Refactor archivers ii (#3827)

* harden 7z.profile

* harden atool.profile

* harden bsdtar.profile

* harden cpio.profile

* harden gzip.profile

* harden tar.profile

* harden unrar.profile

* harden unzip.profile

* harden xzdec.profile

* harden zstd.profile

5 files changed, 3 insertions, 8 deletions

diff --git a/etc/profile-m-z/tar.profile b/etc/profile-m-z/tar.profile
index 2ddc82dbb..29fda7e45 100644
--- a/etc/profile-m-z/tar.profile
+++ b/etc/profile-m-z/tar.profile
@@ -10,12 +10,13 @@ include globals.local
 # Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only.
 noblacklist /var/lib/pacman
 
-ignore include disable-shell.inc
+noblacklist ${PATH}/bash
+noblacklist ${PATH}/sh
 include archiver-common.inc
 
 # support compressed archives
 private-bin awk,bash,bzip2,compress,firejail,grep,gtar,gzip,lbzip2,lzip,lzma,lzop,sh,tar,xz
 private-etc alternatives,group,localtime,login.defs,passwd
-private-lib libfakeroot
+private-lib libfakeroot,liblzma.so.*,libreadline.so.*
 # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic)
 writable-var
diff --git a/etc/profile-m-z/unrar.profile b/etc/profile-m-z/unrar.profile
index cbf0e8679..9487f8e68 100644
--- a/etc/profile-m-z/unrar.profile
+++ b/etc/profile-m-z/unrar.profile
@@ -7,8 +7,6 @@ include unrar.local
 # Persistent global definitions
 include globals.local
 
-ignore nogroups
-ignore private-cache
 include archiver-common.inc
 
 private-bin unrar
diff --git a/etc/profile-m-z/unzip.profile b/etc/profile-m-z/unzip.profile
index 30ee3ec12..be480923e 100644
--- a/etc/profile-m-z/unzip.profile
+++ b/etc/profile-m-z/unzip.profile
@@ -10,7 +10,6 @@ include globals.local
 # GNOME Shell integration (chrome-gnome-shell)
 noblacklist ${HOME}/.local/share/gnome-shell
 
-ignore nogroups
 noroot
 include archiver-common.inc
 
diff --git a/etc/profile-m-z/xzdec.profile b/etc/profile-m-z/xzdec.profile
index c21fe16cf..082392a08 100644
--- a/etc/profile-m-z/xzdec.profile
+++ b/etc/profile-m-z/xzdec.profile
@@ -7,6 +7,4 @@ include xzdec.local
 # Persistent global definitions
 include globals.local
 
-ignore include disable-shell.inc
-ignore nogroups
 include archiver-common.inc
diff --git a/etc/profile-m-z/zstd.profile b/etc/profile-m-z/zstd.profile
index 5ae38e633..42749ba6d 100644
--- a/etc/profile-m-z/zstd.profile
+++ b/etc/profile-m-z/zstd.profile
@@ -7,5 +7,4 @@ include zstd.local
 # Persistent global definitions
 include globals.local
 
-ignore include disable-shell.inc
 include archiver-common.inc