Arch Linux specific changes (#2788)

* Arch Linux specific addition to gzip.profile

* Arch Linux specifics for tar.profile

* Arch Linux specifics for gzip.profile

* Minor re-ordering and wording edits for makepkg.profile

* Spacing fix for cower.profile

4 files changed, 13 insertions, 9 deletions

diff --git a/etc/cower.profile b/etc/cower.profile
index 69575cea4..8efe48240 100644
--- a/etc/cower.profile
+++ b/etc/cower.profile
@@ -45,4 +45,5 @@ private-dev
 private-tmp
 
 memory-deny-write-execute
+
 read-only ${HOME}/.config/cower/config
diff --git a/etc/gzip.profile b/etc/gzip.profile
index 38f6ee65e..48e495c60 100644
--- a/etc/gzip.profile
+++ b/etc/gzip.profile
@@ -7,6 +7,9 @@ include gzip.local
 # Persistent global definitions
 include globals.local
 
+# Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only.
+noblacklist /var/lib/pacman
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
diff --git a/etc/makepkg.profile b/etc/makepkg.profile
index 55bea9c5e..0120fc2cd 100644
--- a/etc/makepkg.profile
+++ b/etc/makepkg.profile
@@ -1,5 +1,10 @@
 # Firejail profile for makepkg
 # This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include makepkg.local
+# Persistent global definitions
+include globals.local
 
 # Note: see this Arch forum discussion https://bbs.archlinux.org/viewtopic.php?pid=1743138
 # for potential issues and their solutions when Firejailing makepkg
@@ -8,13 +13,6 @@
 # whitelist ${HOME}/<Your Build Folder>
 # whitelist ${HOME}/.gnupg
 
-quiet
-# Persistent local customizations
-include makepkg.local
-# Persistent global definitions
-include globals.local
-
-
 # Enable severely restricted access to ${HOME}/.gnupg
 noblacklist ${HOME}/.gnupg
 read-only ${HOME}/.gnupg/gpg.conf
@@ -26,8 +24,7 @@ blacklist ${HOME}/.gnupg/private-keys-v1.d
 blacklist ${HOME}/.gnupg/crls.d
 blacklist ${HOME}/.gnupg/openpgp-revocs.d
 
-
-# Need to be able to read /var/lib/pacman, {Note no capabilities so automatically read-only}
+# Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only.
 noblacklist /var/lib/pacman
 
 include disable-common.inc
diff --git a/etc/tar.profile b/etc/tar.profile
index 1232bb372..cace89965 100644
--- a/etc/tar.profile
+++ b/etc/tar.profile
@@ -7,6 +7,9 @@ include tar.local
 # Persistent global definitions
 include globals.local
 
+# Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only.
+noblacklist /var/lib/pacman
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc