diff options
45 files changed, 111 insertions, 62 deletions
diff --git a/etc/allow-common-devel.inc b/etc/allow-common-devel.inc index 1d794462c..63174eda6 100644 --- a/etc/allow-common-devel.inc +++ b/etc/allow-common-devel.inc | |||
@@ -1,17 +1,21 @@ | |||
1 | # Rust | 1 | # This file is overwritten during software install. |
2 | noblacklist ${HOME}/.cargo/config | 2 | # Persistent customizations should go in a .local file. |
3 | noblacklist ${HOME}/.cargo/registry | 3 | include allow-common-devel.local |
4 | 4 | ||
5 | # Git | 5 | # Git |
6 | noblacklist ${HOME}/.config/git | 6 | noblacklist ${HOME}/.config/git |
7 | noblacklist ${HOME}/.gitconfig | 7 | noblacklist ${HOME}/.gitconfig |
8 | noblacklist ${HOME}/.git-credentials | 8 | noblacklist ${HOME}/.git-credentials |
9 | 9 | ||
10 | # Java | ||
11 | noblacklist ${HOME}/.gradle | ||
12 | noblacklist ${HOME}/.java | ||
13 | |||
10 | # Python | 14 | # Python |
11 | noblacklist ${HOME}/.python-history | 15 | noblacklist ${HOME}/.python-history |
12 | noblacklist ${HOME}/.python_history | 16 | noblacklist ${HOME}/.python_history |
13 | noblacklist ${HOME}/.pythonhist | 17 | noblacklist ${HOME}/.pythonhist |
14 | 18 | ||
15 | # Java | 19 | # Rust |
16 | noblacklist ${HOME}/.gradle | 20 | noblacklist ${HOME}/.cargo/config |
17 | noblacklist ${HOME}/.java | 21 | noblacklist ${HOME}/.cargo/registry |
diff --git a/etc/allow-java.inc b/etc/allow-java.inc index 5204d2dea..24d18fb77 100644 --- a/etc/allow-java.inc +++ b/etc/allow-java.inc | |||
@@ -1,6 +1,9 @@ | |||
1 | noblacklist ${HOME}/.java | 1 | # This file is overwritten during software install. |
2 | # Persistent customizations should go in a .local file. | ||
3 | include allow-java.local | ||
2 | 4 | ||
5 | noblacklist ${HOME}/.java | ||
3 | noblacklist ${PATH}/java | 6 | noblacklist ${PATH}/java |
4 | noblacklist /usr/lib/java | ||
5 | noblacklist /etc/java | 7 | noblacklist /etc/java |
8 | noblacklist /usr/lib/java | ||
6 | noblacklist /usr/share/java | 9 | noblacklist /usr/share/java |
diff --git a/etc/allow-lua.inc b/etc/allow-lua.inc index 51d76f9b1..fbdee22ee 100644 --- a/etc/allow-lua.inc +++ b/etc/allow-lua.inc | |||
@@ -1,3 +1,7 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include allow-lua.local | ||
4 | |||
1 | noblacklist ${PATH}/lua* | 5 | noblacklist ${PATH}/lua* |
2 | noblacklist /usr/include/lua* | 6 | noblacklist /usr/include/lua* |
3 | noblacklist /usr/lib/lua | 7 | noblacklist /usr/lib/lua |
diff --git a/etc/allow-perl.inc b/etc/allow-perl.inc index d37328936..f44e1e3cc 100644 --- a/etc/allow-perl.inc +++ b/etc/allow-perl.inc | |||
@@ -1,5 +1,9 @@ | |||
1 | noblacklist ${PATH}/cpan* | 1 | # This file is overwritten during software install. |
2 | # Persistent customizations should go in a .local file. | ||
3 | include allow-perl.local | ||
4 | |||
2 | noblacklist ${PATH}/core_perl | 5 | noblacklist ${PATH}/core_perl |
6 | noblacklist ${PATH}/cpan* | ||
3 | noblacklist ${PATH}/perl | 7 | noblacklist ${PATH}/perl |
4 | noblacklist ${PATH}/site_perl | 8 | noblacklist ${PATH}/site_perl |
5 | noblacklist ${PATH}/vendor_perl | 9 | noblacklist ${PATH}/vendor_perl |
diff --git a/etc/allow-php.inc b/etc/allow-php.inc new file mode 100644 index 000000000..a0950dc26 --- /dev/null +++ b/etc/allow-php.inc | |||
@@ -0,0 +1,7 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include allow-php.local | ||
4 | |||
5 | noblacklist ${PATH}/php* | ||
6 | noblacklist /usr/lib/php* | ||
7 | noblacklist /usr/share/php* | ||
diff --git a/etc/allow-python2.inc b/etc/allow-python2.inc index 8ea61648b..b0525e2e1 100644 --- a/etc/allow-python2.inc +++ b/etc/allow-python2.inc | |||
@@ -1,3 +1,7 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include allow-python2.local | ||
4 | |||
1 | noblacklist ${PATH}/python2* | 5 | noblacklist ${PATH}/python2* |
2 | noblacklist /usr/include/python2* | 6 | noblacklist /usr/include/python2* |
3 | noblacklist /usr/lib/python2* | 7 | noblacklist /usr/lib/python2* |
diff --git a/etc/allow-python3.inc b/etc/allow-python3.inc index 91c7ffca4..c5660a97d 100644 --- a/etc/allow-python3.inc +++ b/etc/allow-python3.inc | |||
@@ -1,3 +1,7 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include allow-python3.local | ||
4 | |||
1 | noblacklist ${PATH}/python3* | 5 | noblacklist ${PATH}/python3* |
2 | noblacklist /usr/include/python3* | 6 | noblacklist /usr/include/python3* |
3 | noblacklist /usr/lib/python3* | 7 | noblacklist /usr/lib/python3* |
diff --git a/etc/allow-ruby.inc b/etc/allow-ruby.inc new file mode 100644 index 000000000..a8c701219 --- /dev/null +++ b/etc/allow-ruby.inc | |||
@@ -0,0 +1,6 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include allow-ruby.local | ||
4 | |||
5 | noblacklist ${PATH}/ruby | ||
6 | noblacklist /usr/lib/ruby | ||
diff --git a/etc/anki.profile b/etc/anki.profile index c349376ff..a0a79ef48 100644 --- a/etc/anki.profile +++ b/etc/anki.profile | |||
@@ -42,7 +42,8 @@ notv | |||
42 | nou2f | 42 | nou2f |
43 | novideo | 43 | novideo |
44 | protocol unix,inet,inet6 | 44 | protocol unix,inet,inet6 |
45 | seccomp | 45 | # QtWebengine needs chroot to set up its own sandbox |
46 | seccomp !chroot | ||
46 | shell none | 47 | shell none |
47 | tracelog | 48 | tracelog |
48 | 49 | ||
diff --git a/etc/aria2c.profile b/etc/aria2c.profile index 72e577d56..c478bbae9 100644 --- a/etc/aria2c.profile +++ b/etc/aria2c.profile | |||
@@ -7,6 +7,8 @@ include aria2c.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.aria2 | 9 | noblacklist ${HOME}/.aria2 |
10 | noblacklist ${HOME}/.config/aria2 | ||
11 | noblacklist ${HOME}/.netrc | ||
10 | 12 | ||
11 | include disable-common.inc | 13 | include disable-common.inc |
12 | include disable-devel.inc | 14 | include disable-devel.inc |
@@ -35,6 +37,7 @@ seccomp | |||
35 | shell none | 37 | shell none |
36 | 38 | ||
37 | # disable-mnt | 39 | # disable-mnt |
40 | # Add your custom event hook commands to 'private-bin' in your aria2c.local | ||
38 | private-bin aria2c,gzip | 41 | private-bin aria2c,gzip |
39 | # Uncomment the next line (or put 'private-cache' in your aria2c.local) if you don't use Lutris/winetricks (see issue #2772) | 42 | # Uncomment the next line (or put 'private-cache' in your aria2c.local) if you don't use Lutris/winetricks (see issue #2772) |
40 | #private-cache | 43 | #private-cache |
diff --git a/etc/artha.profile b/etc/artha.profile index f1d30a415..e7278fe10 100644 --- a/etc/artha.profile +++ b/etc/artha.profile | |||
@@ -16,7 +16,7 @@ include disable-interpreters.inc | |||
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | 18 | ||
19 | mkdir ${HOME}/.config/artha.conf | 19 | mkfile ${HOME}/.config/artha.conf |
20 | mkdir ${HOME}/.config/enchant | 20 | mkdir ${HOME}/.config/enchant |
21 | whitelist ${HOME}/.config/artha.conf | 21 | whitelist ${HOME}/.config/artha.conf |
22 | whitelist ${HOME}/.config/enchant | 22 | whitelist ${HOME}/.config/enchant |
diff --git a/etc/baobab.profile b/etc/baobab.profile index c419aa202..e8287b448 100644 --- a/etc/baobab.profile +++ b/etc/baobab.profile | |||
@@ -6,7 +6,7 @@ include baobab.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | include disable-common.inc | 9 | # include disable-common.inc |
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
@@ -16,7 +16,7 @@ include disable-passwdmgr.inc | |||
16 | caps.drop all | 16 | caps.drop all |
17 | net none | 17 | net none |
18 | no3d | 18 | no3d |
19 | nodbus | 19 | #nodbus |
20 | nodvd | 20 | nodvd |
21 | nogroups | 21 | nogroups |
22 | nonewprivs | 22 | nonewprivs |
diff --git a/etc/beaker.profile b/etc/beaker.profile index 21eeac4b3..cc1886a49 100644 --- a/etc/beaker.profile +++ b/etc/beaker.profile | |||
@@ -13,7 +13,6 @@ include disable-interpreters.inc | |||
13 | 13 | ||
14 | mkdir ${HOME}/.config/Beaker Browser | 14 | mkdir ${HOME}/.config/Beaker Browser |
15 | whitelist ${HOME}/.config/Beaker Browser | 15 | whitelist ${HOME}/.config/Beaker Browser |
16 | whitelist ${DOWNLOADS} | ||
17 | include whitelist-common.inc | 16 | include whitelist-common.inc |
18 | 17 | ||
19 | # Redirect | 18 | # Redirect |
diff --git a/etc/celluloid.profile b/etc/celluloid.profile index d06eb7a65..ab68c7f13 100644 --- a/etc/celluloid.profile +++ b/etc/celluloid.profile | |||
@@ -41,7 +41,7 @@ tracelog | |||
41 | 41 | ||
42 | private-bin celluloid,env,gnome-mpv,python*,youtube-dl | 42 | private-bin celluloid,env,gnome-mpv,python*,youtube-dl |
43 | private-cache | 43 | private-cache |
44 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,libva.conf,localtime,machine-id,pkcs11,pki,resolv.conf,selinux,ssl,xdg | 44 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,ld.so.cache,libva.conf,localtime,machine-id,pkcs11,pki,resolv.conf,selinux,ssl,xdg |
45 | private-dev | 45 | private-dev |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
diff --git a/etc/chromium-common.profile b/etc/chromium-common.profile index 7b88e417a..c54fb0e19 100644 --- a/etc/chromium-common.profile +++ b/etc/chromium-common.profile | |||
@@ -37,7 +37,7 @@ notv | |||
37 | shell none | 37 | shell none |
38 | 38 | ||
39 | disable-mnt | 39 | disable-mnt |
40 | private-dev | 40 | ?BROWSER_DISABLE_U2F: private-dev |
41 | # private-tmp - problems with multiple browser sessions | 41 | # private-tmp - problems with multiple browser sessions |
42 | 42 | ||
43 | # the file dialog needs to work without d-bus | 43 | # the file dialog needs to work without d-bus |
diff --git a/etc/claws-mail.profile b/etc/claws-mail.profile index 33c0a3369..1790b0b17 100644 --- a/etc/claws-mail.profile +++ b/etc/claws-mail.profile | |||
@@ -16,7 +16,7 @@ include disable-interpreters.inc | |||
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | 18 | ||
19 | whitelist /usr/share/doc | 19 | whitelist /usr/share/doc/claws-mail |
20 | whitelist /usr/share/gnupg | 20 | whitelist /usr/share/gnupg |
21 | whitelist /usr/share/gnupg2 | 21 | whitelist /usr/share/gnupg2 |
22 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
diff --git a/etc/cmus.profile b/etc/cmus.profile index 7e12a06de..fa1e5d722 100644 --- a/etc/cmus.profile +++ b/etc/cmus.profile | |||
@@ -27,4 +27,4 @@ seccomp | |||
27 | shell none | 27 | shell none |
28 | 28 | ||
29 | private-bin cmus | 29 | private-bin cmus |
30 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,machine-id,pki,pulse,ssl | 30 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,machine-id,pki,pulse,resolv.conf,ssl |
diff --git a/etc/digikam.profile b/etc/digikam.profile index 1b80981f7..e66434444 100644 --- a/etc/digikam.profile +++ b/etc/digikam.profile | |||
@@ -32,7 +32,8 @@ nonewprivs | |||
32 | noroot | 32 | noroot |
33 | notv | 33 | notv |
34 | protocol unix,inet,inet6,netlink | 34 | protocol unix,inet,inet6,netlink |
35 | seccomp | 35 | # QtWebengine needs chroot to set up its own sandbox |
36 | seccomp !chroot | ||
36 | shell none | 37 | shell none |
37 | 38 | ||
38 | # private-dev - prevents libdc1394 loading; this lib is used to connect to a camera device | 39 | # private-dev - prevents libdc1394 loading; this lib is used to connect to a camera device |
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index a489a8fbb..207ee32e5 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc | |||
@@ -119,6 +119,7 @@ blacklist ${HOME}/.config/akonadi* | |||
119 | blacklist ${HOME}/.config/akregatorrc | 119 | blacklist ${HOME}/.config/akregatorrc |
120 | blacklist ${HOME}/.config/ardour4 | 120 | blacklist ${HOME}/.config/ardour4 |
121 | blacklist ${HOME}/.config/ardour5 | 121 | blacklist ${HOME}/.config/ardour5 |
122 | blacklist ${HOME}/.config/aria2 | ||
122 | blacklist ${HOME}/.config/arkrc | 123 | blacklist ${HOME}/.config/arkrc |
123 | blacklist ${HOME}/.config/artha.conf | 124 | blacklist ${HOME}/.config/artha.conf |
124 | blacklist ${HOME}/.config/asunder | 125 | blacklist ${HOME}/.config/asunder |
diff --git a/etc/ephemeral.profile b/etc/ephemeral.profile index fa7746da5..c688c2324 100644 --- a/etc/ephemeral.profile +++ b/etc/ephemeral.profile | |||
@@ -55,7 +55,7 @@ tracelog | |||
55 | 55 | ||
56 | disable-mnt | 56 | disable-mnt |
57 | private-cache | 57 | private-cache |
58 | private-dev | 58 | ?BROWSER_DISABLE_U2F: private-dev |
59 | # private-etc below works fine on most distributions. There are some problems on CentOS. | 59 | # private-etc below works fine on most distributions. There are some problems on CentOS. |
60 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,login.defs,machine-id,mailcap,mime.types,nsswitch.conf,os-release,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 60 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,login.defs,machine-id,mailcap,mime.types,nsswitch.conf,os-release,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
61 | private-tmp | 61 | private-tmp |
diff --git a/etc/evince.profile b/etc/evince.profile index ba68e45b4..143a347e6 100644 --- a/etc/evince.profile +++ b/etc/evince.profile | |||
@@ -47,7 +47,7 @@ tracelog | |||
47 | private-bin evince,evince-previewer,evince-thumbnailer | 47 | private-bin evince,evince-previewer,evince-thumbnailer |
48 | private-cache | 48 | private-cache |
49 | private-dev | 49 | private-dev |
50 | private-etc alternatives,fonts,group,machine-id,passwd | 50 | private-etc alternatives,fonts,group,ld.so.cache,machine-id,passwd |
51 | # private-lib might break two-page-view on some systems | 51 | # private-lib might break two-page-view on some systems |
52 | private-lib evince,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* | 52 | private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* |
53 | private-tmp | 53 | private-tmp |
diff --git a/etc/exiftool.profile b/etc/exiftool.profile index e455d32c7..e9c7d290a 100644 --- a/etc/exiftool.profile +++ b/etc/exiftool.profile | |||
@@ -17,6 +17,7 @@ include disable-passwdmgr.inc | |||
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | 18 | ||
19 | whitelist /usr/share/perl5 | 19 | whitelist /usr/share/perl5 |
20 | whitelist /usr/share/perl-image-exiftool | ||
20 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
21 | 22 | ||
22 | apparmor | 23 | apparmor |
diff --git a/etc/ffmpeg.profile b/etc/ffmpeg.profile index 67c0ed311..b392087e8 100644 --- a/etc/ffmpeg.profile +++ b/etc/ffmpeg.profile | |||
@@ -47,7 +47,7 @@ tracelog | |||
47 | private-bin ffmpeg | 47 | private-bin ffmpeg |
48 | private-cache | 48 | private-cache |
49 | private-dev | 49 | private-dev |
50 | private-etc alternatives,ca-certificates,hosts,pkcs11,pki,resolv.conf,ssl | 50 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pkcs11,pki,resolv.conf,ssl |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | # memory-deny-write-execute - it breaks old versions of ffmpeg | 53 | # memory-deny-write-execute - it breaks old versions of ffmpeg |
diff --git a/etc/firefox-common.profile b/etc/firefox-common.profile index 7777d07ce..323070289 100644 --- a/etc/firefox-common.profile +++ b/etc/firefox-common.profile | |||
@@ -52,7 +52,7 @@ shell none | |||
52 | #tracelog | 52 | #tracelog |
53 | 53 | ||
54 | disable-mnt | 54 | disable-mnt |
55 | private-dev | 55 | ?BROWSER_DISABLE_U2F: private-dev |
56 | # private-etc below works fine on most distributions. There are some problems on CentOS. | 56 | # private-etc below works fine on most distributions. There are some problems on CentOS. |
57 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 57 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
58 | private-tmp | 58 | private-tmp |
diff --git a/etc/freecad.profile b/etc/freecad.profile index 079c85fb1..6f0f52a55 100644 --- a/etc/freecad.profile +++ b/etc/freecad.profile | |||
@@ -9,6 +9,10 @@ include globals.local | |||
9 | noblacklist ${HOME}/.config/FreeCAD | 9 | noblacklist ${HOME}/.config/FreeCAD |
10 | noblacklist ${DOCUMENTS} | 10 | noblacklist ${DOCUMENTS} |
11 | 11 | ||
12 | # Allow python (blacklisted by disable-interpreters.inc) | ||
13 | include allow-python2.inc | ||
14 | include allow-python3.inc | ||
15 | |||
12 | include disable-common.inc | 16 | include disable-common.inc |
13 | include disable-devel.inc | 17 | include disable-devel.inc |
14 | include disable-exec.inc | 18 | include disable-exec.inc |
@@ -33,7 +37,7 @@ protocol unix | |||
33 | seccomp | 37 | seccomp |
34 | shell none | 38 | shell none |
35 | 39 | ||
36 | private-bin freecad,freecadcmd | 40 | private-bin freecad,freecadcmd,python* |
37 | private-cache | 41 | private-cache |
38 | private-dev | 42 | private-dev |
39 | private-tmp | 43 | private-tmp |
diff --git a/etc/gedit.profile b/etc/gedit.profile index 6d575e850..7dd6f270e 100644 --- a/etc/gedit.profile +++ b/etc/gedit.profile | |||
@@ -42,6 +42,6 @@ tracelog | |||
42 | 42 | ||
43 | # private-bin gedit | 43 | # private-bin gedit |
44 | private-dev | 44 | private-dev |
45 | private-lib aspell,gconv,gedit,libgspell-1.so.*,libgtksourceview-3.0.so.*,libpeas-gtk-1.0.so.*,libreadline.so.*,libtinfo.so.* | 45 | private-lib aspell,gconv,gedit,libgspell-1.so.*,libgtksourceview-*,libpeas-gtk-1.0.so.*,libreadline.so.*,libtinfo.so.* |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
diff --git a/etc/hexchat.profile b/etc/hexchat.profile index d032c93e6..835205f03 100644 --- a/etc/hexchat.profile +++ b/etc/hexchat.profile | |||
@@ -26,14 +26,12 @@ include whitelist-common.inc | |||
26 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
27 | 27 | ||
28 | caps.drop all | 28 | caps.drop all |
29 | machine-id | ||
30 | netfilter | 29 | netfilter |
31 | no3d | 30 | no3d |
32 | nodvd | 31 | nodvd |
33 | nogroups | 32 | nogroups |
34 | nonewprivs | 33 | nonewprivs |
35 | noroot | 34 | noroot |
36 | nosound | ||
37 | notv | 35 | notv |
38 | nou2f | 36 | nou2f |
39 | novideo | 37 | novideo |
diff --git a/etc/i2prouter.profile b/etc/i2prouter.profile index e46fb3317..d9e7f1c8f 100644 --- a/etc/i2prouter.profile +++ b/etc/i2prouter.profile | |||
@@ -6,19 +6,19 @@ include i2prouter.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Notice: default browser will not be able to automatically open, due to sandbox. | 9 | # Notice: default browser will most likely not be able to automatically open, due to sandbox. |
10 | # Auto-opening default browser can be disabled in the I2P router console. | 10 | # Auto-opening default browser can be disabled in the I2P router console. |
11 | # This profile will not currently work with any Arch User Repository i2p packages, | 11 | # This profile will not currently work with any Arch User Repository I2P packages, |
12 | # use the distro-independent official java installer instead | 12 | # use the distro-independent official I2P java installer instead |
13 | 13 | ||
14 | # Only needed if i2prouter binary is in home directory, java installer does this | 14 | # Only needed if i2prouter binary is in home directory, official I2P java installer does this |
15 | ignore noexec ${HOME} | 15 | ignore noexec ${HOME} |
16 | 16 | ||
17 | noblacklist ${HOME}/.config/i2p | 17 | noblacklist ${HOME}/.config/i2p |
18 | noblacklist ${HOME}/.i2p | 18 | noblacklist ${HOME}/.i2p |
19 | noblacklist ${HOME}/.local/share/i2p | 19 | noblacklist ${HOME}/.local/share/i2p |
20 | noblacklist ${HOME}/i2p | 20 | noblacklist ${HOME}/i2p |
21 | # Only needed if wrapper is placed in /usr/sbin/, ubuntu official ppa package does this | 21 | # Only needed if wrapper is placed in /usr/sbin/, ubuntu official I2P ppa package does this |
22 | noblacklist /usr/sbin | 22 | noblacklist /usr/sbin |
23 | 23 | ||
24 | # Allow java (blacklisted by disable-devel.inc) | 24 | # Allow java (blacklisted by disable-devel.inc) |
@@ -40,13 +40,13 @@ whitelist ${HOME}/.config/i2p | |||
40 | whitelist ${HOME}/.i2p | 40 | whitelist ${HOME}/.i2p |
41 | whitelist ${HOME}/.local/share/i2p | 41 | whitelist ${HOME}/.local/share/i2p |
42 | whitelist ${HOME}/i2p | 42 | whitelist ${HOME}/i2p |
43 | # Only needed if wrapper is placed in /usr/sbin/, ubuntu official ppa package does this | 43 | # Only needed if wrapper is placed in /usr/sbin/, ubuntu official I2P ppa package does this |
44 | whitelist /usr/sbin/wrapper* | 44 | whitelist /usr/sbin/wrapper* |
45 | 45 | ||
46 | include whitelist-common.inc | 46 | include whitelist-common.inc |
47 | 47 | ||
48 | # May break I2P if wrapper is placed in the home directory | 48 | # May break I2P if wrapper is placed in the home directory; official I2P java installer does this |
49 | # If using ubuntu official ppa, this should be fine to uncomment, as it puts wrapper in /usr/sbin/ | 49 | # If using ubuntu official I2P ppa, this should be fine to uncomment, as it puts wrapper in /usr/sbin/ |
50 | #apparmor | 50 | #apparmor |
51 | caps.drop all | 51 | caps.drop all |
52 | ipc-namespace | 52 | ipc-namespace |
@@ -67,5 +67,5 @@ shell none | |||
67 | disable-mnt | 67 | disable-mnt |
68 | private-cache | 68 | private-cache |
69 | private-dev | 69 | private-dev |
70 | private-etc alternatives,ca-certificates,crypto-policies,i2p,java-8-openjdk,pki,ssl | 70 | private-etc alternatives,ca-certificates,crypto-policies,dconf,group,hostname,hosts,i2p,java-8-openjdk,java-9-openjdk,java-10-openjdk,java-11-openjdk,java-12-openjdk,java-13-openjdk,java-openjdk,ld.so.cache,localtime,machine-id,nsswitch.conf,passwd,pki,resolv.conf,ssl |
71 | private-tmp | 71 | private-tmp |
diff --git a/etc/keepass.profile b/etc/keepass.profile index 57a24d821..9852f8a79 100644 --- a/etc/keepass.profile +++ b/etc/keepass.profile | |||
@@ -34,7 +34,7 @@ nosound | |||
34 | notv | 34 | notv |
35 | nou2f | 35 | nou2f |
36 | novideo | 36 | novideo |
37 | protocol unix,inet,inet6 | 37 | protocol unix,inet,inet6,netlink |
38 | seccomp | 38 | seccomp |
39 | shell none | 39 | shell none |
40 | 40 | ||
diff --git a/etc/mpv.profile b/etc/mpv.profile index 6e587fc6a..56cd66199 100644 --- a/etc/mpv.profile +++ b/etc/mpv.profile | |||
@@ -27,6 +27,7 @@ include disable-passwdmgr.inc | |||
27 | include disable-programs.inc | 27 | include disable-programs.inc |
28 | include disable-xdg.inc | 28 | include disable-xdg.inc |
29 | 29 | ||
30 | whitelist /usr/share/vulkan | ||
30 | include whitelist-usr-share-common.inc | 31 | include whitelist-usr-share-common.inc |
31 | include whitelist-var-common.inc | 32 | include whitelist-var-common.inc |
32 | 33 | ||
diff --git a/etc/mupdf.profile b/etc/mupdf.profile index 673c9fd0b..99945bdc9 100644 --- a/etc/mupdf.profile +++ b/etc/mupdf.profile | |||
@@ -32,14 +32,13 @@ nou2f | |||
32 | novideo | 32 | novideo |
33 | protocol unix | 33 | protocol unix |
34 | seccomp | 34 | seccomp |
35 | # seccomp.keep access,arch_prctl,brk,clone,close,connect,execve,exit_group,fchmod,fchown,fcntl,fstat,futex,getcwd,getpeername,getrlimit,getsockname,getsockopt,lseek,lstat,mlock,mmap,mprotect,mremap,munmap,nanosleep,open,poll,prctl,read,recvfrom,recvmsg,restart_syscall,rt_sigaction,rt_sigprocmask,select,sendmsg,set_robust_list,set_tid_address,setresgid,setresuid,shmat,shmctl,shmget,shutdown,socket,stat,sysinfo,uname,unshare,wait4,write,writev | ||
36 | shell none | 35 | shell none |
37 | tracelog | 36 | tracelog |
38 | 37 | ||
39 | # private-bin mupdf,rm,sh,tempfile | 38 | # private-bin mupdf,rm,sh,tempfile |
40 | private-dev | 39 | private-dev |
41 | private-etc alternatives,fonts | 40 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload |
42 | private-tmp | 41 | private-tmp |
43 | 42 | ||
44 | memory-deny-write-execute | 43 | # memory-deny-write-execute |
45 | read-only ${HOME} | 44 | read-only ${HOME} |
diff --git a/etc/musescore.profile b/etc/musescore.profile index 9750a31f4..b3693c956 100644 --- a/etc/musescore.profile +++ b/etc/musescore.profile | |||
@@ -33,7 +33,8 @@ noroot | |||
33 | notv | 33 | notv |
34 | novideo | 34 | novideo |
35 | protocol unix,inet,inet6 | 35 | protocol unix,inet,inet6 |
36 | seccomp | 36 | # QtWebengine needs chroot to set up its own sandbox |
37 | seccomp !chroot | ||
37 | shell none | 38 | shell none |
38 | tracelog | 39 | tracelog |
39 | 40 | ||
diff --git a/etc/neverputt.profile b/etc/neverputt.profile index 93fb14e07..d370d1218 100644 --- a/etc/neverputt.profile +++ b/etc/neverputt.profile | |||
@@ -5,5 +5,7 @@ include neverputt.local | |||
5 | # added by included profile | 5 | # added by included profile |
6 | #include globals.local | 6 | #include globals.local |
7 | 7 | ||
8 | private-bin neverputt | ||
9 | |||
8 | # Redirect | 10 | # Redirect |
9 | include neverball.profile | 11 | include neverball.profile |
diff --git a/etc/pavucontrol.profile b/etc/pavucontrol.profile index 5bbe1386f..0ae9f08af 100644 --- a/etc/pavucontrol.profile +++ b/etc/pavucontrol.profile | |||
@@ -16,11 +16,12 @@ include disable-passwdmgr.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | 17 | include disable-xdg.inc |
18 | 18 | ||
19 | mkfile ${HOME}/.config/pavucontrol.ini | 19 | # whitelisting in ${HOME} is broken, see #3112 |
20 | whitelist ${HOME}/.config/pavucontrol.ini | 20 | #mkfile ${HOME}/.config/pavucontrol.ini |
21 | #whitelist ${HOME}/.config/pavucontrol.ini | ||
21 | whitelist /usr/share/pavucontrol | 22 | whitelist /usr/share/pavucontrol |
22 | whitelist /usr/share/pavucontrol-qt | 23 | whitelist /usr/share/pavucontrol-qt |
23 | include whitelist-common.inc | 24 | #include whitelist-common.inc |
24 | include whitelist-usr-share-common.inc | 25 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
26 | 27 | ||
@@ -39,6 +40,7 @@ novideo | |||
39 | protocol unix,inet,inet6 | 40 | protocol unix,inet,inet6 |
40 | seccomp | 41 | seccomp |
41 | shell none | 42 | shell none |
43 | tracelog | ||
42 | 44 | ||
43 | disable-mnt | 45 | disable-mnt |
44 | private-bin pavucontrol | 46 | private-bin pavucontrol |
@@ -48,4 +50,5 @@ private-etc alternatives,asound.conf,avahi,fonts,machine-id,pulse | |||
48 | private-lib | 50 | private-lib |
49 | private-tmp | 51 | private-tmp |
50 | 52 | ||
51 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 53 | # mdwe is broken under Wayland, but works under Xorg. |
54 | #memory-deny-write-execute | ||
diff --git a/etc/psi-plus.profile b/etc/psi-plus.profile index 087f90966..16fffe517 100644 --- a/etc/psi-plus.profile +++ b/etc/psi-plus.profile | |||
@@ -36,10 +36,10 @@ notv | |||
36 | nou2f | 36 | nou2f |
37 | novideo | 37 | novideo |
38 | protocol unix,inet,inet6 | 38 | protocol unix,inet,inet6 |
39 | seccomp | 39 | # QtWebengine needs chroot to set up its own sandbox |
40 | seccomp !chroot | ||
40 | shell none | 41 | shell none |
41 | 42 | ||
42 | disable-mnt | 43 | disable-mnt |
43 | private-dev | 44 | private-dev |
44 | private-tmp | 45 | private-tmp |
45 | |||
diff --git a/etc/quassel.profile b/etc/quassel.profile index a78d1edcd..c65089e20 100644 --- a/etc/quassel.profile +++ b/etc/quassel.profile | |||
@@ -19,7 +19,8 @@ nonewprivs | |||
19 | noroot | 19 | noroot |
20 | notv | 20 | notv |
21 | protocol unix,inet,inet6 | 21 | protocol unix,inet,inet6 |
22 | seccomp | 22 | # QtWebengine needs chroot to set up its own sandbox |
23 | seccomp !chroot | ||
23 | 24 | ||
24 | private-cache | 25 | private-cache |
25 | private-tmp | 26 | private-tmp |
diff --git a/etc/standardnotes-desktop.profile b/etc/standardnotes-desktop.profile index aa6902854..a402aca5a 100644 --- a/etc/standardnotes-desktop.profile +++ b/etc/standardnotes-desktop.profile | |||
@@ -39,5 +39,5 @@ seccomp !chroot | |||
39 | disable-mnt | 39 | disable-mnt |
40 | private-dev | 40 | private-dev |
41 | private-tmp | 41 | private-tmp |
42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,pki,resolv.conf,ssl,xdg | 42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,pki,resolv.conf,ssl,xdg |
43 | 43 | ||
diff --git a/etc/start-tor-browser.profile b/etc/start-tor-browser.profile index a8b5d109e..f9daf8f09 100644 --- a/etc/start-tor-browser.profile +++ b/etc/start-tor-browser.profile | |||
@@ -36,5 +36,5 @@ shell none | |||
36 | disable-mnt | 36 | disable-mnt |
37 | private-bin bash,cat,cp,cut,dirname,env,getconf,gpg,grep,gxmessage,id,kdialog,ln,mkdir,pwd,readlink,realpath,rm,sed,sh,tail,test,update-desktop-database,xmessage,zenity | 37 | private-bin bash,cat,cp,cut,dirname,env,getconf,gpg,grep,gxmessage,id,kdialog,ln,mkdir,pwd,readlink,realpath,rm,sed,sh,tail,test,update-desktop-database,xmessage,zenity |
38 | private-dev | 38 | private-dev |
39 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,machine-id,pki,pulse,resolv.conf,ssl | 39 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
40 | private-tmp | 40 | private-tmp |
diff --git a/etc/templates/profile.template b/etc/templates/profile.template index dcf6dd201..7bfc3cf0d 100644 --- a/etc/templates/profile.template +++ b/etc/templates/profile.template | |||
@@ -87,6 +87,9 @@ include globals.local | |||
87 | # Allow lua (blacklisted by disable-interpreters.inc) | 87 | # Allow lua (blacklisted by disable-interpreters.inc) |
88 | #include allow-lua.inc | 88 | #include allow-lua.inc |
89 | 89 | ||
90 | # Allow ruby (blacklisted by disable-interpreters.inc) | ||
91 | #include allow-ruby.inc | ||
92 | |||
90 | # Allows files commonly used by IDEs | 93 | # Allows files commonly used by IDEs |
91 | #include allow-common-devel.inc | 94 | #include allow-common-devel.inc |
92 | 95 | ||
diff --git a/etc/torbrowser-launcher.profile b/etc/torbrowser-launcher.profile index 1183cd2f7..b40a18fa3 100644 --- a/etc/torbrowser-launcher.profile +++ b/etc/torbrowser-launcher.profile | |||
@@ -50,5 +50,5 @@ shell none | |||
50 | disable-mnt | 50 | disable-mnt |
51 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,kdialog,ln,mkdir,mv,python*,rm,sed,sh,tail,tar,tclsh,test,tor-browser,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity | 51 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,kdialog,ln,mkdir,mv,python*,rm,sed,sh,tail,tar,tclsh,test,tor-browser,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity |
52 | private-dev | 52 | private-dev |
53 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,ld.so.cache,machine-id,pki,pulse,resolv.conf,ssl | 53 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
54 | private-tmp | 54 | private-tmp |
diff --git a/etc/udiskie.profile b/etc/udiskie.profile index f6e85d60e..265f6429d 100644 --- a/etc/udiskie.profile +++ b/etc/udiskie.profile | |||
@@ -31,7 +31,7 @@ notv | |||
31 | nou2f | 31 | nou2f |
32 | novideo | 32 | novideo |
33 | protocol unix | 33 | protocol unix |
34 | seccomp | 34 | seccomp !request_key |
35 | shell none | 35 | shell none |
36 | tracelog | 36 | tracelog |
37 | 37 | ||
diff --git a/etc/wget.profile b/etc/wget.profile index 4bf354652..9c2cddb67 100644 --- a/etc/wget.profile +++ b/etc/wget.profile | |||
@@ -35,6 +35,6 @@ shell none | |||
35 | 35 | ||
36 | # private-bin wget | 36 | # private-bin wget |
37 | private-dev | 37 | private-dev |
38 | # private-etc alternatives,ca-certificates,crypto-policie,pki,resolv.conf,ssl | 38 | # private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl |
39 | # private-tmp | 39 | # private-tmp |
40 | 40 | ||
diff --git a/etc/wire-desktop.profile b/etc/wire-desktop.profile index 490255fa6..a56ecef1b 100644 --- a/etc/wire-desktop.profile +++ b/etc/wire-desktop.profile | |||
@@ -18,16 +18,12 @@ whitelist ${HOME}/.config/Wire | |||
18 | whitelist ${DOWNLOADS} | 18 | whitelist ${DOWNLOADS} |
19 | include whitelist-common.inc | 19 | include whitelist-common.inc |
20 | 20 | ||
21 | caps.drop all | 21 | caps.keep sys_admin,sys_chroot |
22 | netfilter | 22 | netfilter |
23 | nodvd | 23 | nodvd |
24 | nogroups | 24 | nogroups |
25 | nonewprivs | ||
26 | noroot | ||
27 | notv | 25 | notv |
28 | nou2f | 26 | nou2f |
29 | protocol unix,inet,inet6,netlink | ||
30 | seccomp | ||
31 | shell none | 27 | shell none |
32 | 28 | ||
33 | # Note: The current version of Wire is located in /opt/wire-desktop/wire-desktop, and therefore | 29 | # Note: The current version of Wire is located in /opt/wire-desktop/wire-desktop, and therefore |
diff --git a/etc/youtube-dl.profile b/etc/youtube-dl.profile index 74c07d96b..5fa72c9dc 100644 --- a/etc/youtube-dl.profile +++ b/etc/youtube-dl.profile | |||
@@ -56,7 +56,7 @@ tracelog | |||
56 | private-bin env,ffmpeg,python*,youtube-dl | 56 | private-bin env,ffmpeg,python*,youtube-dl |
57 | private-cache | 57 | private-cache |
58 | private-dev | 58 | private-dev |
59 | private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,mime.types,pki,resolv.conf,ssl,youtube-dl.conf | 59 | private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,ld.so.cache,mime.types,pki,resolv.conf,ssl,youtube-dl.conf |
60 | private-tmp | 60 | private-tmp |
61 | 61 | ||
62 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 62 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 97148c6b6..e3d7a35a1 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -295,7 +295,6 @@ hedgewars | |||
295 | hexchat | 295 | hexchat |
296 | highlight | 296 | highlight |
297 | hugin | 297 | hugin |
298 | i2prouter | ||
299 | icecat | 298 | icecat |
300 | icedove | 299 | icedove |
301 | iceweasel | 300 | iceweasel |