clipit hardening (#5521)

* clipit hardening

* clipit: fix hardening

* clipit: add xdotool lib to private-lib

1 files changed, 14 insertions, 0 deletions

diff --git a/etc/profile-a-l/clipit.profile b/etc/profile-a-l/clipit.profile
index ef1800aaa..0356547cd 100644
--- a/etc/profile-a-l/clipit.profile
+++ b/etc/profile-a-l/clipit.profile
@@ -13,7 +13,9 @@ include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
 include disable-interpreters.inc
+include disable-proc.inc
 include disable-programs.inc
+include disable-shell.inc
 include disable-xdg.inc
 
 mkdir ${HOME}/.config/clipit
@@ -21,6 +23,8 @@ mkdir ${HOME}/.local/share/clipit
 whitelist ${HOME}/.config/clipit
 whitelist ${HOME}/.local/share/clipit
 include whitelist-common.inc
+include whitelist-run-common.inc
+include whitelist-runuser-common.inc
 include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
@@ -34,6 +38,7 @@ nodvd
 nogroups
 noinput
 nonewprivs
+noprinters
 noroot
 nosound
 notv
@@ -41,9 +46,18 @@ nou2f
 novideo
 protocol unix
 seccomp
+tracelog
 
 disable-mnt
+private-bin clipit,xdotool
 private-cache
 private-dev
+private-lib libxdo.so.*
 private-tmp
 
+dbus-user none
+dbus-system none
+
+#memory-deny-write-execute
+restrict-namespaces
+read-only ${HOME}