14 files changed, 110 insertions, 8 deletions

diff --git a/etc/audacity.profile b/etc/audacity.profile
index 4394416ff..779cd8cdb 100644
--- a/etc/audacity.profile
+++ b/etc/audacity.profile
@@ -11,7 +11,9 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+net none
 netfilter
+no3d
 nogroups
 nonewprivs
 noroot
@@ -23,3 +25,6 @@ tracelog
 private-bin audacity
 private-dev
 private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/bleachbit.profile b/etc/bleachbit.profile
index b406b9985..7ea55f505 100644
--- a/etc/bleachbit.profile
+++ b/etc/bleachbit.profile
@@ -9,17 +9,21 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+net none
 netfilter
+no3d
 nogroups
 nonewprivs
 noroot
 nosound
-shell none
-seccomp
 protocol unix
+seccomp
+shell none
 
 # private-bin
 # private-dev
 # private-tmp
 # private-etc
 
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/deadbeef.profile b/etc/deadbeef.profile
index 603d6345c..efd8b463b 100644
--- a/etc/deadbeef.profile
+++ b/etc/deadbeef.profile
@@ -11,7 +11,17 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
+no3d
+nogroups
 nonewprivs
 noroot
 protocol unix,inet,inet6
 seccomp
+shell none
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/dino.profile b/etc/dino.profile
index cec86812f..3de858618 100644
--- a/etc/dino.profile
+++ b/etc/dino.profile
@@ -13,9 +13,9 @@ include /etc/firejail/disable-programs.inc
 whitelist ${HOME}/Downloads
 mkdir ${HOME}/.local/share/dino
 whitelist ${HOME}/.local/share/dino
+include /etc/firejail/whitelist-common.inc
 
 caps.drop all
-machine-id
 netfilter
 no3d
 nogroups
diff --git a/etc/firefox.profile b/etc/firefox.profile
index 1bc3eb769..4d96c05c8 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -21,6 +21,7 @@ nonewprivs
 noroot
 protocol unix,inet,inet6,netlink
 seccomp
+shell none
 tracelog
 
 whitelist ${DOWNLOADS}
@@ -59,3 +60,6 @@ include /etc/firejail/whitelist-common.inc
 #private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
 private-dev 
 private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/gnome-calculator.profile b/etc/gnome-calculator.profile
index f5d952e3d..e9366f07d 100644
--- a/etc/gnome-calculator.profile
+++ b/etc/gnome-calculator.profile
@@ -19,6 +19,7 @@ caps.drop all
 netfilter
 #net none                                     
 no3d
+nogroups
 nonewprivs
 noroot
 nosound
diff --git a/etc/meld.profile b/etc/meld.profile
new file mode 100644
index 000000000..4b95b866d
--- /dev/null
+++ b/etc/meld.profile
@@ -0,0 +1,29 @@
+# This file is overwritten during software install.
+# Persistent customizations should go in a .local file.
+include /etc/firejail/meld.local
+
+# Firejail profile for meld
+noblacklist ${HOME}/.local/share/meld
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+net none
+netfilter
+no3d
+nogroups
+nonewprivs
+noroot
+nosound
+protocol unix
+seccomp
+shell none
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/ssh.profile b/etc/ssh.profile
index b1ef6b27e..425841399 100644
--- a/etc/ssh.profile
+++ b/etc/ssh.profile
@@ -14,7 +14,18 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
+nosound
 protocol unix,inet,inet6
 seccomp
+shell none
+tracelog
+
+private-dev
+#private-tmp #Breaks when exiting
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/steam.profile b/etc/steam.profile
index c81836dfc..536588e4b 100644
--- a/etc/steam.profile
+++ b/etc/steam.profile
@@ -12,11 +12,13 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+nogroups
 nonewprivs
 noroot
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
+tracelog
 
 private-dev
 private-tmp
diff --git a/etc/viking.profile b/etc/viking.profile
new file mode 100644
index 000000000..2b68d731c
--- /dev/null
+++ b/etc/viking.profile
@@ -0,0 +1,30 @@
+# This file is overwritten during software install.
+# Persistent customizations should go in a .local file.
+include /etc/firejail/viking.local
+
+# Firejail profile for viking
+
+noblacklist ${HOME}/.viking
+noblacklist ${HOME}/.viking-maps
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-devel.inc
+
+caps.drop all
+netfilter
+no3d
+nogroups
+nonewprivs
+noroot
+nosound
+protocol unix,inet,inet6
+seccomp
+shell none
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/wget.profile b/etc/wget.profile
index cd156a376..3ba97d95d 100644
--- a/etc/wget.profile
+++ b/etc/wget.profile
@@ -10,11 +10,11 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+no3d
+nogroups
 nonewprivs
 noroot
-nogroups
 nosound
-no3d
 protocol unix,inet,inet6
 seccomp
 shell none
@@ -22,7 +22,9 @@ shell none
 blacklist /tmp/.X11-unix
 
 # private-bin wget
-# private-etc resolv.conf
 private-dev
+# private-etc resolv.conf
 private-tmp
 
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/wireshark.profile b/etc/wireshark.profile
index 90909edf1..dc224b31c 100644
--- a/etc/wireshark.profile
+++ b/etc/wireshark.profile
@@ -18,6 +18,7 @@ include /etc/firejail/disable-passwdmgr.inc
 #protocol unix,inet,inet6,netlink
 
 netfilter
+no3d
 nogroups
 nonewprivs
 nosound
@@ -28,3 +29,6 @@ tracelog
 #private-bin wireshark
 private-dev
 private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index fa66da617..025e715e6 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -113,7 +113,7 @@ static void disable_file(OPERATION op, const char *filename) {
                 else {
                         if (arg_debug) {
                                 if (strcmp(filename, fname))
-                                        printf("Disable %s (requesterd %s)\n", fname, filename);
+                                        printf("Disable %s (requested %s)\n", fname, filename);
                                 else
                                         printf("Disable %s\n", fname);
                         }
diff --git a/test/utils/audit.exp b/test/utils/audit.exp
index 566493947..f0c1906a0 100755
--- a/test/utils/audit.exp
+++ b/test/utils/audit.exp
@@ -35,7 +35,7 @@ expect {
 after 100
 
 
-send -- "firejail --audit=/usr/lib/firejail/faudit\r"
+send -- "firejail --audit\r"
 expect {
         timeout {puts "TESTING ERROR 6\n";exit}
         "Firejail Audit"