refactor nodejs applications (npm & yarn) (#3876)

* add yarn & reorder

* add node-gyp & yarn files

* Create nodejs-common.profile

* Create yarn.profile

* refactor npm.profile

* add new profile: yarn

* read-only's for npm/yarn

Thanks to the [suggestion](https://github.com/netblue30/firejail/pull/3876#pullrequestreview-564682989) from @kmk3.

* ignore read-only's for npm

As [suggested](https://github.com/netblue30/firejail/pull/3876#pullrequestreview-564682989) by @kmk3.

* ignore read-only for yarn

As suggested in https://github.com/netblue30/firejail/pull/3876#pullrequestreview-564682989 by @kmk3.

* remove quiet from nodejs-common.profile

quiet should go into the caller profiles instead

* add quiet to npm.profile

Thanks @rusty-snake for the review.

* re-ordering some options

* re-ordering

1 files changed, 9 insertions, 44 deletions

diff --git a/etc/profile-m-z/npm.profile b/etc/profile-m-z/npm.profile
index 2136fb443..e95e875be 100644
--- a/etc/profile-m-z/npm.profile
+++ b/etc/profile-m-z/npm.profile
@@ -1,64 +1,29 @@
 # Firejail profile for npm
 # Description: The Node.js Package Manager
+quiet
 # This file is overwritten after every install/update
 # Persistent local customizations
 include npm.local
 # Persistent global definitions
 include globals.local
 
-blacklist /tmp/.X11-unix
-blacklist ${RUNUSER}
+ignore read-only ${HOME}/.npm-packages
+ignore read-only ${HOME}/.npmrc
 
+noblacklist ${HOME}/.node-gyp
 noblacklist ${HOME}/.npm
 noblacklist ${HOME}/.npmrc
 
-noblacklist ${PATH}/bash
-noblacklist ${PATH}/dash
-noblacklist ${PATH}/sh
-
-ignore noexec ${HOME}
-
-include disable-common.inc
-include disable-exec.inc
-include disable-passwdmgr.inc
-include disable-programs.inc
-include disable-shell.inc
-include disable-xdg.inc
-
-# If you want whitelisting, change the line below to your npm projects directory
+# If you want whitelisting, change ${HOME}/Projects below to your npm projects directory
 # and uncomment the lines below.
+#mkdir ${HOME}/.node-gyp
 #mkdir ${HOME}/.npm
 #mkfile ${HOME}/.npmrc
+#whitelist ${HOME}/.node-gyp
 #whitelist ${HOME}/.npm
 #whitelist ${HOME}/.npmrc
 #whitelist ${HOME}/Projects
 #include whitelist-common.inc
-include whitelist-runuser-common.inc
-include whitelist-usr-share-common.inc
-include whitelist-var-common.inc
-
-caps.drop all
-ipc-namespace
-machine-id
-netfilter
-no3d
-nodvd
-nogroups
-nonewprivs
-noroot
-nosound
-notv
-nou2f
-novideo
-protocol unix,inet,inet6,netlink
-seccomp
-seccomp.block-secondary
-shell none
-
-disable-mnt
-private-dev
-private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,xdg
-private-tmp
 
-dbus-user none
-dbus-system none
+# Redirect
+include nodejs-common.profile