aboutsummaryrefslogtreecommitdiffstats
path: root/etc
diff options
context:
space:
mode:
authorLibravatar netblue30 <netblue30@protonmail.com>2020-10-25 07:17:01 -0500
committerLibravatar GitHub <noreply@github.com>2020-10-25 07:17:01 -0500
commitbd1819a8641e0eeae016846b28a41e625bcc215b (patch)
tree96bbfeea9759e151a6ee402a63f14874c891ad03 /etc
parentcheck that profiles are sorted (diff)
parentAdd note about private-bin (diff)
downloadfirejail-bd1819a8641e0eeae016846b28a41e625bcc215b.tar.gz
firejail-bd1819a8641e0eeae016846b28a41e625bcc215b.tar.zst
firejail-bd1819a8641e0eeae016846b28a41e625bcc215b.zip
Merge pull request #3607 from kortewegdevries/wemail
Switch mails to whitelisting
Diffstat (limited to 'etc')
-rw-r--r--etc/profile-a-l/evolution.profile60
-rw-r--r--etc/profile-a-l/kmail.profile81
2 files changed, 133 insertions, 8 deletions
diff --git a/etc/profile-a-l/evolution.profile b/etc/profile-a-l/evolution.profile
index 422200ffe..1355c4337 100644
--- a/etc/profile-a-l/evolution.profile
+++ b/etc/profile-a-l/evolution.profile
@@ -6,15 +6,16 @@ include evolution.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9noblacklist /var/mail
10noblacklist /var/spool/mail
11noblacklist ${HOME}/.bogofilter 9noblacklist ${HOME}/.bogofilter
10noblacklist ${HOME}/.gnupg
11noblacklist ${HOME}/.mozilla
12noblacklist ${HOME}/.pki
12noblacklist ${HOME}/.cache/evolution 13noblacklist ${HOME}/.cache/evolution
13noblacklist ${HOME}/.config/evolution 14noblacklist ${HOME}/.config/evolution
14noblacklist ${HOME}/.gnupg
15noblacklist ${HOME}/.local/share/evolution 15noblacklist ${HOME}/.local/share/evolution
16noblacklist ${HOME}/.pki
17noblacklist ${HOME}/.local/share/pki 16noblacklist ${HOME}/.local/share/pki
17noblacklist /var/mail
18noblacklist /var/spool/mail
18 19
19include disable-common.inc 20include disable-common.inc
20include disable-devel.inc 21include disable-devel.inc
@@ -22,13 +23,42 @@ include disable-exec.inc
22include disable-interpreters.inc 23include disable-interpreters.inc
23include disable-passwdmgr.inc 24include disable-passwdmgr.inc
24include disable-programs.inc 25include disable-programs.inc
26include disable-shell.inc
27include disable-xdg.inc
25 28
29mkdir ${HOME}/.bogofilter
30mkdir ${HOME}/.gnupg
31mkdir ${HOME}/.pki
32mkdir ${HOME}/.cache/evolution
33mkdir ${HOME}/.config/evolution
34mkdir ${HOME}/.local/share/evolution
35mkdir ${HOME}/.local/share/pki
36whitelist ${HOME}/.bogofilter
37whitelist ${HOME}/.gnupg
38whitelist ${HOME}/.mozilla/firefox/profiles.ini
39whitelist ${HOME}/.pki
40whitelist ${HOME}/.cache/evolution
41whitelist ${HOME}/.config/evolution
42whitelist ${HOME}/.local/share/evolution
43whitelist ${HOME}/.local/share/pki
44whitelist ${DOCUMENTS}
45whitelist ${DOWNLOADS}
46whitelist ${RUNUSER}/gnupg
47whitelist /usr/share/evolution
48whitelist /usr/share/gnupg
49whitelist /usr/share/gnupg2
50whitelist /var/mail
51whitelist /var/spool/mail
52include whitelist-common.inc
26include whitelist-runuser-common.inc 53include whitelist-runuser-common.inc
54include whitelist-usr-share-common.inc
55include whitelist-var-common.inc
27 56
57apparmor
28caps.drop all 58caps.drop all
29netfilter 59netfilter
30# no3d breaks under wayland 60# no3d breaks under wayland
31#no3d 61# no3d
32nodvd 62nodvd
33nogroups 63nogroups
34nonewprivs 64nonewprivs
@@ -40,7 +70,27 @@ novideo
40protocol unix,inet,inet6 70protocol unix,inet,inet6
41seccomp 71seccomp
42shell none 72shell none
73tracelog
43 74
75# disable-mnt
76# Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg
77# To use private-bin add all evolution,gpg,pinentry binaries and follow firefox.profile for hyperlink support
78# private-bin evolution
79private-cache
44private-dev 80private-dev
81private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,mailname,passwd,pki,resolv.conf,selinux,ssl,xdg
45private-tmp 82private-tmp
83writable-run-user
46writable-var 84writable-var
85
86dbus-user filter
87dbus-user.own org.gnome.Evolution
88dbus-user.talk ca.desrt.dconf
89# Uncomment to have keyring access
90# dbus-user.talk org.freedesktop.secrets
91dbus-user.talk org.gnome.keyring.SystemPrompter
92dbus-user.talk org.gnome.OnlineAccounts
93dbus-user.talk org.freedesktop.Notifications
94dbus-system none
95
96read-only ${HOME}/.mozilla/firefox/profiles.ini
diff --git a/etc/profile-a-l/kmail.profile b/etc/profile-a-l/kmail.profile
index ab4ff10b9..43060dd61 100644
--- a/etc/profile-a-l/kmail.profile
+++ b/etc/profile-a-l/kmail.profile
@@ -9,6 +9,10 @@ include globals.local
9# kmail has problems launching akonadi in debian and ubuntu. 9# kmail has problems launching akonadi in debian and ubuntu.
10# one solution is to have akonadi already running when kmail is started 10# one solution is to have akonadi already running when kmail is started
11 11
12noblacklist ${HOME}/.gnupg
13# noblacklist ${HOME}/.kde/
14# noblacklist ${HOME}/.kde4/
15noblacklist ${HOME}/.mozilla
12noblacklist ${HOME}/.cache/akonadi* 16noblacklist ${HOME}/.cache/akonadi*
13noblacklist ${HOME}/.cache/kmail2 17noblacklist ${HOME}/.cache/kmail2
14noblacklist ${HOME}/.config/akonadi* 18noblacklist ${HOME}/.config/akonadi*
@@ -19,7 +23,6 @@ noblacklist ${HOME}/.config/kmail2rc
19noblacklist ${HOME}/.config/kmailsearchindexingrc 23noblacklist ${HOME}/.config/kmailsearchindexingrc
20noblacklist ${HOME}/.config/mailtransports 24noblacklist ${HOME}/.config/mailtransports
21noblacklist ${HOME}/.config/specialmailcollectionsrc 25noblacklist ${HOME}/.config/specialmailcollectionsrc
22noblacklist ${HOME}/.gnupg
23noblacklist ${HOME}/.local/share/akonadi* 26noblacklist ${HOME}/.local/share/akonadi*
24noblacklist ${HOME}/.local/share/apps/korganizer 27noblacklist ${HOME}/.local/share/apps/korganizer
25noblacklist ${HOME}/.local/share/contacts 28noblacklist ${HOME}/.local/share/contacts
@@ -30,6 +33,8 @@ noblacklist ${HOME}/.local/share/kxmlgui5/kmail2
30noblacklist ${HOME}/.local/share/local-mail 33noblacklist ${HOME}/.local/share/local-mail
31noblacklist ${HOME}/.local/share/notes 34noblacklist ${HOME}/.local/share/notes
32noblacklist /tmp/akonadi-* 35noblacklist /tmp/akonadi-*
36noblacklist /var/mail
37noblacklist /var/spool/mail
33 38
34include disable-common.inc 39include disable-common.inc
35include disable-devel.inc 40include disable-devel.inc
@@ -37,10 +42,73 @@ include disable-exec.inc
37include disable-interpreters.inc 42include disable-interpreters.inc
38include disable-passwdmgr.inc 43include disable-passwdmgr.inc
39include disable-programs.inc 44include disable-programs.inc
45include disable-xdg.inc
40 46
47mkdir ${HOME}/.gnupg
48# mkdir ${HOME}/.kde/
49# mkdir ${HOME}/.kde4/
50mkdir ${HOME}/.cache/akonadi*
51mkdir ${HOME}/.cache/kmail2
52mkdir ${HOME}/.config/akonadi*
53mkdir ${HOME}/.config/baloorc
54mkdir ${HOME}/.config/emaildefaults
55mkdir ${HOME}/.config/emailidentities
56mkdir ${HOME}/.config/kmail2rc
57mkdir ${HOME}/.config/kmailsearchindexingrc
58mkdir ${HOME}/.config/mailtransports
59mkdir ${HOME}/.config/specialmailcollectionsrc
60mkdir ${HOME}/.local/share/akonadi*
61mkdir ${HOME}/.local/share/apps/korganizer
62mkdir ${HOME}/.local/share/contacts
63mkdir ${HOME}/.local/share/emailidentities
64mkdir ${HOME}/.local/share/kmail2
65mkdir ${HOME}/.local/share/kxmlgui5/kmail
66mkdir ${HOME}/.local/share/kxmlgui5/kmail2
67mkdir ${HOME}/.local/share/local-mail
68mkdir ${HOME}/.local/share/notes
69mkdir /tmp/akonadi-*
70whitelist ${HOME}/.gnupg
71# whitelist ${HOME}/.kde/
72# whitelist ${HOME}/.kde4/
73whitelist ${HOME}/.mozilla/firefox/profiles.ini
74whitelist ${HOME}/.cache/akonadi*
75whitelist ${HOME}/.cache/kmail2
76whitelist ${HOME}/.config/akonadi*
77whitelist ${HOME}/.config/baloorc
78whitelist ${HOME}/.config/emaildefaults
79whitelist ${HOME}/.config/emailidentities
80whitelist ${HOME}/.config/kmail2rc
81whitelist ${HOME}/.config/kmailsearchindexingrc
82whitelist ${HOME}/.config/mailtransports
83whitelist ${HOME}/.config/specialmailcollectionsrc
84whitelist ${HOME}/.local/share/akonadi*
85whitelist ${HOME}/.local/share/apps/korganizer
86whitelist ${HOME}/.local/share/contacts
87whitelist ${HOME}/.local/share/emailidentities
88whitelist ${HOME}/.local/share/kmail2
89whitelist ${HOME}/.local/share/kxmlgui5/kmail
90whitelist ${HOME}/.local/share/kxmlgui5/kmail2
91whitelist ${HOME}/.local/share/local-mail
92whitelist ${HOME}/.local/share/notes
93whitelist ${DOWNLOADS}
94whitelist ${DOCUMENTS}
95whitelist ${RUNUSER}/gnupg
96whitelist /tmp/akonadi-*
97whitelist /usr/share/akonadi
98whitelist /usr/share/gnupg
99whitelist /usr/share/gnupg2
100whitelist /usr/share/kconf_update
101whitelist /usr/share/kf5
102whitelist /usr/share/kservices5
103whitelist /usr/share/qlogging-categories5
104whitelist /var/mail
105whitelist /var/spool/mail
106include whitelist-common.inc
107include whitelist-runnuser-common.inc
108include whitelist-usr-share-common.inc
41include whitelist-var-common.inc 109include whitelist-var-common.inc
42 110
43# apparmor 111apparmor
44caps.drop all 112caps.drop all
45netfilter 113netfilter
46nodvd 114nodvd
@@ -56,7 +124,14 @@ protocol unix,inet,inet6,netlink
56seccomp !chroot,!io_getevents,!io_setup,!io_submit,!ioprio_set 124seccomp !chroot,!io_getevents,!io_setup,!io_submit,!ioprio_set
57# tracelog 125# tracelog
58 126
127private-cache
59private-dev 128private-dev
129private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg
60# private-tmp - interrupts connection to akonadi, breaks opening of email attachments 130# private-tmp - interrupts connection to akonadi, breaks opening of email attachments
61# writable-run-user is needed for signing and encrypting emails
62writable-run-user 131writable-run-user
132writable-var
133
134# dbus-user none
135dbus-system none
136
137read-only ${HOME}/.mozilla/firefox/profiles.ini \ No newline at end of file
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-08-18 22:08:19 +0000