diff options
author | 2019-03-04 22:29:15 +0000 | |
---|---|---|
committer | 2019-03-04 22:29:15 +0000 | |
commit | ca2c55b5632a1bbd2e6b2e5562cd010d506405ca (patch) | |
tree | 5d3326060aea55922db2eada77632748a3ecd89f /etc | |
parent | Fix private-lib in regextester profile (#2515) (diff) | |
download | firejail-ca2c55b5632a1bbd2e6b2e5562cd010d506405ca.tar.gz firejail-ca2c55b5632a1bbd2e6b2e5562cd010d506405ca.tar.zst firejail-ca2c55b5632a1bbd2e6b2e5562cd010d506405ca.zip |
Add new profile for gnome-schedule (#2499)
* Create gnome-schedule.profile
* Add gnome-schedule configs to disable-programs.inc
* Add gnome-schedule to firecfg
* mkfile and whitelist changes for gnome-schedule
Diffstat (limited to 'etc')
-rw-r--r-- | etc/disable-programs.inc | 1 | ||||
-rw-r--r-- | etc/gnome-schedule.profile | 77 |
2 files changed, 78 insertions, 0 deletions
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index a0e8b4627..6b87c0715 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc | |||
@@ -320,6 +320,7 @@ blacklist ${HOME}/.frozen-bubble | |||
320 | blacklist ${HOME}/.gimp* | 320 | blacklist ${HOME}/.gimp* |
321 | blacklist ${HOME}/.git-credential-cache | 321 | blacklist ${HOME}/.git-credential-cache |
322 | blacklist ${HOME}/.gitconfig | 322 | blacklist ${HOME}/.gitconfig |
323 | blacklist ${HOME}/.gnome/gnome-schedule | ||
323 | blacklist ${HOME}/.googleearth/Cache/ | 324 | blacklist ${HOME}/.googleearth/Cache/ |
324 | blacklist ${HOME}/.googleearth/Temp/ | 325 | blacklist ${HOME}/.googleearth/Temp/ |
325 | blacklist ${HOME}/.googleearth/myplaces.backup.kml | 326 | blacklist ${HOME}/.googleearth/myplaces.backup.kml |
diff --git a/etc/gnome-schedule.profile b/etc/gnome-schedule.profile new file mode 100644 index 000000000..d856c1f83 --- /dev/null +++ b/etc/gnome-schedule.profile | |||
@@ -0,0 +1,77 @@ | |||
1 | # Firejail profile for gnome-schedule | ||
2 | # Description: Graphical interface to crontab and at for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-schedule.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.gnome/gnome-schedule | ||
10 | |||
11 | # Needs at and crontab to read/write user cron | ||
12 | noblacklist ${PATH}/at | ||
13 | noblacklist ${PATH}/crontab | ||
14 | |||
15 | # Needs access to these files/dirs | ||
16 | noblacklist /etc/cron.allow | ||
17 | noblacklist /etc/cron.deny | ||
18 | noblacklist /etc/shadow | ||
19 | noblacklist /var/spool/cron | ||
20 | |||
21 | # Needs a terminal for cron job test execution | ||
22 | noblacklist ${PATH}/lxterminal | ||
23 | noblacklist ${PATH}/gnome-terminal | ||
24 | noblacklist ${PATH}/gnome-terminal.wrapper | ||
25 | noblacklist ${PATH}/lilyterm | ||
26 | noblacklist ${PATH}/mate-terminal | ||
27 | noblacklist ${PATH}/mate-terminal.wrapper | ||
28 | noblacklist ${PATH}/pantheon-terminal | ||
29 | noblacklist ${PATH}/roxterm | ||
30 | noblacklist ${PATH}/roxterm-config | ||
31 | noblacklist ${PATH}/terminix | ||
32 | noblacklist ${PATH}/tilix | ||
33 | noblacklist ${PATH}/urxvtc | ||
34 | noblacklist ${PATH}/urxvtcd | ||
35 | noblacklist ${PATH}/xfce4-terminal | ||
36 | noblacklist ${PATH}/xfce4-terminal.wrapper | ||
37 | |||
38 | # Allow python (disabled by disable-interpreters.inc) | ||
39 | noblacklist ${PATH}/python2* | ||
40 | noblacklist ${PATH}/python3* | ||
41 | noblacklist /usr/lib/python2* | ||
42 | noblacklist /usr/lib/python3* | ||
43 | |||
44 | include disable-common.inc | ||
45 | include disable-devel.inc | ||
46 | include disable-interpreters.inc | ||
47 | include disable-passwdmgr.inc | ||
48 | include disable-programs.inc | ||
49 | include disable-xdg.inc | ||
50 | |||
51 | mkfile ${HOME}/.gnome/gnome-schedule | ||
52 | whitelist ${HOME}/.gnome/gnome-schedule | ||
53 | include whitelist-common.inc | ||
54 | |||
55 | apparmor | ||
56 | caps.keep chown,dac_override,setgid,setuid | ||
57 | ipc-namespace | ||
58 | machine-id | ||
59 | net none | ||
60 | no3d | ||
61 | nodvd | ||
62 | nogroups | ||
63 | nosound | ||
64 | notv | ||
65 | nou2f | ||
66 | novideo | ||
67 | shell none | ||
68 | tracelog | ||
69 | |||
70 | disable-mnt | ||
71 | private-cache | ||
72 | private-dev | ||
73 | # private-etc alternatives | ||
74 | writable-var | ||
75 | |||
76 | noexec ${HOME} | ||
77 | noexec /tmp | ||