some profile enhancements

6 files changed, 10 insertions, 10 deletions

diff --git a/etc/dnscrypt-proxy.profile b/etc/dnscrypt-proxy.profile
index 6d4f6349a..458de81e2 100644
--- a/etc/dnscrypt-proxy.profile
+++ b/etc/dnscrypt-proxy.profile
@@ -15,8 +15,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
-caps
-# caps.keep ipc_lock,net_bind_service,setgid,setuid,sys_chroot
+caps.keep ipc_lock,net_bind_service,setgid,setuid,sys_chroot
 no3d
 nodvd
 nonewprivs
diff --git a/etc/dnsmasq.profile b/etc/dnsmasq.profile
index 2a1302adb..e6086d1b2 100644
--- a/etc/dnsmasq.profile
+++ b/etc/dnsmasq.profile
@@ -15,8 +15,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
-caps
-# caps.keep net_admin,net_bind_service,net_raw,setgid,setuid
+caps.keep net_admin,net_bind_service,net_raw,setgid,setuid
 no3d
 nodvd
 nonewprivs
diff --git a/etc/unbound.profile b/etc/unbound.profile
index d380b5698..c03a25752 100644
--- a/etc/unbound.profile
+++ b/etc/unbound.profile
@@ -15,8 +15,7 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
-caps
-# caps.keep net_bind_service,setgid,setuid,sys_chroot,sys_resource
+caps.keep net_bind_service,setgid,setuid,sys_chroot,sys_resource
 no3d
 nodvd
 nonewprivs
diff --git a/etc/wireshark.profile b/etc/wireshark.profile
index f1a17ba93..35e781f67 100644
--- a/etc/wireshark.profile
+++ b/etc/wireshark.profile
@@ -12,18 +12,19 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+# caps.drop all
 caps.keep dac_override,net_admin,net_raw
 netfilter
 no3d
-# nogroups - breaks unprivileged wireshark usage
-# nonewprivs - breaks unprivileged wireshark usage
+# nogroups - breaks network traffic capture for unprivileged users
+# nonewprivs - breaks network traffic capture for unprivileged users
 # noroot
 nodvd
 nosound
 notv
 novideo
 # protocol unix,inet,inet6,netlink
-# seccomp - breaks unprivileged wireshark usage
+# seccomp - breaks network traffic capture for unprivileged users
 shell none
 tracelog
 
diff --git a/etc/xplayer.profile b/etc/xplayer.profile
index 5c845e977..d4a2fa846 100644
--- a/etc/xplayer.profile
+++ b/etc/xplayer.profile
@@ -13,6 +13,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nogroups
diff --git a/etc/xreader.profile b/etc/xreader.profile
index bebcb262f..11e5d1102 100644
--- a/etc/xreader.profile
+++ b/etc/xreader.profile
@@ -32,7 +32,7 @@ tracelog
 
 private-bin xreader,xreader-previewer,xreader-thumbnailer
 private-dev
-# private-etc fonts,ld.so.cache
+private-etc fonts,ld.so.cache
 # xreader needs access to /tmp/mozilla* to work in firefox
 # private-tmp