8 files changed, 54 insertions, 2 deletions

diff --git a/etc/empathy.profile b/etc/empathy.profile
index 371100814..2a0a6389c 100644
--- a/etc/empathy.profile
+++ b/etc/empathy.profile
@@ -6,5 +6,7 @@ include /etc/firejail/disable-devel.inc
 caps.drop all
 netfilter
 nonewprivs
+nogroups
+noroot
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/keepass2.profile b/etc/keepass2.profile
new file mode 100644
index 000000000..fd390f7ed
--- /dev/null
+++ b/etc/keepass2.profile
@@ -0,0 +1,6 @@
+# keepass password manager profile
+
+#noblacklist ${HOME}/.config/KeePass
+#noblacklist ${HOME}/.keepass
+ 
+include /etc/firejail/keepass.profile
diff --git a/etc/kmail.profile b/etc/kmail.profile
index bc21ba604..410ff36c6 100644
--- a/etc/kmail.profile
+++ b/etc/kmail.profile
@@ -16,4 +16,4 @@ seccomp
 tracelog
 
 private-dev
-private-tmp
+# private-tmp
diff --git a/etc/mupdf.profile b/etc/mupdf.profile
index e022866e8..dc23d5840 100644
--- a/etc/mupdf.profile
+++ b/etc/mupdf.profile
@@ -16,7 +16,7 @@ net none
 shell none
 tracelog
 
-#seccomp.keep access,arch_prctl,brk,clone,close,connect,execve,exit_group,fchmod,fchown,fcntl,fstat,futex,getcwd,getpeername,getrlimit,getsockname,getsockopt,lseek,lstat,mlock,mmap,mprotect,munmap,nanosleep,open,poll,prctl,read,recvfrom,recvmsg,restart_syscall,rt_sigaction,rt_sigprocmask,select,sendmsg,set_robust_list,set_tid_address,setresgid,setresuid,shmat,shmctl,shmget,shutdown,socket,stat,sysinfo,uname,unshare,wait4,write,writev
+#seccomp.keep access,arch_prctl,brk,clone,close,connect,execve,exit_group,fchmod,fchown,fcntl,fstat,futex,getcwd,getpeername,getrlimit,getsockname,getsockopt,lseek,lstat,mlock,mmap,mprotect,mremap,munmap,nanosleep,open,poll,prctl,read,recvfrom,recvmsg,restart_syscall,rt_sigaction,rt_sigprocmask,select,sendmsg,set_robust_list,set_tid_address,setresgid,setresuid,shmat,shmctl,shmget,shutdown,socket,stat,sysinfo,uname,unshare,wait4,write,writev
 
 private-bin mupdf
 private-tmp
diff --git a/etc/qemu-launcher.profile b/etc/qemu-launcher.profile
new file mode 100644
index 000000000..9fa8a91d4
--- /dev/null
+++ b/etc/qemu-launcher.profile
@@ -0,0 +1,20 @@
+# qemu-launcher profile
+
+noblacklist ~/.qemu-launcher
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-passwdmgr.inc
+
+caps.drop all
+netfilter
+nogroups
+nonewprivs
+noroot
+protocol unix,inet,inet6
+seccomp
+shell none
+tracelog
+
+private-tmp
+
diff --git a/etc/qemu-system-x86_64.profile b/etc/qemu-system-x86_64.profile
new file mode 100644
index 000000000..3d4587fb1
--- /dev/null
+++ b/etc/qemu-system-x86_64.profile
@@ -0,0 +1,18 @@
+# qemu profile
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-passwdmgr.inc
+
+caps.drop all
+netfilter
+nogroups
+nonewprivs
+noroot
+protocol unix,inet,inet6
+seccomp
+shell none
+tracelog
+
+private-tmp
+
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index c6187628c..6377c7426 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -79,6 +79,7 @@
 /etc/firejail/inox.profile
 /etc/firejail/jitsi.profile
 /etc/firejail/keepass.profile
+/etc/firejail/keepass2.profile
 /etc/firejail/keepassx.profile
 /etc/firejail/kmail.profile
 /etc/firejail/konversation.profile
@@ -117,6 +118,8 @@
 /etc/firejail/polari.profile
 /etc/firejail/psi-plus.profile
 /etc/firejail/qbittorrent.profile
+/etc/firejail/qemu-launcher.profile
+/etc/firejail/qemu-system-x86_64.profile
 /etc/firejail/qpdfview.profile
 /etc/firejail/qtox.profile
 /etc/firejail/quassel.profile
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index f18bf8c86..d10d59657 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -82,6 +82,8 @@ mupen64plus
 wine
 dosbox
 virtualbox
+qemu-launcher
+qemu-system-x86_64
 
 # games
 0ad
@@ -154,6 +156,7 @@ atom-beta
 atom
 ranger
 keepass
+keepass2
 keepassx
 xiphos