aboutsummaryrefslogtreecommitdiffstats
path: root/etc
diff options
context:
space:
mode:
authorLibravatar netblue30 <netblue30@protonmail.com>2021-07-25 12:31:32 +0000
committerLibravatar GitHub <noreply@github.com>2021-07-25 12:31:32 +0000
commit209cdb529b8fcaebd1775e553d63367bb7a86ecd (patch)
treec17c687e310c9d3ad7874dd40636c104d308e9a6 /etc
parentRevert "move whitelist/blacklist to allow/deny" (diff)
parentMerge branch 'master' of https://github.com/netblue30/firejail (diff)
downloadfirejail-209cdb529b8fcaebd1775e553d63367bb7a86ecd.tar.gz
firejail-209cdb529b8fcaebd1775e553d63367bb7a86ecd.tar.zst
firejail-209cdb529b8fcaebd1775e553d63367bb7a86ecd.zip
Merge branch 'master' into revert-allow-deny-etc
Diffstat (limited to 'etc')
-rw-r--r--etc/inc/disable-programs.inc8
-rw-r--r--etc/profile-a-l/avidemux.profile1
-rw-r--r--etc/profile-a-l/lifeograph.profile58
-rw-r--r--etc/profile-m-z/io.github.lainsce.Notejot.profile61
-rw-r--r--etc/profile-m-z/rednotebook.profile67
-rw-r--r--etc/profile-m-z/zim.profile72
6 files changed, 267 insertions, 0 deletions
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index fd907034f..44983dd14 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -320,6 +320,7 @@ blacklist ${HOME}/.config/meld
320blacklist ${HOME}/.config/menulibre.cfg 320blacklist ${HOME}/.config/menulibre.cfg
321blacklist ${HOME}/.config/meteo-qt 321blacklist ${HOME}/.config/meteo-qt
322blacklist ${HOME}/.config/mfusion 322blacklist ${HOME}/.config/mfusion
323blacklist ${HOME}/.config/microsoft-edge-beta
323blacklist ${HOME}/.config/microsoft-edge-dev 324blacklist ${HOME}/.config/microsoft-edge-dev
324blacklist ${HOME}/.config/midori 325blacklist ${HOME}/.config/midori
325blacklist ${HOME}/.config/mirage 326blacklist ${HOME}/.config/mirage
@@ -449,6 +450,7 @@ blacklist ${HOME}/.config/youtube-music-desktop-app
449blacklist ${HOME}/.config/youtube-viewer 450blacklist ${HOME}/.config/youtube-viewer
450blacklist ${HOME}/.config/youtubemusic-nativefier-040164 451blacklist ${HOME}/.config/youtubemusic-nativefier-040164
451blacklist ${HOME}/.config/zathura 452blacklist ${HOME}/.config/zathura
453blacklist ${HOME}/.config/zim
452blacklist ${HOME}/.config/zoomus.conf 454blacklist ${HOME}/.config/zoomus.conf
453blacklist ${HOME}/.conkeror.mozdev.org 455blacklist ${HOME}/.conkeror.mozdev.org
454blacklist ${HOME}/.crawl 456blacklist ${HOME}/.crawl
@@ -684,6 +686,7 @@ blacklist ${HOME}/.local/share/godot
684blacklist ${HOME}/.local/share/gradio 686blacklist ${HOME}/.local/share/gradio
685blacklist ${HOME}/.local/share/gwenview 687blacklist ${HOME}/.local/share/gwenview
686blacklist ${HOME}/.local/share/i2p 688blacklist ${HOME}/.local/share/i2p
689blacklist ${HOME}/.local/share/io.github.lainsce.Notejot
687blacklist ${HOME}/.local/share/jami 690blacklist ${HOME}/.local/share/jami
688blacklist ${HOME}/.local/share/kaffeine 691blacklist ${HOME}/.local/share/kaffeine
689blacklist ${HOME}/.local/share/kalgebra 692blacklist ${HOME}/.local/share/kalgebra
@@ -840,6 +843,7 @@ blacklist ${HOME}/.qgis2
840blacklist ${HOME}/.qmmp 843blacklist ${HOME}/.qmmp
841blacklist ${HOME}/.quodlibet 844blacklist ${HOME}/.quodlibet
842blacklist ${HOME}/.redeclipse 845blacklist ${HOME}/.redeclipse
846blacklist ${HOME}/.rednotebook
843blacklist ${HOME}/.remmina 847blacklist ${HOME}/.remmina
844blacklist ${HOME}/.repo_.gitconfig.json 848blacklist ${HOME}/.repo_.gitconfig.json
845blacklist ${HOME}/.repoconfig 849blacklist ${HOME}/.repoconfig
@@ -1010,6 +1014,7 @@ blacklist ${HOME}/.cache/gummi
1010blacklist ${HOME}/.cache/icedove 1014blacklist ${HOME}/.cache/icedove
1011blacklist ${HOME}/.cache/inkscape 1015blacklist ${HOME}/.cache/inkscape
1012blacklist ${HOME}/.cache/inox 1016blacklist ${HOME}/.cache/inox
1017blacklist ${HOME}/.cache/io.github.lainsce.Notejot
1013blacklist ${HOME}/.cache/iridium 1018blacklist ${HOME}/.cache/iridium
1014blacklist ${HOME}/.cache/JetBrains/CLion* 1019blacklist ${HOME}/.cache/JetBrains/CLion*
1015blacklist ${HOME}/.cache/kcmshell5 1020blacklist ${HOME}/.cache/kcmshell5
@@ -1031,6 +1036,7 @@ blacklist ${HOME}/.cache/liferea
1031blacklist ${HOME}/.cache/lutris 1036blacklist ${HOME}/.cache/lutris
1032blacklist ${HOME}/.cache/marker 1037blacklist ${HOME}/.cache/marker
1033blacklist ${HOME}/.cache/matrix-mirage 1038blacklist ${HOME}/.cache/matrix-mirage
1039blacklist ${HOME}/.cache/microsoft-edge-beta
1034blacklist ${HOME}/.cache/microsoft-edge-dev 1040blacklist ${HOME}/.cache/microsoft-edge-dev
1035blacklist ${HOME}/.cache/midori 1041blacklist ${HOME}/.cache/midori
1036blacklist ${HOME}/.cache/minetest 1042blacklist ${HOME}/.cache/minetest
@@ -1066,6 +1072,7 @@ blacklist ${HOME}/.cache/qBittorrent
1066blacklist ${HOME}/.cache/quodlibet 1072blacklist ${HOME}/.cache/quodlibet
1067blacklist ${HOME}/.cache/qupzilla 1073blacklist ${HOME}/.cache/qupzilla
1068blacklist ${HOME}/.cache/qutebrowser 1074blacklist ${HOME}/.cache/qutebrowser
1075blacklist ${HOME}/.cache/rednotebook
1069blacklist ${HOME}/.cache/rhythmbox 1076blacklist ${HOME}/.cache/rhythmbox
1070blacklist ${HOME}/.cache/shotwell 1077blacklist ${HOME}/.cache/shotwell
1071blacklist ${HOME}/.cache/simple-scan 1078blacklist ${HOME}/.cache/simple-scan
@@ -1096,3 +1103,4 @@ blacklist ${HOME}/.cache/yandex-browser
1096blacklist ${HOME}/.cache/yandex-browser-beta 1103blacklist ${HOME}/.cache/yandex-browser-beta
1097blacklist ${HOME}/.cache/youtube-dl 1104blacklist ${HOME}/.cache/youtube-dl
1098blacklist ${HOME}/.cache/youtube-viewer 1105blacklist ${HOME}/.cache/youtube-viewer
1106blacklist ${HOME}/.cache/zim
diff --git a/etc/profile-a-l/avidemux.profile b/etc/profile-a-l/avidemux.profile
index 1ecc03da1..7f9d0f6e7 100644
--- a/etc/profile-a-l/avidemux.profile
+++ b/etc/profile-a-l/avidemux.profile
@@ -23,6 +23,7 @@ mkdir ${HOME}/.config/avidemux3_qt5rc
23whitelist ${HOME}/.avidemux6 23whitelist ${HOME}/.avidemux6
24whitelist ${HOME}/.config/avidemux3_qt5rc 24whitelist ${HOME}/.config/avidemux3_qt5rc
25whitelist ${VIDEOS} 25whitelist ${VIDEOS}
26
26include whitelist-common.inc 27include whitelist-common.inc
27include whitelist-runuser-common.inc 28include whitelist-runuser-common.inc
28include whitelist-usr-share-common.inc 29include whitelist-usr-share-common.inc
diff --git a/etc/profile-a-l/lifeograph.profile b/etc/profile-a-l/lifeograph.profile
new file mode 100644
index 000000000..b9ed0de8e
--- /dev/null
+++ b/etc/profile-a-l/lifeograph.profile
@@ -0,0 +1,58 @@
1# Firejail profile for lifeograph
2# Description: Lifeograph is a diary program to take personal notes
3# This file is overwritten after every install/update
4# Persistent local customizations
5include lifeograph.local
6# Persistent global definitions
7include globals.local
8
9nodeny ${DOCUMENTS}
10
11deny /usr/libexec
12
13include disable-common.inc
14include disable-devel.inc
15include disable-exec.inc
16include disable-interpreters.inc
17include disable-passwdmgr.inc
18include disable-programs.inc
19include disable-shell.inc
20include disable-xdg.inc
21
22allow ${DOCUMENTS}
23allow /usr/share/lifeograph
24include whitelist-common.inc
25include whitelist-runuser-common.inc
26include whitelist-usr-share-common.inc
27include whitelist-var-common.inc
28
29apparmor
30caps.drop all
31machine-id
32net none
33no3d
34nodvd
35nogroups
36noinput
37nonewprivs
38noroot
39nosound
40notv
41nou2f
42novideo
43protocol unix
44seccomp
45seccomp.block-secondary
46shell none
47tracelog
48
49disable-mnt
50private-bin lifeograph
51private-cache
52private-dev
53private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11
54private-tmp
55
56dbus-user filter
57dbus-user.talk ca.desrt.dconf
58dbus-system none
diff --git a/etc/profile-m-z/io.github.lainsce.Notejot.profile b/etc/profile-m-z/io.github.lainsce.Notejot.profile
new file mode 100644
index 000000000..a8029db72
--- /dev/null
+++ b/etc/profile-m-z/io.github.lainsce.Notejot.profile
@@ -0,0 +1,61 @@
1# Firejail profile for notejot
2# Description: Jot your ideas
3# This file is overwritten after every install/update
4# Persistent local customizations
5include io.github.lainsce.Notejot.local
6# Persistent global definitions
7include globals.local
8
9nodeny ${HOME}/.cache/io.github.lainsce.Notejot
10nodeny ${HOME}/.local/share/io.github.lainsce.Notejot
11
12include disable-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18include disable-shell.inc
19include disable-xdg.inc
20
21mkdir ${HOME}/.cache/io.github.lainsce.Notejot
22mkdir ${HOME}/.local/share/io.github.lainsce.Notejot
23allow ${HOME}/.cache/io.github.lainsce.Notejot
24allow ${HOME}/.local/share/io.github.lainsce.Notejot
25allow /usr/libexec/webkit2gtk-4.0
26include whitelist-common.inc
27include whitelist-runuser-common.inc
28include whitelist-usr-share-common.inc
29include whitelist-var-common.inc
30
31apparmor
32caps.drop all
33machine-id
34net none
35no3d
36nodvd
37nogroups
38noinput
39nonewprivs
40noroot
41nosound
42notv
43nou2f
44novideo
45protocol unix
46seccomp
47seccomp.block-secondary
48shell none
49tracelog
50
51disable-mnt
52private-bin io.github.lainsce.Notejot
53private-cache
54private-dev
55private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11
56private-tmp
57
58dbus-user filter
59dbus-user.own io.github.lainsce.Notejot
60dbus-user.talk ca.desrt.dconf
61dbus-system none
diff --git a/etc/profile-m-z/rednotebook.profile b/etc/profile-m-z/rednotebook.profile
new file mode 100644
index 000000000..67281c518
--- /dev/null
+++ b/etc/profile-m-z/rednotebook.profile
@@ -0,0 +1,67 @@
1# Firejail profile for rednotebook
2# Description: Daily journal with calendar, templates and keyword searching
3# This file is overwritten after every install/update
4# Persistent local customizations
5include rednotebook.local
6# Persistent global definitions
7include globals.local
8
9nodeny ${HOME}/.cache/rednotebook
10nodeny ${HOME}/.rednotebook
11
12# Allow python (blacklisted by disable-interpreters.inc)
13include allow-python3.inc
14
15include disable-common.inc
16include disable-devel.inc
17include disable-exec.inc
18include disable-interpreters.inc
19include disable-passwdmgr.inc
20include disable-programs.inc
21include disable-shell.inc
22
23mkdir ${HOME}/.cache/rednotebook
24mkdir ${HOME}/.rednotebook
25allow ${HOME}/.cache/rednotebook
26allow ${HOME}/.rednotebook
27allow ${DESKTOP}
28allow ${DOCUMENTS}
29allow ${DOWNLOADS}
30allow ${MUSIC}
31allow ${PICTURES}
32allow ${VIDEOS}
33allow /usr/libexec/webkit2gtk-4.0
34include whitelist-common.inc
35include whitelist-runuser-common.inc
36include whitelist-usr-share-common.inc
37include whitelist-var-common.inc
38
39apparmor
40caps.drop all
41machine-id
42net none
43no3d
44nodvd
45nogroups
46noinput
47nonewprivs
48noroot
49nosound
50notv
51nou2f
52novideo
53protocol unix
54seccomp
55seccomp.block-secondary
56shell none
57tracelog
58
59disable-mnt
60private-bin python3*,rednotebook
61private-cache
62private-dev
63private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11
64private-tmp
65
66dbus-user none
67dbus-system none
diff --git a/etc/profile-m-z/zim.profile b/etc/profile-m-z/zim.profile
new file mode 100644
index 000000000..5ae9cddb3
--- /dev/null
+++ b/etc/profile-m-z/zim.profile
@@ -0,0 +1,72 @@
1# Firejail profile for Zim
2# Description: Desktop wiki & notekeeper
3# This file is overwritten after every install/update
4# Persistent local customizations
5include zim.local
6# Persistent global definitions
7include globals.local
8
9nodeny ${HOME}/.cache/zim
10nodeny ${HOME}/.config/zim
11
12# Allow python (blacklisted by disable-interpreters.inc)
13include allow-python2.inc
14include allow-python3.inc
15
16deny /usr/libexec
17
18include disable-common.inc
19include disable-devel.inc
20include disable-exec.inc
21include disable-interpreters.inc
22include disable-passwdmgr.inc
23include disable-programs.inc
24include disable-shell.inc
25
26mkdir ${HOME}/.cache/zim
27mkdir ${HOME}/.config/zim
28mkdir ${HOME}/Notebooks
29allow ${HOME}/.cache/zim
30allow ${HOME}/.config/zim
31allow ${HOME}/Notebooks
32allow ${DESKTOP}
33allow ${DOCUMENTS}
34allow ${DOWNLOADS}
35allow ${MUSIC}
36allow ${PICTURES}
37allow ${VIDEOS}
38allow /usr/share/zim
39include whitelist-common.inc
40include whitelist-runuser-common.inc
41include whitelist-usr-share-common.inc
42include whitelist-var-common.inc
43
44apparmor
45caps.drop all
46machine-id
47net none
48no3d
49nodvd
50nogroups
51noinput
52nonewprivs
53noroot
54nosound
55notv
56nou2f
57novideo
58protocol unix
59seccomp
60seccomp.block-secondary
61shell none
62tracelog
63
64disable-mnt
65private-bin python*,zim
66private-cache
67private-dev
68private-etc alternatives,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11
69private-tmp
70
71dbus-user none
72dbus-system none
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-22 22:34:43 +0000