Hardening compressors (#2594)

* Harden atool

* Harden cpio

* Fix ordering in private-* options

* Harden gzip

* Harden tar

* Harden bsdtar

* Harden+ tar

* Harden+ gzip

* Harden+ cpio

* Create bzip2.profile

* Description for bunzip2

* Add bzip2/bunzip2 to firecfg

1 files changed, 12 insertions, 1 deletions

diff --git a/etc/tar.profile b/etc/tar.profile
index e1cfe9c80..14fc00d21 100644
--- a/etc/tar.profile
+++ b/etc/tar.profile
@@ -10,12 +10,20 @@ include tar.local
 
 blacklist /tmp/.X11-unix
 
-hostname tar
+include disable-exec.inc
+include disable-interpreters.inc
+
 ignore noroot
+
+apparmor
+hostname tar
+ipc-namespace
+machine-id
 net none
 no3d
 nodbus
 nodvd
+nogroups
 nosound
 notv
 nou2f
@@ -25,10 +33,13 @@ tracelog
 
 # support compressed archives
 private-bin sh,bash,tar,gtar,compress,gzip,lzma,xz,bzip2,lbzip2,lzip,lzop
+private-cache
 private-dev
 private-etc alternatives,passwd,group,localtime
 private-lib libfakeroot
 
+memory-deny-write-execute
+
 # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic)
 writable-var