Add profiles for build-systems (/package-managers)

Profiles: bunler, cargo (refactor), cmake (untested), make, meson, pip
All redirect to build-systems-common.profile

Other fixes:
 - blacklist ${HOME}/.bundle
 - blacklist ${HOME}/.cargo/* -> blacklist ${HOME}/.cargo
 - blacklist /usr/lib64/ruby

3 files changed, 49 insertions, 0 deletions

diff --git a/etc/profile-m-z/make.profile b/etc/profile-m-z/make.profile
new file mode 100644
index 000000000..7e9638fe4
--- /dev/null
+++ b/etc/profile-m-z/make.profile
@@ -0,0 +1,13 @@
+# Firejail profile for make
+# Description: GNU make utility to maintain groups of programs
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include make.local
+# Persistent global definitions
+include globals.local
+
+memory-deny-write-execute
+
+# Redirect
+include build-systems-common.profile
diff --git a/etc/profile-m-z/meson.profile b/etc/profile-m-z/meson.profile
new file mode 100644
index 000000000..43109e771
--- /dev/null
+++ b/etc/profile-m-z/meson.profile
@@ -0,0 +1,16 @@
+# Firejail profile for meson
+# Description: A high productivity build system
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include meson.local
+# Persistent global definitions
+include globals.local
+
+# Allow python3 (blacklisted by disable-interpreters.inc)
+include allow-python3.inc
+
+private-bin meson,python3*
+
+# Redirect
+include build-systems-common.profile
diff --git a/etc/profile-m-z/pip.profile b/etc/profile-m-z/pip.profile
new file mode 100644
index 000000000..54d95e335
--- /dev/null
+++ b/etc/profile-m-z/pip.profile
@@ -0,0 +1,20 @@
+# Firejail profile for pip
+# Description: package manager for Python packages
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include meson.local
+# Persistent global definitions
+include globals.local
+
+ignore read-only ${HOME}/.local/lib
+
+# Allow python3 (blacklisted by disable-interpreters.inc)
+include allow-python3.inc
+
+whitelist ${HOME}/.local/lib/python*
+
+private-bin pip,pip[0-9].[0-9],pip[0-9].[0-9],python3*
+
+# Redirect
+include build-systems-common.profile