4 files changed, 10 insertions, 10 deletions

diff --git a/etc/dig.profile b/etc/dig.profile
index f283db962..673af1526 100644
--- a/etc/dig.profile
+++ b/etc/dig.profile
@@ -25,7 +25,6 @@ include disable-xdg.inc
 #mkfile ${HOME}/.digrc -- see #903
 whitelist ${HOME}/.digrc
 include whitelist-common.inc
-include whitelist-runuser-common.inc
 include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
@@ -33,7 +32,6 @@ apparmor
 caps.drop all
 ipc-namespace
 machine-id
-memory-deny-write-execute
 netfilter
 no3d
 nodbus
diff --git a/etc/nslookup.profile b/etc/nslookup.profile
index 9ed6ef1e9..000cc1075 100644
--- a/etc/nslookup.profile
+++ b/etc/nslookup.profile
@@ -23,7 +23,6 @@ include disable-xdg.inc
 
 whitelist ${HOME}/.nslookuprc
 include whitelist-common.inc
-include whitelist-runuser-common.inc
 include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
@@ -31,7 +30,6 @@ apparmor
 caps.drop all
 ipc-namespace
 machine-id
-memory-deny-write-execute
 netfilter
 no3d
 nodbus
diff --git a/etc/unknown-horizons.profile b/etc/unknown-horizons.profile
index 489de67bb..7dc13e284 100644
--- a/etc/unknown-horizons.profile
+++ b/etc/unknown-horizons.profile
@@ -23,7 +23,6 @@ include whitelist-var-common.inc
 
 apparmor
 caps.drop all
-# memory-deny-write-execute - doesn't work
 nodvd
 nogroups
 nonewprivs
@@ -40,3 +39,6 @@ disable-mnt
 private-dev
 # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl
 private-tmp
+
+# doesn't work - maybe all Tcl/Tk programs have this problem
+# memory-deny-write-execute
diff --git a/src/profstats/main.c b/src/profstats/main.c
index ac02c69bc..29acdc7bd 100644
--- a/src/profstats/main.c
+++ b/src/profstats/main.c
@@ -68,9 +68,9 @@ static void usage(void) {
         printf("   --private-dev - print profiles without private-dev\n");
         printf("   --private-tmp - print profiles without private-tmp\n");
         printf("   --seccomp - print profiles without seccomp\n");
-        printf("   --memory-deny-write-execute - profile without it\n");
+        printf("   --memory-deny-write-execute - profile without \"memory-deny-write-execute\"\n");
         printf("   --whitelist-var - print profiles without \"include whitelist-var-common.inc\"\n");
-        printf("   --whitelist-runuser - print profiles without \"include whitelist-runuser-common.inc\"\n");
+        printf("   --whitelist-runuser - print profiles without \"include whitelist-runuser-common.inc\" or \"blacklist ${RUNUSER}\"\n");
         printf("   --whitelist-usrshare - print profiles without \"include whitelist-usr-share-common.inc\"\n");
         printf("   --debug\n");
         printf("\n");
@@ -111,9 +111,10 @@ void process_file(const char *fname) {
                         cnt_noexec++;
                 else if (strncmp(ptr, "include whitelist-var-common.inc", 32) == 0)
                         cnt_whitelistvar++;
-                else if (strncmp(ptr, "include whitelist-runuser-common.inc", 32) == 0)
+                else if (strncmp(ptr, "include whitelist-runuser-common.inc", 36) == 0 ||
+                        strncmp(ptr, "blacklist ${RUNUSER}", 20) == 0)
                         cnt_whitelistrunuser++;
-                else if (strncmp(ptr, "include whitelist-usr-share-common.inc", 32) == 0)
+                else if (strncmp(ptr, "include whitelist-usr-share-common.inc", 38) == 0)
                         cnt_whitelistusrshare++;
                 else if (strncmp(ptr, "include disable-common.inc", 26) == 0)
                         cnt_ssh++;
@@ -271,7 +272,8 @@ int main(int argc, char **argv) {
         printf("    private-tmp\t\t\t%d\n", cnt_privatetmp);
         printf("    whitelist var\t\t%d   (include whitelist-var-common.inc)\n", cnt_whitelistvar);
         printf("    whitelist run/user\t\t%d   (include whitelist-runuser-common.inc)\n", cnt_whitelistrunuser);
-        printf("    whitelist usr/share\t\t%d   (include whitelist-usr-share-common.inc)\n", cnt_whitelistusrshare);
+        printf("    whitelist usr/share\t\t%d   (include whitelist-usr-share-common.inc\n", cnt_whitelistusrshare);
+        printf("\t\t\t\t\tor blacklist ${RUNUSER})\n");
         printf("    net none\t\t\t%d\n", cnt_netnone);
         printf("\n");
         return 0;