diff options
author | 2023-10-18 22:47:07 +0000 | |
---|---|---|
committer | 2023-10-18 22:47:07 +0000 | |
commit | 17590553045f40e8c7628608c8330b72412fd7f4 (patch) | |
tree | a1c5d0888101865866492269f5f194ce0ecffc3c /etc/profile-m-z | |
parent | steam.profile: Allow Baba Is You (#6054) (diff) | |
download | firejail-17590553045f40e8c7628608c8330b72412fd7f4.tar.gz firejail-17590553045f40e8c7628608c8330b72412fd7f4.tar.zst firejail-17590553045f40e8c7628608c8330b72412fd7f4.zip |
profiles: exchange private-opt with a whitelist (#6021)
* profiles: drop private-opt (existing whitelist)
* profiles: replace private-opt with whitelist
In most profiles.
Kept private-opt for enpass (~85MB), mate-dictionary (<20MB),
minecraft-launcher (~1.6MB) and ppsspp (~44MB). The only app I couldn't
check: xmr-stak.
* docs: note potential issues with private-opt
Diffstat (limited to 'etc/profile-m-z')
-rw-r--r-- | etc/profile-m-z/microsoft-edge-beta.profile | 3 | ||||
-rw-r--r-- | etc/profile-m-z/mullvad-browser.profile | 1 | ||||
-rw-r--r-- | etc/profile-m-z/notable.profile | 3 | ||||
-rw-r--r-- | etc/profile-m-z/nuclear.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/ocenaudio.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/palemoon.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/spotify.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/thunderbird-beta.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/torbrowser-launcher.profile | 1 | ||||
-rw-r--r-- | etc/profile-m-z/tutanota-desktop.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/twitch.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/xmr-stak.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/youtube.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/youtubemusic-nativefier.profile | 2 |
14 files changed, 12 insertions, 16 deletions
diff --git a/etc/profile-m-z/microsoft-edge-beta.profile b/etc/profile-m-z/microsoft-edge-beta.profile index 6843c11c7..e07bbe6e5 100644 --- a/etc/profile-m-z/microsoft-edge-beta.profile +++ b/etc/profile-m-z/microsoft-edge-beta.profile | |||
@@ -14,10 +14,7 @@ mkdir ${HOME}/.cache/microsoft-edge-beta | |||
14 | mkdir ${HOME}/.config/microsoft-edge-beta | 14 | mkdir ${HOME}/.config/microsoft-edge-beta |
15 | whitelist ${HOME}/.cache/microsoft-edge-beta | 15 | whitelist ${HOME}/.cache/microsoft-edge-beta |
16 | whitelist ${HOME}/.config/microsoft-edge-beta | 16 | whitelist ${HOME}/.config/microsoft-edge-beta |
17 | |||
18 | whitelist /opt/microsoft/msedge-beta | 17 | whitelist /opt/microsoft/msedge-beta |
19 | # private-opt might break the file-copy-limit, see #5307 | ||
20 | #private-opt microsoft | ||
21 | 18 | ||
22 | # Redirect | 19 | # Redirect |
23 | include chromium-common.profile | 20 | include chromium-common.profile |
diff --git a/etc/profile-m-z/mullvad-browser.profile b/etc/profile-m-z/mullvad-browser.profile index cdbb0ae9c..6706386aa 100644 --- a/etc/profile-m-z/mullvad-browser.profile +++ b/etc/profile-m-z/mullvad-browser.profile | |||
@@ -79,7 +79,6 @@ disable-mnt | |||
79 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mullvad-browser,mv,python*,rm,sed,sh,tail,tar,tclsh,test,update-desktop-database,xmessage,xz,zenity | 79 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mullvad-browser,mv,python*,rm,sed,sh,tail,tar,tclsh,test,update-desktop-database,xmessage,xz,zenity |
80 | private-dev | 80 | private-dev |
81 | private-etc @tls-ca | 81 | private-etc @tls-ca |
82 | #private-opt mullvad-browser # can cause slow startup | ||
83 | private-tmp | 82 | private-tmp |
84 | 83 | ||
85 | blacklist ${PATH}/curl | 84 | blacklist ${PATH}/curl |
diff --git a/etc/profile-m-z/notable.profile b/etc/profile-m-z/notable.profile index 9fbbf94c0..4bd3d45ac 100644 --- a/etc/profile-m-z/notable.profile +++ b/etc/profile-m-z/notable.profile | |||
@@ -14,11 +14,12 @@ include globals.local | |||
14 | noblacklist ${HOME}/.config/Notable | 14 | noblacklist ${HOME}/.config/Notable |
15 | noblacklist ${HOME}/.notable | 15 | noblacklist ${HOME}/.notable |
16 | 16 | ||
17 | whitelist /opt/Notable | ||
18 | |||
17 | net none | 19 | net none |
18 | nosound | 20 | nosound |
19 | 21 | ||
20 | ?HAS_APPIMAGE: ignore private-dev | 22 | ?HAS_APPIMAGE: ignore private-dev |
21 | private-opt Notable | ||
22 | 23 | ||
23 | dbus-user filter | 24 | dbus-user filter |
24 | dbus-user.talk ca.desrt.dconf | 25 | dbus-user.talk ca.desrt.dconf |
diff --git a/etc/profile-m-z/nuclear.profile b/etc/profile-m-z/nuclear.profile index 57fba2693..6d1e3cd8a 100644 --- a/etc/profile-m-z/nuclear.profile +++ b/etc/profile-m-z/nuclear.profile | |||
@@ -14,12 +14,12 @@ include disable-shell.inc | |||
14 | 14 | ||
15 | mkdir ${HOME}/.config/nuclear | 15 | mkdir ${HOME}/.config/nuclear |
16 | whitelist ${HOME}/.config/nuclear | 16 | whitelist ${HOME}/.config/nuclear |
17 | whitelist /opt/nuclear | ||
17 | 18 | ||
18 | no3d | 19 | no3d |
19 | 20 | ||
20 | #private-bin nuclear | 21 | #private-bin nuclear |
21 | private-etc @tls-ca,@x11,host.conf,mime.types | 22 | private-etc @tls-ca,@x11,host.conf,mime.types |
22 | private-opt nuclear | ||
23 | 23 | ||
24 | # Redirect | 24 | # Redirect |
25 | include electron-common.profile | 25 | include electron-common.profile |
diff --git a/etc/profile-m-z/ocenaudio.profile b/etc/profile-m-z/ocenaudio.profile index 830483bd4..3fe5a4712 100644 --- a/etc/profile-m-z/ocenaudio.profile +++ b/etc/profile-m-z/ocenaudio.profile | |||
@@ -25,6 +25,7 @@ whitelist ${HOME}/.cache/ocenaudio | |||
25 | whitelist ${HOME}/.local/share/ocenaudio | 25 | whitelist ${HOME}/.local/share/ocenaudio |
26 | whitelist ${DOWNLOADS} | 26 | whitelist ${DOWNLOADS} |
27 | whitelist ${MUSIC} | 27 | whitelist ${MUSIC} |
28 | whitelist /opt/ocenaudio | ||
28 | include whitelist-common.inc | 29 | include whitelist-common.inc |
29 | include whitelist-run-common.inc | 30 | include whitelist-run-common.inc |
30 | include whitelist-runuser-common.inc | 31 | include whitelist-runuser-common.inc |
@@ -54,7 +55,6 @@ private-bin ocenaudio,ocenvst | |||
54 | private-cache | 55 | private-cache |
55 | private-dev | 56 | private-dev |
56 | private-etc @tls-ca,@x11,mime.types | 57 | private-etc @tls-ca,@x11,mime.types |
57 | private-opt ocenaudio | ||
58 | private-tmp | 58 | private-tmp |
59 | 59 | ||
60 | dbus-user none | 60 | dbus-user none |
diff --git a/etc/profile-m-z/palemoon.profile b/etc/profile-m-z/palemoon.profile index ab4e24595..8917a9bc5 100644 --- a/etc/profile-m-z/palemoon.profile +++ b/etc/profile-m-z/palemoon.profile | |||
@@ -12,6 +12,7 @@ mkdir ${HOME}/.cache/moonchild productions/pale moon | |||
12 | mkdir ${HOME}/.moonchild productions | 12 | mkdir ${HOME}/.moonchild productions |
13 | whitelist ${HOME}/.cache/moonchild productions/pale moon | 13 | whitelist ${HOME}/.cache/moonchild productions/pale moon |
14 | whitelist ${HOME}/.moonchild productions | 14 | whitelist ${HOME}/.moonchild productions |
15 | whitelist /opt/palemoon | ||
15 | whitelist /usr/share/moonchild productions | 16 | whitelist /usr/share/moonchild productions |
16 | whitelist /usr/share/palemoon | 17 | whitelist /usr/share/palemoon |
17 | 18 | ||
@@ -22,7 +23,6 @@ ignore seccomp | |||
22 | #private-bin palemoon | 23 | #private-bin palemoon |
23 | # private-etc must first be enabled in firefox-common.profile | 24 | # private-etc must first be enabled in firefox-common.profile |
24 | #private-etc palemoon | 25 | #private-etc palemoon |
25 | #private-opt palemoon | ||
26 | 26 | ||
27 | restrict-namespaces | 27 | restrict-namespaces |
28 | ignore restrict-namespaces | 28 | ignore restrict-namespaces |
diff --git a/etc/profile-m-z/spotify.profile b/etc/profile-m-z/spotify.profile index c893a92fb..63c2c5086 100644 --- a/etc/profile-m-z/spotify.profile +++ b/etc/profile-m-z/spotify.profile | |||
@@ -26,6 +26,7 @@ whitelist ${HOME}/.cache/spotify | |||
26 | whitelist ${HOME}/.config/spotify | 26 | whitelist ${HOME}/.config/spotify |
27 | whitelist ${HOME}/.config/spotify-adblock | 27 | whitelist ${HOME}/.config/spotify-adblock |
28 | whitelist ${HOME}/.local/share/spotify | 28 | whitelist ${HOME}/.local/share/spotify |
29 | whitelist /opt/spotify | ||
29 | include whitelist-common.inc | 30 | include whitelist-common.inc |
30 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
31 | 32 | ||
@@ -48,7 +49,6 @@ private-bin bash,cat,dirname,find,grep,head,rm,sh,spotify,tclsh,touch,zenity | |||
48 | private-dev | 49 | private-dev |
49 | # If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local. | 50 | # If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local. |
50 | private-etc @tls-ca,host.conf,spotify-adblock | 51 | private-etc @tls-ca,host.conf,spotify-adblock |
51 | private-opt spotify | ||
52 | private-srv none | 52 | private-srv none |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
diff --git a/etc/profile-m-z/thunderbird-beta.profile b/etc/profile-m-z/thunderbird-beta.profile index 46a1e57c8..e01a9d2d8 100644 --- a/etc/profile-m-z/thunderbird-beta.profile +++ b/etc/profile-m-z/thunderbird-beta.profile | |||
@@ -6,7 +6,7 @@ include thunderbird-beta.local | |||
6 | # added by included profile | 6 | # added by included profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | private-opt thunderbird-beta | 9 | whitelist /opt/thunderbird-beta |
10 | 10 | ||
11 | # Redirect | 11 | # Redirect |
12 | include thunderbird.profile | 12 | include thunderbird.profile |
diff --git a/etc/profile-m-z/torbrowser-launcher.profile b/etc/profile-m-z/torbrowser-launcher.profile index 20ebddb69..b9fdcf92c 100644 --- a/etc/profile-m-z/torbrowser-launcher.profile +++ b/etc/profile-m-z/torbrowser-launcher.profile | |||
@@ -62,7 +62,6 @@ disable-mnt | |||
62 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mv,python*,rm,sed,sh,tail,tar,tclsh,test,tor-browser,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity | 62 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mv,python*,rm,sed,sh,tail,tar,tclsh,test,tor-browser,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity |
63 | private-dev | 63 | private-dev |
64 | private-etc @tls-ca | 64 | private-etc @tls-ca |
65 | #private-opt tor-browser # can cause slow startup | ||
66 | private-tmp | 65 | private-tmp |
67 | 66 | ||
68 | dbus-user none | 67 | dbus-user none |
diff --git a/etc/profile-m-z/tutanota-desktop.profile b/etc/profile-m-z/tutanota-desktop.profile index 55e4a4392..f0a0cacaf 100644 --- a/etc/profile-m-z/tutanota-desktop.profile +++ b/etc/profile-m-z/tutanota-desktop.profile | |||
@@ -22,6 +22,7 @@ mkdir ${HOME}/.config/tuta_integration | |||
22 | mkdir ${HOME}/.config/tutanota-desktop | 22 | mkdir ${HOME}/.config/tutanota-desktop |
23 | whitelist ${HOME}/.config/tuta_integration | 23 | whitelist ${HOME}/.config/tuta_integration |
24 | whitelist ${HOME}/.config/tutanota-desktop | 24 | whitelist ${HOME}/.config/tutanota-desktop |
25 | whitelist /opt/tutanota-desktop | ||
25 | 26 | ||
26 | # The lines below are needed to find the default Firefox profile name, to allow | 27 | # The lines below are needed to find the default Firefox profile name, to allow |
27 | # opening links in an existing instance of Firefox (note that it still fails if | 28 | # opening links in an existing instance of Firefox (note that it still fails if |
@@ -34,7 +35,6 @@ nosound | |||
34 | 35 | ||
35 | ?HAS_APPIMAGE: ignore private-dev | 36 | ?HAS_APPIMAGE: ignore private-dev |
36 | private-etc @tls-ca | 37 | private-etc @tls-ca |
37 | private-opt tutanota-desktop | ||
38 | 38 | ||
39 | dbus-user filter | 39 | dbus-user filter |
40 | dbus-user.talk org.freedesktop.Notifications | 40 | dbus-user.talk org.freedesktop.Notifications |
diff --git a/etc/profile-m-z/twitch.profile b/etc/profile-m-z/twitch.profile index e2b8de12b..55106d622 100644 --- a/etc/profile-m-z/twitch.profile +++ b/etc/profile-m-z/twitch.profile | |||
@@ -16,10 +16,10 @@ include disable-shell.inc | |||
16 | 16 | ||
17 | mkdir ${HOME}/.config/Twitch | 17 | mkdir ${HOME}/.config/Twitch |
18 | whitelist ${HOME}/.config/Twitch | 18 | whitelist ${HOME}/.config/Twitch |
19 | whitelist /opt/Twitch | ||
19 | 20 | ||
20 | private-bin electron,electron[0-9],electron[0-9][0-9],twitch | 21 | private-bin electron,electron[0-9],electron[0-9][0-9],twitch |
21 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types | 22 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types |
22 | private-opt Twitch | ||
23 | 23 | ||
24 | # Redirect | 24 | # Redirect |
25 | include electron-common.profile | 25 | include electron-common.profile |
diff --git a/etc/profile-m-z/xmr-stak.profile b/etc/profile-m-z/xmr-stak.profile index b8bf0ae96..06f0b5833 100644 --- a/etc/profile-m-z/xmr-stak.profile +++ b/etc/profile-m-z/xmr-stak.profile | |||
@@ -16,6 +16,7 @@ include disable-shell.inc | |||
16 | include disable-xdg.inc | 16 | include disable-xdg.inc |
17 | 17 | ||
18 | mkdir ${HOME}/.xmr-stak | 18 | mkdir ${HOME}/.xmr-stak |
19 | whitelist /opt/cuda | ||
19 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
20 | 21 | ||
21 | caps.drop all | 22 | caps.drop all |
@@ -39,7 +40,6 @@ private-bin xmr-stak | |||
39 | private-dev | 40 | private-dev |
40 | private-etc @tls-ca | 41 | private-etc @tls-ca |
41 | #private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend | 42 | #private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend |
42 | private-opt cuda | ||
43 | private-tmp | 43 | private-tmp |
44 | 44 | ||
45 | memory-deny-write-execute | 45 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/youtube.profile b/etc/profile-m-z/youtube.profile index bee309986..0fb87f747 100644 --- a/etc/profile-m-z/youtube.profile +++ b/etc/profile-m-z/youtube.profile | |||
@@ -15,10 +15,10 @@ include disable-shell.inc | |||
15 | 15 | ||
16 | mkdir ${HOME}/.config/Youtube | 16 | mkdir ${HOME}/.config/Youtube |
17 | whitelist ${HOME}/.config/Youtube | 17 | whitelist ${HOME}/.config/Youtube |
18 | whitelist /opt/Youtube | ||
18 | 19 | ||
19 | private-bin electron,electron[0-9],electron[0-9][0-9],youtube | 20 | private-bin electron,electron[0-9],electron[0-9][0-9],youtube |
20 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types | 21 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types |
21 | private-opt Youtube | ||
22 | 22 | ||
23 | # Redirect | 23 | # Redirect |
24 | include electron-common.profile | 24 | include electron-common.profile |
diff --git a/etc/profile-m-z/youtubemusic-nativefier.profile b/etc/profile-m-z/youtubemusic-nativefier.profile index e98d84329..e5ece41bc 100644 --- a/etc/profile-m-z/youtubemusic-nativefier.profile +++ b/etc/profile-m-z/youtubemusic-nativefier.profile | |||
@@ -12,10 +12,10 @@ include disable-shell.inc | |||
12 | 12 | ||
13 | mkdir ${HOME}/.config/youtubemusic-nativefier-040164 | 13 | mkdir ${HOME}/.config/youtubemusic-nativefier-040164 |
14 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 | 14 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 |
15 | whitelist /opt/youtubemusic-nativefier | ||
15 | 16 | ||
16 | private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier | 17 | private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier |
17 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types | 18 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types |
18 | private-opt youtubemusic-nativefier | ||
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
21 | include electron-common.profile | 21 | include electron-common.profile |