Refactor archivers ii (#3827)

* harden 7z.profile

* harden atool.profile

* harden bsdtar.profile

* harden cpio.profile

* harden gzip.profile

* harden tar.profile

* harden unrar.profile

* harden unzip.profile

* harden xzdec.profile

* harden zstd.profile

5 files changed, 5 insertions, 12 deletions

diff --git a/etc/profile-a-l/7z.profile b/etc/profile-a-l/7z.profile
index c7bed93ce..4f9e72a79 100644
--- a/etc/profile-a-l/7z.profile
+++ b/etc/profile-a-l/7z.profile
@@ -7,8 +7,8 @@ include 7z.local
 # Persistent global definitions
 include globals.local
 
-ignore include disable-shell.inc
-ignore nogroups
+noblacklist ${PATH}/bash
+noblacklist ${PATH}/sh
 include archiver-common.inc
 
-#private-bin 7z,7z*,p7zip
+private-bin 7z,7z*,bash,p7zip,sh
diff --git a/etc/profile-a-l/atool.profile b/etc/profile-a-l/atool.profile
index d8b6bbaaf..34af47df2 100644
--- a/etc/profile-a-l/atool.profile
+++ b/etc/profile-a-l/atool.profile
@@ -9,13 +9,10 @@ include globals.local
 
 # Allow perl (blacklisted by disable-interpreters.inc)
 include allow-perl.inc
-ignore include disable-devel.inc
-ignore include disable-shell.inc
 include archiver-common.inc
 
 noroot
 
-# private-bin atool,perl
 # without login.defs atool complains and uses UID/GID 1000 by default
 private-etc alternatives,group,login.defs,passwd
 private-tmp
diff --git a/etc/profile-a-l/bsdtar.profile b/etc/profile-a-l/bsdtar.profile
index 75e13e7e8..f2116f4ab 100644
--- a/etc/profile-a-l/bsdtar.profile
+++ b/etc/profile-a-l/bsdtar.profile
@@ -6,8 +6,6 @@ include bsdtar.local
 # Persistent global definitions
 include globals.local
 
-ignore include disable-devel.inc
-ignore include disable-shell.inc
 include archiver-common.inc
 
 # support compressed archives
diff --git a/etc/profile-a-l/cpio.profile b/etc/profile-a-l/cpio.profile
index 5e01952b4..785308ffd 100644
--- a/etc/profile-a-l/cpio.profile
+++ b/etc/profile-a-l/cpio.profile
@@ -10,7 +10,4 @@ include globals.local
 noblacklist /sbin
 noblacklist /usr/sbin
 
-ignore include disable-devel.inc
-ignore include disable-interpreters.inc
-ignore include disable-shell.inc
 include archiver-common.inc
diff --git a/etc/profile-a-l/gzip.profile b/etc/profile-a-l/gzip.profile
index 96c1743e3..78ecf5116 100644
--- a/etc/profile-a-l/gzip.profile
+++ b/etc/profile-a-l/gzip.profile
@@ -10,5 +10,6 @@ include globals.local
 # Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only.
 noblacklist /var/lib/pacman
 
-ignore include disable-shell.inc
 include archiver-common.inc
+
+private-bin gunzip,gzexe,gzip,uncompress,zcat,zcmp,zdiff,zegrep,zfgrep,zforce,zgrep,zless,zmore,znew