59 files changed, 91 insertions, 0 deletions

diff --git a/etc/Mathematica.profile b/etc/Mathematica.profile
index 73fb0c9e0..213aa85e5 100644
--- a/etc/Mathematica.profile
+++ b/etc/Mathematica.profile
@@ -8,6 +8,7 @@ include /etc/firejail/whitelist-common.inc
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 caps.drop all
diff --git a/etc/audacious.profile b/etc/audacious.profile
index b9ce11c0e..08537b0b4 100644
--- a/etc/audacious.profile
+++ b/etc/audacious.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/bitlbee.profile b/etc/bitlbee.profile
index ca9e87818..16d013bdd 100644
--- a/etc/bitlbee.profile
+++ b/etc/bitlbee.profile
@@ -3,6 +3,7 @@ noblacklist /sbin
 noblacklist /usr/sbin
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-terminals.inc
 protocol unix,inet,inet6
 private
diff --git a/etc/cherrytree.profile b/etc/cherrytree.profile
index 50c508cf5..25e983b5c 100644
--- a/etc/cherrytree.profile
+++ b/etc/cherrytree.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 
diff --git a/etc/chromium.profile b/etc/chromium.profile
index b58931b8d..c9b857e71 100644
--- a/etc/chromium.profile
+++ b/etc/chromium.profile
@@ -5,6 +5,7 @@ noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-terminals.inc
 
 # chromium is distributed with a perl script on Arch
diff --git a/etc/clementine.profile b/etc/clementine.profile
index 92db9488d..8f4670f3b 100644
--- a/etc/clementine.profile
+++ b/etc/clementine.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-terminals.inc
 include /etc/firejail/disable-devel.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/conkeror.profile b/etc/conkeror.profile
index 2d6323d3b..280403811 100644
--- a/etc/conkeror.profile
+++ b/etc/conkeror.profile
@@ -3,6 +3,7 @@ noblacklist ${HOME}/.conkeror.mozdev.org
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-terminals.inc
 caps.drop all
 seccomp
diff --git a/etc/deadbeef.profile b/etc/deadbeef.profile
index ec9fcd0f0..01378cbc4 100644
--- a/etc/deadbeef.profile
+++ b/etc/deadbeef.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/deluge.profile b/etc/deluge.profile
index bcd754952..21d178c08 100644
--- a/etc/deluge.profile
+++ b/etc/deluge.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/dnscrypt-proxy.profile b/etc/dnscrypt-proxy.profile
index 0bc7ac78e..5702473d3 100644
--- a/etc/dnscrypt-proxy.profile
+++ b/etc/dnscrypt-proxy.profile
@@ -3,6 +3,7 @@ noblacklist /sbin
 noblacklist /usr/sbin
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-terminals.inc
diff --git a/etc/dropbox.profile b/etc/dropbox.profile
index 9d2c612de..94b69281b 100644
--- a/etc/dropbox.profile
+++ b/etc/dropbox.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
 blacklist ${HOME}/.lastpass
diff --git a/etc/empathy.profile b/etc/empathy.profile
index adaf03e23..015318290 100644
--- a/etc/empathy.profile
+++ b/etc/empathy.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.wine
diff --git a/etc/epiphany.profile b/etc/epiphany.profile
index c7031da71..2e4c7bfc1 100644
--- a/etc/epiphany.profile
+++ b/etc/epiphany.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 whitelist ${DOWNLOADS}
diff --git a/etc/evince.profile b/etc/evince.profile
index 81878462b..8adf82443 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/fbreader.profile b/etc/fbreader.profile
index 4ed942138..04d53a841 100644
--- a/etc/fbreader.profile
+++ b/etc/fbreader.profile
@@ -3,6 +3,7 @@ noblacklist ${HOME}/.FBReader
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/filezilla.profile b/etc/filezilla.profile
index 0eabf9a88..3643f3f98 100644
--- a/etc/filezilla.profile
+++ b/etc/filezilla.profile
@@ -4,6 +4,7 @@ noblacklist ${HOME}/.config/filezilla
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.wine
diff --git a/etc/firefox.profile b/etc/firefox.profile
index b06dfa6da..9942bd255 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -6,6 +6,7 @@ noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 
diff --git a/etc/flashpeak-slimjet.profile b/etc/flashpeak-slimjet.profile
index f23010040..ff3e266c5 100644
--- a/etc/flashpeak-slimjet.profile
+++ b/etc/flashpeak-slimjet.profile
@@ -11,6 +11,7 @@ noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-terminals.inc
 
 # chromium is distributed with a perl script on Arch
diff --git a/etc/generic.profile b/etc/generic.profile
index 5618a555e..42e39e86c 100644
--- a/etc/generic.profile
+++ b/etc/generic.profile
@@ -4,6 +4,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
 blacklist ${HOME}/.lastpass
diff --git a/etc/gnome-mplayer.profile b/etc/gnome-mplayer.profile
index 8062c859a..414873870 100644
--- a/etc/gnome-mplayer.profile
+++ b/etc/gnome-mplayer.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/google-chrome-beta.profile b/etc/google-chrome-beta.profile
index 3396585eb..fd167d9e0 100644
--- a/etc/google-chrome-beta.profile
+++ b/etc/google-chrome-beta.profile
@@ -5,6 +5,7 @@ noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-terminals.inc
 
 # chromium is distributed with a perl script on Arch
diff --git a/etc/google-chrome-unstable.profile b/etc/google-chrome-unstable.profile
index ed4332862..bcd56ed62 100644
--- a/etc/google-chrome-unstable.profile
+++ b/etc/google-chrome-unstable.profile
@@ -5,6 +5,7 @@ noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-terminals.inc
 
 # chromium is distributed with a perl script on Arch
diff --git a/etc/google-chrome.profile b/etc/google-chrome.profile
index 985af38eb..c2665f709 100644
--- a/etc/google-chrome.profile
+++ b/etc/google-chrome.profile
@@ -5,6 +5,7 @@ noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-terminals.inc
 
 # chromium is distributed with a perl script on Arch
diff --git a/etc/hedgewars.profile b/etc/hedgewars.profile
index 03a376e2f..0c3743ba3 100644
--- a/etc/hedgewars.profile
+++ b/etc/hedgewars.profile
@@ -1,6 +1,7 @@
 # whitelist profile for Hedgewars (game)
 
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
diff --git a/etc/hexchat.profile b/etc/hexchat.profile
index 8f9e71b44..48b0dac40 100644
--- a/etc/hexchat.profile
+++ b/etc/hexchat.profile
@@ -3,6 +3,7 @@ noblacklist ${HOME}/.config/hexchat
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 caps.drop all
diff --git a/etc/kmail.profile b/etc/kmail.profile
index ca29675a0..931df67c3 100644
--- a/etc/kmail.profile
+++ b/etc/kmail.profile
@@ -3,6 +3,7 @@ noblacklist ${HOME}/.gnupg
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/lxterminal.profile b/etc/lxterminal.profile
index a614a8dbf..7f45c95a9 100644
--- a/etc/lxterminal.profile
+++ b/etc/lxterminal.profile
@@ -3,6 +3,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 blacklist ${HOME}/.pki/nssdb
 blacklist ${HOME}/.lastpass
 blacklist ${HOME}/.keepassx
diff --git a/etc/midori.profile b/etc/midori.profile
index e46a6baa2..64a19d452 100644
--- a/etc/midori.profile
+++ b/etc/midori.profile
@@ -3,6 +3,7 @@ noblacklist ${HOME}/.config/midori
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 caps.drop all
diff --git a/etc/mupen64plus.profile b/etc/mupen64plus.profile
index 239ab3a80..ae61ae068 100644
--- a/etc/mupen64plus.profile
+++ b/etc/mupen64plus.profile
@@ -3,6 +3,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 mkdir ${HOME}/.local
diff --git a/etc/openbox.profile b/etc/openbox.profile
new file mode 100644
index 000000000..5fadcee90
--- /dev/null
+++ b/etc/openbox.profile
@@ -0,0 +1,16 @@
+################################
+# Generic GUI application profile
+################################
+include /etc/firejail/disable-mgmt.inc
+include /etc/firejail/disable-secret.inc
+include /etc/firejail/disable-terminals.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+caps.drop all
+seccomp
+protocol unix,inet,inet6
+netfilter
+noroot
+
diff --git a/etc/opera-beta.profile b/etc/opera-beta.profile
index 91eb10787..91c858738 100644
--- a/etc/opera-beta.profile
+++ b/etc/opera-beta.profile
@@ -5,6 +5,7 @@ noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 
diff --git a/etc/opera.profile b/etc/opera.profile
index 08bbd5a06..74e331bab 100644
--- a/etc/opera.profile
+++ b/etc/opera.profile
@@ -5,6 +5,7 @@ noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 
diff --git a/etc/parole.profile b/etc/parole.profile
index fd49bcf07..9c7764ff9 100644
--- a/etc/parole.profile
+++ b/etc/parole.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 private-etc passwd,group,fonts
diff --git a/etc/pidgin.profile b/etc/pidgin.profile
index 54bedccc8..b8b04df18 100644
--- a/etc/pidgin.profile
+++ b/etc/pidgin.profile
@@ -3,6 +3,7 @@ noblacklist ${HOME}/.purple
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.wine
diff --git a/etc/polari.profile b/etc/polari.profile
index 26d5ff27b..8cedddc4e 100644
--- a/etc/polari.profile
+++ b/etc/polari.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 mkdir ${HOME}/.local
diff --git a/etc/qbittorrent.profile b/etc/qbittorrent.profile
index f067aaa99..9d0f1ae54 100644
--- a/etc/qbittorrent.profile
+++ b/etc/qbittorrent.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/qtox.profile b/etc/qtox.profile
index 8e75f01e6..aa6efa5cb 100644
--- a/etc/qtox.profile
+++ b/etc/qtox.profile
@@ -3,6 +3,7 @@ noblacklist ${HOME}/.config/tox
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 mkdir ${HOME}/.config/tox
diff --git a/etc/quassel.profile b/etc/quassel.profile
index bc8c76915..d64b0eaa0 100644
--- a/etc/quassel.profile
+++ b/etc/quassel.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.wine
diff --git a/etc/qutebrowser.profile b/etc/qutebrowser.profile
index 83626185b..685a4c86f 100644
--- a/etc/qutebrowser.profile
+++ b/etc/qutebrowser.profile
@@ -5,6 +5,7 @@ noblacklist ~/.cache/qutebrowser
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 
diff --git a/etc/rhythmbox.profile b/etc/rhythmbox.profile
index a1a20a863..3ef6da11c 100644
--- a/etc/rhythmbox.profile
+++ b/etc/rhythmbox.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/rtorrent.profile b/etc/rtorrent.profile
index 6041052af..2bb6bf38b 100644
--- a/etc/rtorrent.profile
+++ b/etc/rtorrent.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-terminals.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 caps.drop all
diff --git a/etc/seamonkey.profile b/etc/seamonkey.profile
index b896af97a..cbe48e425 100644
--- a/etc/seamonkey.profile
+++ b/etc/seamonkey.profile
@@ -5,6 +5,7 @@ noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 
diff --git a/etc/skype.profile b/etc/skype.profile
index a33cc339d..c301050b4 100644
--- a/etc/skype.profile
+++ b/etc/skype.profile
@@ -3,6 +3,7 @@ noblacklist ${HOME}/.Skype
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 caps.drop all
diff --git a/etc/spotify.profile b/etc/spotify.profile
index 1986a513c..5b7cb49a5 100644
--- a/etc/spotify.profile
+++ b/etc/spotify.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 
 # Whitelist the folders needed by Spotify - This is more restrictive 
diff --git a/etc/ssh.profile b/etc/ssh.profile
new file mode 100644
index 000000000..d78fa749d
--- /dev/null
+++ b/etc/ssh.profile
@@ -0,0 +1,17 @@
+# ssh client
+noblacklist ~/.ssh
+include /etc/firejail/disable-mgmt.inc
+include /etc/firejail/disable-secret.inc
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-terminals.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+caps.drop all
+seccomp
+protocol unix,inet,inet6
+netfilter
+noroot
+
diff --git a/etc/steam.profile b/etc/steam.profile
index dc17c7a0f..73ef1e70b 100644
--- a/etc/steam.profile
+++ b/etc/steam.profile
@@ -4,6 +4,7 @@ noblacklist ${HOME}/.local/share/steam
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 caps.drop all
diff --git a/etc/telegram.profile b/etc/telegram.profile
index 94167675c..8027846dc 100644
--- a/etc/telegram.profile
+++ b/etc/telegram.profile
@@ -3,6 +3,7 @@ noblacklist ${HOME}/.TelegramDesktop
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 
diff --git a/etc/totem.profile b/etc/totem.profile
index f2485a2d0..bee8d8678 100644
--- a/etc/totem.profile
+++ b/etc/totem.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/transmission-gtk.profile b/etc/transmission-gtk.profile
index 18356a91e..ac229e43b 100644
--- a/etc/transmission-gtk.profile
+++ b/etc/transmission-gtk.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/transmission-qt.profile b/etc/transmission-qt.profile
index cd07f35c7..6e4f096a0 100644
--- a/etc/transmission-qt.profile
+++ b/etc/transmission-qt.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/uget-gtk.profile b/etc/uget-gtk.profile
index 3b27c00ba..b3360ffb1 100644
--- a/etc/uget-gtk.profile
+++ b/etc/uget-gtk.profile
@@ -2,6 +2,7 @@
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 caps.drop all
diff --git a/etc/unbound.profile b/etc/unbound.profile
index c4f009159..7f36e9588 100644
--- a/etc/unbound.profile
+++ b/etc/unbound.profile
@@ -3,6 +3,7 @@ noblacklist /sbin
 noblacklist /usr/sbin
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-terminals.inc
diff --git a/etc/vivaldi.profile b/etc/vivaldi.profile
index daab0b81a..a353a4ca8 100644
--- a/etc/vivaldi.profile
+++ b/etc/vivaldi.profile
@@ -5,6 +5,7 @@ noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 
diff --git a/etc/vlc.profile b/etc/vlc.profile
index adcfbb119..3652e1f7d 100644
--- a/etc/vlc.profile
+++ b/etc/vlc.profile
@@ -3,6 +3,7 @@ noblacklist ${HOME}/.config/vlc
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.pki/nssdb
diff --git a/etc/weechat.profile b/etc/weechat.profile
index 3fbce62ca..4041332be 100644
--- a/etc/weechat.profile
+++ b/etc/weechat.profile
@@ -2,6 +2,7 @@
 noblacklist ${HOME}/.weechat
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-terminals.inc
 caps.drop all
diff --git a/etc/wesnoth.profile b/etc/wesnoth.profile
index a5b6127df..57bb13e9d 100644
--- a/etc/wesnoth.profile
+++ b/etc/wesnoth.profile
@@ -1,6 +1,7 @@
 # Whitelist-based profile for "Battle for Wesnoth" (game).
 
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
diff --git a/etc/wine.profile b/etc/wine.profile
index ae1f5d1b6..5a86977ee 100644
--- a/etc/wine.profile
+++ b/etc/wine.profile
@@ -5,6 +5,7 @@ noblacklist ${HOME}/.wine
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 caps.drop all
diff --git a/etc/xchat.profile b/etc/xchat.profile
index e2dcadc0e..360ca96a5 100644
--- a/etc/xchat.profile
+++ b/etc/xchat.profile
@@ -3,6 +3,7 @@ noblacklist ${HOME}/.config/xchat
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
 blacklist ${HOME}/.wine
diff --git a/todo b/todo
index 7b59dcac4..4e7d20e7f 100644
--- a/todo
+++ b/todo
@@ -73,3 +73,5 @@ CapPrm:	0000000000000000
 CapEff: 0000000000000000
 CapBnd: 0000003fffffffff
 CapAmb: 0000000000000000
+
+11. cleanup thunderbird profile - disable-common was commented out