Merge branch 'master' of https://github.com/netblue30/firejail

7 files changed, 27 insertions, 4 deletions

diff --git a/etc/audacious.profile b/etc/audacious.profile
index 63ba9af9c..d12032166 100644
--- a/etc/audacious.profile
+++ b/etc/audacious.profile
@@ -4,13 +4,21 @@ include /etc/firejail/audacious.local
 
 # Audacious media player profile
 noblacklist ~/.config/audacious
+noblacklist ~/.config/Audaciousrc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
 nonewprivs
 noroot
 protocol unix,inet,inet6
 seccomp
+shell none
+tracelog
+
+private-bin audacious
+private-dev
+private-tmp
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index be3144133..78b41371a 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -165,6 +165,7 @@ blacklist ${HOME}/*.key
 blacklist ${HOME}/.muttrc
 blacklist ${HOME}/.mutt/muttrc
 blacklist ${HOME}/.msmtprc
+blacklist ${HOME}/.pki
 blacklist /etc/shadow
 blacklist /etc/gshadow
 blacklist /etc/passwd-
diff --git a/etc/disable-passwdmgr.inc b/etc/disable-passwdmgr.inc
index c4112d4d5..b5260e897 100644
--- a/etc/disable-passwdmgr.inc
+++ b/etc/disable-passwdmgr.inc
@@ -2,7 +2,6 @@
 # Persistent customizations should go in a .local file.
 include /etc/firejail/disable-passwdmgr.local
 
-blacklist ${HOME}/.pki/nssdb
 blacklist ${HOME}/.lastpass
 blacklist ${HOME}/.keepassx
 blacklist ${HOME}/.keepass
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 6b2b1d994..eeb5bc663 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -20,6 +20,7 @@ blacklist ${HOME}/.bcast5
 blacklist ${HOME}/.claws-mail
 blacklist ${HOME}/.config/0ad
 blacklist ${HOME}/.config/Atom
+blacklist ${HOME}/.config/Audaciousrc
 blacklist ${HOME}/.config/Brackets
 blacklist ${HOME}/.config/Cryptocat
 blacklist ${HOME}/.config/Franz
@@ -72,6 +73,7 @@ blacklist ${HOME}/.config/google-chrome-beta
 blacklist ${HOME}/.config/google-chrome-unstable
 blacklist ${HOME}./config/gpicview
 blacklist ${HOME}/.config/gthumb
+blacklist ${HOME}/.config/gwenviewrc
 blacklist ${HOME}/.config/hexchat
 blacklist ${HOME}/.config/inox
 blacklist ${HOME}/.config/jd-gui.cfg
@@ -89,6 +91,7 @@ blacklist ${HOME}/.config/nautilus
 blacklist ${HOME}/.config/netsurf
 blacklist ${HOME}/.config/opera
 blacklist ${HOME}/.config/opera-beta
+blacklist ${HOME}/.config/org.kde.gwenviewrc
 blacklist ${HOME}/.config/pix
 blacklist ${HOME}/.config/pluma
 blacklist ${HOME}/.config/psi+
@@ -225,12 +228,12 @@ blacklist ${HOME}/.openshot
 blacklist ${HOME}/.openshot_qt
 blacklist ${HOME}/.opera
 blacklist ${HOME}/.opera-beta
-blacklist ${HOME}/.pki
 blacklist ${HOME}/.purple
 blacklist ${HOME}/.qemu-launcher
 blacklist ${HOME}/.remmina
 blacklist ${HOME}/.retroshare
 blacklist ${HOME}/.scribus
+blacklist ${HOME}/.scribusrc
 blacklist ${HOME}/.steam
 blacklist ${HOME}/.steampath
 blacklist ${HOME}/.steampid
diff --git a/etc/gwenview.profile b/etc/gwenview.profile
index f636792f0..b8067866c 100644
--- a/etc/gwenview.profile
+++ b/etc/gwenview.profile
@@ -5,6 +5,8 @@ include /etc/firejail/gwenview.local
 # KDE gwenview profile
 noblacklist ~/.kde/share/apps/gwenview
 noblacklist ~/.kde/share/config/gwenviewrc
+noblacklist ~/.config/gwenviewrc
+noblacklist ~/.config/org.kde.gwenviewrc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
@@ -16,11 +18,11 @@ nonewprivs
 noroot
 protocol unix
 seccomp
-nosound
+tracelog
 
 private-dev
 
-#Experimental:
+# Experimental:
 #shell none
 #private-bin gwenview
 #private-etc X11
diff --git a/etc/scribus.profile b/etc/scribus.profile
index da2076286..5d0dc5af9 100644
--- a/etc/scribus.profile
+++ b/etc/scribus.profile
@@ -5,9 +5,15 @@ include /etc/firejail/scribus.local
 # Firejail profile for Scribus
 noblacklist ~/.scribus
 noblacklist ~/.config/scribus
+noblacklist ~/.config/scribusrc
 noblacklist ~/.local/share/scribus
 noblacklist ~/.gimp*
 
+# Support for PDF readers (Scribus 1.5 and higher)
+noblacklist ~/.kde/share/apps/okular
+noblacklist ~/.kde/share/config/okularrc
+noblacklist ~/.kde/share/config/okularpartrc
+
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
diff --git a/etc/thunderbird.profile b/etc/thunderbird.profile
index 1dc8b15c7..df1a4cdbb 100644
--- a/etc/thunderbird.profile
+++ b/etc/thunderbird.profile
@@ -14,6 +14,10 @@ noblacklist ~/.thunderbird
 mkdir ~/.thunderbird
 whitelist ~/.thunderbird
 
+noblacklist ~/.icedove
+mkdir ~/.icedove
+whitelist ~/.icedove
+
 # allow browsers
 ignore private-tmp
 include /etc/firejail/firefox.profile