blacklist ${HOME}/.config/artha.conf
133blacklist ${HOME}/.config/artha.log
134blacklist ${HOME}/.config/asunder
135blacklist ${HOME}/.config/atril
136blacklist ${HOME}/.config/audacious
137blacklist ${HOME}/.config/autokey
138blacklist ${HOME}/.config/aweather
139blacklist ${HOME}/.config/baloofilerc
140blacklist ${HOME}/.config/baloorc
141blacklist ${HOME}/.config/blender
142blacklist ${HOME}/.config/bless
143blacklist ${HOME}/.config/bnox
144blacklist ${HOME}/.config/borg
145blacklist ${HOME}/.config/brasero
146blacklist ${HOME}/.config/brave
147blacklist ${HOME}/.config/brave-flags.conf
148blacklist ${HOME}/.config/caja
149blacklist ${HOME}/.config/calibre
150blacklist ${HOME}/.config/cantata
151blacklist ${HOME}/.config/catfish
152blacklist ${HOME}/.config/celluloid
153blacklist ${HOME}/.config/cherrytree
154blacklist ${HOME}/.config/chromium
155blacklist ${HOME}/.config/chromium-dev
156blacklist ${HOME}/.config/chromium-flags.conf
157blacklist ${HOME}/.config/clipit
158blacklist ${HOME}/.config/cliqz
159blacklist ${HOME}/.config/cmus
160blacklist ${HOME}/.config/corebird
161blacklist ${HOME}/.config/cower
162blacklist ${HOME}/.config/darktable
163blacklist ${HOME}/.config/deadbeef
164blacklist ${HOME}/.config/deluge
165blacklist ${HOME}/.config/devilspie2
166blacklist ${HOME}/.config/digikam
167blacklist ${HOME}/.config/digikamrc
168blacklist ${HOME}/.config/discord
169blacklist ${HOME}/.config/discordcanary
170blacklist ${HOME}/.config/dkl
171blacklist ${HOME}/.config/dnox
172blacklist ${HOME}/.config/dolphinrc
173blacklist ${HOME}/.config/dragonplayerrc
174blacklist ${HOME}/.config/draw.io
175blacklist ${HOME}/.config/d-feet
176blacklist ${HOME}/.config/electron-mail
177blacklist ${HOME}/.config/emaildefaults
178blacklist ${HOME}/.config/emailidentities
179blacklist ${HOME}/.config/enchant
180blacklist ${HOME}/.config/eog
181blacklist ${HOME}/.config/epiphany
182blacklist ${HOME}/.config/evince
183blacklist ${HOME}/.config/evolution
184blacklist ${HOME}/.config/falkon
185blacklist ${HOME}/.config/filezilla
186blacklist ${HOME}/.config/flowblade
187blacklist ${HOME}/.config/font-manager
188blacklist ${HOME}/.config/freecol
189blacklist ${HOME}/.config/gajim
190blacklist ${HOME}/.config/galculator
191blacklist ${HOME}/.config/gconf
192blacklist ${HOME}/.config/geany
193blacklist ${HOME}/.config/gedit
194blacklist ${HOME}/.config/geeqie
195blacklist ${HOME}/.config/ghb
196blacklist ${HOME}/.config/ghostwriter
197blacklist ${HOME}/.config/git
198blacklist ${HOME}/.config/globaltime
199blacklist ${HOME}/.config/gmpc
200blacklist ${HOME}/.config/gnome-builder
201blacklist ${HOME}/.config/gnome-chess
202blacklist ${HOME}/.config/gnome-latex
203blacklist ${HOME}/.config/gnome-mplayer
204blacklist ${HOME}/.config/gnome-mpv
205blacklist ${HOME}/.config/gnome-pie
206blacklist ${HOME}/.config/godot
207blacklist ${HOME}/.config/google-chrome
208blacklist ${HOME}/.config/google-chrome-beta
209blacklist ${HOME}/.config/google-chrome-unstable
210blacklist ${HOME}/.config/gpicview
211blacklist ${HOME}/.config/gthumb
212blacklist ${HOME}/.config/gummi
213blacklist ${HOME}/.config/gwenviewrc
214blacklist ${HOME}/.config/hexchat
215blacklist ${HOME}/.config/i2p
216blacklist ${HOME}/.config/inkscape
217blacklist ${HOME}/.config/inox
218blacklist ${HOME}/.config/iridium
219blacklist ${HOME}/.config/itch
220blacklist ${HOME}/.config/jd-gui.cfg
221blacklist ${HOME}/.config/k3brc
222blacklist ${HOME}/.config/kaffeinerc
223blacklist ${HOME}/.config/kalgebrarc
224blacklist ${HOME}/.config/katemetainfos
225blacklist ${HOME}/.config/katepartrc
226blacklist ${HOME}/.config/katerc
227blacklist ${HOME}/.config/kateschemarc
228blacklist ${HOME}/.config/katesyntaxhighlightingrc
229blacklist ${HOME}/.config/katevirc
230blacklist ${HOME}/.config/kdeconnect
231blacklist ${HOME}/.config/kdenliverc
232blacklist ${HOME}/.config/kfindrc
233blacklist ${HOME}/.config/kgetrc
234blacklist ${HOME}/.config/kid3rc
235blacklist ${HOME}/.config/klavaro
236blacklist ${HOME}/.config/klipperrc
237blacklist ${HOME}/.config/kmail2rc
238blacklist ${HOME}/.config/kmailsearchindexingrc
239blacklist ${HOME}/.config/kmplayerrc
240blacklist ${HOME}/.config/knotesrc
241blacklist ${HOME}/.config/konversationrc
242blacklist ${HOME}/.config/kritarc
243blacklist ${HOME}/.config/ktorrentrc
244blacklist ${HOME}/.config/ktouch2rc
245blacklist ${HOME}/.config/kwriterc
246blacklist ${HOME}/.config/leafpad
247blacklist ${HOME}/.config/libreoffice
248blacklist ${HOME}/.config/liferea
249blacklist ${HOME}/.config/lugaru
250blacklist ${HOME}/.config/lximage-qt
251blacklist ${HOME}/.config/mailtransports
252blacklist ${HOME}/.config/mana
253blacklist ${HOME}/.config/mate-calc
254blacklist ${HOME}/.config/mate/eom
255blacklist ${HOME}/.config/mate/mate-dictionary
256blacklist ${HOME}/.config/meld
257blacklist ${HOME}/.config/meteo-qt
258blacklist ${HOME}/.config/mfusion
259blacklist ${HOME}/.config/Microsoft
260blacklist ${HOME}/.config/midori
261blacklist ${HOME}/.config/mono
262blacklist ${HOME}/.config/mpDris2
263blacklist ${HOME}/.config/mpd
264blacklist ${HOME}/.config/mps-youtube
265blacklist ${HOME}/.config/mpv
266blacklist ${HOME}/.config/mupen64plus
267blacklist ${HOME}/.config/mypaint
268blacklist ${HOME}/.config/nano
269blacklist ${HOME}/.config/nautilus
270blacklist ${HOME}/.config/nemo
271blacklist ${HOME}/.config/netsurf
272blacklist ${HOME}/.config/newsbeuter
273blacklist ${HOME}/.config/nheko
274blacklist ${HOME}/.config/NitroShare
275blacklist ${HOME}/.config/nomacs
276blacklist ${HOME}/.config/obs-studio
277blacklist ${HOME}/.config/okularpartrc
278blacklist ${HOME}/.config/okularrc
279blacklist ${HOME}/.config/onionshare
280blacklist ${HOME}/.config/onlyoffice
281blacklist ${HOME}/.config/opera
282blacklist ${HOME}/.config/opera-beta
283blacklist ${HOME}/.config/orage
284blacklist ${HOME}/.config/org.gabmus.gfeeds.json
285blacklist ${HOME}/.config/org.kde.gwenviewrc
286blacklist ${HOME}/.config/pavucontrol-qt
287blacklist ${HOME}/.config/pavucontrol.ini
288blacklist ${HOME}/.config/pcmanfm
289blacklist ${HOME}/.config/pdfmod
290blacklist ${HOME}/.config/Pinta
291blacklist ${HOME}/.config/pitivi
292blacklist ${HOME}/.config/pix
293blacklist ${HOME}/.config/pluma
294blacklist ${HOME}/.config/ppsspp
295blacklist ${HOME}/.config/pragha
296blacklist ${HOME}/.config/profanity
297blacklist ${HOME}/.config/psi+
298blacklist ${HOME}/.config/qBittorrent
299blacklist ${HOME}/.config/qBittorrentrc
300blacklist ${HOME}/.config/qpdfview
301blacklist ${HOME}/.config/qupzilla
302blacklist ${HOME}/.config/qutebrowser
303blacklist ${HOME}/.config/ranger
304blacklist ${HOME}/.config/redshift
305blacklist ${HOME}/.config/redshift.conf
306blacklist ${HOME}/.config/remmina
307blacklist ${HOME}/.config/ristretto
308blacklist ${HOME}/.config/rtv
309blacklist ${HOME}/.config/scribus
310blacklist ${HOME}/.config/scribusrc
311blacklist ${HOME}/.config/sinew.in
312blacklist ${HOME}/.config/skypeforlinux
313blacklist ${HOME}/.config/slimjet
314blacklist ${HOME}/.config/smplayer
315blacklist ${HOME}/.config/smtube
316blacklist ${HOME}/.config/snox
317blacklist ${HOME}/.config/sound-juicer
318blacklist ${HOME}/.config/specialmailcollectionsrc
319blacklist ${HOME}/.config/spotify
320blacklist ${HOME}/.config/sqlitebrowser
321blacklist ${HOME}/.config/stellarium
322blacklist ${HOME}/.config/supertuxkart
323blacklist ${HOME}/.config/synfig
324blacklist ${HOME}/.config/teams
325blacklist ${HOME}/.config/telepathy-account-widgets
326blacklist ${HOME}/.config/torbrowser
327blacklist ${HOME}/.config/totem
328blacklist ${HOME}/.config/tox
329blacklist ${HOME}/.config/transgui
330blacklist ${HOME}/.config/transmission
331blacklist ${HOME}/.config/truecraft
332blacklist ${HOME}/.config/tvbrowser
333blacklist ${HOME}/.config/uGet
334blacklist ${HOME}/.config/uzbl
335blacklist ${HOME}/.config/viewnior
336blacklist ${HOME}/.config/vivaldi
337blacklist ${HOME}/.config/vivaldi-snapshot
338blacklist ${HOME}/.config/vlc
339blacklist ${HOME}/.config/wesnoth
340blacklist ${HOME}/.config/wormux
341blacklist ${HOME}/.config/Whalebird
342blacklist ${HOME}/.config/wireshark
343blacklist ${HOME}/.config/xchat
344blacklist ${HOME}/.config/xed
345blacklist ${HOME}/.config/xfburn
346blacklist ${HOME}/.config/xfce4/xfce4-notes.gtkrc
347blacklist ${HOME}/.config/xfce4/xfce4-notes.rc
348blacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml
349blacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml
350blacklist ${HOME}/.config/xfce4-dict
351blacklist ${HOME}/.config/xiaoyong
352blacklist ${HOME}/.config/xmms2
353blacklist ${HOME}/.config/xplayer
354blacklist ${HOME}/.config/xreader
355blacklist ${HOME}/.config/xviewer
356blacklist ${HOME}/.config/yandex-browser
357blacklist ${HOME}/.config/yandex-browser-beta
358blacklist ${HOME}/.config/yelp
359blacklist ${HOME}/.config/youtube-dl
360blacklist ${HOME}/.config/zathura
361blacklist ${HOME}/.config/zoomus.conf
362blacklist ${HOME}/.config/Zulip
363blacklist ${HOME}/.conkeror.mozdev.org
364blacklist ${HOME}/.crawl
365blacklist ${HOME}/.curlrc
366blacklist ${HOME}/.dashcore
367blacklist ${HOME}/.devilspie
368blacklist ${HOME}/.dia
369blacklist ${HOME}/.digrc
370blacklist ${HOME}/.dillo
371blacklist ${HOME}/.dooble
372blacklist ${HOME}/.dosbox
373blacklist ${HOME}/.dropbox*
374blacklist ${HOME}/.easystroke
375blacklist ${HOME}/.electron-cache
376blacklist ${HOME}/.electrum*
377blacklist ${HOME}/.elinks
378blacklist ${HOME}/.emacs
379blacklist ${HOME}/.emacs.d
380blacklist ${HOME}/.ethereum
381blacklist ${HOME}/.etr
382blacklist ${HOME}/.filezilla
383blacklist ${HOME}/.flowblade
384blacklist ${HOME}/.fltk
385blacklist ${HOME}/.fossamail
386blacklist ${HOME}/.freeciv
387blacklist ${HOME}/.freecol
388blacklist ${HOME}/.freemind
389blacklist ${HOME}/.frogatto
390blacklist ${HOME}/.frozen-bubble
391blacklist ${HOME}/.gimp*
392blacklist ${HOME}/.gist
393blacklist ${HOME}/.gitconfig
394blacklist ${HOME}/.gnome/gnome-schedule
395blacklist ${HOME}/.googleearth/Cache
396blacklist ${HOME}/.googleearth/Temp
397blacklist ${HOME}/.googleearth/myplaces.backup.kml
398blacklist ${HOME}/.googleearth/myplaces.kml
399blacklist ${HOME}/.gradle
400blacklist ${HOME}/.gramps
401blacklist ${HOME}/.guayadeque
402blacklist ${HOME}/.hashcat
403blacklist ${HOME}/.hedgewars
404blacklist ${HOME}/.hugin
405blacklist ${HOME}/.i2p
406blacklist ${HOME}/.icedove
407blacklist ${HOME}/.imagej
408blacklist ${HOME}/.inkscape
409blacklist ${HOME}/.itch
410blacklist ${HOME}/.jack-server
411blacklist ${HOME}/.jack-settings
412blacklist ${HOME}/.jak
413blacklist ${HOME}/.java
414blacklist ${HOME}/.jd
415blacklist ${HOME}/.jitsi
416blacklist ${HOME}/.jumpnbump
417blacklist ${HOME}/.kde/share/apps/digikam
418blacklist ${HOME}/.kde/share/apps/gwenview
419blacklist ${HOME}/.kde/share/apps/kaffeine
420blacklist ${HOME}/.kde/share/apps/kcookiejar
421blacklist ${HOME}/.kde/share/apps/kget
422blacklist ${HOME}/.kde/share/apps/khtml
423blacklist ${HOME}/.kde/share/apps/klatexformula
424blacklist ${HOME}/.kde/share/apps/konqsidebartng
425blacklist ${HOME}/.kde/share/apps/konqueror
426blacklist ${HOME}/.kde/share/apps/kopete
427blacklist ${HOME}/.kde/share/apps/ktorrent
428blacklist ${HOME}/.kde/share/apps/okular
429blacklist ${HOME}/.kde/share/config/baloofilerc
430blacklist ${HOME}/.kde/share/config/baloorc
431blacklist ${HOME}/.kde/share/config/digikam
432blacklist ${HOME}/.kde/share/config/gwenviewrc
433blacklist ${HOME}/.kde/share/config/k3brc
434blacklist ${HOME}/.kde/share/config/kaffeinerc
435blacklist ${HOME}/.kde/share/config/kcookiejarrc
436blacklist ${HOME}/.kde/share/config/kfindrc
437blacklist ${HOME}/.kde/share/config/kgetrc
438blacklist ${HOME}/.kde/share/config/khtmlrc
439blacklist ${HOME}/.kde/share/config/klipperrc
440blacklist ${HOME}/.kde/share/config/kmplayerrc
441blacklist ${HOME}/.kde/share/config/konq_history
442blacklist ${HOME}/.kde/share/config/konqsidebartngrc
443blacklist ${HOME}/.kde/share/config/konquerorrc
444blacklist ${HOME}/.kde/share/config/konversationrc
445blacklist ${HOME}/.kde/share/config/kopeterc
446blacklist ${HOME}/.kde/share/config/ktorrentrc
447blacklist ${HOME}/.kde/share/config/okularpartrc
448blacklist ${HOME}/.kde/share/config/okularrc
449blacklist ${HOME}/.kde4/share/apps/digikam
450blacklist ${HOME}/.kde4/share/apps/gwenview
451blacklist ${HOME}/.kde4/share/apps/kaffeine
452blacklist ${HOME}/.kde4/share/apps/kcookiejar
453blacklist ${HOME}/.kde4/share/apps/kget
454blacklist ${HOME}/.kde4/share/apps/khtml
455blacklist ${HOME}/.kde4/share/apps/konqsidebartng
456blacklist ${HOME}/.kde4/share/apps/konqueror
457blacklist ${HOME}/.kde4/share/apps/kopete
458blacklist ${HOME}/.kde4/share/apps/ktorrent
459blacklist ${HOME}/.kde4/share/apps/okular
460blacklist ${HOME}/.kde4/share/config/baloofilerc
461blacklist ${HOME}/.kde4/share/config/baloorc
462blacklist ${HOME}/.kde4/share/config/digikam
463blacklist ${HOME}/.kde4/share/config/gwenviewrc
464blacklist ${HOME}/.kde4/share/config/k3brc
465blacklist ${HOME}/.kde4/share/config/kaffeinerc
466blacklist ${HOME}/.kde4/share/config/kcookiejarrc
467blacklist ${HOME}/.kde4/share/config/kfindrc
468blacklist ${HOME}/.kde4/share/config/kgetrc
469blacklist ${HOME}/.kde4/share/config/khtmlrc
470blacklist ${HOME}/.kde4/share/config/klipperrc
471blacklist ${HOME}/.kde4/share/config/konq_history
472blacklist ${HOME}/.kde4/share/config/konqsidebartngrc
473blacklist ${HOME}/.kde4/share/config/konquerorrc
474blacklist ${HOME}/.kde4/share/config/konversationrc
475blacklist ${HOME}/.kde4/share/config/kopeterc
476blacklist ${HOME}/.kde4/share/config/ktorrentrc
477blacklist ${HOME}/.kde4/share/config/okularpartrc
478blacklist ${HOME}/.kde4/share/config/okularrc
479blacklist ${HOME}/.killingfloor
480blacklist ${HOME}/.kingsoft
481blacklist ${HOME}/.kino-history
482blacklist ${HOME}/.kinorc
483blacklist ${HOME}/.klatexformula
484blacklist ${HOME}/.kodi
485blacklist ${HOME}/.lincity-ng
486blacklist ${HOME}/.links
487blacklist ${HOME}/.linphone-history.db
488blacklist ${HOME}/.linphonerc
489blacklist ${HOME}/.lmmsrc.xml
490blacklist ${HOME}/.local/lib/vivaldi
491blacklist ${HOME}/.local/share/0ad
492blacklist ${HOME}/.local/share/3909/PapersPlease
493blacklist ${HOME}/.local/share/Anki2
494blacklist ${HOME}/.local/share/Empathy
495blacklist ${HOME}/.local/share/Enpass
496blacklist ${HOME}/.local/share/JetBrains
497blacklist ${HOME}/.local/share/Kingsoft
498blacklist ${HOME}/.local/share/Mendeley Ltd.
499blacklist ${HOME}/.local/share/Mumble
500blacklist ${HOME}/.local/share/PBE
501blacklist ${HOME}/.local/share/QGIS
502blacklist ${HOME}/.local/share/QMediathekView
503blacklist ${HOME}/.local/share/QuiteRss
504blacklist ${HOME}/.local/share/Ricochet
505blacklist ${HOME}/.local/share/Shortwave
506blacklist ${HOME}/.local/share/Steam
507blacklist ${HOME}/.local/share/SuperHexagon
508blacklist ${HOME}/.local/share/TelegramDesktop
509blacklist ${HOME}/.local/share/Terraria
510blacklist ${HOME}/.local/share/TpLogger
511blacklist ${HOME}/.local/share/Zeal
512blacklist ${HOME}/.local/share/akonadi*
513blacklist ${HOME}/.local/share/akregator
514blacklist ${HOME}/.local/share/agenda
515blacklist ${HOME}/.local/share/apps/korganizer
516blacklist ${HOME}/.local/share/aspyr-media
517blacklist ${HOME}/.local/share/autokey
518blacklist ${HOME}/.local/share/baloo
519blacklist ${HOME}/.local/share/barrier
520blacklist ${HOME}/.local/share/bibletime
521blacklist ${HOME}/.local/share/caja-python
522blacklist ${HOME}/.local/share/cantata
523blacklist ${HOME}/.local/share/cdprojektred
524blacklist ${HOME}/.local/share/clipit
525blacklist ${HOME}/.local/share/com.github.johnfactotum.Foliate
526blacklist ${HOME}/.local/share/contacts
527blacklist ${HOME}/.local/share/data/Mendeley Ltd.
528blacklist ${HOME}/.local/share/data/Mumble
529blacklist ${HOME}/.local/share/data/MusE
530blacklist ${HOME}/.local/share/data/MuseScore
531blacklist ${HOME}/.local/share/data/nomacs
532blacklist ${HOME}/.local/share/data/qBittorrent
533blacklist ${HOME}/.local/share/dino
534blacklist ${HOME}/.local/share/dolphin
535blacklist ${HOME}/.local/share/emailidentities
536blacklist ${HOME}/.local/share/epiphany
537blacklist ${HOME}/.local/share/evolution
538blacklist ${HOME}/.local/share/feedreader
539blacklist ${HOME}/.local/share/feral-interactive
540blacklist ${HOME}/.local/share/five-or-more
541blacklist ${HOME}/.local/share/freecol
542blacklist ${HOME}/.local/share/gajim
543blacklist ${HOME}/.local/share/geary
544blacklist ${HOME}/.local/share/geeqie
545blacklist ${HOME}/.local/share/ghostwriter
546blacklist ${HOME}/.local/share/gitg
547blacklist ${HOME}/.local/share/gnome-2048
548blacklist ${HOME}/.local/share/gnome-chess
549blacklist ${HOME}/.local/share/gnome-builder
550blacklist ${HOME}/.local/share/gnome-klotski
551blacklist ${HOME}/.local/share/gnome-latex
552blacklist ${HOME}/.local/share/gnome-mines
553blacklist ${HOME}/.local/share/gnome-music
554blacklist ${HOME}/.local/share/gnome-nibbles
555blacklist ${HOME}/.local/share/gnome-photos
556blacklist ${HOME}/.local/share/gnome-pomodoro
557blacklist ${HOME}/.local/share/gnome-recipes
558blacklist ${HOME}/.local/share/gnome-ring
559blacklist ${HOME}/.local/share/gnome-sudoku
560blacklist ${HOME}/.local/share/gnome-twitch
561blacklist ${HOME}/.local/share/godot
562blacklist ${HOME}/.local/share/gradio
563blacklist ${HOME}/.local/share/gwenview
564blacklist ${HOME}/.local/share/i2p
565blacklist ${HOME}/.local/share/kaffeine
566blacklist ${HOME}/.local/share/kalgebra
567blacklist ${HOME}/.local/share/kate
568blacklist ${HOME}/.local/share/kdenlive
569blacklist ${HOME}/.local/share/kget
570blacklist ${HOME}/.local/share/kiwix
571blacklist ${HOME}/.local/share/kiwix-desktop
572blacklist ${HOME}/.local/share/klavaro
573blacklist ${HOME}/.local/share/kmail2
574blacklist ${HOME}/.local/share/kmplayer
575blacklist ${HOME}/.local/share/knotes
576blacklist ${HOME}/.local/share/krita
577blacklist ${HOME}/.local/share/ktorrent
578blacklist ${HOME}/.local/share/ktorrentrc
579blacklist ${HOME}/.local/share/ktouch
580blacklist ${HOME}/.local/share/kwrite
581blacklist ${HOME}/.local/share/liferea
582blacklist ${HOME}/.local/share/local-mail
583blacklist ${HOME}/.local/share/lollypop
584blacklist ${HOME}/.local/share/love
585blacklist ${HOME}/.local/share/lugaru
586blacklist ${HOME}/.local/share/mana
587blacklist ${HOME}/.local/share/maps-places.json
588blacklist ${HOME}/.local/share/meld
589blacklist ${HOME}/.local/share/midori
590blacklist ${HOME}/.local/share/multimc
591blacklist ${HOME}/.local/share/multimc5
592blacklist ${HOME}/.local/share/mupen64plus
593blacklist ${HOME}/.local/share/mypaint
594blacklist ${HOME}/.local/share/nautilus
595blacklist ${HOME}/.local/share/nautilus-python
596blacklist ${HOME}/.local/share/nemo
597blacklist ${HOME}/.local/share/nemo-python
598blacklist ${HOME}/.local/share/nomacs
599blacklist ${HOME}/.local/share/notes
600blacklist ${HOME}/.local/share/ocenaudio
601blacklist ${HOME}/.local/share/okular
602blacklist ${HOME}/.local/share/onlyoffice
603blacklist ${HOME}/.local/share/orage
604blacklist ${HOME}/.local/share/org.kde.gwenview
605blacklist ${HOME}/.local/share/pix
606blacklist ${HOME}/.local/share/plasma_notes
607blacklist ${HOME}/.local/share/profanity
608blacklist ${HOME}/.local/share/psi+
609blacklist ${HOME}/.local/share/qpdfview
610blacklist ${HOME}/.local/share/qutebrowser
611blacklist ${HOME}/.local/share/remmina
612blacklist ${HOME}/.local/share/rhythmbox
613blacklist ${HOME}/.local/share/rtv
614blacklist ${HOME}/.local/share/scribus
615blacklist ${HOME}/.local/share/signal-cli
616blacklist ${HOME}/.local/share/spotify
617blacklist ${HOME}/.local/share/steam
618blacklist ${HOME}/.local/share/supertux2
619blacklist ${HOME}/.local/share/supertuxkart
620blacklist ${HOME}/.local/share/swell-foop
621blacklist ${HOME}/.local/share/telepathy
622blacklist ${HOME}/.local/share/terasology
623blacklist ${HOME}/.local/share/torbrowser
624blacklist ${HOME}/.local/share/totem
625blacklist ${HOME}/.local/share/uzbl
626blacklist ${HOME}/.local/share/vlc
627blacklist ${HOME}/.local/share/vpltd
628blacklist ${HOME}/.local/share/vulkan
629blacklist ${HOME}/.local/share/warsow-2.1
630blacklist ${HOME}/.local/share/wesnoth
631blacklist ${HOME}/.local/share/wormux
632blacklist ${HOME}/.local/share/xplayer
633blacklist ${HOME}/.local/share/xreader
634blacklist ${HOME}/.local/share/zathura
635blacklist ${HOME}/.lv2
636blacklist ${HOME}/.magicor
637blacklist ${HOME}/.masterpdfeditor
638blacklist ${HOME}/.mcabber
639blacklist ${HOME}/.mcabberrc
640blacklist ${HOME}/.mediathek3
641blacklist ${HOME}/.megaglest
642blacklist ${HOME}/.minetest
643blacklist ${HOME}/.mirrormagic
644blacklist ${HOME}/.moonchild productions/basilisk
645blacklist ${HOME}/.moonchild productions/pale moon
646blacklist ${HOME}/.mozilla
647blacklist ${HOME}/.mp3splt-gtk
648blacklist ${HOME}/.mpd
649blacklist ${HOME}/.mpdconf
650blacklist ${HOME}/.mplayer
651blacklist ${HOME}/.msmtprc
652blacklist ${HOME}/.multimc5
653blacklist ${HOME}/.nanorc
654blacklist ${HOME}/.netactview
655blacklist ${HOME}/.neverball
656blacklist ${HOME}/.newsbeuter
657blacklist ${HOME}/.newsboat
658blacklist ${HOME}/.nicotine
659blacklist ${HOME}/.nv
660blacklist ${HOME}/.nylas-mail
661blacklist ${HOME}/.openarena
662blacklist ${HOME}/.opencity
663blacklist ${HOME}/.openinvaders
664blacklist ${HOME}/.openshot
665blacklist ${HOME}/.openshot_qt
666blacklist ${HOME}/.openttd
667blacklist ${HOME}/.opera
668blacklist ${HOME}/.opera-beta
669blacklist ${HOME}/.ostrichriders
670blacklist ${HOME}/.parallelrealities/blobwars
671blacklist ${HOME}/.penguin-command
672blacklist ${HOME}/.pingus
673blacklist ${HOME}/.pioneer
674blacklist ${HOME}/.purple
675blacklist ${HOME}/.qemu-launcher
676blacklist ${HOME}/.qgis2
677blacklist ${HOME}/.qmmp
678blacklist ${HOME}/.quodlibet
679blacklist ${HOME}/.redeclipse
680blacklist ${HOME}/.remmina
681blacklist ${HOME}/.repo_.gitconfig.json
682blacklist ${HOME}/.repoconfig
683blacklist ${HOME}/.retroshare
684blacklist ${HOME}/.ripperXrc
685blacklist ${HOME}/.scorched3d
686blacklist ${HOME}/.scribus
687blacklist ${HOME}/.scribusrc
688blacklist ${HOME}/.simutrans
689blacklist ${HOME}/.smartgit/*/passwords
690blacklist ${HOME}/.ssr
691blacklist ${HOME}/.steam
692blacklist ${HOME}/.steampath
693blacklist ${HOME}/.steampid
694blacklist ${HOME}/.stellarium
695blacklist ${HOME}/.subversion
696blacklist ${HOME}/.surf
697blacklist ${HOME}/.swb.ini
698blacklist ${HOME}/.sword
699blacklist ${HOME}/.sylpheed-2.0
700blacklist ${HOME}/.synfig
701blacklist ${HOME}/.config/teams-for-linux
702blacklist ${HOME}/.tb
703blacklist ${HOME}/.tconn
704blacklist ${HOME}/.teeworlds
705blacklist ${HOME}/.thunderbird
706blacklist ${HOME}/.tilp
707blacklist ${HOME}/.tooling
708blacklist ${HOME}/.tor-browser*
709blacklist ${HOME}/.torcs
710blacklist ${HOME}/.tremulous
711blacklist ${HOME}/.ts3client
712blacklist ${HOME}/.tuxguitar*
713blacklist ${HOME}/.tvbrowser
714blacklist ${HOME}/.unknown-horizons
715blacklist ${HOME}/.viking
716blacklist ${HOME}/.viking-maps
717blacklist ${HOME}/.vim
718blacklist ${HOME}/.vimrc
719blacklist ${HOME}/.vscode
720blacklist ${HOME}/.vscode-oss
721blacklist ${HOME}/.vst
722blacklist ${HOME}/.vultures
723blacklist ${HOME}/.w3m
724blacklist ${HOME}/.warzone2100-3.*
725blacklist ${HOME}/.waterfox
726blacklist ${HOME}/.weechat
727blacklist ${HOME}/.wget-hsts
728blacklist ${HOME}/.wgetrc
729blacklist ${HOME}/.widelands
730blacklist ${HOME}/.wine
731blacklist ${HOME}/.wine64
732blacklist ${HOME}/.wireshark
733blacklist ${HOME}/.wordwarvi
734blacklist ${HOME}/.wormux
735blacklist ${HOME}/.xiphos
736blacklist ${HOME}/.xmind
737blacklist ${HOME}/.xmms
738blacklist ${HOME}/.xmr-stak
739blacklist ${HOME}/.xonotic
740blacklist ${HOME}/.xpdfrc
741blacklist ${HOME}/.zoom
742blacklist /tmp/akonadi-*
743blacklist /tmp/ssh-*
744blacklist /tmp/.wine-*
745blacklist /var/games/nethack
746blacklist /var/games/slashem
747blacklist /var/games/vulturesclaw
748blacklist /var/games/vultureseye
749blacklist /var/lib/games/Maelstrom-Scores
750
751# ${HOME}/.cache directory
752blacklist ${HOME}/.cache/0ad
753blacklist ${HOME}/.cache/8pecxstudios
754blacklist ${HOME}/.cache/Authenticator
755blacklist ${HOME}/.cache/BraveSoftware
756blacklist ${HOME}/.cache/Clementine
757blacklist ${HOME}/.cache/Enox
758blacklist ${HOME}/.cache/Enpass
759blacklist ${HOME}/.cache/Ferdi
760blacklist ${HOME}/.cache/Franz
761blacklist ${HOME}/.cache/INRIA
762blacklist ${HOME}/.cache/MusicBrainz
763blacklist ${HOME}/.cache/QuiteRss
764blacklist ${HOME}/.cache/Shortwave
765blacklist ${HOME}/.cache/Tox
766blacklist ${HOME}/.cache/Zeal
767blacklist ${HOME}/.cache/agenda
768blacklist ${HOME}/.cache/akonadi*
769blacklist ${HOME}/.cache/atril
770blacklist ${HOME}/.cache/attic
771blacklist ${HOME}/.cache/babl
772blacklist ${HOME}/.cache/bnox
773blacklist ${HOME}/.cache/borg
774blacklist ${HOME}/.cache/calibre
775blacklist ${HOME}/.cache/cantata
776blacklist ${HOME}/.cache/champlain
777blacklist ${HOME}/.cache/chromium
778blacklist ${HOME}/.cache/chromium-dev
779blacklist ${HOME}/.cache/cliqz
780blacklist ${HOME}/.cache/com.github.johnfactotum.Foliate
781blacklist ${HOME}/.cache/darktable
782blacklist ${HOME}/.cache/discover
783blacklist ${HOME}/.cache/dnox
784blacklist ${HOME}/.cache/dolphin
785blacklist ${HOME}/.cache/ephemeral
786blacklist ${HOME}/.cache/epiphany
787blacklist ${HOME}/.cache/evolution
788blacklist ${HOME}/.cache/falkon
789blacklist ${HOME}/.cache/feedreader
790blacklist ${HOME}/.cache/font-manager
791blacklist ${HOME}/.cache/fossamail
792blacklist ${HOME}/.cache/freecol
793blacklist ${HOME}/.cache/gajim
794blacklist ${HOME}/.cache/gegl-0.4
795blacklist ${HOME}/.cache/geeqie
796blacklist ${HOME}/.cache/gfeeds
797blacklist ${HOME}/.cache/gimp
798blacklist ${HOME}/.cache/gnome-builder
799blacklist ${HOME}/.cache/gnome-recipes
800blacklist ${HOME}/.cache/gnome-screenshot
801blacklist ${HOME}/.cache/gnome-twitch
802blacklist ${HOME}/.cache/godot
803blacklist ${HOME}/.cache/google-chrome
804blacklist ${HOME}/.cache/google-chrome-beta
805blacklist ${HOME}/.cache/google-chrome-unstable
806blacklist ${HOME}/.cache/gradio
807blacklist ${HOME}/.cache/gummi
808blacklist ${HOME}/.cache/icedove
809blacklist ${HOME}/.cache/INRIA/Natron
810blacklist ${HOME}/.cache/inkscape
811blacklist ${HOME}/.cache/inox
812blacklist ${HOME}/.cache/iridium
813blacklist ${HOME}/.cache/kcmshell5
814blacklist ${HOME}/.cache/kdenlive
815blacklist ${HOME}/.cache/kfind
816blacklist ${HOME}/.cache/kinfocenter
817blacklist ${HOME}/.cache/kmail2
818blacklist ${HOME}/.cache/krunner
819blacklist ${HOME}/.cache/krunnerbookmarkrunnerfirefoxdbfile.sqlite*
820blacklist ${HOME}/.cache/kscreenlocker_greet
821blacklist ${HOME}/.cache/ksmserver-logout-greeter
822blacklist ${HOME}/.cache/ksplashqml
823blacklist ${HOME}/.cache/kwin
824blacklist ${HOME}/.cache/libgweather
825blacklist ${HOME}/.cache/liferea
826blacklist ${HOME}/.cache/Mendeley Ltd.
827blacklist ${HOME}/.cache/midori
828blacklist ${HOME}/.cache/minetest
829blacklist ${HOME}/.cache/moonchild productions/basilisk
830blacklist ${HOME}/.cache/moonchild productions/pale moon
831blacklist ${HOME}/.cache/mozilla
832blacklist ${HOME}/.cache/ms-excel-online
833blacklist ${HOME}/.cache/ms-office-online
834blacklist ${HOME}/.cache/ms-onenote-online
835blacklist ${HOME}/.cache/ms-outlook-online
836blacklist ${HOME}/.cache/ms-powerpoint-online
837blacklist ${HOME}/.cache/ms-skype-online
838blacklist ${HOME}/.cache/ms-word-online
839blacklist ${HOME}/.cache/mutt
840blacklist ${HOME}/.cache/mypaint
841blacklist ${HOME}/.cache/nheko/nheko
842blacklist ${HOME}/.cache/netsurf
843blacklist ${HOME}/.cache/okular
844blacklist ${HOME}/.cache/opera
845blacklist ${HOME}/.cache/opera-beta
846blacklist ${HOME}/.cache/org.gabmus.gfeeds
847blacklist ${HOME}/.cache/org.gnome.Books
848blacklist ${HOME}/.cache/org.gnome.Maps
849blacklist ${HOME}/.cache/pdfmod
850blacklist ${HOME}/.cache/peek
851blacklist ${HOME}/.cache/plasmashell
852blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite*
853blacklist ${HOME}/.cache/qBittorrent
854blacklist ${HOME}/.cache/qupzilla
855blacklist ${HOME}/.cache/qutebrowser
856blacklist ${HOME}/.cache/rhythmbox
857blacklist ${HOME}/.cache/simple-scan
858blacklist ${HOME}/.cache/slimjet
859blacklist ${HOME}/.cache/snox
860blacklist ${HOME}/.cache/spotify
861blacklist ${HOME}/.cache/supertuxkart
862blacklist ${HOME}/.cache/systemsettings
863blacklist ${HOME}/.cache/telepathy
864blacklist ${HOME}/.cache/thunderbird
865blacklist ${HOME}/.cache/torbrowser
866blacklist ${HOME}/.cache/transmission
867blacklist ${HOME}/.cache/vivaldi
868blacklist ${HOME}/.cache/vivaldi-snapshot
869blacklist ${HOME}/.cache/vlc
870blacklist ${HOME}/.cache/warsow-2.1
871blacklist ${HOME}/.cache/waterfox
872blacklist ${HOME}/.cache/wesnoth
873blacklist ${HOME}/.cache/xmms2
874blacklist ${HOME}/.cache/xreader
875blacklist ${HOME}/.cache/yandex-browser
876blacklist ${HOME}/.cache/yandex-browser-beta
877blacklist ${HOME}/.cache/youtube-dl
diff --git a/etc/inc/disable-xdg.inc b/etc/inc/disable-xdg.inc
new file mode 100644
index 000000000..22acf272d
--- /dev/null
+++ b/etc/inc/disable-xdg.inc
@@ -0,0 +1,12 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include disable-xdg.local
4
5blacklist ${DOCUMENTS}
6blacklist ${MUSIC}
7blacklist ${PICTURES}
8blacklist ${VIDEOS}
9
10# The following should be considered catch-all directories
11#blacklist ${DESKTOP}
12#blacklist ${DOWNLOADS}
diff --git a/etc/inc/feh-network.inc b/etc/inc/feh-network.inc
new file mode 100644
index 000000000..e94e7205c
--- /dev/null
+++ b/etc/inc/feh-network.inc
@@ -0,0 +1,4 @@
1ignore net none
2netfilter
3protocol unix,inet,inet6
4private-etc ca-certificates,crypto-policies,hosts,pki,resolv.conf,ssl
diff --git a/etc/inc/firefox-common-addons.inc b/etc/inc/firefox-common-addons.inc
new file mode 100644
index 000000000..681e72d33
--- /dev/null
+++ b/etc/inc/firefox-common-addons.inc
@@ -0,0 +1,69 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include firefox-common-addons.local
4
5noblacklist ${HOME}/.config/kgetrc
6noblacklist ${HOME}/.config/okularpartrc
7noblacklist ${HOME}/.config/okularrc
8noblacklist ${HOME}/.config/qpdfview
9noblacklist ${HOME}/.kde/share/apps/kget
10noblacklist ${HOME}/.kde/share/apps/okular
11noblacklist ${HOME}/.kde/share/config/kgetrc
12noblacklist ${HOME}/.kde/share/config/okularpartrc
13noblacklist ${HOME}/.kde/share/config/okularrc
14noblacklist ${HOME}/.kde4/share/apps/kget
15noblacklist ${HOME}/.kde4/share/apps/okular
16noblacklist ${HOME}/.kde4/share/config/kgetrc
17noblacklist ${HOME}/.kde4/share/config/okularpartrc
18noblacklist ${HOME}/.kde4/share/config/okularrc
19noblacklist ${HOME}/.local/share/kget
20noblacklist ${HOME}/.local/share/okular
21noblacklist ${HOME}/.local/share/qpdfview
22
23whitelist ${HOME}/.cache/gnome-mplayer/plugin
24whitelist ${HOME}/.config/gnome-mplayer
25whitelist ${HOME}/.config/kgetrc
26whitelist ${HOME}/.config/okularpartrc
27whitelist ${HOME}/.config/okularrc
28whitelist ${HOME}/.config/pipelight-silverlight5.1
29whitelist ${HOME}/.config/pipelight-widevine
30whitelist ${HOME}/.config/qpdfview
31whitelist ${HOME}/.kde/share/apps/kget
32whitelist ${HOME}/.kde/share/apps/okular
33whitelist ${HOME}/.kde/share/config/kgetrc
34whitelist ${HOME}/.kde/share/config/okularpartrc
35whitelist ${HOME}/.kde/share/config/okularrc
36whitelist ${HOME}/.kde4/share/apps/kget
37whitelist ${HOME}/.kde4/share/apps/okular
38whitelist ${HOME}/.kde4/share/config/kgetrc
39whitelist ${HOME}/.kde4/share/config/okularpartrc
40whitelist ${HOME}/.kde4/share/config/okularrc
41whitelist ${HOME}/.keysnail.js
42whitelist ${HOME}/.lastpass
43whitelist ${HOME}/.local/share/kget
44whitelist ${HOME}/.local/share/okular
45whitelist ${HOME}/.local/share/qpdfview
46whitelist ${HOME}/.local/share/tridactyl
47whitelist ${HOME}/.pentadactyl
48whitelist ${HOME}/.pentadactylrc
49whitelist ${HOME}/.tridactylrc
50whitelist ${HOME}/.vimperator
51whitelist ${HOME}/.vimperatorrc
52whitelist ${HOME}/.wine-pipelight
53whitelist ${HOME}/.wine-pipelight64
54whitelist ${HOME}/.zotero
55whitelist ${HOME}/dwhelper
56
57# GNOME Shell integration (chrome-gnome-shell) needs dbus and python 3 (blacklisted by disable-interpreters.inc)
58noblacklist ${HOME}/.local/share/gnome-shell
59whitelist ${HOME}/.local/share/gnome-shell
60ignore dbus-user none
61ignore dbus-system none
62include allow-python3.inc
63
64# KeePassXC Browser Integration
65#private-bin keepassxc-proxy
66
67# Flash plugin
68# private-etc must first be enabled in firefox-common.profile and in profiles including it.
69#private-etc adobe
diff --git a/etc/inc/softmaker-common.inc b/etc/inc/softmaker-common.inc
new file mode 100644
index 000000000..a8ec5848c
--- /dev/null
+++ b/etc/inc/softmaker-common.inc
@@ -0,0 +1,50 @@
1# Firejail profile for softmaker-common
2# This file is overwritten after every install/update
3# Persistent local customizations
4include softmaker-common.local
5# Persistent global definitions
6# added by caller profile
7#include globals.local
8
9# The offical packages install the desktop file under /usr/local/share/applications
10# with an absolute Exec line. These files are NOT handelt by firecfg,
11# therefore you must manualy copy them in you home and remove '/usr/bin/'.
12
13noblacklist ${HOME}/SoftMaker
14
15include disable-common.inc
16include disable-devel.inc
17include disable-exec.inc
18include disable-interpreters.inc
19include disable-passwdmgr.inc
20include disable-programs.inc
21
22whitelist /usr/share/office2018
23whitelist /usr/share/freeoffice2018
24include whitelist-usr-share-common.inc
25include whitelist-var-common.inc
26
27apparmor
28caps.drop all
29ipc-namespace
30netfilter
31nodvd
32nogroups
33nonewprivs
34noroot
35notv
36nou2f
37novideo
38protocol unix,inet,inet6
39seccomp
40shell none
41tracelog
42
43private-bin freeoffice-planmaker,freeoffice-presentations,freeoffice-textmaker,planmaker18,planmaker18free,presentations18,presentations18free,sh,textmaker18,textmaker18free
44private-cache
45private-dev
46private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,SoftMaker,ssl
47private-tmp
48
49dbus-user none
50dbus-system none
diff --git a/etc/inc/whitelist-common.inc b/etc/inc/whitelist-common.inc
new file mode 100644
index 000000000..9c1b7b92c
--- /dev/null
+++ b/etc/inc/whitelist-common.inc
@@ -0,0 +1,76 @@
1# Local customizations come here
2include whitelist-common.local
3
4# common whitelist for all profiles
5
6whitelist ${HOME}/.XCompose
7whitelist ${HOME}/.asoundrc
8whitelist ${HOME}/.config/ibus
9whitelist ${HOME}/.config/mimeapps.list
10whitelist ${HOME}/.config/pkcs11
11read-only ${HOME}/.config/pkcs11
12whitelist ${HOME}/.config/user-dirs.dirs
13read-only ${HOME}/.config/user-dirs.dirs
14whitelist ${HOME}/.drirc
15whitelist ${HOME}/.icons
16?HAS_APPIMAGE: whitelist ${HOME}/.local/share/appimagekit
17whitelist ${HOME}/.local/share/applications
18read-only ${HOME}/.local/share/applications
19whitelist ${HOME}/.local/share/icons
20whitelist ${HOME}/.local/share/mime
21whitelist ${HOME}/.mime.types
22
23# dconf
24mkdir ${HOME}/.config/dconf
25whitelist ${HOME}/.config/dconf
26
27# fonts
28whitelist ${HOME}/.cache/fontconfig
29whitelist ${HOME}/.config/fontconfig
30whitelist ${HOME}/.fontconfig
31whitelist ${HOME}/.fonts
32whitelist ${HOME}/.fonts.conf
33whitelist ${HOME}/.fonts.conf.d
34whitelist ${HOME}/.fonts.d
35whitelist ${HOME}/.local/share/fonts
36whitelist ${HOME}/.pangorc
37
38# gtk
39whitelist ${HOME}/.config/gtk-2.0
40whitelist ${HOME}/.config/gtk-3.0
41whitelist ${HOME}/.config/gtkrc
42whitelist ${HOME}/.config/gtkrc-2.0
43whitelist ${HOME}/.gnome2
44whitelist ${HOME}/.gnome2-private
45whitelist ${HOME}/.gtk-2.0
46whitelist ${HOME}/.gtkrc
47whitelist ${HOME}/.gtkrc-2.0
48whitelist ${HOME}/.kde/share/config/gtkrc
49whitelist ${HOME}/.kde/share/config/gtkrc-2.0
50whitelist ${HOME}/.kde4/share/config/gtkrc
51whitelist ${HOME}/.kde4/share/config/gtkrc-2.0
52whitelist ${HOME}/.local/share/themes
53whitelist ${HOME}/.themes
54
55# qt/kde
56whitelist ${HOME}/.cache/kioexec/krun
57whitelist ${HOME}/.config/Kvantum
58whitelist ${HOME}/.config/Trolltech.conf
59whitelist ${HOME}/.config/kdeglobals
60whitelist ${HOME}/.config/kio_httprc
61whitelist ${HOME}/.config/kioslaverc
62whitelist ${HOME}/.config/ksslcablacklist
63whitelist ${HOME}/.config/qt5ct
64whitelist ${HOME}/.kde/share/config/kdeglobals
65whitelist ${HOME}/.kde/share/config/kio_httprc
66whitelist ${HOME}/.kde/share/config/kioslaverc
67whitelist ${HOME}/.kde/share/config/ksslcablacklist
68whitelist ${HOME}/.kde/share/config/oxygenrc
69whitelist ${HOME}/.kde/share/icons
70whitelist ${HOME}/.kde4/share/config/kdeglobals
71whitelist ${HOME}/.kde4/share/config/kio_httprc
72whitelist ${HOME}/.kde4/share/config/kioslaverc
73whitelist ${HOME}/.kde4/share/config/ksslcablacklist
74whitelist ${HOME}/.kde4/share/config/oxygenrc
75whitelist ${HOME}/.kde4/share/icons
76whitelist ${HOME}/.local/share/qt5ct
diff --git a/etc/inc/whitelist-runuser-common.inc b/etc/inc/whitelist-runuser-common.inc
new file mode 100644
index 000000000..9ffd3d5be
--- /dev/null
+++ b/etc/inc/whitelist-runuser-common.inc
@@ -0,0 +1,11 @@
1# Local customizations come here
2include whitelist-runuser-common.local
3
4# common ${RUNUSER} (=/run/user/$UID) whitelist for all profiles
5
6whitelist ${RUNUSER}/bus
7whitelist ${RUNUSER}/dconf
8whitelist ${RUNUSER}/gdm/Xauthority
9whitelist ${RUNUSER}/.mutter-Xwaylandauth.*
10whitelist ${RUNUSER}/pulse/native
11whitelist ${RUNUSER}/wayland-0
diff --git a/etc/inc/whitelist-usr-share-common.inc b/etc/inc/whitelist-usr-share-common.inc
new file mode 100644
index 000000000..193b00a2a
--- /dev/null
+++ b/etc/inc/whitelist-usr-share-common.inc
@@ -0,0 +1,61 @@
1# Local customizations come here
2include whitelist-usr-share-common.local
3
4# common /usr/share whitelist for all profiles
5
6whitelist /usr/share/alsa
7whitelist /usr/share/applications
8whitelist /usr/share/ca-certificates
9whitelist /usr/share/crypto-policies
10whitelist /usr/share/cursors
11whitelist /usr/share/dconf
12whitelist /usr/share/distro-info
13whitelist /usr/share/drirc.d
14whitelist /usr/share/enchant
15whitelist /usr/share/enchant-2
16whitelist /usr/share/file
17whitelist /usr/share/fontconfig
18whitelist /usr/share/fonts
19whitelist /usr/share/gir-1.0
20whitelist /usr/share/gjs-1.0
21whitelist /usr/share/glib-2.0
22whitelist /usr/share/glvnd
23whitelist /usr/share/gtk-2.0
24whitelist /usr/share/gtk-3.0
25whitelist /usr/share/gtk-engines
26whitelist /usr/share/gtksourceview-3.0
27whitelist /usr/share/gtksourceview-4
28whitelist /usr/share/hunspell
29whitelist /usr/share/hwdata
30whitelist /usr/share/icons
31whitelist /usr/share/icu
32whitelist /usr/share/knotifications5
33whitelist /usr/share/kservices5
34whitelist /usr/share/Kvantum
35whitelist /usr/share/kxmlgui5
36whitelist /usr/share/libdrm
37whitelist /usr/share/libthai
38whitelist /usr/share/locale
39whitelist /usr/share/mime
40whitelist /usr/share/misc
41whitelist /usr/share/Modules
42whitelist /usr/share/myspell
43whitelist /usr/share/p11-kit
44whitelist /usr/share/pixmaps
45whitelist /usr/share/pki
46whitelist /usr/share/plasma
47whitelist /usr/share/publicsuffix
48whitelist /usr/share/qt
49whitelist /usr/share/qt4
50whitelist /usr/share/qt5
51whitelist /usr/share/sounds
52whitelist /usr/share/tcl8.6
53whitelist /usr/share/tcltk
54whitelist /usr/share/terminfo
55whitelist /usr/share/texlive
56whitelist /usr/share/texmf
57whitelist /usr/share/themes
58whitelist /usr/share/thumbnail.so
59whitelist /usr/share/X11
60whitelist /usr/share/xml
61whitelist /usr/share/zoneinfo
diff --git a/etc/inc/whitelist-var-common.inc b/etc/inc/whitelist-var-common.inc
new file mode 100644
index 000000000..e2210057b
--- /dev/null
+++ b/etc/inc/whitelist-var-common.inc
@@ -0,0 +1,11 @@
1# Local customizations come here
2include whitelist-var-common.local
3
4# common /var whitelist for all profiles
5
6whitelist /var/lib/dbus
7whitelist /var/lib/menu-xdg
8whitelist /var/cache/fontconfig
9whitelist /var/tmp
10whitelist /var/run
11whitelist /var/lock
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-06-26 08:45:41 +0000