5 files changed, 194 insertions, 175 deletions

diff --git a/.gitignore b/.gitignore
index 16169ab94..76ce6c7ec 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,7 @@
 *.DS_Store
 .directory
 *.man
+.vscode
 Makefile
 autom4te.cache/
 config.log
diff --git a/contrib/jail_prober.py b/contrib/jail_prober.py
index dad790b57..67e851282 100755
--- a/contrib/jail_prober.py
+++ b/contrib/jail_prober.py
@@ -1,174 +1,186 @@
-#!/usr/bin/env python3

-# This file is part of Firejail project

-# Copyright (C) 2014-2020 Firejail Authors

-# License GPL v2

-"""

-Figure out which profile options may be causing a particular program to break

-when run in firejail.

-

-Instead of having to comment out each line in a profile by hand, and then

-enable each line individually until the bad line or lines are found, this

-largely automates the process. Users only have to provide the path to the

-profile, program name, and answer 'y' for yes or 'n' for no when prompted.

-

-After completion, you'll be provided with some information to copy and then

-paste into a GitHub issue in the Firejail project repository:

-https://github.com/netblue30/firejail/issues

-

-Paths to the profile should be absolute. If the program is in your path, then

-you only have to type the profile name. Else, you'll need to provide the

-absolute path to the profile.

-

-Examples:

-python jail_prober.py /etc/firejail/spotify.profile spotify

-python jail_prober.py /usr/local/etc/firejail/firefox.profile /usr/bin/firefox

-"""

-

-import sys

-import os

-import subprocess

-

-

-def check_params(profilePath):

-    """

-    Ensure the path to the profile is valid and that an actual profile has been

-    passed (as opposed to a config or .local file).

-

-    :params profilePath: The absolute path to the problematic profile.

-    """

-    if not os.path.isfile(profilePath):

-        raise FileNotFoundError(

-            'The path %s is not a valid system path.' % profilePath)

-    if not profilePath.endswith('.profile'):

-        raise ValueError('%s is not a valid Firejail profile.' % profilePath)

-

-

-def get_args(profilePath):

-    """

-    Read the profile, stripping out comments and newlines

-

-    :params profilePath: The absolute path to the problematic profile.

-

-    :returns profile: A list containing all active profile arguments

-    """

-    with open(profilePath, 'r') as f:

-        profile = f.readlines()

-        profile = [

-            arg.strip() for arg in profile

-            if not arg.startswith('#') and arg.strip() != ''

-        ]

-

-    return profile

-

-

-def arg_converter(argList, style):

-    """

-    Convert between firejail command-line arguments (--example=something) and

-    profile arguments (example something)

-

-    :params argList: A list of firejail arguments

-

-    :params style: Whether to convert arguments to command-line form or profile

-    form

-    """

-    if style == 'to_profile':

-        oldSep = '='

-        newSep = ' '

-        prefix = ''

-    elif style == 'to_commandline':

-        oldSep = ' '

-        newSep = '='

-        prefix = '--'

-    newArgs = [prefix + word.replace(oldSep, newSep) for word in argList]

-    # Additional strip of '--' if converting to profile form

-    if style == 'to_profile':

-        newArgs = [word[2:] for word in newArgs]

-

-    # Remove invalid '--include' args if converting to command-line form

-    elif style == 'to_commandline':

-        newArgs = [word for word in newArgs if 'include' not in word]

-

-    return newArgs

-

-

-def run_firejail(program, allArgs):

-    """

-    Attempt to run the program in firejail, incrementally adding to the number

-    of firejail arguments. Initial run has no additional params besides

-    noprofile.

-

-    :params program: The program name. If it doesn't exist in the user's path

-    then the full path should be provided.

-

-    :params allArgs: A list of all Firejail arguments to try, in command-line

-    format.

-

-    :returns goodArgs: A list of arguments that the user has reported to not

-    affect the program

-

-    :returns badArgs: A list of arguments that the user has reported to break

-    the program when sandboxing with Firejail

-    """

-    goodArgs = ['firejail', '--noprofile', program]

-    badArgs = []

-    allArgs.insert(0,"")

-    print('Attempting to run %s in Firejail' % program)

-    for arg in allArgs:

-        if arg:

-            print('Running with', arg)

-        else:

-            print('Running without profile')

-        #We are adding the argument in a copy of the actual list to avoid modify it now.

-        myargs=goodArgs.copy()

-        if arg:

-            myargs.insert(-1,arg)

-        subprocess.call(myargs)

-        ans = input('Did %s run correctly? [y]/n ' % program)

-        if ans in ['n', 'N']:

-            badArgs.append(arg)

-        elif arg:

-            goodArgs.insert(-1, arg)

-        print('\n')

-    # Don't include 'firejail', '--noprofile', or program name in arguments

-    goodArgs = goodArgs[2:-1]

-

-    return goodArgs, badArgs

-

-

-def main():

-    profilePath = sys.argv[1]

-    program = sys.argv[2]

-    # Quick error check and extract arguments

-    check_params(profilePath)

-    profile = get_args(profilePath)

-    allArgs = arg_converter(profile, 'to_commandline')

-    # Find out which profile options break the program when running in firejail

-    goodArgs, badArgs = run_firejail(program, allArgs)

-

-    goodArgs = arg_converter(goodArgs, 'to_profile')

-    badArgs = arg_converter(badArgs, 'to_profile')

-

-    print('\n###########################')

-    print('Debugging completed.')

-    print(

-        'Please copy the following and report it to the Firejail development',

-        'team on GitHub at %s \n\n' %

-        'https://github.com/netblue30/firejail/issues')

-

-    subprocess.call(['firejail', '--version'])

-

-    print('These profile options break the program.')

-    print('```')

-    for item in badArgs:

-        print(item)

-    print('```\n\n\n')

-

-    print('This is a minimal working profile:')

-    print('```')

-    for item in goodArgs:

-        print(item)

-    print('```')

-

-

-if __name__ == '__main__':

-    main()

+#!/usr/bin/env python3
+# This file is part of Firejail project
+# Copyright (C) 2014-2020 Firejail Authors
+# License GPL v2
+"""
+Figure out which profile options may be causing a particular program to break
+when run in firejail.
+
+Instead of having to comment out each line in a profile by hand, and then
+enable each line individually until the bad line or lines are found, this
+largely automates the process. Users only have to provide the path to the
+profile, program name, and answer 'y' for yes or 'n' for no when prompted.
+
+After completion, you'll be provided with some information to copy and then
+paste into a GitHub issue in the Firejail project repository:
+https://github.com/netblue30/firejail/issues
+
+Paths to the profile should be absolute. If the program is in your path, then
+you only have to type the profile name. Else, you'll need to provide the
+absolute path to the profile.
+
+Examples:
+python jail_prober.py /etc/firejail/spotify.profile spotify
+python jail_prober.py /usr/local/etc/firejail/firefox.profile /usr/bin/firefox
+"""
+
+import sys
+import os
+import subprocess
+
+
+def check_params(profile_path):
+    """
+    Ensure the path to the profile is valid and that an actual profile has been
+    passed (as opposed to a config or .local file).
+
+    Args:
+        profile_path:       The absolute path to the problematic profile
+
+    Raises:
+        FileNotFoundError:  If the provided path isn't real
+
+        ValueError:         If the provided path is real but doesn't point to
+                            a Firejail profile
+    """
+    if not os.path.isfile(profile_path):
+        raise FileNotFoundError('The path %s is not a valid system path.' %
+                                profile_path)
+    if not profile_path.endswith('.profile'):
+        raise ValueError('%s is not a valid Firejail profile.' % profile_path)
+
+
+def get_args(profile_path):
+    """
+    Read the profile, stripping out comments and newlines
+
+    Args:
+        profile_path:   The absolute path to the problematic profile.
+
+    Returns:
+        A list containing all active profile arguments
+    """
+    with open(profile_path, 'r') as f:
+        profile = f.readlines()
+        profile = [
+            arg.strip() for arg in profile
+            if not arg.startswith('#') and arg.strip() != ''
+        ]
+
+    return profile
+
+
+def arg_converter(arg_list, style):
+    """
+    Convert between firejail command-line arguments (--example=something) and
+    profile arguments (example something)
+
+    Args:
+        arg_list:   A list of firejail arguments
+
+        style:      String, one of {'to_profile', 'to_commandline'}. Whether to
+                    convert arguments to command-line form or profile form
+    """
+    if style == 'to_profile':
+        old_sep = '='
+        new_sep = ' '
+        prefix = ''
+    elif style == 'to_commandline':
+        old_sep = ' '
+        new_sep = '='
+        prefix = '--'
+    new_args = [prefix + word.replace(old_sep, new_sep) for word in arg_list]
+    # Additional strip of '--' if converting to profile form
+    if style == 'to_profile':
+        new_args = [word[2:] for word in new_args]
+
+    # Remove invalid '--include' args if converting to command-line form
+    elif style == 'to_commandline':
+        new_args = [word for word in new_args if 'include' not in word]
+
+    return new_args
+
+
+def run_firejail(program, all_args):
+    """
+    Attempt to run the program in firejail, incrementally adding to the number
+    of firejail arguments. Initial run has no additional params besides
+    noprofile.
+
+    Args:
+        program:    String, the program name. If it doesn't exist in $PATH then
+                    the full path to the program should be provided
+
+        all_args:   List, all Firejail arguments to try, in command-line format
+                    (i.e. prefixed by '--')
+
+    Returns:
+        good_args:  List, all Firejail arguments that the user has reported to
+                    not adversely affect the program
+
+        bad_args:   List, all Firejail arguments that the user has reported to
+                    break the program
+    """
+    good_args = ['firejail', '--noprofile', program]
+    bad_args = []
+    all_args.insert(0, "")
+    print('Attempting to run %s in Firejail' % program)
+    for arg in all_args:
+        if arg:
+            print('Running with', arg)
+        else:
+            print('Running without profile')
+        #We are adding the argument in a copy of the actual list to avoid modify it now.
+        myargs = good_args.copy()
+        if arg:
+            myargs.insert(-1, arg)
+        subprocess.call(myargs)
+        ans = input('Did %s run correctly? [y]/n ' % program)
+        if ans in ['n', 'N']:
+            bad_args.append(arg)
+        elif arg:
+            good_args.insert(-1, arg)
+        print('\n')
+    # Don't include 'firejail', '--noprofile', or program name in arguments
+    good_args = good_args[2:-1]
+
+    return good_args, bad_args
+
+
+def main():
+    profile_path = sys.argv[1]
+    program = sys.argv[2]
+    # Quick error check and extract arguments
+    check_params(profile_path)
+    profile = get_args(profile_path)
+    all_args = arg_converter(profile, 'to_commandline')
+    # Find out which profile options break the program when running in firejail
+    good_args, bad_args = run_firejail(program, all_args)
+
+    good_args = arg_converter(good_args, 'to_profile')
+    bad_args = arg_converter(bad_args, 'to_profile')
+
+    print('\n###########################')
+    print('Debugging completed.')
+    print(
+        'Please copy the following and report it to the Firejail development',
+        'team on GitHub at %s \n\n' %
+        'https://github.com/netblue30/firejail/issues')
+
+    subprocess.call(['firejail', '--version'])
+
+    print('These profile options break the program.')
+    print('```')
+    for item in bad_args:
+        print(item)
+    print('```\n\n\n')
+
+    print('This is a minimal working profile:')
+    print('```')
+    for item in good_args:
+        print(item)
+    print('```')
+
+
+if __name__ == '__main__':
+    main()
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index 4f90e6413..cc4f81fa6 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -214,6 +214,7 @@ blacklist ${HOME}/.config/evince
 blacklist ${HOME}/.config/evolution
 blacklist ${HOME}/.config/falkon
 blacklist ${HOME}/.config/filezilla
+blacklist ${HOME}/.config/flameshot
 blacklist ${HOME}/.config/flaska.net
 blacklist ${HOME}/.config/flowblade
 blacklist ${HOME}/.config/font-manager
diff --git a/etc/profile-a-l/firefox.profile b/etc/profile-a-l/firefox.profile
index 337311ed8..ce2013c57 100644
--- a/etc/profile-a-l/firefox.profile
+++ b/etc/profile-a-l/firefox.profile
@@ -24,7 +24,7 @@ include whitelist-usr-share-common.inc
 # firefox requires a shell to launch on Arch.
 #private-bin bash,dbus-launch,dbus-send,env,firefox,sh,which
 # Fedora use shell scripts to launch firefox, at least this is required
-#private-bin basename,bash,cat,dirname,expr,false,firefox,firefox-wayland,ln,mkdir,pidof,rm,rmdir,sed,sh,tclsh,true,uname
+#private-bin basename,bash,cat,dirname,expr,false,firefox,firefox-wayland,getenforce,ln,mkdir,pidof,restorecon,rm,rmdir,sed,sh,tclsh,true,uname
 # private-etc must first be enabled in firefox-common.profile
 #private-etc firefox
 
diff --git a/etc/profile-a-l/flameshot.profile b/etc/profile-a-l/flameshot.profile
index 7c41417ec..357354e70 100644
--- a/etc/profile-a-l/flameshot.profile
+++ b/etc/profile-a-l/flameshot.profile
@@ -9,6 +9,7 @@ include globals.local
 
 noblacklist ${PICTURES}
 noblacklist ${HOME}/.config/Dharkael
+noblacklist ${HOME}/.config/flameshot
 
 include disable-common.inc
 include disable-devel.inc
@@ -19,8 +20,11 @@ include disable-programs.inc
 include disable-shell.inc
 include disable-xdg.inc
 
+#mkdir ${HOME}/.config/Dharkael
+#mkdir ${HOME}/.config/flameshot
 #whitelist ${PICTURES}
 #whitelist ${HOME}/.config/Dharkael
+#whitelist ${HOME}/.config/flameshot
 whitelist /usr/share/flameshot
 #include whitelist-common.inc
 include whitelist-runuser-common.inc
@@ -53,4 +57,5 @@ private-tmp
 
 dbus-user filter
 dbus-user.own org.dharkael.Flameshot
+dbus-user.own org.flameshot.Flameshot
 dbus-system none