aboutsummaryrefslogtreecommitdiffstats
path: root/etc
diff options
context:
space:
mode:
authorLibravatar hawkeye116477 <hawkeye116477@gmail.com>2017-06-22 19:26:28 +0200
committerLibravatar hawkeye116477 <hawkeye116477@gmail.com>2017-06-22 19:26:28 +0200
commit4ccb35df264267e00c38953f93dddd1dc9581fa5 (patch)
tree0700fd4306ef514d8f28ce11138c1a1ff1a29c87 /etc
parentUpdate profile for Cyberfox (diff)
parentMerge pull request #1343 from BafDyce/fix-example-typo (diff)
downloadfirejail-4ccb35df264267e00c38953f93dddd1dc9581fa5.tar.gz
firejail-4ccb35df264267e00c38953f93dddd1dc9581fa5.tar.zst
firejail-4ccb35df264267e00c38953f93dddd1dc9581fa5.zip
Merge remote-tracking branch 'upstream/master'
Diffstat (limited to 'etc')
-rw-r--r--etc/0ad.profile1
-rw-r--r--etc/7z.profile4
-rw-r--r--etc/atom-beta.profile1
-rw-r--r--etc/atom.profile1
-rw-r--r--etc/atool.profile1
-rw-r--r--etc/atril.profile1
-rw-r--r--etc/audacity.profile1
-rw-r--r--etc/aweather.profile1
-rw-r--r--etc/baloo_file.profile1
-rw-r--r--etc/bibletime.profile1
-rw-r--r--etc/bleachbit.profile1
-rw-r--r--etc/bless.profile1
-rw-r--r--etc/brasero.profile2
-rw-r--r--etc/calibre.profile35
-rw-r--r--etc/catfish.profile32
-rw-r--r--etc/cherrytree.profile1
-rw-r--r--etc/chromium.profile2
-rw-r--r--etc/clementine.profile1
-rw-r--r--etc/clipit.profile1
-rw-r--r--etc/cpio.profile2
-rw-r--r--etc/curl.profile35
-rw-r--r--etc/deadbeef.profile1
-rw-r--r--etc/deluge.profile1
-rw-r--r--etc/dia.profile1
-rw-r--r--etc/digikam.profile33
-rw-r--r--etc/dino.profile1
-rw-r--r--etc/disable-programs.inc17
-rw-r--r--etc/dragon.profile1
-rw-r--r--etc/dropbox.profile1
-rw-r--r--etc/ebook-viewer.profile10
-rw-r--r--etc/elinks.profile3
-rw-r--r--etc/engrampa.profile1
-rw-r--r--etc/eog.profile1
-rw-r--r--etc/eom.profile1
-rw-r--r--etc/evince.profile1
-rw-r--r--etc/file.profile2
-rw-r--r--etc/firefox.profile5
-rw-r--r--etc/ghb.profile9
-rw-r--r--etc/gimp-2.8.profile4
-rw-r--r--etc/git.profile2
-rw-r--r--etc/gtar.profile2
-rw-r--r--etc/gzip.profile2
-rw-r--r--etc/handbrake-gtk.profile9
-rw-r--r--etc/handbrake.profile30
-rw-r--r--etc/keepassx.profile5
-rw-r--r--etc/ktorrent.profile7
-rw-r--r--etc/less.profile2
-rw-r--r--etc/mate-calculator.profile4
-rw-r--r--etc/mplayer.profile31
-rw-r--r--etc/qpdfview.profile2
-rw-r--r--etc/server.profile1
-rw-r--r--etc/smplayer.profile32
-rw-r--r--etc/ssh-agent.profile2
-rw-r--r--etc/ssh.profile2
-rw-r--r--etc/strings.profile2
-rw-r--r--etc/tar.profile2
-rw-r--r--etc/thunar.profile4
-rw-r--r--etc/thunderbird.profile5
-rw-r--r--etc/unrar.profile2
-rw-r--r--etc/unzip.profile2
-rw-r--r--etc/uudeview.profile2
-rw-r--r--etc/vivaldi-beta.profile2
-rw-r--r--etc/vivaldi-stable.profile16
-rw-r--r--etc/vivaldi.profile17
-rw-r--r--etc/vlc.profile2
-rw-r--r--etc/wget.profile3
-rw-r--r--etc/xz.profile2
-rw-r--r--etc/xzdec.profile2
-rw-r--r--etc/youtube-dl.profile2
69 files changed, 372 insertions, 45 deletions
diff --git a/etc/0ad.profile b/etc/0ad.profile
index 596cb845a..e946c1418 100644
--- a/etc/0ad.profile
+++ b/etc/0ad.profile
@@ -29,6 +29,7 @@ netfilter
29nogroups 29nogroups
30nonewprivs 30nonewprivs
31noroot 31noroot
32novideo
32protocol unix,inet,inet6 33protocol unix,inet,inet6
33seccomp 34seccomp
34shell none 35shell none
diff --git a/etc/7z.profile b/etc/7z.profile
index f36735303..c7c857dc8 100644
--- a/etc/7z.profile
+++ b/etc/7z.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,6 @@ include /etc/firejail/globals.local
6include /etc/firejail/7z.local 7include /etc/firejail/7z.local
7 8
8# 7zip crompression tool profile 9# 7zip crompression tool profile
9quiet
10ignore noroot 10ignore noroot
11 11
12include /etc/firejail/default.profile 12include /etc/firejail/default.profile
@@ -15,6 +15,8 @@ blacklist /tmp/.X11-unix
15 15
16tracelog 16tracelog
17net none 17net none
18nosound
19novideo
18shell none 20shell none
19private-dev 21private-dev
20nosound 22nosound
diff --git a/etc/atom-beta.profile b/etc/atom-beta.profile
index 5a42e28e8..367aa5672 100644
--- a/etc/atom-beta.profile
+++ b/etc/atom-beta.profile
@@ -19,6 +19,7 @@ nogroups
19nonewprivs 19nonewprivs
20noroot 20noroot
21nosound 21nosound
22novideo
22protocol unix,inet,inet6,netlink 23protocol unix,inet,inet6,netlink
23seccomp 24seccomp
24shell none 25shell none
diff --git a/etc/atom.profile b/etc/atom.profile
index fc9e49eab..726682617 100644
--- a/etc/atom.profile
+++ b/etc/atom.profile
@@ -19,6 +19,7 @@ nogroups
19nonewprivs 19nonewprivs
20noroot 20noroot
21nosound 21nosound
22novideo
22protocol unix,inet,inet6,netlink 23protocol unix,inet,inet6,netlink
23seccomp 24seccomp
24shell none 25shell none
diff --git a/etc/atool.profile b/etc/atool.profile
index 3f4b60312..a66b4b1c5 100644
--- a/etc/atool.profile
+++ b/etc/atool.profile
@@ -16,6 +16,7 @@ nogroups
16nonewprivs 16nonewprivs
17noroot 17noroot
18nosound 18nosound
19novideo
19protocol unix 20protocol unix
20seccomp 21seccomp
21netfilter 22netfilter
diff --git a/etc/atril.profile b/etc/atril.profile
index a9199f512..0abad494a 100644
--- a/etc/atril.profile
+++ b/etc/atril.profile
@@ -18,6 +18,7 @@ nogroups
18nonewprivs 18nonewprivs
19noroot 19noroot
20nosound 20nosound
21novideo
21protocol unix 22protocol unix
22seccomp 23seccomp
23shell none 24shell none
diff --git a/etc/audacity.profile b/etc/audacity.profile
index 67b625f2b..5b38d84e8 100644
--- a/etc/audacity.profile
+++ b/etc/audacity.profile
@@ -21,6 +21,7 @@ no3d
21nogroups 21nogroups
22nonewprivs 22nonewprivs
23noroot 23noroot
24novideo
24protocol unix 25protocol unix
25seccomp 26seccomp
26shell none 27shell none
diff --git a/etc/aweather.profile b/etc/aweather.profile
index 73bf1cc5a..9d8e336cd 100644
--- a/etc/aweather.profile
+++ b/etc/aweather.profile
@@ -22,6 +22,7 @@ nogroups
22nonewprivs 22nonewprivs
23noroot 23noroot
24nosound 24nosound
25novideo
25protocol unix,inet,inet6 26protocol unix,inet,inet6
26seccomp 27seccomp
27shell none 28shell none
diff --git a/etc/baloo_file.profile b/etc/baloo_file.profile
index 9caef7508..2fe6d1927 100644
--- a/etc/baloo_file.profile
+++ b/etc/baloo_file.profile
@@ -22,6 +22,7 @@ nogroups
22nonewprivs 22nonewprivs
23noroot 23noroot
24nosound 24nosound
25novideo
25protocol unix 26protocol unix
26# Baloo makes ioprio_set system calls, which are blacklisted by default. 27# Baloo makes ioprio_set system calls, which are blacklisted by default.
27seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,name_to_handle_at,open_by_handle_at,create_module,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,chroot,tuxcall,reboot,mfsservctl,get_kernel_syms,bpf,clock_settime,personality,process_vm_writev,query_module,settimeofday,stime,umount,userfaultfd,ustat,vm86,vm86old 28seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,name_to_handle_at,open_by_handle_at,create_module,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,chroot,tuxcall,reboot,mfsservctl,get_kernel_syms,bpf,clock_settime,personality,process_vm_writev,query_module,settimeofday,stime,umount,userfaultfd,ustat,vm86,vm86old
diff --git a/etc/bibletime.profile b/etc/bibletime.profile
index 9b205456a..2162151a1 100644
--- a/etc/bibletime.profile
+++ b/etc/bibletime.profile
@@ -29,6 +29,7 @@ nogroups
29nonewprivs 29nonewprivs
30noroot 30noroot
31nosound 31nosound
32novideo
32protocol unix,inet,inet6,netlink 33protocol unix,inet,inet6,netlink
33seccomp 34seccomp
34shell none 35shell none
diff --git a/etc/bleachbit.profile b/etc/bleachbit.profile
index 40c7a5c83..345dd119a 100644
--- a/etc/bleachbit.profile
+++ b/etc/bleachbit.profile
@@ -20,6 +20,7 @@ nogroups
20nonewprivs 20nonewprivs
21noroot 21noroot
22nosound 22nosound
23novideo
23protocol unix 24protocol unix
24seccomp 25seccomp
25shell none 26shell none
diff --git a/etc/bless.profile b/etc/bless.profile
index 436c06a15..c9ccfc02e 100644
--- a/etc/bless.profile
+++ b/etc/bless.profile
@@ -28,6 +28,7 @@ nogroups
28nonewprivs 28nonewprivs
29noroot 29noroot
30nosound 30nosound
31novideo
31protocol unix 32protocol unix
32seccomp 33seccomp
33shell none 34shell none
diff --git a/etc/brasero.profile b/etc/brasero.profile
index ac9ea8a7c..d013e0b8e 100644
--- a/etc/brasero.profile
+++ b/etc/brasero.profile
@@ -20,9 +20,9 @@ nogroups
20nonewprivs 20nonewprivs
21noroot 21noroot
22nosound 22nosound
23novideo
23protocol unix 24protocol unix
24seccomp 25seccomp
25netfilter
26shell none 26shell none
27tracelog 27tracelog
28 28
diff --git a/etc/calibre.profile b/etc/calibre.profile
new file mode 100644
index 000000000..b75e0c276
--- /dev/null
+++ b/etc/calibre.profile
@@ -0,0 +1,35 @@
1# Persistent global definitions go here
2include /etc/firejail/globals.local
3
4# This file is overwritten during software install.
5# Persistent customizations should go in a .local file.
6include /etc/firejail/calibre.local
7
8noblacklist ~/.config/calibre
9noblacklist ~/.cache/calibre
10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-programs.inc
13#include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-passwdmgr.inc
15
16caps.drop all
17#ipc-namespace
18netfilter
19no3d
20nogroups
21nonewprivs
22noroot
23nosound
24novideo
25protocol unix,inet,inet6
26seccomp
27shell none
28tracelog
29
30#private-bin
31private-dev
32private-tmp
33
34noexec ${HOME}
35noexec /tmp
diff --git a/etc/catfish.profile b/etc/catfish.profile
new file mode 100644
index 000000000..0deaca1b5
--- /dev/null
+++ b/etc/catfish.profile
@@ -0,0 +1,32 @@
1# Persistent global definitions go here
2include /etc/firejail/globals.local
3
4# This file is overwritten during software install.
5# Persistent customizations should go in a .local file.
6include /etc/firejail/catfish.local
7
8# Firejail profile for catfish
9noblacklist ~/.config/catfish
10
11# We can't blacklist much since catfish
12# is for finding files/content
13include /etc/firejail/disable-devel.inc
14
15caps.drop all
16net none
17no3d
18nogroups
19nonewprivs
20noroot
21nosound
22novideo
23protocol unix
24seccomp
25shell none
26tracelog
27
28# These options work but are disabled in case
29# a users wants to search in these directories.
30#private-bin bash,catfish,env,locate,ls,mlocate,python,python2,python2.7,python3,python3.5,python3.5m,python3m
31#private-dev
32#private-tmp
diff --git a/etc/cherrytree.profile b/etc/cherrytree.profile
index 258be50d6..0ac71ca3c 100644
--- a/etc/cherrytree.profile
+++ b/etc/cherrytree.profile
@@ -20,6 +20,7 @@ nogroups
20nonewprivs 20nonewprivs
21noroot 21noroot
22nosound 22nosound
23novideo
23seccomp 24seccomp
24protocol unix,inet,inet6,netlink 25protocol unix,inet,inet6,netlink
25tracelog 26tracelog
diff --git a/etc/chromium.profile b/etc/chromium.profile
index 7e73634ec..2728bf74a 100644
--- a/etc/chromium.profile
+++ b/etc/chromium.profile
@@ -34,7 +34,7 @@ nogroups
34shell none 34shell none
35 35
36private-dev 36private-dev
37private-tmp 37#private-tmp - problems with multiple browser sessions
38 38
39noexec ${HOME} 39noexec ${HOME}
40noexec /tmp 40noexec /tmp
diff --git a/etc/clementine.profile b/etc/clementine.profile
index 0f585e43e..ccacc632d 100644
--- a/etc/clementine.profile
+++ b/etc/clementine.profile
@@ -14,6 +14,7 @@ include /etc/firejail/disable-passwdmgr.inc
14caps.drop all 14caps.drop all
15nonewprivs 15nonewprivs
16noroot 16noroot
17novideo
17protocol unix,inet,inet6 18protocol unix,inet,inet6
18# Clementine makes ioprio_set system calls, which are blacklisted by default. 19# Clementine makes ioprio_set system calls, which are blacklisted by default.
19seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,name_to_handle_at,open_by_handle_at,create_module,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,chroot,tuxcall,reboot,mfsservctl,get_kernel_syms,bpf,clock_settime,personality,process_vm_writev,query_module,settimeofday,stime,umount,userfaultfd,ustat,vm86,vm86old 20seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,name_to_handle_at,open_by_handle_at,create_module,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,chroot,tuxcall,reboot,mfsservctl,get_kernel_syms,bpf,clock_settime,personality,process_vm_writev,query_module,settimeofday,stime,umount,userfaultfd,ustat,vm86,vm86old
diff --git a/etc/clipit.profile b/etc/clipit.profile
index cd744a022..b671b253b 100644
--- a/etc/clipit.profile
+++ b/etc/clipit.profile
@@ -15,6 +15,7 @@ caps.drop all
15netfilter 15netfilter
16nonewprivs 16nonewprivs
17noroot 17noroot
18novideo
18protocol unix,inet,inet6 19protocol unix,inet,inet6
19seccomp 20seccomp
20 21
diff --git a/etc/cpio.profile b/etc/cpio.profile
index f38e0a6ce..fe1dc0408 100644
--- a/etc/cpio.profile
+++ b/etc/cpio.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -8,7 +9,6 @@ include /etc/firejail/cpio.local
8# cpio profile 9# cpio profile
9# /sbin and /usr/sbin are visible inside the sandbox 10# /sbin and /usr/sbin are visible inside the sandbox
10# /boot is not visible and /var is heavily modified 11# /boot is not visible and /var is heavily modified
11quiet
12noblacklist /sbin 12noblacklist /sbin
13noblacklist /usr/sbin 13noblacklist /usr/sbin
14include /etc/firejail/disable-common.inc 14include /etc/firejail/disable-common.inc
diff --git a/etc/curl.profile b/etc/curl.profile
new file mode 100644
index 000000000..58b5f050a
--- /dev/null
+++ b/etc/curl.profile
@@ -0,0 +1,35 @@
1quiet
2# Persistent global definitions go here
3include /etc/firejail/globals.local
4
5# This file is overwritten during software install.
6# Persistent customizations should go in a .local file.
7include /etc/firejail/curl.local
8
9# curl profile
10noblacklist ~/.curlrc
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-programs.inc
13include /etc/firejail/disable-passwdmgr.inc
14
15caps.drop all
16#ipc-namespace
17netfilter
18no3d
19nogroups
20nonewprivs
21noroot
22nosound
23protocol unix,inet,inet6
24seccomp
25shell none
26
27blacklist /tmp/.X11-unix
28
29# private-bin curl
30private-dev
31# private-etc resolv.conf
32private-tmp
33
34noexec ${HOME}
35noexec /tmp
diff --git a/etc/deadbeef.profile b/etc/deadbeef.profile
index 8d50dedda..486df1d99 100644
--- a/etc/deadbeef.profile
+++ b/etc/deadbeef.profile
@@ -20,6 +20,7 @@ no3d
20nogroups 20nogroups
21nonewprivs 21nonewprivs
22noroot 22noroot
23novideo
23protocol unix,inet,inet6 24protocol unix,inet,inet6
24seccomp 25seccomp
25shell none 26shell none
diff --git a/etc/deluge.profile b/etc/deluge.profile
index db2d339c7..4e7d90e53 100644
--- a/etc/deluge.profile
+++ b/etc/deluge.profile
@@ -24,6 +24,7 @@ netfilter
24nonewprivs 24nonewprivs
25noroot 25noroot
26nosound 26nosound
27novideo
27protocol unix,inet,inet6 28protocol unix,inet,inet6
28seccomp 29seccomp
29 30
diff --git a/etc/dia.profile b/etc/dia.profile
index fc564b96d..4e009afd7 100644
--- a/etc/dia.profile
+++ b/etc/dia.profile
@@ -14,6 +14,7 @@ caps.drop all
14netfilter 14netfilter
15nonewprivs 15nonewprivs
16noroot 16noroot
17novideo
17protocol unix,inet,inet6 18protocol unix,inet,inet6
18seccomp 19seccomp
19 20
diff --git a/etc/digikam.profile b/etc/digikam.profile
new file mode 100644
index 000000000..fd19953a0
--- /dev/null
+++ b/etc/digikam.profile
@@ -0,0 +1,33 @@
1# Persistent global definitions go here
2include /etc/firejail/globals.local
3
4# This file is overwritten during software install.
5# Persistent customizations should go in a .local file.
6include /etc/firejail/digikam.local
7
8noblacklist ${HOME}/.kde4/share/apps/digikam
9noblacklist ${HOME}/.kde/share/apps/digikam
10noblacklist ${HOME}/.config/digikamrc
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-programs.inc
14include /etc/firejail/disable-passwdmgr.inc
15include /etc/firejail/disable-devel.inc
16
17caps.drop all
18netfilter
19nonewprivs
20noroot
21protocol unix,inet,inet6,netlink
22
23# This is a seccomp whitelist profile for Debian jessie, Kubuntu 17.04.
24# Uncomment seccomp.keep line and try it out. By default only the regular seccomp blacklist profile is enabled.
25#seccomp.keep fallocate,getrusage,openat,access,arch_prctl,bind,brk,chdir,chmod,clock_getres,clone,close,connect,dup2,dup3,eventfd2,execve,fadvise64,fcntl,fdatasync,flock,fstat,fstatfs,ftruncate,futex,getcwd,getdents,getegid,geteuid,getgid,getpeername,getpgrp,getpid,getppid,getrandom,getresgid,getresuid,getrlimit,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,ioctl,lseek,lstat,madvise,mbind,memfd_create,mkdir,mmap,mprotect,msync,munmap,nanosleep,open,pipe,pipe2,poll,ppoll,prctl,pread64,pwrite64,read,readlink,readlinkat,recvfrom,recvmsg,rename,rt_sigaction,rt_sigprocmask,rt_sigreturn,sched_getaffinity,sched_getparam,sched_get_priority_max,sched_get_priority_min,sched_getscheduler,sched_setscheduler,sched_yield,sendmsg,sendto,setgid,setresgid,setresuid,set_robust_list,setsid,setsockopt,set_tid_address,setuid,shmat,shmctl,shmdt,shmget,shutdown,socket,stat,statfs,sysinfo,timerfd_create,umask,uname,unlink,wait4,waitid,write,writev,fchmod,fchown,unshare,exit,exit_group
26seccomp
27
28nogroups
29shell none
30# private-bin program
31# private-etc none
32# private-dev - prevents libdc1394 loading; this lib is used to connect to a camera device
33private-tmp
diff --git a/etc/dino.profile b/etc/dino.profile
index a979cad7c..6d63e894e 100644
--- a/etc/dino.profile
+++ b/etc/dino.profile
@@ -26,6 +26,7 @@ nogroups
26nonewprivs 26nonewprivs
27noroot 27noroot
28nosound 28nosound
29novideo
29protocol unix,inet,inet6 30protocol unix,inet,inet6
30seccomp 31seccomp
31shell none 32shell none
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index af0bbfce6..7a3ca37ed 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -62,6 +62,8 @@ blacklist ${HOME}/.config/borg
62blacklist ${HOME}/.config/brasero 62blacklist ${HOME}/.config/brasero
63blacklist ${HOME}/.config/brave 63blacklist ${HOME}/.config/brave
64blacklist ${HOME}/.config/caja 64blacklist ${HOME}/.config/caja
65blacklist ${HOME}/.config/calibre
66blacklist ${HOME}/.config/catfish
65blacklist ${HOME}/.config/cherrytree 67blacklist ${HOME}/.config/cherrytree
66blacklist ${HOME}/.config/chromium 68blacklist ${HOME}/.config/chromium
67blacklist ${HOME}/.config/chromium-dev 69blacklist ${HOME}/.config/chromium-dev
@@ -71,6 +73,7 @@ blacklist ${HOME}/.config/cmus
71blacklist ${HOME}/.config/darktable 73blacklist ${HOME}/.config/darktable
72blacklist ${HOME}/.config/deadbeef 74blacklist ${HOME}/.config/deadbeef
73blacklist ${HOME}/.config/deluge 75blacklist ${HOME}/.config/deluge
76blacklist ${HOME}/.config/digikam
74blacklist ${HOME}/.config/dolphinrc 77blacklist ${HOME}/.config/dolphinrc
75blacklist ${HOME}/.config/dragonplayerrc 78blacklist ${HOME}/.config/dragonplayerrc
76blacklist ${HOME}/.config/enchant 79blacklist ${HOME}/.config/enchant
@@ -85,11 +88,12 @@ blacklist ${HOME}/.config/galculator
85blacklist ${HOME}/.config/geany 88blacklist ${HOME}/.config/geany
86blacklist ${HOME}/.config/geeqie 89blacklist ${HOME}/.config/geeqie
87blacklist ${HOME}/.config/gedit 90blacklist ${HOME}/.config/gedit
91blacklist ${HOME}/.config/ghb
88blacklist ${HOME}/.config/globaltime 92blacklist ${HOME}/.config/globaltime
89blacklist ${HOME}/.config/google-chrome 93blacklist ${HOME}/.config/google-chrome
90blacklist ${HOME}/.config/google-chrome-beta 94blacklist ${HOME}/.config/google-chrome-beta
91blacklist ${HOME}/.config/google-chrome-unstable 95blacklist ${HOME}/.config/google-chrome-unstable
92blacklist ${HOME}./config/gpicview 96blacklist ${HOME}/.config/gpicview
93blacklist ${HOME}/.config/gthumb 97blacklist ${HOME}/.config/gthumb
94blacklist ${HOME}/.config/gwenviewrc 98blacklist ${HOME}/.config/gwenviewrc
95blacklist ${HOME}/.config/hexchat 99blacklist ${HOME}/.config/hexchat
@@ -103,6 +107,7 @@ blacklist ${HOME}/.config/katesyntaxhighlightingrc
103blacklist ${HOME}/.config/katevirc 107blacklist ${HOME}/.config/katevirc
104blacklist ${HOME}/.config/kdeconnect 108blacklist ${HOME}/.config/kdeconnect
105blacklist ${HOME}/.config/knotesrc 109blacklist ${HOME}/.config/knotesrc
110blacklist ${HOME}/.config/ktorrentrc
106blacklist ${HOME}/.config/leafpad 111blacklist ${HOME}/.config/leafpad
107blacklist ${HOME}/.config/libreoffice 112blacklist ${HOME}/.config/libreoffice
108blacklist ${HOME}/.config/lximage-qt 113blacklist ${HOME}/.config/lximage-qt
@@ -136,6 +141,7 @@ blacklist ${HOME}/.config/redshift.conf
136blacklist ${HOME}/.config/scribus 141blacklist ${HOME}/.config/scribus
137blacklist ${HOME}/.config/skypeforlinux 142blacklist ${HOME}/.config/skypeforlinux
138blacklist ${HOME}/.config/slimjet 143blacklist ${HOME}/.config/slimjet
144blacklist ${HOME}/.config/smplayer
139blacklist ${HOME}/.config/spotify 145blacklist ${HOME}/.config/spotify
140blacklist ${HOME}/.config/stellarium 146blacklist ${HOME}/.config/stellarium
141blacklist ${HOME}/.config/synfig 147blacklist ${HOME}/.config/synfig
@@ -166,6 +172,7 @@ blacklist ${HOME}/.config/xviewer
166blacklist ${HOME}/.config/zathura 172blacklist ${HOME}/.config/zathura
167blacklist ${HOME}/.config/zoomus.conf 173blacklist ${HOME}/.config/zoomus.conf
168blacklist ${HOME}/.conkeror.mozdev.org 174blacklist ${HOME}/.conkeror.mozdev.org
175blacklist ${HOME}/.curlrc
169blacklist ${HOME}/.dia 176blacklist ${HOME}/.dia
170blacklist ${HOME}/.dillo 177blacklist ${HOME}/.dillo
171blacklist ${HOME}/.dosbox 178blacklist ${HOME}/.dosbox
@@ -200,6 +207,7 @@ blacklist ${HOME}/.kde4/share/apps/okular
200blacklist ${HOME}/.kde4/share/config/baloofilerc 207blacklist ${HOME}/.kde4/share/config/baloofilerc
201blacklist ${HOME}/.kde4/share/config/baloorc 208blacklist ${HOME}/.kde4/share/config/baloorc
202blacklist ${HOME}/.kde4/share/config/gwenviewrc 209blacklist ${HOME}/.kde4/share/config/gwenviewrc
210blacklist ${HOME}/.kde4/share/config/digikam
203blacklist ${HOME}/.kde4/share/config/k3brc 211blacklist ${HOME}/.kde4/share/config/k3brc
204blacklist ${HOME}/.kde4/share/config/kcookiejarrc 212blacklist ${HOME}/.kde4/share/config/kcookiejarrc
205blacklist ${HOME}/.kde4/share/config/khtmlrc 213blacklist ${HOME}/.kde4/share/config/khtmlrc
@@ -217,6 +225,7 @@ blacklist ${HOME}/.kde/share/apps/konqueror
217blacklist ${HOME}/.kde/share/apps/okular 225blacklist ${HOME}/.kde/share/apps/okular
218blacklist ${HOME}/.kde/share/config/baloofilerc 226blacklist ${HOME}/.kde/share/config/baloofilerc
219blacklist ${HOME}/.kde/share/config/baloorc 227blacklist ${HOME}/.kde/share/config/baloorc
228blacklist ${HOME}/.kde/share/config/digikam
220blacklist ${HOME}/.kde/share/config/gwenviewrc 229blacklist ${HOME}/.kde/share/config/gwenviewrc
221blacklist ${HOME}/.kde/share/config/k3brc 230blacklist ${HOME}/.kde/share/config/k3brc
222blacklist ${HOME}/.kde/share/config/kcookiejarrc 231blacklist ${HOME}/.kde/share/config/kcookiejarrc
@@ -253,7 +262,7 @@ blacklist ${HOME}/.local/share/caja-python
253blacklist ${HOME}/.local/share/cdprojektred 262blacklist ${HOME}/.local/share/cdprojektred
254blacklist ${HOME}/.local/share/clipit 263blacklist ${HOME}/.local/share/clipit
255blacklist ${HOME}/.local/share/data/Mumble 264blacklist ${HOME}/.local/share/data/Mumble
256blacklist ${HOME}./local/share/dino 265blacklist ${HOME}/.local/share/dino
257blacklist ${HOME}/.local/share/dolphin 266blacklist ${HOME}/.local/share/dolphin
258blacklist ${HOME}/.local/share/epiphany 267blacklist ${HOME}/.local/share/epiphany
259blacklist ${HOME}/.local/share/evolution 268blacklist ${HOME}/.local/share/evolution
@@ -265,6 +274,7 @@ blacklist ${HOME}/.local/share/gnome-chess
265blacklist ${HOME}/.local/share/gnome-music 274blacklist ${HOME}/.local/share/gnome-music
266blacklist ${HOME}/.local/share/gnome-photos 275blacklist ${HOME}/.local/share/gnome-photos
267blacklist ${HOME}/.local/share/kate 276blacklist ${HOME}/.local/share/kate
277blacklist ${HOME}/.local/share/ktorrentrc
268blacklist ${HOME}/.local/share/lollypop 278blacklist ${HOME}/.local/share/lollypop
269blacklist ${HOME}/.local/share/meld 279blacklist ${HOME}/.local/share/meld
270blacklist ${HOME}/.local/share/multimc5 280blacklist ${HOME}/.local/share/multimc5
@@ -298,6 +308,7 @@ blacklist ${HOME}/.mcabberrc
298blacklist ${HOME}/.mediathek3 308blacklist ${HOME}/.mediathek3
299blacklist ${HOME}/.mozilla 309blacklist ${HOME}/.mozilla
300blacklist ${HOME}/.mpdconf 310blacklist ${HOME}/.mpdconf
311blacklist ${HOME}/.mplayer
301blacklist ${HOME}/.msmtprc 312blacklist ${HOME}/.msmtprc
302blacklist ${HOME}/.multimc5 313blacklist ${HOME}/.multimc5
303blacklist ${HOME}/.mutt 314blacklist ${HOME}/.mutt
@@ -332,6 +343,7 @@ blacklist ${HOME}/.vst
332blacklist ${HOME}/.w3m 343blacklist ${HOME}/.w3m
333blacklist ${HOME}/.warzone2100-3.* 344blacklist ${HOME}/.warzone2100-3.*
334blacklist ${HOME}/.weechat 345blacklist ${HOME}/.weechat
346blacklist ${HOME}/.wgetrc
335blacklist ${HOME}/.wine 347blacklist ${HOME}/.wine
336blacklist ${HOME}/.wine64 348blacklist ${HOME}/.wine64
337blacklist ${HOME}/.xiphos 349blacklist ${HOME}/.xiphos
@@ -350,6 +362,7 @@ blacklist ${HOME}/.cache/INRIA
350blacklist ${HOME}/.cache/QuiteRss 362blacklist ${HOME}/.cache/QuiteRss
351blacklist ${HOME}/.cache/attic 363blacklist ${HOME}/.cache/attic
352blacklist ${HOME}/.cache/borg 364blacklist ${HOME}/.cache/borg
365blacklist ${HOME}/.cache/calibre
353blacklist ${HOME}/.cache/champlain 366blacklist ${HOME}/.cache/champlain
354blacklist ${HOME}/.cache/chromium 367blacklist ${HOME}/.cache/chromium
355blacklist ${HOME}/.cache/qupzilla 368blacklist ${HOME}/.cache/qupzilla
diff --git a/etc/dragon.profile b/etc/dragon.profile
index 661f663c3..d099f1d9d 100644
--- a/etc/dragon.profile
+++ b/etc/dragon.profile
@@ -18,6 +18,7 @@ netfilter
18nogroups 18nogroups
19nonewprivs 19nonewprivs
20noroot 20noroot
21novideo
21shell none 22shell none
22seccomp 23seccomp
23protocol unix,inet,inet6 24protocol unix,inet,inet6
diff --git a/etc/dropbox.profile b/etc/dropbox.profile
index e0097a8ea..19076704b 100644
--- a/etc/dropbox.profile
+++ b/etc/dropbox.profile
@@ -14,6 +14,7 @@ include /etc/firejail/disable-passwdmgr.inc
14caps 14caps
15nonewprivs 15nonewprivs
16noroot 16noroot
17novideo
17protocol unix,inet,inet6 18protocol unix,inet,inet6
18seccomp 19seccomp
19 20
diff --git a/etc/ebook-viewer.profile b/etc/ebook-viewer.profile
new file mode 100644
index 000000000..ba28e3550
--- /dev/null
+++ b/etc/ebook-viewer.profile
@@ -0,0 +1,10 @@
1# Persistent global definitions go here
2include /etc/firejail/globals.local
3
4# This file is overwritten during software install.
5# Persistent customizations should go in a .local file.
6include /etc/firejail/ebook-viewer.local
7
8# Firejail profile for ebook-viewer (Calibre)
9include /etc/firejail/calibre.profile
10net none
diff --git a/etc/elinks.profile b/etc/elinks.profile
index 76a7e6b94..597e43fb8 100644
--- a/etc/elinks.profile
+++ b/etc/elinks.profile
@@ -14,11 +14,12 @@ include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-passwdmgr.inc 14include /etc/firejail/disable-passwdmgr.inc
15 15
16caps.drop all 16caps.drop all
17no3d
17nogroups 18nogroups
18nonewprivs 19nonewprivs
19noroot 20noroot
20nosound 21nosound
21no3d 22novideo
22protocol unix,inet,inet6 23protocol unix,inet,inet6
23seccomp 24seccomp
24netfilter 25netfilter
diff --git a/etc/engrampa.profile b/etc/engrampa.profile
index f409a8dd4..081a5f6b0 100644
--- a/etc/engrampa.profile
+++ b/etc/engrampa.profile
@@ -16,6 +16,7 @@ nogroups
16nonewprivs 16nonewprivs
17noroot 17noroot
18nosound 18nosound
19novideo
19protocol unix 20protocol unix
20seccomp 21seccomp
21netfilter 22netfilter
diff --git a/etc/eog.profile b/etc/eog.profile
index 447a41a86..1b9926ec9 100644
--- a/etc/eog.profile
+++ b/etc/eog.profile
@@ -24,6 +24,7 @@ nogroups
24nonewprivs 24nonewprivs
25noroot 25noroot
26nosound 26nosound
27novideo
27protocol unix 28protocol unix
28seccomp 29seccomp
29shell none 30shell none
diff --git a/etc/eom.profile b/etc/eom.profile
index d2622ebcf..b5eedd989 100644
--- a/etc/eom.profile
+++ b/etc/eom.profile
@@ -19,6 +19,7 @@ nogroups
19nonewprivs 19nonewprivs
20noroot 20noroot
21nosound 21nosound
22novideo
22protocol unix 23protocol unix
23seccomp 24seccomp
24shell none 25shell none
diff --git a/etc/evince.profile b/etc/evince.profile
index 51ed3fbf3..6719244da 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -22,6 +22,7 @@ nogroups
22nonewprivs 22nonewprivs
23noroot 23noroot
24nosound 24nosound
25novideo
25protocol unix 26protocol unix
26seccomp 27seccomp
27shell none 28shell none
diff --git a/etc/file.profile b/etc/file.profile
index a757dce5a..915bf1088 100644
--- a/etc/file.profile
+++ b/etc/file.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,6 @@ include /etc/firejail/globals.local
6include /etc/firejail/file.local 7include /etc/firejail/file.local
7 8
8# file profile 9# file profile
9quiet
10include /etc/firejail/disable-common.inc 10include /etc/firejail/disable-common.inc
11include /etc/firejail/disable-programs.inc 11include /etc/firejail/disable-programs.inc
12include /etc/firejail/disable-passwdmgr.inc 12include /etc/firejail/disable-passwdmgr.inc
diff --git a/etc/firefox.profile b/etc/firefox.profile
index 9d047db97..70b41a240 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -13,7 +13,10 @@ noblacklist ~/.local/share/qpdfview
13noblacklist ~/.kde4/share/apps/okular 13noblacklist ~/.kde4/share/apps/okular
14noblacklist ~/.kde/share/apps/okular 14noblacklist ~/.kde/share/apps/okular
15noblacklist ~/.local/share/okular 15noblacklist ~/.local/share/okular
16noblacklist ~/.config/okularpartrc
17noblacklist ~/.config/okularrc
16noblacklist ~/.pki 18noblacklist ~/.pki
19
17include /etc/firejail/disable-common.inc 20include /etc/firejail/disable-common.inc
18include /etc/firejail/disable-programs.inc 21include /etc/firejail/disable-programs.inc
19include /etc/firejail/disable-devel.inc 22include /etc/firejail/disable-devel.inc
@@ -48,6 +51,8 @@ whitelist ~/.pki
48whitelist ~/.lastpass 51whitelist ~/.lastpass
49whitelist ~/.config/qpdfview 52whitelist ~/.config/qpdfview
50whitelist ~/.local/share/qpdfview 53whitelist ~/.local/share/qpdfview
54whitelist ~/.config/okularrc
55whitelist ~/.config/okularpartrc
51whitelist ~/.kde4/share/apps/okular 56whitelist ~/.kde4/share/apps/okular
52whitelist ~/.kde/share/apps/okular 57whitelist ~/.kde/share/apps/okular
53whitelist ~/.local/share/okular 58whitelist ~/.local/share/okular
diff --git a/etc/ghb.profile b/etc/ghb.profile
new file mode 100644
index 000000000..2068c3136
--- /dev/null
+++ b/etc/ghb.profile
@@ -0,0 +1,9 @@
1# Persistent global definitions go here
2include /etc/firejail/globals.local
3
4# This file is overwritten during software install.
5# Persistent customizations should go in a .local file.
6include /etc/firejail/ghb.local
7
8# HandBrake
9include /etc/firejail/handbrake.profile
diff --git a/etc/gimp-2.8.profile b/etc/gimp-2.8.profile
index 1902fac72..ce6cee7a5 100644
--- a/etc/gimp-2.8.profile
+++ b/etc/gimp-2.8.profile
@@ -1,4 +1,8 @@
1# Persistent global definitions go here 1# Persistent global definitions go here
2include /etc/firejail/globals.local 2include /etc/firejail/globals.local
3 3
4# This file is overwritten during software install.
5# Persistent customizations should go in a .local file.
6include /etc/firejail/gimp-2.8.local
7
4include /etc/firejail/gimp.profile 8include /etc/firejail/gimp.profile
diff --git a/etc/git.profile b/etc/git.profile
index a8e7bf882..5fa3ef95e 100644
--- a/etc/git.profile
+++ b/etc/git.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,6 @@ include /etc/firejail/globals.local
6include /etc/firejail/git.local 7include /etc/firejail/git.local
7 8
8# git profile 9# git profile
9quiet
10noblacklist ~/.gitconfig 10noblacklist ~/.gitconfig
11noblacklist ~/.ssh 11noblacklist ~/.ssh
12noblacklist ~/.gnupg 12noblacklist ~/.gnupg
diff --git a/etc/gtar.profile b/etc/gtar.profile
index cd15b7156..9a4325082 100644
--- a/etc/gtar.profile
+++ b/etc/gtar.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,5 +7,4 @@ include /etc/firejail/globals.local
6include /etc/firejail/gtar.local 7include /etc/firejail/gtar.local
7 8
8# gtar profile 9# gtar profile
9quiet
10include /etc/firejail/tar.profile 10include /etc/firejail/tar.profile
diff --git a/etc/gzip.profile b/etc/gzip.profile
index 2ba4e0b58..5a2a5d26e 100644
--- a/etc/gzip.profile
+++ b/etc/gzip.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,6 @@ include /etc/firejail/globals.local
6include /etc/firejail/gzip.local 7include /etc/firejail/gzip.local
7 8
8# gzip profile 9# gzip profile
9quiet
10ignore noroot 10ignore noroot
11include /etc/firejail/default.profile 11include /etc/firejail/default.profile
12 12
diff --git a/etc/handbrake-gtk.profile b/etc/handbrake-gtk.profile
new file mode 100644
index 000000000..a162352de
--- /dev/null
+++ b/etc/handbrake-gtk.profile
@@ -0,0 +1,9 @@
1# Persistent global definitions go here
2include /etc/firejail/globals.local
3
4# This file is overwritten during software install.
5# Persistent customizations should go in a .local file.
6include /etc/firejail/handbrake-gtk.local
7
8# HandBrake
9include /etc/firejail/handbrake.profile
diff --git a/etc/handbrake.profile b/etc/handbrake.profile
new file mode 100644
index 000000000..0f3f32250
--- /dev/null
+++ b/etc/handbrake.profile
@@ -0,0 +1,30 @@
1# Persistent global definitions go here
2include /etc/firejail/globals.local
3
4# This file is overwritten during software install.
5# Persistent customizations should go in a .local file.
6include /etc/firejail/handbrake.local
7
8noblacklist ~/.config/ghb
9include /etc/firejail/disable-common.inc
10include /etc/firejail/disable-programs.inc
11include /etc/firejail/disable-passwdmgr.inc
12
13caps.drop all
14netfilter
15nonewprivs
16noroot
17# netlink required!
18protocol unix,inet,inet6,netlink
19seccomp
20
21#
22# depending on your usage, you can enable some of the commands below:
23#
24nogroups
25shell none
26# private-bin program
27# private-etc none
28#private-dev
29private-tmp
30nosound
diff --git a/etc/keepassx.profile b/etc/keepassx.profile
index 9aeed0057..34e260f8f 100644
--- a/etc/keepassx.profile
+++ b/etc/keepassx.profile
@@ -17,6 +17,7 @@ include /etc/firejail/disable-devel.inc
17include /etc/firejail/disable-passwdmgr.inc 17include /etc/firejail/disable-passwdmgr.inc
18 18
19caps.drop all 19caps.drop all
20machine-id
20net none 21net none
21no3d 22no3d
22nogroups 23nogroups
@@ -28,8 +29,8 @@ seccomp
28shell none 29shell none
29tracelog 30tracelog
30 31
31private-bin keepassx 32private-bin keepassx,keepassx2
32private-etc fonts 33private-etc fonts,machine-id
33private-dev 34private-dev
34private-tmp 35private-tmp
35 36
diff --git a/etc/ktorrent.profile b/etc/ktorrent.profile
index 5b7e5e667..59c2827cd 100644
--- a/etc/ktorrent.profile
+++ b/etc/ktorrent.profile
@@ -8,6 +8,8 @@ include /etc/firejail/ktorrent.local
8################################ 8################################
9# Generic GUI application profile 9# Generic GUI application profile
10################################ 10################################
11noblacklist ~/.config/ktorrentrc
12noblacklist ~/.local/share/ktorrent
11noblacklist ~/.kde/share/config/ktorrentrc 13noblacklist ~/.kde/share/config/ktorrentrc
12noblacklist ~/.kde4/share/config/ktorrentrc 14noblacklist ~/.kde4/share/config/ktorrentrc
13noblacklist ~/.kde/share/apps/ktorrent 15noblacklist ~/.kde/share/apps/ktorrent
@@ -16,7 +18,10 @@ include /etc/firejail/disable-common.inc
16include /etc/firejail/disable-programs.inc 18include /etc/firejail/disable-programs.inc
17include /etc/firejail/disable-passwdmgr.inc 19include /etc/firejail/disable-passwdmgr.inc
18 20
19 21mkfile ~/.config/ktorrentrc
22whitelist ~/.config/ktorrentrc
23mkdir ~/.local/share/ktorrent
24whitelist ~/.local/share/ktorrent
20mkdir ~/.kde/share/config/ktorrentrc 25mkdir ~/.kde/share/config/ktorrentrc
21whitelist ~/.kde/share/config/ktorrentrc 26whitelist ~/.kde/share/config/ktorrentrc
22mkdir ~/.kde4/share/config/ktorrentrc 27mkdir ~/.kde4/share/config/ktorrentrc
diff --git a/etc/less.profile b/etc/less.profile
index 273b47a7a..dd63d3e2e 100644
--- a/etc/less.profile
+++ b/etc/less.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,6 @@ include /etc/firejail/globals.local
6include /etc/firejail/less.local 7include /etc/firejail/less.local
7 8
8# less profile 9# less profile
9quiet
10ignore noroot 10ignore noroot
11include /etc/firejail/default.profile 11include /etc/firejail/default.profile
12 12
diff --git a/etc/mate-calculator.profile b/etc/mate-calculator.profile
index 67a9f244e..acc687b81 100644
--- a/etc/mate-calculator.profile
+++ b/etc/mate-calculator.profile
@@ -1,4 +1,8 @@
1# Persistent global definitions go here 1# Persistent global definitions go here
2include /etc/firejail/globals.local 2include /etc/firejail/globals.local
3 3
4# This file is overwritten during software install.
5# Persistent customizations should go in a .local file.
6include /etc/firejail/mate-calculator.local
7
4#include /etc/firejail/mate-calc.profile 8#include /etc/firejail/mate-calc.profile
diff --git a/etc/mplayer.profile b/etc/mplayer.profile
new file mode 100644
index 000000000..879223e1a
--- /dev/null
+++ b/etc/mplayer.profile
@@ -0,0 +1,31 @@
1# Persistent global definitions go here
2include /etc/firejail/globals.local
3
4# This file is overwritten during software install.
5# Persistent customizations should go in a .local file.
6include /etc/firejail/mplayer.local
7
8# mplayer profile
9noblacklist ${HOME}/.mplayer
10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-programs.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-passwdmgr.inc
15
16caps.drop all
17#ipc-namespace
18netfilter
19# nogroups
20nonewprivs
21noroot
22protocol unix,inet,inet6,netlink
23seccomp
24shell none
25
26private-dev
27private-tmp
28private-bin mplayer
29
30noexec ${HOME}
31noexec /tmp
diff --git a/etc/qpdfview.profile b/etc/qpdfview.profile
index 1fe0a1f63..97bd2b0b1 100644
--- a/etc/qpdfview.profile
+++ b/etc/qpdfview.profile
@@ -6,7 +6,7 @@ include /etc/firejail/globals.local
6include /etc/firejail/qpdfview.local 6include /etc/firejail/qpdfview.local
7 7
8# qpdfview profile 8# qpdfview profile
9noblacklist ${HOME}./config/qt5ct 9noblacklist ${HOME}/.config/qt5ct
10noblacklist ${HOME}/.config/qpdfview 10noblacklist ${HOME}/.config/qpdfview
11noblacklist ${HOME}/.local/share/qpdfview 11noblacklist ${HOME}/.local/share/qpdfview
12 12
diff --git a/etc/server.profile b/etc/server.profile
index 31a81b88f..2d79fa1c8 100644
--- a/etc/server.profile
+++ b/etc/server.profile
@@ -18,6 +18,7 @@ blacklist /tmp/.X11-unix
18no3d 18no3d
19nosound 19nosound
20seccomp 20seccomp
21caps
21 22
22private 23private
23private-dev 24private-dev
diff --git a/etc/smplayer.profile b/etc/smplayer.profile
new file mode 100644
index 000000000..6a5c115b7
--- /dev/null
+++ b/etc/smplayer.profile
@@ -0,0 +1,32 @@
1# Persistent global definitions go here
2include /etc/firejail/globals.local
3
4# This file is overwritten during software install.
5# Persistent customizations should go in a .local file.
6include /etc/firejail/smplayer.local
7
8# smplayer profile
9noblacklist ${HOME}/.config/smplayer
10noblacklist ${HOME}/.mplayer
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-programs.inc
14include /etc/firejail/disable-devel.inc
15include /etc/firejail/disable-passwdmgr.inc
16
17caps.drop all
18#ipc-namespace
19netfilter
20# nogroups
21nonewprivs
22noroot
23protocol unix,inet,inet6,netlink
24seccomp
25shell none
26
27private-dev
28private-tmp
29private-bin smplayer,mplayer
30
31noexec ${HOME}
32noexec /tmp
diff --git a/etc/ssh-agent.profile b/etc/ssh-agent.profile
index bbb0baade..ab47067f1 100644
--- a/etc/ssh-agent.profile
+++ b/etc/ssh-agent.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,6 @@ include /etc/firejail/globals.local
6include /etc/firejail/ssh-agent.local 7include /etc/firejail/ssh-agent.local
7 8
8# ssh-agent 9# ssh-agent
9quiet
10noblacklist ~/.ssh 10noblacklist ~/.ssh
11noblacklist /tmp/ssh-* 11noblacklist /tmp/ssh-*
12noblacklist /etc/ssh 12noblacklist /etc/ssh
diff --git a/etc/ssh.profile b/etc/ssh.profile
index 7ea78535d..e592841a1 100644
--- a/etc/ssh.profile
+++ b/etc/ssh.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,6 @@ include /etc/firejail/globals.local
6include /etc/firejail/ssh.local 7include /etc/firejail/ssh.local
7 8
8# ssh client 9# ssh client
9quiet
10noblacklist ~/.ssh 10noblacklist ~/.ssh
11noblacklist /tmp/ssh-* 11noblacklist /tmp/ssh-*
12noblacklist /etc/ssh 12noblacklist /etc/ssh
diff --git a/etc/strings.profile b/etc/strings.profile
index b12c42f0d..a9301c652 100644
--- a/etc/strings.profile
+++ b/etc/strings.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,6 @@ include /etc/firejail/globals.local
6include /etc/firejail/strings.local 7include /etc/firejail/strings.local
7 8
8# strings profile 9# strings profile
9quiet
10ignore noroot 10ignore noroot
11include /etc/firejail/default.profile 11include /etc/firejail/default.profile
12 12
diff --git a/etc/tar.profile b/etc/tar.profile
index 0661286b4..577e795f8 100644
--- a/etc/tar.profile
+++ b/etc/tar.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,6 @@ include /etc/firejail/globals.local
6include /etc/firejail/tar.local 7include /etc/firejail/tar.local
7 8
8# tar profile 9# tar profile
9quiet
10ignore noroot 10ignore noroot
11include /etc/firejail/default.profile 11include /etc/firejail/default.profile
12 12
diff --git a/etc/thunar.profile b/etc/thunar.profile
index cd84acf39..d8389ebc8 100644
--- a/etc/thunar.profile
+++ b/etc/thunar.profile
@@ -1,4 +1,8 @@
1# Persistent global definitions go here 1# Persistent global definitions go here
2include /etc/firejail/globals.local 2include /etc/firejail/globals.local
3 3
4# This file is overwritten during software install.
5# Persistent customizations should go in a .local file.
6include /etc/firejail/thunar.local
7
4include /etc/firejail/Thunar.profile 8include /etc/firejail/Thunar.profile
diff --git a/etc/thunderbird.profile b/etc/thunderbird.profile
index 8a5bf1f7b..c693a53b3 100644
--- a/etc/thunderbird.profile
+++ b/etc/thunderbird.profile
@@ -25,6 +25,11 @@ noblacklist ~/.cache/thunderbird
25mkdir ~/.cache/thunderbird 25mkdir ~/.cache/thunderbird
26whitelist ~/.cache/thunderbird 26whitelist ~/.cache/thunderbird
27 27
28whitelist ~/.config/mimeapps.list
29read-only ~/.config/mimeapps.list
30whitelist ~/.local/share/applications
31read-only ~/.local/share/applications
32
28# allow browsers 33# allow browsers
29ignore private-tmp 34ignore private-tmp
30include /etc/firejail/firefox.profile 35include /etc/firejail/firefox.profile
diff --git a/etc/unrar.profile b/etc/unrar.profile
index 1375c9b48..62d6665ec 100644
--- a/etc/unrar.profile
+++ b/etc/unrar.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,6 @@ include /etc/firejail/globals.local
6include /etc/firejail/unrar.local 7include /etc/firejail/unrar.local
7 8
8# unrar profile 9# unrar profile
9quiet
10ignore noroot 10ignore noroot
11include /etc/firejail/default.profile 11include /etc/firejail/default.profile
12 12
diff --git a/etc/unzip.profile b/etc/unzip.profile
index 581d65167..130e57ae9 100644
--- a/etc/unzip.profile
+++ b/etc/unzip.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,6 @@ include /etc/firejail/globals.local
6include /etc/firejail/unzip.local 7include /etc/firejail/unzip.local
7 8
8# unzip profile 9# unzip profile
9quiet
10ignore noroot 10ignore noroot
11include /etc/firejail/default.profile 11include /etc/firejail/default.profile
12blacklist /tmp/.X11-unix 12blacklist /tmp/.X11-unix
diff --git a/etc/uudeview.profile b/etc/uudeview.profile
index c795619a0..46f28179b 100644
--- a/etc/uudeview.profile
+++ b/etc/uudeview.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,6 @@ include /etc/firejail/globals.local
6include /etc/firejail/uudeview.local 7include /etc/firejail/uudeview.local
7 8
8# uudeview profile 9# uudeview profile
9quiet
10ignore noroot 10ignore noroot
11include /etc/firejail/default.profile 11include /etc/firejail/default.profile
12 12
diff --git a/etc/vivaldi-beta.profile b/etc/vivaldi-beta.profile
index 51954c643..f2c2f4cc0 100644
--- a/etc/vivaldi-beta.profile
+++ b/etc/vivaldi-beta.profile
@@ -6,4 +6,4 @@ include /etc/firejail/globals.local
6include /etc/firejail/vivaldi-beta.local 6include /etc/firejail/vivaldi-beta.local
7 7
8# Vivaldi Beta browser profile 8# Vivaldi Beta browser profile
9include /etc/firejail/vivaldi-stable.profile 9include /etc/firejail/vivaldi.profile
diff --git a/etc/vivaldi-stable.profile b/etc/vivaldi-stable.profile
index a57b2dd78..9b2ccd4f3 100644
--- a/etc/vivaldi-stable.profile
+++ b/etc/vivaldi-stable.profile
@@ -4,19 +4,5 @@ include /etc/firejail/globals.local
4# This file is overwritten during software install. 4# This file is overwritten during software install.
5# Persistent customizations should go in a .local file. 5# Persistent customizations should go in a .local file.
6include /etc/firejail/vivaldi.local 6include /etc/firejail/vivaldi.local
7noblacklist ~/.cache/vivaldi
8 7
9# Vivaldi browser profile 8include /etc/firejail/vivaldi.profile
10noblacklist ~/.config/vivaldi
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-programs.inc
13include /etc/firejail/disable-devel.inc
14
15netfilter
16
17whitelist ${DOWNLOADS}
18mkdir ~/.config/vivaldi
19whitelist ~/.config/vivaldi
20mkdir ~/.cache/vivaldi
21whitelist ~/.cache/vivaldi
22include /etc/firejail/whitelist-common.inc
diff --git a/etc/vivaldi.profile b/etc/vivaldi.profile
index c01c6d608..25d78439d 100644
--- a/etc/vivaldi.profile
+++ b/etc/vivaldi.profile
@@ -6,4 +6,19 @@ include /etc/firejail/globals.local
6include /etc/firejail/vivaldi.local 6include /etc/firejail/vivaldi.local
7 7
8# Vivaldi browser profile 8# Vivaldi browser profile
9include /etc/firejail/vivaldi-stable.profile 9noblacklist ~/.cache/vivaldi
10
11# Vivaldi browser profile
12noblacklist ~/.config/vivaldi
13include /etc/firejail/disable-common.inc
14include /etc/firejail/disable-programs.inc
15include /etc/firejail/disable-devel.inc
16
17netfilter
18
19whitelist ${DOWNLOADS}
20mkdir ~/.config/vivaldi
21whitelist ~/.config/vivaldi
22mkdir ~/.cache/vivaldi
23whitelist ~/.cache/vivaldi
24include /etc/firejail/whitelist-common.inc
diff --git a/etc/vlc.profile b/etc/vlc.profile
index efd6d04a6..b36e844ff 100644
--- a/etc/vlc.profile
+++ b/etc/vlc.profile
@@ -24,7 +24,7 @@ seccomp
24shell none 24shell none
25 25
26private-bin vlc,cvlc,nvlc,rvlc,qvlc,svlc 26private-bin vlc,cvlc,nvlc,rvlc,qvlc,svlc
27# private-dev 27private-dev
28private-tmp 28private-tmp
29 29
30noexec ${HOME} 30noexec ${HOME}
diff --git a/etc/wget.profile b/etc/wget.profile
index 562c7bbf1..801e034ea 100644
--- a/etc/wget.profile
+++ b/etc/wget.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,7 @@ include /etc/firejail/globals.local
6include /etc/firejail/wget.local 7include /etc/firejail/wget.local
7 8
8# wget profile 9# wget profile
9quiet 10noblacklist ~/.wgetrc
10include /etc/firejail/disable-common.inc 11include /etc/firejail/disable-common.inc
11include /etc/firejail/disable-programs.inc 12include /etc/firejail/disable-programs.inc
12include /etc/firejail/disable-passwdmgr.inc 13include /etc/firejail/disable-passwdmgr.inc
diff --git a/etc/xz.profile b/etc/xz.profile
index f01906610..a3c1ab3ca 100644
--- a/etc/xz.profile
+++ b/etc/xz.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,5 +7,4 @@ include /etc/firejail/globals.local
6include /etc/firejail/xz.local 7include /etc/firejail/xz.local
7 8
8# xz profile 9# xz profile
9quiet
10include /etc/firejail/cpio.profile 10include /etc/firejail/cpio.profile
diff --git a/etc/xzdec.profile b/etc/xzdec.profile
index 21cb15556..2a84bf0ee 100644
--- a/etc/xzdec.profile
+++ b/etc/xzdec.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -6,7 +7,6 @@ include /etc/firejail/globals.local
6include /etc/firejail/xzdec.local 7include /etc/firejail/xzdec.local
7 8
8# xzdec profile 9# xzdec profile
9quiet
10ignore noroot 10ignore noroot
11include /etc/firejail/default.profile 11include /etc/firejail/default.profile
12 12
diff --git a/etc/youtube-dl.profile b/etc/youtube-dl.profile
index 8d925a354..e1ed3ccab 100644
--- a/etc/youtube-dl.profile
+++ b/etc/youtube-dl.profile
@@ -1,3 +1,4 @@
1quiet
1# Persistent global definitions go here 2# Persistent global definitions go here
2include /etc/firejail/globals.local 3include /etc/firejail/globals.local
3 4
@@ -24,7 +25,6 @@ protocol unix,inet,inet6
24seccomp 25seccomp
25shell none 26shell none
26tracelog 27tracelog
27quiet
28 28
29private-dev 29private-dev
30 30
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-08 23:05:17 +0000