Harden profiles

- Added 'disable-devel.conf' to many profiles
- Added 'disable-mnt' to many profiles
- Added 'noexec' to many profiles
- Removed 'netfilter' and 'net none' from profiles with 'protocol unix'
- Cleaned up profiles using defaults

1 files changed, 19 insertions, 1 deletions

diff --git a/etc/liferea.profile b/etc/liferea.profile
index 92b3b8f88..f11137cdd 100644
--- a/etc/liferea.profile
+++ b/etc/liferea.profile
@@ -20,10 +20,28 @@ noblacklist ~/.cache/liferea
 mkdir ~/.cache/liferea
 whitelist ~/.cache/liferea
 
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-common.inc
-include /etc/firejail/default.profile
 
+caps.drop all
+#ipc-namespace
+netfilter
+#no3d
 nogroups
+nonewprivs
+noroot
+#nosound
+novideo
+protocol unix,inet,inet6
+seccomp
 shell none
+
 private-dev
 private-tmp
+disable-mnt
+
+noexec ${HOME}
+noexec /tmp