Merge branch 'master' of https://github.com/netblue30/firejail

100 files changed, 1300 insertions, 10 deletions

diff --git a/etc/2048-qt.profile b/etc/2048-qt.profile
index 06cc69503..964a9e5fa 100644
--- a/etc/2048-qt.profile
+++ b/etc/2048-qt.profile
@@ -13,6 +13,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nodvd
diff --git a/etc/Natron.profile b/etc/Natron.profile
new file mode 100644
index 000000000..b21790fe4
--- /dev/null
+++ b/etc/Natron.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for natron
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/natron.profile
diff --git a/etc/Viber.profile b/etc/Viber.profile
new file mode 100644
index 000000000..03e5f1086
--- /dev/null
+++ b/etc/Viber.profile
@@ -0,0 +1,38 @@
+# Firejail profile for Viber
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/Viber.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.ViberPC
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+whitelist ${DOWNLOADS}
+whitelist ${HOME}/.ViberPC
+include /etc/firejail/whitelist-common.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+protocol unix,inet,inet6
+seccomp
+shell none
+
+disable-mnt
+private-bin sh,bash,dash,dig,awk,Viber
+private-etc hosts,fonts,mailcap,resolv.conf,X11,pulse,alternatives,localtime,nsswitch.conf,ssl,proxychains.conf
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/akregator.profile b/etc/akregator.profile
index 12bb06fb5..55434e45b 100644
--- a/etc/akregator.profile
+++ b/etc/akregator.profile
@@ -13,6 +13,12 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+mkfile ${HOME}/.config/akregatorrc
+mkdir ${HOME}/.local/share/akregator
+whitelist ${HOME}/.config/akregatorrc
+whitelist ${HOME}/.local/share/akregator
+include /etc/firejail/whitelist-common.inc
+
 caps.drop all
 netfilter
 no3d
@@ -27,6 +33,7 @@ seccomp
 shell none
 
 disable-mnt
+private-bin akregator,akregatorstorageexporter,dbus-launch,kdeinit5,kshell5,kdeinit5_shutdown,kdeinit5_wrapper,kdeinit4,kshell4,kdeinit4_shutdown,kdeinit4_wrapper
 private-dev
 private-tmp
 
diff --git a/etc/amarok.profile b/etc/amarok.profile
index 478d5285c..79343fcdf 100644
--- a/etc/amarok.profile
+++ b/etc/amarok.profile
@@ -11,6 +11,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nogroups
diff --git a/etc/amule.profile b/etc/amule.profile
new file mode 100644
index 000000000..98ec52015
--- /dev/null
+++ b/etc/amule.profile
@@ -0,0 +1,40 @@
+# Firejail profile for amule
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/amule.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.aMule
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+whitelist ${DOWNLOADS}
+whitelist ${HOME}/.aMule
+include /etc/firejail/whitelist-common.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+private-bin amule
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/ardour4.profile b/etc/ardour4.profile
new file mode 100644
index 000000000..7d1163174
--- /dev/null
+++ b/etc/ardour4.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for ardour5
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/ardour5.profile
diff --git a/etc/ardour5.profile b/etc/ardour5.profile
new file mode 100644
index 000000000..69b3dde46
--- /dev/null
+++ b/etc/ardour5.profile
@@ -0,0 +1,37 @@
+# Firejail profile for ardour5
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/ardour5.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.config/ardour4
+noblacklist ${HOME}/.config/ardour5
+noblacklist ${HOME}/.lv2
+noblacklist ${HOME}/.vst
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+net none
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+protocol unix
+seccomp
+shell none
+
+#private-bin sh,ardour4,ardour5,ardour5-copy-mixer,ardour5-export,ardour5-fix_bbtppq,grep,sed,ldd,nm
+private-dev
+#private-etc pulse,X11,alternatives,ardour4,ardour5,fonts
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/audacious.profile b/etc/audacious.profile
index bd2367fe0..52e701821 100644
--- a/etc/audacious.profile
+++ b/etc/audacious.profile
@@ -15,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nogroups
 nonewprivs
 noroot
 notv
diff --git a/etc/brackets.profile b/etc/brackets.profile
new file mode 100644
index 000000000..0a8c592a7
--- /dev/null
+++ b/etc/brackets.profile
@@ -0,0 +1,29 @@
+# Firejail profile for brackets
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/brackets.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+noblacklist ${HOME}/.config/Brackets
+noblacklist /opt/brackets/
+noblacklist /opt/google/
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+netfilter
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+private-dev
diff --git a/etc/calibre.profile b/etc/calibre.profile
index aa0de473c..844231032 100644
--- a/etc/calibre.profile
+++ b/etc/calibre.profile
@@ -13,6 +13,8 @@ include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 no3d
diff --git a/etc/calligra.profile b/etc/calligra.profile
new file mode 100644
index 000000000..e90c8efe8
--- /dev/null
+++ b/etc/calligra.profile
@@ -0,0 +1,29 @@
+# Firejail profile for calligra
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/calligra.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+novideo
+protocol unix
+seccomp
+shell none
+
+private-bin calligra,calligraauthor,calligraconverter,calligraflow,calligraplan,calligraplanwork,calligrasheets,calligrastage,calligrawords,dbus-launch
+private-dev
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/calligraauthor.profile b/etc/calligraauthor.profile
new file mode 100644
index 000000000..629ab46c1
--- /dev/null
+++ b/etc/calligraauthor.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for calligra
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/calligra.profile
diff --git a/etc/calligraconverter.profile b/etc/calligraconverter.profile
new file mode 100644
index 000000000..629ab46c1
--- /dev/null
+++ b/etc/calligraconverter.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for calligra
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/calligra.profile
diff --git a/etc/calligraflow.profile b/etc/calligraflow.profile
new file mode 100644
index 000000000..629ab46c1
--- /dev/null
+++ b/etc/calligraflow.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for calligra
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/calligra.profile
diff --git a/etc/calligraplan.profile b/etc/calligraplan.profile
new file mode 100644
index 000000000..629ab46c1
--- /dev/null
+++ b/etc/calligraplan.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for calligra
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/calligra.profile
diff --git a/etc/calligraplanwork.profile b/etc/calligraplanwork.profile
new file mode 100644
index 000000000..629ab46c1
--- /dev/null
+++ b/etc/calligraplanwork.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for calligra
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/calligra.profile
diff --git a/etc/calligrasheets.profile b/etc/calligrasheets.profile
new file mode 100644
index 000000000..629ab46c1
--- /dev/null
+++ b/etc/calligrasheets.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for calligra
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/calligra.profile
diff --git a/etc/calligrastage.profile b/etc/calligrastage.profile
new file mode 100644
index 000000000..629ab46c1
--- /dev/null
+++ b/etc/calligrastage.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for calligra
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/calligra.profile
diff --git a/etc/calligrawords.profile b/etc/calligrawords.profile
new file mode 100644
index 000000000..629ab46c1
--- /dev/null
+++ b/etc/calligrawords.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for calligra
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/calligra.profile
diff --git a/etc/catfish.profile b/etc/catfish.profile
index 498f3b6ee..5fc585d90 100644
--- a/etc/catfish.profile
+++ b/etc/catfish.profile
@@ -8,8 +8,13 @@ include /etc/firejail/globals.local
 # We can't blacklist much since catfish
 # is for finding files/content
 noblacklist ~/.config/catfish
+include /etc/firejail/disable-common.inc
+# include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
 
-include /etc/firejail/disable-devel.inc
+whitelist /var/lib/mlocate
+include /etc/firejail/whitelist-var-common.inc
 
 caps.drop all
 net none
diff --git a/etc/chromium.profile b/etc/chromium.profile
index 9be99e68a..0c7058a11 100644
--- a/etc/chromium.profile
+++ b/etc/chromium.profile
@@ -23,6 +23,7 @@ whitelist ~/.config/chromium
 whitelist ~/.config/chromium-flags.conf
 whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
+include /etc/firejail/whitelist-var-common.inc
 
 caps.keep sys_chroot,sys_admin
 netfilter
diff --git a/etc/cin.profile b/etc/cin.profile
new file mode 100644
index 000000000..eeeda476f
--- /dev/null
+++ b/etc/cin.profile
@@ -0,0 +1,31 @@
+# Firejail profile for cin
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/cin.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+noblacklist ${HOME}/.bcast5
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+net none
+nodvd
+nogroups
+nonewprivs
+notv
+noroot
+protocol unix
+seccomp
+shell none
+
+#private-bin cin
+private-dev
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/clamav.profile b/etc/clamav.profile
new file mode 100644
index 000000000..a5aacc1d5
--- /dev/null
+++ b/etc/clamav.profile
@@ -0,0 +1,32 @@
+# Firejail profile for clamav
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include /etc/firejail/clamav.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+caps.drop all
+ipc-namespace
+net none
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix
+seccomp
+shell none
+tracelog
+x11 none
+
+private-dev
+read-only ${HOME}
+
+memory-deny-write-execute
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/clamdscan.profile b/etc/clamdscan.profile
new file mode 100644
index 000000000..1fc728206
--- /dev/null
+++ b/etc/clamdscan.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for clamav
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/clamav.profile
diff --git a/etc/clamdtop.profile b/etc/clamdtop.profile
new file mode 100644
index 000000000..1fc728206
--- /dev/null
+++ b/etc/clamdtop.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for clamav
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/clamav.profile
diff --git a/etc/clamscan.profile b/etc/clamscan.profile
new file mode 100644
index 000000000..1fc728206
--- /dev/null
+++ b/etc/clamscan.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for clamav
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/clamav.profile
diff --git a/etc/conky.profile b/etc/conky.profile
new file mode 100644
index 000000000..4ee25f099
--- /dev/null
+++ b/etc/conky.profile
@@ -0,0 +1,35 @@
+# Firejail profile for conky
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/conky.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+disable-mnt
+private-dev
+private-tmp
+
+memory-deny-write-execute
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/darktable.profile b/etc/darktable.profile
index e04163486..c2dc0b42c 100644
--- a/etc/darktable.profile
+++ b/etc/darktable.profile
@@ -26,6 +26,7 @@ protocol unix,inet,inet6
 seccomp
 shell none
 
+#private-bin darktable
 private-dev
 private-tmp
 
diff --git a/etc/dia.profile b/etc/dia.profile
index a625ab36d..abe83ac8c 100644
--- a/etc/dia.profile
+++ b/etc/dia.profile
@@ -27,6 +27,7 @@ seccomp
 shell none
 
 disable-mnt
+#private-bin dia
 private-dev
 private-tmp
 
diff --git a/etc/digikam.profile b/etc/digikam.profile
index 43191ec06..ef518470e 100644
--- a/etc/digikam.profile
+++ b/etc/digikam.profile
@@ -14,6 +14,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nodvd
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index 5dd3dfd30..ca6ba9710 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -2,13 +2,15 @@
 # Persistent customizations should go in a .local file.
 include /etc/firejail/disable-common.local
 
-# History files in $HOME
+# History files and clipboard managers in $HOME
 blacklist-nolog ${HOME}/.*_history
 blacklist-nolog ${HOME}/.adobe
 blacklist-nolog ${HOME}/.bash_history
 blacklist-nolog ${HOME}/.history
 blacklist-nolog ${HOME}/.local/share/fish/fish_history
 blacklist-nolog ${HOME}/.macromedia
+blacklist-nolog /tmp/clipmenu*   
+blacklist-nolog ${HOME}/.cache/greenclip*
 
 # X11 session autostart
 # blacklist ${HOME}/.xpra - this will kill --x11=xpra cmdline option for all programs
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 7e44d582e..88b7e7d32 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -17,8 +17,10 @@ blacklist ${HOME}/.Steam
 blacklist ${HOME}/.Steampath
 blacklist ${HOME}/.Steampid
 blacklist ${HOME}/.TelegramDesktop
+blacklist ${HOME}/.ViberPC
 blacklist ${HOME}/.VirtualBox
 blacklist ${HOME}/.Wolfram Research
+blacklist ${HOME}/.aMule
 blacklist ${HOME}/.android
 blacklist ${HOME}/.arduino15
 blacklist ${HOME}/.atom
@@ -35,6 +37,7 @@ blacklist ${HOME}/.config/Brackets
 blacklist ${HOME}/.config/Clementine
 blacklist ${HOME}/.config/Cryptocat
 blacklist ${HOME}/.config/Franz
+blacklist ${HOME}/.config/FreeCAD
 blacklist ${HOME}/.config/Gitter
 blacklist ${HOME}/.config/Google
 blacklist ${HOME}/.config/Gpredict
@@ -51,6 +54,7 @@ blacklist ${HOME}/.config/Qlipper
 blacklist ${HOME}/.config/QuiteRss
 blacklist ${HOME}/.config/QuiteRssrc
 blacklist ${HOME}/.config/Riot
+blacklist ${HOME}/.config/Rocket.Chat
 blacklist ${HOME}/.config/Slack
 blacklist ${HOME}/.config/Thunar
 blacklist ${HOME}/.config/VirtualBox
@@ -123,6 +127,7 @@ blacklist ${HOME}/.config/lximage-qt
 blacklist ${HOME}/.config/mate-calc
 blacklist ${HOME}/.config/mate/eom
 blacklist ${HOME}/.config/mate/mate-dictionary
+blacklist ${HOME}/.config/mfusion
 blacklist ${HOME}/.config/midori
 blacklist ${HOME}/.config/mpv
 blacklist ${HOME}/.config/mupen64plus
@@ -187,6 +192,7 @@ blacklist ${HOME}/.conkeror.mozdev.org
 blacklist ${HOME}/.curlrc
 blacklist ${HOME}/.dia
 blacklist ${HOME}/.dillo
+blacklist ${HOME}/.dooble
 blacklist ${HOME}/.dosbox
 blacklist ${HOME}/.dropbox-dist
 blacklist ${HOME}/.electrum*
@@ -211,6 +217,7 @@ blacklist ${HOME}/.guayadeque
 blacklist ${HOME}/.hedgewars
 blacklist ${HOME}/.hugin
 blacklist ${HOME}/.icedove
+blacklist ${HOME}/.imagej
 blacklist ${HOME}/.inkscape
 blacklist ${HOME}/.java
 blacklist ${HOME}/.jitsi
@@ -318,6 +325,7 @@ blacklist ${HOME}/.local/share/spotify
 blacklist ${HOME}/.local/share/steam
 blacklist ${HOME}/.local/share/supertux2
 blacklist ${HOME}/.local/share/telepathy
+blacklist ${HOME}/.local/share/terasology
 blacklist ${HOME}/.local/share/torbrowser
 blacklist ${HOME}/.local/share/totem
 blacklist ${HOME}/.local/share/vpltd
@@ -360,6 +368,7 @@ blacklist ${HOME}/.steampath
 blacklist ${HOME}/.steampid
 blacklist ${HOME}/.stellarium
 blacklist ${HOME}/.subversion
+blacklist ${HOME}/.surf
 blacklist ${HOME}/.sword
 blacklist ${HOME}/.sylpheed-2.0
 blacklist ${HOME}/.synfig
@@ -407,6 +416,7 @@ blacklist ${HOME}/.cache/google-chrome
 blacklist ${HOME}/.cache/google-chrome-beta
 blacklist ${HOME}/.cache/google-chrome-unstable
 blacklist ${HOME}/.cache/icedove
+blacklist ${HOME}/.cache/INRIA/Natron
 blacklist ${HOME}/.cache/inox
 blacklist ${HOME}/.cache/libgweather
 blacklist ${HOME}/.cache/midori
diff --git a/etc/dooble-qt4.profile b/etc/dooble-qt4.profile
new file mode 100644
index 000000000..4e1227a0f
--- /dev/null
+++ b/etc/dooble-qt4.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for dooble
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/dooble.profile
diff --git a/etc/dooble.profile b/etc/dooble.profile
new file mode 100644
index 000000000..2a57b0ef3
--- /dev/null
+++ b/etc/dooble.profile
@@ -0,0 +1,39 @@
+# Firejail profile for dooble
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/dooble-qt4.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.dooble
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+mkdir ${HOME}/.dooble
+whitelist ${DOWNLOADS}
+whitelist ${HOME}/.dooble
+include /etc/firejail/whitelist-common.inc
+
+caps.drop all
+netfilter
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+novideo
+protocol unix,inet,inet6,netlink
+seccomp
+shell none
+tracelog
+
+disable-mnt
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/dosbox.profile b/etc/dosbox.profile
index fa9b26e82..a64578e5c 100644
--- a/etc/dosbox.profile
+++ b/etc/dosbox.profile
@@ -12,6 +12,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nodvd
diff --git a/etc/dragon.profile b/etc/dragon.profile
index 211c2432f..c37f81ac9 100644
--- a/etc/dragon.profile
+++ b/etc/dragon.profile
@@ -12,6 +12,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nodvd
diff --git a/etc/electron.profile b/etc/electron.profile
index 9b21c1bfd..91e5cd3df 100644
--- a/etc/electron.profile
+++ b/etc/electron.profile
@@ -5,11 +5,12 @@ include /etc/firejail/electron.local
 # Persistent global definitions
 include /etc/firejail/globals.local
 
-
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+whitelist ${DOWNLOADS}
+
 caps.drop all
 netfilter
 nodvd
diff --git a/etc/evince.profile b/etc/evince.profile
index 5c6215bb2..f503b9a8e 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -12,6 +12,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 no3d
diff --git a/etc/fetchmail.profile b/etc/fetchmail.profile
new file mode 100644
index 000000000..3fd7f3d75
--- /dev/null
+++ b/etc/fetchmail.profile
@@ -0,0 +1,29 @@
+# Firejail profile for fetchmail
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/fetchmail.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+#private-bin fetchmail,procmail,bash,chmod
+private-dev
diff --git a/etc/firefox.profile b/etc/firefox.profile
index 85201b021..1f4a8e3f6 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -59,6 +59,7 @@ whitelist ~/.wine-pipelight64
 whitelist ~/.zotero
 whitelist ~/dwhelper
 include /etc/firejail/whitelist-common.inc
+include /etc/firejail/whitelist-var-common.inc
 
 caps.drop all
 netfilter
diff --git a/etc/freecad.profile b/etc/freecad.profile
new file mode 100644
index 000000000..4fde66839
--- /dev/null
+++ b/etc/freecad.profile
@@ -0,0 +1,35 @@
+# Firejail profile for freecad
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/freecad.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.config/FreeCAD
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+net none
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix
+seccomp
+shell none
+
+private-bin freecad,freecadcmd
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/freecadcmd.profile b/etc/freecadcmd.profile
new file mode 100644
index 000000000..f8bbff593
--- /dev/null
+++ b/etc/freecadcmd.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for freecad
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/freecad.profile
diff --git a/etc/freshclam.profile b/etc/freshclam.profile
new file mode 100644
index 000000000..08eac5595
--- /dev/null
+++ b/etc/freshclam.profile
@@ -0,0 +1,34 @@
+# Firejail profile for freshclam
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include /etc/firejail/clamav.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+caps.keep setgid,setuid
+ipc-namespace
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+nosound
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+tracelog
+
+disable-mnt
+private
+private-dev
+private-tmp
+writable-var
+writable-var-log
+
+memory-deny-write-execute
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/galculator.profile b/etc/galculator.profile
index 37f147f0f..dbc22a889 100644
--- a/etc/galculator.profile
+++ b/etc/galculator.profile
@@ -15,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 mkdir ~/.config/galculator
 whitelist ~/.config/galculator
 include /etc/firejail/whitelist-common.inc
+include /etc/firejail/whitelist-var-common.inc
 
 caps.drop all
 net none
diff --git a/etc/gimp.profile b/etc/gimp.profile
index aa77d6105..292c2aac9 100644
--- a/etc/gimp.profile
+++ b/etc/gimp.profile
@@ -11,6 +11,8 @@ include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 net none
 nodvd
diff --git a/etc/gnome-calculator.profile b/etc/gnome-calculator.profile
index 6547c73df..326222426 100644
--- a/etc/gnome-calculator.profile
+++ b/etc/gnome-calculator.profile
@@ -11,6 +11,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-common.inc
+include /etc/firejail/whitelist-var-common.inc
 
 caps.drop all
 netfilter
diff --git a/etc/google-earth.profile b/etc/google-earth.profile
new file mode 100644
index 000000000..b60f5b3a5
--- /dev/null
+++ b/etc/google-earth.profile
@@ -0,0 +1,48 @@
+# Firejail profile for google-earth
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/google-earth.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+noblacklist ${HOME}/.config/Google
+noblacklist ${HOME}/.googleearth/Cache/
+noblacklist ${HOME}/.googleearth/Temp/
+noblacklist ${HOME}/.googleearth/myplaces.backup.kml
+noblacklist ${HOME}/.googleearth/myplaces.kml
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+mkdir ${HOME}/.config/Google
+mkdir ${HOME}/.googleearth/Cache/
+mkdir ${HOME}/.googleearth/Temp/
+mkfile ${HOME}/.googleearth/myplaces.backup.kml
+mkfile ${HOME}/.googleearth/myplaces.kml
+whitelist ${HOME}/.config/Google
+whitelist ${HOME}/.googleearth/Cache/
+whitelist ${HOME}/.googleearth/Temp/
+whitelist ${HOME}/.googleearth/myplaces.backup.kml
+whitelist ${HOME}/.googleearth/myplaces.kml
+include /etc/firejail/whitelist-common.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+private-bin google-earth,sh,bash,dash,grep,sed,ls,dirname
+private-dev
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/gpicview.profile b/etc/gpicview.profile
index 26bc589ee..1842c9cb1 100644
--- a/etc/gpicview.profile
+++ b/etc/gpicview.profile
@@ -12,6 +12,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 net none
 nodvd
diff --git a/etc/handbrake.profile b/etc/handbrake.profile
index 2b33051e2..f5e7bc329 100644
--- a/etc/handbrake.profile
+++ b/etc/handbrake.profile
@@ -12,6 +12,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nogroups
diff --git a/etc/hugin.profile b/etc/hugin.profile
index d3cd181b1..ff88e0d5c 100644
--- a/etc/hugin.profile
+++ b/etc/hugin.profile
@@ -25,6 +25,7 @@ protocol unix
 seccomp
 shell none
 
+private-bin PTBatcherGUI,calibrate_lens_gui,hugin,hugin_stitch_project,align_image_stack,autooptimiser,celeste_standalone,checkpto,cpclean,cpfind,deghosting_mask,fulla,geocpset,hugin_executor,hugin_hdrmerge,hugin_lensdb,icpfind,linefind,nona,pano_modify,pano_trafo,pto_gen,pto_lensstack,pto_mask,pto_merge,pto_move,pto_template,pto_var,tca_correct,verdandi,vig_optimize,enblend
 private-dev
 private-tmp
 
diff --git a/etc/imagej.profile b/etc/imagej.profile
new file mode 100644
index 000000000..88a56c706
--- /dev/null
+++ b/etc/imagej.profile
@@ -0,0 +1,35 @@
+# Firejail profile for imagej
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/imagej.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.imagej
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+net none
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix
+seccomp
+shell none
+
+private-bin imagej,bash,grep,sort,tail,tr,cut,whoami,hostname,uname,mkdir,ls,touch,free,awk,update-java-alternatives,basename,xprop,rm,ln
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/inkscape.profile b/etc/inkscape.profile
index 1d24f5d7d..c062ab8ef 100644
--- a/etc/inkscape.profile
+++ b/etc/inkscape.profile
@@ -12,6 +12,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nodvd
@@ -25,6 +27,7 @@ protocol unix
 seccomp
 shell none
 
+#private-bin inkscape
 private-dev
 private-tmp
 
diff --git a/etc/k3b.profile b/etc/k3b.profile
index ca190ecb9..58623d823 100644
--- a/etc/k3b.profile
+++ b/etc/k3b.profile
@@ -14,6 +14,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 no3d
 nonewprivs
diff --git a/etc/karbon.profile b/etc/karbon.profile
new file mode 100644
index 000000000..3525a3e06
--- /dev/null
+++ b/etc/karbon.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for krita
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/krita.profile
diff --git a/etc/kate.profile b/etc/kate.profile
index ec5d09ce2..69100d49d 100644
--- a/etc/kate.profile
+++ b/etc/kate.profile
@@ -17,6 +17,8 @@ include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nodvd
diff --git a/etc/kcalc.profile b/etc/kcalc.profile
index f334c4c72..0de23f106 100644
--- a/etc/kcalc.profile
+++ b/etc/kcalc.profile
@@ -11,6 +11,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 no3d
diff --git a/etc/kdenlive.profile b/etc/kdenlive.profile
new file mode 100644
index 000000000..a1a5f957c
--- /dev/null
+++ b/etc/kdenlive.profile
@@ -0,0 +1,30 @@
+# Firejail profile for kdenlive
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/kdenlive.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+net none
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+protocol unix,inet,inet6
+seccomp
+shell none
+
+private-bin kdenlive,kdenlive_render,dbus-launch,melt,ffmpeg,ffplay,ffprobe,dvdauthor,genisoimage,vlc,xine,kdeinit5,kshell5,kdeinit5_shutdown,kdeinit5_wrapper,kdeinit4,kshell4,kdeinit4_shutdown,kdeinit4_wrapper
+private-dev
+#private-etc fonts,alternatives,X11,pulse,passwd
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/krita.profile b/etc/krita.profile
new file mode 100644
index 000000000..e91f5b242
--- /dev/null
+++ b/etc/krita.profile
@@ -0,0 +1,32 @@
+# Firejail profile for krita
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/krita.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+net none
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix
+seccomp
+shell none
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/kwrite.profile b/etc/kwrite.profile
index 6ba076dc0..6b458ede3 100644
--- a/etc/kwrite.profile
+++ b/etc/kwrite.profile
@@ -17,6 +17,8 @@ include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nodvd
diff --git a/etc/leafpad.profile b/etc/leafpad.profile
index e7557651b..c9addba21 100644
--- a/etc/leafpad.profile
+++ b/etc/leafpad.profile
@@ -12,6 +12,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 no3d
diff --git a/etc/libreoffice.profile b/etc/libreoffice.profile
index ec7356002..8d05a557c 100644
--- a/etc/libreoffice.profile
+++ b/etc/libreoffice.profile
@@ -14,6 +14,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nodvd
diff --git a/etc/linphone.profile b/etc/linphone.profile
new file mode 100644
index 000000000..41f9245a2
--- /dev/null
+++ b/etc/linphone.profile
@@ -0,0 +1,41 @@
+# Firejail profile for linphone
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/linphone.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+noblacklist ${HOME}/.linphone-history.db
+noblacklist ${HOME}/.linphonerc
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+mkfile ${HOME}/.linphone-history.db
+mkfile ${HOME}/.linphonerc
+whitelist ${HOME}/.linphone-history.db
+whitelist ${HOME}/.linphonerc
+whitelist ${HOME}/Downloads
+include /etc/firejail/whitelist-common.inc
+
+caps.drop all
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+disable-mnt
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/lmms.profile b/etc/lmms.profile
new file mode 100644
index 000000000..29ed235c6
--- /dev/null
+++ b/etc/lmms.profile
@@ -0,0 +1,34 @@
+# Firejail profile for lmms
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/lmms.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.lmmsrc.xml
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+net none
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+novideo
+protocol unix
+seccomp
+shell none
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/luminance-hdr.profile b/etc/luminance-hdr.profile
index bd32e0c70..ec2a65290 100644
--- a/etc/luminance-hdr.profile
+++ b/etc/luminance-hdr.profile
@@ -26,6 +26,7 @@ seccomp
 shell none
 tracelog
 
+#private-bin luminance-hdr,luminance-hdr-cli,align_image_stack
 private-dev
 private-tmp
 
diff --git a/etc/macrofusion.profile b/etc/macrofusion.profile
new file mode 100644
index 000000000..be66cf6ee
--- /dev/null
+++ b/etc/macrofusion.profile
@@ -0,0 +1,35 @@
+# Firejail profile for macrofusion
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/macrofusion.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.config/mfusion
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+net none
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix
+seccomp
+shell none
+
+#private-bin python3,macrofusion,env,enfuse,exiftool,align_image_stack
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/mousepad.profile b/etc/mousepad.profile
index 36365fc2f..60205ffda 100644
--- a/etc/mousepad.profile
+++ b/etc/mousepad.profile
@@ -12,6 +12,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nodvd
diff --git a/etc/mpd.profile b/etc/mpd.profile
new file mode 100644
index 000000000..7bfa47d77
--- /dev/null
+++ b/etc/mpd.profile
@@ -0,0 +1,33 @@
+# Firejail profile for mpd
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/mpd.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.mpdconf
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+netfilter
+no3d
+nodvd
+nonewprivs
+noroot
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+#private-bin mpd,bash
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/mpv.profile b/etc/mpv.profile
index 0592751ef..eb8a88a4b 100644
--- a/etc/mpv.profile
+++ b/etc/mpv.profile
@@ -13,6 +13,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nogroups
diff --git a/etc/musescore.profile b/etc/musescore.profile
index 3b5a0b13c..b039d07b2 100644
--- a/etc/musescore.profile
+++ b/etc/musescore.profile
@@ -19,6 +19,7 @@ caps.drop all
 netfilter
 no3d
 nodvd
+nogroups
 nonewprivs
 noroot
 notv
diff --git a/etc/natron.profile b/etc/natron.profile
new file mode 100644
index 000000000..d77539d83
--- /dev/null
+++ b/etc/natron.profile
@@ -0,0 +1,33 @@
+# Firejail profile for natron
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/natron.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.Natron
+noblacklist ${HOME}/.cache/INRIA/Natron
+noblacklist ${HOME}/.config/INRIA
+noblacklist /opt/natron
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+netfilter
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+protocol unix,inet,inet6
+seccomp
+shell none
+
+private-bin natron,Natron,NatronRenderer
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/okular.profile b/etc/okular.profile
index 5a704ad26..94736fbae 100644
--- a/etc/okular.profile
+++ b/etc/okular.profile
@@ -20,6 +20,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nodvd
diff --git a/etc/pidgin.profile b/etc/pidgin.profile
index dd610920a..d195cf586 100644
--- a/etc/pidgin.profile
+++ b/etc/pidgin.profile
@@ -27,3 +27,6 @@ tracelog
 private-bin pidgin
 private-dev
 private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/ricochet.profile b/etc/ricochet.profile
new file mode 100644
index 000000000..6da0e21d5
--- /dev/null
+++ b/etc/ricochet.profile
@@ -0,0 +1,40 @@
+# Firejail profile for ricochet
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/ricochet.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.local/share/Ricochet
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+whitelist ${DOWNLOADS}
+whitelist ${HOME}/.local/share/Ricochet
+include /etc/firejail/whitelist-common.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+disable-mnt
+private-bin ricochet,tor
+private-dev
+#private-etc fonts,tor,X11,alternatives
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/riot-web.profile b/etc/riot-web.profile
index c714652df..06dbbe9d9 100644
--- a/etc/riot-web.profile
+++ b/etc/riot-web.profile
@@ -5,9 +5,9 @@ include /etc/firejail/riot-web.local
 # Persistent global definitions
 include /etc/firejail/globals.local
 
-noblacklist ~/.config/Riot
+noblacklist ${HOME}/.config/Riot
 
-whitelist ~/.config/Riot
+whitelist ${HOME}/.config/Riot
 include /etc/firejail/whitelist-common.inc
 
 # Redirect
diff --git a/etc/rocketchat.profile b/etc/rocketchat.profile
new file mode 100644
index 000000000..da92cd938
--- /dev/null
+++ b/etc/rocketchat.profile
@@ -0,0 +1,14 @@
+# Firejail profile for rocketchat
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/rocketchat.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+noblacklist ${HOME}/.config/Rocket.Chat
+
+whitelist ${HOME}/.config/Rocket.Chat
+include /etc/firejail/whitelist-common.inc
+
+# Redirect
+include /etc/firejail/electron.profile
diff --git a/etc/scribus.profile b/etc/scribus.profile
index e4c88be49..dd06fa59f 100644
--- a/etc/scribus.profile
+++ b/etc/scribus.profile
@@ -38,5 +38,6 @@ protocol unix
 seccomp
 tracelog
 
+#private-bin scribus,gs
 private-dev
 # private-tmp
diff --git a/etc/shotcut.profile b/etc/shotcut.profile
new file mode 100644
index 000000000..e30bc1f46
--- /dev/null
+++ b/etc/shotcut.profile
@@ -0,0 +1,31 @@
+# Firejail profile for shotcut
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/shotcut.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.config/Meltytech
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+net none
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+protocol unix
+seccomp
+shell none
+
+#private-bin shotcut,melt,qmelt,nice
+private-dev
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/silentarmy.profile b/etc/silentarmy.profile
index abc68a499..977cfea99 100644
--- a/etc/silentarmy.profile
+++ b/etc/silentarmy.profile
@@ -11,6 +11,8 @@ include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nodvd
@@ -28,6 +30,7 @@ disable-mnt
 private
 # private-bin silentarmy,sa-solver,python3
 private-dev
+private-opt none
 private-tmp
 
 noexec ${HOME}
diff --git a/etc/skype.profile b/etc/skype.profile
index f3e504a3f..b12f9879e 100644
--- a/etc/skype.profile
+++ b/etc/skype.profile
@@ -24,6 +24,7 @@ seccomp
 shell none
 
 disable-mnt
+#private-bin skype,bash
 private-dev
 private-tmp
 
diff --git a/etc/ssh-agent.profile b/etc/ssh-agent.profile
index 7e9d34c92..fa5728d9b 100644
--- a/etc/ssh-agent.profile
+++ b/etc/ssh-agent.profile
@@ -16,6 +16,7 @@ include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+shell none
 caps.drop all
 netfilter
 no3d
diff --git a/etc/steam.profile b/etc/steam.profile
index 227162e1f..b4b9ede70 100644
--- a/etc/steam.profile
+++ b/etc/steam.profile
@@ -21,6 +21,8 @@ noblacklist ${HOME}/.steampath
 noblacklist ${HOME}/.steampid
 # with >=llvm-4 mesa drivers need llvm stuff
 noblacklist /usr/lib/llvm*
+# needed for STEAM_RUNTIME_PREFER_HOST_LIBRARIES=1 to work
+noblacklist /sbin
 
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
@@ -44,5 +46,5 @@ shell none
 
 # private-dev should be commented for controllers
 private-dev
-private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl
+private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,ld.so.conf,ld.so.conf.d,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl
 private-tmp
diff --git a/etc/surf.profile b/etc/surf.profile
new file mode 100644
index 000000000..251331902
--- /dev/null
+++ b/etc/surf.profile
@@ -0,0 +1,35 @@
+# Firejail profile for surf
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/surf.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+noblacklist ~/.surf
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-programs.inc
+
+mkdir ~/.surf
+whitelist ${DOWNLOADS}
+include /etc/firejail/whitelist-common.inc
+
+caps.drop all
+netfilter
+nodvd
+nonewprivs
+noroot
+notv
+protocol unix,inet,inet6,netlink
+seccomp
+shell none
+tracelog
+
+private-bin ls,surf,sh,dash,bash,curl,dmenu,printf,sed,sleep,st,stterm,xargs,xprop
+private-dev
+private-etc passwd,group,hosts,resolv.conf,fonts,ssl
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/synfigstudio.profile b/etc/synfigstudio.profile
index 08ece1e9b..b0014ace6 100644
--- a/etc/synfigstudio.profile
+++ b/etc/synfigstudio.profile
@@ -26,6 +26,7 @@ protocol unix
 seccomp
 shell none
 
+#private-bin synfigstudio
 private-dev
 private-tmp
 
diff --git a/etc/teamspeak3.profile b/etc/teamspeak3.profile
new file mode 100644
index 000000000..86f96ba50
--- /dev/null
+++ b/etc/teamspeak3.profile
@@ -0,0 +1,39 @@
+# Firejail profile for teamspeak3
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/teamspeak3.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+noblacklist ${HOME}/.ts3client
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+mkdir ${HOME}/.ts3client
+whitelist ${DOWNLOADS}
+whitelist ${HOME}/.ts3client
+include /etc/firejail/whitelist-common.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+disable-mnt
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/terasology.profile b/etc/terasology.profile
new file mode 100644
index 000000000..ca580c0d0
--- /dev/null
+++ b/etc/terasology.profile
@@ -0,0 +1,42 @@
+# Firejail profile for terasology
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/default.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.java
+noblacklist ${HOME}/.local/share/terasology
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+mkdir ${HOME}/.java
+mkdir ${HOME}/.local/share/terasology
+whitelist ${HOME}/.java
+whitelist ${HOME}/.local/share/terasology
+include /etc/firejail/whitelist-common.inc
+
+caps.drop all
+ipc-namespace
+net none
+netfilter
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+disable-mnt
+private-dev
+private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl,java-8-openjdk,java-7-openjdk
+private-tmp
+
+noexec ${HOME}
diff --git a/etc/tor-browser-en.profile b/etc/tor-browser-en.profile
new file mode 100644
index 000000000..bf3a80139
--- /dev/null
+++ b/etc/tor-browser-en.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for torbrowser-launcher
+# This file is overwritten after every install/update
+
+
+# Redirect
+include /etc/firejail/torbrowser-launcher.profile
diff --git a/etc/tor.profile b/etc/tor.profile
new file mode 100644
index 000000000..fcb123eef
--- /dev/null
+++ b/etc/tor.profile
@@ -0,0 +1,47 @@
+# Firejail profile for tor
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/tor.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+# How to use:
+# Create a script called anything (e.g. mytor)
+# with the following contents:
+
+# #!/bin/bash
+# TORCMD="tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 1"
+# sudo -b daemon -f -d -- firejail --profile=/home/<username>/.config/firejail/tor.profile $TORCMD
+
+# You'll also likely want to disable the system service (if it exists)
+# Run mytor (or whatever you called the script above) whenever you want to start tor
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.keep setuid,setgid,net_bind_service,dac_read_search
+ipc-namespace
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+nosound
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+writable-var
+
+disable-mnt
+private
+private-bin tor,bash
+private-dev
+private-etc tor,passwd
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/torbrowser-launcher.profile b/etc/torbrowser-launcher.profile
index 763c2d051..3b6b65bec 100644
--- a/etc/torbrowser-launcher.profile
+++ b/etc/torbrowser-launcher.profile
@@ -5,17 +5,20 @@ include /etc/firejail/torbrowser-launcher.local
 # Persistent global definitions
 include /etc/firejail/globals.local
 
-
+noblacklist ~/.tor-browser-en
 noblacklist ~/.config/torbrowser
-whitelist ~/.config/torbrowser
 noblacklist ~/.local/share/torbrowser
-whitelist ~/.local/share/torbrowser
 
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+whitelist ~/.tor-browser-en
+whitelist ~/.config/torbrowser
+whitelist ~/.local/share/torbrowser
+include /etc/firejail/whitelist-common.inc
+
 caps.drop all
 netfilter
 nodvd
@@ -29,7 +32,7 @@ seccomp
 shell none
 tracelog
 
-private-bin torbrowser-launcher,python2.7,python,bash,dash,sh,grep,tail,env,gpg,id,readlink,dirname,test,mkdir,ln,sed,cp,rm,getconf
+private-bin bash,cp,dash,dirname,env,expr,file,getconf,gpg,grep,id,ln,mkdir,python,python2.7,readlink,rm,sed,sh,tail,test,tor-browser-en,torbrowser-launcher
 private-dev
 private-etc fonts
 private-tmp
diff --git a/etc/transmission-gtk.profile b/etc/transmission-gtk.profile
index 0bb721c64..6a8d6c679 100644
--- a/etc/transmission-gtk.profile
+++ b/etc/transmission-gtk.profile
@@ -19,6 +19,7 @@ whitelist  ${DOWNLOADS}
 whitelist ~/.cache/transmission
 whitelist ~/.config/transmission
 include /etc/firejail/whitelist-common.inc
+include /etc/firejail/whitelist-var-common.inc
 
 caps.drop all
 netfilter
diff --git a/etc/transmission-qt.profile b/etc/transmission-qt.profile
index 08964bbab..4db8e19ce 100644
--- a/etc/transmission-qt.profile
+++ b/etc/transmission-qt.profile
@@ -19,6 +19,7 @@ whitelist  ${DOWNLOADS}
 whitelist ~/.cache/transmission
 whitelist ~/.config/transmission
 include /etc/firejail/whitelist-common.inc
+include /etc/firejail/whitelist-var-common.inc
 
 caps.drop all
 netfilter
diff --git a/etc/tuxguitar.profile b/etc/tuxguitar.profile
index 5b6a257f6..fbc198cc3 100644
--- a/etc/tuxguitar.profile
+++ b/etc/tuxguitar.profile
@@ -17,6 +17,7 @@ caps.drop all
 netfilter
 no3d
 nodvd
+nogroups
 nonewprivs
 noroot
 notv
diff --git a/etc/virtualbox.profile b/etc/virtualbox.profile
index 6e153d559..b01e6d144 100644
--- a/etc/virtualbox.profile
+++ b/etc/virtualbox.profile
@@ -20,7 +20,9 @@ mkdir ~/.config/VirtualBox
 mkdir ~/VirtualBox VMs
 whitelist ~/.config/VirtualBox
 whitelist ~/VirtualBox VMs
+whitelist ${DOWNLOADS}
 include /etc/firejail/whitelist-common.inc
+include /etc/firejail/whitelist-var-common.inc
 
 caps.drop all
 netfilter
diff --git a/etc/vlc.profile b/etc/vlc.profile
index bccde7a3d..c3a4d58d0 100644
--- a/etc/vlc.profile
+++ b/etc/vlc.profile
@@ -12,6 +12,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 # nogroups
diff --git a/etc/whitelist-common.inc b/etc/whitelist-common.inc
index ba4b91451..310149ecd 100644
--- a/etc/whitelist-common.inc
+++ b/etc/whitelist-common.inc
@@ -16,6 +16,7 @@ whitelist ~/.drirc
 whitelist ~/.mime.types
 whitelist ~/.local/share/applications
 read-only ~/.local/share/applications
+whitelist ~/.config/ibus
 
 # fonts
 whitelist ~/.fonts
@@ -34,10 +35,14 @@ whitelist ~/.gtkrc-2.0
 whitelist ~/.gtk-2.0
 whitelist ~/.config/gtk-2.0
 whitelist ~/.config/gtk-3.0
+whitelist ~/.config/gtkrc
+whitelist ~/.config/gtkrc-2.0
 whitelist ~/.themes
 whitelist ~/.local/share/themes
 whitelist ~/.kde/share/config/gtkrc
 whitelist ~/.kde/share/config/gtkrc-2.0
+whitelist ~/.kde4/share/config/gtkrc
+whitelist ~/.kde4/share/config/gtkrc-2.0
 whitelist ~/.gnome2
 whitelist ~/.gnome2-private
 
@@ -50,3 +55,6 @@ whitelist ~/.config/kdeglobals
 whitelist ~/.kde/share/config/oxygenrc
 whitelist ~/.kde/share/config/kdeglobals
 whitelist ~/.kde/share/icons
+whitelist ~/.kde4/share/config/oxygenrc
+whitelist ~/.kde4/share/config/kdeglobals
+whitelist ~/.kde4/share/icons
diff --git a/etc/whitelist-var-common.inc b/etc/whitelist-var-common.inc
new file mode 100644
index 000000000..024995f20
--- /dev/null
+++ b/etc/whitelist-var-common.inc
@@ -0,0 +1,11 @@
+# Local customizations come here
+include /etc/firejail/whitelist-var-common.local
+
+# common /var whitelist for all profiles
+
+whitelist /var/lib/dbus
+whitelist /var/lib/menu-xdg
+whitelist /var/cache/fontconfig
+whitelist /var/tmp
+whitelist /var/run
+whitelist /var/lock
diff --git a/etc/x-terminal-emulator.profile b/etc/x-terminal-emulator.profile
new file mode 100644
index 000000000..1395b81c9
--- /dev/null
+++ b/etc/x-terminal-emulator.profile
@@ -0,0 +1,20 @@
+# Firejail profile for x-terminal-emulator
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/x-terminal-emulator.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+caps.drop all
+ipc-namespace
+net none
+netfilter
+nogroups
+noroot
+protocol unix
+seccomp
+
+private-dev
+
+noexec /tmp
diff --git a/etc/xmr-stak-cpu.profile b/etc/xmr-stak-cpu.profile
new file mode 100644
index 000000000..9cc6e0c1f
--- /dev/null
+++ b/etc/xmr-stak-cpu.profile
@@ -0,0 +1,42 @@
+# Firejail profile for xmr-stak-cpu
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/xmr-stak-cpu.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+include /etc/firejail/whitelist-var-common.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+disable-mnt
+private
+private-bin xmr-stak-cpu
+private-dev
+private-etc xmr-stak-cpu.json
+private-lib
+private-opt none
+private-tmp
+
+memory-deny-write-execute
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/youtube-dl.profile b/etc/youtube-dl.profile
index e20fb3e99..d41591fd6 100644
--- a/etc/youtube-dl.profile
+++ b/etc/youtube-dl.profile
@@ -13,6 +13,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 ipc-namespace
 netfilter
diff --git a/etc/zart.profile b/etc/zart.profile
new file mode 100644
index 000000000..6e136d0c9
--- /dev/null
+++ b/etc/zart.profile
@@ -0,0 +1,30 @@
+# Firejail profile for zart
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/zart.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+net none
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+protocol unix
+seccomp
+shell none
+
+private-bin zart,ffmpeg,melt,ffprobe,ffplay
+private-dev
+
+noexec ${HOME}
+noexec /tmp