profiles: blacklist i3 IPC socket & dir except for i3 itself (#6361)

This closes the escape route discussed in #6357.

It's left open for i3's own profile, so that people who run i3 itself
sandboxed still have the option to use IPC with it at all.

Reference for file paths:
https://i3wm.org/docs/userguide.html#_interprocess_communication

1 files changed, 4 insertions, 0 deletions

diff --git a/etc/profile-a-l/i3.profile b/etc/profile-a-l/i3.profile
index 2268072ef..412e31762 100644
--- a/etc/profile-a-l/i3.profile
+++ b/etc/profile-a-l/i3.profile
@@ -8,6 +8,10 @@ include globals.local
 
 # all applications started in i3 will run in this profile
 noblacklist ${HOME}/.config/i3
+noblacklist ${RUNUSER}/i3
+noblacklist ${RUNUSER}/i3/ipc-socket.*
+noblacklist /tmp/i3-*
+noblacklist /tmp/i3-*/ipc-socket.*
 include disable-common.inc
 
 caps.drop all