aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.gitattributes1
-rw-r--r--.github/workflows/profile-checks.yml31
-rw-r--r--.github/workflows/sort.yml21
-rw-r--r--Makefile.in3
-rw-r--r--README2
-rw-r--r--README.md6
-rw-r--r--RELNOTES2
-rwxr-xr-xci/check/profiles/private-etc-always-required.sh15
-rwxr-xr-xci/check/profiles/sort-disable-programs.sh2
-rwxr-xr-xci/check/profiles/sort-firecfg.config.sh2
l---------ci/check/profiles/sort.py1
-rw-r--r--etc/apparmor/firejail-base15
-rw-r--r--etc/ids.config16
-rw-r--r--etc/inc/allow-ssh.inc7
-rw-r--r--etc/inc/disable-common.inc30
-rw-r--r--etc/inc/disable-programs.inc351
-rw-r--r--etc/profile-a-l/abiword.profile2
-rw-r--r--etc/profile-a-l/agetpkg.profile2
-rw-r--r--etc/profile-a-l/alacarte.profile2
-rw-r--r--etc/profile-a-l/anki.profile2
-rw-r--r--etc/profile-a-l/aria2c.profile2
-rw-r--r--etc/profile-a-l/arm.profile2
-rw-r--r--etc/profile-a-l/artha.profile2
-rw-r--r--etc/profile-a-l/atool.profile2
-rw-r--r--etc/profile-a-l/authenticator-rs.profile2
-rw-r--r--etc/profile-a-l/balsa.profile2
-rw-r--r--etc/profile-a-l/bibletime.profile2
-rw-r--r--etc/profile-a-l/bijiben.profile2
-rw-r--r--etc/profile-a-l/bitwarden.profile2
-rw-r--r--etc/profile-a-l/bless.profile2
-rw-r--r--etc/profile-a-l/blobby.profile2
-rw-r--r--etc/profile-a-l/blobwars.profile2
-rw-r--r--etc/profile-a-l/bsdtar.profile2
-rw-r--r--etc/profile-a-l/cameramonitor.profile2
-rw-r--r--etc/profile-a-l/cawbird.profile2
-rw-r--r--etc/profile-a-l/cheese.profile2
-rw-r--r--etc/profile-a-l/chromium-common.profile1
-rw-r--r--etc/profile-a-l/clawsker.profile2
-rw-r--r--etc/profile-a-l/cmus.profile2
-rw-r--r--etc/profile-a-l/com.github.bleakgrey.tootle.profile2
-rw-r--r--etc/profile-a-l/com.github.dahenson.agenda.profile2
-rw-r--r--etc/profile-a-l/com.github.johnfactotum.Foliate.profile2
-rw-r--r--etc/profile-a-l/coyim.profile2
-rw-r--r--etc/profile-a-l/crow.profile2
-rw-r--r--etc/profile-a-l/d-feet.profile2
-rw-r--r--etc/profile-a-l/dbus-send.profile2
-rw-r--r--etc/profile-a-l/dconf-editor.profile2
-rw-r--r--etc/profile-a-l/dconf.profile2
-rw-r--r--etc/profile-a-l/ddgtk.profile2
-rw-r--r--etc/profile-a-l/devilspie.profile2
-rw-r--r--etc/profile-a-l/display.profile2
-rw-r--r--etc/profile-a-l/drawio.profile2
-rw-r--r--etc/profile-a-l/easystroke.profile2
-rw-r--r--etc/profile-a-l/electron-mail.profile2
-rw-r--r--etc/profile-a-l/electrum.profile2
-rw-r--r--etc/profile-a-l/email-common.profile2
-rw-r--r--etc/profile-a-l/enchant.profile2
-rw-r--r--etc/profile-a-l/eo-common.profile2
-rw-r--r--etc/profile-a-l/equalx.profile2
-rw-r--r--etc/profile-a-l/exiftool.profile2
-rw-r--r--etc/profile-a-l/falkon.profile2
-rw-r--r--etc/profile-a-l/fdns.profile2
-rw-r--r--etc/profile-a-l/feh-network.inc.profile2
-rw-r--r--etc/profile-a-l/feh.profile2
-rw-r--r--etc/profile-a-l/ffplay.profile2
-rw-r--r--etc/profile-a-l/file-roller.profile2
-rw-r--r--etc/profile-a-l/flameshot.profile2
-rw-r--r--etc/profile-a-l/freetube.profile2
-rw-r--r--etc/profile-a-l/frogatto.profile2
-rw-r--r--etc/profile-a-l/ftp.profile54
-rw-r--r--etc/profile-a-l/galculator.profile2
-rw-r--r--etc/profile-a-l/gallery-dl.profile2
-rw-r--r--etc/profile-a-l/gapplication.profile2
-rw-r--r--etc/profile-a-l/gconf.profile2
-rw-r--r--etc/profile-a-l/geary.profile2
-rw-r--r--etc/profile-a-l/geekbench.profile2
-rw-r--r--etc/profile-a-l/gget.profile2
-rw-r--r--etc/profile-a-l/gist.profile2
-rw-r--r--etc/profile-a-l/git-cola.profile2
-rw-r--r--etc/profile-a-l/gitter.profile2
-rw-r--r--etc/profile-a-l/gmpc.profile2
-rw-r--r--etc/profile-a-l/gnome-calendar.profile2
-rw-r--r--etc/profile-a-l/gnome-chess.profile2
-rw-r--r--etc/profile-a-l/gnome-clocks.profile2
-rw-r--r--etc/profile-a-l/gnome-hexgl.profile2
-rw-r--r--etc/profile-a-l/gnome-latex.profile2
-rw-r--r--etc/profile-a-l/gnome-logs.profile2
-rw-r--r--etc/profile-a-l/gnome-music.profile2
-rw-r--r--etc/profile-a-l/gnome-passwordsafe.profile2
-rw-r--r--etc/profile-a-l/gnome-pie.profile2
-rw-r--r--etc/profile-a-l/gnome-pomodoro.profile2
-rw-r--r--etc/profile-a-l/gnome-recipes.profile2
-rw-r--r--etc/profile-a-l/gnome-screenshot.profile2
-rw-r--r--etc/profile-a-l/gnome-sound-recorder.profile2
-rw-r--r--etc/profile-a-l/gnome-system-log.profile2
-rw-r--r--etc/profile-a-l/gnome-todo.profile2
-rw-r--r--etc/profile-a-l/gnome_games-common.profile2
-rw-r--r--etc/profile-a-l/gnote.profile2
-rw-r--r--etc/profile-a-l/gnubik.profile2
-rw-r--r--etc/profile-a-l/godot.profile2
-rw-r--r--etc/profile-a-l/goldendict.profile2
-rw-r--r--etc/profile-a-l/googler-common.profile2
-rw-r--r--etc/profile-a-l/gpicview.profile2
-rw-r--r--etc/profile-a-l/gpredict.profile2
-rw-r--r--etc/profile-a-l/gradio.profile2
-rw-r--r--etc/profile-a-l/gravity-beams-and-evaporating-stars.profile2
-rw-r--r--etc/profile-a-l/gtk-update-icon-cache.profile2
-rw-r--r--etc/profile-a-l/hyperrogue.profile2
-rw-r--r--etc/profile-a-l/ipcalc.profile2
-rw-r--r--etc/profile-a-l/jerry.profile2
-rw-r--r--etc/profile-a-l/jumpnbump.profile2
-rw-r--r--etc/profile-a-l/kalgebra.profile2
-rw-r--r--etc/profile-a-l/kazam.profile2
-rw-r--r--etc/profile-a-l/keepassx.profile2
-rw-r--r--etc/profile-a-l/kid3.profile2
-rw-r--r--etc/profile-a-l/klavaro.profile2
-rw-r--r--etc/profile-a-l/ktouch.profile2
-rw-r--r--etc/profile-a-l/kube.profile2
-rw-r--r--etc/profile-a-l/links-common.profile2
-rw-r--r--etc/profile-a-l/lollypop.profile2
-rw-r--r--etc/profile-a-l/lyx.profile2
-rw-r--r--etc/profile-m-z/Viber.profile2
-rw-r--r--etc/profile-m-z/magicor.profile2
-rw-r--r--etc/profile-m-z/man.profile2
-rw-r--r--etc/profile-m-z/masterpdfeditor.profile2
-rw-r--r--etc/profile-m-z/mate-calc.profile2
-rw-r--r--etc/profile-m-z/mate-color-select.profile2
-rw-r--r--etc/profile-m-z/mate-dictionary.profile2
-rw-r--r--etc/profile-m-z/mcabber.profile2
-rw-r--r--etc/profile-m-z/mdr.profile2
-rw-r--r--etc/profile-m-z/mediainfo.profile2
-rw-r--r--etc/profile-m-z/menulibre.profile2
-rw-r--r--etc/profile-m-z/mindless.profile2
-rw-r--r--etc/profile-m-z/mirrormagic.profile2
-rw-r--r--etc/profile-m-z/mocp.profile2
-rw-r--r--etc/profile-m-z/mp3splt-gtk.profile2
-rw-r--r--etc/profile-m-z/mp3splt.profile2
-rw-r--r--etc/profile-m-z/mpDris2.profile2
-rw-r--r--etc/profile-m-z/mpv.profile2
-rw-r--r--etc/profile-m-z/mrrescue.profile2
-rw-r--r--etc/profile-m-z/ms-office.profile2
-rw-r--r--etc/profile-m-z/mupdf-x11-curl.profile2
-rw-r--r--etc/profile-m-z/musixmatch.profile2
-rw-r--r--etc/profile-m-z/mutt.profile2
-rw-r--r--etc/profile-m-z/mypaint.profile2
-rw-r--r--etc/profile-m-z/nano.profile2
-rw-r--r--etc/profile-m-z/neomutt.profile2
-rw-r--r--etc/profile-m-z/netactview.profile2
-rw-r--r--etc/profile-m-z/newsboat.profile2
-rw-r--r--etc/profile-m-z/newsflash.profile2
-rw-r--r--etc/profile-m-z/nomacs.profile2
-rw-r--r--etc/profile-m-z/noprofile.profile28
-rw-r--r--etc/profile-m-z/notify-send.profile2
-rw-r--r--etc/profile-m-z/nuclear.profile2
-rw-r--r--etc/profile-m-z/nyx.profile2
-rw-r--r--etc/profile-m-z/odt2txt.profile2
-rw-r--r--etc/profile-m-z/onboard.profile2
-rw-r--r--etc/profile-m-z/openarena.profile2
-rw-r--r--etc/profile-m-z/openstego.profile58
-rw-r--r--etc/profile-m-z/pandoc.profile2
-rw-r--r--etc/profile-m-z/parole.profile2
-rw-r--r--etc/profile-m-z/pavucontrol.profile2
-rw-r--r--etc/profile-m-z/pdfchain.profile2
-rw-r--r--etc/profile-m-z/pdftotext.profile2
-rw-r--r--etc/profile-m-z/peek.profile2
-rw-r--r--etc/profile-m-z/photoflare.profile2
-rw-r--r--etc/profile-m-z/pingus.profile2
-rw-r--r--etc/profile-m-z/pkglog.profile2
-rw-r--r--etc/profile-m-z/plv.profile2
-rw-r--r--etc/profile-m-z/pngquant.profile2
-rw-r--r--etc/profile-m-z/pragha.profile2
-rw-r--r--etc/profile-m-z/profanity.profile2
-rw-r--r--etc/profile-m-z/qgis.profile2
-rw-r--r--etc/profile-m-z/qnapi.profile2
-rw-r--r--etc/profile-m-z/qrencode.profile2
-rw-r--r--etc/profile-m-z/regextester.profile2
-rw-r--r--etc/profile-m-z/rsync-download_only.profile2
-rw-r--r--etc/profile-m-z/scorchwentbonkers.profile2
-rw-r--r--etc/profile-m-z/seahorse-adventures.profile2
-rw-r--r--etc/profile-m-z/seahorse-tool.profile2
-rw-r--r--etc/profile-m-z/seahorse.profile2
-rw-r--r--etc/profile-m-z/shotwell.profile2
-rw-r--r--etc/profile-m-z/softmaker-common.profile2
-rw-r--r--etc/profile-m-z/sqlitebrowser.profile2
-rw-r--r--etc/profile-m-z/strawberry.profile2
-rw-r--r--etc/profile-m-z/subdownloader.profile2
-rw-r--r--etc/profile-m-z/supertux2.profile2
-rw-r--r--etc/profile-m-z/supertuxkart.profile2
-rw-r--r--etc/profile-m-z/surf.profile2
-rw-r--r--etc/profile-m-z/tar.profile2
-rw-r--r--etc/profile-m-z/teams-for-linux.profile2
-rw-r--r--etc/profile-m-z/telnet.profile54
-rw-r--r--etc/profile-m-z/tilp.profile2
-rw-r--r--etc/profile-m-z/tin.profile2
-rw-r--r--etc/profile-m-z/tor.profile2
-rw-r--r--etc/profile-m-z/transgui.profile2
-rw-r--r--etc/profile-m-z/transmission-cli.profile2
-rw-r--r--etc/profile-m-z/transmission-daemon.profile2
-rw-r--r--etc/profile-m-z/transmission-remote-gtk.profile2
-rw-r--r--etc/profile-m-z/transmission-remote.profile2
-rw-r--r--etc/profile-m-z/transmission-show.profile2
-rw-r--r--etc/profile-m-z/trojita.profile2
-rw-r--r--etc/profile-m-z/twitch.profile2
-rw-r--r--etc/profile-m-z/unf.profile2
-rw-r--r--etc/profile-m-z/unrar.profile2
-rw-r--r--etc/profile-m-z/unzip.profile2
-rw-r--r--etc/profile-m-z/uudeview.profile2
-rw-r--r--etc/profile-m-z/viewnior.profile2
-rw-r--r--etc/profile-m-z/virtualbox.profile2
-rw-r--r--etc/profile-m-z/vmware-view.profile1
-rw-r--r--etc/profile-m-z/vmware.profile3
-rw-r--r--etc/profile-m-z/w3m.profile2
-rw-r--r--etc/profile-m-z/warmux.profile2
-rw-r--r--etc/profile-m-z/whalebird.profile2
-rw-r--r--etc/profile-m-z/whois.profile2
-rw-r--r--etc/profile-m-z/wire-desktop.profile2
-rw-r--r--etc/profile-m-z/wordwarvi.profile2
-rw-r--r--etc/profile-m-z/xbill.profile2
-rw-r--r--etc/profile-m-z/xfce4-mixer.profile2
-rw-r--r--etc/profile-m-z/xfce4-screenshooter.profile2
-rw-r--r--etc/profile-m-z/xiphos.profile2
-rw-r--r--etc/profile-m-z/xlinks.profile2
-rw-r--r--etc/profile-m-z/xlinks22
-rw-r--r--etc/profile-m-z/xmr-stak.profile2
-rw-r--r--etc/profile-m-z/xournal.profile2
-rw-r--r--etc/profile-m-z/yelp.profile2
-rw-r--r--etc/profile-m-z/youtube-viewers-common.profile2
-rw-r--r--etc/profile-m-z/youtube.profile2
-rw-r--r--etc/profile-m-z/youtubemusic-nativefier.profile2
-rw-r--r--etc/profile-m-z/yt-dlp.profile4
-rw-r--r--etc/profile-m-z/ytmdesktop.profile2
-rw-r--r--etc/profile-m-z/zulip.profile2
-rwxr-xr-xgcov.sh6
-rwxr-xr-xlinecnt.sh4
-rwxr-xr-xmkasc.sh12
-rwxr-xr-xmkdeb.sh.in38
-rwxr-xr-xmkman.sh10
-rwxr-xr-xmkuid.sh4
-rw-r--r--src/fids/main.c19
-rw-r--r--src/firecfg/firecfg.config33
-rw-r--r--src/firecfg/main.c8
-rw-r--r--src/firejail/appimage.c6
-rw-r--r--src/firejail/fs.c43
-rw-r--r--src/firejail/fs_bin.c7
-rw-r--r--src/firejail/fs_home.c9
-rw-r--r--src/firejail/main.c12
-rw-r--r--src/firejail/run_symlink.c2
-rw-r--r--src/firejail/seccomp.c6
-rw-r--r--src/man/firecfg.txt2
249 files changed, 819 insertions, 526 deletions
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 000000000..6b329f917
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
/etc/inc/*.inc linguist-language=text
diff --git a/.github/workflows/profile-checks.yml b/.github/workflows/profile-checks.yml
new file mode 100644
index 000000000..951a8b8cf
--- /dev/null
+++ b/.github/workflows/profile-checks.yml
@@ -0,0 +1,31 @@
1name: Profile Checks
2
3on:
4 push:
5 branches: [ master ]
6 paths:
7 - 'etc/**'
8 - 'ci/check/profiles/**'
9 - 'src/firecfg/firecfg.config'
10 - 'contrib/sort.py'
11 pull_request:
12 branches: [ master ]
13 paths:
14 - 'etc/**'
15 - 'ci/check/profiles/**'
16 - 'src/firecfg/firecfg.config'
17 - 'contrib/sort.py'
18
19jobs:
20 profile-checks:
21 runs-on: ubuntu-20.04
22 steps:
23 - uses: actions/checkout@v2
24 - name: sort.py
25 run: ./ci/check/profiles/sort.py etc/inc/*.inc etc/{profile-a-l,profile-m-z}/*.profile
26 - name: private-etc-always-required.sh
27 run: ./ci/check/profiles/private-etc-always-required.sh etc/inc/*.inc etc/{profile-a-l,profile-m-z}/*.profile
28 - name: sort-disable-programs.sh
29 run: ./ci/check/profiles/sort-disable-programs.sh etc/inc/disable-programs.inc
30 - name: sort-firecfg.config.sh
31 run: ./ci/check/profiles/sort-firecfg.config.sh src/firecfg/firecfg.config
diff --git a/.github/workflows/sort.yml b/.github/workflows/sort.yml
deleted file mode 100644
index cfa40d2d2..000000000
--- a/.github/workflows/sort.yml
+++ /dev/null
@@ -1,21 +0,0 @@
1name: sort.py
2
3on:
4 push:
5 branches: [ master ]
6 paths:
7 - 'etc/**'
8 - 'contrib/sort.py'
9 pull_request:
10 branches: [ master ]
11 paths:
12 - 'etc/**'
13 - 'contrib/sort.py'
14
15jobs:
16 profile-sort:
17 runs-on: ubuntu-20.04
18 steps:
19 - uses: actions/checkout@v2
20 - name: check profiles
21 run: ./contrib/sort.py etc/*/{*.inc,*.profile}
diff --git a/Makefile.in b/Makefile.in
index 11193122d..ddc63c1af 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -116,7 +116,7 @@ endif
116 install -m 0755 src/jailcheck/jailcheck $(DESTDIR)$(bindir) 116 install -m 0755 src/jailcheck/jailcheck $(DESTDIR)$(bindir)
117 # libraries and plugins 117 # libraries and plugins
118 install -m 0755 -d $(DESTDIR)$(libdir)/firejail 118 install -m 0755 -d $(DESTDIR)$(libdir)/firejail
119 install -m 0644 -t $(DESTDIR)$(libdir)/firejail $(MYLIBS) $(SECCOMP_FILTERS) src/firecfg/firecfg.config 119 install -m 0644 -t $(DESTDIR)$(libdir)/firejail $(MYLIBS) $(SECCOMP_FILTERS)
120 install -m 0755 -t $(DESTDIR)$(libdir)/firejail $(SBOX_APPS) 120 install -m 0755 -t $(DESTDIR)$(libdir)/firejail $(SBOX_APPS)
121 # plugins w/o read permission (non-dumpable) 121 # plugins w/o read permission (non-dumpable)
122 install -m 0711 -t $(DESTDIR)$(libdir)/firejail $(SBOX_APPS_NON_DUMPABLE) 122 install -m 0711 -t $(DESTDIR)$(libdir)/firejail $(SBOX_APPS_NON_DUMPABLE)
@@ -135,6 +135,7 @@ endif
135 install -m 0644 -t $(DESTDIR)$(DOCDIR) COPYING README RELNOTES etc/templates/* 135 install -m 0644 -t $(DESTDIR)$(DOCDIR) COPYING README RELNOTES etc/templates/*
136 # profiles and settings 136 # profiles and settings
137 install -m 0755 -d $(DESTDIR)$(sysconfdir)/firejail 137 install -m 0755 -d $(DESTDIR)$(sysconfdir)/firejail
138 install -m 0644 -t $(DESTDIR)$(sysconfdir)/firejail src/firecfg/firecfg.config
138 install -m 0644 -t $(DESTDIR)$(sysconfdir)/firejail etc/profile-a-l/*.profile etc/profile-m-z/*.profile etc/inc/*.inc etc/net/*.net etc/firejail.config etc/ids.config 139 install -m 0644 -t $(DESTDIR)$(sysconfdir)/firejail etc/profile-a-l/*.profile etc/profile-m-z/*.profile etc/inc/*.inc etc/net/*.net etc/firejail.config etc/ids.config
139 sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;" 140 sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
140ifeq ($(BUSYBOX_WORKAROUND),yes) 141ifeq ($(BUSYBOX_WORKAROUND),yes)
diff --git a/README b/README
index 6a260a330..c6db6b6a5 100644
--- a/README
+++ b/README
@@ -467,6 +467,8 @@ hhzek0014 (https://github.com/hhzek0014)
467 - updated bibletime.profile 467 - updated bibletime.profile
468hlein (https://github.com/hlein) 468hlein (https://github.com/hlein)
469 - strip out \r's from jail prober 469 - strip out \r's from jail prober
470 - make env/arg sanity check failure messages more useful
471 - relocate firecfg.config to /etc/firejail/
470Holger Heinz (https://github.com/hheinz) 472Holger Heinz (https://github.com/hheinz)
471 - manpage work 473 - manpage work
472Haowei Yu (https://github.com/sfc-gh-hyu) 474Haowei Yu (https://github.com/sfc-gh-hyu)
diff --git a/README.md b/README.md
index cf9d9563e..2bd3c9fb4 100644
--- a/README.md
+++ b/README.md
@@ -96,7 +96,7 @@ https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-loca
96 96
97Try installing Firejail from your system packages first. Firejail is included in Alpine, ALT Linux, Arch, Artix, Chakra, Debian, Deepin, Devuan, Fedora, Gentoo, Manjaro, Mint, NixOS, Parabola, Parrot, PCLinuxOS, ROSA, Solus, Slackware/SlackBuilds, Trisquel, Ubuntu, Void and possibly others. 97Try installing Firejail from your system packages first. Firejail is included in Alpine, ALT Linux, Arch, Artix, Chakra, Debian, Deepin, Devuan, Fedora, Gentoo, Manjaro, Mint, NixOS, Parabola, Parrot, PCLinuxOS, ROSA, Solus, Slackware/SlackBuilds, Trisquel, Ubuntu, Void and possibly others.
98 98
99The firejail 0.9.52-LTS version is deprecated. On Ubuntu 18.04 LTS users are advised to use the [PPA](https://launchpad.net/~deki/+archive/ubuntu/firejail). On Debian buster we recommend to use the [backports](https://packages.debian.org/buster-backports/firejail) package. 99The firejail 0.9.52-LTS version is deprecated. On Ubuntu 18.04 LTS users are advised to use the [PPA](https://launchpad.net/~deki/+archive/ubuntu/firejail). On Debian stable (bullseye) we recommend to use the [backports](https://packages.debian.org/bullseye-backports/firejail) package.
100 100
101You can also install one of the [released packages](http://sourceforge.net/projects/firejail/files/firejail), or clone Firejail’s source code from our Git repository and compile manually: 101You can also install one of the [released packages](http://sourceforge.net/projects/firejail/files/firejail), or clone Firejail’s source code from our Git repository and compile manually:
102 102
@@ -150,7 +150,7 @@ PulseAudio changes.
150Start your programs the way you are used to: desktop manager menus, file manager, desktop launchers. 150Start your programs the way you are used to: desktop manager menus, file manager, desktop launchers.
151The integration applies to any program supported by default by Firejail. There are about 250 default applications 151The integration applies to any program supported by default by Firejail. There are about 250 default applications
152in current Firejail version, and the number goes up with every new release. 152in current Firejail version, and the number goes up with every new release.
153We keep the application list in [/usr/lib/firejail/firecfg.config](https://github.com/netblue30/firejail/blob/master/src/firecfg/firecfg.config) file. 153We keep the application list in [/etc/firejail/firecfg.config](https://github.com/netblue30/firejail/blob/master/src/firecfg/firecfg.config) file.
154 154
155## Security profiles 155## Security profiles
156 156
@@ -248,4 +248,4 @@ $ ./profstats *.profile
248### New profiles: 248### New profiles:
249 249
250clion-eap, lifeograph, io.github.lainsce.Notejot, rednotebook, zim, microsoft-edge-beta, ncdu2, gallery-dl, yt-dlp, goldendict, bundle, 250clion-eap, lifeograph, io.github.lainsce.Notejot, rednotebook, zim, microsoft-edge-beta, ncdu2, gallery-dl, yt-dlp, goldendict, bundle,
251cmake, make, meson, pip, codium 251cmake, make, meson, pip, codium, telnet, ftp
diff --git a/RELNOTES b/RELNOTES
index 3f92c89c7..9ff0bf5bb 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -10,7 +10,7 @@ firejail (0.9.67) baseline; urgency=low
10 * new profiles: microsoft-edge-beta, clion-eap, lifeograph, zim 10 * new profiles: microsoft-edge-beta, clion-eap, lifeograph, zim
11 * new profiles: io.github.lainsce.Notejot, rednotebook, gallery-dl 11 * new profiles: io.github.lainsce.Notejot, rednotebook, gallery-dl
12 * new profiles: yt-dlp, goldendict, goldendict, bundle, cmake 12 * new profiles: yt-dlp, goldendict, goldendict, bundle, cmake
13 * new profiles: make, meson, pip, codium 13 * new profiles: make, meson, pip, codium, telnet, ftp
14 -- netblue30 <netblue30@yahoo.com> Thu, 29 Jul 2021 09:00:00 -0500 14 -- netblue30 <netblue30@yahoo.com> Thu, 29 Jul 2021 09:00:00 -0500
15 15
16firejail (0.9.66) baseline; urgency=low 16firejail (0.9.66) baseline; urgency=low
diff --git a/ci/check/profiles/private-etc-always-required.sh b/ci/check/profiles/private-etc-always-required.sh
new file mode 100755
index 000000000..892b15aa4
--- /dev/null
+++ b/ci/check/profiles/private-etc-always-required.sh
@@ -0,0 +1,15 @@
1#!/bin/bash
2
3ALWAYS_REQUIRED=(alternatives ld.so.cache ld.so.preload)
4
5error=0
6while IFS=: read -r profile private_etc; do
7 for required in "${ALWAYS_REQUIRED[@]}"; do
8 if grep -q -v -E "( |,)$required(,|$)" <<<"$private_etc"; then
9 printf '%s misses %s\n' "$profile" "$required" >&2
10 error=1
11 fi
12 done
13done < <(grep "^private-etc " "$@")
14
15exit "$error"
diff --git a/ci/check/profiles/sort-disable-programs.sh b/ci/check/profiles/sort-disable-programs.sh
new file mode 100755
index 000000000..d81ee75d7
--- /dev/null
+++ b/ci/check/profiles/sort-disable-programs.sh
@@ -0,0 +1,2 @@
1#!/bin/sh
2tail -n +5 "$1" | LC_ALL=C sort -c -u
diff --git a/ci/check/profiles/sort-firecfg.config.sh b/ci/check/profiles/sort-firecfg.config.sh
new file mode 100755
index 000000000..17a595350
--- /dev/null
+++ b/ci/check/profiles/sort-firecfg.config.sh
@@ -0,0 +1,2 @@
1#!/bin/sh
2tail -n +4 "$1" | sed 's/^# /#/' | LC_ALL=C sort -c -d
diff --git a/ci/check/profiles/sort.py b/ci/check/profiles/sort.py
new file mode 120000
index 000000000..e1f3f5f16
--- /dev/null
+++ b/ci/check/profiles/sort.py
@@ -0,0 +1 @@
../../../contrib/sort.py \ No newline at end of file
diff --git a/etc/apparmor/firejail-base b/etc/apparmor/firejail-base
index 41e4ac2bf..6e286d4af 100644
--- a/etc/apparmor/firejail-base
+++ b/etc/apparmor/firejail-base
@@ -1,26 +1,27 @@
1######################################### 1#########################################
2# Firejail base abstraction drop-in 2# Firejail base abstraction drop-in
3######################################### 3#
4
5# Adds basic Firejail support to AppArmor profiles. 4# Adds basic Firejail support to AppArmor profiles.
6# Please note: Firejail's nonewprivs and seccomp options 5# Please note: Firejail's nonewprivs and seccomp options
7# are not compatible with AppArmor profile transitions. 6# are not compatible with AppArmor profile transitions.
7# Also there is no support for Firejail chroot options.
8#########################################
8 9
9# Discovery of process names 10# Discovery of process names
10owner /{,run/firejail/mnt/oroot/}proc/@{pid}/comm r, 11owner /proc/@{pid}/comm r,
11 12
12########## 13##########
13# Following paths only exist inside a Firejail sandbox 14# Following paths only exist inside a Firejail sandbox
14########## 15##########
15 16
16# Library preloading 17# Library preloading
17/{,run/firejail/mnt/oroot/}{,var/}run/firejail/lib/*.so mr, 18/{,var/}run/firejail/lib/*.so mr,
18 19
19# Supporting seccomp 20# Supporting seccomp
20owner /{,run/firejail/mnt/oroot/}{,var/}run/firejail/mnt/seccomp/seccomp.postexec r, 21owner /{,var/}run/firejail/mnt/seccomp/seccomp.postexec r,
21 22
22# Supporting trace 23# Supporting trace
23owner /{,run/firejail/mnt/oroot/}{,var/}run/firejail/mnt/trace w, 24owner /{,var/}run/firejail/mnt/trace w,
24 25
25# Supporting tracelog 26# Supporting tracelog
26/{,run/firejail/mnt/oroot/}{,var/}run/firejail/mnt/fslogger r, 27/{,var/}run/firejail/mnt/fslogger r,
diff --git a/etc/ids.config b/etc/ids.config
index 09b0ae912..ff55416ca 100644
--- a/etc/ids.config
+++ b/etc/ids.config
@@ -37,6 +37,7 @@ include ids.config.local
37 37
38### shells local ### 38### shells local ###
39# bash 39# bash
40${HOME}/.bash_aliases
40${HOME}/.bash_login 41${HOME}/.bash_login
41${HOME}/.bash_logout 42${HOME}/.bash_logout
42${HOME}/.bash_profile 43${HOME}/.bash_profile
@@ -99,10 +100,24 @@ ${HOME}/.xsessionrc
99### window/desktop manager ### 100### window/desktop manager ###
100${HOME}/Desktop/*.desktop 101${HOME}/Desktop/*.desktop
101${HOME}/.config/autostart 102${HOME}/.config/autostart
103${HOME}/.config/autostart-scripts
102${HOME}/.config/lxsession/LXDE/autostart 104${HOME}/.config/lxsession/LXDE/autostart
105${HOME}/.config/openbox/autostart
106${HOME}/.config/openbox/environment
107${HOME}/.config/plasma-workspace/env
108${HOME}/.config/plasma-workspace/shutdown
103${HOME}/.gnomerc 109${HOME}/.gnomerc
104${HOME}/.gtkrc 110${HOME}/.gtkrc
111${HOME}/.kde/Autostart
112${HOME}/.kde/env
113${HOME}/.kde/share/autostart
114${HOME}/.kde/shutdown
115${HOME}/.kde4/Autostart
116${HOME}/.kde4/env
117${HOME}/.kde4/share/autostart
118${HOME}/.kde4/shutdown
105${HOME}/.kderc 119${HOME}/.kderc
120${HOME}/.local/share/autostart
106 121
107### security ### 122### security ###
108/etc/aide 123/etc/aide
@@ -123,6 +138,7 @@ ${HOME}/.kderc
123/etc/tripwire 138/etc/tripwire
124${HOME}/.config/firejail 139${HOME}/.config/firejail
125${HOME}/.gnupg 140${HOME}/.gnupg
141${HOME}/.pam_environment
126 142
127### network security ### 143### network security ###
128/etc/ca-certificates* 144/etc/ca-certificates*
diff --git a/etc/inc/allow-ssh.inc b/etc/inc/allow-ssh.inc
index 67c78a483..5d41e6607 100644
--- a/etc/inc/allow-ssh.inc
+++ b/etc/inc/allow-ssh.inc
@@ -5,4 +5,11 @@ include allow-ssh.local
5noblacklist ${HOME}/.ssh 5noblacklist ${HOME}/.ssh
6noblacklist /etc/ssh 6noblacklist /etc/ssh
7noblacklist /etc/ssh/ssh_config 7noblacklist /etc/ssh/ssh_config
8noblacklist ${PATH}/ssh
8noblacklist /tmp/ssh-* 9noblacklist /tmp/ssh-*
10# Arch Linux and derivatives
11noblacklist /usr/lib/ssh
12# Debian/Ubuntu and derivatives
13noblacklist /usr/lib/openssh
14# Fedora and derivatives
15noblacklist /usr/libexec/openssh
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc
index ae84ee38a..04f4bf2d6 100644
--- a/etc/inc/disable-common.inc
+++ b/etc/inc/disable-common.inc
@@ -458,7 +458,7 @@ blacklist /sbin
458blacklist /usr/local/sbin 458blacklist /usr/local/sbin
459blacklist /usr/sbin 459blacklist /usr/sbin
460 460
461# system management 461# system management and various SUID executables
462blacklist ${PATH}/at 462blacklist ${PATH}/at
463blacklist ${PATH}/busybox 463blacklist ${PATH}/busybox
464blacklist ${PATH}/chage 464blacklist ${PATH}/chage
@@ -493,6 +493,25 @@ blacklist ${PATH}/umount
493blacklist ${PATH}/unix_chkpwd 493blacklist ${PATH}/unix_chkpwd
494blacklist ${PATH}/xev 494blacklist ${PATH}/xev
495blacklist ${PATH}/xinput 495blacklist ${PATH}/xinput
496# from 0.9.67
497blacklist /usr/lib/openssh
498blacklist /usr/lib/ssh
499blacklist /usr/libexec/openssh
500blacklist ${PATH}/passwd
501blacklist /usr/lib/xorg/Xorg.wrap
502blacklist /usr/lib/policykit-1/polkit-agent-helper-1
503blacklist /usr/lib/dbus-1.0/dbus-daemon-launch-helper
504blacklist /usr/lib/eject/dmcrypt-get-device
505blacklist /usr/lib/chromium/chrome-sandbox
506blacklist /usr/lib/vmware
507blacklist ${PATH}/suexec
508blacklist /usr/lib/squid/basic_pam_auth
509blacklist ${PATH}/slock
510blacklist ${PATH}/physlock
511blacklist ${PATH}/schroot
512blacklist ${PATH}/wshowkeys
513blacklist ${PATH}/pmount
514blacklist ${PATH}/pumount
496 515
497# other SUID binaries 516# other SUID binaries
498blacklist /usr/lib/virtualbox 517blacklist /usr/lib/virtualbox
@@ -563,8 +582,7 @@ blacklist ${HOME}/sent
563# kernel configuration 582# kernel configuration
564blacklist /proc/config.gz 583blacklist /proc/config.gz
565 584
566# prevent DNS malware attempting to communicate with the server 585# prevent DNS malware attempting to communicate with the server using regular DNS tools
567# using regular DNS tools
568blacklist ${PATH}/dig 586blacklist ${PATH}/dig
569blacklist ${PATH}/dlint 587blacklist ${PATH}/dlint
570blacklist ${PATH}/dns2tcp 588blacklist ${PATH}/dns2tcp
@@ -582,8 +600,14 @@ blacklist ${PATH}/nslookup
582blacklist ${PATH}/resolvectl 600blacklist ${PATH}/resolvectl
583blacklist ${PATH}/unbound-host 601blacklist ${PATH}/unbound-host
584 602
603# prevent an intruder to guess passwords using regular network tools
604blacklist ${PATH}/ftp
605blacklist ${PATH}/ssh
606blacklist ${PATH}/telnet
607
585# rest of ${RUNUSER} 608# rest of ${RUNUSER}
586blacklist ${RUNUSER}/*.lock 609blacklist ${RUNUSER}/*.lock
587blacklist ${RUNUSER}/inaccessible 610blacklist ${RUNUSER}/inaccessible
588blacklist ${RUNUSER}/pk-debconf-socket 611blacklist ${RUNUSER}/pk-debconf-socket
589blacklist ${RUNUSER}/update-notifier.pid 612blacklist ${RUNUSER}/update-notifier.pid
613
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index 6734e220a..254d05e8e 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -51,10 +51,182 @@ blacklist ${HOME}/.blobby
51blacklist ${HOME}/.bogofilter 51blacklist ${HOME}/.bogofilter
52blacklist ${HOME}/.bundle 52blacklist ${HOME}/.bundle
53blacklist ${HOME}/.bzf 53blacklist ${HOME}/.bzf
54blacklist ${HOME}/.cache/0ad
55blacklist ${HOME}/.cache/8pecxstudios
56blacklist ${HOME}/.cache/Authenticator
57blacklist ${HOME}/.cache/BraveSoftware
58blacklist ${HOME}/.cache/Clementine
59blacklist ${HOME}/.cache/ENCOM/Spectral
60blacklist ${HOME}/.cache/Enox
61blacklist ${HOME}/.cache/Enpass
62blacklist ${HOME}/.cache/Ferdi
63blacklist ${HOME}/.cache/Flavio Tordini
64blacklist ${HOME}/.cache/Franz
65blacklist ${HOME}/.cache/GoldenDict
66blacklist ${HOME}/.cache/INRIA
67blacklist ${HOME}/.cache/INRIA/Natron
68blacklist ${HOME}/.cache/JetBrains/CLion*
69blacklist ${HOME}/.cache/KDE/neochat
70blacklist ${HOME}/.cache/Mendeley Ltd.
71blacklist ${HOME}/.cache/MusicBrainz
72blacklist ${HOME}/.cache/NewsFlashGTK
73blacklist ${HOME}/.cache/Otter
74blacklist ${HOME}/.cache/PawelStolowski
75blacklist ${HOME}/.cache/Psi
76blacklist ${HOME}/.cache/QuiteRss
77blacklist ${HOME}/.cache/Quotient/quaternion
78blacklist ${HOME}/.cache/Shortwave
79blacklist ${HOME}/.cache/Tox
80blacklist ${HOME}/.cache/Zeal
81blacklist ${HOME}/.cache/agenda
82blacklist ${HOME}/.cache/akonadi*
83blacklist ${HOME}/.cache/atril
84blacklist ${HOME}/.cache/attic
85blacklist ${HOME}/.cache/babl
86blacklist ${HOME}/.cache/bnox
87blacklist ${HOME}/.cache/borg
88blacklist ${HOME}/.cache/calibre
89blacklist ${HOME}/.cache/cantata
90blacklist ${HOME}/.cache/champlain
91blacklist ${HOME}/.cache/chromium
92blacklist ${HOME}/.cache/chromium-dev
93blacklist ${HOME}/.cache/cliqz
94blacklist ${HOME}/.cache/com.github.johnfactotum.Foliate
95blacklist ${HOME}/.cache/darktable
96blacklist ${HOME}/.cache/deja-dup
97blacklist ${HOME}/.cache/discover
98blacklist ${HOME}/.cache/dnox
99blacklist ${HOME}/.cache/dolphin
100blacklist ${HOME}/.cache/dolphin-emu
101blacklist ${HOME}/.cache/ephemeral
102blacklist ${HOME}/.cache/epiphany
103blacklist ${HOME}/.cache/evolution
104blacklist ${HOME}/.cache/falkon
105blacklist ${HOME}/.cache/feedreader
106blacklist ${HOME}/.cache/firedragon
107blacklist ${HOME}/.cache/flaska.net/trojita
108blacklist ${HOME}/.cache/folks
109blacklist ${HOME}/.cache/font-manager
110blacklist ${HOME}/.cache/fossamail
111blacklist ${HOME}/.cache/fractal
112blacklist ${HOME}/.cache/freecol
113blacklist ${HOME}/.cache/gajim
114blacklist ${HOME}/.cache/geary
115blacklist ${HOME}/.cache/geeqie
116blacklist ${HOME}/.cache/gegl-0.4
117blacklist ${HOME}/.cache/gfeeds
118blacklist ${HOME}/.cache/gimp
119blacklist ${HOME}/.cache/gnome-boxes
120blacklist ${HOME}/.cache/gnome-builder
121blacklist ${HOME}/.cache/gnome-control-center
122blacklist ${HOME}/.cache/gnome-recipes
123blacklist ${HOME}/.cache/gnome-screenshot
124blacklist ${HOME}/.cache/gnome-software
125blacklist ${HOME}/.cache/gnome-twitch
126blacklist ${HOME}/.cache/godot
127blacklist ${HOME}/.cache/google-chrome
128blacklist ${HOME}/.cache/google-chrome-beta
129blacklist ${HOME}/.cache/google-chrome-unstable
130blacklist ${HOME}/.cache/gradio
131blacklist ${HOME}/.cache/gummi
132blacklist ${HOME}/.cache/icedove
133blacklist ${HOME}/.cache/inkscape
134blacklist ${HOME}/.cache/inox
135blacklist ${HOME}/.cache/io.github.lainsce.Notejot
136blacklist ${HOME}/.cache/iridium
137blacklist ${HOME}/.cache/kcmshell5
138blacklist ${HOME}/.cache/kdenlive
139blacklist ${HOME}/.cache/keepassxc
140blacklist ${HOME}/.cache/kfind
141blacklist ${HOME}/.cache/kinfocenter
142blacklist ${HOME}/.cache/kmail2
143blacklist ${HOME}/.cache/krunner
144blacklist ${HOME}/.cache/krunnerbookmarkrunnerfirefoxdbfile.sqlite*
145blacklist ${HOME}/.cache/kscreenlocker_greet
146blacklist ${HOME}/.cache/ksmserver-logout-greeter
147blacklist ${HOME}/.cache/ksplashqml
148blacklist ${HOME}/.cache/kube
149blacklist ${HOME}/.cache/kwin
150blacklist ${HOME}/.cache/libgweather
151blacklist ${HOME}/.cache/librewolf
152blacklist ${HOME}/.cache/liferea
153blacklist ${HOME}/.cache/lutris
154blacklist ${HOME}/.cache/marker
155blacklist ${HOME}/.cache/matrix-mirage
156blacklist ${HOME}/.cache/microsoft-edge-beta
157blacklist ${HOME}/.cache/microsoft-edge-dev
158blacklist ${HOME}/.cache/midori
159blacklist ${HOME}/.cache/minetest
160blacklist ${HOME}/.cache/mirage
161blacklist ${HOME}/.cache/moonchild productions/basilisk
162blacklist ${HOME}/.cache/moonchild productions/pale moon
163blacklist ${HOME}/.cache/mozilla
164blacklist ${HOME}/.cache/ms-excel-online
165blacklist ${HOME}/.cache/ms-office-online
166blacklist ${HOME}/.cache/ms-onenote-online
167blacklist ${HOME}/.cache/ms-outlook-online
168blacklist ${HOME}/.cache/ms-powerpoint-online
169blacklist ${HOME}/.cache/ms-skype-online
170blacklist ${HOME}/.cache/ms-word-online
171blacklist ${HOME}/.cache/mutt
172blacklist ${HOME}/.cache/mypaint
173blacklist ${HOME}/.cache/netsurf
174blacklist ${HOME}/.cache/nheko
175blacklist ${HOME}/.cache/okular
176blacklist ${HOME}/.cache/opera
177blacklist ${HOME}/.cache/opera-beta
178blacklist ${HOME}/.cache/org.gabmus.gfeeds
179blacklist ${HOME}/.cache/org.gnome.Books
180blacklist ${HOME}/.cache/org.gnome.Maps
181blacklist ${HOME}/.cache/pdfmod
182blacklist ${HOME}/.cache/peek
183blacklist ${HOME}/.cache/pip
184blacklist ${HOME}/.cache/pipe-viewer
185blacklist ${HOME}/.cache/plasmashell
186blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite*
187blacklist ${HOME}/.cache/psi
188blacklist ${HOME}/.cache/qBittorrent
189blacklist ${HOME}/.cache/quodlibet
190blacklist ${HOME}/.cache/qupzilla
191blacklist ${HOME}/.cache/qutebrowser
192blacklist ${HOME}/.cache/rednotebook
193blacklist ${HOME}/.cache/rhythmbox
194blacklist ${HOME}/.cache/shotwell
195blacklist ${HOME}/.cache/simple-scan
196blacklist ${HOME}/.cache/slimjet
197blacklist ${HOME}/.cache/smuxi
198blacklist ${HOME}/.cache/snox
199blacklist ${HOME}/.cache/spotify
200blacklist ${HOME}/.cache/straw-viewer
201blacklist ${HOME}/.cache/strawberry
202blacklist ${HOME}/.cache/supertuxkart
203blacklist ${HOME}/.cache/systemsettings
204blacklist ${HOME}/.cache/telepathy
205blacklist ${HOME}/.cache/thunderbird
206blacklist ${HOME}/.cache/torbrowser
207blacklist ${HOME}/.cache/transmission
208blacklist ${HOME}/.cache/ungoogled-chromium
209blacklist ${HOME}/.cache/vivaldi
210blacklist ${HOME}/.cache/vivaldi-snapshot
211blacklist ${HOME}/.cache/vlc
212blacklist ${HOME}/.cache/vmware
213blacklist ${HOME}/.cache/warsow-2.1
214blacklist ${HOME}/.cache/waterfox
215blacklist ${HOME}/.cache/wesnoth
216blacklist ${HOME}/.cache/winetricks
217blacklist ${HOME}/.cache/xmms2
218blacklist ${HOME}/.cache/xournalpp
219blacklist ${HOME}/.cache/xreader
220blacklist ${HOME}/.cache/yandex-browser
221blacklist ${HOME}/.cache/yandex-browser-beta
222blacklist ${HOME}/.cache/youtube-dl
223blacklist ${HOME}/.cache/youtube-viewer
224blacklist ${HOME}/.cache/yt-dlp
225blacklist ${HOME}/.cache/zim
54blacklist ${HOME}/.cargo 226blacklist ${HOME}/.cargo
55blacklist ${HOME}/.claws-mail 227blacklist ${HOME}/.claws-mail
56blacklist ${HOME}/.cliqz
57blacklist ${HOME}/.clion* 228blacklist ${HOME}/.clion*
229blacklist ${HOME}/.cliqz
58blacklist ${HOME}/.clonk 230blacklist ${HOME}/.clonk
59blacklist ${HOME}/.config/0ad 231blacklist ${HOME}/.config/0ad
60blacklist ${HOME}/.config/2048-qt 232blacklist ${HOME}/.config/2048-qt
@@ -93,8 +265,8 @@ blacklist ${HOME}/.config/Google Play Music Desktop Player
93blacklist ${HOME}/.config/Gpredict 265blacklist ${HOME}/.config/Gpredict
94blacklist ${HOME}/.config/INRIA 266blacklist ${HOME}/.config/INRIA
95blacklist ${HOME}/.config/InSilmaril 267blacklist ${HOME}/.config/InSilmaril
96blacklist ${HOME}/.config/Jitsi Meet
97blacklist ${HOME}/.config/JetBrains/CLion* 268blacklist ${HOME}/.config/JetBrains/CLion*
269blacklist ${HOME}/.config/Jitsi Meet
98blacklist ${HOME}/.config/KDE/neochat 270blacklist ${HOME}/.config/KDE/neochat
99blacklist ${HOME}/.config/KeePass 271blacklist ${HOME}/.config/KeePass
100blacklist ${HOME}/.config/KeePassXCrc 272blacklist ${HOME}/.config/KeePassXCrc
@@ -948,6 +1120,7 @@ blacklist ${HOME}/TeamSpeak3-Client-linux_x86
948blacklist ${HOME}/hyperrogue.ini 1120blacklist ${HOME}/hyperrogue.ini
949blacklist ${HOME}/i2p 1121blacklist ${HOME}/i2p
950blacklist ${HOME}/mps 1122blacklist ${HOME}/mps
1123blacklist ${HOME}/openstego.ini
951blacklist ${HOME}/wallet.dat 1124blacklist ${HOME}/wallet.dat
952blacklist ${HOME}/yt-dlp.conf 1125blacklist ${HOME}/yt-dlp.conf
953blacklist ${RUNUSER}/*firefox* 1126blacklist ${RUNUSER}/*firefox*
@@ -958,177 +1131,3 @@ blacklist /var/games/slashem
958blacklist /var/games/vulturesclaw 1131blacklist /var/games/vulturesclaw
959blacklist /var/games/vultureseye 1132blacklist /var/games/vultureseye
960blacklist /var/lib/games/Maelstrom-Scores 1133blacklist /var/lib/games/Maelstrom-Scores
961
962# ${HOME}/.cache directory
963blacklist ${HOME}/.cache/0ad
964blacklist ${HOME}/.cache/8pecxstudios
965blacklist ${HOME}/.cache/Authenticator
966blacklist ${HOME}/.cache/BraveSoftware
967blacklist ${HOME}/.cache/Clementine
968blacklist ${HOME}/.cache/ENCOM/Spectral
969blacklist ${HOME}/.cache/Enox
970blacklist ${HOME}/.cache/Enpass
971blacklist ${HOME}/.cache/Ferdi
972blacklist ${HOME}/.cache/Flavio Tordini
973blacklist ${HOME}/.cache/Franz
974blacklist ${HOME}/.cache/GoldenDict
975blacklist ${HOME}/.cache/INRIA
976blacklist ${HOME}/.cache/INRIA/Natron
977blacklist ${HOME}/.cache/KDE/neochat
978blacklist ${HOME}/.cache/Mendeley Ltd.
979blacklist ${HOME}/.cache/MusicBrainz
980blacklist ${HOME}/.cache/NewsFlashGTK
981blacklist ${HOME}/.cache/Otter
982blacklist ${HOME}/.cache/PawelStolowski
983blacklist ${HOME}/.cache/Psi
984blacklist ${HOME}/.cache/QuiteRss
985blacklist ${HOME}/.cache/Quotient/quaternion
986blacklist ${HOME}/.cache/Shortwave
987blacklist ${HOME}/.cache/Tox
988blacklist ${HOME}/.cache/Zeal
989blacklist ${HOME}/.cache/agenda
990blacklist ${HOME}/.cache/akonadi*
991blacklist ${HOME}/.cache/atril
992blacklist ${HOME}/.cache/attic
993blacklist ${HOME}/.cache/babl
994blacklist ${HOME}/.cache/bnox
995blacklist ${HOME}/.cache/borg
996blacklist ${HOME}/.cache/calibre
997blacklist ${HOME}/.cache/cantata
998blacklist ${HOME}/.cache/champlain
999blacklist ${HOME}/.cache/chromium
1000blacklist ${HOME}/.cache/chromium-dev
1001blacklist ${HOME}/.cache/cliqz
1002blacklist ${HOME}/.cache/com.github.johnfactotum.Foliate
1003blacklist ${HOME}/.cache/darktable
1004blacklist ${HOME}/.cache/deja-dup
1005blacklist ${HOME}/.cache/discover
1006blacklist ${HOME}/.cache/dnox
1007blacklist ${HOME}/.cache/dolphin
1008blacklist ${HOME}/.cache/dolphin-emu
1009blacklist ${HOME}/.cache/ephemeral
1010blacklist ${HOME}/.cache/epiphany
1011blacklist ${HOME}/.cache/evolution
1012blacklist ${HOME}/.cache/falkon
1013blacklist ${HOME}/.cache/feedreader
1014blacklist ${HOME}/.cache/firedragon
1015blacklist ${HOME}/.cache/flaska.net/trojita
1016blacklist ${HOME}/.cache/folks
1017blacklist ${HOME}/.cache/font-manager
1018blacklist ${HOME}/.cache/fossamail
1019blacklist ${HOME}/.cache/fractal
1020blacklist ${HOME}/.cache/freecol
1021blacklist ${HOME}/.cache/gajim
1022blacklist ${HOME}/.cache/geary
1023blacklist ${HOME}/.cache/geeqie
1024blacklist ${HOME}/.cache/gegl-0.4
1025blacklist ${HOME}/.cache/gfeeds
1026blacklist ${HOME}/.cache/gimp
1027blacklist ${HOME}/.cache/gnome-boxes
1028blacklist ${HOME}/.cache/gnome-builder
1029blacklist ${HOME}/.cache/gnome-control-center
1030blacklist ${HOME}/.cache/gnome-recipes
1031blacklist ${HOME}/.cache/gnome-screenshot
1032blacklist ${HOME}/.cache/gnome-software
1033blacklist ${HOME}/.cache/gnome-twitch
1034blacklist ${HOME}/.cache/godot
1035blacklist ${HOME}/.cache/google-chrome
1036blacklist ${HOME}/.cache/google-chrome-beta
1037blacklist ${HOME}/.cache/google-chrome-unstable
1038blacklist ${HOME}/.cache/gradio
1039blacklist ${HOME}/.cache/gummi
1040blacklist ${HOME}/.cache/icedove
1041blacklist ${HOME}/.cache/inkscape
1042blacklist ${HOME}/.cache/inox
1043blacklist ${HOME}/.cache/io.github.lainsce.Notejot
1044blacklist ${HOME}/.cache/iridium
1045blacklist ${HOME}/.cache/JetBrains/CLion*
1046blacklist ${HOME}/.cache/kcmshell5
1047blacklist ${HOME}/.cache/kdenlive
1048blacklist ${HOME}/.cache/keepassxc
1049blacklist ${HOME}/.cache/kfind
1050blacklist ${HOME}/.cache/kinfocenter
1051blacklist ${HOME}/.cache/kmail2
1052blacklist ${HOME}/.cache/krunner
1053blacklist ${HOME}/.cache/krunnerbookmarkrunnerfirefoxdbfile.sqlite*
1054blacklist ${HOME}/.cache/kscreenlocker_greet
1055blacklist ${HOME}/.cache/ksmserver-logout-greeter
1056blacklist ${HOME}/.cache/ksplashqml
1057blacklist ${HOME}/.cache/kube
1058blacklist ${HOME}/.cache/kwin
1059blacklist ${HOME}/.cache/libgweather
1060blacklist ${HOME}/.cache/librewolf
1061blacklist ${HOME}/.cache/liferea
1062blacklist ${HOME}/.cache/lutris
1063blacklist ${HOME}/.cache/marker
1064blacklist ${HOME}/.cache/matrix-mirage
1065blacklist ${HOME}/.cache/microsoft-edge-beta
1066blacklist ${HOME}/.cache/microsoft-edge-dev
1067blacklist ${HOME}/.cache/midori
1068blacklist ${HOME}/.cache/minetest
1069blacklist ${HOME}/.cache/mirage
1070blacklist ${HOME}/.cache/moonchild productions/basilisk
1071blacklist ${HOME}/.cache/moonchild productions/pale moon
1072blacklist ${HOME}/.cache/mozilla
1073blacklist ${HOME}/.cache/ms-excel-online
1074blacklist ${HOME}/.cache/ms-office-online
1075blacklist ${HOME}/.cache/ms-onenote-online
1076blacklist ${HOME}/.cache/ms-outlook-online
1077blacklist ${HOME}/.cache/ms-powerpoint-online
1078blacklist ${HOME}/.cache/ms-skype-online
1079blacklist ${HOME}/.cache/ms-word-online
1080blacklist ${HOME}/.cache/mutt
1081blacklist ${HOME}/.cache/mypaint
1082blacklist ${HOME}/.cache/netsurf
1083blacklist ${HOME}/.cache/nheko
1084blacklist ${HOME}/.cache/okular
1085blacklist ${HOME}/.cache/opera
1086blacklist ${HOME}/.cache/opera-beta
1087blacklist ${HOME}/.cache/org.gabmus.gfeeds
1088blacklist ${HOME}/.cache/org.gnome.Books
1089blacklist ${HOME}/.cache/org.gnome.Maps
1090blacklist ${HOME}/.cache/pdfmod
1091blacklist ${HOME}/.cache/peek
1092blacklist ${HOME}/.cache/pip
1093blacklist ${HOME}/.cache/pipe-viewer
1094blacklist ${HOME}/.cache/plasmashell
1095blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite*
1096blacklist ${HOME}/.cache/psi
1097blacklist ${HOME}/.cache/qBittorrent
1098blacklist ${HOME}/.cache/quodlibet
1099blacklist ${HOME}/.cache/qupzilla
1100blacklist ${HOME}/.cache/qutebrowser
1101blacklist ${HOME}/.cache/rednotebook
1102blacklist ${HOME}/.cache/rhythmbox
1103blacklist ${HOME}/.cache/shotwell
1104blacklist ${HOME}/.cache/simple-scan
1105blacklist ${HOME}/.cache/slimjet
1106blacklist ${HOME}/.cache/smuxi
1107blacklist ${HOME}/.cache/snox
1108blacklist ${HOME}/.cache/spotify
1109blacklist ${HOME}/.cache/straw-viewer
1110blacklist ${HOME}/.cache/strawberry
1111blacklist ${HOME}/.cache/supertuxkart
1112blacklist ${HOME}/.cache/systemsettings
1113blacklist ${HOME}/.cache/telepathy
1114blacklist ${HOME}/.cache/thunderbird
1115blacklist ${HOME}/.cache/torbrowser
1116blacklist ${HOME}/.cache/transmission
1117blacklist ${HOME}/.cache/ungoogled-chromium
1118blacklist ${HOME}/.cache/vivaldi
1119blacklist ${HOME}/.cache/vivaldi-snapshot
1120blacklist ${HOME}/.cache/vlc
1121blacklist ${HOME}/.cache/vmware
1122blacklist ${HOME}/.cache/warsow-2.1
1123blacklist ${HOME}/.cache/waterfox
1124blacklist ${HOME}/.cache/wesnoth
1125blacklist ${HOME}/.cache/winetricks
1126blacklist ${HOME}/.cache/xmms2
1127blacklist ${HOME}/.cache/xournalpp
1128blacklist ${HOME}/.cache/xreader
1129blacklist ${HOME}/.cache/yandex-browser
1130blacklist ${HOME}/.cache/yandex-browser-beta
1131blacklist ${HOME}/.cache/youtube-dl
1132blacklist ${HOME}/.cache/youtube-viewer
1133blacklist ${HOME}/.cache/yt-dlp
1134blacklist ${HOME}/.cache/zim
diff --git a/etc/profile-a-l/abiword.profile b/etc/profile-a-l/abiword.profile
index 256e2115a..0e7126458 100644
--- a/etc/profile-a-l/abiword.profile
+++ b/etc/profile-a-l/abiword.profile
@@ -42,7 +42,7 @@ tracelog
42private-bin abiword 42private-bin abiword
43private-cache 43private-cache
44private-dev 44private-dev
45private-etc fonts,gtk-3.0,ld.so.preload,passwd 45private-etc alternatives,fonts,gtk-3.0,ld.so.cache,ld.so.preload,passwd
46private-tmp 46private-tmp
47 47
48# dbus-user none 48# dbus-user none
diff --git a/etc/profile-a-l/agetpkg.profile b/etc/profile-a-l/agetpkg.profile
index 8652ae5f1..dd3b2e59b 100644
--- a/etc/profile-a-l/agetpkg.profile
+++ b/etc/profile-a-l/agetpkg.profile
@@ -50,7 +50,7 @@ tracelog
50private-bin agetpkg,python3 50private-bin agetpkg,python3
51private-cache 51private-cache
52private-dev 52private-dev
53private-etc ca-certificates,crypto-policies,ld.so.preload,pki,resolv.conf,ssl 53private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl
54private-tmp 54private-tmp
55 55
56dbus-user none 56dbus-user none
diff --git a/etc/profile-a-l/alacarte.profile b/etc/profile-a-l/alacarte.profile
index 9b74b4d29..5a528595b 100644
--- a/etc/profile-a-l/alacarte.profile
+++ b/etc/profile-a-l/alacarte.profile
@@ -53,7 +53,7 @@ disable-mnt
53# private-bin alacarte,bash,python*,sh 53# private-bin alacarte,bash,python*,sh
54private-cache 54private-cache
55private-dev 55private-dev
56private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload,locale.alias,locale.conf,login.defs,mime.types,nsswitch.conf,passwd,pki,X11,xdg 56private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,locale.alias,locale.conf,login.defs,mime.types,nsswitch.conf,passwd,pki,X11,xdg
57private-tmp 57private-tmp
58 58
59dbus-user none 59dbus-user none
diff --git a/etc/profile-a-l/anki.profile b/etc/profile-a-l/anki.profile
index b6e931be5..f6d711b2e 100644
--- a/etc/profile-a-l/anki.profile
+++ b/etc/profile-a-l/anki.profile
@@ -50,7 +50,7 @@ disable-mnt
50private-bin anki,python* 50private-bin anki,python*
51private-cache 51private-cache
52private-dev 52private-dev
53private-etc alternatives,ca-certificates,fonts,gtk-2.0,hostname,hosts,ld.so.preload,machine-id,pki,resolv.conf,ssl,Trolltech.conf 53private-etc alternatives,ca-certificates,fonts,gtk-2.0,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,pki,resolv.conf,ssl,Trolltech.conf
54private-tmp 54private-tmp
55 55
56dbus-user none 56dbus-user none
diff --git a/etc/profile-a-l/aria2c.profile b/etc/profile-a-l/aria2c.profile
index e96def048..8aef75cd1 100644
--- a/etc/profile-a-l/aria2c.profile
+++ b/etc/profile-a-l/aria2c.profile
@@ -45,7 +45,7 @@ private-bin aria2c,gzip
45# Add 'private-cache' to your aria2c.local if you don't use Lutris/winetricks (see issue #2772). 45# Add 'private-cache' to your aria2c.local if you don't use Lutris/winetricks (see issue #2772).
46#private-cache 46#private-cache
47private-dev 47private-dev
48private-etc alternatives,ca-certificates,crypto-policies,groups,ld.so.preload,login.defs,machine-id,nsswitch.conf,passwd,pki,resolv.conf,ssl 48private-etc alternatives,ca-certificates,crypto-policies,groups,ld.so.cache,ld.so.preload,login.defs,machine-id,nsswitch.conf,passwd,pki,resolv.conf,ssl
49private-lib libreadline.so.* 49private-lib libreadline.so.*
50private-tmp 50private-tmp
51 51
diff --git a/etc/profile-a-l/arm.profile b/etc/profile-a-l/arm.profile
index 98ae01950..6676d42e9 100644
--- a/etc/profile-a-l/arm.profile
+++ b/etc/profile-a-l/arm.profile
@@ -43,6 +43,6 @@ tracelog
43disable-mnt 43disable-mnt
44private-bin arm,bash,ldconfig,lsof,ps,python*,sh,tor 44private-bin arm,bash,ldconfig,lsof,ps,python*,sh,tor
45private-dev 45private-dev
46private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,passwd,pki,ssl,tor 46private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,passwd,pki,ssl,tor
47private-tmp 47private-tmp
48 48
diff --git a/etc/profile-a-l/artha.profile b/etc/profile-a-l/artha.profile
index adf4e16ee..254f3f571 100644
--- a/etc/profile-a-l/artha.profile
+++ b/etc/profile-a-l/artha.profile
@@ -56,7 +56,7 @@ disable-mnt
56private-bin artha,enchant,notify-send 56private-bin artha,enchant,notify-send
57private-cache 57private-cache
58private-dev 58private-dev
59private-etc alternatives,fonts,ld.so.preload,machine-id 59private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id
60private-lib libnotify.so.* 60private-lib libnotify.so.*
61private-tmp 61private-tmp
62 62
diff --git a/etc/profile-a-l/atool.profile b/etc/profile-a-l/atool.profile
index 272f9906d..6399bc1a3 100644
--- a/etc/profile-a-l/atool.profile
+++ b/etc/profile-a-l/atool.profile
@@ -13,7 +13,7 @@ include allow-perl.inc
13noroot 13noroot
14 14
15# without login.defs atool complains and uses UID/GID 1000 by default 15# without login.defs atool complains and uses UID/GID 1000 by default
16private-etc alternatives,group,ld.so.preload,login.defs,passwd 16private-etc alternatives,group,ld.so.cache,ld.so.preload,login.defs,passwd
17private-tmp 17private-tmp
18 18
19# Redirect 19# Redirect
diff --git a/etc/profile-a-l/authenticator-rs.profile b/etc/profile-a-l/authenticator-rs.profile
index 8fefc1eb7..a8af1928b 100644
--- a/etc/profile-a-l/authenticator-rs.profile
+++ b/etc/profile-a-l/authenticator-rs.profile
@@ -47,7 +47,7 @@ disable-mnt
47private-bin authenticator-rs 47private-bin authenticator-rs
48private-cache 48private-cache
49private-dev 49private-dev
50private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.preload,pki,resolv.conf,ssl,xdg 50private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl,xdg
51private-tmp 51private-tmp
52 52
53dbus-user filter 53dbus-user filter
diff --git a/etc/profile-a-l/balsa.profile b/etc/profile-a-l/balsa.profile
index 2080aad62..be3543b08 100644
--- a/etc/profile-a-l/balsa.profile
+++ b/etc/profile-a-l/balsa.profile
@@ -66,7 +66,7 @@ tracelog
66private-bin balsa,balsa-ab,gpg,gpg-agent,gpg2,gpgsm 66private-bin balsa,balsa-ab,gpg,gpg-agent,gpg2,gpgsm
67private-cache 67private-cache
68private-dev 68private-dev
69private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.preload,mailname,passwd,pki,resolv.conf,selinux,ssl,xdg 69private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,mailname,passwd,pki,resolv.conf,selinux,ssl,xdg
70private-tmp 70private-tmp
71writable-run-user 71writable-run-user
72writable-var 72writable-var
diff --git a/etc/profile-a-l/bibletime.profile b/etc/profile-a-l/bibletime.profile
index 24db11c7e..be29ce8a7 100644
--- a/etc/profile-a-l/bibletime.profile
+++ b/etc/profile-a-l/bibletime.profile
@@ -52,7 +52,7 @@ disable-mnt
52# private-bin bibletime,qt5ct 52# private-bin bibletime,qt5ct
53private-cache 53private-cache
54private-dev 54private-dev
55private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,login.defs,machine-id,passwd,pki,resolv.conf,ssl,sword,sword.conf 55private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,login.defs,machine-id,passwd,pki,resolv.conf,ssl,sword,sword.conf
56private-tmp 56private-tmp
57 57
58dbus-user none 58dbus-user none
diff --git a/etc/profile-a-l/bijiben.profile b/etc/profile-a-l/bijiben.profile
index 61cd792b1..b86232860 100644
--- a/etc/profile-a-l/bijiben.profile
+++ b/etc/profile-a-l/bijiben.profile
@@ -51,7 +51,7 @@ disable-mnt
51private-bin bijiben 51private-bin bijiben
52# private-cache -- access to .cache/tracker is required 52# private-cache -- access to .cache/tracker is required
53private-dev 53private-dev
54private-etc dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload 54private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload
55private-tmp 55private-tmp
56 56
57dbus-user filter 57dbus-user filter
diff --git a/etc/profile-a-l/bitwarden.profile b/etc/profile-a-l/bitwarden.profile
index 91ce57966..f8114c71b 100644
--- a/etc/profile-a-l/bitwarden.profile
+++ b/etc/profile-a-l/bitwarden.profile
@@ -23,7 +23,7 @@ no3d
23nosound 23nosound
24 24
25?HAS_APPIMAGE: ignore private-dev 25?HAS_APPIMAGE: ignore private-dev
26private-etc alternatives,ca-certificates,crypto-policies,fonts,hosts,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl 26private-etc alternatives,ca-certificates,crypto-policies,fonts,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl
27private-opt Bitwarden 27private-opt Bitwarden
28 28
29# Redirect 29# Redirect
diff --git a/etc/profile-a-l/bless.profile b/etc/profile-a-l/bless.profile
index 8d8787174..3e20ed133 100644
--- a/etc/profile-a-l/bless.profile
+++ b/etc/profile-a-l/bless.profile
@@ -35,7 +35,7 @@ shell none
35# private-bin bash,bless,mono,sh 35# private-bin bash,bless,mono,sh
36private-cache 36private-cache
37private-dev 37private-dev
38private-etc alternatives,fonts,ld.so.preload,mono 38private-etc alternatives,fonts,ld.so.cache,ld.so.preload,mono
39private-tmp 39private-tmp
40 40
41dbus-user none 41dbus-user none
diff --git a/etc/profile-a-l/blobby.profile b/etc/profile-a-l/blobby.profile
index 7179bf4a5..d7df3bc49 100644
--- a/etc/profile-a-l/blobby.profile
+++ b/etc/profile-a-l/blobby.profile
@@ -41,7 +41,7 @@ tracelog
41disable-mnt 41disable-mnt
42private-bin blobby 42private-bin blobby
43private-dev 43private-dev
44private-etc alsa,alternatives,asound.conf,drirc,group,hosts,ld.so.preload,login.defs,machine-id,passwd,pulse 44private-etc alsa,alternatives,asound.conf,drirc,group,hosts,ld.so.cache,ld.so.preload,login.defs,machine-id,passwd,pulse
45private-lib 45private-lib
46private-tmp 46private-tmp
47 47
diff --git a/etc/profile-a-l/blobwars.profile b/etc/profile-a-l/blobwars.profile
index 66f38b358..cc2fda3f2 100644
--- a/etc/profile-a-l/blobwars.profile
+++ b/etc/profile-a-l/blobwars.profile
@@ -43,7 +43,7 @@ disable-mnt
43private-bin blobwars 43private-bin blobwars
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc ld.so.preload,machine-id 46private-etc alternatives,ld.so.cache,ld.so.preload,machine-id
47private-tmp 47private-tmp
48 48
49dbus-user none 49dbus-user none
diff --git a/etc/profile-a-l/bsdtar.profile b/etc/profile-a-l/bsdtar.profile
index dbfc90996..fbc7c9056 100644
--- a/etc/profile-a-l/bsdtar.profile
+++ b/etc/profile-a-l/bsdtar.profile
@@ -6,7 +6,7 @@ include bsdtar.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9private-etc alternatives,group,ld.so.preload,localtime,passwd 9private-etc alternatives,group,ld.so.cache,ld.so.preload,localtime,passwd
10 10
11# Redirect 11# Redirect
12include archiver-common.profile 12include archiver-common.profile
diff --git a/etc/profile-a-l/cameramonitor.profile b/etc/profile-a-l/cameramonitor.profile
index d3c25d451..92c455144 100644
--- a/etc/profile-a-l/cameramonitor.profile
+++ b/etc/profile-a-l/cameramonitor.profile
@@ -46,7 +46,7 @@ tracelog
46disable-mnt 46disable-mnt
47private-bin cameramonitor,python* 47private-bin cameramonitor,python*
48private-cache 48private-cache
49private-etc alternatives,fonts,ld.so.preload 49private-etc alternatives,fonts,ld.so.cache,ld.so.preload
50private-tmp 50private-tmp
51 51
52# dbus-user none 52# dbus-user none
diff --git a/etc/profile-a-l/cawbird.profile b/etc/profile-a-l/cawbird.profile
index ceba03269..c7a98250e 100644
--- a/etc/profile-a-l/cawbird.profile
+++ b/etc/profile-a-l/cawbird.profile
@@ -39,7 +39,7 @@ disable-mnt
39private-bin cawbird 39private-bin cawbird
40private-cache 40private-cache
41private-dev 41private-dev
42private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,pki,resolv.conf,ssl,X11,xdg 42private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,pki,resolv.conf,ssl,X11,xdg
43private-tmp 43private-tmp
44 44
45# dbus-user none 45# dbus-user none
diff --git a/etc/profile-a-l/cheese.profile b/etc/profile-a-l/cheese.profile
index 7fbc82aba..713d8a5e4 100644
--- a/etc/profile-a-l/cheese.profile
+++ b/etc/profile-a-l/cheese.profile
@@ -52,7 +52,7 @@ disable-mnt
52private-bin cheese 52private-bin cheese
53private-cache 53private-cache
54private-dev 54private-dev
55private-etc alternatives,clutter-1.0,dconf,drirc,fonts,gtk-3.0,ld.so.preload 55private-etc alternatives,clutter-1.0,dconf,drirc,fonts,gtk-3.0,ld.so.cache,ld.so.preload
56private-tmp 56private-tmp
57 57
58dbus-user filter 58dbus-user filter
diff --git a/etc/profile-a-l/chromium-common.profile b/etc/profile-a-l/chromium-common.profile
index c42243e02..7bfb61688 100644
--- a/etc/profile-a-l/chromium-common.profile
+++ b/etc/profile-a-l/chromium-common.profile
@@ -11,6 +11,7 @@ include chromium-common.local
11 11
12noblacklist ${HOME}/.pki 12noblacklist ${HOME}/.pki
13noblacklist ${HOME}/.local/share/pki 13noblacklist ${HOME}/.local/share/pki
14noblacklist /usr/lib/chromium/chrome-sandbox
14 15
15# Add the next line to your chromium-common.local if you want Google Chrome/Chromium browser 16# Add the next line to your chromium-common.local if you want Google Chrome/Chromium browser
16# to have access to Gnome extensions (extensions.gnome.org) via browser connector 17# to have access to Gnome extensions (extensions.gnome.org) via browser connector
diff --git a/etc/profile-a-l/clawsker.profile b/etc/profile-a-l/clawsker.profile
index 5eb2cb621..677d2b7eb 100644
--- a/etc/profile-a-l/clawsker.profile
+++ b/etc/profile-a-l/clawsker.profile
@@ -44,7 +44,7 @@ disable-mnt
44private-bin bash,clawsker,perl,sh,which 44private-bin bash,clawsker,perl,sh,which
45private-cache 45private-cache
46private-dev 46private-dev
47private-etc alternatives,fonts,ld.so.preload 47private-etc alternatives,fonts,ld.so.cache,ld.so.preload
48private-lib girepository-1.*,libdbus-glib-1.so.*,libetpan.so.*,libgirepository-1.*,libgtk-3.so.*,libgtk-x11-2.0.so.*,libstartup-notification-1.so.*,perl* 48private-lib girepository-1.*,libdbus-glib-1.so.*,libetpan.so.*,libgirepository-1.*,libgtk-3.so.*,libgtk-x11-2.0.so.*,libstartup-notification-1.so.*,perl*
49private-tmp 49private-tmp
50 50
diff --git a/etc/profile-a-l/cmus.profile b/etc/profile-a-l/cmus.profile
index e51dd6bed..7421debe0 100644
--- a/etc/profile-a-l/cmus.profile
+++ b/etc/profile-a-l/cmus.profile
@@ -27,4 +27,4 @@ seccomp
27shell none 27shell none
28 28
29private-bin cmus 29private-bin cmus
30private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl 30private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl
diff --git a/etc/profile-a-l/com.github.bleakgrey.tootle.profile b/etc/profile-a-l/com.github.bleakgrey.tootle.profile
index 6f08bc378..27780b669 100644
--- a/etc/profile-a-l/com.github.bleakgrey.tootle.profile
+++ b/etc/profile-a-l/com.github.bleakgrey.tootle.profile
@@ -45,7 +45,7 @@ disable-mnt
45private-bin com.github.bleakgrey.tootle 45private-bin com.github.bleakgrey.tootle
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,machine-id mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg 48private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg
49private-tmp 49private-tmp
50 50
51# Settings are immutable 51# Settings are immutable
diff --git a/etc/profile-a-l/com.github.dahenson.agenda.profile b/etc/profile-a-l/com.github.dahenson.agenda.profile
index d33b89e7c..0e29d90de 100644
--- a/etc/profile-a-l/com.github.dahenson.agenda.profile
+++ b/etc/profile-a-l/com.github.dahenson.agenda.profile
@@ -52,7 +52,7 @@ disable-mnt
52private-bin com.github.dahenson.agenda 52private-bin com.github.dahenson.agenda
53private-cache 53private-cache
54private-dev 54private-dev
55private-etc dconf,fonts,gtk-3.0,ld.so.preload 55private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload
56private-tmp 56private-tmp
57 57
58dbus-user filter 58dbus-user filter
diff --git a/etc/profile-a-l/com.github.johnfactotum.Foliate.profile b/etc/profile-a-l/com.github.johnfactotum.Foliate.profile
index c75a09a51..24222164b 100644
--- a/etc/profile-a-l/com.github.johnfactotum.Foliate.profile
+++ b/etc/profile-a-l/com.github.johnfactotum.Foliate.profile
@@ -55,7 +55,7 @@ disable-mnt
55private-bin com.github.johnfactotum.Foliate,gjs 55private-bin com.github.johnfactotum.Foliate,gjs
56private-cache 56private-cache
57private-dev 57private-dev
58private-etc dconf,fonts,gconf,gtk-3.0,ld.so.preload 58private-etc alternatives,dconf,fonts,gconf,gtk-3.0,ld.so.cache,ld.so.preload
59private-tmp 59private-tmp
60 60
61read-only ${HOME} 61read-only ${HOME}
diff --git a/etc/profile-a-l/coyim.profile b/etc/profile-a-l/coyim.profile
index 1d623fa09..099253b21 100644
--- a/etc/profile-a-l/coyim.profile
+++ b/etc/profile-a-l/coyim.profile
@@ -40,7 +40,7 @@ tracelog
40disable-mnt 40disable-mnt
41private-cache 41private-cache
42private-dev 42private-dev
43private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,machine-id,pki,ssl 43private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,machine-id,pki,ssl
44private-tmp 44private-tmp
45 45
46dbus-user none 46dbus-user none
diff --git a/etc/profile-a-l/crow.profile b/etc/profile-a-l/crow.profile
index deb2c0ef8..ed1213687 100644
--- a/etc/profile-a-l/crow.profile
+++ b/etc/profile-a-l/crow.profile
@@ -39,7 +39,7 @@ shell none
39disable-mnt 39disable-mnt
40private-bin crow 40private-bin crow
41private-dev 41private-dev
42private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,ld.so.preload,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl 42private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl
43private-opt none 43private-opt none
44private-tmp 44private-tmp
45private-srv none 45private-srv none
diff --git a/etc/profile-a-l/d-feet.profile b/etc/profile-a-l/d-feet.profile
index 0e754c448..c75bc756f 100644
--- a/etc/profile-a-l/d-feet.profile
+++ b/etc/profile-a-l/d-feet.profile
@@ -50,7 +50,7 @@ disable-mnt
50private-bin d-feet,python* 50private-bin d-feet,python*
51private-cache 51private-cache
52private-dev 52private-dev
53private-etc alternatives,dbus-1,fonts,ld.so.preload,machine-id 53private-etc alternatives,dbus-1,fonts,ld.so.cache,ld.so.preload,machine-id
54private-tmp 54private-tmp
55 55
56#memory-deny-write-execute - breaks on Arch (see issue #1803) 56#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/profile-a-l/dbus-send.profile b/etc/profile-a-l/dbus-send.profile
index c2532ed3b..e1b96f186 100644
--- a/etc/profile-a-l/dbus-send.profile
+++ b/etc/profile-a-l/dbus-send.profile
@@ -51,7 +51,7 @@ private
51private-bin dbus-send 51private-bin dbus-send
52private-cache 52private-cache
53private-dev 53private-dev
54private-etc alternatives,dbus-1,ld.so.preload 54private-etc alternatives,dbus-1,ld.so.cache,ld.so.preload
55private-lib libpcre* 55private-lib libpcre*
56private-tmp 56private-tmp
57 57
diff --git a/etc/profile-a-l/dconf-editor.profile b/etc/profile-a-l/dconf-editor.profile
index 2b43c5ea3..8c3c22dcf 100644
--- a/etc/profile-a-l/dconf-editor.profile
+++ b/etc/profile-a-l/dconf-editor.profile
@@ -43,7 +43,7 @@ disable-mnt
43private-bin dconf-editor 43private-bin dconf-editor
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload,machine-id 46private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,machine-id
47private-lib 47private-lib
48private-tmp 48private-tmp
49 49
diff --git a/etc/profile-a-l/dconf.profile b/etc/profile-a-l/dconf.profile
index 1cbeee763..b170842c3 100644
--- a/etc/profile-a-l/dconf.profile
+++ b/etc/profile-a-l/dconf.profile
@@ -46,7 +46,7 @@ disable-mnt
46private-bin dconf,gsettings 46private-bin dconf,gsettings
47private-cache 47private-cache
48private-dev 48private-dev
49private-etc alternatives,dconf,ld.so.preload 49private-etc alternatives,dconf,ld.so.cache,ld.so.preload
50private-lib 50private-lib
51private-tmp 51private-tmp
52 52
diff --git a/etc/profile-a-l/ddgtk.profile b/etc/profile-a-l/ddgtk.profile
index 0669a5a6c..e9b8f5c47 100644
--- a/etc/profile-a-l/ddgtk.profile
+++ b/etc/profile-a-l/ddgtk.profile
@@ -45,7 +45,7 @@ tracelog
45disable-mnt 45disable-mnt
46private-bin bash,dd,ddgtk,grep,lsblk,python*,sed,sh,tr 46private-bin bash,dd,ddgtk,grep,lsblk,python*,sed,sh,tr
47private-cache 47private-cache
48private-etc alternatives,fonts,ld.so.preload 48private-etc alternatives,fonts,ld.so.cache,ld.so.preload
49private-tmp 49private-tmp
50 50
51dbus-user none 51dbus-user none
diff --git a/etc/profile-a-l/devilspie.profile b/etc/profile-a-l/devilspie.profile
index 19b6cffaf..a0f24c388 100644
--- a/etc/profile-a-l/devilspie.profile
+++ b/etc/profile-a-l/devilspie.profile
@@ -48,7 +48,7 @@ disable-mnt
48private-bin devilspie 48private-bin devilspie
49private-cache 49private-cache
50private-dev 50private-dev
51private-etc alternatives,ld.so.preload 51private-etc alternatives,ld.so.cache,ld.so.preload
52private-lib gconv 52private-lib gconv
53private-tmp 53private-tmp
54 54
diff --git a/etc/profile-a-l/display.profile b/etc/profile-a-l/display.profile
index 6eff39d40..8a8d816a3 100644
--- a/etc/profile-a-l/display.profile
+++ b/etc/profile-a-l/display.profile
@@ -40,7 +40,7 @@ shell none
40private-bin display,python* 40private-bin display,python*
41private-dev 41private-dev
42# On Debian-based systems, display is a symlink in /etc/alternatives 42# On Debian-based systems, display is a symlink in /etc/alternatives
43private-etc alternatives,ld.so.preload 43private-etc alternatives,ld.so.cache,ld.so.preload
44private-tmp 44private-tmp
45 45
46dbus-user none 46dbus-user none
diff --git a/etc/profile-a-l/drawio.profile b/etc/profile-a-l/drawio.profile
index 253f5643e..df7be55de 100644
--- a/etc/profile-a-l/drawio.profile
+++ b/etc/profile-a-l/drawio.profile
@@ -45,7 +45,7 @@ shell none
45private-bin drawio 45private-bin drawio
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc alternatives,fonts,ld.so.preload 48private-etc alternatives,fonts,ld.so.cache,ld.so.preload
49private-tmp 49private-tmp
50 50
51dbus-user none 51dbus-user none
diff --git a/etc/profile-a-l/easystroke.profile b/etc/profile-a-l/easystroke.profile
index 0345f2b24..20cffae73 100644
--- a/etc/profile-a-l/easystroke.profile
+++ b/etc/profile-a-l/easystroke.profile
@@ -45,7 +45,7 @@ disable-mnt
45#private-bin bash,easystroke,sh 45#private-bin bash,easystroke,sh
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc alternatives,fonts,group,ld.so.preload,passwd 48private-etc alternatives,fonts,group,ld.so.cache,ld.so.preload,passwd
49# breaks custom shell command functionality 49# breaks custom shell command functionality
50#private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* 50#private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*
51private-tmp 51private-tmp
diff --git a/etc/profile-a-l/electron-mail.profile b/etc/profile-a-l/electron-mail.profile
index e472f57b6..09d14045a 100644
--- a/etc/profile-a-l/electron-mail.profile
+++ b/etc/profile-a-l/electron-mail.profile
@@ -45,7 +45,7 @@ shell none
45private-bin electron-mail 45private-bin electron-mail
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,ld.so.preload,nsswitch.conf,pki,resolv.conf,selinux,ssl,xdg 48private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,selinux,ssl,xdg
49private-opt ElectronMail 49private-opt ElectronMail
50private-tmp 50private-tmp
51 51
diff --git a/etc/profile-a-l/electrum.profile b/etc/profile-a-l/electrum.profile
index 8cfc9f797..dfbe5cee4 100644
--- a/etc/profile-a-l/electrum.profile
+++ b/etc/profile-a-l/electrum.profile
@@ -47,7 +47,7 @@ private-bin electrum,python*
47private-cache 47private-cache
48?HAS_APPIMAGE: ignore private-dev 48?HAS_APPIMAGE: ignore private-dev
49private-dev 49private-dev
50private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,ld.so.preload,machine-id,pki,resolv.conf,ssl 50private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,ld.so.cache,ld.so.preload,machine-id,pki,resolv.conf,ssl
51private-tmp 51private-tmp
52 52
53# dbus-user none 53# dbus-user none
diff --git a/etc/profile-a-l/email-common.profile b/etc/profile-a-l/email-common.profile
index 8673b65ca..ac73f002f 100644
--- a/etc/profile-a-l/email-common.profile
+++ b/etc/profile-a-l/email-common.profile
@@ -66,7 +66,7 @@ tracelog
66# disable-mnt 66# disable-mnt
67private-cache 67private-cache
68private-dev 68private-dev
69private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,ld.so.preload,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg 69private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg
70private-tmp 70private-tmp
71# encrypting and signing email 71# encrypting and signing email
72writable-run-user 72writable-run-user
diff --git a/etc/profile-a-l/enchant.profile b/etc/profile-a-l/enchant.profile
index 0a2e23996..eff0f64ea 100644
--- a/etc/profile-a-l/enchant.profile
+++ b/etc/profile-a-l/enchant.profile
@@ -48,7 +48,7 @@ x11 none
48private-bin enchant,enchant-* 48private-bin enchant,enchant-*
49private-cache 49private-cache
50private-dev 50private-dev
51private-etc alternatives,ld.so.preload 51private-etc alternatives,ld.so.cache,ld.so.preload
52private-lib 52private-lib
53private-tmp 53private-tmp
54 54
diff --git a/etc/profile-a-l/eo-common.profile b/etc/profile-a-l/eo-common.profile
index ddc0ce0b9..31f39e210 100644
--- a/etc/profile-a-l/eo-common.profile
+++ b/etc/profile-a-l/eo-common.profile
@@ -47,6 +47,6 @@ tracelog
47 47
48private-cache 48private-cache
49private-dev 49private-dev
50private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload 50private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload
51private-lib eog,eom,gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.* 51private-lib eog,eom,gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.*
52private-tmp 52private-tmp
diff --git a/etc/profile-a-l/equalx.profile b/etc/profile-a-l/equalx.profile
index fe7b912bd..0c3b790d5 100644
--- a/etc/profile-a-l/equalx.profile
+++ b/etc/profile-a-l/equalx.profile
@@ -54,7 +54,7 @@ disable-mnt
54private-bin equalx,gs,pdflatex,pdftocairo 54private-bin equalx,gs,pdflatex,pdftocairo
55private-cache 55private-cache
56private-dev 56private-dev
57private-etc equalx,equalx.conf,fonts,gtk-2.0,latexmk.conf,ld.so.preload,machine-id,papersize,passwd,texlive,Trolltech.conf 57private-etc alternatives,equalx,equalx.conf,fonts,gtk-2.0,latexmk.conf,ld.so.cache,ld.so.preload,machine-id,papersize,passwd,texlive,Trolltech.conf
58private-tmp 58private-tmp
59 59
60dbus-user none 60dbus-user none
diff --git a/etc/profile-a-l/exiftool.profile b/etc/profile-a-l/exiftool.profile
index 12c22ba5b..ae550e842 100644
--- a/etc/profile-a-l/exiftool.profile
+++ b/etc/profile-a-l/exiftool.profile
@@ -48,7 +48,7 @@ x11 none
48#private-bin exiftool,perl 48#private-bin exiftool,perl
49private-cache 49private-cache
50private-dev 50private-dev
51private-etc alternatives,ld.so.preload 51private-etc alternatives,ld.so.cache,ld.so.preload
52private-tmp 52private-tmp
53 53
54dbus-user none 54dbus-user none
diff --git a/etc/profile-a-l/falkon.profile b/etc/profile-a-l/falkon.profile
index 03d6b30a1..321cb0145 100644
--- a/etc/profile-a-l/falkon.profile
+++ b/etc/profile-a-l/falkon.profile
@@ -47,7 +47,7 @@ disable-mnt
47# private-bin falkon 47# private-bin falkon
48private-cache 48private-cache
49private-dev 49private-dev
50private-etc adobe,alternatives,asound.conf,ati,ca-certificates,crypto-policies,dconf,drirc,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg 50private-etc adobe,alternatives,asound.conf,ati,ca-certificates,crypto-policies,dconf,drirc,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg
51private-tmp 51private-tmp
52 52
53# dbus-user filter 53# dbus-user filter
diff --git a/etc/profile-a-l/fdns.profile b/etc/profile-a-l/fdns.profile
index 25e1082ad..ee775566e 100644
--- a/etc/profile-a-l/fdns.profile
+++ b/etc/profile-a-l/fdns.profile
@@ -42,7 +42,7 @@ private
42private-bin bash,fdns,sh 42private-bin bash,fdns,sh
43private-cache 43private-cache
44#private-dev 44#private-dev
45private-etc ca-certificates,crypto-policies,fdns,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pki,ssl 45private-etc alternatives,ca-certificates,crypto-policies,fdns,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pki,ssl
46# private-lib 46# private-lib
47private-tmp 47private-tmp
48 48
diff --git a/etc/profile-a-l/feh-network.inc.profile b/etc/profile-a-l/feh-network.inc.profile
index f9b3d58c9..7293e89a8 100644
--- a/etc/profile-a-l/feh-network.inc.profile
+++ b/etc/profile-a-l/feh-network.inc.profile
@@ -5,4 +5,4 @@ include feh-network.inc.local
5ignore net none 5ignore net none
6netfilter 6netfilter
7protocol unix,inet,inet6 7protocol unix,inet,inet6
8private-etc ca-certificates,crypto-policies,hosts,ld.so.preload,pki,resolv.conf,ssl 8private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl
diff --git a/etc/profile-a-l/feh.profile b/etc/profile-a-l/feh.profile
index f2770f294..4b8d41170 100644
--- a/etc/profile-a-l/feh.profile
+++ b/etc/profile-a-l/feh.profile
@@ -36,7 +36,7 @@ shell none
36private-bin feh,jpegexiforient,jpegtran 36private-bin feh,jpegexiforient,jpegtran
37private-cache 37private-cache
38private-dev 38private-dev
39private-etc alternatives,feh,ld.so.preload 39private-etc alternatives,feh,ld.so.cache,ld.so.preload
40private-tmp 40private-tmp
41 41
42dbus-user none 42dbus-user none
diff --git a/etc/profile-a-l/ffplay.profile b/etc/profile-a-l/ffplay.profile
index 2284ccbe4..52abb99d4 100644
--- a/etc/profile-a-l/ffplay.profile
+++ b/etc/profile-a-l/ffplay.profile
@@ -14,7 +14,7 @@ ignore nogroups
14ignore nosound 14ignore nosound
15 15
16private-bin ffplay 16private-bin ffplay
17private-etc alsa,asound.conf,group,ld.so.preload 17private-etc alsa,alternatives,asound.conf,group,ld.so.cache,ld.so.preload
18 18
19# Redirect 19# Redirect
20include ffmpeg.profile 20include ffmpeg.profile
diff --git a/etc/profile-a-l/file-roller.profile b/etc/profile-a-l/file-roller.profile
index 54fa7dfa7..06a8f6170 100644
--- a/etc/profile-a-l/file-roller.profile
+++ b/etc/profile-a-l/file-roller.profile
@@ -43,7 +43,7 @@ tracelog
43private-bin 7z,7za,7zr,ar,arj,atool,bash,brotli,bsdtar,bzip2,compress,cp,cpio,dpkg-deb,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,mv,p7zip,rar,rm,rzip,sh,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,unzstd,xz,xzdec,zip,zoo,zstd 43private-bin 7z,7za,7zr,ar,arj,atool,bash,brotli,bsdtar,bzip2,compress,cp,cpio,dpkg-deb,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,mv,p7zip,rar,rm,rzip,sh,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,unzstd,xz,xzdec,zip,zoo,zstd
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc dconf,fonts,gtk-3.0,ld.so.preload,xdg 46private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,xdg
47# private-tmp 47# private-tmp
48 48
49dbus-system none 49dbus-system none
diff --git a/etc/profile-a-l/flameshot.profile b/etc/profile-a-l/flameshot.profile
index 862ef6ab6..f80297022 100644
--- a/etc/profile-a-l/flameshot.profile
+++ b/etc/profile-a-l/flameshot.profile
@@ -52,7 +52,7 @@ tracelog
52disable-mnt 52disable-mnt
53private-bin flameshot 53private-bin flameshot
54private-cache 54private-cache
55private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.conf,ld.so.preload,machine-id,pki,resolv.conf,ssl 55private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.preload,machine-id,pki,resolv.conf,ssl
56private-dev 56private-dev
57#private-tmp 57#private-tmp
58 58
diff --git a/etc/profile-a-l/freetube.profile b/etc/profile-a-l/freetube.profile
index aeed313c8..cb00ce11b 100644
--- a/etc/profile-a-l/freetube.profile
+++ b/etc/profile-a-l/freetube.profile
@@ -16,7 +16,7 @@ mkdir ${HOME}/.config/FreeTube
16whitelist ${HOME}/.config/FreeTube 16whitelist ${HOME}/.config/FreeTube
17 17
18private-bin electron,electron[0-9],electron[0-9][0-9],freetube,sh 18private-bin electron,electron[0-9],electron[0-9][0-9],freetube,sh
19private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg 19private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg
20 20
21# Redirect 21# Redirect
22include electron.profile 22include electron.profile
diff --git a/etc/profile-a-l/frogatto.profile b/etc/profile-a-l/frogatto.profile
index efd5246d6..8419998de 100644
--- a/etc/profile-a-l/frogatto.profile
+++ b/etc/profile-a-l/frogatto.profile
@@ -45,7 +45,7 @@ disable-mnt
45private-bin frogatto,sh 45private-bin frogatto,sh
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc ld.so.preload,machine-id 48private-etc alternatives,ld.so.cache,ld.so.preload,machine-id
49private-tmp 49private-tmp
50 50
51dbus-user none 51dbus-user none
diff --git a/etc/profile-a-l/ftp.profile b/etc/profile-a-l/ftp.profile
new file mode 100644
index 000000000..29470360c
--- /dev/null
+++ b/etc/profile-a-l/ftp.profile
@@ -0,0 +1,54 @@
1# Firejail profile for ftp
2# Description: standard File Access Protocol utility
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include ftp.local
7# Persistent global definitions
8include globals.local
9
10noblacklist ${PATH}/ftp
11
12include disable-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-proc.inc
17include disable-programs.inc
18#include disable-shell.inc
19include disable-write-mnt.inc
20include disable-X11.inc
21include disable-xdg.inc
22
23apparmor
24caps.drop all
25ipc-namespace
26machine-id
27netfilter
28no3d
29nodvd
30nogroups
31noinput
32nonewprivs
33noroot
34nosound
35notv
36nou2f
37novideo
38protocol inet,inet6
39seccomp
40shell none
41tracelog
42
43#disable-mnt
44#private-bin PROGRAMS
45private-cache
46private-dev
47#private-etc FILES
48private-tmp
49
50dbus-user none
51dbus-system none
52
53memory-deny-write-execute
54noexec ${HOME}
diff --git a/etc/profile-a-l/galculator.profile b/etc/profile-a-l/galculator.profile
index c6280c488..4efe41f8d 100644
--- a/etc/profile-a-l/galculator.profile
+++ b/etc/profile-a-l/galculator.profile
@@ -43,7 +43,7 @@ tracelog
43private-bin galculator 43private-bin galculator
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc alternatives,fonts,ld.so.preload 46private-etc alternatives,fonts,ld.so.cache,ld.so.preload
47private-lib 47private-lib
48private-tmp 48private-tmp
49 49
diff --git a/etc/profile-a-l/gallery-dl.profile b/etc/profile-a-l/gallery-dl.profile
index a31dde21c..2947873ef 100644
--- a/etc/profile-a-l/gallery-dl.profile
+++ b/etc/profile-a-l/gallery-dl.profile
@@ -12,7 +12,7 @@ noblacklist ${HOME}/.config/gallery-dl
12noblacklist ${HOME}/.gallery-dl.conf 12noblacklist ${HOME}/.gallery-dl.conf
13 13
14private-bin gallery-dl 14private-bin gallery-dl
15private-etc gallery-dl.conf,ld.so.preload 15private-etc alternatives,gallery-dl.conf,ld.so.cache,ld.so.preload
16 16
17# Redirect 17# Redirect
18include youtube-dl.profile 18include youtube-dl.profile
diff --git a/etc/profile-a-l/gapplication.profile b/etc/profile-a-l/gapplication.profile
index 62f3659ea..ec5b733c8 100644
--- a/etc/profile-a-l/gapplication.profile
+++ b/etc/profile-a-l/gapplication.profile
@@ -49,7 +49,7 @@ private
49private-bin gapplication 49private-bin gapplication
50private-cache 50private-cache
51private-dev 51private-dev
52private-etc ld.so.preload 52private-etc alternatives,ld.so.cache,ld.so.preload
53private-tmp 53private-tmp
54 54
55# Add the next line to your gapplication.local to filter D-Bus names. 55# Add the next line to your gapplication.local to filter D-Bus names.
diff --git a/etc/profile-a-l/gconf.profile b/etc/profile-a-l/gconf.profile
index 6532d85f0..a45374d4e 100644
--- a/etc/profile-a-l/gconf.profile
+++ b/etc/profile-a-l/gconf.profile
@@ -54,7 +54,7 @@ disable-mnt
54private-bin gconf-editor,gconf-merge-*,gconfpkg,gconftool-2,gsettings-*-convert,python2* 54private-bin gconf-editor,gconf-merge-*,gconfpkg,gconftool-2,gsettings-*-convert,python2*
55private-cache 55private-cache
56private-dev 56private-dev
57private-etc alternatives,fonts,gconf,ld.so.preload 57private-etc alternatives,fonts,gconf,ld.so.cache,ld.so.preload
58private-lib GConf,libpython*,python2* 58private-lib GConf,libpython*,python2*
59private-tmp 59private-tmp
60 60
diff --git a/etc/profile-a-l/geary.profile b/etc/profile-a-l/geary.profile
index b78f7e647..cececd9e9 100644
--- a/etc/profile-a-l/geary.profile
+++ b/etc/profile-a-l/geary.profile
@@ -70,7 +70,7 @@ tracelog
70private-bin geary 70private-bin geary
71private-cache 71private-cache
72private-dev 72private-dev
73private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.preload,pki,resolv.conf,ssl,xdg 73private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl,xdg
74private-tmp 74private-tmp
75 75
76dbus-user filter 76dbus-user filter
diff --git a/etc/profile-a-l/geekbench.profile b/etc/profile-a-l/geekbench.profile
index 4812e1368..243b893b9 100644
--- a/etc/profile-a-l/geekbench.profile
+++ b/etc/profile-a-l/geekbench.profile
@@ -48,7 +48,7 @@ disable-mnt
48#private-bin bash,geekbench*,sh -- #4576 48#private-bin bash,geekbench*,sh -- #4576
49private-cache 49private-cache
50private-dev 50private-dev
51private-etc alternatives,group,ld.so.preload,lsb-release,passwd 51private-etc alternatives,group,ld.so.cache,ld.so.preload,lsb-release,passwd
52private-tmp 52private-tmp
53 53
54dbus-user none 54dbus-user none
diff --git a/etc/profile-a-l/gget.profile b/etc/profile-a-l/gget.profile
index d8ca4ae41..bc1199914 100644
--- a/etc/profile-a-l/gget.profile
+++ b/etc/profile-a-l/gget.profile
@@ -49,7 +49,7 @@ disable-mnt
49private-bin gget 49private-bin gget
50private-cache 50private-cache
51private-dev 51private-dev
52private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,pki,resolv.conf,ssl 52private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl
53private-lib 53private-lib
54private-tmp 54private-tmp
55 55
diff --git a/etc/profile-a-l/gist.profile b/etc/profile-a-l/gist.profile
index 010cdae06..506ab7127 100644
--- a/etc/profile-a-l/gist.profile
+++ b/etc/profile-a-l/gist.profile
@@ -52,7 +52,7 @@ tracelog
52disable-mnt 52disable-mnt
53private-cache 53private-cache
54private-dev 54private-dev
55private-etc alternatives,ld.so.preload 55private-etc alternatives,ld.so.cache,ld.so.preload
56private-tmp 56private-tmp
57 57
58dbus-user none 58dbus-user none
diff --git a/etc/profile-a-l/git-cola.profile b/etc/profile-a-l/git-cola.profile
index c13273321..6439c8821 100644
--- a/etc/profile-a-l/git-cola.profile
+++ b/etc/profile-a-l/git-cola.profile
@@ -70,7 +70,7 @@ tracelog
70private-bin basename,bash,cola,envsubst,gettext,git,git-cola,git-dag,git-gui,gitk,gpg,gpg-agent,nano,ps,python*,sh,ssh,ssh-agent,tclsh,tr,wc,which,xed 70private-bin basename,bash,cola,envsubst,gettext,git,git-cola,git-dag,git-gui,gitk,gpg,gpg-agent,nano,ps,python*,sh,ssh,ssh-agent,tclsh,tr,wc,which,xed
71private-cache 71private-cache
72private-dev 72private-dev
73private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gitconfig,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,localtime,login.defs,machine-id,mime.types,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssh,ssl,X11,xdg 73private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gitconfig,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,mime.types,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssh,ssl,X11,xdg
74private-tmp 74private-tmp
75writable-run-user 75writable-run-user
76 76
diff --git a/etc/profile-a-l/gitter.profile b/etc/profile-a-l/gitter.profile
index 36b016e02..16358d064 100644
--- a/etc/profile-a-l/gitter.profile
+++ b/etc/profile-a-l/gitter.profile
@@ -37,7 +37,7 @@ shell none
37 37
38disable-mnt 38disable-mnt
39private-bin bash,env,gitter 39private-bin bash,env,gitter
40private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,pki,pulse,resolv.conf,ssl 40private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,pulse,resolv.conf,ssl
41private-opt Gitter 41private-opt Gitter
42private-dev 42private-dev
43private-tmp 43private-tmp
diff --git a/etc/profile-a-l/gmpc.profile b/etc/profile-a-l/gmpc.profile
index 0a1264888..e53297c06 100644
--- a/etc/profile-a-l/gmpc.profile
+++ b/etc/profile-a-l/gmpc.profile
@@ -44,7 +44,7 @@ tracelog
44disable-mnt 44disable-mnt
45#private-bin gmpc 45#private-bin gmpc
46private-cache 46private-cache
47private-etc alternatives,fonts,ld.so.preload 47private-etc alternatives,fonts,ld.so.cache,ld.so.preload
48private-tmp 48private-tmp
49writable-run-user 49writable-run-user
50 50
diff --git a/etc/profile-a-l/gnome-calendar.profile b/etc/profile-a-l/gnome-calendar.profile
index 2c1dee50c..f9df83e2a 100644
--- a/etc/profile-a-l/gnome-calendar.profile
+++ b/etc/profile-a-l/gnome-calendar.profile
@@ -45,7 +45,7 @@ private
45private-bin gnome-calendar 45private-bin gnome-calendar
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,ld.so.preload,localtime,nsswitch.conf,pki,resolv.conf,ssl 48private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,pki,resolv.conf,ssl
49private-tmp 49private-tmp
50 50
51dbus-user filter 51dbus-user filter
diff --git a/etc/profile-a-l/gnome-chess.profile b/etc/profile-a-l/gnome-chess.profile
index 6261fcc27..dc9092a93 100644
--- a/etc/profile-a-l/gnome-chess.profile
+++ b/etc/profile-a-l/gnome-chess.profile
@@ -50,5 +50,5 @@ disable-mnt
50private-bin fairymax,gnome-chess,gnuchess,hoichess 50private-bin fairymax,gnome-chess,gnuchess,hoichess
51private-cache 51private-cache
52private-dev 52private-dev
53private-etc alternatives,dconf,fonts,gnome-chess,gtk-3.0,ld.so.preload 53private-etc alternatives,dconf,fonts,gnome-chess,gtk-3.0,ld.so.cache,ld.so.preload
54private-tmp 54private-tmp
diff --git a/etc/profile-a-l/gnome-clocks.profile b/etc/profile-a-l/gnome-clocks.profile
index 7d33ac94e..90665add6 100644
--- a/etc/profile-a-l/gnome-clocks.profile
+++ b/etc/profile-a-l/gnome-clocks.profile
@@ -42,6 +42,6 @@ disable-mnt
42private-bin gnome-clocks,gsound-play 42private-bin gnome-clocks,gsound-play
43private-cache 43private-cache
44private-dev 44private-dev
45private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.preload,localtime,machine-id,pkcs11,pki,ssl 45private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,pkcs11,pki,ssl
46private-tmp 46private-tmp
47 47
diff --git a/etc/profile-a-l/gnome-hexgl.profile b/etc/profile-a-l/gnome-hexgl.profile
index 28c7e3346..ab6279608 100644
--- a/etc/profile-a-l/gnome-hexgl.profile
+++ b/etc/profile-a-l/gnome-hexgl.profile
@@ -42,7 +42,7 @@ private
42private-bin gnome-hexgl 42private-bin gnome-hexgl
43private-cache 43private-cache
44private-dev 44private-dev
45private-etc alsa,asound.conf,ld.so.preload,machine-id,pulse 45private-etc alsa,alternatives,asound.conf,ld.so.cache,ld.so.preload,machine-id,pulse
46private-tmp 46private-tmp
47 47
48dbus-user none 48dbus-user none
diff --git a/etc/profile-a-l/gnome-latex.profile b/etc/profile-a-l/gnome-latex.profile
index 1d2366365..39a6718a6 100644
--- a/etc/profile-a-l/gnome-latex.profile
+++ b/etc/profile-a-l/gnome-latex.profile
@@ -48,6 +48,6 @@ tracelog
48private-cache 48private-cache
49private-dev 49private-dev
50# passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed 50# passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed
51private-etc alternatives,dconf,fonts,gtk-3.0,latexmk.conf,ld.so.preload,login.defs,passwd,texlive 51private-etc alternatives,dconf,fonts,gtk-3.0,latexmk.conf,ld.so.cache,ld.so.preload,login.defs,passwd,texlive
52 52
53dbus-system none 53dbus-system none
diff --git a/etc/profile-a-l/gnome-logs.profile b/etc/profile-a-l/gnome-logs.profile
index 3d8218e99..7ee4d8b75 100644
--- a/etc/profile-a-l/gnome-logs.profile
+++ b/etc/profile-a-l/gnome-logs.profile
@@ -40,7 +40,7 @@ disable-mnt
40private-bin gnome-logs 40private-bin gnome-logs
41private-cache 41private-cache
42private-dev 42private-dev
43private-etc alternatives,fonts,ld.so.preload,localtime,machine-id 43private-etc alternatives,fonts,ld.so.cache,ld.so.preload,localtime,machine-id
44private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* 44private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*
45private-tmp 45private-tmp
46writable-var-log 46writable-var-log
diff --git a/etc/profile-a-l/gnome-music.profile b/etc/profile-a-l/gnome-music.profile
index fe8268530..7b79fa15d 100644
--- a/etc/profile-a-l/gnome-music.profile
+++ b/etc/profile-a-l/gnome-music.profile
@@ -42,6 +42,6 @@ tracelog
42# private-bin calls a file manager - whatever is installed! 42# private-bin calls a file manager - whatever is installed!
43#private-bin env,gio-launch-desktop,gnome-music,python*,yelp 43#private-bin env,gio-launch-desktop,gnome-music,python*,yelp
44private-dev 44private-dev
45private-etc alternatives,asound.conf,dconf,fonts,fonts,gtk-3.0,ld.so.preload,machine-id,pulse,selinux,xdg 45private-etc alternatives,asound.conf,dconf,fonts,fonts,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,pulse,selinux,xdg
46private-tmp 46private-tmp
47 47
diff --git a/etc/profile-a-l/gnome-passwordsafe.profile b/etc/profile-a-l/gnome-passwordsafe.profile
index bdc09b5ac..a96ec6f05 100644
--- a/etc/profile-a-l/gnome-passwordsafe.profile
+++ b/etc/profile-a-l/gnome-passwordsafe.profile
@@ -53,7 +53,7 @@ disable-mnt
53private-bin gnome-passwordsafe,python3* 53private-bin gnome-passwordsafe,python3*
54private-cache 54private-cache
55private-dev 55private-dev
56private-etc dconf,fonts,gtk-3.0,ld.so.preload,passwd 56private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,passwd
57private-tmp 57private-tmp
58 58
59dbus-user filter 59dbus-user filter
diff --git a/etc/profile-a-l/gnome-pie.profile b/etc/profile-a-l/gnome-pie.profile
index fb108ee97..6d30213cb 100644
--- a/etc/profile-a-l/gnome-pie.profile
+++ b/etc/profile-a-l/gnome-pie.profile
@@ -34,7 +34,7 @@ shell none
34disable-mnt 34disable-mnt
35private-cache 35private-cache
36private-dev 36private-dev
37private-etc alternatives,fonts,ld.so.preload,machine-id 37private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id
38private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* 38private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*
39private-tmp 39private-tmp
40 40
diff --git a/etc/profile-a-l/gnome-pomodoro.profile b/etc/profile-a-l/gnome-pomodoro.profile
index 256a0c69f..99d569a04 100644
--- a/etc/profile-a-l/gnome-pomodoro.profile
+++ b/etc/profile-a-l/gnome-pomodoro.profile
@@ -44,7 +44,7 @@ disable-mnt
44private-bin gnome-pomodoro 44private-bin gnome-pomodoro
45private-cache 45private-cache
46private-dev 46private-dev
47private-etc dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id 47private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id
48private-tmp 48private-tmp
49 49
50dbus-user filter 50dbus-user filter
diff --git a/etc/profile-a-l/gnome-recipes.profile b/etc/profile-a-l/gnome-recipes.profile
index 9a5f878fc..b2ce4a92a 100644
--- a/etc/profile-a-l/gnome-recipes.profile
+++ b/etc/profile-a-l/gnome-recipes.profile
@@ -47,7 +47,7 @@ shell none
47disable-mnt 47disable-mnt
48private-bin gnome-recipes,tar 48private-bin gnome-recipes,tar
49private-dev 49private-dev
50private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,pki,ssl 50private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,ssl
51private-lib gdk-pixbuf-2.0,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,libgnutls.so.*,libjpeg.so.*,libp11-kit.so.*,libproxy.so.*,librsvg-2.so.* 51private-lib gdk-pixbuf-2.0,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,libgnutls.so.*,libjpeg.so.*,libp11-kit.so.*,libproxy.so.*,librsvg-2.so.*
52private-tmp 52private-tmp
53 53
diff --git a/etc/profile-a-l/gnome-screenshot.profile b/etc/profile-a-l/gnome-screenshot.profile
index a4e4ae38a..36c6693a9 100644
--- a/etc/profile-a-l/gnome-screenshot.profile
+++ b/etc/profile-a-l/gnome-screenshot.profile
@@ -42,7 +42,7 @@ tracelog
42disable-mnt 42disable-mnt
43private-bin gnome-screenshot 43private-bin gnome-screenshot
44private-dev 44private-dev
45private-etc dconf,fonts,gtk-3.0,ld.so.preload,localtime,machine-id 45private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,localtime,machine-id
46private-tmp 46private-tmp
47 47
48dbus-user filter 48dbus-user filter
diff --git a/etc/profile-a-l/gnome-sound-recorder.profile b/etc/profile-a-l/gnome-sound-recorder.profile
index 859d56bd9..28a0205b9 100644
--- a/etc/profile-a-l/gnome-sound-recorder.profile
+++ b/etc/profile-a-l/gnome-sound-recorder.profile
@@ -40,5 +40,5 @@ tracelog
40disable-mnt 40disable-mnt
41private-cache 41private-cache
42private-dev 42private-dev
43private-etc alsa,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.preload,machine-id,openal,pango,pulse,xdg 43private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,openal,pango,pulse,xdg
44private-tmp 44private-tmp
diff --git a/etc/profile-a-l/gnome-system-log.profile b/etc/profile-a-l/gnome-system-log.profile
index addd76f7f..02b023855 100644
--- a/etc/profile-a-l/gnome-system-log.profile
+++ b/etc/profile-a-l/gnome-system-log.profile
@@ -43,7 +43,7 @@ disable-mnt
43private-bin gnome-system-log 43private-bin gnome-system-log
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc alternatives,fonts,ld.so.preload,localtime,machine-id 46private-etc alternatives,fonts,ld.so.cache,ld.so.preload,localtime,machine-id
47private-lib 47private-lib
48private-tmp 48private-tmp
49writable-var-log 49writable-var-log
diff --git a/etc/profile-a-l/gnome-todo.profile b/etc/profile-a-l/gnome-todo.profile
index e7615e4f2..c6cd12250 100644
--- a/etc/profile-a-l/gnome-todo.profile
+++ b/etc/profile-a-l/gnome-todo.profile
@@ -46,7 +46,7 @@ disable-mnt
46private-bin gnome-todo 46private-bin gnome-todo
47private-cache 47private-cache
48private-dev 48private-dev
49private-etc dconf,fonts,gtk-3.0,ld.so.preload,localtime,passwd,xdg 49private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,localtime,passwd,xdg
50private-tmp 50private-tmp
51 51
52dbus-user filter 52dbus-user filter
diff --git a/etc/profile-a-l/gnome_games-common.profile b/etc/profile-a-l/gnome_games-common.profile
index a76fbbb2c..9b4f68808 100644
--- a/etc/profile-a-l/gnome_games-common.profile
+++ b/etc/profile-a-l/gnome_games-common.profile
@@ -41,7 +41,7 @@ tracelog
41disable-mnt 41disable-mnt
42private-cache 42private-cache
43private-dev 43private-dev
44private-etc dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.preload,machine-id,pango,passwd,X11 44private-etc alternatives,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,pango,passwd,X11
45private-tmp 45private-tmp
46 46
47dbus-user filter 47dbus-user filter
diff --git a/etc/profile-a-l/gnote.profile b/etc/profile-a-l/gnote.profile
index deda06f8e..928f2c548 100644
--- a/etc/profile-a-l/gnote.profile
+++ b/etc/profile-a-l/gnote.profile
@@ -51,7 +51,7 @@ disable-mnt
51private-bin gnote 51private-bin gnote
52private-cache 52private-cache
53private-dev 53private-dev
54private-etc dconf,fonts,gtk-3.0,ld.so.preload,pango,X11 54private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,pango,X11
55private-tmp 55private-tmp
56 56
57dbus-user filter 57dbus-user filter
diff --git a/etc/profile-a-l/gnubik.profile b/etc/profile-a-l/gnubik.profile
index e2e154216..c895b4ce9 100644
--- a/etc/profile-a-l/gnubik.profile
+++ b/etc/profile-a-l/gnubik.profile
@@ -43,7 +43,7 @@ private
43private-bin gnubik 43private-bin gnubik
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc drirc,fonts,gtk-2.0,ld.so.preload 46private-etc alternatives,drirc,fonts,gtk-2.0,ld.so.cache,ld.so.preload
47private-tmp 47private-tmp
48 48
49dbus-user none 49dbus-user none
diff --git a/etc/profile-a-l/godot.profile b/etc/profile-a-l/godot.profile
index f33f63497..46b362db9 100644
--- a/etc/profile-a-l/godot.profile
+++ b/etc/profile-a-l/godot.profile
@@ -38,7 +38,7 @@ tracelog
38# private-bin godot 38# private-bin godot
39private-cache 39private-cache
40private-dev 40private-dev
41private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,ld.so.preload,machine-id,mono,nsswitch.conf,openal,pki,pulse,resolv.conf,ssl 41private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,ld.so.cache,ld.so.preload,machine-id,mono,nsswitch.conf,openal,pki,pulse,resolv.conf,ssl
42private-tmp 42private-tmp
43 43
44dbus-user none 44dbus-user none
diff --git a/etc/profile-a-l/goldendict.profile b/etc/profile-a-l/goldendict.profile
index 59a572319..5251ed427 100644
--- a/etc/profile-a-l/goldendict.profile
+++ b/etc/profile-a-l/goldendict.profile
@@ -50,7 +50,7 @@ disable-mnt
50private-bin goldendict 50private-bin goldendict
51private-cache 51private-cache
52private-dev 52private-dev
53private-etc ca-certificates,crypto-policies,fonts,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl 53private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl
54private-tmp 54private-tmp
55 55
56dbus-user none 56dbus-user none
diff --git a/etc/profile-a-l/googler-common.profile b/etc/profile-a-l/googler-common.profile
index a37c7ad77..a35813a09 100644
--- a/etc/profile-a-l/googler-common.profile
+++ b/etc/profile-a-l/googler-common.profile
@@ -54,7 +54,7 @@ disable-mnt
54private-bin env,python3*,sh,w3m 54private-bin env,python3*,sh,w3m
55private-cache 55private-cache
56private-dev 56private-dev
57private-etc ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl 57private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl
58private-tmp 58private-tmp
59 59
60dbus-user none 60dbus-user none
diff --git a/etc/profile-a-l/gpicview.profile b/etc/profile-a-l/gpicview.profile
index 436134e1b..26afe6e49 100644
--- a/etc/profile-a-l/gpicview.profile
+++ b/etc/profile-a-l/gpicview.profile
@@ -41,7 +41,7 @@ tracelog
41private-bin gpicview 41private-bin gpicview
42private-cache 42private-cache
43private-dev 43private-dev
44private-etc alternatives,fonts,group,ld.so.preload,passwd 44private-etc alternatives,fonts,group,ld.so.cache,ld.so.preload,passwd
45private-lib 45private-lib
46private-tmp 46private-tmp
47 47
diff --git a/etc/profile-a-l/gpredict.profile b/etc/profile-a-l/gpredict.profile
index e421c6a0b..511be6fcc 100644
--- a/etc/profile-a-l/gpredict.profile
+++ b/etc/profile-a-l/gpredict.profile
@@ -36,6 +36,6 @@ tracelog
36 36
37private-bin gpredict 37private-bin gpredict
38private-dev 38private-dev
39private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,pki,resolv.conf,ssl 39private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl
40private-tmp 40private-tmp
41 41
diff --git a/etc/profile-a-l/gradio.profile b/etc/profile-a-l/gradio.profile
index efb6b39c6..9cc25e45c 100644
--- a/etc/profile-a-l/gradio.profile
+++ b/etc/profile-a-l/gradio.profile
@@ -45,7 +45,7 @@ disable-mnt
45private-bin gradio 45private-bin gradio
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg 48private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg
49private-tmp 49private-tmp
50 50
51dbus-user filter 51dbus-user filter
diff --git a/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile b/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile
index 10d41735a..d76ca105f 100644
--- a/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile
+++ b/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile
@@ -40,7 +40,7 @@ private
40private-bin gravity-beams-and-evaporating-stars 40private-bin gravity-beams-and-evaporating-stars
41private-cache 41private-cache
42private-dev 42private-dev
43private-etc fonts,ld.so.preload,machine-id 43private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id
44private-tmp 44private-tmp
45 45
46dbus-user none 46dbus-user none
diff --git a/etc/profile-a-l/gtk-update-icon-cache.profile b/etc/profile-a-l/gtk-update-icon-cache.profile
index e38dc5c0c..ec8a614fd 100644
--- a/etc/profile-a-l/gtk-update-icon-cache.profile
+++ b/etc/profile-a-l/gtk-update-icon-cache.profile
@@ -46,7 +46,7 @@ disable-mnt
46private-bin gtk-update-icon-cache 46private-bin gtk-update-icon-cache
47private-cache 47private-cache
48private-dev 48private-dev
49private-etc ld.so.preload 49private-etc alternatives,ld.so.cache,ld.so.preload
50private-lib 50private-lib
51private-tmp 51private-tmp
52 52
diff --git a/etc/profile-a-l/hyperrogue.profile b/etc/profile-a-l/hyperrogue.profile
index 0baebdae1..74e0faa7f 100644
--- a/etc/profile-a-l/hyperrogue.profile
+++ b/etc/profile-a-l/hyperrogue.profile
@@ -44,7 +44,7 @@ private-bin hyperrogue
44private-cache 44private-cache
45private-cwd ${HOME} 45private-cwd ${HOME}
46private-dev 46private-dev
47private-etc fonts,ld.so.preload,machine-id 47private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id
48private-tmp 48private-tmp
49 49
50dbus-user none 50dbus-user none
diff --git a/etc/profile-a-l/ipcalc.profile b/etc/profile-a-l/ipcalc.profile
index 3200d1850..6eefd2945 100644
--- a/etc/profile-a-l/ipcalc.profile
+++ b/etc/profile-a-l/ipcalc.profile
@@ -50,7 +50,7 @@ private-bin bash,ipcalc,ipcalc-ng,perl,sh
50# private-cache 50# private-cache
51private-dev 51private-dev
52# empty etc directory 52# empty etc directory
53private-etc ld.so.preload 53private-etc alternatives,ld.so.cache,ld.so.preload
54private-lib 54private-lib
55private-opt none 55private-opt none
56private-tmp 56private-tmp
diff --git a/etc/profile-a-l/jerry.profile b/etc/profile-a-l/jerry.profile
index 59260dc64..6ca977512 100644
--- a/etc/profile-a-l/jerry.profile
+++ b/etc/profile-a-l/jerry.profile
@@ -34,7 +34,7 @@ tracelog
34 34
35private-bin bash,jerry,sh,stockfish 35private-bin bash,jerry,sh,stockfish
36private-dev 36private-dev
37private-etc fonts,gtk-2.0,gtk-3.0,ld.so.preload 37private-etc alternatives,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload
38private-tmp 38private-tmp
39 39
40dbus-user none 40dbus-user none
diff --git a/etc/profile-a-l/jumpnbump.profile b/etc/profile-a-l/jumpnbump.profile
index 8528ece7c..4a9232344 100644
--- a/etc/profile-a-l/jumpnbump.profile
+++ b/etc/profile-a-l/jumpnbump.profile
@@ -41,7 +41,7 @@ disable-mnt
41private-bin jumpnbump 41private-bin jumpnbump
42private-cache 42private-cache
43private-dev 43private-dev
44private-etc ld.so.preload 44private-etc alternatives,ld.so.cache,ld.so.preload
45private-tmp 45private-tmp
46 46
47dbus-user none 47dbus-user none
diff --git a/etc/profile-a-l/kalgebra.profile b/etc/profile-a-l/kalgebra.profile
index 5253a78b0..6ad50cf14 100644
--- a/etc/profile-a-l/kalgebra.profile
+++ b/etc/profile-a-l/kalgebra.profile
@@ -42,7 +42,7 @@ disable-mnt
42private-bin kalgebra,kalgebramobile 42private-bin kalgebra,kalgebramobile
43private-cache 43private-cache
44private-dev 44private-dev
45private-etc fonts,ld.so.preload,machine-id 45private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id
46private-tmp 46private-tmp
47 47
48dbus-user none 48dbus-user none
diff --git a/etc/profile-a-l/kazam.profile b/etc/profile-a-l/kazam.profile
index d88631005..277db1c24 100644
--- a/etc/profile-a-l/kazam.profile
+++ b/etc/profile-a-l/kazam.profile
@@ -49,7 +49,7 @@ disable-mnt
49# private-bin kazam,python* 49# private-bin kazam,python*
50private-cache 50private-cache
51private-dev 51private-dev
52private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.preload,machine-id,pulse,selinux,X11,xdg 52private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,pulse,selinux,X11,xdg
53private-tmp 53private-tmp
54 54
55dbus-system none 55dbus-system none
diff --git a/etc/profile-a-l/keepassx.profile b/etc/profile-a-l/keepassx.profile
index 616b87d7e..5e2d6d8df 100644
--- a/etc/profile-a-l/keepassx.profile
+++ b/etc/profile-a-l/keepassx.profile
@@ -41,7 +41,7 @@ tracelog
41 41
42private-bin keepassx,keepassx2 42private-bin keepassx,keepassx2
43private-dev 43private-dev
44private-etc alternatives,fonts,ld.so.preload,machine-id 44private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id
45private-tmp 45private-tmp
46 46
47dbus-user none 47dbus-user none
diff --git a/etc/profile-a-l/kid3.profile b/etc/profile-a-l/kid3.profile
index 8b35a8946..5563aa410 100644
--- a/etc/profile-a-l/kid3.profile
+++ b/etc/profile-a-l/kid3.profile
@@ -37,7 +37,7 @@ tracelog
37 37
38private-cache 38private-cache
39private-dev 39private-dev
40private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hostname,hosts,kde5rc,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl 40private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hostname,hosts,kde5rc,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl
41private-tmp 41private-tmp
42private-opt none 42private-opt none
43private-srv none 43private-srv none
diff --git a/etc/profile-a-l/klavaro.profile b/etc/profile-a-l/klavaro.profile
index 964175274..46164403b 100644
--- a/etc/profile-a-l/klavaro.profile
+++ b/etc/profile-a-l/klavaro.profile
@@ -45,7 +45,7 @@ disable-mnt
45private-bin bash,klavaro,sh,tclsh,tclsh* 45private-bin bash,klavaro,sh,tclsh,tclsh*
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc alternatives,fonts,ld.so.preload 48private-etc alternatives,fonts,ld.so.cache,ld.so.preload
49private-tmp 49private-tmp
50private-opt none 50private-opt none
51private-srv none 51private-srv none
diff --git a/etc/profile-a-l/ktouch.profile b/etc/profile-a-l/ktouch.profile
index 78eb2e8f5..44da8acca 100644
--- a/etc/profile-a-l/ktouch.profile
+++ b/etc/profile-a-l/ktouch.profile
@@ -46,7 +46,7 @@ disable-mnt
46private-bin ktouch 46private-bin ktouch
47private-cache 47private-cache
48private-dev 48private-dev
49private-etc alternatives,fonts,kde5rc,ld.so.preload,machine-id 49private-etc alternatives,fonts,kde5rc,ld.so.cache,ld.so.preload,machine-id
50private-tmp 50private-tmp
51 51
52dbus-user none 52dbus-user none
diff --git a/etc/profile-a-l/kube.profile b/etc/profile-a-l/kube.profile
index ad6b2f5fe..718cbbf40 100644
--- a/etc/profile-a-l/kube.profile
+++ b/etc/profile-a-l/kube.profile
@@ -68,7 +68,7 @@ tracelog
68private-bin kube,sink_synchronizer 68private-bin kube,sink_synchronizer
69private-cache 69private-cache
70private-dev 70private-dev
71private-etc alternatives,ca-certificates,crypto-policies,fonts,gcrypt,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.preload,pki,resolv.conf,selinux,ssl,xdg 71private-etc alternatives,ca-certificates,crypto-policies,fonts,gcrypt,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,pki,resolv.conf,selinux,ssl,xdg
72private-tmp 72private-tmp
73writable-run-user 73writable-run-user
74 74
diff --git a/etc/profile-a-l/links-common.profile b/etc/profile-a-l/links-common.profile
index dac3eaee3..84f5dc50d 100644
--- a/etc/profile-a-l/links-common.profile
+++ b/etc/profile-a-l/links-common.profile
@@ -51,7 +51,7 @@ disable-mnt
51private-bin sh 51private-bin sh
52private-cache 52private-cache
53private-dev 53private-dev
54private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl 54private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl
55# Add the next line to your links-common.local to allow external media players. 55# Add the next line to your links-common.local to allow external media players.
56# private-etc alsa,asound.conf,machine-id,openal,pulse 56# private-etc alsa,asound.conf,machine-id,openal,pulse
57private-tmp 57private-tmp
diff --git a/etc/profile-a-l/lollypop.profile b/etc/profile-a-l/lollypop.profile
index a590c5fb7..fde338ff0 100644
--- a/etc/profile-a-l/lollypop.profile
+++ b/etc/profile-a-l/lollypop.profile
@@ -37,6 +37,6 @@ seccomp
37shell none 37shell none
38 38
39private-dev 39private-dev
40private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg 40private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg
41private-tmp 41private-tmp
42 42
diff --git a/etc/profile-a-l/lyx.profile b/etc/profile-a-l/lyx.profile
index 3213f3674..ae2f2d434 100644
--- a/etc/profile-a-l/lyx.profile
+++ b/etc/profile-a-l/lyx.profile
@@ -32,7 +32,7 @@ apparmor
32machine-id 32machine-id
33 33
34# private-bin atril,dvilualatex,env,latex,lua*,luatex,lyx,lyxclient,okular,pdf2latex,pdflatex,pdftex,perl*,python*,qpdf,qpdfview,sh,tex2lyx,texmf,xelatex 34# private-bin atril,dvilualatex,env,latex,lua*,luatex,lyx,lyxclient,okular,pdf2latex,pdflatex,pdftex,perl*,python*,qpdf,qpdfview,sh,tex2lyx,texmf,xelatex
35private-etc alternatives,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.preload,locale,locale.alias,locale.conf,lyx,machine-id,mime.types,passwd,texmf,X11,xdg 35private-etc alternatives,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,locale,locale.alias,locale.conf,lyx,machine-id,mime.types,passwd,texmf,X11,xdg
36 36
37# Redirect 37# Redirect
38include latex-common.profile 38include latex-common.profile
diff --git a/etc/profile-m-z/Viber.profile b/etc/profile-m-z/Viber.profile
index ca7165a5d..89ca53af6 100644
--- a/etc/profile-m-z/Viber.profile
+++ b/etc/profile-m-z/Viber.profile
@@ -33,5 +33,5 @@ shell none
33 33
34disable-mnt 34disable-mnt
35private-bin awk,bash,dig,sh,Viber 35private-bin awk,bash,dig,sh,Viber
36private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hosts,ld.so.preload,localtime,machine-id,mailcap,nsswitch.conf,pki,proxychains.conf,pulse,resolv.conf,ssl,X11 36private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,mailcap,nsswitch.conf,pki,proxychains.conf,pulse,resolv.conf,ssl,X11
37private-tmp 37private-tmp
diff --git a/etc/profile-m-z/magicor.profile b/etc/profile-m-z/magicor.profile
index b7cba2421..47165dd3d 100644
--- a/etc/profile-m-z/magicor.profile
+++ b/etc/profile-m-z/magicor.profile
@@ -45,7 +45,7 @@ disable-mnt
45private-bin magicor,python2* 45private-bin magicor,python2*
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc ld.so.preload,machine-id 48private-etc alternatives,ld.so.cache,ld.so.preload,machine-id
49private-tmp 49private-tmp
50 50
51dbus-user none 51dbus-user none
diff --git a/etc/profile-m-z/man.profile b/etc/profile-m-z/man.profile
index b6038cc91..9c5959091 100644
--- a/etc/profile-m-z/man.profile
+++ b/etc/profile-m-z/man.profile
@@ -58,7 +58,7 @@ disable-mnt
58#private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim 58#private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim
59private-cache 59private-cache
60private-dev 60private-dev
61private-etc alternatives,fonts,groff,ld.so.preload,locale,locale.alias,locale.conf,man_db.conf,manpath.config,selinux,sysless,xdg 61private-etc alternatives,fonts,groff,ld.so.cache,ld.so.preload,locale,locale.alias,locale.conf,man_db.conf,manpath.config,selinux,sysless,xdg
62#private-tmp 62#private-tmp
63 63
64dbus-user none 64dbus-user none
diff --git a/etc/profile-m-z/masterpdfeditor.profile b/etc/profile-m-z/masterpdfeditor.profile
index dc2088a18..764d040ab 100644
--- a/etc/profile-m-z/masterpdfeditor.profile
+++ b/etc/profile-m-z/masterpdfeditor.profile
@@ -36,6 +36,6 @@ tracelog
36 36
37private-cache 37private-cache
38private-dev 38private-dev
39private-etc alternatives,fonts,ld.so.preload 39private-etc alternatives,fonts,ld.so.cache,ld.so.preload
40private-tmp 40private-tmp
41 41
diff --git a/etc/profile-m-z/mate-calc.profile b/etc/profile-m-z/mate-calc.profile
index cb14c6584..2be6b9af1 100644
--- a/etc/profile-m-z/mate-calc.profile
+++ b/etc/profile-m-z/mate-calc.profile
@@ -42,7 +42,7 @@ shell none
42 42
43disable-mnt 43disable-mnt
44private-bin mate-calc,mate-calculator 44private-bin mate-calc,mate-calculator
45private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload 45private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload
46private-dev 46private-dev
47private-opt none 47private-opt none
48private-tmp 48private-tmp
diff --git a/etc/profile-m-z/mate-color-select.profile b/etc/profile-m-z/mate-color-select.profile
index 97793abd5..e16b0fc6c 100644
--- a/etc/profile-m-z/mate-color-select.profile
+++ b/etc/profile-m-z/mate-color-select.profile
@@ -33,7 +33,7 @@ shell none
33 33
34disable-mnt 34disable-mnt
35private-bin mate-color-select 35private-bin mate-color-select
36private-etc alternatives,fonts,ld.so.preload 36private-etc alternatives,fonts,ld.so.cache,ld.so.preload
37private-dev 37private-dev
38private-lib 38private-lib
39private-tmp 39private-tmp
diff --git a/etc/profile-m-z/mate-dictionary.profile b/etc/profile-m-z/mate-dictionary.profile
index cb0002af6..469416304 100644
--- a/etc/profile-m-z/mate-dictionary.profile
+++ b/etc/profile-m-z/mate-dictionary.profile
@@ -37,7 +37,7 @@ shell none
37 37
38disable-mnt 38disable-mnt
39private-bin mate-dictionary 39private-bin mate-dictionary
40private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,pki,resolv.conf,ssl 40private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl
41private-opt mate-dictionary 41private-opt mate-dictionary
42private-dev 42private-dev
43private-tmp 43private-tmp
diff --git a/etc/profile-m-z/mcabber.profile b/etc/profile-m-z/mcabber.profile
index 87083f1e3..4c4a6aa76 100644
--- a/etc/profile-m-z/mcabber.profile
+++ b/etc/profile-m-z/mcabber.profile
@@ -31,4 +31,4 @@ shell none
31 31
32private-bin mcabber 32private-bin mcabber
33private-dev 33private-dev
34private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,pki,ssl 34private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,pki,ssl
diff --git a/etc/profile-m-z/mdr.profile b/etc/profile-m-z/mdr.profile
index 618a1fd3a..bcfd59cbb 100644
--- a/etc/profile-m-z/mdr.profile
+++ b/etc/profile-m-z/mdr.profile
@@ -45,7 +45,7 @@ disable-mnt
45private-bin mdr 45private-bin mdr
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc ld.so.preload 48private-etc alternatives,ld.so.cache,ld.so.preload
49private-lib 49private-lib
50private-tmp 50private-tmp
51 51
diff --git a/etc/profile-m-z/mediainfo.profile b/etc/profile-m-z/mediainfo.profile
index 9403321e2..9bfbaf745 100644
--- a/etc/profile-m-z/mediainfo.profile
+++ b/etc/profile-m-z/mediainfo.profile
@@ -42,7 +42,7 @@ x11 none
42private-bin mediainfo 42private-bin mediainfo
43private-cache 43private-cache
44private-dev 44private-dev
45private-etc alternatives,ld.so.preload 45private-etc alternatives,ld.so.cache,ld.so.preload
46private-tmp 46private-tmp
47 47
48dbus-user none 48dbus-user none
diff --git a/etc/profile-m-z/menulibre.profile b/etc/profile-m-z/menulibre.profile
index f9f7db3cb..ed0758a49 100644
--- a/etc/profile-m-z/menulibre.profile
+++ b/etc/profile-m-z/menulibre.profile
@@ -52,7 +52,7 @@ tracelog
52disable-mnt 52disable-mnt
53private-cache 53private-cache
54private-dev 54private-dev
55private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload,locale.alias,locale.conf,mime.types,nsswitch.conf,passwd,pki,selinux,X11,xdg 55private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,locale.alias,locale.conf,mime.types,nsswitch.conf,passwd,pki,selinux,X11,xdg
56private-tmp 56private-tmp
57 57
58dbus-user none 58dbus-user none
diff --git a/etc/profile-m-z/mindless.profile b/etc/profile-m-z/mindless.profile
index bcc7b232b..16ace7ce4 100644
--- a/etc/profile-m-z/mindless.profile
+++ b/etc/profile-m-z/mindless.profile
@@ -42,7 +42,7 @@ private
42private-bin mindless 42private-bin mindless
43private-cache 43private-cache
44private-dev 44private-dev
45private-etc fonts,ld.so.preload 45private-etc alternatives,fonts,ld.so.cache,ld.so.preload
46private-tmp 46private-tmp
47 47
48dbus-user none 48dbus-user none
diff --git a/etc/profile-m-z/mirrormagic.profile b/etc/profile-m-z/mirrormagic.profile
index 133a17350..be846ce63 100644
--- a/etc/profile-m-z/mirrormagic.profile
+++ b/etc/profile-m-z/mirrormagic.profile
@@ -44,7 +44,7 @@ private
44private-bin mirrormagic 44private-bin mirrormagic
45private-cache 45private-cache
46private-dev 46private-dev
47private-etc ld.so.preload,machine-id 47private-etc alternatives,ld.so.cache,ld.so.preload,machine-id
48private-tmp 48private-tmp
49 49
50dbus-user none 50dbus-user none
diff --git a/etc/profile-m-z/mocp.profile b/etc/profile-m-z/mocp.profile
index 79f603f92..313d78030 100644
--- a/etc/profile-m-z/mocp.profile
+++ b/etc/profile-m-z/mocp.profile
@@ -42,7 +42,7 @@ tracelog
42private-bin mocp 42private-bin mocp
43private-cache 43private-cache
44private-dev 44private-dev
45private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl 45private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl
46private-tmp 46private-tmp
47 47
48dbus-user none 48dbus-user none
diff --git a/etc/profile-m-z/mp3splt-gtk.profile b/etc/profile-m-z/mp3splt-gtk.profile
index 445691f6a..fe3c78b55 100644
--- a/etc/profile-m-z/mp3splt-gtk.profile
+++ b/etc/profile-m-z/mp3splt-gtk.profile
@@ -37,7 +37,7 @@ tracelog
37private-bin mp3splt-gtk 37private-bin mp3splt-gtk
38private-cache 38private-cache
39private-dev 39private-dev
40private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-3.0,ld.so.preload,machine-id,openal,pulse 40private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,openal,pulse
41private-tmp 41private-tmp
42 42
43dbus-user none 43dbus-user none
diff --git a/etc/profile-m-z/mp3splt.profile b/etc/profile-m-z/mp3splt.profile
index 4d6109250..c89c72ce4 100644
--- a/etc/profile-m-z/mp3splt.profile
+++ b/etc/profile-m-z/mp3splt.profile
@@ -44,7 +44,7 @@ disable-mnt
44private-bin flacsplt,mp3splt,mp3wrap,oggsplt 44private-bin flacsplt,mp3splt,mp3wrap,oggsplt
45private-cache 45private-cache
46private-dev 46private-dev
47private-etc alternatives,ld.so.preload 47private-etc alternatives,ld.so.cache,ld.so.preload
48private-tmp 48private-tmp
49 49
50memory-deny-write-execute 50memory-deny-write-execute
diff --git a/etc/profile-m-z/mpDris2.profile b/etc/profile-m-z/mpDris2.profile
index 597390914..18a839363 100644
--- a/etc/profile-m-z/mpDris2.profile
+++ b/etc/profile-m-z/mpDris2.profile
@@ -49,7 +49,7 @@ shell none
49private-bin mpDris2,notify-send,python* 49private-bin mpDris2,notify-send,python*
50private-cache 50private-cache
51private-dev 51private-dev
52private-etc alternatives,hosts,ld.so.preload,nsswitch.conf 52private-etc alternatives,hosts,ld.so.cache,ld.so.preload,nsswitch.conf
53private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotify.so.*,libpython*,python2*,python3* 53private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotify.so.*,libpython*,python2*,python3*
54private-tmp 54private-tmp
55 55
diff --git a/etc/profile-m-z/mpv.profile b/etc/profile-m-z/mpv.profile
index 74402a8de..efb11465b 100644
--- a/etc/profile-m-z/mpv.profile
+++ b/etc/profile-m-z/mpv.profile
@@ -74,7 +74,7 @@ seccomp.block-secondary
74shell none 74shell none
75tracelog 75tracelog
76 76
77private-bin env,mpv,python*,waf,youtube-dl 77private-bin env,mpv,python*,waf,youtube-dl,yt-dlp
78# private-cache causes slow OSD, see #2838 78# private-cache causes slow OSD, see #2838
79#private-cache 79#private-cache
80private-dev 80private-dev
diff --git a/etc/profile-m-z/mrrescue.profile b/etc/profile-m-z/mrrescue.profile
index 5b5902563..3fe88ec7f 100644
--- a/etc/profile-m-z/mrrescue.profile
+++ b/etc/profile-m-z/mrrescue.profile
@@ -52,7 +52,7 @@ disable-mnt
52private-bin love,mrrescue,sh 52private-bin love,mrrescue,sh
53private-cache 53private-cache
54private-dev 54private-dev
55private-etc ld.so.preload,machine-id 55private-etc alternatives,ld.so.cache,ld.so.preload,machine-id
56private-tmp 56private-tmp
57 57
58dbus-user none 58dbus-user none
diff --git a/etc/profile-m-z/ms-office.profile b/etc/profile-m-z/ms-office.profile
index 7b4a305e9..e15b14db7 100644
--- a/etc/profile-m-z/ms-office.profile
+++ b/etc/profile-m-z/ms-office.profile
@@ -35,7 +35,7 @@ tracelog
35 35
36disable-mnt 36disable-mnt
37private-bin bash,env,fonts,jak,ms-office,python*,sh 37private-bin bash,env,fonts,jak,ms-office,python*,sh
38private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,pki,resolv.conf,ssl 38private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl
39private-dev 39private-dev
40private-tmp 40private-tmp
41 41
diff --git a/etc/profile-m-z/mupdf-x11-curl.profile b/etc/profile-m-z/mupdf-x11-curl.profile
index b95ab2194..006f64ba8 100644
--- a/etc/profile-m-z/mupdf-x11-curl.profile
+++ b/etc/profile-m-z/mupdf-x11-curl.profile
@@ -12,7 +12,7 @@ ignore net none
12netfilter 12netfilter
13protocol unix,inet,inet6 13protocol unix,inet,inet6
14 14
15private-etc ca-certificates,crypto-policies,hosts,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl 15private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl
16 16
17# Redirect 17# Redirect
18include mupdf.profile 18include mupdf.profile
diff --git a/etc/profile-m-z/musixmatch.profile b/etc/profile-m-z/musixmatch.profile
index aab2ac19d..796d7fbb0 100644
--- a/etc/profile-m-z/musixmatch.profile
+++ b/etc/profile-m-z/musixmatch.profile
@@ -33,5 +33,5 @@ seccomp !chroot
33 33
34disable-mnt 34disable-mnt
35private-dev 35private-dev
36private-etc alternatives,asound.conf,ca-certificates,crypto-policies,ld.so.preload,machine-id,pki,pulse,ssl 36private-etc alternatives,asound.conf,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,machine-id,pki,pulse,ssl
37 37
diff --git a/etc/profile-m-z/mutt.profile b/etc/profile-m-z/mutt.profile
index fb923051f..d10c55549 100644
--- a/etc/profile-m-z/mutt.profile
+++ b/etc/profile-m-z/mutt.profile
@@ -134,7 +134,7 @@ tracelog
134# disable-mnt 134# disable-mnt
135private-cache 135private-cache
136private-dev 136private-dev
137private-etc alternatives,ca-certificates,crypto-policies,fonts,gai.conf,gcrypt,gnupg,gnutls,hostname,hosts,hosts.conf,ld.so.preload,mail,mailname,Mutt,Muttrc,Muttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,terminfo,xdg 137private-etc alternatives,ca-certificates,crypto-policies,fonts,gai.conf,gcrypt,gnupg,gnutls,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,mail,mailname,Mutt,Muttrc,Muttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,terminfo,xdg
138private-tmp 138private-tmp
139writable-run-user 139writable-run-user
140writable-var 140writable-var
diff --git a/etc/profile-m-z/mypaint.profile b/etc/profile-m-z/mypaint.profile
index bf01aaa0e..74301df06 100644
--- a/etc/profile-m-z/mypaint.profile
+++ b/etc/profile-m-z/mypaint.profile
@@ -43,7 +43,7 @@ tracelog
43 43
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload 46private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload
47private-tmp 47private-tmp
48 48
49dbus-user none 49dbus-user none
diff --git a/etc/profile-m-z/nano.profile b/etc/profile-m-z/nano.profile
index 23a30bf97..f7c1f0ff7 100644
--- a/etc/profile-m-z/nano.profile
+++ b/etc/profile-m-z/nano.profile
@@ -49,7 +49,7 @@ private-dev
49# Add the next lines to your nano.local if you want to edit files in /etc directly. 49# Add the next lines to your nano.local if you want to edit files in /etc directly.
50#ignore private-etc 50#ignore private-etc
51#writable-etc 51#writable-etc
52private-etc alternatives,ld.so.preload,nanorc 52private-etc alternatives,ld.so.cache,ld.so.preload,nanorc
53# Add the next line to your nano.local if you want to edit files in /var directly. 53# Add the next line to your nano.local if you want to edit files in /var directly.
54#writable-var 54#writable-var
55 55
diff --git a/etc/profile-m-z/neomutt.profile b/etc/profile-m-z/neomutt.profile
index 1e59a1490..f31cf9dcb 100644
--- a/etc/profile-m-z/neomutt.profile
+++ b/etc/profile-m-z/neomutt.profile
@@ -137,7 +137,7 @@ tracelog
137# disable-mnt 137# disable-mnt
138private-cache 138private-cache
139private-dev 139private-dev
140private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,hostname,hosts,hosts.conf,ld.so.preload,mail,mailname,Mutt,Muttrc,Muttrc.d,neomuttrc,neomuttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,xdg 140private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,mail,mailname,Mutt,Muttrc,Muttrc.d,neomuttrc,neomuttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,xdg
141private-tmp 141private-tmp
142writable-run-user 142writable-run-user
143writable-var 143writable-var
diff --git a/etc/profile-m-z/netactview.profile b/etc/profile-m-z/netactview.profile
index 57f026a0b..d6ac8d5bc 100644
--- a/etc/profile-m-z/netactview.profile
+++ b/etc/profile-m-z/netactview.profile
@@ -45,7 +45,7 @@ disable-mnt
45private-bin netactview,netactview_polkit 45private-bin netactview,netactview_polkit
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc alternatives,fonts,ld.so.preload 48private-etc alternatives,fonts,ld.so.cache,ld.so.preload
49private-lib 49private-lib
50private-tmp 50private-tmp
51 51
diff --git a/etc/profile-m-z/newsboat.profile b/etc/profile-m-z/newsboat.profile
index 34c6110cf..cf72bf802 100644
--- a/etc/profile-m-z/newsboat.profile
+++ b/etc/profile-m-z/newsboat.profile
@@ -53,7 +53,7 @@ disable-mnt
53private-bin gzip,lynx,newsboat,sh,w3m 53private-bin gzip,lynx,newsboat,sh,w3m
54private-cache 54private-cache
55private-dev 55private-dev
56private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,lynx.cfg,lynx.lss,pki,resolv.conf,ssl,terminfo 56private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,lynx.cfg,lynx.lss,pki,resolv.conf,ssl,terminfo
57private-tmp 57private-tmp
58 58
59dbus-user none 59dbus-user none
diff --git a/etc/profile-m-z/newsflash.profile b/etc/profile-m-z/newsflash.profile
index 56cedec03..9966a0e1b 100644
--- a/etc/profile-m-z/newsflash.profile
+++ b/etc/profile-m-z/newsflash.profile
@@ -51,7 +51,7 @@ disable-mnt
51private-bin com.gitlab.newsflash,newsflash 51private-bin com.gitlab.newsflash,newsflash
52private-cache 52private-cache
53private-dev 53private-dev
54private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pango,pki,resolv.conf,ssl,X11 54private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pango,pki,resolv.conf,ssl,X11
55private-tmp 55private-tmp
56 56
57dbus-user none 57dbus-user none
diff --git a/etc/profile-m-z/nomacs.profile b/etc/profile-m-z/nomacs.profile
index 0bed12b1f..7ffb09e56 100644
--- a/etc/profile-m-z/nomacs.profile
+++ b/etc/profile-m-z/nomacs.profile
@@ -41,5 +41,5 @@ tracelog
41#private-bin nomacs 41#private-bin nomacs
42private-cache 42private-cache
43private-dev 43private-dev
44private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,ld.so.preload,login.defs,machine-id,pki,resolv.conf,ssl 44private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.preload,login.defs,machine-id,pki,resolv.conf,ssl
45private-tmp 45private-tmp
diff --git a/etc/profile-m-z/noprofile.profile b/etc/profile-m-z/noprofile.profile
new file mode 100644
index 000000000..560ee9db3
--- /dev/null
+++ b/etc/profile-m-z/noprofile.profile
@@ -0,0 +1,28 @@
1# This is the weakest possible firejail profile.
2# If a program still fail with this profile, it is incompatible with firejail.
3# (from https://gist.github.com/rusty-snake/bb234cb3e50e1e4e7429f29a7931cc72)
4#
5# Usage:
6# 1. download
7# 2. firejail --profile=noprofile.profile /path/to/program
8
9# Keep in mind that even with this profile some things are done
10# which can break the program.
11# - some env-vars are cleared
12# - /etc/firejail/firejail.config can contain options such as 'force-nonewprivs yes'
13# - a new private pid-namespace is created
14# - a minimal hardcoded blacklist is applied
15# - ...
16
17noblacklist /sys/fs
18noblacklist /sys/module
19
20allow-debuggers
21allusers
22keep-config-pulse
23keep-dev-shm
24keep-var-tmp
25writable-etc
26writable-run-user
27writable-var
28writable-var-log
diff --git a/etc/profile-m-z/notify-send.profile b/etc/profile-m-z/notify-send.profile
index 8e51d8e78..9f23c099d 100644
--- a/etc/profile-m-z/notify-send.profile
+++ b/etc/profile-m-z/notify-send.profile
@@ -49,7 +49,7 @@ private
49private-bin notify-send 49private-bin notify-send
50private-cache 50private-cache
51private-dev 51private-dev
52private-etc ld.so.preload 52private-etc alternatives,ld.so.cache,ld.so.preload
53private-tmp 53private-tmp
54 54
55dbus-user filter 55dbus-user filter
diff --git a/etc/profile-m-z/nuclear.profile b/etc/profile-m-z/nuclear.profile
index 9e3093ea7..9f4a6ec46 100644
--- a/etc/profile-m-z/nuclear.profile
+++ b/etc/profile-m-z/nuclear.profile
@@ -18,7 +18,7 @@ whitelist ${HOME}/.config/nuclear
18no3d 18no3d
19 19
20# private-bin nuclear 20# private-bin nuclear
21private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg 21private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg
22private-opt nuclear 22private-opt nuclear
23 23
24# Redirect 24# Redirect
diff --git a/etc/profile-m-z/nyx.profile b/etc/profile-m-z/nyx.profile
index 9b431d76d..653591482 100644
--- a/etc/profile-m-z/nyx.profile
+++ b/etc/profile-m-z/nyx.profile
@@ -45,7 +45,7 @@ disable-mnt
45private-bin nyx,python* 45private-bin nyx,python*
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc alternatives,fonts,ld.so.preload,passwd,tor 48private-etc alternatives,fonts,ld.so.cache,ld.so.preload,passwd,tor
49private-opt none 49private-opt none
50private-srv none 50private-srv none
51private-tmp 51private-tmp
diff --git a/etc/profile-m-z/odt2txt.profile b/etc/profile-m-z/odt2txt.profile
index 7d2374ccf..de62f4114 100644
--- a/etc/profile-m-z/odt2txt.profile
+++ b/etc/profile-m-z/odt2txt.profile
@@ -38,7 +38,7 @@ x11 none
38private-bin odt2txt 38private-bin odt2txt
39private-cache 39private-cache
40private-dev 40private-dev
41private-etc alternatives,ld.so.preload 41private-etc alternatives,ld.so.cache,ld.so.preload
42private-tmp 42private-tmp
43 43
44dbus-user none 44dbus-user none
diff --git a/etc/profile-m-z/onboard.profile b/etc/profile-m-z/onboard.profile
index e70e5e81e..e05e58cad 100644
--- a/etc/profile-m-z/onboard.profile
+++ b/etc/profile-m-z/onboard.profile
@@ -50,7 +50,7 @@ disable-mnt
50private-cache 50private-cache
51private-bin onboard,python*,tput 51private-bin onboard,python*,tput
52private-dev 52private-dev
53private-etc alternatives,dbus-1,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.preload,locale,locale.alias,locale.conf,mime.types,selinux,X11,xdg 53private-etc alternatives,dbus-1,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,locale,locale.alias,locale.conf,mime.types,selinux,X11,xdg
54private-tmp 54private-tmp
55 55
56dbus-system none 56dbus-system none
diff --git a/etc/profile-m-z/openarena.profile b/etc/profile-m-z/openarena.profile
index de334defd..c3ac097a0 100644
--- a/etc/profile-m-z/openarena.profile
+++ b/etc/profile-m-z/openarena.profile
@@ -43,7 +43,7 @@ disable-mnt
43private-bin bash,cut,glxinfo,grep,head,openarena,openarena_ded,quake3,zenity 43private-bin bash,cut,glxinfo,grep,head,openarena,openarena_ded,quake3,zenity
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc drirc,ld.so.preload,machine-id,openal,passwd,selinux,udev,xdg 46private-etc alternatives,drirc,ld.so.cache,ld.so.preload,machine-id,openal,passwd,selinux,udev,xdg
47private-tmp 47private-tmp
48 48
49dbus-user none 49dbus-user none
diff --git a/etc/profile-m-z/openstego.profile b/etc/profile-m-z/openstego.profile
new file mode 100644
index 000000000..f6622b38d
--- /dev/null
+++ b/etc/profile-m-z/openstego.profile
@@ -0,0 +1,58 @@
1# Firejail profile for OpenStego
2# Description: Steganography application that provides data hiding and watermarking functionality
3# This file is overwritten after every install/update
4# Persistent local customizations
5include openstego.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/openstego.ini
10
11# Allow java (blacklisted by disable-devel.inc)
12include allow-java.inc
13
14include disable-common.inc
15include disable-devel.inc
16include disable-exec.inc
17include disable-interpreters.inc
18include disable-proc.inc
19include disable-programs.inc
20
21mkfile ${HOME}/openstego.ini
22whitelist ${HOME}/openstego.ini
23whitelist ${HOME}/.java
24whitelist ${PICTURES}
25whitelist ${DOCUMENTS}
26whitelist ${DESKTOP}
27whitelist /usr/share/java
28include whitelist-common.inc
29include whitelist-run-common.inc
30include whitelist-runuser-common.inc
31include whitelist-usr-share-common.inc
32include whitelist-var-common.inc
33
34caps.drop all
35machine-id
36net none
37no3d
38nogroups
39noinput
40nonewprivs
41noroot
42nosound
43notv
44nou2f
45novideo
46seccomp
47seccomp.block-secondary
48shell none
49tracelog
50
51disable-mnt
52private-bin bash,dirname,openstego,readlink,sh
53private-cache
54private-dev
55private-tmp
56
57dbus-user none
58dbus-system none
diff --git a/etc/profile-m-z/pandoc.profile b/etc/profile-m-z/pandoc.profile
index 460f60beb..c016b5103 100644
--- a/etc/profile-m-z/pandoc.profile
+++ b/etc/profile-m-z/pandoc.profile
@@ -50,7 +50,7 @@ x11 none
50disable-mnt 50disable-mnt
51private-cache 51private-cache
52private-dev 52private-dev
53private-etc alternatives,ld.so.preload,texlive,texmf 53private-etc alternatives,ld.so.cache,ld.so.preload,texlive,texmf
54private-tmp 54private-tmp
55 55
56dbus-user none 56dbus-user none
diff --git a/etc/profile-m-z/parole.profile b/etc/profile-m-z/parole.profile
index a4737d388..3d380542f 100644
--- a/etc/profile-m-z/parole.profile
+++ b/etc/profile-m-z/parole.profile
@@ -27,4 +27,4 @@ shell none
27 27
28private-bin dbus-launch,parole 28private-bin dbus-launch,parole
29private-cache 29private-cache
30private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.preload,machine-id,passwd,pki,pulse,ssl 30private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd,pki,pulse,ssl
diff --git a/etc/profile-m-z/pavucontrol.profile b/etc/profile-m-z/pavucontrol.profile
index 76f1c9704..d64aab200 100644
--- a/etc/profile-m-z/pavucontrol.profile
+++ b/etc/profile-m-z/pavucontrol.profile
@@ -45,7 +45,7 @@ disable-mnt
45private-bin pavucontrol 45private-bin pavucontrol
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc alternatives,asound.conf,avahi,fonts,ld.so.preload,machine-id,pulse 48private-etc alternatives,asound.conf,avahi,fonts,ld.so.cache,ld.so.preload,machine-id,pulse
49private-lib 49private-lib
50private-tmp 50private-tmp
51 51
diff --git a/etc/profile-m-z/pdfchain.profile b/etc/profile-m-z/pdfchain.profile
index 400fc3d77..41ec98a39 100644
--- a/etc/profile-m-z/pdfchain.profile
+++ b/etc/profile-m-z/pdfchain.profile
@@ -34,7 +34,7 @@ shell none
34 34
35private-bin pdfchain,pdftk,sh 35private-bin pdfchain,pdftk,sh
36private-dev 36private-dev
37private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload,xdg 37private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,xdg
38private-tmp 38private-tmp
39 39
40dbus-user none 40dbus-user none
diff --git a/etc/profile-m-z/pdftotext.profile b/etc/profile-m-z/pdftotext.profile
index b1c2dfb1c..9d2f2b95f 100644
--- a/etc/profile-m-z/pdftotext.profile
+++ b/etc/profile-m-z/pdftotext.profile
@@ -48,7 +48,7 @@ x11 none
48private-bin pdftotext 48private-bin pdftotext
49private-cache 49private-cache
50private-dev 50private-dev
51private-etc alternatives,ld.so.preload 51private-etc alternatives,ld.so.cache,ld.so.preload
52private-tmp 52private-tmp
53 53
54dbus-user none 54dbus-user none
diff --git a/etc/profile-m-z/peek.profile b/etc/profile-m-z/peek.profile
index e216742a4..f5c295b5d 100644
--- a/etc/profile-m-z/peek.profile
+++ b/etc/profile-m-z/peek.profile
@@ -48,7 +48,7 @@ tracelog
48disable-mnt 48disable-mnt
49private-bin bash,convert,ffmpeg,firejail,fish,peek,sh,which,zsh 49private-bin bash,convert,ffmpeg,firejail,fish,peek,sh,which,zsh
50private-dev 50private-dev
51private-etc dconf,firejail,fonts,gtk-3.0,ld.so.preload,login.defs,pango,passwd,X11 51private-etc alternatives,dconf,firejail,fonts,gtk-3.0,ld.so.cache,ld.so.preload,login.defs,pango,passwd,X11
52private-tmp 52private-tmp
53 53
54dbus-user filter 54dbus-user filter
diff --git a/etc/profile-m-z/photoflare.profile b/etc/profile-m-z/photoflare.profile
index c0d0ae4df..80efedec7 100644
--- a/etc/profile-m-z/photoflare.profile
+++ b/etc/profile-m-z/photoflare.profile
@@ -43,7 +43,7 @@ disable-mnt
43private-bin photoflare 43private-bin photoflare
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc alternatives,fonts,ld.so.preload,locale,locale.alias,locale.conf,mime.types,X11 46private-etc alternatives,fonts,ld.so.cache,ld.so.preload,locale,locale.alias,locale.conf,mime.types,X11
47private-tmp 47private-tmp
48 48
49dbus-user none 49dbus-user none
diff --git a/etc/profile-m-z/pingus.profile b/etc/profile-m-z/pingus.profile
index fb50e66ca..69c78740d 100644
--- a/etc/profile-m-z/pingus.profile
+++ b/etc/profile-m-z/pingus.profile
@@ -50,7 +50,7 @@ disable-mnt
50private-bin pingus,pingus.bin,sh 50private-bin pingus,pingus.bin,sh
51private-cache 51private-cache
52private-dev 52private-dev
53private-etc ld.so.preload,machine-id 53private-etc alternatives,ld.so.cache,ld.so.preload,machine-id
54private-tmp 54private-tmp
55 55
56dbus-user none 56dbus-user none
diff --git a/etc/profile-m-z/pkglog.profile b/etc/profile-m-z/pkglog.profile
index 23e21f347..69b954f53 100644
--- a/etc/profile-m-z/pkglog.profile
+++ b/etc/profile-m-z/pkglog.profile
@@ -44,7 +44,7 @@ private
44private-bin pkglog,python* 44private-bin pkglog,python*
45private-cache 45private-cache
46private-dev 46private-dev
47private-etc alternatives,ld.so.preload 47private-etc alternatives,ld.so.cache,ld.so.preload
48private-opt none 48private-opt none
49private-tmp 49private-tmp
50writable-var-log 50writable-var-log
diff --git a/etc/profile-m-z/plv.profile b/etc/profile-m-z/plv.profile
index a6b0768f1..38ccf72e8 100644
--- a/etc/profile-m-z/plv.profile
+++ b/etc/profile-m-z/plv.profile
@@ -46,7 +46,7 @@ disable-mnt
46private-bin plv 46private-bin plv
47private-cache 47private-cache
48private-dev 48private-dev
49private-etc alternatives,fonts,ld.so.preload 49private-etc alternatives,fonts,ld.so.cache,ld.so.preload
50private-opt none 50private-opt none
51private-tmp 51private-tmp
52writable-var-log 52writable-var-log
diff --git a/etc/profile-m-z/pngquant.profile b/etc/profile-m-z/pngquant.profile
index 534cc5943..6b989202f 100644
--- a/etc/profile-m-z/pngquant.profile
+++ b/etc/profile-m-z/pngquant.profile
@@ -47,7 +47,7 @@ x11 none
47private-bin pngquant 47private-bin pngquant
48private-cache 48private-cache
49private-dev 49private-dev
50private-etc alternatives,ld.so.preload 50private-etc alternatives,ld.so.cache,ld.so.preload
51private-tmp 51private-tmp
52 52
53dbus-user none 53dbus-user none
diff --git a/etc/profile-m-z/pragha.profile b/etc/profile-m-z/pragha.profile
index c9793433e..fd595c27a 100644
--- a/etc/profile-m-z/pragha.profile
+++ b/etc/profile-m-z/pragha.profile
@@ -33,6 +33,6 @@ seccomp
33shell none 33shell none
34 34
35private-dev 35private-dev
36private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg 36private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg
37private-tmp 37private-tmp
38 38
diff --git a/etc/profile-m-z/profanity.profile b/etc/profile-m-z/profanity.profile
index af0ca5d8f..25a248425 100644
--- a/etc/profile-m-z/profanity.profile
+++ b/etc/profile-m-z/profanity.profile
@@ -44,7 +44,7 @@ shell none
44private-bin profanity 44private-bin profanity
45private-cache 45private-cache
46private-dev 46private-dev
47private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,localtime,mime.types,nsswitch.conf,pki,resolv.conf,ssl 47private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,localtime,mime.types,nsswitch.conf,pki,resolv.conf,ssl
48private-tmp 48private-tmp
49 49
50dbus-user none 50dbus-user none
diff --git a/etc/profile-m-z/qgis.profile b/etc/profile-m-z/qgis.profile
index 4ebd556d6..555e1e41b 100644
--- a/etc/profile-m-z/qgis.profile
+++ b/etc/profile-m-z/qgis.profile
@@ -52,7 +52,7 @@ tracelog
52disable-mnt 52disable-mnt
53private-cache 53private-cache
54private-dev 54private-dev
55private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,machine-id,pki,QGIS,QGIS.conf,resolv.conf,ssl,Trolltech.conf 55private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,machine-id,pki,QGIS,QGIS.conf,resolv.conf,ssl,Trolltech.conf
56private-tmp 56private-tmp
57 57
58dbus-user none 58dbus-user none
diff --git a/etc/profile-m-z/qnapi.profile b/etc/profile-m-z/qnapi.profile
index 89cb5baa8..4a3ce366e 100644
--- a/etc/profile-m-z/qnapi.profile
+++ b/etc/profile-m-z/qnapi.profile
@@ -47,7 +47,7 @@ tracelog
47private-bin 7z,qnapi 47private-bin 7z,qnapi
48private-cache 48private-cache
49private-dev 49private-dev
50private-etc alternatives,fonts,ld.so.preload 50private-etc alternatives,fonts,ld.so.cache,ld.so.preload
51private-opt none 51private-opt none
52private-tmp 52private-tmp
53 53
diff --git a/etc/profile-m-z/qrencode.profile b/etc/profile-m-z/qrencode.profile
index 2d9fefe40..dd3f24875 100644
--- a/etc/profile-m-z/qrencode.profile
+++ b/etc/profile-m-z/qrencode.profile
@@ -47,7 +47,7 @@ disable-mnt
47private-bin qrencode 47private-bin qrencode
48private-cache 48private-cache
49private-dev 49private-dev
50private-etc ld.so.preload 50private-etc alternatives,ld.so.cache,ld.so.preload
51private-lib libpcre* 51private-lib libpcre*
52private-tmp 52private-tmp
53 53
diff --git a/etc/profile-m-z/regextester.profile b/etc/profile-m-z/regextester.profile
index 6b9144791..f1ce313e7 100644
--- a/etc/profile-m-z/regextester.profile
+++ b/etc/profile-m-z/regextester.profile
@@ -43,7 +43,7 @@ disable-mnt
43private-bin regextester 43private-bin regextester
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc alternatives,fonts,ld.so.preload 46private-etc alternatives,fonts,ld.so.cache,ld.so.preload
47private-lib libgranite.so.* 47private-lib libgranite.so.*
48private-tmp 48private-tmp
49 49
diff --git a/etc/profile-m-z/rsync-download_only.profile b/etc/profile-m-z/rsync-download_only.profile
index e49f10b7b..e44e55a12 100644
--- a/etc/profile-m-z/rsync-download_only.profile
+++ b/etc/profile-m-z/rsync-download_only.profile
@@ -49,7 +49,7 @@ disable-mnt
49private-bin rsync 49private-bin rsync
50private-cache 50private-cache
51private-dev 51private-dev
52private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl 52private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl
53private-tmp 53private-tmp
54 54
55dbus-user none 55dbus-user none
diff --git a/etc/profile-m-z/scorchwentbonkers.profile b/etc/profile-m-z/scorchwentbonkers.profile
index d256b2efe..70b5d844a 100644
--- a/etc/profile-m-z/scorchwentbonkers.profile
+++ b/etc/profile-m-z/scorchwentbonkers.profile
@@ -43,7 +43,7 @@ disable-mnt
43private-bin scorchwentbonkers 43private-bin scorchwentbonkers
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc alsa,asound.conf,ld.so.preload,machine-id,pulse 46private-etc alsa,alternatives,asound.conf,ld.so.cache,ld.so.preload,machine-id,pulse
47private-tmp 47private-tmp
48 48
49dbus-user none 49dbus-user none
diff --git a/etc/profile-m-z/seahorse-adventures.profile b/etc/profile-m-z/seahorse-adventures.profile
index cb3378597..72d6d5cf7 100644
--- a/etc/profile-m-z/seahorse-adventures.profile
+++ b/etc/profile-m-z/seahorse-adventures.profile
@@ -48,7 +48,7 @@ private
48private-bin bash,dash,python*,seahorse-adventures,sh 48private-bin bash,dash,python*,seahorse-adventures,sh
49private-cache 49private-cache
50private-dev 50private-dev
51private-etc ld.so.preload,machine-id 51private-etc alternatives,ld.so.cache,ld.so.preload,machine-id
52private-tmp 52private-tmp
53 53
54dbus-user none 54dbus-user none
diff --git a/etc/profile-m-z/seahorse-tool.profile b/etc/profile-m-z/seahorse-tool.profile
index f08b852db..9ef174606 100644
--- a/etc/profile-m-z/seahorse-tool.profile
+++ b/etc/profile-m-z/seahorse-tool.profile
@@ -8,7 +8,7 @@ include seahorse-tool.local
8#include globals.local 8#include globals.local
9 9
10# private-etc workaround for: #2877 10# private-etc workaround for: #2877
11private-etc firejail,ld.so.preload,login.defs,passwd 11private-etc alternatives,firejail,ld.so.cache,ld.so.preload,login.defs,passwd
12private-tmp 12private-tmp
13 13
14# Redirect 14# Redirect
diff --git a/etc/profile-m-z/seahorse.profile b/etc/profile-m-z/seahorse.profile
index 94a27da87..7382e4712 100644
--- a/etc/profile-m-z/seahorse.profile
+++ b/etc/profile-m-z/seahorse.profile
@@ -60,7 +60,7 @@ tracelog
60disable-mnt 60disable-mnt
61private-cache 61private-cache
62private-dev 62private-dev
63private-etc ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssh,ssl,X11 63private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssh,ssl,X11
64writable-run-user 64writable-run-user
65 65
66dbus-user filter 66dbus-user filter
diff --git a/etc/profile-m-z/shotwell.profile b/etc/profile-m-z/shotwell.profile
index 304a1cda2..3b569eeaf 100644
--- a/etc/profile-m-z/shotwell.profile
+++ b/etc/profile-m-z/shotwell.profile
@@ -49,7 +49,7 @@ tracelog
49private-bin shotwell 49private-bin shotwell
50private-cache 50private-cache
51private-dev 51private-dev
52private-etc alternatives,fonts,ld.so.preload,machine-id 52private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id
53private-opt none 53private-opt none
54private-tmp 54private-tmp
55 55
diff --git a/etc/profile-m-z/softmaker-common.profile b/etc/profile-m-z/softmaker-common.profile
index 47468a531..099e6a2ad 100644
--- a/etc/profile-m-z/softmaker-common.profile
+++ b/etc/profile-m-z/softmaker-common.profile
@@ -43,7 +43,7 @@ tracelog
43private-bin freeoffice-planmaker,freeoffice-presentations,freeoffice-textmaker,planmaker18,planmaker18free,presentations18,presentations18free,sh,textmaker18,textmaker18free 43private-bin freeoffice-planmaker,freeoffice-presentations,freeoffice-textmaker,planmaker18,planmaker18free,presentations18,presentations18free,sh,textmaker18,textmaker18free
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,SoftMaker,ssl 46private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,SoftMaker,ssl
47private-tmp 47private-tmp
48 48
49dbus-user none 49dbus-user none
diff --git a/etc/profile-m-z/sqlitebrowser.profile b/etc/profile-m-z/sqlitebrowser.profile
index 21a77a0d1..deaf37f52 100644
--- a/etc/profile-m-z/sqlitebrowser.profile
+++ b/etc/profile-m-z/sqlitebrowser.profile
@@ -42,7 +42,7 @@ shell none
42private-bin sqlitebrowser 42private-bin sqlitebrowser
43private-cache 43private-cache
44private-dev 44private-dev
45private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.preload,machine-id,passwd,pki,ssl 45private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd,pki,ssl
46private-tmp 46private-tmp
47 47
48# breaks proxy creation 48# breaks proxy creation
diff --git a/etc/profile-m-z/strawberry.profile b/etc/profile-m-z/strawberry.profile
index 50ecc3432..32e43f079 100644
--- a/etc/profile-m-z/strawberry.profile
+++ b/etc/profile-m-z/strawberry.profile
@@ -43,7 +43,7 @@ disable-mnt
43private-bin strawberry,strawberry-tagreader 43private-bin strawberry,strawberry-tagreader
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl 46private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl
47private-tmp 47private-tmp
48 48
49dbus-system none 49dbus-system none
diff --git a/etc/profile-m-z/subdownloader.profile b/etc/profile-m-z/subdownloader.profile
index 65cb678d0..a9f22085b 100644
--- a/etc/profile-m-z/subdownloader.profile
+++ b/etc/profile-m-z/subdownloader.profile
@@ -44,7 +44,7 @@ tracelog
44 44
45private-cache 45private-cache
46private-dev 46private-dev
47private-etc alternatives,fonts,ld.so.preload 47private-etc alternatives,fonts,ld.so.cache,ld.so.preload
48private-tmp 48private-tmp
49 49
50dbus-user none 50dbus-user none
diff --git a/etc/profile-m-z/supertux2.profile b/etc/profile-m-z/supertux2.profile
index d48065c4b..464fa1b08 100644
--- a/etc/profile-m-z/supertux2.profile
+++ b/etc/profile-m-z/supertux2.profile
@@ -44,7 +44,7 @@ tracelog
44disable-mnt 44disable-mnt
45# private-bin supertux2 45# private-bin supertux2
46private-cache 46private-cache
47private-etc ld.so.preload,machine-id 47private-etc alternatives,ld.so.cache,ld.so.preload,machine-id
48private-dev 48private-dev
49private-tmp 49private-tmp
50 50
diff --git a/etc/profile-m-z/supertuxkart.profile b/etc/profile-m-z/supertuxkart.profile
index 5b5b4aae5..473472251 100644
--- a/etc/profile-m-z/supertuxkart.profile
+++ b/etc/profile-m-z/supertuxkart.profile
@@ -54,7 +54,7 @@ private-bin supertuxkart
54private-cache 54private-cache
55# Add the next line to your supertuxkart.local if you do not need controller support. 55# Add the next line to your supertuxkart.local if you do not need controller support.
56#private-dev 56#private-dev
57private-etc alternatives,ca-certificates,crypto-policies,drirc,hosts,ld.so.preload,machine-id,openal,pki,resolv.conf,ssl 57private-etc alternatives,ca-certificates,crypto-policies,drirc,hosts,ld.so.cache,ld.so.preload,machine-id,openal,pki,resolv.conf,ssl
58private-tmp 58private-tmp
59private-opt none 59private-opt none
60private-srv none 60private-srv none
diff --git a/etc/profile-m-z/surf.profile b/etc/profile-m-z/surf.profile
index cfecb6f62..c04f00cab 100644
--- a/etc/profile-m-z/surf.profile
+++ b/etc/profile-m-z/surf.profile
@@ -34,6 +34,6 @@ tracelog
34disable-mnt 34disable-mnt
35private-bin bash,curl,dmenu,ls,printf,sed,sh,sleep,st,stterm,surf,xargs,xprop 35private-bin bash,curl,dmenu,ls,printf,sed,sh,sleep,st,stterm,surf,xargs,xprop
36private-dev 36private-dev
37private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,ld.so.preload,machine-id,passwd,pki,resolv.conf,ssl 37private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,ld.so.cache,ld.so.preload,machine-id,passwd,pki,resolv.conf,ssl
38private-tmp 38private-tmp
39 39
diff --git a/etc/profile-m-z/tar.profile b/etc/profile-m-z/tar.profile
index 388805f31..0817adda8 100644
--- a/etc/profile-m-z/tar.profile
+++ b/etc/profile-m-z/tar.profile
@@ -14,7 +14,7 @@ ignore include disable-shell.inc
14# all capabilities this is automatically read-only. 14# all capabilities this is automatically read-only.
15noblacklist /var/lib/pacman 15noblacklist /var/lib/pacman
16 16
17private-etc alternatives,group,ld.so.preload,localtime,login.defs,passwd 17private-etc alternatives,group,ld.so.cache,ld.so.preload,localtime,login.defs,passwd
18#private-lib libfakeroot,liblzma.so.*,libreadline.so.* 18#private-lib libfakeroot,liblzma.so.*,libreadline.so.*
19# Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) 19# Debian based distributions need this for 'dpkg --unpack' (incl. synaptic)
20writable-var 20writable-var
diff --git a/etc/profile-m-z/teams-for-linux.profile b/etc/profile-m-z/teams-for-linux.profile
index 310c440b1..ee19bcd00 100644
--- a/etc/profile-m-z/teams-for-linux.profile
+++ b/etc/profile-m-z/teams-for-linux.profile
@@ -20,7 +20,7 @@ mkdir ${HOME}/.config/teams-for-linux
20whitelist ${HOME}/.config/teams-for-linux 20whitelist ${HOME}/.config/teams-for-linux
21 21
22private-bin bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,teams-for-linux,tr,xdg-mime,xdg-open,zsh 22private-bin bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,teams-for-linux,tr,xdg-mime,xdg-open,zsh
23private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,resolv.conf,ssl 23private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,resolv.conf,ssl
24 24
25# Redirect 25# Redirect
26include electron.profile 26include electron.profile
diff --git a/etc/profile-m-z/telnet.profile b/etc/profile-m-z/telnet.profile
new file mode 100644
index 000000000..0b0510460
--- /dev/null
+++ b/etc/profile-m-z/telnet.profile
@@ -0,0 +1,54 @@
1# Firejail profile for ftp
2# Description: standard File Access Protocol utility
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include telnet.local
7# Persistent global definitions
8include globals.local
9
10noblacklist ${PATH}/telnet
11
12include disable-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-proc.inc
17include disable-programs.inc
18#include disable-shell.inc
19include disable-write-mnt.inc
20include disable-X11.inc
21include disable-xdg.inc
22
23apparmor
24caps.drop all
25ipc-namespace
26machine-id
27netfilter
28no3d
29nodvd
30nogroups
31noinput
32nonewprivs
33noroot
34nosound
35notv
36nou2f
37novideo
38protocol inet,inet6
39seccomp
40shell none
41tracelog
42
43#disable-mnt
44#private-bin PROGRAMS
45private-cache
46private-dev
47#private-etc FILES
48private-tmp
49
50dbus-user none
51dbus-system none
52
53memory-deny-write-execute
54noexec ${HOME}
diff --git a/etc/profile-m-z/tilp.profile b/etc/profile-m-z/tilp.profile
index 07212a452..d2db44b1c 100644
--- a/etc/profile-m-z/tilp.profile
+++ b/etc/profile-m-z/tilp.profile
@@ -30,6 +30,6 @@ tracelog
30disable-mnt 30disable-mnt
31private-bin tilp 31private-bin tilp
32private-cache 32private-cache
33private-etc alternatives,fonts,ld.so.preload 33private-etc alternatives,fonts,ld.so.cache,ld.so.preload
34private-tmp 34private-tmp
35 35
diff --git a/etc/profile-m-z/tin.profile b/etc/profile-m-z/tin.profile
index a43e53aae..1d4ee9370 100644
--- a/etc/profile-m-z/tin.profile
+++ b/etc/profile-m-z/tin.profile
@@ -58,7 +58,7 @@ disable-mnt
58private-bin rtin,tin 58private-bin rtin,tin
59private-cache 59private-cache
60private-dev 60private-dev
61private-etc ld.so.preload,passwd,resolv.conf,terminfo,tin 61private-etc alternatives,ld.so.cache,ld.so.preload,passwd,resolv.conf,terminfo,tin
62private-lib terminfo 62private-lib terminfo
63private-tmp 63private-tmp
64 64
diff --git a/etc/profile-m-z/tor.profile b/etc/profile-m-z/tor.profile
index 312123f59..d8cd8eb44 100644
--- a/etc/profile-m-z/tor.profile
+++ b/etc/profile-m-z/tor.profile
@@ -46,6 +46,6 @@ private
46private-bin bash,tor 46private-bin bash,tor
47private-cache 47private-cache
48private-dev 48private-dev
49private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,passwd,pki,ssl,tor 49private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,passwd,pki,ssl,tor
50private-tmp 50private-tmp
51writable-var 51writable-var
diff --git a/etc/profile-m-z/transgui.profile b/etc/profile-m-z/transgui.profile
index 0e23b7843..4acb8e7e8 100644
--- a/etc/profile-m-z/transgui.profile
+++ b/etc/profile-m-z/transgui.profile
@@ -45,7 +45,7 @@ tracelog
45private-bin geoiplookup,geoiplookup6,transgui 45private-bin geoiplookup,geoiplookup6,transgui
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc alternatives,fonts,ld.so.preload 48private-etc alternatives,fonts,ld.so.cache,ld.so.preload
49private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.* 49private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.*
50private-tmp 50private-tmp
51 51
diff --git a/etc/profile-m-z/transmission-cli.profile b/etc/profile-m-z/transmission-cli.profile
index b3fab083c..8a1711e97 100644
--- a/etc/profile-m-z/transmission-cli.profile
+++ b/etc/profile-m-z/transmission-cli.profile
@@ -8,7 +8,7 @@ include transmission-cli.local
8include globals.local 8include globals.local
9 9
10private-bin transmission-cli 10private-bin transmission-cli
11private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl 11private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl
12 12
13# Redirect 13# Redirect
14include transmission-common.profile 14include transmission-common.profile
diff --git a/etc/profile-m-z/transmission-daemon.profile b/etc/profile-m-z/transmission-daemon.profile
index 9d91b8b81..5d28f2f10 100644
--- a/etc/profile-m-z/transmission-daemon.profile
+++ b/etc/profile-m-z/transmission-daemon.profile
@@ -17,7 +17,7 @@ caps.keep ipc_lock,net_bind_service,setgid,setuid,sys_chroot
17protocol packet 17protocol packet
18 18
19private-bin transmission-daemon 19private-bin transmission-daemon
20private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl 20private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl
21 21
22read-write /var/lib/transmission 22read-write /var/lib/transmission
23writable-var-log 23writable-var-log
diff --git a/etc/profile-m-z/transmission-remote-gtk.profile b/etc/profile-m-z/transmission-remote-gtk.profile
index 20d54500f..6a0f1bde3 100644
--- a/etc/profile-m-z/transmission-remote-gtk.profile
+++ b/etc/profile-m-z/transmission-remote-gtk.profile
@@ -12,7 +12,7 @@ noblacklist ${HOME}/.config/transmission-remote-gtk
12mkdir ${HOME}/.config/transmission-remote-gtk 12mkdir ${HOME}/.config/transmission-remote-gtk
13whitelist ${HOME}/.config/transmission-remote-gtk 13whitelist ${HOME}/.config/transmission-remote-gtk
14 14
15private-etc fonts,hostname,hosts,ld.so.preload,resolv.conf 15private-etc alternatives,fonts,hostname,hosts,ld.so.cache,ld.so.preload,resolv.conf
16# Problems with private-lib (see issue #2889) 16# Problems with private-lib (see issue #2889)
17ignore private-lib 17ignore private-lib
18 18
diff --git a/etc/profile-m-z/transmission-remote.profile b/etc/profile-m-z/transmission-remote.profile
index ad4ad2172..565433d99 100644
--- a/etc/profile-m-z/transmission-remote.profile
+++ b/etc/profile-m-z/transmission-remote.profile
@@ -8,7 +8,7 @@ include transmission-remote.local
8include globals.local 8include globals.local
9 9
10private-bin transmission-remote 10private-bin transmission-remote
11private-etc alternatives,hosts,ld.so.preload,nsswitch.conf 11private-etc alternatives,hosts,ld.so.cache,ld.so.preload,nsswitch.conf
12 12
13# Redirect 13# Redirect
14include transmission-common.profile 14include transmission-common.profile
diff --git a/etc/profile-m-z/transmission-show.profile b/etc/profile-m-z/transmission-show.profile
index 822a368da..0a5826ec4 100644
--- a/etc/profile-m-z/transmission-show.profile
+++ b/etc/profile-m-z/transmission-show.profile
@@ -8,7 +8,7 @@ include transmission-show.local
8include globals.local 8include globals.local
9 9
10private-bin transmission-show 10private-bin transmission-show
11private-etc alternatives,hosts,ld.so.preload,nsswitch.conf 11private-etc alternatives,hosts,ld.so.cache,ld.so.preload,nsswitch.conf
12 12
13# Redirect 13# Redirect
14include transmission-common.profile 14include transmission-common.profile
diff --git a/etc/profile-m-z/trojita.profile b/etc/profile-m-z/trojita.profile
index 1959aee1e..60a192ac1 100644
--- a/etc/profile-m-z/trojita.profile
+++ b/etc/profile-m-z/trojita.profile
@@ -54,7 +54,7 @@ tracelog
54private-bin trojita 54private-bin trojita
55private-cache 55private-cache
56private-dev 56private-dev
57private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.preload,pki,resolv.conf,selinux,ssl,xdg 57private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.preload,pki,resolv.conf,selinux,ssl,xdg
58private-tmp 58private-tmp
59 59
60dbus-user filter 60dbus-user filter
diff --git a/etc/profile-m-z/twitch.profile b/etc/profile-m-z/twitch.profile
index bd2f1bcf9..987a2b719 100644
--- a/etc/profile-m-z/twitch.profile
+++ b/etc/profile-m-z/twitch.profile
@@ -18,7 +18,7 @@ mkdir ${HOME}/.config/Twitch
18whitelist ${HOME}/.config/Twitch 18whitelist ${HOME}/.config/Twitch
19 19
20private-bin electron,electron[0-9],electron[0-9][0-9],twitch 20private-bin electron,electron[0-9],electron[0-9][0-9],twitch
21private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg 21private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg
22private-opt Twitch 22private-opt Twitch
23 23
24# Redirect 24# Redirect
diff --git a/etc/profile-m-z/unf.profile b/etc/profile-m-z/unf.profile
index 685e74e25..1b82ad881 100644
--- a/etc/profile-m-z/unf.profile
+++ b/etc/profile-m-z/unf.profile
@@ -49,7 +49,7 @@ private-bin unf
49private-cache 49private-cache
50?HAS_APPIMAGE: ignore private-dev 50?HAS_APPIMAGE: ignore private-dev
51private-dev 51private-dev
52private-etc alternatives,ld.so.preload 52private-etc alternatives,ld.so.cache,ld.so.preload
53private-lib gcc/*/*/libgcc_s.so.* 53private-lib gcc/*/*/libgcc_s.so.*
54private-tmp 54private-tmp
55 55
diff --git a/etc/profile-m-z/unrar.profile b/etc/profile-m-z/unrar.profile
index 761ee91c5..443d1f415 100644
--- a/etc/profile-m-z/unrar.profile
+++ b/etc/profile-m-z/unrar.profile
@@ -8,7 +8,7 @@ include unrar.local
8include globals.local 8include globals.local
9 9
10private-bin unrar 10private-bin unrar
11private-etc alternatives,group,ld.so.preload,localtime,passwd 11private-etc alternatives,group,ld.so.cache,ld.so.preload,localtime,passwd
12private-tmp 12private-tmp
13 13
14# Redirect 14# Redirect
diff --git a/etc/profile-m-z/unzip.profile b/etc/profile-m-z/unzip.profile
index 981826b16..97df693ba 100644
--- a/etc/profile-m-z/unzip.profile
+++ b/etc/profile-m-z/unzip.profile
@@ -10,7 +10,7 @@ include globals.local
10# GNOME Shell integration (chrome-gnome-shell) 10# GNOME Shell integration (chrome-gnome-shell)
11noblacklist ${HOME}/.local/share/gnome-shell 11noblacklist ${HOME}/.local/share/gnome-shell
12 12
13private-etc alternatives,group,ld.so.preload,localtime,passwd 13private-etc alternatives,group,ld.so.cache,ld.so.preload,localtime,passwd
14 14
15# Redirect 15# Redirect
16include archiver-common.profile 16include archiver-common.profile
diff --git a/etc/profile-m-z/uudeview.profile b/etc/profile-m-z/uudeview.profile
index 3b38f16e0..426766e17 100644
--- a/etc/profile-m-z/uudeview.profile
+++ b/etc/profile-m-z/uudeview.profile
@@ -41,7 +41,7 @@ x11 none
41private-bin uudeview 41private-bin uudeview
42private-cache 42private-cache
43private-dev 43private-dev
44private-etc alternatives,ld.so.preload 44private-etc alternatives,ld.so.cache,ld.so.preload
45 45
46dbus-user none 46dbus-user none
47dbus-system none 47dbus-system none
diff --git a/etc/profile-m-z/viewnior.profile b/etc/profile-m-z/viewnior.profile
index ed2f0103b..585a8eddb 100644
--- a/etc/profile-m-z/viewnior.profile
+++ b/etc/profile-m-z/viewnior.profile
@@ -43,7 +43,7 @@ tracelog
43private-bin viewnior 43private-bin viewnior
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc alternatives,fonts,ld.so.preload,machine-id 46private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id
47private-tmp 47private-tmp
48 48
49dbus-user none 49dbus-user none
diff --git a/etc/profile-m-z/virtualbox.profile b/etc/profile-m-z/virtualbox.profile
index a6d3eaafd..227ad83cc 100644
--- a/etc/profile-m-z/virtualbox.profile
+++ b/etc/profile-m-z/virtualbox.profile
@@ -45,7 +45,7 @@ tracelog
45#disable-mnt 45#disable-mnt
46#private-bin awk,basename,bash,env,gawk,grep,ps,readlink,sh,virtualbox,VirtualBox,VBox*,vbox*,whoami 46#private-bin awk,basename,bash,env,gawk,grep,ps,readlink,sh,virtualbox,VirtualBox,VBox*,vbox*,whoami
47private-cache 47private-cache
48private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,pulse,resolv.conf,ssl 48private-etc alsa,alternatives,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,pulse,resolv.conf,ssl
49private-tmp 49private-tmp
50 50
51dbus-user none 51dbus-user none
diff --git a/etc/profile-m-z/vmware-view.profile b/etc/profile-m-z/vmware-view.profile
index b2b019ff4..278a66149 100644
--- a/etc/profile-m-z/vmware-view.profile
+++ b/etc/profile-m-z/vmware-view.profile
@@ -7,6 +7,7 @@ include vmware-view.local
7include globals.local 7include globals.local
8 8
9noblacklist ${HOME}/.vmware 9noblacklist ${HOME}/.vmware
10noblacklist /usr/lib/vmware
10 11
11noblacklist /sbin 12noblacklist /sbin
12noblacklist /usr/sbin 13noblacklist /usr/sbin
diff --git a/etc/profile-m-z/vmware.profile b/etc/profile-m-z/vmware.profile
index 8e25daee0..57fbbae96 100644
--- a/etc/profile-m-z/vmware.profile
+++ b/etc/profile-m-z/vmware.profile
@@ -8,6 +8,7 @@ include globals.local
8 8
9noblacklist ${HOME}/.cache/vmware 9noblacklist ${HOME}/.cache/vmware
10noblacklist ${HOME}/.vmware 10noblacklist ${HOME}/.vmware
11noblacklist /usr/lib/vmware
11 12
12include disable-common.inc 13include disable-common.inc
13include disable-devel.inc 14include disable-devel.inc
@@ -38,6 +39,6 @@ tracelog
38#disable-mnt 39#disable-mnt
39# Add the next line to your vmware.local to enable private-bin. 40# Add the next line to your vmware.local to enable private-bin.
40#private-bin env,bash,sh,ovftool,vmafossexec,vmaf_*,vmnet-*,vmplayer,vmrest,vmrun,vmss2core,vmstat,vmware,vmware-* 41#private-bin env,bash,sh,ovftool,vmafossexec,vmaf_*,vmnet-*,vmplayer,vmrest,vmrun,vmss2core,vmstat,vmware,vmware-*
41private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl,vmware,vmware-installer,vmware-vix 42private-etc alsa,alternatives,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl,vmware,vmware-installer,vmware-vix
42dbus-user none 43dbus-user none
43dbus-system none 44dbus-system none
diff --git a/etc/profile-m-z/w3m.profile b/etc/profile-m-z/w3m.profile
index d2e30e824..c9e209142 100644
--- a/etc/profile-m-z/w3m.profile
+++ b/etc/profile-m-z/w3m.profile
@@ -62,7 +62,7 @@ disable-mnt
62private-bin perl,sh,w3m 62private-bin perl,sh,w3m
63private-cache 63private-cache
64private-dev 64private-dev
65private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,mailcap,nsswitch.conf,pki,resolv.conf,ssl 65private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,mailcap,nsswitch.conf,pki,resolv.conf,ssl
66private-tmp 66private-tmp
67 67
68dbus-user none 68dbus-user none
diff --git a/etc/profile-m-z/warmux.profile b/etc/profile-m-z/warmux.profile
index fc59b7239..0a6f19b1e 100644
--- a/etc/profile-m-z/warmux.profile
+++ b/etc/profile-m-z/warmux.profile
@@ -49,7 +49,7 @@ disable-mnt
49private-bin warmux 49private-bin warmux
50private-cache 50private-cache
51private-dev 51private-dev
52private-etc ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.preload,machine-id,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl 52private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl
53private-tmp 53private-tmp
54 54
55dbus-user none 55dbus-user none
diff --git a/etc/profile-m-z/whalebird.profile b/etc/profile-m-z/whalebird.profile
index ae3944561..92ebebdae 100644
--- a/etc/profile-m-z/whalebird.profile
+++ b/etc/profile-m-z/whalebird.profile
@@ -21,7 +21,7 @@ whitelist ${HOME}/.config/Whalebird
21no3d 21no3d
22 22
23private-bin electron,electron[0-9],electron[0-9][0-9],whalebird 23private-bin electron,electron[0-9],electron[0-9][0-9],whalebird
24private-etc fonts,ld.so.preload,machine-id 24private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id
25 25
26# Redirect 26# Redirect
27include electron.profile 27include electron.profile
diff --git a/etc/profile-m-z/whois.profile b/etc/profile-m-z/whois.profile
index 0650e41ad..afff6f587 100644
--- a/etc/profile-m-z/whois.profile
+++ b/etc/profile-m-z/whois.profile
@@ -47,7 +47,7 @@ private
47private-bin bash,sh,whois 47private-bin bash,sh,whois
48private-cache 48private-cache
49private-dev 49private-dev
50private-etc alternatives,hosts,jwhois.conf,ld.so.preload,resolv.conf,services,whois.conf 50private-etc alternatives,hosts,jwhois.conf,ld.so.cache,ld.so.preload,resolv.conf,services,whois.conf
51private-lib gconv 51private-lib gconv
52private-tmp 52private-tmp
53 53
diff --git a/etc/profile-m-z/wire-desktop.profile b/etc/profile-m-z/wire-desktop.profile
index eebad4a19..d8742cd71 100644
--- a/etc/profile-m-z/wire-desktop.profile
+++ b/etc/profile-m-z/wire-desktop.profile
@@ -26,7 +26,7 @@ mkdir ${HOME}/.config/Wire
26whitelist ${HOME}/.config/Wire 26whitelist ${HOME}/.config/Wire
27 27
28private-bin bash,electron,electron[0-9],electron[0-9][0-9],env,sh,wire-desktop 28private-bin bash,electron,electron[0-9],electron[0-9][0-9],env,sh,wire-desktop
29private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,machine-id,pki,resolv.conf,ssl 29private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,machine-id,pki,resolv.conf,ssl
30 30
31# Redirect 31# Redirect
32include electron.profile 32include electron.profile
diff --git a/etc/profile-m-z/wordwarvi.profile b/etc/profile-m-z/wordwarvi.profile
index 374290ed0..3147c2ac3 100644
--- a/etc/profile-m-z/wordwarvi.profile
+++ b/etc/profile-m-z/wordwarvi.profile
@@ -45,7 +45,7 @@ private
45private-bin wordwarvi 45private-bin wordwarvi
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc alsa,asound.conf,ld.so.preload,machine-id,pulse 48private-etc alsa,alternatives,asound.conf,ld.so.cache,ld.so.preload,machine-id,pulse
49private-tmp 49private-tmp
50 50
51dbus-user none 51dbus-user none
diff --git a/etc/profile-m-z/xbill.profile b/etc/profile-m-z/xbill.profile
index 8382e4d76..bb119996c 100644
--- a/etc/profile-m-z/xbill.profile
+++ b/etc/profile-m-z/xbill.profile
@@ -44,7 +44,7 @@ private
44private-bin xbill 44private-bin xbill
45private-cache 45private-cache
46private-dev 46private-dev
47private-etc ld.so.preload 47private-etc alternatives,ld.so.cache,ld.so.preload
48private-tmp 48private-tmp
49 49
50dbus-user none 50dbus-user none
diff --git a/etc/profile-m-z/xfce4-mixer.profile b/etc/profile-m-z/xfce4-mixer.profile
index 21857dbe6..386ef2bd6 100644
--- a/etc/profile-m-z/xfce4-mixer.profile
+++ b/etc/profile-m-z/xfce4-mixer.profile
@@ -46,7 +46,7 @@ disable-mnt
46private-bin xfce4-mixer,xfconf-query 46private-bin xfce4-mixer,xfconf-query
47private-cache 47private-cache
48private-dev 48private-dev
49private-etc alternatives,asound.conf,fonts,ld.so.preload,machine-id,pulse 49private-etc alternatives,asound.conf,fonts,ld.so.cache,ld.so.preload,machine-id,pulse
50private-tmp 50private-tmp
51 51
52dbus-user filter 52dbus-user filter
diff --git a/etc/profile-m-z/xfce4-screenshooter.profile b/etc/profile-m-z/xfce4-screenshooter.profile
index ad3058ce2..d74ed5754 100644
--- a/etc/profile-m-z/xfce4-screenshooter.profile
+++ b/etc/profile-m-z/xfce4-screenshooter.profile
@@ -42,7 +42,7 @@ tracelog
42disable-mnt 42disable-mnt
43private-bin xfce4-screenshooter,xfconf-query 43private-bin xfce4-screenshooter,xfconf-query
44private-dev 44private-dev
45private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,ld.so.preload,pki,resolv.conf,ssl 45private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl
46private-tmp 46private-tmp
47 47
48dbus-user none 48dbus-user none
diff --git a/etc/profile-m-z/xiphos.profile b/etc/profile-m-z/xiphos.profile
index 9b7a006d2..c7fd0799b 100644
--- a/etc/profile-m-z/xiphos.profile
+++ b/etc/profile-m-z/xiphos.profile
@@ -47,5 +47,5 @@ disable-mnt
47private-bin xiphos 47private-bin xiphos
48private-cache 48private-cache
49private-dev 49private-dev
50private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,pki,resolv.conf,ssli,sword,sword.conf 50private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssli,sword,sword.conf
51private-tmp 51private-tmp
diff --git a/etc/profile-m-z/xlinks.profile b/etc/profile-m-z/xlinks.profile
index 1c9310986..404baf607 100644
--- a/etc/profile-m-z/xlinks.profile
+++ b/etc/profile-m-z/xlinks.profile
@@ -14,7 +14,7 @@ include whitelist-common.inc
14# if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' 14# if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2'
15# to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line 15# to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line
16private-bin xlinks 16private-bin xlinks
17private-etc fonts,ld.so.preload 17private-etc alternatives,fonts,ld.so.cache,ld.so.preload
18 18
19# Redirect 19# Redirect
20include links.profile 20include links.profile
diff --git a/etc/profile-m-z/xlinks2 b/etc/profile-m-z/xlinks2
index bbf660e29..d7edd3543 100644
--- a/etc/profile-m-z/xlinks2
+++ b/etc/profile-m-z/xlinks2
@@ -14,7 +14,7 @@ include whitelist-common.inc
14# if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' 14# if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2'
15# to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line 15# to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line
16private-bin xlinks2 16private-bin xlinks2
17private-etc fonts,ld.so.preload 17private-etc alternatives,fonts,ld.so.cache,ld.so.preload
18 18
19# Redirect 19# Redirect
20include links2.profile 20include links2.profile
diff --git a/etc/profile-m-z/xmr-stak.profile b/etc/profile-m-z/xmr-stak.profile
index 2a9fbf171..e541436a4 100644
--- a/etc/profile-m-z/xmr-stak.profile
+++ b/etc/profile-m-z/xmr-stak.profile
@@ -38,7 +38,7 @@ disable-mnt
38private ${HOME}/.xmr-stak 38private ${HOME}/.xmr-stak
39private-bin xmr-stak 39private-bin xmr-stak
40private-dev 40private-dev
41private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl 41private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl
42#private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend 42#private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend
43private-opt cuda 43private-opt cuda
44private-tmp 44private-tmp
diff --git a/etc/profile-m-z/xournal.profile b/etc/profile-m-z/xournal.profile
index fe7395078..a0e77b4e7 100644
--- a/etc/profile-m-z/xournal.profile
+++ b/etc/profile-m-z/xournal.profile
@@ -43,7 +43,7 @@ tracelog
43private-bin xournal 43private-bin xournal
44private-cache 44private-cache
45private-dev 45private-dev
46private-etc alternatives,fonts,group,ld.so.preload,machine-id,passwd 46private-etc alternatives,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd
47# TODO should use private-lib 47# TODO should use private-lib
48private-tmp 48private-tmp
49 49
diff --git a/etc/profile-m-z/yelp.profile b/etc/profile-m-z/yelp.profile
index c5e44c6b4..31a51b2c4 100644
--- a/etc/profile-m-z/yelp.profile
+++ b/etc/profile-m-z/yelp.profile
@@ -56,7 +56,7 @@ disable-mnt
56private-bin groff,man,tbl,troff,yelp 56private-bin groff,man,tbl,troff,yelp
57private-cache 57private-cache
58private-dev 58private-dev
59private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,groff,gtk-3.0,ld.so.preload,machine-id,man_db.conf,openal,os-release,pulse,sgml,xml 59private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,groff,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,man_db.conf,openal,os-release,pulse,sgml,xml
60private-tmp 60private-tmp
61 61
62dbus-user filter 62dbus-user filter
diff --git a/etc/profile-m-z/youtube-viewers-common.profile b/etc/profile-m-z/youtube-viewers-common.profile
index 3224f8fc6..80d551038 100644
--- a/etc/profile-m-z/youtube-viewers-common.profile
+++ b/etc/profile-m-z/youtube-viewers-common.profile
@@ -53,7 +53,7 @@ disable-mnt
53private-bin bash,ffmpeg,ffprobe,firefox,mpv,perl,python*,sh,smplayer,stty,wget,which,xterm,youtube-dl,yt-dlp 53private-bin bash,ffmpeg,ffprobe,firefox,mpv,perl,python*,sh,smplayer,stty,wget,which,xterm,youtube-dl,yt-dlp
54private-cache 54private-cache
55private-dev 55private-dev
56private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg 56private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg
57private-tmp 57private-tmp
58 58
59dbus-user none 59dbus-user none
diff --git a/etc/profile-m-z/youtube.profile b/etc/profile-m-z/youtube.profile
index c7dbec968..5c4d697da 100644
--- a/etc/profile-m-z/youtube.profile
+++ b/etc/profile-m-z/youtube.profile
@@ -17,7 +17,7 @@ mkdir ${HOME}/.config/Youtube
17whitelist ${HOME}/.config/Youtube 17whitelist ${HOME}/.config/Youtube
18 18
19private-bin electron,electron[0-9],electron[0-9][0-9],youtube 19private-bin electron,electron[0-9],electron[0-9][0-9],youtube
20private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg 20private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg
21private-opt Youtube 21private-opt Youtube
22 22
23# Redirect 23# Redirect
diff --git a/etc/profile-m-z/youtubemusic-nativefier.profile b/etc/profile-m-z/youtubemusic-nativefier.profile
index 35ecf059d..2b5ffeaaf 100644
--- a/etc/profile-m-z/youtubemusic-nativefier.profile
+++ b/etc/profile-m-z/youtubemusic-nativefier.profile
@@ -14,7 +14,7 @@ mkdir ${HOME}/.config/youtubemusic-nativefier-040164
14whitelist ${HOME}/.config/youtubemusic-nativefier-040164 14whitelist ${HOME}/.config/youtubemusic-nativefier-040164
15 15
16private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier 16private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier
17private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg 17private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg
18private-opt youtubemusic-nativefier 18private-opt youtubemusic-nativefier
19 19
20# Redirect 20# Redirect
diff --git a/etc/profile-m-z/yt-dlp.profile b/etc/profile-m-z/yt-dlp.profile
index bfb24b488..32e873aa5 100644
--- a/etc/profile-m-z/yt-dlp.profile
+++ b/etc/profile-m-z/yt-dlp.profile
@@ -12,8 +12,8 @@ noblacklist ${HOME}/.cache/yt-dlp
12noblacklist ${HOME}/.config/yt-dlp 12noblacklist ${HOME}/.config/yt-dlp
13noblacklist ${HOME}/yt-dlp.conf 13noblacklist ${HOME}/yt-dlp.conf
14 14
15private-bin yt-dlp 15private-bin ffprobe,yt-dlp
16private-etc ld.so.preload,yt-dlp.conf 16private-etc alternatives,ld.so.cache,ld.so.preload,yt-dlp.conf
17 17
18# Redirect 18# Redirect
19include youtube-dl.profile 19include youtube-dl.profile
diff --git a/etc/profile-m-z/ytmdesktop.profile b/etc/profile-m-z/ytmdesktop.profile
index 84f2f3cb2..59b6e2543 100644
--- a/etc/profile-m-z/ytmdesktop.profile
+++ b/etc/profile-m-z/ytmdesktop.profile
@@ -14,7 +14,7 @@ mkdir ${HOME}/.config/youtube-music-desktop-app
14whitelist ${HOME}/.config/youtube-music-desktop-app 14whitelist ${HOME}/.config/youtube-music-desktop-app
15 15
16# private-bin env,ytmdesktop 16# private-bin env,ytmdesktop
17private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg 17private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg
18# private-opt 18# private-opt
19 19
20# Redirect 20# Redirect
diff --git a/etc/profile-m-z/zulip.profile b/etc/profile-m-z/zulip.profile
index c1c94d74f..8acfdd651 100644
--- a/etc/profile-m-z/zulip.profile
+++ b/etc/profile-m-z/zulip.profile
@@ -44,5 +44,5 @@ disable-mnt
44private-bin locale,zulip 44private-bin locale,zulip
45private-cache 45private-cache
46private-dev 46private-dev
47private-etc asound.conf,fonts,ld.so.preload,machine-id 47private-etc alternatives,asound.conf,fonts,ld.so.cache,ld.so.preload,machine-id
48private-tmp 48private-tmp
diff --git a/gcov.sh b/gcov.sh
index 9bb2596f6..61f4b2483 100755
--- a/gcov.sh
+++ b/gcov.sh
@@ -4,7 +4,7 @@
4# License GPL v2 4# License GPL v2
5 5
6gcov_init() { 6gcov_init() {
7 USER=`whoami` 7 USER="$(whoami)"
8 firejail --help > /dev/null 8 firejail --help > /dev/null
9 firemon --help > /dev/null 9 firemon --help > /dev/null
10 /usr/lib/firejail/fnet --help > /dev/null 10 /usr/lib/firejail/fnet --help > /dev/null
@@ -20,7 +20,7 @@ gcov_init() {
20 /usr/lib/firejail/faudit --help > /dev/null 20 /usr/lib/firejail/faudit --help > /dev/null
21 /usr/lib/firejail/fbuilder --help > /dev/null 21 /usr/lib/firejail/fbuilder --help > /dev/null
22 22
23 sudo chown $USER:$USER `find .` 23 find . -exec sudo chown "$USER:$USER" '{}' +
24} 24}
25 25
26generate() { 26generate() {
@@ -28,7 +28,7 @@ generate() {
28 lcov --add-tracefile gcov-file-old --add-tracefile gcov-file-new --output-file gcov-file 28 lcov --add-tracefile gcov-file-old --add-tracefile gcov-file-new --output-file gcov-file
29 rm -fr gcov-dir 29 rm -fr gcov-dir
30 genhtml -q gcov-file --output-directory gcov-dir 30 genhtml -q gcov-file --output-directory gcov-dir
31 sudo rm `find . -name *.gcda` 31 find . -name '*.gcda' -exec sudo rm '{}' +
32 cp gcov-file gcov-file-old 32 cp gcov-file gcov-file-old
33 gcov_init 33 gcov_init
34} 34}
diff --git a/linecnt.sh b/linecnt.sh
index 86bccbc07..c30e175ba 100755
--- a/linecnt.sh
+++ b/linecnt.sh
@@ -4,7 +4,7 @@
4# License GPL v2 4# License GPL v2
5 5
6gcov_init() { 6gcov_init() {
7 USER=`whoami` 7 USER="$(whoami)"
8 firejail --help > /dev/null 8 firejail --help > /dev/null
9 firemon --help > /dev/null 9 firemon --help > /dev/null
10 /usr/lib/firejail/fnet --help > /dev/null 10 /usr/lib/firejail/fnet --help > /dev/null
@@ -20,7 +20,7 @@ gcov_init() {
20 /usr/lib/firejail/faudit --help > /dev/null 20 /usr/lib/firejail/faudit --help > /dev/null
21 /usr/lib/firejail/fbuilder --help > /dev/null 21 /usr/lib/firejail/fbuilder --help > /dev/null
22 22
23 sudo chown $USER:$USER `find .` 23 find . -exec sudo chown "$USER:$USER" '{}' +
24} 24}
25 25
26rm -fr gcov-dir 26rm -fr gcov-dir
diff --git a/mkasc.sh b/mkasc.sh
index 31c3f4ffd..b41585460 100755
--- a/mkasc.sh
+++ b/mkasc.sh
@@ -5,9 +5,9 @@
5 5
6echo "Calculating SHA256 for all files in /transfer - firejail version $1" 6echo "Calculating SHA256 for all files in /transfer - firejail version $1"
7 7
8cd /transfer 8cd /transfer || exit 1
9sha256sum * > firejail-$1-unsigned 9sha256sum ./* > "firejail-$1-unsigned"
10gpg --clearsign --digest-algo SHA256 < firejail-$1-unsigned > firejail-$1.asc 10gpg --clearsign --digest-algo SHA256 < "firejail-$1-unsigned" > "firejail-$1.asc"
11gpg --verify firejail-$1.asc 11gpg --verify "firejail-$1.asc"
12gpg --detach-sign --armor firejail-$1.tar.xz 12gpg --detach-sign --armor "firejail-$1.tar.xz"
13rm firejail-$1-unsigned 13rm "firejail-$1-unsigned"
diff --git a/mkdeb.sh.in b/mkdeb.sh.in
index e45acf8eb..ddd6ca1ee 100755
--- a/mkdeb.sh.in
+++ b/mkdeb.sh.in
@@ -22,7 +22,7 @@ if [ -n "$HAVE_SELINUX" ]; then
22 CONFIG_ARGS="$CONFIG_ARGS --enable-selinux" 22 CONFIG_ARGS="$CONFIG_ARGS --enable-selinux"
23fi 23fi
24 24
25TOP=`pwd` 25TOP="$PWD"
26CODE_ARCHIVE="$NAME-$VERSION.tar.xz" 26CODE_ARCHIVE="$NAME-$VERSION.tar.xz"
27CODE_DIR="$NAME-$VERSION" 27CODE_DIR="$NAME-$VERSION"
28INSTALL_DIR="${INSTALL_DIR}${CODE_DIR}/debian" 28INSTALL_DIR="${INSTALL_DIR}${CODE_DIR}/debian"
@@ -35,9 +35,9 @@ echo "install directory: $INSTALL_DIR"
35echo "debian control directory: $DEBIAN_CTRL_DIR" 35echo "debian control directory: $DEBIAN_CTRL_DIR"
36echo "*****************************************" 36echo "*****************************************"
37 37
38tar -xJvf $CODE_ARCHIVE 38tar -xJvf "$CODE_ARCHIVE"
39#mkdir -p $INSTALL_DIR 39#mkdir -p "$INSTALL_DIR"
40cd $CODE_DIR 40cd "$CODE_DIR"
41./configure $CONFIG_ARGS 41./configure $CONFIG_ARGS
42make -j2 42make -j2
43mkdir debian 43mkdir debian
@@ -45,26 +45,26 @@ DESTDIR=debian make install-strip
45 45
46cd .. 46cd ..
47echo "*****************************************" 47echo "*****************************************"
48SIZE=`du -s $INSTALL_DIR` 48SIZE="$(du -s "$INSTALL_DIR")"
49echo "install size $SIZE" 49echo "install size $SIZE"
50echo "*****************************************" 50echo "*****************************************"
51 51
52mv $INSTALL_DIR/usr/share/doc/firejail/RELNOTES $INSTALL_DIR/usr/share/doc/firejail/changelog.Debian 52mv "$INSTALL_DIR/usr/share/doc/firejail/RELNOTES" "$INSTALL_DIR/usr/share/doc/firejail/changelog.Debian"
53gzip -9 -n $INSTALL_DIR/usr/share/doc/firejail/changelog.Debian 53gzip -9 -n "$INSTALL_DIR/usr/share/doc/firejail/changelog.Debian"
54rm $INSTALL_DIR/usr/share/doc/firejail/COPYING 54rm "$INSTALL_DIR/usr/share/doc/firejail/COPYING"
55install -m644 $CODE_DIR/platform/debian/copyright $INSTALL_DIR/usr/share/doc/firejail/. 55install -m644 "$CODE_DIR/platform/debian/copyright" "$INSTALL_DIR/usr/share/doc/firejail/."
56mkdir -p $DEBIAN_CTRL_DIR 56mkdir -p "$DEBIAN_CTRL_DIR"
57sed "s/FIREJAILVER/$VERSION/g" $CODE_DIR/platform/debian/control.$(dpkg-architecture -qDEB_HOST_ARCH) > $DEBIAN_CTRL_DIR/control 57sed "s/FIREJAILVER/$VERSION/g" "$CODE_DIR/platform/debian/control.$(dpkg-architecture -qDEB_HOST_ARCH)" > "$DEBIAN_CTRL_DIR/control"
58 58
59mkdir -p $INSTALL_DIR/usr/share/lintian/overrides/ 59mkdir -p "$INSTALL_DIR/usr/share/lintian/overrides/"
60install -m644 $CODE_DIR/platform/debian/firejail.lintian-overrides $INSTALL_DIR/usr/share/lintian/overrides/firejail 60install -m644 "$CODE_DIR/platform/debian/firejail.lintian-overrides" "$INSTALL_DIR/usr/share/lintian/overrides/firejail"
61 61
62find $INSTALL_DIR/etc -type f | sed "s,^$INSTALL_DIR,," | LC_ALL=C sort > $DEBIAN_CTRL_DIR/conffiles 62find "$INSTALL_DIR/etc" -type f | sed "s,^$INSTALL_DIR,," | LC_ALL=C sort > "$DEBIAN_CTRL_DIR/conffiles"
63chmod 644 $DEBIAN_CTRL_DIR/conffiles 63chmod 644 "$DEBIAN_CTRL_DIR/conffiles"
64find $INSTALL_DIR -type d | xargs chmod 755 64find "$INSTALL_DIR" -type d -exec chmod 755 '{}' +
65cd $CODE_DIR 65cd "$CODE_DIR"
66fakeroot dpkg-deb --build debian 66fakeroot dpkg-deb --build debian
67lintian --no-tag-display-limit debian.deb 67lintian --no-tag-display-limit debian.deb
68mv debian.deb ../firejail_${VERSION}${EXTRA_VERSION}_1_$(dpkg-architecture -qDEB_HOST_ARCH).deb 68mv debian.deb "../firejail_${VERSION}${EXTRA_VERSION}_1_$(dpkg-architecture -qDEB_HOST_ARCH).deb"
69cd .. 69cd ..
70rm -fr $CODE_DIR 70rm -fr "$CODE_DIR"
diff --git a/mkman.sh b/mkman.sh
index 8767972d1..c9606c1e7 100755
--- a/mkman.sh
+++ b/mkman.sh
@@ -5,8 +5,8 @@
5 5
6set -e 6set -e
7 7
8sed "s/VERSION/$1/g" $2 > $3 8sed "s/VERSION/$1/g" "$2" > "$3"
9MONTH=`LC_ALL=C date -u --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%b` 9MONTH="$(LC_ALL=C date -u --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%b)"
10sed -i "s/MONTH/$MONTH/g" $3 10sed -i "s/MONTH/$MONTH/g" "$3"
11YEAR=`LC_ALL=C date -u --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y` 11YEAR="$(LC_ALL=C date -u --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y)"
12sed -i "s/YEAR/$YEAR/g" $3 12sed -i "s/YEAR/$YEAR/g" "$3"
diff --git a/mkuid.sh b/mkuid.sh
index 0264628cc..47aa42acd 100755
--- a/mkuid.sh
+++ b/mkuid.sh
@@ -9,8 +9,8 @@ echo "#define FIREJAIL_UIDS_H" >> uids.h
9 9
10if [ -r /etc/login.defs ] 10if [ -r /etc/login.defs ]
11then 11then
12 UID_MIN=`awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs` 12 UID_MIN="$(awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs)"
13 GID_MIN=`awk '/^\s*GID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs` 13 GID_MIN="$(awk '/^\s*GID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs)"
14fi 14fi
15 15
16# use default values if not found 16# use default values if not found
diff --git a/src/fids/main.c b/src/fids/main.c
index c899b55e1..8f9bc1ea0 100644
--- a/src/fids/main.c
+++ b/src/fids/main.c
@@ -210,22 +210,29 @@ static void process_config(const char *fname) {
210 exit(1); 210 exit(1);
211 } 211 }
212 212
213 // make sure the file is owned by root 213 fprintf(stderr, "Opening config file %s\n", fname);
214 struct stat s; 214 int fd = open(fname, O_RDONLY|O_CLOEXEC);
215 if (stat(fname, &s)) { 215 if (fd < 0) {
216 if (include_level == 1) { 216 if (include_level == 1) {
217 fprintf(stderr, "Error ids: config file not found\n"); 217 fprintf(stderr, "Error ids: cannot open config file %s\n", fname);
218 exit(1); 218 exit(1);
219 } 219 }
220 return; 220 return;
221 } 221 }
222
223 // make sure the file is owned by root
224 struct stat s;
225 if (fstat(fd, &s)) {
226 fprintf(stderr, "Error ids: cannot stat config file %s\n", fname);
227 exit(1);
228 }
222 if (s.st_uid || s.st_gid) { 229 if (s.st_uid || s.st_gid) {
223 fprintf(stderr, "Error ids: config file not owned by root\n"); 230 fprintf(stderr, "Error ids: config file not owned by root\n");
224 exit(1); 231 exit(1);
225 } 232 }
226 233
227 fprintf(stderr, "Loading %s config file\n", fname); 234 fprintf(stderr, "Loading config file %s\n", fname);
228 FILE *fp = fopen(fname, "r"); 235 FILE *fp = fdopen(fd, "r");
229 if (!fp) { 236 if (!fp) {
230 fprintf(stderr, "Error fids: cannot open config file %s\n", fname); 237 fprintf(stderr, "Error fids: cannot open config file %s\n", fname);
231 exit(1); 238 exit(1);
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 1982afdee..117c6f6ae 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -1,7 +1,6 @@
1# /usr/lib/firejail/firecfg.config - firecfg utility configuration file 1# /etc/firejail/firecfg.config - firecfg utility configuration file
2# This is the list of programs in alphabetical order handled by firecfg utility 2# This is the list of programs in alphabetical order handled by firecfg utility
3# 3#
4#qemu-system-x86_64
50ad 40ad
62048-qt 52048-qt
7Books 6Books
@@ -139,8 +138,8 @@ clamdscan
139clamdtop 138clamdtop
140clamscan 139clamscan
141clamtk 140clamtk
142claws-mail
143clawsker 141clawsker
142claws-mail
144clementine 143clementine
145clion 144clion
146clion-eap 145clion-eap
@@ -170,7 +169,6 @@ crow
170cryptocat 169cryptocat
171cvlc 170cvlc
172cyberfox 171cyberfox
173d-feet
174darktable 172darktable
175dconf-editor 173dconf-editor
176ddgr 174ddgr
@@ -180,6 +178,7 @@ deluge
180desktopeditors 178desktopeditors
181devhelp 179devhelp
182dex2jar 180dex2jar
181d-feet
183dia 182dia
184dig 183dig
185digikam 184digikam
@@ -256,8 +255,8 @@ flacsplt
256flameshot 255flameshot
257flashpeak-slimjet 256flashpeak-slimjet
258flowblade 257flowblade
259font-manager
260fontforge 258fontforge
259font-manager
261fossamail 260fossamail
262four-in-a-row 261four-in-a-row
263fractal 262fractal
@@ -276,6 +275,7 @@ freetube
276freshclam 275freshclam
277frogatto 276frogatto
278frozen-bubble 277frozen-bubble
278ftp
279funnyboat 279funnyboat
280gajim 280gajim
281gajim-history-manager 281gajim-history-manager
@@ -366,11 +366,11 @@ gradio
366gramps 366gramps
367gravity-beams-and-evaporating-stars 367gravity-beams-and-evaporating-stars
368gthumb 368gthumb
369gtk2-youtube-viewer
370gtk3-youtube-viewer
369gtk-pipe-viewer 371gtk-pipe-viewer
370gtk-straw-viewer 372gtk-straw-viewer
371gtk-youtube-viewer 373gtk-youtube-viewer
372gtk2-youtube-viewer
373gtk3-youtube-viewer
374guayadeque 374guayadeque
375gucharmap 375gucharmap
376gummi 376gummi
@@ -391,8 +391,8 @@ icecat
391icedove 391icedove
392iceweasel 392iceweasel
393idea 393idea
394idea.sh
395ideaIC 394ideaIC
395idea.sh
396imagej 396imagej
397img2txt 397img2txt
398impressive 398impressive
@@ -533,6 +533,7 @@ mp3wrap
533mpDris2 533mpDris2
534mpg123 534mpg123
535mpg123-alsa 535mpg123-alsa
536mpg123.bin
536mpg123-id3dump 537mpg123-id3dump
537mpg123-jack 538mpg123-jack
538mpg123-nas 539mpg123-nas
@@ -541,7 +542,6 @@ mpg123-oss
541mpg123-portaudio 542mpg123-portaudio
542mpg123-pulse 543mpg123-pulse
543mpg123-strip 544mpg123-strip
544mpg123.bin
545mplayer 545mplayer
546mpsyt 546mpsyt
547mpv 547mpv
@@ -606,16 +606,17 @@ onboard
606onionshare-gui 606onionshare-gui
607ooffice 607ooffice
608ooviewdoc 608ooviewdoc
609open-invaders
610openarena 609openarena
611openarena_ded 610openarena_ded
612opencity 611opencity
613openclonk 612openclonk
613open-invaders
614openmw 614openmw
615openmw-launcher 615openmw-launcher
616openoffice.org 616openoffice.org
617openshot 617openshot
618openshot-qt 618openshot-qt
619openstego
619openttd 620openttd
620opera 621opera
621opera-beta 622opera-beta
@@ -669,6 +670,7 @@ pybitmessage
669qbittorrent 670qbittorrent
670qcomicbook 671qcomicbook
671qemu-launcher 672qemu-launcher
673#qemu-system-x86_64
672qgis 674qgis
673qlipper 675qlipper
674qmmp 676qmmp
@@ -732,8 +734,8 @@ smuxi-frontend-gnome
732snox 734snox
733soffice 735soffice
734sol 736sol
735sound-juicer
736soundconverter 737soundconverter
738sound-juicer
737spectacle 739spectacle
738spectral 740spectral
739spotify 741spotify
@@ -746,8 +748,8 @@ steam
746steam-native 748steam-native
747steam-runtime 749steam-runtime
748stellarium 750stellarium
749straw-viewer
750strawberry 751strawberry
752straw-viewer
751strings 753strings
752studio.sh 754studio.sh
753subdownloader 755subdownloader
@@ -767,6 +769,7 @@ teamspeak3
767teeworlds 769teeworlds
768telegram 770telegram
769telegram-desktop 771telegram-desktop
772telnet
770terasology 773terasology
771textmaker18 774textmaker18
772textmaker18free 775textmaker18free
@@ -775,6 +778,7 @@ thunderbird-beta
775thunderbird-wayland 778thunderbird-wayland
776tilp 779tilp
777tor-browser 780tor-browser
781torbrowser
778tor-browser-ar 782tor-browser-ar
779tor-browser-ca 783tor-browser-ca
780tor-browser-cs 784tor-browser-cs
@@ -796,6 +800,7 @@ tor-browser-it
796tor-browser-ja 800tor-browser-ja
797tor-browser-ka 801tor-browser-ka
798tor-browser-ko 802tor-browser-ko
803torbrowser-launcher
799tor-browser-nb 804tor-browser-nb
800tor-browser-nl 805tor-browser-nl
801tor-browser-pl 806tor-browser-pl
@@ -806,8 +811,6 @@ tor-browser-tr
806tor-browser-vi 811tor-browser-vi
807tor-browser-zh-cn 812tor-browser-zh-cn
808tor-browser-zh-tw 813tor-browser-zh-tw
809torbrowser
810torbrowser-launcher
811torcs 814torcs
812totem 815totem
813tracker 816tracker
@@ -913,8 +916,8 @@ yelp
913youtube 916youtube
914youtube-dl 917youtube-dl
915youtube-dl-gui 918youtube-dl-gui
916youtube-viewer
917youtubemusic-nativefier 919youtubemusic-nativefier
920youtube-viewer
918yt-dlp 921yt-dlp
919ytmdesktop 922ytmdesktop
920zaproxy 923zaproxy
diff --git a/src/firecfg/main.c b/src/firecfg/main.c
index 363000e15..fafa0e635 100644
--- a/src/firecfg/main.c
+++ b/src/firecfg/main.c
@@ -171,17 +171,17 @@ static void set_file(const char *name, const char *firejail_exec) {
171 free(fname); 171 free(fname);
172} 172}
173 173
174// parse /usr/lib/firejail/firecfg.cfg file 174// parse /etc/firejail/firecfg.config file
175static void set_links_firecfg(void) { 175static void set_links_firecfg(void) {
176 char *cfgfile; 176 char *cfgfile;
177 if (asprintf(&cfgfile, "%s/firejail/firecfg.config", LIBDIR) == -1) 177 if (asprintf(&cfgfile, "%s/firecfg.config", SYSCONFDIR) == -1)
178 errExit("asprintf"); 178 errExit("asprintf");
179 179
180 char *firejail_exec; 180 char *firejail_exec;
181 if (asprintf(&firejail_exec, "%s/bin/firejail", PREFIX) == -1) 181 if (asprintf(&firejail_exec, "%s/bin/firejail", PREFIX) == -1)
182 errExit("asprintf"); 182 errExit("asprintf");
183 183
184 // parse /usr/lib/firejail/firecfg.cfg file 184 // parse /etc/firejail/firecfg.config file
185 FILE *fp = fopen(cfgfile, "r"); 185 FILE *fp = fopen(cfgfile, "r");
186 if (!fp) { 186 if (!fp) {
187 perror("fopen"); 187 perror("fopen");
@@ -440,7 +440,7 @@ int main(int argc, char **argv) {
440 // clear all symlinks 440 // clear all symlinks
441 clean(); 441 clean();
442 442
443 // set new symlinks based on /usr/lib/firejail/firecfg.cfg 443 // set new symlinks based on /etc/firejail/firecfg.config
444 set_links_firecfg(); 444 set_links_firecfg();
445 445
446 if (getuid() == 0) { 446 if (getuid() == 0) {
diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c
index 2266fa499..bb5b29d79 100644
--- a/src/firejail/appimage.c
+++ b/src/firejail/appimage.c
@@ -45,10 +45,10 @@ int appimage_find_profile(const char *archive) {
45 assert(archive); 45 assert(archive);
46 assert(strlen(archive)); 46 assert(strlen(archive));
47 47
48 // try to match the name of the archive with the list of programs in /usr/lib/firejail/firecfg.config 48 // try to match the name of the archive with the list of programs in /etc/firejail/firecfg.config
49 FILE *fp = fopen(LIBDIR "/firejail/firecfg.config", "r"); 49 FILE *fp = fopen(SYSCONFDIR "/firecfg.config", "r");
50 if (!fp) { 50 if (!fp) {
51 fprintf(stderr, "Error: cannot find %s, firejail is not correctly installed\n", LIBDIR "/firejail/firecfg.config"); 51 fprintf(stderr, "Error: cannot find %s, firejail is not correctly installed\n", SYSCONFDIR "/firecfg.config");
52 exit(1); 52 exit(1);
53 } 53 }
54 char buf[MAXBUF]; 54 char buf[MAXBUF];
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 9c1b889ed..f62e6404e 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -94,16 +94,7 @@ static void disable_file(OPERATION op, const char *filename) {
94 return; 94 return;
95 } 95 }
96 96
97 // if the file is not present, do nothing
98 assert(fname); 97 assert(fname);
99 struct stat s;
100 if (stat(fname, &s) < 0) {
101 if (arg_debug)
102 printf("Warning (blacklisting): cannot access %s: %s\n", fname, strerror(errno));
103 free(fname);
104 return;
105 }
106
107 // check for firejail executable 98 // check for firejail executable
108 // we might have a file found in ${PATH} pointing to /usr/bin/firejail 99 // we might have a file found in ${PATH} pointing to /usr/bin/firejail
109 // blacklisting it here will end up breaking situations like user clicks on a link in Thunderbird 100 // blacklisting it here will end up breaking situations like user clicks on a link in Thunderbird
@@ -113,6 +104,24 @@ static void disable_file(OPERATION op, const char *filename) {
113 return; 104 return;
114 } 105 }
115 106
107 // if the file is not present, do nothing
108 int fd = open(fname, O_PATH|O_CLOEXEC);
109 if (fd < 0) {
110 if (arg_debug)
111 printf("Warning (blacklisting): cannot open %s: %s\n", fname, strerror(errno));
112 free(fname);
113 return;
114 }
115
116 struct stat s;
117 if (fstat(fd, &s) < 0) {
118 if (arg_debug)
119 printf("Warning (blacklisting): cannot stat %s: %s\n", fname, strerror(errno));
120 free(fname);
121 close(fd);
122 return;
123 }
124
116 // modify the file 125 // modify the file
117 if (op == BLACKLIST_FILE || op == BLACKLIST_NOLOG) { 126 if (op == BLACKLIST_FILE || op == BLACKLIST_NOLOG) {
118 // some distros put all executables under /usr/bin and make /bin a symbolic link 127 // some distros put all executables under /usr/bin and make /bin a symbolic link
@@ -136,13 +145,6 @@ static void disable_file(OPERATION op, const char *filename) {
136 printf(" - no logging\n"); 145 printf(" - no logging\n");
137 } 146 }
138 147
139 int fd = open(fname, O_PATH|O_CLOEXEC);
140 if (fd < 0) {
141 if (arg_debug)
142 printf("Warning (blacklisting): cannot open %s: %s\n", fname, strerror(errno));
143 free(fname);
144 return;
145 }
146 EUID_ROOT(); 148 EUID_ROOT();
147 if (S_ISDIR(s.st_mode)) { 149 if (S_ISDIR(s.st_mode)) {
148 if (bind_mount_path_to_fd(RUN_RO_DIR, fd) < 0) 150 if (bind_mount_path_to_fd(RUN_RO_DIR, fd) < 0)
@@ -153,7 +155,6 @@ static void disable_file(OPERATION op, const char *filename) {
153 errExit("disable file"); 155 errExit("disable file");
154 } 156 }
155 EUID_USER(); 157 EUID_USER();
156 close(fd);
157 158
158 if (op == BLACKLIST_FILE) 159 if (op == BLACKLIST_FILE)
159 fs_logger2("blacklist", fname); 160 fs_logger2("blacklist", fname);
@@ -180,8 +181,7 @@ static void disable_file(OPERATION op, const char *filename) {
180 else if (op == MOUNT_TMPFS) { 181 else if (op == MOUNT_TMPFS) {
181 if (!S_ISDIR(s.st_mode)) { 182 if (!S_ISDIR(s.st_mode)) {
182 fwarning("%s is not a directory; cannot mount a tmpfs on top of it.\n", fname); 183 fwarning("%s is not a directory; cannot mount a tmpfs on top of it.\n", fname);
183 free(fname); 184 goto out;
184 return;
185 } 185 }
186 186
187 uid_t uid = getuid(); 187 uid_t uid = getuid();
@@ -191,8 +191,7 @@ static void disable_file(OPERATION op, const char *filename) {
191 strncmp(cfg.homedir, fname, strlen(cfg.homedir)) != 0 || 191 strncmp(cfg.homedir, fname, strlen(cfg.homedir)) != 0 ||
192 fname[strlen(cfg.homedir)] != '/') { 192 fname[strlen(cfg.homedir)] != '/') {
193 fwarning("you are not allowed to mount a tmpfs on %s\n", fname); 193 fwarning("you are not allowed to mount a tmpfs on %s\n", fname);
194 free(fname); 194 goto out;
195 return;
196 } 195 }
197 } 196 }
198 197
@@ -202,6 +201,8 @@ static void disable_file(OPERATION op, const char *filename) {
202 else 201 else
203 assert(0); 202 assert(0);
204 203
204out:
205 close(fd);
205 free(fname); 206 free(fname);
206} 207}
207 208
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index a4c1ff822..4c9dac0c2 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -285,24 +285,25 @@ void fs_private_bin_list(void) {
285 while ((ptr = strtok(NULL, ",")) != NULL) 285 while ((ptr = strtok(NULL, ",")) != NULL)
286 globbing(ptr); 286 globbing(ptr);
287 free(dlist); 287 free(dlist);
288 fs_logger_print();
289 288
290 // mount-bind 289 // mount-bind
290 EUID_ROOT();
291 int i = 0; 291 int i = 0;
292 while (paths[i]) { 292 while (paths[i]) {
293 struct stat s; 293 struct stat s;
294 if (stat(paths[i], &s) == 0) { 294 if (stat(paths[i], &s) == 0) {
295 if (arg_debug) 295 if (arg_debug)
296 printf("Mount-bind %s on top of %s\n", RUN_BIN_DIR, paths[i]); 296 printf("Mount-bind %s on top of %s\n", RUN_BIN_DIR, paths[i]);
297 EUID_ROOT();
298 if (mount(RUN_BIN_DIR, paths[i], NULL, MS_BIND|MS_REC, NULL) < 0) 297 if (mount(RUN_BIN_DIR, paths[i], NULL, MS_BIND|MS_REC, NULL) < 0)
299 errExit("mount bind"); 298 errExit("mount bind");
300 EUID_USER();
301 fs_logger2("tmpfs", paths[i]); 299 fs_logger2("tmpfs", paths[i]);
302 fs_logger2("mount", paths[i]); 300 fs_logger2("mount", paths[i]);
303 } 301 }
304 i++; 302 i++;
305 } 303 }
304 fs_logger_print();
305 EUID_USER();
306
306 selinux_relabel_path(RUN_BIN_DIR, "/bin"); 307 selinux_relabel_path(RUN_BIN_DIR, "/bin");
307 fmessage("%d %s installed in %0.2f ms\n", prog_cnt, (prog_cnt == 1)? "program": "programs", timetrace_end()); 308 fmessage("%d %s installed in %0.2f ms\n", prog_cnt, (prog_cnt == 1)? "program": "programs", timetrace_end());
308} 309}
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index 8d8530d81..230e9186c 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -380,12 +380,14 @@ void fs_private(void) {
380 selinux_relabel_path("/home", "/home"); 380 selinux_relabel_path("/home", "/home");
381 fs_logger("tmpfs /home"); 381 fs_logger("tmpfs /home");
382 } 382 }
383 EUID_USER();
383 384
384 if (u != 0) { 385 if (u != 0) {
385 if (!arg_allusers && strncmp(homedir, "/home/", 6) == 0) { 386 if (!arg_allusers && strncmp(homedir, "/home/", 6) == 0) {
386 // create new empty /home/user directory 387 // create new empty /home/user directory
387 if (arg_debug) 388 if (arg_debug)
388 printf("Create a new user directory\n"); 389 printf("Create a new user directory\n");
390 EUID_ROOT();
389 if (mkdir(homedir, S_IRWXU) == -1) { 391 if (mkdir(homedir, S_IRWXU) == -1) {
390 if (mkpath_as_root(homedir) == -1) 392 if (mkpath_as_root(homedir) == -1)
391 errExit("mkpath"); 393 errExit("mkpath");
@@ -394,20 +396,17 @@ void fs_private(void) {
394 } 396 }
395 if (chown(homedir, u, g) < 0) 397 if (chown(homedir, u, g) < 0)
396 errExit("chown"); 398 errExit("chown");
399 EUID_USER();
397 fs_logger2("mkdir", homedir); 400 fs_logger2("mkdir", homedir);
398 fs_logger2("tmpfs", homedir); 401 fs_logger2("tmpfs", homedir);
399 } 402 }
400 else { 403 else
401 // mask user home directory 404 // mask user home directory
402 // the directory should be owned by the current user 405 // the directory should be owned by the current user
403 EUID_USER();
404 fs_tmpfs(homedir, 1); 406 fs_tmpfs(homedir, 1);
405 EUID_ROOT();
406 }
407 407
408 selinux_relabel_path(homedir, homedir); 408 selinux_relabel_path(homedir, homedir);
409 } 409 }
410 EUID_USER();
411 410
412 skel(homedir); 411 skel(homedir);
413 if (xflag) 412 if (xflag)
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 4bcf98035..dd36ac4b7 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -872,7 +872,7 @@ char *guess_shell(void) {
872 if (shell) { 872 if (shell) {
873 invalid_filename(shell, 0); // no globbing 873 invalid_filename(shell, 0); // no globbing
874 if (access(shell, X_OK) == 0 && !is_dir(shell) && strstr(shell, "..") == NULL && 874 if (access(shell, X_OK) == 0 && !is_dir(shell) && strstr(shell, "..") == NULL &&
875 strcmp(shell, PATH_FIREJAIL) != 0) 875 strcmp(gnu_basename(shell), "firejail") != 0)
876 goto found; 876 goto found;
877 } 877 }
878 878
@@ -936,6 +936,8 @@ static void run_builder(int argc, char **argv) {
936 if (setresuid(-1, getuid(), getuid()) != 0) 936 if (setresuid(-1, getuid(), getuid()) != 0)
937 errExit("setresuid"); 937 errExit("setresuid");
938 938
939 if (env_get("LD_PRELOAD") != NULL)
940 fprintf(stderr, "run_builder: LD_PRELOAD is: '%s'\n", env_get("LD_PRELOAD"));
939 assert(env_get("LD_PRELOAD") == NULL); 941 assert(env_get("LD_PRELOAD") == NULL);
940 assert(getenv("LD_PRELOAD") == NULL); 942 assert(getenv("LD_PRELOAD") == NULL);
941 umask(orig_umask); 943 umask(orig_umask);
@@ -1004,18 +1006,18 @@ int main(int argc, char **argv, char **envp) {
1004 fprintf(stderr, "Error: argv is invalid\n"); 1006 fprintf(stderr, "Error: argv is invalid\n");
1005 exit(1); 1007 exit(1);
1006 } else if (argc >= MAX_ARGS) { 1008 } else if (argc >= MAX_ARGS) {
1007 fprintf(stderr, "Error: too many arguments\n"); 1009 fprintf(stderr, "Error: too many arguments: argc (%d) >= MAX_ARGS (%d)\n", argc, MAX_ARGS);
1008 exit(1); 1010 exit(1);
1009 } 1011 }
1010 1012
1011 // sanity check for arguments 1013 // sanity check for arguments
1012 for (i = 0; i < argc; i++) { 1014 for (i = 0; i < argc; i++) {
1013 if (*argv[i] == 0) { 1015 if (*argv[i] == 0) {
1014 fprintf(stderr, "Error: too short arguments\n"); 1016 fprintf(stderr, "Error: too short arguments: argv[%d] is empty\n", i);
1015 exit(1); 1017 exit(1);
1016 } 1018 }
1017 if (strlen(argv[i]) >= MAX_ARG_LEN) { 1019 if (strlen(argv[i]) >= MAX_ARG_LEN) {
1018 fprintf(stderr, "Error: too long arguments\n"); 1020 fprintf(stderr, "Error: too long arguments: argv[%d] len (%zu) >= MAX_ARG_LEN (%d)\n", i, strlen(argv[i]), MAX_ARG_LEN);
1019 exit(1); 1021 exit(1);
1020 } 1022 }
1021 } 1023 }
@@ -1026,7 +1028,7 @@ int main(int argc, char **argv, char **envp) {
1026 1028
1027 // sanity check for environment variables 1029 // sanity check for environment variables
1028 if (i >= MAX_ENVS) { 1030 if (i >= MAX_ENVS) {
1029 fprintf(stderr, "Error: too many environment variables\n"); 1031 fprintf(stderr, "Error: too many environment variables: >= MAX_ENVS (%d)\n", MAX_ENVS);
1030 exit(1); 1032 exit(1);
1031 } 1033 }
1032 1034
diff --git a/src/firejail/run_symlink.c b/src/firejail/run_symlink.c
index 6397418d1..14667d9eb 100644
--- a/src/firejail/run_symlink.c
+++ b/src/firejail/run_symlink.c
@@ -76,6 +76,8 @@ void run_symlink(int argc, char **argv, int run_as_is) {
76 a[i + 2] = argv[i + 1]; 76 a[i + 2] = argv[i + 1];
77 } 77 }
78 a[i + 2] = NULL; 78 a[i + 2] = NULL;
79 if (env_get("LD_PRELOAD") != NULL)
80 fprintf(stderr, "run_symlink: LD_PRELOAD is: '%s'\n", env_get("LD_PRELOAD"));
79 assert(env_get("LD_PRELOAD") == NULL); 81 assert(env_get("LD_PRELOAD") == NULL);
80 assert(getenv("LD_PRELOAD") == NULL); 82 assert(getenv("LD_PRELOAD") == NULL);
81 execvp(a[0], a); 83 execvp(a[0], a);
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 3d9bf9082..e02be29f1 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -435,11 +435,11 @@ void seccomp_print_filter(pid_t pid) {
435 if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_SECCOMP_LIST) == -1) 435 if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_SECCOMP_LIST) == -1)
436 errExit("asprintf"); 436 errExit("asprintf");
437 437
438 struct stat s; 438 int fd = open(fname, O_RDONLY|O_CLOEXEC);
439 if (stat(fname, &s) == -1) 439 if (fd < 0)
440 goto errexit; 440 goto errexit;
441 441
442 FILE *fp = fopen(fname, "re"); 442 FILE *fp = fdopen(fd, "r");
443 if (!fp) 443 if (!fp)
444 goto errexit; 444 goto errexit;
445 free(fname); 445 free(fname);
diff --git a/src/man/firecfg.txt b/src/man/firecfg.txt
index 7e0a57f92..189e9cc8d 100644
--- a/src/man/firecfg.txt
+++ b/src/man/firecfg.txt
@@ -27,7 +27,7 @@ desktop managers are supported in this moment
27To set it up, run "sudo firecfg" after installing Firejail software. 27To set it up, run "sudo firecfg" after installing Firejail software.
28The same command should also be run after 28The same command should also be run after
29installing new programs. If the program is supported by Firejail, the symbolic link in /usr/local/bin 29installing new programs. If the program is supported by Firejail, the symbolic link in /usr/local/bin
30will be created. For a full list of programs supported by default run "cat /usr/lib/firejail/firecfg.config". 30will be created. For a full list of programs supported by default run "cat /etc/firejail/firecfg.config".
31 31
32For user-driven manual integration, see \fBDESKTOP INTEGRATION\fR section in \fBman 1 firejail\fR. 32For user-driven manual integration, see \fBDESKTOP INTEGRATION\fR section in \fBman 1 firejail\fR.
33.SH DEFAULT ACTIONS 33.SH DEFAULT ACTIONS
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-06 03:46:15 +0000