profile hardening: add disable-exec.inc in more places

12 files changed, 17 insertions, 21 deletions

diff --git a/etc/clamav.profile b/etc/clamav.profile
index a48fa8039..45e7723eb 100644
--- a/etc/clamav.profile
+++ b/etc/clamav.profile
@@ -7,6 +7,8 @@ include clamav.local
 # Persistent global definitions
 include globals.local
 
+include disable-exec.inc
+
 caps.drop all
 ipc-namespace
 net none
@@ -30,5 +32,3 @@ private-dev
 read-only ${HOME}
 
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/default.profile b/etc/default.profile
index efa66d5db..3eacf9546 100644
--- a/etc/default.profile
+++ b/etc/default.profile
@@ -14,7 +14,7 @@ include disable-common.inc
 # include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
-#include disable-xdg.inc
+# include disable-xdg.inc
 
 # apparmor
 caps.drop all
diff --git a/etc/dig.profile b/etc/dig.profile
index 23970d9d0..1843f6e46 100644
--- a/etc/dig.profile
+++ b/etc/dig.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.digrc
 
 include disable-common.inc
 # include disable-devel.inc
+include disable-exec.inc
 # include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -49,5 +50,3 @@ private-lib
 private-tmp
 
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/disable-exec.inc b/etc/disable-exec.inc
index c535af7d4..ee3391730 100644
--- a/etc/disable-exec.inc
+++ b/etc/disable-exec.inc
@@ -6,6 +6,6 @@ noexec ${HOME}
 noexec ${RUNUSER}
 noexec /dev/shm
 noexec /tmp
-# /var/tmp is noexec by default
-# just in case there is a keep-var-tmp option:
-noexec /var/tmp
+# /var is noexec by default for unprivileged users
+# except there is a writable-var option, so just in case:
+noexec /var
diff --git a/etc/freshclam.profile b/etc/freshclam.profile
index 2dd55d8cc..2bab79e2e 100644
--- a/etc/freshclam.profile
+++ b/etc/freshclam.profile
@@ -6,6 +6,7 @@ include clamav.local
 # Persistent global definitions
 include globals.local
 
+include disable-exec.inc
 
 caps.keep setgid,setuid
 ipc-namespace
@@ -32,5 +33,3 @@ writable-var
 writable-var-log
 
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/mupdf.profile b/etc/mupdf.profile
index 1f2afa5f0..1d5953ff7 100644
--- a/etc/mupdf.profile
+++ b/etc/mupdf.profile
@@ -41,4 +41,5 @@ private-dev
 private-etc alternatives,fonts
 private-tmp
 
+memory-deny-write-execute
 read-only ${HOME}
diff --git a/etc/patch.profile b/etc/patch.profile
index c0937bfc5..9515bffdf 100644
--- a/etc/patch.profile
+++ b/etc/patch.profile
@@ -11,6 +11,7 @@ noblacklist ${DOCUMENTS}
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-xdg.inc
@@ -39,5 +40,3 @@ private-dev
 private-lib libfakeroot
 
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/pdfchain.profile b/etc/pdfchain.profile
index d9f721578..98a9f1840 100644
--- a/etc/pdfchain.profile
+++ b/etc/pdfchain.profile
@@ -9,6 +9,7 @@ noblacklist ${DOCUMENTS}
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -38,5 +39,3 @@ private-etc alternatives,dconf,fonts,gtk-3.0,xdg
 private-tmp
 
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/server.profile b/etc/server.profile
index 8da4853e7..686268a18 100644
--- a/etc/server.profile
+++ b/etc/server.profile
@@ -17,10 +17,11 @@ noblacklist /usr/sbin
 
 include disable-common.inc
 # include disable-devel.inc
+# include disable-exec.inc
 # include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
-#include disable-xdg.inc
+# include disable-xdg.inc
 
 caps
 # ipc-namespace
@@ -48,5 +49,3 @@ private-dev
 private-tmp
 
 # memory-deny-write-execute
-# noexec ${HOME}
-# noexec /tmp
diff --git a/etc/ssh.profile b/etc/ssh.profile
index de627dcf0..4c8af65b8 100644
--- a/etc/ssh.profile
+++ b/etc/ssh.profile
@@ -12,6 +12,7 @@ noblacklist /tmp/ssh-*
 noblacklist ${HOME}/.ssh
 
 include disable-common.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
@@ -36,6 +37,4 @@ private-dev
 # private-tmp # Breaks when exiting
 
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
 writable-run-user
diff --git a/etc/start-tor-browser.profile b/etc/start-tor-browser.profile
index b0cb52a0f..8acf77349 100644
--- a/etc/start-tor-browser.profile
+++ b/etc/start-tor-browser.profile
@@ -5,9 +5,11 @@ include start-tor-browser.local
 # Persistent global definitions
 include globals.local
 
+ignore noexec ${HOME}
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -36,5 +38,3 @@ private-bin bash,sh,grep,tail,env,gpg,id,readlink,dirname,test,mkdir,ln,sed,cp,r
 private-dev
 private-etc alternatives,fonts,hostname,hosts,resolv.conf,pki,ssl,ca-certificates,crypto-policies,alsa,asound.conf,pulse,machine-id,ld.so.cache
 private-tmp
-
-noexec /tmp
diff --git a/etc/strings.profile b/etc/strings.profile
index ca7bd0922..cacf919f5 100644
--- a/etc/strings.profile
+++ b/etc/strings.profile
@@ -8,6 +8,7 @@ include strings.local
 #include globals.local
 
 blacklist /tmp/.X11-unix
+include disable-exec.inc
 
 ignore noroot
 net none