Merge pull request #2362 from glitsj16/github-desktop

Refactoring github-desktop profile and firecfg

1 files changed, 15 insertions, 11 deletions

diff --git a/etc/desktop.profile b/etc/github-desktop.profile
index bfb1618b2..9ac212fe8 100644
--- a/etc/desktop.profile
+++ b/etc/github-desktop.profile
@@ -1,4 +1,4 @@
-# Firejail profile for desktop
+# Firejail profile for github-desktop
 # Description: Extend your GitHub workflow beyond your browser with GitHub Desktop
 # This file is overwritten after every install/update
 # Persistent local customizations
@@ -6,8 +6,8 @@ include github-desktop.local
 # Persistent global definitions
 include globals.local
 
-whitelist ${HOME}/.gitconfig
-whitelist ${HOME}/.config/GitHub Desktop
+noblacklist ${HOME}/.gitconfig
+noblacklist ${HOME}/.config/GitHub Desktop
 
 include disable-common.inc
 include disable-passwdmgr.inc
@@ -15,8 +15,6 @@ include disable-programs.inc
 include disable-devel.inc
 include disable-interpreters.inc
 
-include whitelist-common.inc
-
 caps.drop all
 netfilter
 # no3d
@@ -31,14 +29,20 @@ novideo
 protocol unix,inet,inet6,netlink
 seccomp
 
+# Note: On debian-based distributions the binary might be located in
+# /opt/GitHub Desktop/github-desktop, and therefore not be in PATH.
+# If that's the case you can start GitHub Desktop with firejail via
+# `firejail "/opt/GitHub Desktop/github-desktop"`.
+
 disable-mnt
-# private-bin Atom,desktop
-# private-cache
-# private-dev
+# private-bin github-desktop
+private-cache
+?HAS_APPIMAGE: ignore private-dev
+private-dev
 # private-etc none
 # private-lib
-# private-tmp
+private-tmp
 
 # memory-deny-write-execute
-# noexec ${HOME}
-# noexec /tmp
+noexec ${HOME}
+noexec /tmp