diff options
758 files changed, 3549 insertions, 2061 deletions
diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs new file mode 100644 index 000000000..0c9701d1c --- /dev/null +++ b/.git-blame-ignore-revs | |||
@@ -0,0 +1,4 @@ | |||
1 | # move whitelist/blacklist to allow/deny | ||
2 | fe0f975f447d59977d90c3226cc8c623b31b20b3 | ||
3 | # Revert "move whitelist/blacklist to allow/deny" | ||
4 | f43382f1e9707b4fd5e63c7bfe881912aa4ee994 | ||
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 4b2df855c..0f13afc51 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md | |||
@@ -6,44 +6,72 @@ labels: '' | |||
6 | assignees: '' | 6 | assignees: '' |
7 | 7 | ||
8 | --- | 8 | --- |
9 | Write clear, concise and in textual form. | ||
10 | 9 | ||
11 | **Bug and expected behavior** | 10 | ### Description |
12 | - Describe the bug. | ||
13 | - What did you expect to happen? | ||
14 | 11 | ||
15 | **No profile and disabling firejail** | 12 | _Describe the bug_ |
16 | - What changed calling `firejail --noprofile /path/to/program` in a terminal? | ||
17 | - What changed calling the program by path (e.g. `/usr/bin/vlc`)? | ||
18 | 13 | ||
19 | **Reproduce** | 14 | ### Steps to Reproduce |
20 | Steps to reproduce the behavior: | ||
21 | 1. Run in bash `firejail PROGRAM` | ||
22 | 2. See error `ERROR` | ||
23 | 3. Click on '....' | ||
24 | 4. Scroll down to '....' | ||
25 | 15 | ||
26 | **Environment** | 16 | _Steps to reproduce the behavior_ |
27 | - Linux distribution and version (ie output of `lsb_release -a`, `screenfetch` or `cat /etc/os-release`) | ||
28 | - Firejail version (output of `firejail --version`) exclusive or used git commit (`git rev-parse HEAD`) | ||
29 | 17 | ||
30 | **Additional context** | 18 | 1. Run in bash `LANG=C firejail PROGRAM` (`LANG=C` to get English messages that can be understood by everybody) |
31 | Other context about the problem like related errors to understand the problem. | 19 | 2. Click on '....' |
20 | 3. Scroll down to '....' | ||
21 | 4. See error `ERROR` | ||
32 | 22 | ||
33 | **Checklist** | 23 | ### Expected behavior |
34 | - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). | ||
35 | - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) | ||
36 | - [ ] I have performed a short search for similar issues (to avoid opening a duplicate). | ||
37 | - [ ] If it is a AppImage, `--profile=PROFILENAME` is used to set the right profile. | ||
38 | - [ ] Used `LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM` to get english error-messages. | ||
39 | - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. | ||
40 | - [ ] This is not a question. Questions should be asked in https://github.com/netblue30/firejail/discussions. | ||
41 | 24 | ||
25 | _What you expected to happen_ | ||
42 | 26 | ||
43 | <details><summary> debug output </summary> | 27 | ### Actual behavior |
28 | |||
29 | _What actually happened_ | ||
30 | |||
31 | ### Behavior without a profile | ||
32 | |||
33 | _What changed calling `firejail --noprofile /path/to/program` in a terminal?_ | ||
34 | |||
35 | ### Additional context | ||
36 | |||
37 | _Any other detail that may help to understand/debug the problem_ | ||
38 | |||
39 | ### Environment | ||
40 | |||
41 | - Linux distribution and version (e.g. "Ubuntu 20.04" or "Arch Linux") | ||
42 | - Firejail version (`firejail --version`). | ||
43 | - If you use a development version of firejail, also the commit from which it was compiled (`git rev-parse HEAD`). | ||
44 | |||
45 | ### Checklist | ||
46 | |||
47 | - [ ] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). | ||
48 | - [ ] I can reproduce the issue without custom modifications (e.g. globals.local). | ||
49 | - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) | ||
50 | - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). | ||
51 | - [ ] I have performed a short search for similar issues (to avoid opening a duplicate). | ||
52 | - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. | ||
53 | - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) | ||
54 | |||
55 | ### Log | ||
56 | |||
57 | <details> | ||
58 | <summary>Output of <code>firejail /path/to/program</code></summary> | ||
59 | <p> | ||
60 | |||
61 | ``` | ||
62 | output goes here | ||
63 | ``` | ||
64 | |||
65 | </p> | ||
66 | </details> | ||
67 | |||
68 | <details> | ||
69 | <summary>Output of <code>firejail --debug /path/to/program</code></summary> | ||
70 | <p> | ||
44 | 71 | ||
45 | ``` | 72 | ``` |
46 | OUTPUT OF `firejail --debug PROGRAM` | 73 | output goes here |
47 | ``` | 74 | ``` |
48 | 75 | ||
76 | </p> | ||
49 | </details> | 77 | </details> |
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 000000000..b8fe40acd --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml | |||
@@ -0,0 +1,5 @@ | |||
1 | blank_issues_enabled: true | ||
2 | contact_links: | ||
3 | - name: Question | ||
4 | url: https://github.com/netblue30/firejail/discussions | ||
5 | about: For questions you should use GitHub Discussions. | ||
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 000000000..a723cdbde --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md | |||
@@ -0,0 +1,23 @@ | |||
1 | --- | ||
2 | name: Feature request | ||
3 | about: Suggest an idea for this project | ||
4 | title: '' | ||
5 | labels: '' | ||
6 | assignees: '' | ||
7 | --- | ||
8 | |||
9 | ### Is your feature request related to a problem? Please describe. | ||
10 | |||
11 | _A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]_ | ||
12 | |||
13 | ### Describe the solution you'd like | ||
14 | |||
15 | _A clear and concise description of what you want to happen._ | ||
16 | |||
17 | ### Describe alternatives you've considered | ||
18 | |||
19 | _A clear and concise description of any alternative solutions or features you've considered._ | ||
20 | |||
21 | ### Additional context | ||
22 | |||
23 | _Add any other context or screenshots about the feature request here._ | ||
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 57ac2e9c4..7cb92a938 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md | |||
@@ -1,4 +1,3 @@ | |||
1 | |||
2 | If your PR isn't about profiles or you have no idea how to do one of these, skip the following and go ahead with this PR. | 1 | If your PR isn't about profiles or you have no idea how to do one of these, skip the following and go ahead with this PR. |
3 | 2 | ||
4 | If you submit a PR for new profiles or changing profiles, please do the following: | 3 | If you submit a PR for new profiles or changing profiles, please do the following: |
diff --git a/.github/workflows/sort.yml b/.github/workflows/sort.yml index f3ded0f22..cfa40d2d2 100644 --- a/.github/workflows/sort.yml +++ b/.github/workflows/sort.yml | |||
@@ -19,4 +19,3 @@ jobs: | |||
19 | - uses: actions/checkout@v2 | 19 | - uses: actions/checkout@v2 |
20 | - name: check profiles | 20 | - name: check profiles |
21 | run: ./contrib/sort.py etc/*/{*.inc,*.profile} | 21 | run: ./contrib/sort.py etc/*/{*.inc,*.profile} |
22 | |||
diff --git a/.gitignore b/.gitignore index ea053b503..ace86f218 100644 --- a/.gitignore +++ b/.gitignore | |||
@@ -22,12 +22,13 @@ firejail-users.5 | |||
22 | firejail.1 | 22 | firejail.1 |
23 | firemon.1 | 23 | firemon.1 |
24 | firecfg.1 | 24 | firecfg.1 |
25 | jailcheck.5 | 25 | jailcheck.1 |
26 | mkdeb.sh | 26 | mkdeb.sh |
27 | src/firejail/firejail | 27 | src/firejail/firejail |
28 | src/firemon/firemon | 28 | src/firemon/firemon |
29 | src/firecfg/firecfg | 29 | src/firecfg/firecfg |
30 | src/ftee/ftee | 30 | src/ftee/ftee |
31 | src/fids/fids | ||
31 | src/tags | 32 | src/tags |
32 | src/faudit/faudit | 33 | src/faudit/faudit |
33 | src/fnet/fnet | 34 | src/fnet/fnet |
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 5affd5cff..03e18d269 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml | |||
@@ -67,6 +67,8 @@ debian_ci: | |||
67 | - cd $CI_PROJECT_DIR/.. && (apt-get source --download-only -t experimental firejail || apt-get source --download-only firejail) | 67 | - cd $CI_PROJECT_DIR/.. && (apt-get source --download-only -t experimental firejail || apt-get source --download-only firejail) |
68 | - cd $CI_PROJECT_DIR && tar xf ../firejail_*.debian.tar.* | 68 | - cd $CI_PROJECT_DIR && tar xf ../firejail_*.debian.tar.* |
69 | - rm -rf debian/patches/ | 69 | - rm -rf debian/patches/ |
70 | # next line is a temporary fix for dh_missing failure; remove it after next release | ||
71 | - echo "etc/firejail/*.config" >> debian/firejail.install | ||
70 | - VERSION=$(grep ^PACKAGE_VERSION= configure | cut -d"'" -f2) && dch -v ${VERSION}-0.1~ci "Non-maintainer upload." && git archive -o ../firejail_${VERSION}.orig.tar.gz HEAD && pristine-tar commit ../firejail_${VERSION}.orig.tar.gz ci_build && git branch -m pristine-tar origin/pristine-tar | 72 | - VERSION=$(grep ^PACKAGE_VERSION= configure | cut -d"'" -f2) && dch -v ${VERSION}-0.1~ci "Non-maintainer upload." && git archive -o ../firejail_${VERSION}.orig.tar.gz HEAD && pristine-tar commit ../firejail_${VERSION}.orig.tar.gz ci_build && git branch -m pristine-tar origin/pristine-tar |
71 | - git add debian && git commit -m "add debian/" | 73 | - git add debian && git commit -m "add debian/" |
72 | - export CI_COMMIT_SHA=$(git rev-parse HEAD) | 74 | - export CI_COMMIT_SHA=$(git rev-parse HEAD) |
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 688101d13..0f868d6c4 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md | |||
@@ -34,6 +34,13 @@ If you want to write a new profile, the easiest way to do this is to use the | |||
34 | [profile template](https://github.com/netblue30/firejail/blob/master/etc/templates/profile.template). | 34 | [profile template](https://github.com/netblue30/firejail/blob/master/etc/templates/profile.template). |
35 | If you have already written a profile, please make sure it follows the rules described in the template. | 35 | If you have already written a profile, please make sure it follows the rules described in the template. |
36 | 36 | ||
37 | If you add a new command, here's the checklist: | ||
38 | |||
39 | - [ ] Update manpages: firejail(1) and firejail-profile(5) | ||
40 | - [ ] Update shell completions | ||
41 | - [ ] Update vim syntax files | ||
42 | - [ ] Update --help | ||
43 | |||
37 | # Editing the wiki | 44 | # Editing the wiki |
38 | 45 | ||
39 | You are highly encouraged to add your own tips and tricks to the [wiki](https://github.com/netblue30/firejail/wiki). | 46 | You are highly encouraged to add your own tips and tricks to the [wiki](https://github.com/netblue30/firejail/wiki). |
@@ -1,12 +1,12 @@ | |||
1 | GNU GENERAL PUBLIC LICENSE | 1 | GNU GENERAL PUBLIC LICENSE |
2 | Version 2, June 1991 | 2 | Version 2, June 1991 |
3 | 3 | ||
4 | Copyright (C) 1989, 1991 Free Software Foundation, Inc. | 4 | Copyright (C) 1989, 1991 Free Software Foundation, Inc., |
5 | 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA | 5 | 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA |
6 | Everyone is permitted to copy and distribute verbatim copies | 6 | Everyone is permitted to copy and distribute verbatim copies |
7 | of this license document, but changing it is not allowed. | 7 | of this license document, but changing it is not allowed. |
8 | 8 | ||
9 | Preamble | 9 | Preamble |
10 | 10 | ||
11 | The licenses for most software are designed to take away your | 11 | The licenses for most software are designed to take away your |
12 | freedom to share and change it. By contrast, the GNU General Public | 12 | freedom to share and change it. By contrast, the GNU General Public |
@@ -15,7 +15,7 @@ software--to make sure the software is free for all its users. This | |||
15 | General Public License applies to most of the Free Software | 15 | General Public License applies to most of the Free Software |
16 | Foundation's software and to any other program whose authors commit to | 16 | Foundation's software and to any other program whose authors commit to |
17 | using it. (Some other Free Software Foundation software is covered by | 17 | using it. (Some other Free Software Foundation software is covered by |
18 | the GNU Library General Public License instead.) You can apply it to | 18 | the GNU Lesser General Public License instead.) You can apply it to |
19 | your programs, too. | 19 | your programs, too. |
20 | 20 | ||
21 | When we speak of free software, we are referring to freedom, not | 21 | When we speak of free software, we are referring to freedom, not |
@@ -55,8 +55,8 @@ patent must be licensed for everyone's free use or not licensed at all. | |||
55 | 55 | ||
56 | The precise terms and conditions for copying, distribution and | 56 | The precise terms and conditions for copying, distribution and |
57 | modification follow. | 57 | modification follow. |
58 | 58 | ||
59 | GNU GENERAL PUBLIC LICENSE | 59 | GNU GENERAL PUBLIC LICENSE |
60 | TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION | 60 | TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION |
61 | 61 | ||
62 | 0. This License applies to any program or other work which contains | 62 | 0. This License applies to any program or other work which contains |
@@ -110,7 +110,7 @@ above, provided that you also meet all of these conditions: | |||
110 | License. (Exception: if the Program itself is interactive but | 110 | License. (Exception: if the Program itself is interactive but |
111 | does not normally print such an announcement, your work based on | 111 | does not normally print such an announcement, your work based on |
112 | the Program is not required to print an announcement.) | 112 | the Program is not required to print an announcement.) |
113 | 113 | ||
114 | These requirements apply to the modified work as a whole. If | 114 | These requirements apply to the modified work as a whole. If |
115 | identifiable sections of that work are not derived from the Program, | 115 | identifiable sections of that work are not derived from the Program, |
116 | and can be reasonably considered independent and separate works in | 116 | and can be reasonably considered independent and separate works in |
@@ -168,7 +168,7 @@ access to copy from a designated place, then offering equivalent | |||
168 | access to copy the source code from the same place counts as | 168 | access to copy the source code from the same place counts as |
169 | distribution of the source code, even though third parties are not | 169 | distribution of the source code, even though third parties are not |
170 | compelled to copy the source along with the object code. | 170 | compelled to copy the source along with the object code. |
171 | 171 | ||
172 | 4. You may not copy, modify, sublicense, or distribute the Program | 172 | 4. You may not copy, modify, sublicense, or distribute the Program |
173 | except as expressly provided under this License. Any attempt | 173 | except as expressly provided under this License. Any attempt |
174 | otherwise to copy, modify, sublicense or distribute the Program is | 174 | otherwise to copy, modify, sublicense or distribute the Program is |
@@ -225,7 +225,7 @@ impose that choice. | |||
225 | 225 | ||
226 | This section is intended to make thoroughly clear what is believed to | 226 | This section is intended to make thoroughly clear what is believed to |
227 | be a consequence of the rest of this License. | 227 | be a consequence of the rest of this License. |
228 | 228 | ||
229 | 8. If the distribution and/or use of the Program is restricted in | 229 | 8. If the distribution and/or use of the Program is restricted in |
230 | certain countries either by patents or by copyrighted interfaces, the | 230 | certain countries either by patents or by copyrighted interfaces, the |
231 | original copyright holder who places the Program under this License | 231 | original copyright holder who places the Program under this License |
@@ -255,7 +255,7 @@ make exceptions for this. Our decision will be guided by the two goals | |||
255 | of preserving the free status of all derivatives of our free software and | 255 | of preserving the free status of all derivatives of our free software and |
256 | of promoting the sharing and reuse of software generally. | 256 | of promoting the sharing and reuse of software generally. |
257 | 257 | ||
258 | NO WARRANTY | 258 | NO WARRANTY |
259 | 259 | ||
260 | 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY | 260 | 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY |
261 | FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN | 261 | FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN |
@@ -277,4 +277,63 @@ YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER | |||
277 | PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE | 277 | PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE |
278 | POSSIBILITY OF SUCH DAMAGES. | 278 | POSSIBILITY OF SUCH DAMAGES. |
279 | 279 | ||
280 | END OF TERMS AND CONDITIONS | 280 | END OF TERMS AND CONDITIONS |
281 | |||
282 | How to Apply These Terms to Your New Programs | ||
283 | |||
284 | If you develop a new program, and you want it to be of the greatest | ||
285 | possible use to the public, the best way to achieve this is to make it | ||
286 | free software which everyone can redistribute and change under these terms. | ||
287 | |||
288 | To do so, attach the following notices to the program. It is safest | ||
289 | to attach them to the start of each source file to most effectively | ||
290 | convey the exclusion of warranty; and each file should have at least | ||
291 | the "copyright" line and a pointer to where the full notice is found. | ||
292 | |||
293 | <one line to give the program's name and a brief idea of what it does.> | ||
294 | Copyright (C) <year> <name of author> | ||
295 | |||
296 | This program is free software; you can redistribute it and/or modify | ||
297 | it under the terms of the GNU General Public License as published by | ||
298 | the Free Software Foundation; either version 2 of the License, or | ||
299 | (at your option) any later version. | ||
300 | |||
301 | This program is distributed in the hope that it will be useful, | ||
302 | but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
303 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
304 | GNU General Public License for more details. | ||
305 | |||
306 | You should have received a copy of the GNU General Public License along | ||
307 | with this program; if not, write to the Free Software Foundation, Inc., | ||
308 | 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
309 | |||
310 | Also add information on how to contact you by electronic and paper mail. | ||
311 | |||
312 | If the program is interactive, make it output a short notice like this | ||
313 | when it starts in an interactive mode: | ||
314 | |||
315 | Gnomovision version 69, Copyright (C) year name of author | ||
316 | Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. | ||
317 | This is free software, and you are welcome to redistribute it | ||
318 | under certain conditions; type `show c' for details. | ||
319 | |||
320 | The hypothetical commands `show w' and `show c' should show the appropriate | ||
321 | parts of the General Public License. Of course, the commands you use may | ||
322 | be called something other than `show w' and `show c'; they could even be | ||
323 | mouse-clicks or menu items--whatever suits your program. | ||
324 | |||
325 | You should also get your employer (if you work as a programmer) or your | ||
326 | school, if any, to sign a "copyright disclaimer" for the program, if | ||
327 | necessary. Here is a sample; alter the names: | ||
328 | |||
329 | Yoyodyne, Inc., hereby disclaims all copyright interest in the program | ||
330 | `Gnomovision' (which makes passes at compilers) written by James Hacker. | ||
331 | |||
332 | <signature of Ty Coon>, 1 April 1989 | ||
333 | Ty Coon, President of Vice | ||
334 | |||
335 | This General Public License does not permit incorporating your program into | ||
336 | proprietary programs. If your program is a subroutine library, you may | ||
337 | consider it more useful to permit linking proprietary applications with the | ||
338 | library. If this is what you want to do, use the GNU Lesser General | ||
339 | Public License instead of this License. | ||
diff --git a/Makefile.in b/Makefile.in index 17bd76464..c94d8c7a4 100644 --- a/Makefile.in +++ b/Makefile.in | |||
@@ -26,7 +26,7 @@ COMPLETIONDIRS = src/zsh_completion src/bash_completion | |||
26 | .PHONY: all | 26 | .PHONY: all |
27 | all: all_items mydirs $(MAN_TARGET) filters | 27 | all: all_items mydirs $(MAN_TARGET) filters |
28 | APPS = src/firecfg/firecfg src/firejail/firejail src/firemon/firemon src/profstats/profstats src/jailcheck/jailcheck | 28 | APPS = src/firecfg/firecfg src/firejail/firejail src/firemon/firemon src/profstats/profstats src/jailcheck/jailcheck |
29 | SBOX_APPS = src/fbuilder/fbuilder src/ftee/ftee | 29 | SBOX_APPS = src/fbuilder/fbuilder src/ftee/ftee src/fids/fids |
30 | SBOX_APPS_NON_DUMPABLE = src/fcopy/fcopy src/fldd/fldd src/fnet/fnet src/fnetfilter/fnetfilter | 30 | SBOX_APPS_NON_DUMPABLE = src/fcopy/fcopy src/fldd/fldd src/fnet/fnet src/fnetfilter/fnetfilter |
31 | MYDIRS = src/lib $(MAN_SRC) $(COMPLETIONDIRS) | 31 | MYDIRS = src/lib $(MAN_SRC) $(COMPLETIONDIRS) |
32 | MYLIBS = src/libpostexecseccomp/libpostexecseccomp.so src/libtrace/libtrace.so src/libtracelog/libtracelog.so | 32 | MYLIBS = src/libpostexecseccomp/libpostexecseccomp.so src/libtrace/libtrace.so src/libtracelog/libtracelog.so |
@@ -135,7 +135,7 @@ endif | |||
135 | install -m 0644 -t $(DESTDIR)$(DOCDIR) COPYING README RELNOTES etc/templates/* | 135 | install -m 0644 -t $(DESTDIR)$(DOCDIR) COPYING README RELNOTES etc/templates/* |
136 | # profiles and settings | 136 | # profiles and settings |
137 | install -m 0755 -d $(DESTDIR)$(sysconfdir)/firejail | 137 | install -m 0755 -d $(DESTDIR)$(sysconfdir)/firejail |
138 | install -m 0644 -t $(DESTDIR)$(sysconfdir)/firejail etc/profile-a-l/*.profile etc/profile-m-z/*.profile etc/inc/*.inc etc/net/*.net etc/firejail.config | 138 | install -m 0644 -t $(DESTDIR)$(sysconfdir)/firejail etc/profile-a-l/*.profile etc/profile-m-z/*.profile etc/inc/*.inc etc/net/*.net etc/firejail.config etc/ids.config |
139 | sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;" | 139 | sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;" |
140 | ifeq ($(BUSYBOX_WORKAROUND),yes) | 140 | ifeq ($(BUSYBOX_WORKAROUND),yes) |
141 | ./mketc.sh $(DESTDIR)$(sysconfdir)/firejail/disable-common.inc | 141 | ./mketc.sh $(DESTDIR)$(sysconfdir)/firejail/disable-common.inc |
@@ -1,13 +1,13 @@ | |||
1 | Firejail is a SUID sandbox program that reduces the risk of security | 1 | Firejail is a SUID sandbox program that reduces the risk of security |
2 | breaches by restricting the running environment of untrusted applications | 2 | breaches by restricting the running environment of untrusted applications |
3 | using Linux namespaces and seccomp-bpf. It includes sandbox profiles for | 3 | using Linux namespaces and seccomp-bpf. It includes sandbox profiles for |
4 | Iceweasel/Mozilla Firefox, Chromium, Midori, Opera, Evince, Transmission, | 4 | Iceweasel/Mozilla Firefox, Chromium, Midori, Opera, Evince, Transmission, |
5 | VLC, Audacious, Clementine, Rhythmbox, Totem, Deluge, qBittorrent. | 5 | VLC, Audacious, Clementine, Rhythmbox, Totem, Deluge, qBittorrent. |
6 | DeaDBeeF, Dropbox, Empathy, FileZilla, IceCat, Thunderbird/Icedove, | 6 | DeaDBeeF, Dropbox, Empathy, FileZilla, IceCat, Thunderbird/Icedove, |
7 | Pidgin, Quassel, and XChat. | 7 | Pidgin, Quassel, and XChat. |
8 | 8 | ||
9 | Firejail also expands the restricted shell facility found in bash by adding | 9 | Firejail also expands the restricted shell facility found in bash by adding |
10 | Linux namespace support. It supports sandboxing specific users upon login. | 10 | Linux namespace support. It supports sandboxing specific users upon login. |
11 | 11 | ||
12 | Download: https://sourceforge.net/projects/firejail/files/ | 12 | Download: https://sourceforge.net/projects/firejail/files/ |
13 | Build and install: ./configure && make && sudo make install | 13 | Build and install: ./configure && make && sudo make install |
@@ -45,6 +45,7 @@ Committers | |||
45 | - Kelvin M. Klann (https://github.com/kmk3) | 45 | - Kelvin M. Klann (https://github.com/kmk3) |
46 | - Kristóf Marussy (https://github.com/kris7t) | 46 | - Kristóf Marussy (https://github.com/kris7t) |
47 | - Neo00001 (https://github.com/Neo00001) | 47 | - Neo00001 (https://github.com/Neo00001) |
48 | - pirate486743186 (https://github.com/pirate486743186) | ||
48 | - Reiner Herrmann (https://github.com/reinerh - Debian/Ubuntu maintainer) | 49 | - Reiner Herrmann (https://github.com/reinerh - Debian/Ubuntu maintainer) |
49 | - rusty-snake (https://github.com/rusty-snake) | 50 | - rusty-snake (https://github.com/rusty-snake) |
50 | - smitsohu (https://github.com/smitsohu) | 51 | - smitsohu (https://github.com/smitsohu) |
@@ -67,6 +68,8 @@ Firejail Authors (alphabetical order) | |||
67 | - fix flameshot raw screenshots | 68 | - fix flameshot raw screenshots |
68 | 1dnrr (https://github.com/1dnrr) | 69 | 1dnrr (https://github.com/1dnrr) |
69 | - add pybitmessage profile | 70 | - add pybitmessage profile |
71 | a1346054 (https://github.com/a1346054) | ||
72 | - add missing final newlines in various files | ||
70 | Ádler Jonas Gross (https://github.com/adgross) | 73 | Ádler Jonas Gross (https://github.com/adgross) |
71 | - AppArmor fix | 74 | - AppArmor fix |
72 | Adrian L. Shaw (https://github.com/adrianlshaw) | 75 | Adrian L. Shaw (https://github.com/adrianlshaw) |
@@ -80,6 +83,8 @@ Akhil Hans Maulloo (https://github.com/kouul) | |||
80 | Albin Kauffmann (https://github.com/albinou) | 83 | Albin Kauffmann (https://github.com/albinou) |
81 | - Firefox and Chromium profile fixes | 84 | - Firefox and Chromium profile fixes |
82 | - info to allow screen sharing in profiles | 85 | - info to allow screen sharing in profiles |
86 | Alex Leahu (https://github.com/alxjsn) | ||
87 | - fix screen sharing configuration on Wayland | ||
83 | Alexey Kuznetsov (kuznet@ms2.inr.ac.ru) | 88 | Alexey Kuznetsov (kuznet@ms2.inr.ac.ru) |
84 | - src/lib/libnetlink.c extracted from iproute2 software package | 89 | - src/lib/libnetlink.c extracted from iproute2 software package |
85 | Aleksey Manevich (https://github.com/manevich) | 90 | Aleksey Manevich (https://github.com/manevich) |
@@ -168,6 +173,8 @@ Bandie (https://github.com/Bandie) | |||
168 | - fixed riot-desktop | 173 | - fixed riot-desktop |
169 | Barış Ekin Yıldırım (https://github.com/circuitshaker) | 174 | Barış Ekin Yıldırım (https://github.com/circuitshaker) |
170 | - removing net none from code.profile | 175 | - removing net none from code.profile |
176 | Bart Bakker (https://github.com/bjpbakker) | ||
177 | - multimc5: fix exec of LWJGL libraries | ||
171 | bbhtt (https://github.com/bbhtt) | 178 | bbhtt (https://github.com/bbhtt) |
172 | - improvements to balsa,fractal,gajim,trojita profiles | 179 | - improvements to balsa,fractal,gajim,trojita profiles |
173 | - improvements to nheko, spectral, feh, links, lynx, smplayer profiles | 180 | - improvements to nheko, spectral, feh, links, lynx, smplayer profiles |
@@ -182,6 +189,7 @@ bitfreak25 (https://github.com/bitfreak25) | |||
182 | - added PlayOnLinux profile | 189 | - added PlayOnLinux profile |
183 | - minetest profile fix | 190 | - minetest profile fix |
184 | - added sylpheed profile | 191 | - added sylpheed profile |
192 | |||
185 | bn0785ac (https://github.com/bn0785ac) | 193 | bn0785ac (https://github.com/bn0785ac) |
186 | - fixed bnox, dnox profiles | 194 | - fixed bnox, dnox profiles |
187 | - support all tor-browser langpacks | 195 | - support all tor-browser langpacks |
@@ -215,6 +223,8 @@ Carlo Abelli (https://github.com/carloabelli) | |||
215 | - fixed simple-scan | 223 | - fixed simple-scan |
216 | Cat (https://github.com/ecat3) | 224 | Cat (https://github.com/ecat3) |
217 | - prevent tmux connecting to an existing session | 225 | - prevent tmux connecting to an existing session |
226 | cayday (https://github.com/caydey) | ||
227 | - added ~/Private blacklist in disable-common.inc | ||
218 | Christian Pinedo (https://github.com/chrpinedo) | 228 | Christian Pinedo (https://github.com/chrpinedo) |
219 | - added nicotine profile | 229 | - added nicotine profile |
220 | - allow python3 in totem profile | 230 | - allow python3 in totem profile |
@@ -240,6 +250,8 @@ crass (https://github.com/crass) | |||
240 | - extract_command_name fixes | 250 | - extract_command_name fixes |
241 | - update appimage size calculation to newest code from libappimage | 251 | - update appimage size calculation to newest code from libappimage |
242 | - firejail should look for processes with names exactly named | 252 | - firejail should look for processes with names exactly named |
253 | croket (https://github.com/crocket) | ||
254 | - fix librewolf profile | ||
243 | curiosity-seeker (https://github.com/curiosity-seeker - old) | 255 | curiosity-seeker (https://github.com/curiosity-seeker - old) |
244 | curiosityseeker (https://github.com/curiosityseeker - new) | 256 | curiosityseeker (https://github.com/curiosityseeker - new) |
245 | - tightening unbound and dnscrypt-proxy profiles | 257 | - tightening unbound and dnscrypt-proxy profiles |
@@ -281,6 +293,7 @@ Davide Beatrici (https://github.com/davidebeatrici) | |||
281 | - steam.profile: correctly blacklist unneeded directories in user's home | 293 | - steam.profile: correctly blacklist unneeded directories in user's home |
282 | - minetest fixes | 294 | - minetest fixes |
283 | - map /dev/input with "--private-dev", add "--no-input" option to disable it | 295 | - map /dev/input with "--private-dev", add "--no-input" option to disable it |
296 | - whitelist /usr/share/TelegramDesktop in telegram.profile | ||
284 | David Hyrule (https://github.com/Svaag) | 297 | David Hyrule (https://github.com/Svaag) |
285 | - remove nou2f in ssh profile | 298 | - remove nou2f in ssh profile |
286 | Deelvesh Bunjun (https://github.com/DeelveshBunjun) | 299 | Deelvesh Bunjun (https://github.com/DeelveshBunjun) |
@@ -328,6 +341,7 @@ Florian Begusch (https://github.com/florianbegusch) | |||
328 | - (la)tex profiles | 341 | - (la)tex profiles |
329 | - fixed transmission-common.profile | 342 | - fixed transmission-common.profile |
330 | - fixed standardnotes-desktop.profile | 343 | - fixed standardnotes-desktop.profile |
344 | - fix jailprober.py | ||
331 | floxo (https://github.com/floxo) | 345 | floxo (https://github.com/floxo) |
332 | - fixed qml disk cache issue | 346 | - fixed qml disk cache issue |
333 | Franco (nextime) Lanza (https://github.com/nextime) | 347 | Franco (nextime) Lanza (https://github.com/nextime) |
@@ -446,7 +460,7 @@ hawkey116477 (https://github.com/hawkeye116477) | |||
446 | Helmut Grohne (https://github.com/helmutg) | 460 | Helmut Grohne (https://github.com/helmutg) |
447 | - compiler support in the build system - Debian bug #869707 | 461 | - compiler support in the build system - Debian bug #869707 |
448 | hhzek0014 (https://github.com/hhzek0014) | 462 | hhzek0014 (https://github.com/hhzek0014) |
449 | - updated bibletime.profile | 463 | - updated bibletime.profile |
450 | hlein (https://github.com/hlein) | 464 | hlein (https://github.com/hlein) |
451 | - strip out \r's from jail prober | 465 | - strip out \r's from jail prober |
452 | Holger Heinz (https://github.com/hheinz) | 466 | Holger Heinz (https://github.com/hheinz) |
@@ -471,6 +485,8 @@ irregulator (https://github.com/irregulator) | |||
471 | Irvine (https://github.com/Irvinehimself) | 485 | Irvine (https://github.com/Irvinehimself) |
472 | - added conky profile | 486 | - added conky profile |
473 | - added ping, bsdtar, makepkg (Arch), archaudit-report, cower (Arch) profiles | 487 | - added ping, bsdtar, makepkg (Arch), archaudit-report, cower (Arch) profiles |
488 | Ivan (https://github.com/ordinary-dev) | ||
489 | - fix telegram profile | ||
474 | Ivan Kozik (https://github.com/ivan) | 490 | Ivan Kozik (https://github.com/ivan) |
475 | - speed up sandbox exit | 491 | - speed up sandbox exit |
476 | Jaykishan Mutkawoa (https://github.com/jmutkawoa) | 492 | Jaykishan Mutkawoa (https://github.com/jmutkawoa) |
@@ -480,6 +496,10 @@ James Elford (https://github.com/jelford) | |||
480 | - removed shell none from ssh-agent configuration, fixing the infinite loop | 496 | - removed shell none from ssh-agent configuration, fixing the infinite loop |
481 | - added gcloud profile | 497 | - added gcloud profile |
482 | - blacklist sensitive cloud provider files in disable-common | 498 | - blacklist sensitive cloud provider files in disable-common |
499 | Jan-Niclas (https://github.com/0x6a61) | ||
500 | - moved rules from firefox-common.profile to firefox.profile | ||
501 | - blacklist /*firefox* except for firefox itself | ||
502 | - fix Firefox 'Profile not found' - whitelist /run/user/xxx/firefox | ||
483 | Jean Lucas (https://github.com/flacks) | 503 | Jean Lucas (https://github.com/flacks) |
484 | - fix Discord profile | 504 | - fix Discord profile |
485 | - add AnyDesk profile | 505 | - add AnyDesk profile |
@@ -516,6 +536,7 @@ John Mullee (https://github.com/jmullee) | |||
516 | Jonas Heinrich (https://github.com/onny) | 536 | Jonas Heinrich (https://github.com/onny) |
517 | - added signal-desktop profile | 537 | - added signal-desktop profile |
518 | - fixed franz profile | 538 | - fixed franz profile |
539 | - remove /etc/hosts is_link check for NixOS | ||
519 | Jose Riha (https://github.com/jose1711) | 540 | Jose Riha (https://github.com/jose1711) |
520 | - added meteo-qt profile | 541 | - added meteo-qt profile |
521 | - created qgis, links, xlinks profiles | 542 | - created qgis, links, xlinks profiles |
@@ -558,7 +579,7 @@ Kishore96in (https://github.com/Kishore96in) | |||
558 | - added falkon profile | 579 | - added falkon profile |
559 | - kxmlgui fixes | 580 | - kxmlgui fixes |
560 | - okular profile fixes | 581 | - okular profile fixes |
561 | - jitsi-meet-desktop profile | 582 | - jitsi-meet-desktop profile |
562 | - konversatin profile fix | 583 | - konversatin profile fix |
563 | - added Neochat profile | 584 | - added Neochat profile |
564 | - added whitelist-1793-workaround.inc | 585 | - added whitelist-1793-workaround.inc |
@@ -573,6 +594,8 @@ Kristóf Marussy (https://github.com/kris7t) | |||
573 | - dns support | 594 | - dns support |
574 | kuesji koesnu (https://github.com/kuesji) | 595 | kuesji koesnu (https://github.com/kuesji) |
575 | - unit suffixes for rlimit-fsize and rlimit-as | 596 | - unit suffixes for rlimit-fsize and rlimit-as |
597 | - util.c and firejail.h fixes | ||
598 | - better parser for size strings | ||
576 | Kunal Mehta (https://github.com/legoktm) | 599 | Kunal Mehta (https://github.com/legoktm) |
577 | - converted all links to https in manpages | 600 | - converted all links to https in manpages |
578 | laniakea64 (https://github.com/laniakea64) | 601 | laniakea64 (https://github.com/laniakea64) |
@@ -583,6 +606,9 @@ Laurent Declercq (https://github.com/nuxwin) | |||
583 | - fixed test for shell interpreter in chroots | 606 | - fixed test for shell interpreter in chroots |
584 | LaurentGH (https://github.com/LaurentGH) | 607 | LaurentGH (https://github.com/LaurentGH) |
585 | - allow private-bin parameters to be absolute paths | 608 | - allow private-bin parameters to be absolute paths |
609 | lecso7 (https://github.com/lecso7) | ||
610 | - added goldendict profile | ||
611 | - allow evince to read .cbz file format | ||
586 | Loïc Damien (https://github.com/dzamlo) | 612 | Loïc Damien (https://github.com/dzamlo) |
587 | - small fixes | 613 | - small fixes |
588 | Liorst4 (https://github.com/Liorst4) | 614 | Liorst4 (https://github.com/Liorst4) |
@@ -596,6 +622,8 @@ Lukáš Krejčí (https://github.com/lskrejci) | |||
596 | - fixed parsing of --keep-var-tmp | 622 | - fixed parsing of --keep-var-tmp |
597 | luzpaz (https://github.com/luzpaz) | 623 | luzpaz (https://github.com/luzpaz) |
598 | - code spelling fixes | 624 | - code spelling fixes |
625 | lxeiqr (https://github.com/lxeiqr) | ||
626 | - fix sndio support | ||
599 | Mace Muilman (https://github.com/mace015) | 627 | Mace Muilman (https://github.com/mace015) |
600 | - google-chrome{,beta,unstable} flags | 628 | - google-chrome{,beta,unstable} flags |
601 | maces (https://github.com/maces) | 629 | maces (https://github.com/maces) |
@@ -613,6 +641,8 @@ Martin Carpenter (https://github.com/mcarpenter) | |||
613 | Martin Dosch (spam-debian@mdosch.de) | 641 | Martin Dosch (spam-debian@mdosch.de) |
614 | - support for gnome-shell integration addon in Firefox | 642 | - support for gnome-shell integration addon in Firefox |
615 | (Bug-Debian: https://bugs.debian.org/872720) | 643 | (Bug-Debian: https://bugs.debian.org/872720) |
644 | Martynas Janonis (https://github.com/mjanonis) | ||
645 | - update wrc for Arch Linux | ||
616 | Matt Parnell (https://github.com/ilikenwf) | 646 | Matt Parnell (https://github.com/ilikenwf) |
617 | - whitelisting for core firefox related functionality | 647 | - whitelisting for core firefox related functionality |
618 | Mattias Wadman (https://github.com/wader) | 648 | Mattias Wadman (https://github.com/wader) |
@@ -636,6 +666,8 @@ Michael Hoffmann (https://github.com/brisad) | |||
636 | - added support for subdirs in private-etc | 666 | - added support for subdirs in private-etc |
637 | Mike Frysinger (vapier@gentoo.org) | 667 | Mike Frysinger (vapier@gentoo.org) |
638 | - Gentoo compile patch | 668 | - Gentoo compile patch |
669 | minus7 (https://github.com/minus7) | ||
670 | - fix hanging arp_check | ||
639 | mirabellette (https://github.com/mirabellette) | 671 | mirabellette (https://github.com/mirabellette) |
640 | - add comment to thunderbird.profile to allow Firefox to load profiles | 672 | - add comment to thunderbird.profile to allow Firefox to load profiles |
641 | mjudtmann (https://github.com/mjudtmann) | 673 | mjudtmann (https://github.com/mjudtmann) |
@@ -654,6 +686,8 @@ Neo00001 (https://github.com/Neo00001) | |||
654 | - update telegram profile | 686 | - update telegram profile |
655 | - add spectacle profile | 687 | - add spectacle profile |
656 | - add kdiff3 profile | 688 | - add kdiff3 profile |
689 | NetSysFire (https://github.com/NetSysFire) | ||
690 | - update weechat profile | ||
657 | Nick Fox (https://github.com/njfox) | 691 | Nick Fox (https://github.com/njfox) |
658 | - add a profile alias for code-oss | 692 | - add a profile alias for code-oss |
659 | - add code-oss config directory | 693 | - add code-oss config directory |
@@ -681,7 +715,7 @@ Ondra Nekola (https://github.com/satai) | |||
681 | OndrejMalek (https://github.com/OndrejMalek) | 715 | OndrejMalek (https://github.com/OndrejMalek) |
682 | - various manpage fixes | 716 | - various manpage fixes |
683 | Ondřej Nový (https://github.com/onovy) | 717 | Ondřej Nový (https://github.com/onovy) |
684 | - allow video for Signal profile | 718 | - allow video for Signal profile |
685 | - added Mattermost desktop profile | 719 | - added Mattermost desktop profile |
686 | - hardened Zoom profile | 720 | - hardened Zoom profile |
687 | - hardened Signal desktop profile | 721 | - hardened Signal desktop profile |
@@ -698,7 +732,7 @@ Patrick Toomey (https://sourceforge.net/u/ptoomey/profile/) | |||
698 | Paul Moore <pmoore@redhat.com> | 732 | Paul Moore <pmoore@redhat.com> |
699 | -src/fsec-print/print.c extracted from libseccomp software package | 733 | -src/fsec-print/print.c extracted from libseccomp software package |
700 | Paupiah Yash (https://github.com/CaffeinatedStud) | 734 | Paupiah Yash (https://github.com/CaffeinatedStud) |
701 | - gzip profile | 735 | - gzip profile |
702 | Pawel (https://github.com/grimskies) | 736 | Pawel (https://github.com/grimskies) |
703 | - make --join return exit code of the invoked program | 737 | - make --join return exit code of the invoked program |
704 | Peter Millerchip (https://github.com/pmillerchip) | 738 | Peter Millerchip (https://github.com/pmillerchip) |
@@ -739,8 +773,9 @@ pirate486743186 (https://github.com/pirate486743186) | |||
739 | - adding qcomicbook and pipe-viewer in disable-programs | 773 | - adding qcomicbook and pipe-viewer in disable-programs |
740 | - newsboat/newsbeuter profiles | 774 | - newsboat/newsbeuter profiles |
741 | - fix atril profile | 775 | - fix atril profile |
742 | - rtv profile | ||
743 | - reorganizing links browsers | 776 | - reorganizing links browsers |
777 | - added rtv, alpine, mcomix, qcomicbook, googler, ddgr profiles | ||
778 | - w3m, zahura, profile.template fixes | ||
744 | Pixel Fairy (https://github.com/xahare) | 779 | Pixel Fairy (https://github.com/xahare) |
745 | - added fjclip.py, fjdisplay.py and fjresize.py in contrib section | 780 | - added fjclip.py, fjdisplay.py and fjresize.py in contrib section |
746 | PizzaDude (https://github.com/pizzadude) | 781 | PizzaDude (https://github.com/pizzadude) |
@@ -925,7 +960,7 @@ SYN-cook (https://github.com/SYN-cook) | |||
925 | - gnome-calculator changes | 960 | - gnome-calculator changes |
926 | startx2017 (https://github.com/startx2017) | 961 | startx2017 (https://github.com/startx2017) |
927 | - syscall list update | 962 | - syscall list update |
928 | - updated default seccomp filters - added bpf, clock_settime, personality, process_vm_writev, query_module, | 963 | - updated default seccomp filters - added bpf, clock_settime, personality, process_vm_writev, query_module, |
929 | settimeofday, stime, umount, userfaultfd, ustat, vm86, and vm86old | 964 | settimeofday, stime, umount, userfaultfd, ustat, vm86, and vm86old |
930 | - enable/disable join support in /etc/firejail/firejail.config | 965 | - enable/disable join support in /etc/firejail/firejail.config |
931 | - firecfg fix: create ~/.local/share/applications directory if it doesn't exist | 966 | - firecfg fix: create ~/.local/share/applications directory if it doesn't exist |
@@ -976,10 +1011,11 @@ Topi Miettinen (https://github.com/topimiettinen) | |||
976 | - improve loading of seccomp filter and memory-deny-write-execute feature | 1011 | - improve loading of seccomp filter and memory-deny-write-execute feature |
977 | - private-lib feature | 1012 | - private-lib feature |
978 | - make --nodbus block also system D-Bus socket | 1013 | - make --nodbus block also system D-Bus socket |
979 | Ted Robertson (https://github.com/tredondo) | 1014 | Ted Robertson (https://github.com/tredondo) |
980 | - webstorm profile fixes | 1015 | - webstorm profile fixes |
981 | - added bcompare profile | 1016 | - added bcompare profile |
982 | - various documentation fixes | 1017 | - various documentation fixes |
1018 | - blacklist Exodus wallet | ||
983 | user1024 (user1024@tut.by) | 1019 | user1024 (user1024@tut.by) |
984 | - electron profile whitelisting | 1020 | - electron profile whitelisting |
985 | - fixed Rocket.Chat profile | 1021 | - fixed Rocket.Chat profile |
@@ -1035,7 +1071,7 @@ vismir2 (https://github.com/vismir2) | |||
1035 | - feh, ranger, 7z, keepass, keepassx and zathura profiles | 1071 | - feh, ranger, 7z, keepass, keepassx and zathura profiles |
1036 | - claws-mail, mutt, git, emacs, vim profiles | 1072 | - claws-mail, mutt, git, emacs, vim profiles |
1037 | - lots of profile fixes | 1073 | - lots of profile fixes |
1038 | - support for truecrypt and zuluCrypt | 1074 | - support for truecrypt and zuluCrypt |
1039 | viq (https://github.com/viq) | 1075 | viq (https://github.com/viq) |
1040 | - discord-canary profile | 1076 | - discord-canary profile |
1041 | Vladimir Gorelov (https://github.com/larkvirtual) | 1077 | Vladimir Gorelov (https://github.com/larkvirtual) |
@@ -1043,10 +1079,12 @@ Vladimir Gorelov (https://github.com/larkvirtual) | |||
1043 | Vladimir Schowalter (https://github.com/VladimirSchowalter20) | 1079 | Vladimir Schowalter (https://github.com/VladimirSchowalter20) |
1044 | - apparmor profile enhancements | 1080 | - apparmor profile enhancements |
1045 | - various KDE profile enhancements | 1081 | - various KDE profile enhancements |
1046 | read-only kde5 services directory | 1082 | - read-only kde5 services directory |
1047 | Vladislav Nepogodin (https://github.com/vnepogodin) | 1083 | Vladislav Nepogodin (https://github.com/vnepogodin) |
1048 | - added Librewolf profiles | 1084 | - added Librewolf profiles |
1049 | - added Sway profile | 1085 | - added Sway profile |
1086 | - fix CLion profile | ||
1087 | - fixes for disable-programs.inc | ||
1050 | xee5ch (https://github.com/xee5ch) | 1088 | xee5ch (https://github.com/xee5ch) |
1051 | - skypeforlinux profile | 1089 | - skypeforlinux profile |
1052 | Ypnose (https://github.com/Ypnose) | 1090 | Ypnose (https://github.com/Ypnose) |
@@ -114,7 +114,7 @@ https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-loca | |||
114 | 114 | ||
115 | ## Installing | 115 | ## Installing |
116 | 116 | ||
117 | Try installing Firejail from your system packages first. Firejail is included in Alpine, ALT Linux, Arch, Chakra, Debian, Deepin, Devuan, Fedora, Gentoo, Manjaro, Mint, NixOS, Parabola, Parrot, PCLinuxOS, ROSA, Solus, Slackware/SlackBuilds, Trisquel, Ubuntu, Void and possibly others. | 117 | Try installing Firejail from your system packages first. Firejail is included in Alpine, ALT Linux, Arch, Artix, Chakra, Debian, Deepin, Devuan, Fedora, Gentoo, Manjaro, Mint, NixOS, Parabola, Parrot, PCLinuxOS, ROSA, Solus, Slackware/SlackBuilds, Trisquel, Ubuntu, Void and possibly others. |
118 | 118 | ||
119 | The firejail 0.9.52-LTS version is deprecated. On Ubuntu 18.04 LTS users are advised to use the [PPA](https://launchpad.net/~deki/+archive/ubuntu/firejail). On Debian buster we recommend to use the [backports](https://packages.debian.org/buster-backports/firejail) package. | 119 | The firejail 0.9.52-LTS version is deprecated. On Ubuntu 18.04 LTS users are advised to use the [PPA](https://launchpad.net/~deki/+archive/ubuntu/firejail). On Debian buster we recommend to use the [backports](https://packages.debian.org/buster-backports/firejail) package. |
120 | 120 | ||
@@ -189,107 +189,48 @@ You can also use this tool to get a list of syscalls needed by a program: [contr | |||
189 | 189 | ||
190 | We also keep a list of profile fixes for previous released versions in [etc-fixes](https://github.com/netblue30/firejail/tree/master/etc-fixes) directory. | 190 | We also keep a list of profile fixes for previous released versions in [etc-fixes](https://github.com/netblue30/firejail/tree/master/etc-fixes) directory. |
191 | 191 | ||
192 | ## Latest released version: 0.9.64 | 192 | ## Latest released version: 0.9.66 |
193 | 193 | ||
194 | ## Current development version: 0.9.65 | 194 | ## Current development version: 0.9.67 |
195 | 195 | ||
196 | Milestone page: https://github.com/netblue30/firejail/milestone/1 | 196 | Milestone page: https://github.com/netblue30/firejail/milestone/1 |
197 | Release discussion: https://github.com/netblue30/firejail/issues/3696 | 197 | Release discussion: https://github.com/netblue30/firejail/issues/3696 |
198 | 198 | ||
199 | ### jailcheck | 199 | Moving from whitelist/blacklist to allow/deny is under way! We are still open to other options, so it might change! |
200 | ````` | ||
201 | JAILCHECK(1) JAILCHECK man page JAILCHECK(1) | ||
202 | |||
203 | NAME | ||
204 | jailcheck - Simple utility program to test running sandboxes | ||
205 | |||
206 | SYNOPSIS | ||
207 | sudo jailcheck [OPTIONS] [directory] | ||
208 | |||
209 | DESCRIPTION | ||
210 | jailcheck attaches itself to all sandboxes started by the user and per‐ | ||
211 | forms some basic tests on the sandbox filesystem: | ||
212 | |||
213 | 1. Virtual directories | ||
214 | jailcheck extracts a list with the main virtual directories in‐ | ||
215 | stalled by the sandbox. These directories are build by firejail | ||
216 | at startup using --private* and --whitelist commands. | ||
217 | |||
218 | 2. Noexec test | ||
219 | jailcheck inserts executable programs in /home/username, /tmp, | ||
220 | and /var/tmp directories and tries to run them from inside the | ||
221 | sandbox, thus testing if the directory is executable or not. | ||
222 | |||
223 | 3. Read access test | ||
224 | jailcheck creates test files in the directories specified by the | ||
225 | user and tries to read them from inside the sandbox. | ||
226 | |||
227 | 4. AppArmor test | ||
228 | |||
229 | 5. Seccomp test | ||
230 | |||
231 | The program is started as root using sudo. | ||
232 | |||
233 | OPTIONS | ||
234 | --debug | ||
235 | Print debug messages. | ||
236 | |||
237 | -?, --help | ||
238 | Print options and exit. | ||
239 | |||
240 | --version | ||
241 | Print program version and exit. | ||
242 | 200 | ||
243 | [directory] | 201 | The old whitelist/blacklist will remain as aliasses for the next one or two releases |
244 | One or more directories in user home to test for read access. | 202 | in order to give users a chance to switch their local profiles. |
245 | ~/.ssh and ~/.gnupg are tested by default. | 203 | The latest discussion on this issue is here: https://github.com/netblue30/firejail/issues/4379 |
246 | 204 | ||
247 | OUTPUT | 205 | ### Intrusion Detection System ### |
248 | For each sandbox detected we print the following line: | ||
249 | 206 | ||
250 | PID:USER:Sandbox Name:Command | 207 | We are adding IDS capabilities in the next release. We have the list of files in [/etc/firejail/ids.config](https://github.com/netblue30/firejail/blob/master/etc/ids.config), |
208 | and we generate a [BLAKE2](https://en.wikipedia.org/wiki/BLAKE_%28hash_function%29) checksum in /var/lib/firejail/username.ids. | ||
209 | The program runs as regular user, each user has his own file in /var/lib/firejail. | ||
251 | 210 | ||
252 | It is followed by relevant sandbox information, such as the virtual di‐ | 211 | Initialize the database: |
253 | rectories and various warnings. | 212 | ````` |
254 | 213 | $ firejail --ids-init | |
255 | EXAMPLE | 214 | Loading /etc/firejail/ids.config config file |
256 | $ sudo jailcheck | 215 | 500 1000 1500 2000 |
257 | 2014:netblue::firejail /usr/bin/gimp | 216 | 2457 files scanned |
258 | Virtual dirs: /tmp, /var/tmp, /dev, /usr/share, | 217 | IDS database initialized |
259 | Warning: I can run programs in /home/netblue | 218 | ````` |
260 | |||
261 | 2055:netblue::firejail /usr/bin/ssh -X netblue@x.y.z.net | ||
262 | Virtual dirs: /var/tmp, /dev, /usr/share, /run/user/1000, | ||
263 | Warning: I can read ~/.ssh | ||
264 | |||
265 | 2186:netblue:libreoffice:firejail --appimage /opt/LibreOffice-fresh.ap‐ | ||
266 | pimage | ||
267 | Virtual dirs: /tmp, /var/tmp, /dev, | ||
268 | |||
269 | 26090:netblue::/usr/bin/firejail /opt/firefox/firefox | ||
270 | Virtual dirs: /home/netblue, /tmp, /var/tmp, /dev, /etc, /usr/share, | ||
271 | /run/user/1000, | ||
272 | |||
273 | 26160:netblue:tor:firejail --private=~/tor-browser_en-US ./start-tor | ||
274 | Warning: AppArmor not enabled | ||
275 | Virtual dirs: /home/netblue, /tmp, /var/tmp, /dev, /etc, /bin, | ||
276 | /usr/share, /run/user/1000, | ||
277 | Warning: I can run programs in /home/netblue | ||
278 | |||
279 | LICENSE | ||
280 | This program is free software; you can redistribute it and/or modify it | ||
281 | under the terms of the GNU General Public License as published by the | ||
282 | Free Software Foundation; either version 2 of the License, or (at your | ||
283 | option) any later version. | ||
284 | |||
285 | Homepage: https://firejail.wordpress.com | ||
286 | |||
287 | SEE ALSO | ||
288 | firejail(1), firemon(1), firecfg(1), firejail-profile(5), firejail-lo‐ | ||
289 | gin(5), firejail-users(5), | ||
290 | 219 | ||
291 | 0.9.65 May 2021 JAILCHECK(1) | 220 | Later, we check it: |
221 | ````` | ||
222 | $ firejail --ids-check | ||
223 | Loading /etc/firejail/ids.config config file | ||
224 | 500 1000 1500 | ||
225 | Warning: modified /home/netblue/.bashrc | ||
226 | 2000 | ||
227 | 2457 files scanned: modified 1, permissions 0, new 0, removed 0 | ||
292 | ````` | 228 | ````` |
229 | The program will print the files that have been modified since the database was created, or the files with different access permissions. | ||
230 | New files and deleted files are also flagged. | ||
231 | |||
232 | Currently while scanning the file system symbolic links are not followed, and files the user doesn't have read access to are silently dropped. | ||
233 | The program can also be run as root (sudo firejail --ids-init/--ids-check). | ||
293 | 234 | ||
294 | ### Profile Statistics | 235 | ### Profile Statistics |
295 | 236 | ||
@@ -298,40 +239,32 @@ A small tool to print profile statistics. Compile as usual and run in /etc/profi | |||
298 | $ sudo cp src/profstats/profstats /etc/firejail/. | 239 | $ sudo cp src/profstats/profstats /etc/firejail/. |
299 | $ cd /etc/firejail | 240 | $ cd /etc/firejail |
300 | $ ./profstats *.profile | 241 | $ ./profstats *.profile |
301 | Stats: | 242 | profiles 1150 |
302 | profiles 1135 | 243 | include local profile 1150 (include profile-name.local) |
303 | include local profile 1135 (include profile-name.local) | 244 | include globals 1120 (include globals.local) |
304 | include globals 1106 (include globals.local) | 245 | blacklist ~/.ssh 1026 (include disable-common.inc) |
305 | blacklist ~/.ssh 1009 (include disable-common.inc) | 246 | seccomp 1050 |
306 | seccomp 1035 | 247 | capabilities 1146 |
307 | capabilities 1130 | 248 | noexec 1030 (include disable-exec.inc) |
308 | noexec 1011 (include disable-exec.inc) | 249 | noroot 959 |
309 | noroot 944 | 250 | memory-deny-write-execute 253 |
310 | memory-deny-write-execute 242 | 251 | apparmor 681 |
311 | apparmor 667 | 252 | private-bin 667 |
312 | private-bin 635 | 253 | private-dev 1009 |
313 | private-dev 992 | 254 | private-etc 523 |
314 | private-etc 508 | 255 | private-tmp 883 |
315 | private-tmp 866 | 256 | whitelist home directory 547 |
316 | whitelist home directory 542 | 257 | whitelist var 818 (include whitelist-var-common.inc) |
317 | whitelist var 799 (include whitelist-var-common.inc) | 258 | whitelist run/user 616 (include whitelist-runuser-common.inc |
318 | whitelist run/user 597 (include whitelist-runuser-common.inc | ||
319 | or blacklist ${RUNUSER}) | 259 | or blacklist ${RUNUSER}) |
320 | whitelist usr/share 569 (include whitelist-usr-share-common.inc | 260 | whitelist usr/share 591 (include whitelist-usr-share-common.inc |
321 | net none 389 | 261 | net none 391 |
322 | dbus-user none 619 | 262 | dbus-user none 641 |
323 | dbus-user filter 105 | 263 | dbus-user filter 105 |
324 | dbus-system none 770 | 264 | dbus-system none 792 |
325 | dbus-system filter 7 | 265 | dbus-system filter 7 |
326 | ``` | 266 | ``` |
327 | 267 | ||
328 | ### New profiles: | 268 | ### New profiles: |
329 | 269 | ||
330 | vmware-view, display-im6.q16, ipcalc, ipcalc-ng, ebook-convert, ebook-edit, ebook-meta, ebook-polish, lzop, | 270 | clion-eap, lifeograph, io.github.lainsce.Notejot, rednotebook, zim, microsoft-edge-beta, ncdu2, gallery-dl, yt-dlp |
331 | avidemux, calligragemini, vmware-player, vmware-workstation, gget, com.github.phase1geo.minder, nextcloud-desktop, | ||
332 | pcsxr, PPSSPPSDL, openmw, openmw-launcher, jami-gnome, PCSX2, bcompare, b2sum, cksum, md5sum, sha1sum, sha224sum, | ||
333 | sha256sum, sha384sum, sha512sum, sum, librewold-nightly, Quodlibet, tmux, sway, alienarena, alienarena-wrapper, | ||
334 | ballbuster, ballbuster-wrapper, colorful, colorful-wrapper, gl-117, gl-117-wrapper, glaxium, glaxium-wrapper, | ||
335 | pinball, pinball-wrapper, etr-wrapper, neverball-wrapper, neverputt-wrapper, supertuxkart-wrapper, firedragon, | ||
336 | neochat, node, nvm, cargo, LibreCAD, blobby, funnyboat, pipe-viewer, gtk-pipe-viewer, links2, xlinks2, googler, ddgr, | ||
337 | tin | ||
@@ -1,6 +1,23 @@ | |||
1 | firejail (0.9.65) baseline; urgency=low | 1 | firejail (0.9.67) baseline; urgency=low |
2 | * work in progress | ||
3 | * deprecated --disable-whitelist at compile time | ||
4 | * deprecated whitelist=yes/no in /etc/firejail/firejail.config | ||
5 | * remove (some) environment variables with auth-tokens | ||
6 | * new includes: whitelist-run-common.inc, disable-X11.inc | ||
7 | * removed includes: disable-passwordmgr.inc | ||
8 | * new profiles: microsoft-edge-beta, clion-eap, lifeograph, zim | ||
9 | * new profiles: io.github.lainsce.Notejot, rednotebook, gallery-dl | ||
10 | * new profiles: yt-dlp | ||
11 | -- netblue30 <netblue30@yahoo.com> Thu, 29 Jul 2021 09:00:00 -0500 | ||
12 | |||
13 | firejail (0.9.66) baseline; urgency=low | ||
2 | * deprecated --audit options, relpaced by jailcheck utility | 14 | * deprecated --audit options, relpaced by jailcheck utility |
3 | * deprecated follow-symlink-as-user from firejail.config | 15 | * deprecated follow-symlink-as-user from firejail.config |
16 | * new firejail.config settings: private-bin, private-etc | ||
17 | * new firejail.config settings: private-opt, private-srv | ||
18 | * new firejail.config settings: whitelist-disable-topdir | ||
19 | * new firejail.config settings: seccomp-filter-add | ||
20 | * removed kcmp syscall from seccomp default filter | ||
4 | * rename --noautopulse to keep-config-pulse | 21 | * rename --noautopulse to keep-config-pulse |
5 | * filtering environment variables | 22 | * filtering environment variables |
6 | * zsh completion | 23 | * zsh completion |
@@ -34,7 +51,7 @@ firejail (0.9.65) baseline; urgency=low | |||
34 | * neverball-wrapper, neverputt-wrapper, supertuxkart-wrapper, neochat, | 51 | * neverball-wrapper, neverputt-wrapper, supertuxkart-wrapper, neochat, |
35 | * cargo, LibreCAD, blobby, funnyboat, pipe-viewer, gtk-pipe-viewer | 52 | * cargo, LibreCAD, blobby, funnyboat, pipe-viewer, gtk-pipe-viewer |
36 | * links2, xlinks2, googler, ddgr, tin | 53 | * links2, xlinks2, googler, ddgr, tin |
37 | -- netblue30 <netblue30@yahoo.com> Wed, 2 Jun 2021 09:00:00 -0500 | 54 | -- netblue30 <netblue30@yahoo.com> Mon, 28 Jun 2021 09:00:00 -0500 |
38 | 55 | ||
39 | firejail (0.9.64.4) baseline; urgency=low | 56 | firejail (0.9.64.4) baseline; urgency=low |
40 | * disabled overlayfs, pending multiple fixes (CVE-2021-26910) | 57 | * disabled overlayfs, pending multiple fixes (CVE-2021-26910) |
@@ -42,7 +59,7 @@ firejail (0.9.64.4) baseline; urgency=low | |||
42 | 59 | ||
43 | firejail (0.9.64.2) baseline; urgency=low | 60 | firejail (0.9.64.2) baseline; urgency=low |
44 | * allow --tmpfs inside $HOME for unprivileged users | 61 | * allow --tmpfs inside $HOME for unprivileged users |
45 | * --disable-usertmpfs compile time option | 62 | * --disable-usertmpfs compile time option |
46 | * allow AF_BLUETOOTH via --protocol=bluetooth | 63 | * allow AF_BLUETOOTH via --protocol=bluetooth |
47 | * Setup guide for new users: contrib/firejail-welcome.sh | 64 | * Setup guide for new users: contrib/firejail-welcome.sh |
48 | * implement netns in profiles | 65 | * implement netns in profiles |
@@ -549,7 +566,7 @@ firejail (0.9.44) baseline; urgency=low | |||
549 | * feature: disable 3D hardware acceleration (--no3d) | 566 | * feature: disable 3D hardware acceleration (--no3d) |
550 | * feature: x11 xpra, x11 xephyr, x11 block, allusers, no3d profile commands | 567 | * feature: x11 xpra, x11 xephyr, x11 block, allusers, no3d profile commands |
551 | * feature: move files in sandbox (--put) | 568 | * feature: move files in sandbox (--put) |
552 | * feature: accept wildcard patterns in user name field of restricted | 569 | * feature: accept wildcard patterns in user name field of restricted |
553 | shell login feature | 570 | shell login feature |
554 | * new profiles: qpdfview, mupdf, Luminance HDR, Synfig Studio, Gimp, Inkscape | 571 | * new profiles: qpdfview, mupdf, Luminance HDR, Synfig Studio, Gimp, Inkscape |
555 | * new profiles: feh, ranger, zathura, 7z, keepass, keepassx, | 572 | * new profiles: feh, ranger, zathura, 7z, keepass, keepassx, |
@@ -591,7 +608,7 @@ firejail (0.9.42) baseline; urgency=low | |||
591 | * compile time: disable whitelisting (--disable-whitelist) | 608 | * compile time: disable whitelisting (--disable-whitelist) |
592 | * compile time: disable global config (--disable-globalcfg) | 609 | * compile time: disable global config (--disable-globalcfg) |
593 | * run time: enable/disable overlayfs (overlayfs yes/no) | 610 | * run time: enable/disable overlayfs (overlayfs yes/no) |
594 | * run time: enable/disable quiet as default (quiet-by-default yes/no) | 611 | * run time: enable/disable quiet as default (quiet-by-default yes/no) |
595 | * run time: user-defined network filter (netfilter-default) | 612 | * run time: user-defined network filter (netfilter-default) |
596 | * run time: enable/disable whitelisting (whitelist yes/no) | 613 | * run time: enable/disable whitelisting (whitelist yes/no) |
597 | * run time: enable/disable remounting of /proc and /sys | 614 | * run time: enable/disable remounting of /proc and /sys |
@@ -689,7 +706,7 @@ firejail (0.9.38) baseline; urgency=low | |||
689 | -- netblue30 <netblue30@yahoo.com> Tue, 2 Feb 2016 10:00:00 -0500 | 706 | -- netblue30 <netblue30@yahoo.com> Tue, 2 Feb 2016 10:00:00 -0500 |
690 | 707 | ||
691 | firejail (0.9.36) baseline; urgency=low | 708 | firejail (0.9.36) baseline; urgency=low |
692 | * added unbound, dnscrypt-proxy, BitlBee, HexChat, WeeChat, | 709 | * added unbound, dnscrypt-proxy, BitlBee, HexChat, WeeChat, |
693 | parole and rtorrent profiles | 710 | parole and rtorrent profiles |
694 | * Google Chrome profile rework | 711 | * Google Chrome profile rework |
695 | * added google-chrome-stable profile | 712 | * added google-chrome-stable profile |
diff --git a/SECURITY.md b/SECURITY.md index 92204da0a..ef9b9b5fb 100644 --- a/SECURITY.md +++ b/SECURITY.md | |||
@@ -2,23 +2,24 @@ | |||
2 | 2 | ||
3 | ## Supported Versions | 3 | ## Supported Versions |
4 | 4 | ||
5 | | Version | Supported by us | EOL | Supported by distribution | | 5 | | Version | Supported by us | EOL | Supported by distribution | |
6 | | ------- | ------------------ | ---- | --------------------------- | 6 | | ------- | ------------------ | ------------------ | --------------------------------------------------------------------------------- | |
7 | | 0.9.64 | :heavy_check_mark: | | :white_check_mark: Debian 10 **backports**, Debian 11 **backports**, Debian 12 (testing/unstable) | 7 | | 0.9.66 | :heavy_check_mark: | | :white_check_mark: Debian 11 **backports**, Debian 12 (testing/unstable) | |
8 | | 0.9.62 | :x: | | :white_check_mark: Ubuntu 20.04 LTS, Ubuntu 20.10 | 8 | | 0.9.64 | :x: | | :white_check_mark: Debian 10 **backports**, Debian 11, Ubuntu 21.04, Ubuntu 21.10 | |
9 | | 0.9.60 | :x: | 29 Dec 2019 | | 9 | | 0.9.62 | :x: | | :white_check_mark: Ubuntu 20.04 LTS, Ubuntu 20.10 | |
10 | | 0.9.58 | :x: | | :white_check_mark: Debian 9 **backports**, Debian 10 | 10 | | 0.9.60 | :x: | 29 Dec 2019 | | |
11 | | 0.9.56 | :x: | 27 Jan 2019 | | 11 | | 0.9.58 | :x: | | :white_check_mark: Debian 9 **backports**, Debian 10 | |
12 | | 0.9.54 | :x: | 18 Sep 2018 | | 12 | | 0.9.56 | :x: | 27 Jan 2019 | | |
13 | | 0.9.52 | :x: | | :white_check_mark: Ubuntu 18.04 LTS | 13 | | 0.9.54 | :x: | 18 Sep 2018 | | |
14 | | 0.9.50 | :x: | 12 Dec 2017 | | 14 | | 0.9.52 | :x: | | :white_check_mark: Ubuntu 18.04 LTS | |
15 | | 0.9.48 | :x: | 09 Sep 2017 | | 15 | | 0.9.50 | :x: | 12 Dec 2017 | | |
16 | | 0.9.46 | :x: | 12 Jun 2017 | | 16 | | 0.9.48 | :x: | 09 Sep 2017 | | |
17 | | 0.9.44 | :x: | | :white_check_mark: Debian 9 | 17 | | 0.9.46 | :x: | 12 Jun 2017 | | |
18 | | 0.9.42 | :x: | 22 Oct 2016 | | 18 | | 0.9.44 | :x: | | :white_check_mark: Debian 9 | |
19 | | 0.9.40 | :x: | 09 Sep 2016 | | 19 | | 0.9.42 | :x: | 22 Oct 2016 | | |
20 | | 0.9.38 | :x: | | :white_check_mark: Ubuntu 16.04 LTS | 20 | | 0.9.40 | :x: | 09 Sep 2016 | | |
21 | | <0.9.38 | :x: | Before 05 Feb 2016 | | 21 | | 0.9.38 | :x: | | :white_check_mark: Ubuntu 16.04 LTS | |
22 | | <0.9.38 | :x: | Before 05 Feb 2016 | | | ||
22 | 23 | ||
23 | ## Security vulnerabilities | 24 | ## Security vulnerabilities |
24 | 25 | ||
@@ -1,6 +1,6 @@ | |||
1 | #! /bin/sh | 1 | #! /bin/sh |
2 | # Guess values for system-dependent variables and create Makefiles. | 2 | # Guess values for system-dependent variables and create Makefiles. |
3 | # Generated by GNU Autoconf 2.69 for firejail 0.9.66rc1. | 3 | # Generated by GNU Autoconf 2.69 for firejail 0.9.67. |
4 | # | 4 | # |
5 | # Report bugs to <netblue30@protonmail.com>. | 5 | # Report bugs to <netblue30@protonmail.com>. |
6 | # | 6 | # |
@@ -580,8 +580,8 @@ MAKEFLAGS= | |||
580 | # Identity of this package. | 580 | # Identity of this package. |
581 | PACKAGE_NAME='firejail' | 581 | PACKAGE_NAME='firejail' |
582 | PACKAGE_TARNAME='firejail' | 582 | PACKAGE_TARNAME='firejail' |
583 | PACKAGE_VERSION='0.9.66rc1' | 583 | PACKAGE_VERSION='0.9.67' |
584 | PACKAGE_STRING='firejail 0.9.66rc1' | 584 | PACKAGE_STRING='firejail 0.9.67' |
585 | PACKAGE_BUGREPORT='netblue30@protonmail.com' | 585 | PACKAGE_BUGREPORT='netblue30@protonmail.com' |
586 | PACKAGE_URL='https://firejail.wordpress.com' | 586 | PACKAGE_URL='https://firejail.wordpress.com' |
587 | 587 | ||
@@ -634,7 +634,6 @@ HAVE_GCOV | |||
634 | BUSYBOX_WORKAROUND | 634 | BUSYBOX_WORKAROUND |
635 | HAVE_FATAL_WARNINGS | 635 | HAVE_FATAL_WARNINGS |
636 | HAVE_SUID | 636 | HAVE_SUID |
637 | HAVE_WHITELIST | ||
638 | HAVE_FILE_TRANSFER | 637 | HAVE_FILE_TRANSFER |
639 | HAVE_X11 | 638 | HAVE_X11 |
640 | HAVE_USERNS | 639 | HAVE_USERNS |
@@ -726,7 +725,6 @@ enable_network | |||
726 | enable_userns | 725 | enable_userns |
727 | enable_x11 | 726 | enable_x11 |
728 | enable_file_transfer | 727 | enable_file_transfer |
729 | enable_whitelist | ||
730 | enable_suid | 728 | enable_suid |
731 | enable_fatal_warnings | 729 | enable_fatal_warnings |
732 | enable_busybox_workaround | 730 | enable_busybox_workaround |
@@ -1299,7 +1297,7 @@ if test "$ac_init_help" = "long"; then | |||
1299 | # Omit some internal or obsolete options to make the list less imposing. | 1297 | # Omit some internal or obsolete options to make the list less imposing. |
1300 | # This message is too long to be a string in the A/UX 3.1 sh. | 1298 | # This message is too long to be a string in the A/UX 3.1 sh. |
1301 | cat <<_ACEOF | 1299 | cat <<_ACEOF |
1302 | \`configure' configures firejail 0.9.66rc1 to adapt to many kinds of systems. | 1300 | \`configure' configures firejail 0.9.67 to adapt to many kinds of systems. |
1303 | 1301 | ||
1304 | Usage: $0 [OPTION]... [VAR=VALUE]... | 1302 | Usage: $0 [OPTION]... [VAR=VALUE]... |
1305 | 1303 | ||
@@ -1361,7 +1359,7 @@ fi | |||
1361 | 1359 | ||
1362 | if test -n "$ac_init_help"; then | 1360 | if test -n "$ac_init_help"; then |
1363 | case $ac_init_help in | 1361 | case $ac_init_help in |
1364 | short | recursive ) echo "Configuration of firejail 0.9.66rc1:";; | 1362 | short | recursive ) echo "Configuration of firejail 0.9.67:";; |
1365 | esac | 1363 | esac |
1366 | cat <<\_ACEOF | 1364 | cat <<\_ACEOF |
1367 | 1365 | ||
@@ -1385,7 +1383,6 @@ Optional Features: | |||
1385 | --disable-userns disable user namespace | 1383 | --disable-userns disable user namespace |
1386 | --disable-x11 disable X11 sandboxing support | 1384 | --disable-x11 disable X11 sandboxing support |
1387 | --disable-file-transfer disable file transfer | 1385 | --disable-file-transfer disable file transfer |
1388 | --disable-whitelist disable whitelist | ||
1389 | --disable-suid install as a non-SUID executable | 1386 | --disable-suid install as a non-SUID executable |
1390 | --enable-fatal-warnings -W -Wall -Werror | 1387 | --enable-fatal-warnings -W -Wall -Werror |
1391 | --enable-busybox-workaround | 1388 | --enable-busybox-workaround |
@@ -1481,7 +1478,7 @@ fi | |||
1481 | test -n "$ac_init_help" && exit $ac_status | 1478 | test -n "$ac_init_help" && exit $ac_status |
1482 | if $ac_init_version; then | 1479 | if $ac_init_version; then |
1483 | cat <<\_ACEOF | 1480 | cat <<\_ACEOF |
1484 | firejail configure 0.9.66rc1 | 1481 | firejail configure 0.9.67 |
1485 | generated by GNU Autoconf 2.69 | 1482 | generated by GNU Autoconf 2.69 |
1486 | 1483 | ||
1487 | Copyright (C) 2012 Free Software Foundation, Inc. | 1484 | Copyright (C) 2012 Free Software Foundation, Inc. |
@@ -1783,7 +1780,7 @@ cat >config.log <<_ACEOF | |||
1783 | This file contains any messages produced by compilers while | 1780 | This file contains any messages produced by compilers while |
1784 | running configure, to aid debugging if configure makes a mistake. | 1781 | running configure, to aid debugging if configure makes a mistake. |
1785 | 1782 | ||
1786 | It was created by firejail $as_me 0.9.66rc1, which was | 1783 | It was created by firejail $as_me 0.9.67, which was |
1787 | generated by GNU Autoconf 2.69. Invocation command line was | 1784 | generated by GNU Autoconf 2.69. Invocation command line was |
1788 | 1785 | ||
1789 | $ $0 $@ | 1786 | $ $0 $@ |
@@ -3552,7 +3549,7 @@ if test "x$enable_dbusproxy" != "xno"; then : | |||
3552 | 3549 | ||
3553 | fi | 3550 | fi |
3554 | 3551 | ||
3555 | # overlayfs features temporarely disabled pending fixes | 3552 | # overlayfs features temporarily disabled pending fixes |
3556 | HAVE_OVERLAYFS="" | 3553 | HAVE_OVERLAYFS="" |
3557 | 3554 | ||
3558 | # | 3555 | # |
@@ -3747,19 +3744,6 @@ if test "x$enable_file_transfer" != "xno"; then : | |||
3747 | 3744 | ||
3748 | fi | 3745 | fi |
3749 | 3746 | ||
3750 | HAVE_WHITELIST="" | ||
3751 | # Check whether --enable-whitelist was given. | ||
3752 | if test "${enable_whitelist+set}" = set; then : | ||
3753 | enableval=$enable_whitelist; | ||
3754 | fi | ||
3755 | |||
3756 | if test "x$enable_whitelist" != "xno"; then : | ||
3757 | |||
3758 | HAVE_WHITELIST="-DHAVE_WHITELIST" | ||
3759 | |||
3760 | |||
3761 | fi | ||
3762 | |||
3763 | HAVE_SUID="" | 3747 | HAVE_SUID="" |
3764 | # Check whether --enable-suid was given. | 3748 | # Check whether --enable-suid was given. |
3765 | if test "${enable_suid+set}" = set; then : | 3749 | if test "${enable_suid+set}" = set; then : |
@@ -4366,7 +4350,7 @@ fi | |||
4366 | 4350 | ||
4367 | ac_config_files="$ac_config_files mkdeb.sh" | 4351 | ac_config_files="$ac_config_files mkdeb.sh" |
4368 | 4352 | ||
4369 | ac_config_files="$ac_config_files Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile src/jailcheck/Makefile" | 4353 | ac_config_files="$ac_config_files Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile src/jailcheck/Makefile src/fids/Makefile" |
4370 | 4354 | ||
4371 | cat >confcache <<\_ACEOF | 4355 | cat >confcache <<\_ACEOF |
4372 | # This file is a shell script that caches the results of configure | 4356 | # This file is a shell script that caches the results of configure |
@@ -4910,7 +4894,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 | |||
4910 | # report actual input values of CONFIG_FILES etc. instead of their | 4894 | # report actual input values of CONFIG_FILES etc. instead of their |
4911 | # values after options handling. | 4895 | # values after options handling. |
4912 | ac_log=" | 4896 | ac_log=" |
4913 | This file was extended by firejail $as_me 0.9.66rc1, which was | 4897 | This file was extended by firejail $as_me 0.9.67, which was |
4914 | generated by GNU Autoconf 2.69. Invocation command line was | 4898 | generated by GNU Autoconf 2.69. Invocation command line was |
4915 | 4899 | ||
4916 | CONFIG_FILES = $CONFIG_FILES | 4900 | CONFIG_FILES = $CONFIG_FILES |
@@ -4964,7 +4948,7 @@ _ACEOF | |||
4964 | cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 | 4948 | cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 |
4965 | ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" | 4949 | ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" |
4966 | ac_cs_version="\\ | 4950 | ac_cs_version="\\ |
4967 | firejail config.status 0.9.66rc1 | 4951 | firejail config.status 0.9.67 |
4968 | configured by $0, generated by GNU Autoconf 2.69, | 4952 | configured by $0, generated by GNU Autoconf 2.69, |
4969 | with options \\"\$ac_cs_config\\" | 4953 | with options \\"\$ac_cs_config\\" |
4970 | 4954 | ||
@@ -5100,6 +5084,7 @@ do | |||
5100 | "src/bash_completion/Makefile") CONFIG_FILES="$CONFIG_FILES src/bash_completion/Makefile" ;; | 5084 | "src/bash_completion/Makefile") CONFIG_FILES="$CONFIG_FILES src/bash_completion/Makefile" ;; |
5101 | "test/Makefile") CONFIG_FILES="$CONFIG_FILES test/Makefile" ;; | 5085 | "test/Makefile") CONFIG_FILES="$CONFIG_FILES test/Makefile" ;; |
5102 | "src/jailcheck/Makefile") CONFIG_FILES="$CONFIG_FILES src/jailcheck/Makefile" ;; | 5086 | "src/jailcheck/Makefile") CONFIG_FILES="$CONFIG_FILES src/jailcheck/Makefile" ;; |
5087 | "src/fids/Makefile") CONFIG_FILES="$CONFIG_FILES src/fids/Makefile" ;; | ||
5103 | 5088 | ||
5104 | *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;; | 5089 | *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;; |
5105 | esac | 5090 | esac |
@@ -5572,7 +5557,6 @@ Configuration options: | |||
5572 | network: $HAVE_NETWORK | 5557 | network: $HAVE_NETWORK |
5573 | user namespace: $HAVE_USERNS | 5558 | user namespace: $HAVE_USERNS |
5574 | X11 sandboxing support: $HAVE_X11 | 5559 | X11 sandboxing support: $HAVE_X11 |
5575 | whitelisting: $HAVE_WHITELIST | ||
5576 | private home support: $HAVE_PRIVATE_HOME | 5560 | private home support: $HAVE_PRIVATE_HOME |
5577 | file transfer support: $HAVE_FILE_TRANSFER | 5561 | file transfer support: $HAVE_FILE_TRANSFER |
5578 | overlayfs support: $HAVE_OVERLAYFS | 5562 | overlayfs support: $HAVE_OVERLAYFS |
diff --git a/configure.ac b/configure.ac index f37db5926..5fde6d402 100644 --- a/configure.ac +++ b/configure.ac | |||
@@ -12,7 +12,7 @@ | |||
12 | # | 12 | # |
13 | 13 | ||
14 | AC_PREREQ([2.68]) | 14 | AC_PREREQ([2.68]) |
15 | AC_INIT([firejail],[0.9.66rc1],[netblue30@protonmail.com],[],[https://firejail.wordpress.com]) | 15 | AC_INIT([firejail],[0.9.67],[netblue30@protonmail.com],[],[https://firejail.wordpress.com]) |
16 | AC_CONFIG_SRCDIR([src/firejail/main.c]) | 16 | AC_CONFIG_SRCDIR([src/firejail/main.c]) |
17 | 17 | ||
18 | AC_CONFIG_MACRO_DIR([m4]) | 18 | AC_CONFIG_MACRO_DIR([m4]) |
@@ -76,7 +76,7 @@ AS_IF([test "x$enable_dbusproxy" != "xno"], [ | |||
76 | AC_SUBST(HAVE_DBUSPROXY) | 76 | AC_SUBST(HAVE_DBUSPROXY) |
77 | ]) | 77 | ]) |
78 | 78 | ||
79 | # overlayfs features temporarely disabled pending fixes | 79 | # overlayfs features temporarily disabled pending fixes |
80 | HAVE_OVERLAYFS="" | 80 | HAVE_OVERLAYFS="" |
81 | AC_SUBST(HAVE_OVERLAYFS) | 81 | AC_SUBST(HAVE_OVERLAYFS) |
82 | # | 82 | # |
@@ -177,14 +177,6 @@ AS_IF([test "x$enable_file_transfer" != "xno"], [ | |||
177 | AC_SUBST(HAVE_FILE_TRANSFER) | 177 | AC_SUBST(HAVE_FILE_TRANSFER) |
178 | ]) | 178 | ]) |
179 | 179 | ||
180 | HAVE_WHITELIST="" | ||
181 | AC_ARG_ENABLE([whitelist], | ||
182 | AS_HELP_STRING([--disable-whitelist], [disable whitelist])) | ||
183 | AS_IF([test "x$enable_whitelist" != "xno"], [ | ||
184 | HAVE_WHITELIST="-DHAVE_WHITELIST" | ||
185 | AC_SUBST(HAVE_WHITELIST) | ||
186 | ]) | ||
187 | |||
188 | HAVE_SUID="" | 180 | HAVE_SUID="" |
189 | AC_ARG_ENABLE([suid], | 181 | AC_ARG_ENABLE([suid], |
190 | AS_HELP_STRING([--disable-suid], [install as a non-SUID executable])) | 182 | AS_HELP_STRING([--disable-suid], [install as a non-SUID executable])) |
@@ -308,7 +300,7 @@ AC_CONFIG_FILES([Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/ | |||
308 | src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile \ | 300 | src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile \ |
309 | src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile \ | 301 | src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile \ |
310 | src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile \ | 302 | src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile \ |
311 | src/jailcheck/Makefile]) | 303 | src/jailcheck/Makefile src/fids/Makefile]) |
312 | AC_OUTPUT | 304 | AC_OUTPUT |
313 | 305 | ||
314 | cat <<EOF | 306 | cat <<EOF |
@@ -323,7 +315,6 @@ Configuration options: | |||
323 | network: $HAVE_NETWORK | 315 | network: $HAVE_NETWORK |
324 | user namespace: $HAVE_USERNS | 316 | user namespace: $HAVE_USERNS |
325 | X11 sandboxing support: $HAVE_X11 | 317 | X11 sandboxing support: $HAVE_X11 |
326 | whitelisting: $HAVE_WHITELIST | ||
327 | private home support: $HAVE_PRIVATE_HOME | 318 | private home support: $HAVE_PRIVATE_HOME |
328 | file transfer support: $HAVE_FILE_TRANSFER | 319 | file transfer support: $HAVE_FILE_TRANSFER |
329 | overlayfs support: $HAVE_OVERLAYFS | 320 | overlayfs support: $HAVE_OVERLAYFS |
diff --git a/contrib/fix_private-bin.py b/contrib/fix_private-bin.py index 12b596749..961646aa4 100755 --- a/contrib/fix_private-bin.py +++ b/contrib/fix_private-bin.py | |||
@@ -164,7 +164,7 @@ def printHelp(): | |||
164 | 164 | ||
165 | 165 | ||
166 | def main() -> None: | 166 | def main() -> None: |
167 | """The main function. Parses the commandline args, shows messages and calles the function actually doing the work.""" | 167 | """The main function. Parses the commandline args, shows messages and calls the function actually doing the work.""" |
168 | if len(sys.argv) > 2 or (len(sys.argv) == 2 and | 168 | if len(sys.argv) > 2 or (len(sys.argv) == 2 and |
169 | (sys.argv[1] == "-h" or sys.argv[1] == "--help")): | 169 | (sys.argv[1] == "-h" or sys.argv[1] == "--help")): |
170 | printHelp() | 170 | printHelp() |
diff --git a/contrib/gdb-firejail.sh b/contrib/gdb-firejail.sh index 941fc45ef..686bdc2c0 100755 --- a/contrib/gdb-firejail.sh +++ b/contrib/gdb-firejail.sh | |||
@@ -21,4 +21,4 @@ else | |||
21 | fi | 21 | fi |
22 | 22 | ||
23 | bash -c "kill -STOP \$\$; exec \"\$0\" \"\$@\"" "$@" & | 23 | bash -c "kill -STOP \$\$; exec \"\$0\" \"\$@\"" "$@" & |
24 | sudo gdb -e "$FIREJAIL" -p "$!" | 24 | sudo gdb -e "$FIREJAIL" -p "$!" |
diff --git a/contrib/sort.py b/contrib/sort.py index c7325facb..4af9c674c 100755 --- a/contrib/sort.py +++ b/contrib/sort.py | |||
@@ -24,7 +24,7 @@ Exit-Codes: | |||
24 | 24 | ||
25 | # Requirements: | 25 | # Requirements: |
26 | # python >= 3.6 | 26 | # python >= 3.6 |
27 | from sys import argv | 27 | from sys import argv, exit as sys_exit |
28 | 28 | ||
29 | 29 | ||
30 | def sort_alphabetical(raw_items): | 30 | def sort_alphabetical(raw_items): |
@@ -34,7 +34,7 @@ def sort_alphabetical(raw_items): | |||
34 | 34 | ||
35 | 35 | ||
36 | def sort_protocol(protocols): | 36 | def sort_protocol(protocols): |
37 | """sort the given protocole into this scheme: unix,inet,inet6,netlink,packet,bluetooth""" | 37 | """sort the given protocols into this scheme: unix,inet,inet6,netlink,packet,bluetooth""" |
38 | 38 | ||
39 | # shortcut for common protocol lines | 39 | # shortcut for common protocol lines |
40 | if protocols in ("unix", "unix,inet,inet6"): | 40 | if protocols in ("unix", "unix,inet,inet6"): |
@@ -105,4 +105,4 @@ def main(args): | |||
105 | 105 | ||
106 | 106 | ||
107 | if __name__ == "__main__": | 107 | if __name__ == "__main__": |
108 | exit(main(argv[1:])) | 108 | sys_exit(main(argv[1:])) |
diff --git a/etc-fixes/0.9.58/atom.profile b/etc-fixes/0.9.58/atom.profile index 9bc35da5a..1cc9b0116 100644 --- a/etc-fixes/0.9.58/atom.profile +++ b/etc-fixes/0.9.58/atom.profile | |||
@@ -1,4 +1,3 @@ | |||
1 | |||
2 | # Firejail profile for atom | 1 | # Firejail profile for atom |
3 | # Description: A hackable text editor for the 21st Century | 2 | # Description: A hackable text editor for the 21st Century |
4 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
diff --git a/etc-fixes/seccomp-join-bug/README b/etc-fixes/seccomp-join-bug/README index 9f85a0e00..15596eca7 100644 --- a/etc-fixes/seccomp-join-bug/README +++ b/etc-fixes/seccomp-join-bug/README | |||
@@ -8,4 +8,3 @@ on May 21, 2019: | |||
8 | 8 | ||
9 | The original discussion thread: https://github.com/netblue30/firejail/issues/2718 | 9 | The original discussion thread: https://github.com/netblue30/firejail/issues/2718 |
10 | The fix on mainline: https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134 | 10 | The fix on mainline: https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134 |
11 | |||
diff --git a/etc/apparmor/firejail-default b/etc/apparmor/firejail-default index ca32f5b0d..a7044152e 100644 --- a/etc/apparmor/firejail-default +++ b/etc/apparmor/firejail-default | |||
@@ -129,7 +129,7 @@ signal (receive), | |||
129 | ########## | 129 | ########## |
130 | # The list of recognized capabilities varies from one apparmor version to another. | 130 | # The list of recognized capabilities varies from one apparmor version to another. |
131 | # For example on Debian 10 (apparmor 2.13.2) checkpoint_restore, perfmon, bpf are not available | 131 | # For example on Debian 10 (apparmor 2.13.2) checkpoint_restore, perfmon, bpf are not available |
132 | # We allow all caps by default and remove the ones we don't like: | 132 | # We allow all caps by default and remove the ones we don't like: |
133 | capability, | 133 | capability, |
134 | deny capability audit_write, | 134 | deny capability audit_write, |
135 | deny capability audit_control, | 135 | deny capability audit_control, |
diff --git a/etc/firejail.config b/etc/firejail.config index f5b3d5efa..aec152b85 100644 --- a/etc/firejail.config +++ b/etc/firejail.config | |||
@@ -63,7 +63,7 @@ | |||
63 | # a file argument, the default filter is hardcoded (see man 1 firejail). This | 63 | # a file argument, the default filter is hardcoded (see man 1 firejail). This |
64 | # configuration entry allows the user to change the default by specifying | 64 | # configuration entry allows the user to change the default by specifying |
65 | # a file containing the filter configuration. The filter file format is the | 65 | # a file containing the filter configuration. The filter file format is the |
66 | # format of iptables-save and iptable-restore commands. Example: | 66 | # format of iptables-save and iptables-restore commands. Example: |
67 | # netfilter-default /etc/iptables.iptables.rules | 67 | # netfilter-default /etc/iptables.iptables.rules |
68 | 68 | ||
69 | # Enable or disable networking features, default enabled. | 69 | # Enable or disable networking features, default enabled. |
@@ -113,15 +113,16 @@ | |||
113 | # Enable or disable seccomp support, default enabled. | 113 | # Enable or disable seccomp support, default enabled. |
114 | # seccomp yes | 114 | # seccomp yes |
115 | 115 | ||
116 | # Add rules to the default seccomp filter. Same syntax as for --seccomp= | ||
117 | # None by default; this is an example. | ||
118 | # seccomp-filter-add !chroot,kcmp,mincore | ||
119 | |||
116 | # Seccomp error action, kill, log or errno (EPERM, ENOSYS etc) | 120 | # Seccomp error action, kill, log or errno (EPERM, ENOSYS etc) |
117 | # seccomp-error-action EPERM | 121 | # seccomp-error-action EPERM |
118 | 122 | ||
119 | # Enable or disable user namespace support, default enabled. | 123 | # Enable or disable user namespace support, default enabled. |
120 | # userns yes | 124 | # userns yes |
121 | 125 | ||
122 | # Enable or disable whitelisting support, default enabled. | ||
123 | # whitelist yes | ||
124 | |||
125 | # Disable whitelist top level directories, in addition to those | 126 | # Disable whitelist top level directories, in addition to those |
126 | # that are disabled out of the box. None by default; this is an example. | 127 | # that are disabled out of the box. None by default; this is an example. |
127 | # whitelist-disable-topdir /etc,/usr/etc | 128 | # whitelist-disable-topdir /etc,/usr/etc |
diff --git a/etc/ids.config b/etc/ids.config new file mode 100644 index 000000000..09b0ae912 --- /dev/null +++ b/etc/ids.config | |||
@@ -0,0 +1,142 @@ | |||
1 | # /etc/firejail/ids.config - configuration file for Firejail's Intrusion Detection System | ||
2 | # This config file is overwritten when a new version of Firejail is installed. | ||
3 | # For global customization use /etc/firejail/ids.config.local. | ||
4 | include ids.config.local | ||
5 | # | ||
6 | # Each line is a file or directory name such as | ||
7 | # /usr/bin | ||
8 | # or | ||
9 | # ${HOME}/Desktop/*.desktop | ||
10 | # | ||
11 | # ${HOME} is expanded to the user's home directory, and * is the regular | ||
12 | # globbing match for zero or more characters. | ||
13 | # | ||
14 | # File or directory names starting with ! are not scanned. For example | ||
15 | # !${HOME}/.ssh/known_hosts | ||
16 | # ${HOME}/.ssh | ||
17 | # will scan all files in ~/.ssh directory with the exception of known_hosts | ||
18 | |||
19 | ### system executables ### | ||
20 | /bin | ||
21 | /sbin | ||
22 | /usr/bin | ||
23 | /usr/games | ||
24 | /usr/libexec | ||
25 | /usr/sbin | ||
26 | |||
27 | ### user executables ### | ||
28 | #/opt | ||
29 | #/usr/local | ||
30 | |||
31 | ### system libraries ### | ||
32 | #/lib | ||
33 | #/usr/lib | ||
34 | #/usr/lib32 | ||
35 | #/usr/lib64 | ||
36 | #/usr/libx32 | ||
37 | |||
38 | ### shells local ### | ||
39 | # bash | ||
40 | ${HOME}/.bash_login | ||
41 | ${HOME}/.bash_logout | ||
42 | ${HOME}/.bash_profile | ||
43 | ${HOME}/.bashrc | ||
44 | # fish | ||
45 | ${HOME}/.config/fish/config.fish | ||
46 | # others | ||
47 | ${HOME}/.cshrc | ||
48 | ${HOME}/.kshrc | ||
49 | ${HOME}/.login | ||
50 | ${HOME}/.logout | ||
51 | ${HOME}/.profile | ||
52 | ${HOME}/.tcshrc | ||
53 | # zsh | ||
54 | ${HOME}/.zlogin | ||
55 | ${HOME}/.zlogout | ||
56 | ${HOME}/.zshenv | ||
57 | ${HOME}/.zshprofile | ||
58 | ${HOME}/.zshrc | ||
59 | |||
60 | ### shells global ### | ||
61 | # all | ||
62 | /etc/dircolors | ||
63 | /etc/environment | ||
64 | /etc/profile | ||
65 | /etc/profile.d | ||
66 | /etc/shells | ||
67 | /etc/skel | ||
68 | # bash | ||
69 | /etc/bash_completion* | ||
70 | /etc/bash.bashrc | ||
71 | /etc/bashrc | ||
72 | # fish | ||
73 | /etc/fish | ||
74 | # ksh | ||
75 | /etc/ksh.kshrc | ||
76 | # tcsh | ||
77 | /etc/complete.tcsh | ||
78 | /etc/csh.cshrc | ||
79 | /etc/csh.login | ||
80 | /etc/csh.logout | ||
81 | # zsh | ||
82 | /etc/zlogin | ||
83 | /etc/zlogout | ||
84 | /etc/zprofile | ||
85 | /etc/zshenv | ||
86 | /etc/zshrc | ||
87 | |||
88 | ### X11 ### | ||
89 | /etc/X11 | ||
90 | ${HOME}/.xinitrc | ||
91 | ${HOME}/.xmodmaprc | ||
92 | ${HOME}/.xprofile | ||
93 | ${HOME}/.Xresources | ||
94 | ${HOME}/.xserverrc | ||
95 | ${HOME}/.Xsession | ||
96 | ${HOME}/.xsession | ||
97 | ${HOME}/.xsessionrc | ||
98 | |||
99 | ### window/desktop manager ### | ||
100 | ${HOME}/Desktop/*.desktop | ||
101 | ${HOME}/.config/autostart | ||
102 | ${HOME}/.config/lxsession/LXDE/autostart | ||
103 | ${HOME}/.gnomerc | ||
104 | ${HOME}/.gtkrc | ||
105 | ${HOME}/.kderc | ||
106 | |||
107 | ### security ### | ||
108 | /etc/aide | ||
109 | /etc/apparmor* | ||
110 | /etc/chkrootkit.conf | ||
111 | /etc/cracklib | ||
112 | /etc/libaudit.conf | ||
113 | /etc/group* | ||
114 | /etc/gshadow* | ||
115 | /etc/pam.* | ||
116 | /etc/passwd* | ||
117 | /etc/rkhunter* | ||
118 | /etc/securetty | ||
119 | /etc/security | ||
120 | /etc/selinux | ||
121 | /etc/shadow* | ||
122 | /etc/sudoers* | ||
123 | /etc/tripwire | ||
124 | ${HOME}/.config/firejail | ||
125 | ${HOME}/.gnupg | ||
126 | |||
127 | ### network security ### | ||
128 | /etc/ca-certificates* | ||
129 | /etc/hosts.* | ||
130 | /etc/services | ||
131 | /etc/snort | ||
132 | /etc/ssh | ||
133 | /etc/ssl | ||
134 | /etc/wireshark | ||
135 | !${HOME}/.ssh/known_hosts # excluding | ||
136 | ${HOME}/.ssh | ||
137 | /usr/share/ca-certificates | ||
138 | |||
139 | ### system config ### | ||
140 | /etc/cron.* | ||
141 | /etc/crontab | ||
142 | /etc/default | ||
diff --git a/etc/inc/allow-opengl-game.inc b/etc/inc/allow-opengl-game.inc index b5ff1bd50..5d2d6c5c1 100644 --- a/etc/inc/allow-opengl-game.inc +++ b/etc/inc/allow-opengl-game.inc | |||
@@ -1,3 +1,7 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include allow-opengl-game.local | ||
4 | |||
1 | noblacklist ${PATH}/bash | 5 | noblacklist ${PATH}/bash |
2 | whitelist /usr/share/opengl-games-utils/opengl-game-functions.sh | 6 | whitelist /usr/share/opengl-games-utils/opengl-game-functions.sh |
3 | private-bin basename,bash,cut,glxinfo,grep,head,sed,zenity | 7 | private-bin basename,bash,cut,glxinfo,grep,head,sed,zenity |
diff --git a/etc/inc/disable-X11.inc b/etc/inc/disable-X11.inc new file mode 100644 index 000000000..d227c7a0b --- /dev/null +++ b/etc/inc/disable-X11.inc | |||
@@ -0,0 +1,15 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include disable-X11.local | ||
4 | |||
5 | blacklist /tmp/.X11-unix | ||
6 | blacklist ${HOME}/.Xauthority | ||
7 | blacklist ${RUNUSER}/gdm/Xauthority | ||
8 | blacklist ${RUNUSER}/.mutter-Xwaylandauth* | ||
9 | blacklist ${RUNUSER}/xauth_* | ||
10 | #blacklist ${RUNUSER}/[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]] | ||
11 | blacklist /tmp/xauth* | ||
12 | blacklist /tmp/.ICE-unix | ||
13 | blacklist ${RUNUSER}/ICEauthority | ||
14 | rmenv DISPLAY | ||
15 | rmenv XAUTHORITY | ||
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc index 2dc53d311..ae84ee38a 100644 --- a/etc/inc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -159,20 +159,23 @@ blacklist ${RUNUSER}/gsconnect | |||
159 | # systemd | 159 | # systemd |
160 | blacklist ${HOME}/.config/systemd | 160 | blacklist ${HOME}/.config/systemd |
161 | blacklist ${HOME}/.local/share/systemd | 161 | blacklist ${HOME}/.local/share/systemd |
162 | blacklist /var/lib/systemd | 162 | blacklist ${PATH}/systemctl |
163 | blacklist ${PATH}/systemd-run | 163 | blacklist ${PATH}/systemd-run |
164 | blacklist ${RUNUSER}/systemd | 164 | blacklist ${RUNUSER}/systemd |
165 | blacklist /etc/systemd/network | ||
166 | blacklist /etc/systemd/system | ||
167 | blacklist /var/lib/systemd | ||
165 | # creates problems on Arch where /etc/resolv.conf is a symlink to /var/run/systemd/resolve/resolv.conf | 168 | # creates problems on Arch where /etc/resolv.conf is a symlink to /var/run/systemd/resolve/resolv.conf |
166 | #blacklist /var/run/systemd | 169 | #blacklist /var/run/systemd |
167 | 170 | ||
168 | # openrc | 171 | # openrc |
169 | blacklist /etc/runlevels/ | 172 | blacklist /etc/init.d |
170 | blacklist /etc/init.d/ | ||
171 | blacklist /etc/rc.conf | 173 | blacklist /etc/rc.conf |
174 | blacklist /etc/runlevels | ||
172 | 175 | ||
173 | # VirtualBox | 176 | # VirtualBox |
174 | blacklist ${HOME}/.VirtualBox | ||
175 | blacklist ${HOME}/.config/VirtualBox | 177 | blacklist ${HOME}/.config/VirtualBox |
178 | blacklist ${HOME}/.VirtualBox | ||
176 | blacklist ${HOME}/VirtualBox VMs | 179 | blacklist ${HOME}/VirtualBox VMs |
177 | 180 | ||
178 | # GNOME Boxes | 181 | # GNOME Boxes |
@@ -242,20 +245,34 @@ blacklist /var/spool/cron | |||
242 | blacklist /var/spool/mail | 245 | blacklist /var/spool/mail |
243 | 246 | ||
244 | # etc | 247 | # etc |
248 | blacklist /etc/adduser.conf | ||
245 | blacklist /etc/anacrontab | 249 | blacklist /etc/anacrontab |
250 | blacklist /etc/apparmor* | ||
246 | blacklist /etc/cron* | 251 | blacklist /etc/cron* |
252 | blacklist /etc/default | ||
253 | blacklist /etc/dkms | ||
254 | blacklist /etc/grub* | ||
255 | blacklist /etc/kernel* | ||
256 | blacklist /etc/logrotate* | ||
257 | blacklist /etc/modules* | ||
247 | blacklist /etc/profile.d | 258 | blacklist /etc/profile.d |
248 | blacklist /etc/rc.local | 259 | blacklist /etc/rc.local |
249 | # rc1.d, rc2.d, ... | 260 | # rc1.d, rc2.d, ... |
250 | blacklist /etc/rc?.d | 261 | blacklist /etc/rc?.d |
251 | blacklist /etc/kernel* | 262 | blacklist /etc/sysconfig |
252 | blacklist /etc/grub* | 263 | |
253 | blacklist /etc/dkms | 264 | # hide config for various intrusion detection systems |
254 | blacklist /etc/apparmor* | 265 | blacklist /etc/aide |
255 | blacklist /etc/selinux | 266 | blacklist /etc/aide.conf |
256 | blacklist /etc/modules* | 267 | blacklist /etc/chkrootkit.conf |
257 | blacklist /etc/logrotate* | 268 | blacklist /etc/fail2ban.conf |
258 | blacklist /etc/adduser.conf | 269 | blacklist /etc/logcheck |
270 | blacklist /etc/lynis | ||
271 | blacklist /etc/rkhunter.* | ||
272 | blacklist /etc/snort | ||
273 | blacklist /etc/suricata | ||
274 | blacklist /etc/tripwire | ||
275 | blacklist /var/lib/rkhunter | ||
259 | 276 | ||
260 | # Startup files | 277 | # Startup files |
261 | read-only ${HOME}/.antigen | 278 | read-only ${HOME}/.antigen |
@@ -335,15 +352,15 @@ read-only ${HOME}/_vimrc | |||
335 | read-only ${HOME}/dotfiles | 352 | read-only ${HOME}/dotfiles |
336 | 353 | ||
337 | # Make directories commonly found in $PATH read-only | 354 | # Make directories commonly found in $PATH read-only |
355 | read-only ${HOME}/.bin | ||
356 | read-only ${HOME}/.cargo/bin | ||
338 | read-only ${HOME}/.gem | 357 | read-only ${HOME}/.gem |
358 | read-only ${HOME}/.local/bin | ||
339 | read-only ${HOME}/.luarocks | 359 | read-only ${HOME}/.luarocks |
340 | read-only ${HOME}/.npm-packages | 360 | read-only ${HOME}/.npm-packages |
341 | read-only ${HOME}/.nvm | 361 | read-only ${HOME}/.nvm |
342 | read-only ${HOME}/bin | ||
343 | read-only ${HOME}/.bin | ||
344 | read-only ${HOME}/.local/bin | ||
345 | read-only ${HOME}/.cargo/bin | ||
346 | read-only ${HOME}/.rustup | 362 | read-only ${HOME}/.rustup |
363 | read-only ${HOME}/bin | ||
347 | 364 | ||
348 | # Write-protection for desktop entries | 365 | # Write-protection for desktop entries |
349 | read-only ${HOME}/.config/menus | 366 | read-only ${HOME}/.config/menus |
@@ -362,14 +379,32 @@ read-only ${HOME}/.local/share/thumbnailers | |||
362 | blacklist /tmp/ssh-* | 379 | blacklist /tmp/ssh-* |
363 | 380 | ||
364 | # top secret | 381 | # top secret |
382 | blacklist /.fscrypt | ||
383 | blacklist /etc/davfs2/secrets | ||
384 | blacklist /etc/group+ | ||
385 | blacklist /etc/group- | ||
386 | blacklist /etc/gshadow | ||
387 | blacklist /etc/gshadow+ | ||
388 | blacklist /etc/gshadow- | ||
389 | blacklist /etc/passwd+ | ||
390 | blacklist /etc/passwd- | ||
391 | blacklist /etc/shadow | ||
392 | blacklist /etc/shadow+ | ||
393 | blacklist /etc/shadow- | ||
394 | blacklist /etc/ssh | ||
395 | blacklist /etc/ssh/* | ||
396 | blacklist /home/.ecryptfs | ||
397 | blacklist /home/.fscrypt | ||
365 | blacklist ${HOME}/*.kdb | 398 | blacklist ${HOME}/*.kdb |
366 | blacklist ${HOME}/*.kdbx | 399 | blacklist ${HOME}/*.kdbx |
367 | blacklist ${HOME}/*.key | 400 | blacklist ${HOME}/*.key |
401 | blacklist ${HOME}/Private | ||
368 | blacklist ${HOME}/.Private | 402 | blacklist ${HOME}/.Private |
369 | blacklist ${HOME}/.caff | 403 | blacklist ${HOME}/.caff |
370 | blacklist ${HOME}/.cargo/credentials | 404 | blacklist ${HOME}/.cargo/credentials |
371 | blacklist ${HOME}/.cargo/credentials.toml | 405 | blacklist ${HOME}/.cargo/credentials.toml |
372 | blacklist ${HOME}/.cert | 406 | blacklist ${HOME}/.cert |
407 | blacklist ${HOME}/.config/hub | ||
373 | blacklist ${HOME}/.config/keybase | 408 | blacklist ${HOME}/.config/keybase |
374 | blacklist ${HOME}/.davfs2/secrets | 409 | blacklist ${HOME}/.davfs2/secrets |
375 | blacklist ${HOME}/.ecryptfs | 410 | blacklist ${HOME}/.ecryptfs |
@@ -379,40 +414,36 @@ blacklist ${HOME}/.git-credential-cache | |||
379 | blacklist ${HOME}/.git-credentials | 414 | blacklist ${HOME}/.git-credentials |
380 | blacklist ${HOME}/.gnome2/keyrings | 415 | blacklist ${HOME}/.gnome2/keyrings |
381 | blacklist ${HOME}/.gnupg | 416 | blacklist ${HOME}/.gnupg |
382 | blacklist ${HOME}/.config/hub | ||
383 | blacklist ${HOME}/.kde/share/apps/kwallet | 417 | blacklist ${HOME}/.kde/share/apps/kwallet |
384 | blacklist ${HOME}/.kde4/share/apps/kwallet | 418 | blacklist ${HOME}/.kde4/share/apps/kwallet |
385 | blacklist ${HOME}/.local/share/keyrings | 419 | blacklist ${HOME}/.local/share/keyrings |
386 | blacklist ${HOME}/.local/share/kwalletd | 420 | blacklist ${HOME}/.local/share/kwalletd |
421 | blacklist ${HOME}/.local/share/pki | ||
387 | blacklist ${HOME}/.local/share/plasma-vault | 422 | blacklist ${HOME}/.local/share/plasma-vault |
423 | blacklist ${HOME}/.minisign | ||
388 | blacklist ${HOME}/.msmtprc | 424 | blacklist ${HOME}/.msmtprc |
389 | blacklist ${HOME}/.mutt | 425 | blacklist ${HOME}/.mutt |
390 | blacklist ${HOME}/.muttrc | 426 | blacklist ${HOME}/.muttrc |
391 | blacklist ${HOME}/.netrc | 427 | blacklist ${HOME}/.netrc |
392 | blacklist ${HOME}/.nyx | 428 | blacklist ${HOME}/.nyx |
393 | blacklist ${HOME}/.pki | 429 | blacklist ${HOME}/.pki |
394 | blacklist ${HOME}/.local/share/pki | ||
395 | blacklist ${HOME}/.smbcredentials | 430 | blacklist ${HOME}/.smbcredentials |
396 | blacklist ${HOME}/.ssh | 431 | blacklist ${HOME}/.ssh |
397 | blacklist ${HOME}/.vaults | 432 | blacklist ${HOME}/.vaults |
398 | blacklist /.fscrypt | ||
399 | blacklist /etc/davfs2/secrets | ||
400 | blacklist /etc/group+ | ||
401 | blacklist /etc/group- | ||
402 | blacklist /etc/gshadow | ||
403 | blacklist /etc/gshadow+ | ||
404 | blacklist /etc/gshadow- | ||
405 | blacklist /etc/passwd+ | ||
406 | blacklist /etc/passwd- | ||
407 | blacklist /etc/shadow | ||
408 | blacklist /etc/shadow+ | ||
409 | blacklist /etc/shadow- | ||
410 | blacklist /etc/ssh | ||
411 | blacklist /etc/ssh/* | ||
412 | blacklist /home/.ecryptfs | ||
413 | blacklist /home/.fscrypt | ||
414 | blacklist /var/backup | 433 | blacklist /var/backup |
415 | 434 | ||
435 | # Remove environment variables with auth tokens. | ||
436 | # Note however that the sandbox might still have access to the | ||
437 | # files where these variables are set. | ||
438 | rmenv GH_TOKEN | ||
439 | rmenv GITHUB_TOKEN | ||
440 | rmenv GH_ENTERPRISE_TOKEN | ||
441 | rmenv GITHUB_ENTERPRISE_TOKEN | ||
442 | rmenv CARGO_REGISTRY_TOKEN | ||
443 | rmenv RESTIC_KEY_HINT | ||
444 | rmenv RESTIC_PASSWORD_COMMAND | ||
445 | rmenv RESTIC_PASSWORD_FILE | ||
446 | |||
416 | # cloud provider configuration | 447 | # cloud provider configuration |
417 | blacklist ${HOME}/.aws | 448 | blacklist ${HOME}/.aws |
418 | blacklist ${HOME}/.boto | 449 | blacklist ${HOME}/.boto |
@@ -473,10 +504,12 @@ blacklist /tmp/.lxterminal-socket* | |||
473 | blacklist /tmp/tmux-* | 504 | blacklist /tmp/tmux-* |
474 | 505 | ||
475 | # disable terminals running as server resulting in sandbox escape | 506 | # disable terminals running as server resulting in sandbox escape |
476 | blacklist ${PATH}/lxterminal | ||
477 | blacklist ${PATH}/gnome-terminal | 507 | blacklist ${PATH}/gnome-terminal |
478 | blacklist ${PATH}/gnome-terminal.wrapper | 508 | blacklist ${PATH}/gnome-terminal.wrapper |
509 | # blacklist ${PATH}/konsole | ||
510 | # konsole doesn't seem to have this problem - last tested on Ubuntu 16.04 | ||
479 | blacklist ${PATH}/lilyterm | 511 | blacklist ${PATH}/lilyterm |
512 | blacklist ${PATH}/lxterminal | ||
480 | blacklist ${PATH}/mate-terminal | 513 | blacklist ${PATH}/mate-terminal |
481 | blacklist ${PATH}/mate-terminal.wrapper | 514 | blacklist ${PATH}/mate-terminal.wrapper |
482 | blacklist ${PATH}/pantheon-terminal | 515 | blacklist ${PATH}/pantheon-terminal |
@@ -488,8 +521,6 @@ blacklist ${PATH}/urxvtc | |||
488 | blacklist ${PATH}/urxvtcd | 521 | blacklist ${PATH}/urxvtcd |
489 | blacklist ${PATH}/xfce4-terminal | 522 | blacklist ${PATH}/xfce4-terminal |
490 | blacklist ${PATH}/xfce4-terminal.wrapper | 523 | blacklist ${PATH}/xfce4-terminal.wrapper |
491 | # blacklist ${PATH}/konsole | ||
492 | # konsole doesn't seem to have this problem - last tested on Ubuntu 16.04 | ||
493 | 524 | ||
494 | # kernel files | 525 | # kernel files |
495 | blacklist /initrd* | 526 | blacklist /initrd* |
@@ -505,17 +536,17 @@ noblacklist ${HOME}/.local/share/flatpak/exports | |||
505 | read-only ${HOME}/.local/share/flatpak/exports | 536 | read-only ${HOME}/.local/share/flatpak/exports |
506 | blacklist ${HOME}/.local/share/flatpak/* | 537 | blacklist ${HOME}/.local/share/flatpak/* |
507 | blacklist ${HOME}/.var | 538 | blacklist ${HOME}/.var |
508 | blacklist ${RUNUSER}/app | 539 | # most of the time bwrap is SUID binary |
509 | blacklist ${RUNUSER}/doc | 540 | blacklist ${PATH}/bwrap |
510 | blacklist ${RUNUSER}/.dbus-proxy | 541 | blacklist ${RUNUSER}/.dbus-proxy |
511 | blacklist ${RUNUSER}/.flatpak | 542 | blacklist ${RUNUSER}/.flatpak |
512 | blacklist ${RUNUSER}/.flatpak-cache | 543 | blacklist ${RUNUSER}/.flatpak-cache |
513 | blacklist ${RUNUSER}/.flatpak-helper | 544 | blacklist ${RUNUSER}/.flatpak-helper |
545 | blacklist ${RUNUSER}/app | ||
546 | blacklist ${RUNUSER}/doc | ||
514 | blacklist /usr/share/flatpak | 547 | blacklist /usr/share/flatpak |
515 | noblacklist /var/lib/flatpak/exports | 548 | noblacklist /var/lib/flatpak/exports |
516 | blacklist /var/lib/flatpak/* | 549 | blacklist /var/lib/flatpak/* |
517 | # most of the time bwrap is SUID binary | ||
518 | blacklist ${PATH}/bwrap | ||
519 | 550 | ||
520 | # snap | 551 | # snap |
521 | blacklist ${RUNUSER}/snapd-session-agent.socket | 552 | blacklist ${RUNUSER}/snapd-session-agent.socket |
diff --git a/etc/inc/disable-devel.inc b/etc/inc/disable-devel.inc index e74b1b40b..98bf5ecc8 100644 --- a/etc/inc/disable-devel.inc +++ b/etc/inc/disable-devel.inc | |||
@@ -60,9 +60,7 @@ blacklist /usr/lib/tcc | |||
60 | blacklist ${PATH}/valgrind* | 60 | blacklist ${PATH}/valgrind* |
61 | blacklist /usr/lib/valgrind | 61 | blacklist /usr/lib/valgrind |
62 | 62 | ||
63 | |||
64 | # Source-Code | 63 | # Source-Code |
65 | |||
66 | blacklist /usr/src | 64 | blacklist /usr/src |
67 | blacklist /usr/local/src | 65 | blacklist /usr/local/src |
68 | blacklist /usr/include | 66 | blacklist /usr/include |
diff --git a/etc/inc/disable-passwdmgr.inc b/etc/inc/disable-passwdmgr.inc deleted file mode 100644 index 3ed9a1b14..000000000 --- a/etc/inc/disable-passwdmgr.inc +++ /dev/null | |||
@@ -1,19 +0,0 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include disable-passwdmgr.local | ||
4 | |||
5 | blacklist ${HOME}/.config/Bitwarden | ||
6 | blacklist ${HOME}/.config/KeePass | ||
7 | blacklist ${HOME}/.config/keepass | ||
8 | blacklist ${HOME}/.config/keepassx | ||
9 | blacklist ${HOME}/.config/keepassxc | ||
10 | blacklist ${HOME}/.config/KeePassXCrc | ||
11 | blacklist ${HOME}/.config/Sinew Software Systems | ||
12 | blacklist ${HOME}/.fpm | ||
13 | blacklist ${HOME}/.keepass | ||
14 | blacklist ${HOME}/.keepassx | ||
15 | blacklist ${HOME}/.keepassxc | ||
16 | blacklist ${HOME}/.lastpass | ||
17 | blacklist ${HOME}/.local/share/KeePass | ||
18 | blacklist ${HOME}/.local/share/keepass | ||
19 | blacklist ${HOME}/.password-store | ||
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 0e575e5eb..511d8730e 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -2,18 +2,6 @@ | |||
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include disable-programs.local | 3 | include disable-programs.local |
4 | 4 | ||
5 | blacklist ${HOME}/Arduino | ||
6 | blacklist ${HOME}/i2p | ||
7 | blacklist ${HOME}/Monero/wallets | ||
8 | blacklist ${HOME}/Nextcloud | ||
9 | blacklist ${HOME}/Nextcloud/Notes | ||
10 | blacklist ${HOME}/SoftMaker | ||
11 | blacklist ${HOME}/Standard Notes Backups | ||
12 | blacklist ${HOME}/TeamSpeak3-Client-linux_x86 | ||
13 | blacklist ${HOME}/TeamSpeak3-Client-linux_amd64 | ||
14 | blacklist ${HOME}/hyperrogue.ini | ||
15 | blacklist ${HOME}/mps | ||
16 | blacklist ${HOME}/wallet.dat | ||
17 | blacklist ${HOME}/.*coin | 5 | blacklist ${HOME}/.*coin |
18 | blacklist ${HOME}/.8pecxstudios | 6 | blacklist ${HOME}/.8pecxstudios |
19 | blacklist ${HOME}/.AndroidStudio* | 7 | blacklist ${HOME}/.AndroidStudio* |
@@ -38,10 +26,10 @@ blacklist ${HOME}/.VirtualBox | |||
38 | blacklist ${HOME}/.WebStorm* | 26 | blacklist ${HOME}/.WebStorm* |
39 | blacklist ${HOME}/.Wolfram Research | 27 | blacklist ${HOME}/.Wolfram Research |
40 | blacklist ${HOME}/.ZAP | 28 | blacklist ${HOME}/.ZAP |
29 | blacklist ${HOME}/.aMule | ||
41 | blacklist ${HOME}/.abook | 30 | blacklist ${HOME}/.abook |
42 | blacklist ${HOME}/.addressbook | 31 | blacklist ${HOME}/.addressbook |
43 | blacklist ${HOME}/.alpine-smime | 32 | blacklist ${HOME}/.alpine-smime |
44 | blacklist ${HOME}/.aMule | ||
45 | blacklist ${HOME}/.android | 33 | blacklist ${HOME}/.android |
46 | blacklist ${HOME}/.anydesk | 34 | blacklist ${HOME}/.anydesk |
47 | blacklist ${HOME}/.arduino15 | 35 | blacklist ${HOME}/.arduino15 |
@@ -65,6 +53,7 @@ blacklist ${HOME}/.bzf | |||
65 | blacklist ${HOME}/.cargo/* | 53 | blacklist ${HOME}/.cargo/* |
66 | blacklist ${HOME}/.claws-mail | 54 | blacklist ${HOME}/.claws-mail |
67 | blacklist ${HOME}/.cliqz | 55 | blacklist ${HOME}/.cliqz |
56 | blacklist ${HOME}/.clion* | ||
68 | blacklist ${HOME}/.clonk | 57 | blacklist ${HOME}/.clonk |
69 | blacklist ${HOME}/.config/0ad | 58 | blacklist ${HOME}/.config/0ad |
70 | blacklist ${HOME}/.config/2048-qt | 59 | blacklist ${HOME}/.config/2048-qt |
@@ -83,11 +72,12 @@ blacklist ${HOME}/.config/Code Industry | |||
83 | blacklist ${HOME}/.config/Cryptocat | 72 | blacklist ${HOME}/.config/Cryptocat |
84 | blacklist ${HOME}/.config/Debauchee/Barrier.conf | 73 | blacklist ${HOME}/.config/Debauchee/Barrier.conf |
85 | blacklist ${HOME}/.config/Dharkael | 74 | blacklist ${HOME}/.config/Dharkael |
75 | blacklist ${HOME}/.config/ENCOM | ||
86 | blacklist ${HOME}/.config/Element | 76 | blacklist ${HOME}/.config/Element |
87 | blacklist ${HOME}/.config/Element (Riot) | 77 | blacklist ${HOME}/.config/Element (Riot) |
88 | blacklist ${HOME}/.config/ENCOM | ||
89 | blacklist ${HOME}/.config/Enox | 78 | blacklist ${HOME}/.config/Enox |
90 | blacklist ${HOME}/.config/Epic | 79 | blacklist ${HOME}/.config/Epic |
80 | blacklist ${HOME}/.config/Exodus | ||
91 | blacklist ${HOME}/.config/Ferdi | 81 | blacklist ${HOME}/.config/Ferdi |
92 | blacklist ${HOME}/.config/Flavio Tordini | 82 | blacklist ${HOME}/.config/Flavio Tordini |
93 | blacklist ${HOME}/.config/Franz | 83 | blacklist ${HOME}/.config/Franz |
@@ -103,7 +93,10 @@ blacklist ${HOME}/.config/Gpredict | |||
103 | blacklist ${HOME}/.config/INRIA | 93 | blacklist ${HOME}/.config/INRIA |
104 | blacklist ${HOME}/.config/InSilmaril | 94 | blacklist ${HOME}/.config/InSilmaril |
105 | blacklist ${HOME}/.config/Jitsi Meet | 95 | blacklist ${HOME}/.config/Jitsi Meet |
96 | blacklist ${HOME}/.config/JetBrains/CLion* | ||
106 | blacklist ${HOME}/.config/KDE/neochat | 97 | blacklist ${HOME}/.config/KDE/neochat |
98 | blacklist ${HOME}/.config/KeePass | ||
99 | blacklist ${HOME}/.config/KeePassXCrc | ||
107 | blacklist ${HOME}/.config/Kid3 | 100 | blacklist ${HOME}/.config/Kid3 |
108 | blacklist ${HOME}/.config/Kingsoft | 101 | blacklist ${HOME}/.config/Kingsoft |
109 | blacklist ${HOME}/.config/LibreCAD | 102 | blacklist ${HOME}/.config/LibreCAD |
@@ -113,6 +106,7 @@ blacklist ${HOME}/.config/LyX | |||
113 | blacklist ${HOME}/.config/Mattermost | 106 | blacklist ${HOME}/.config/Mattermost |
114 | blacklist ${HOME}/.config/Meltytech | 107 | blacklist ${HOME}/.config/Meltytech |
115 | blacklist ${HOME}/.config/Mendeley Ltd. | 108 | blacklist ${HOME}/.config/Mendeley Ltd. |
109 | blacklist ${HOME}/.config/Microsoft | ||
116 | blacklist ${HOME}/.config/Min | 110 | blacklist ${HOME}/.config/Min |
117 | blacklist ${HOME}/.config/ModTheSpire | 111 | blacklist ${HOME}/.config/ModTheSpire |
118 | blacklist ${HOME}/.config/Mousepad | 112 | blacklist ${HOME}/.config/Mousepad |
@@ -122,11 +116,13 @@ blacklist ${HOME}/.config/MuseScore | |||
122 | blacklist ${HOME}/.config/MusicBrainz | 116 | blacklist ${HOME}/.config/MusicBrainz |
123 | blacklist ${HOME}/.config/Nathan Osman | 117 | blacklist ${HOME}/.config/Nathan Osman |
124 | blacklist ${HOME}/.config/Nextcloud | 118 | blacklist ${HOME}/.config/Nextcloud |
119 | blacklist ${HOME}/.config/NitroShare | ||
125 | blacklist ${HOME}/.config/Nylas Mail | 120 | blacklist ${HOME}/.config/Nylas Mail |
121 | blacklist ${HOME}/.config/PBE | ||
126 | blacklist ${HOME}/.config/PacmanLogViewer | 122 | blacklist ${HOME}/.config/PacmanLogViewer |
127 | blacklist ${HOME}/.config/PawelStolowski | 123 | blacklist ${HOME}/.config/PawelStolowski |
128 | blacklist ${HOME}/.config/PBE | ||
129 | blacklist ${HOME}/.config/Philipp Schmieder | 124 | blacklist ${HOME}/.config/Philipp Schmieder |
125 | blacklist ${HOME}/.config/Pinta | ||
130 | blacklist ${HOME}/.config/QGIS | 126 | blacklist ${HOME}/.config/QGIS |
131 | blacklist ${HOME}/.config/QMediathekView | 127 | blacklist ${HOME}/.config/QMediathekView |
132 | blacklist ${HOME}/.config/Qlipper | 128 | blacklist ${HOME}/.config/Qlipper |
@@ -147,10 +143,12 @@ blacklist ${HOME}/.config/Thunar | |||
147 | blacklist ${HOME}/.config/Twitch | 143 | blacklist ${HOME}/.config/Twitch |
148 | blacklist ${HOME}/.config/Unknown Organization | 144 | blacklist ${HOME}/.config/Unknown Organization |
149 | blacklist ${HOME}/.config/VirtualBox | 145 | blacklist ${HOME}/.config/VirtualBox |
146 | blacklist ${HOME}/.config/Whalebird | ||
150 | blacklist ${HOME}/.config/Wire | 147 | blacklist ${HOME}/.config/Wire |
151 | blacklist ${HOME}/.config/Youtube | 148 | blacklist ${HOME}/.config/Youtube |
152 | blacklist ${HOME}/.config/Zeal | ||
153 | blacklist ${HOME}/.config/ZeGrapher Project | 149 | blacklist ${HOME}/.config/ZeGrapher Project |
150 | blacklist ${HOME}/.config/Zeal | ||
151 | blacklist ${HOME}/.config/Zulip | ||
154 | blacklist ${HOME}/.config/aacs | 152 | blacklist ${HOME}/.config/aacs |
155 | blacklist ${HOME}/.config/abiword | 153 | blacklist ${HOME}/.config/abiword |
156 | blacklist ${HOME}/.config/agenda | 154 | blacklist ${HOME}/.config/agenda |
@@ -203,6 +201,7 @@ blacklist ${HOME}/.config/com.github.bleakgrey.tootle | |||
203 | blacklist ${HOME}/.config/corebird | 201 | blacklist ${HOME}/.config/corebird |
204 | blacklist ${HOME}/.config/cower | 202 | blacklist ${HOME}/.config/cower |
205 | blacklist ${HOME}/.config/coyim | 203 | blacklist ${HOME}/.config/coyim |
204 | blacklist ${HOME}/.config/d-feet | ||
206 | blacklist ${HOME}/.config/darktable | 205 | blacklist ${HOME}/.config/darktable |
207 | blacklist ${HOME}/.config/deadbeef | 206 | blacklist ${HOME}/.config/deadbeef |
208 | blacklist ${HOME}/.config/deluge | 207 | blacklist ${HOME}/.config/deluge |
@@ -217,7 +216,6 @@ blacklist ${HOME}/.config/dolphin-emu | |||
217 | blacklist ${HOME}/.config/dolphinrc | 216 | blacklist ${HOME}/.config/dolphinrc |
218 | blacklist ${HOME}/.config/dragonplayerrc | 217 | blacklist ${HOME}/.config/dragonplayerrc |
219 | blacklist ${HOME}/.config/draw.io | 218 | blacklist ${HOME}/.config/draw.io |
220 | blacklist ${HOME}/.config/d-feet | ||
221 | blacklist ${HOME}/.config/electron-mail | 219 | blacklist ${HOME}/.config/electron-mail |
222 | blacklist ${HOME}/.config/emaildefaults | 220 | blacklist ${HOME}/.config/emaildefaults |
223 | blacklist ${HOME}/.config/emailidentities | 221 | blacklist ${HOME}/.config/emailidentities |
@@ -237,6 +235,7 @@ blacklist ${HOME}/.config/font-manager | |||
237 | blacklist ${HOME}/.config/freecol | 235 | blacklist ${HOME}/.config/freecol |
238 | blacklist ${HOME}/.config/gajim | 236 | blacklist ${HOME}/.config/gajim |
239 | blacklist ${HOME}/.config/galculator | 237 | blacklist ${HOME}/.config/galculator |
238 | blacklist ${HOME}/.config/gallery-dl | ||
240 | blacklist ${HOME}/.config/gconf | 239 | blacklist ${HOME}/.config/gconf |
241 | blacklist ${HOME}/.config/geany | 240 | blacklist ${HOME}/.config/geany |
242 | blacklist ${HOME}/.config/geary | 241 | blacklist ${HOME}/.config/geary |
@@ -291,6 +290,9 @@ blacklist ${HOME}/.config/kdeconnect | |||
291 | blacklist ${HOME}/.config/kdenliverc | 290 | blacklist ${HOME}/.config/kdenliverc |
292 | blacklist ${HOME}/.config/kdiff3fileitemactionrc | 291 | blacklist ${HOME}/.config/kdiff3fileitemactionrc |
293 | blacklist ${HOME}/.config/kdiff3rc | 292 | blacklist ${HOME}/.config/kdiff3rc |
293 | blacklist ${HOME}/.config/keepass | ||
294 | blacklist ${HOME}/.config/keepassx | ||
295 | blacklist ${HOME}/.config/keepassxc | ||
294 | blacklist ${HOME}/.config/kfindrc | 296 | blacklist ${HOME}/.config/kfindrc |
295 | blacklist ${HOME}/.config/kgetrc | 297 | blacklist ${HOME}/.config/kgetrc |
296 | blacklist ${HOME}/.config/kid3rc | 298 | blacklist ${HOME}/.config/kid3rc |
@@ -300,8 +302,8 @@ blacklist ${HOME}/.config/kmail2rc | |||
300 | blacklist ${HOME}/.config/kmailsearchindexingrc | 302 | blacklist ${HOME}/.config/kmailsearchindexingrc |
301 | blacklist ${HOME}/.config/kmplayerrc | 303 | blacklist ${HOME}/.config/kmplayerrc |
302 | blacklist ${HOME}/.config/knotesrc | 304 | blacklist ${HOME}/.config/knotesrc |
303 | blacklist ${HOME}/.config/konversationrc | ||
304 | blacklist ${HOME}/.config/konversation.notifyrc | 305 | blacklist ${HOME}/.config/konversation.notifyrc |
306 | blacklist ${HOME}/.config/konversationrc | ||
305 | blacklist ${HOME}/.config/kritarc | 307 | blacklist ${HOME}/.config/kritarc |
306 | blacklist ${HOME}/.config/ktorrentrc | 308 | blacklist ${HOME}/.config/ktorrentrc |
307 | blacklist ${HOME}/.config/ktouch2rc | 309 | blacklist ${HOME}/.config/ktouch2rc |
@@ -322,10 +324,10 @@ blacklist ${HOME}/.config/mate/mate-dictionary | |||
322 | blacklist ${HOME}/.config/matrix-mirage | 324 | blacklist ${HOME}/.config/matrix-mirage |
323 | blacklist ${HOME}/.config/mcomix | 325 | blacklist ${HOME}/.config/mcomix |
324 | blacklist ${HOME}/.config/meld | 326 | blacklist ${HOME}/.config/meld |
325 | blacklist ${HOME}/.config/meteo-qt | ||
326 | blacklist ${HOME}/.config/menulibre.cfg | 327 | blacklist ${HOME}/.config/menulibre.cfg |
328 | blacklist ${HOME}/.config/meteo-qt | ||
327 | blacklist ${HOME}/.config/mfusion | 329 | blacklist ${HOME}/.config/mfusion |
328 | blacklist ${HOME}/.config/Microsoft | 330 | blacklist ${HOME}/.config/microsoft-edge-beta |
329 | blacklist ${HOME}/.config/microsoft-edge-dev | 331 | blacklist ${HOME}/.config/microsoft-edge-dev |
330 | blacklist ${HOME}/.config/midori | 332 | blacklist ${HOME}/.config/midori |
331 | blacklist ${HOME}/.config/mirage | 333 | blacklist ${HOME}/.config/mirage |
@@ -341,15 +343,14 @@ blacklist ${HOME}/.config/mypaint | |||
341 | blacklist ${HOME}/.config/nano | 343 | blacklist ${HOME}/.config/nano |
342 | blacklist ${HOME}/.config/nautilus | 344 | blacklist ${HOME}/.config/nautilus |
343 | blacklist ${HOME}/.config/nemo | 345 | blacklist ${HOME}/.config/nemo |
344 | blacklist ${HOME}/.config/neochatrc | ||
345 | blacklist ${HOME}/.config/neochat.notifyrc | 346 | blacklist ${HOME}/.config/neochat.notifyrc |
347 | blacklist ${HOME}/.config/neochatrc | ||
346 | blacklist ${HOME}/.config/neomutt | 348 | blacklist ${HOME}/.config/neomutt |
347 | blacklist ${HOME}/.config/netsurf | 349 | blacklist ${HOME}/.config/netsurf |
348 | blacklist ${HOME}/.config/newsbeuter | 350 | blacklist ${HOME}/.config/newsbeuter |
349 | blacklist ${HOME}/.config/newsboat | 351 | blacklist ${HOME}/.config/newsboat |
350 | blacklist ${HOME}/.config/newsflash | 352 | blacklist ${HOME}/.config/newsflash |
351 | blacklist ${HOME}/.config/nheko | 353 | blacklist ${HOME}/.config/nheko |
352 | blacklist ${HOME}/.config/NitroShare | ||
353 | blacklist ${HOME}/.config/nomacs | 354 | blacklist ${HOME}/.config/nomacs |
354 | blacklist ${HOME}/.config/nuclear | 355 | blacklist ${HOME}/.config/nuclear |
355 | blacklist ${HOME}/.config/obs-studio | 356 | blacklist ${HOME}/.config/obs-studio |
@@ -370,7 +371,6 @@ blacklist ${HOME}/.config/pavucontrol-qt | |||
370 | blacklist ${HOME}/.config/pavucontrol.ini | 371 | blacklist ${HOME}/.config/pavucontrol.ini |
371 | blacklist ${HOME}/.config/pcmanfm | 372 | blacklist ${HOME}/.config/pcmanfm |
372 | blacklist ${HOME}/.config/pdfmod | 373 | blacklist ${HOME}/.config/pdfmod |
373 | blacklist ${HOME}/.config/Pinta | ||
374 | blacklist ${HOME}/.config/pipe-viewer | 374 | blacklist ${HOME}/.config/pipe-viewer |
375 | blacklist ${HOME}/.config/pitivi | 375 | blacklist ${HOME}/.config/pitivi |
376 | blacklist ${HOME}/.config/pix | 376 | blacklist ${HOME}/.config/pix |
@@ -409,8 +409,8 @@ blacklist ${HOME}/.config/spectaclerc | |||
409 | blacklist ${HOME}/.config/spotify | 409 | blacklist ${HOME}/.config/spotify |
410 | blacklist ${HOME}/.config/sqlitebrowser | 410 | blacklist ${HOME}/.config/sqlitebrowser |
411 | blacklist ${HOME}/.config/stellarium | 411 | blacklist ${HOME}/.config/stellarium |
412 | blacklist ${HOME}/.config/strawberry | ||
413 | blacklist ${HOME}/.config/straw-viewer | 412 | blacklist ${HOME}/.config/straw-viewer |
413 | blacklist ${HOME}/.config/strawberry | ||
414 | blacklist ${HOME}/.config/supertuxkart | 414 | blacklist ${HOME}/.config/supertuxkart |
415 | blacklist ${HOME}/.config/synfig | 415 | blacklist ${HOME}/.config/synfig |
416 | blacklist ${HOME}/.config/teams | 416 | blacklist ${HOME}/.config/teams |
@@ -433,19 +433,19 @@ blacklist ${HOME}/.config/vivaldi | |||
433 | blacklist ${HOME}/.config/vivaldi-snapshot | 433 | blacklist ${HOME}/.config/vivaldi-snapshot |
434 | blacklist ${HOME}/.config/vlc | 434 | blacklist ${HOME}/.config/vlc |
435 | blacklist ${HOME}/.config/wesnoth | 435 | blacklist ${HOME}/.config/wesnoth |
436 | blacklist ${HOME}/.config/wormux | ||
437 | blacklist ${HOME}/.config/Whalebird | ||
438 | blacklist ${HOME}/.config/wireshark | 436 | blacklist ${HOME}/.config/wireshark |
437 | blacklist ${HOME}/.config/wormux | ||
439 | blacklist ${HOME}/.config/xchat | 438 | blacklist ${HOME}/.config/xchat |
440 | blacklist ${HOME}/.config/xed | 439 | blacklist ${HOME}/.config/xed |
441 | blacklist ${HOME}/.config/xfburn | 440 | blacklist ${HOME}/.config/xfburn |
441 | blacklist ${HOME}/.config/xfce4-dict | ||
442 | blacklist ${HOME}/.config/xfce4/xfce4-notes.gtkrc | 442 | blacklist ${HOME}/.config/xfce4/xfce4-notes.gtkrc |
443 | blacklist ${HOME}/.config/xfce4/xfce4-notes.rc | 443 | blacklist ${HOME}/.config/xfce4/xfce4-notes.rc |
444 | blacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml | 444 | blacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml |
445 | blacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml | 445 | blacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml |
446 | blacklist ${HOME}/.config/xfce4-dict | ||
447 | blacklist ${HOME}/.config/xiaoyong | 446 | blacklist ${HOME}/.config/xiaoyong |
448 | blacklist ${HOME}/.config/xmms2 | 447 | blacklist ${HOME}/.config/xmms2 |
448 | blacklist ${HOME}/.config/xournalpp | ||
449 | blacklist ${HOME}/.config/xplayer | 449 | blacklist ${HOME}/.config/xplayer |
450 | blacklist ${HOME}/.config/xreader | 450 | blacklist ${HOME}/.config/xreader |
451 | blacklist ${HOME}/.config/xviewer | 451 | blacklist ${HOME}/.config/xviewer |
@@ -454,12 +454,13 @@ blacklist ${HOME}/.config/yandex-browser-beta | |||
454 | blacklist ${HOME}/.config/yelp | 454 | blacklist ${HOME}/.config/yelp |
455 | blacklist ${HOME}/.config/youtube-dl | 455 | blacklist ${HOME}/.config/youtube-dl |
456 | blacklist ${HOME}/.config/youtube-dlg | 456 | blacklist ${HOME}/.config/youtube-dlg |
457 | blacklist ${HOME}/.config/youtubemusic-nativefier-040164 | ||
458 | blacklist ${HOME}/.config/youtube-music-desktop-app | 457 | blacklist ${HOME}/.config/youtube-music-desktop-app |
459 | blacklist ${HOME}/.config/youtube-viewer | 458 | blacklist ${HOME}/.config/youtube-viewer |
459 | blacklist ${HOME}/.config/youtubemusic-nativefier-040164 | ||
460 | blacklist ${HOME}/.config/yt-dlp | ||
460 | blacklist ${HOME}/.config/zathura | 461 | blacklist ${HOME}/.config/zathura |
462 | blacklist ${HOME}/.config/zim | ||
461 | blacklist ${HOME}/.config/zoomus.conf | 463 | blacklist ${HOME}/.config/zoomus.conf |
462 | blacklist ${HOME}/.config/Zulip | ||
463 | blacklist ${HOME}/.conkeror.mozdev.org | 464 | blacklist ${HOME}/.conkeror.mozdev.org |
464 | blacklist ${HOME}/.crawl | 465 | blacklist ${HOME}/.crawl |
465 | blacklist ${HOME}/.cups | 466 | blacklist ${HOME}/.cups |
@@ -487,25 +488,29 @@ blacklist ${HOME}/.firedragon | |||
487 | blacklist ${HOME}/.flowblade | 488 | blacklist ${HOME}/.flowblade |
488 | blacklist ${HOME}/.fltk | 489 | blacklist ${HOME}/.fltk |
489 | blacklist ${HOME}/.fossamail | 490 | blacklist ${HOME}/.fossamail |
491 | blacklist ${HOME}/.fpm | ||
490 | blacklist ${HOME}/.freeciv | 492 | blacklist ${HOME}/.freeciv |
491 | blacklist ${HOME}/.freecol | 493 | blacklist ${HOME}/.freecol |
492 | blacklist ${HOME}/.freemind | 494 | blacklist ${HOME}/.freemind |
493 | blacklist ${HOME}/.frogatto | 495 | blacklist ${HOME}/.frogatto |
494 | blacklist ${HOME}/.frozen-bubble | 496 | blacklist ${HOME}/.frozen-bubble |
495 | blacklist ${HOME}/.funnyboat | 497 | blacklist ${HOME}/.funnyboat |
498 | blacklist ${HOME}/.gallery-dl.conf | ||
499 | blacklist ${HOME}/.geekbench5 | ||
496 | blacklist ${HOME}/.gimp* | 500 | blacklist ${HOME}/.gimp* |
497 | blacklist ${HOME}/.gist | 501 | blacklist ${HOME}/.gist |
498 | blacklist ${HOME}/.gitconfig | 502 | blacklist ${HOME}/.gitconfig |
499 | blacklist ${HOME}/.gl-117 | 503 | blacklist ${HOME}/.gl-117 |
500 | blacklist ${HOME}/.glaxiumrc | 504 | blacklist ${HOME}/.glaxiumrc |
501 | blacklist ${HOME}/.gnome/gnome-schedule | 505 | blacklist ${HOME}/.gnome/gnome-schedule |
506 | blacklist ${HOME}/.goldendict | ||
502 | blacklist ${HOME}/.googleearth | 507 | blacklist ${HOME}/.googleearth |
503 | blacklist ${HOME}/.gradle | 508 | blacklist ${HOME}/.gradle |
504 | blacklist ${HOME}/.gramps | 509 | blacklist ${HOME}/.gramps |
505 | blacklist ${HOME}/.guayadeque | 510 | blacklist ${HOME}/.guayadeque |
506 | blacklist ${HOME}/.hashcat | 511 | blacklist ${HOME}/.hashcat |
507 | blacklist ${HOME}/.hex-a-hop | ||
508 | blacklist ${HOME}/.hedgewars | 512 | blacklist ${HOME}/.hedgewars |
513 | blacklist ${HOME}/.hex-a-hop | ||
509 | blacklist ${HOME}/.hugin | 514 | blacklist ${HOME}/.hugin |
510 | blacklist ${HOME}/.i2p | 515 | blacklist ${HOME}/.i2p |
511 | blacklist ${HOME}/.icedove | 516 | blacklist ${HOME}/.icedove |
@@ -581,6 +586,9 @@ blacklist ${HOME}/.kde4/share/config/kopeterc | |||
581 | blacklist ${HOME}/.kde4/share/config/ktorrentrc | 586 | blacklist ${HOME}/.kde4/share/config/ktorrentrc |
582 | blacklist ${HOME}/.kde4/share/config/okularpartrc | 587 | blacklist ${HOME}/.kde4/share/config/okularpartrc |
583 | blacklist ${HOME}/.kde4/share/config/okularrc | 588 | blacklist ${HOME}/.kde4/share/config/okularrc |
589 | blacklist ${HOME}/.keepass | ||
590 | blacklist ${HOME}/.keepassx | ||
591 | blacklist ${HOME}/.keepassxc | ||
584 | blacklist ${HOME}/.killingfloor | 592 | blacklist ${HOME}/.killingfloor |
585 | blacklist ${HOME}/.kingsoft | 593 | blacklist ${HOME}/.kingsoft |
586 | blacklist ${HOME}/.kino-history | 594 | blacklist ${HOME}/.kino-history |
@@ -588,6 +596,7 @@ blacklist ${HOME}/.kinorc | |||
588 | blacklist ${HOME}/.klatexformula | 596 | blacklist ${HOME}/.klatexformula |
589 | blacklist ${HOME}/.klei | 597 | blacklist ${HOME}/.klei |
590 | blacklist ${HOME}/.kodi | 598 | blacklist ${HOME}/.kodi |
599 | blacklist ${HOME}/.lastpass | ||
591 | blacklist ${HOME}/.librewolf | 600 | blacklist ${HOME}/.librewolf |
592 | blacklist ${HOME}/.lincity-ng | 601 | blacklist ${HOME}/.lincity-ng |
593 | blacklist ${HOME}/.links | 602 | blacklist ${HOME}/.links |
@@ -602,15 +611,19 @@ blacklist ${HOME}/.local/share/Anki2 | |||
602 | blacklist ${HOME}/.local/share/Dredmor | 611 | blacklist ${HOME}/.local/share/Dredmor |
603 | blacklist ${HOME}/.local/share/Empathy | 612 | blacklist ${HOME}/.local/share/Empathy |
604 | blacklist ${HOME}/.local/share/Enpass | 613 | blacklist ${HOME}/.local/share/Enpass |
614 | blacklist ${HOME}/.local/share/FasterThanLight | ||
605 | blacklist ${HOME}/.local/share/Flavio Tordini | 615 | blacklist ${HOME}/.local/share/Flavio Tordini |
616 | blacklist ${HOME}/.local/share/IntoTheBreach | ||
606 | blacklist ${HOME}/.local/share/JetBrains | 617 | blacklist ${HOME}/.local/share/JetBrains |
607 | blacklist ${HOME}/.local/share/KDE/neochat | 618 | blacklist ${HOME}/.local/share/KDE/neochat |
619 | blacklist ${HOME}/.local/share/KeePass | ||
608 | blacklist ${HOME}/.local/share/Kingsoft | 620 | blacklist ${HOME}/.local/share/Kingsoft |
609 | blacklist ${HOME}/.local/share/LibreCAD | 621 | blacklist ${HOME}/.local/share/LibreCAD |
610 | blacklist ${HOME}/.local/share/Mendeley Ltd. | 622 | blacklist ${HOME}/.local/share/Mendeley Ltd. |
611 | blacklist ${HOME}/.local/share/Mumble | 623 | blacklist ${HOME}/.local/share/Mumble |
612 | blacklist ${HOME}/.local/share/Nextcloud | 624 | blacklist ${HOME}/.local/share/Nextcloud |
613 | blacklist ${HOME}/.local/share/PBE | 625 | blacklist ${HOME}/.local/share/PBE |
626 | blacklist ${HOME}/.local/share/Paradox Interactive | ||
614 | blacklist ${HOME}/.local/share/PawelStolowski | 627 | blacklist ${HOME}/.local/share/PawelStolowski |
615 | blacklist ${HOME}/.local/share/PillarsOfEternity | 628 | blacklist ${HOME}/.local/share/PillarsOfEternity |
616 | blacklist ${HOME}/.local/share/Psi | 629 | blacklist ${HOME}/.local/share/Psi |
@@ -622,20 +635,20 @@ blacklist ${HOME}/.local/share/RogueLegacy | |||
622 | blacklist ${HOME}/.local/share/RogueLegacyStorageContainer | 635 | blacklist ${HOME}/.local/share/RogueLegacyStorageContainer |
623 | blacklist ${HOME}/.local/share/Shortwave | 636 | blacklist ${HOME}/.local/share/Shortwave |
624 | blacklist ${HOME}/.local/share/Steam | 637 | blacklist ${HOME}/.local/share/Steam |
625 | blacklist ${HOME}/.local/share/SteamWorldDig | ||
626 | blacklist ${HOME}/.local/share/SteamWorld Dig 2 | 638 | blacklist ${HOME}/.local/share/SteamWorld Dig 2 |
639 | blacklist ${HOME}/.local/share/SteamWorldDig | ||
627 | blacklist ${HOME}/.local/share/SuperHexagon | 640 | blacklist ${HOME}/.local/share/SuperHexagon |
628 | blacklist ${HOME}/.local/share/TelegramDesktop | 641 | blacklist ${HOME}/.local/share/TelegramDesktop |
629 | blacklist ${HOME}/.local/share/Terraria | 642 | blacklist ${HOME}/.local/share/Terraria |
630 | blacklist ${HOME}/.local/share/TpLogger | 643 | blacklist ${HOME}/.local/share/TpLogger |
631 | blacklist ${HOME}/.local/share/Zeal | 644 | blacklist ${HOME}/.local/share/Zeal |
645 | blacklist ${HOME}/.local/share/agenda | ||
632 | blacklist ${HOME}/.local/share/akonadi* | 646 | blacklist ${HOME}/.local/share/akonadi* |
633 | blacklist ${HOME}/.local/share/akregator | 647 | blacklist ${HOME}/.local/share/akregator |
634 | blacklist ${HOME}/.local/share/agenda | ||
635 | blacklist ${HOME}/.local/share/apps/korganizer | 648 | blacklist ${HOME}/.local/share/apps/korganizer |
636 | blacklist ${HOME}/.local/share/aspyr-media | 649 | blacklist ${HOME}/.local/share/aspyr-media |
637 | blacklist ${HOME}/.local/share/autokey | ||
638 | blacklist ${HOME}/.local/share/authenticator-rs | 650 | blacklist ${HOME}/.local/share/authenticator-rs |
651 | blacklist ${HOME}/.local/share/autokey | ||
639 | blacklist ${HOME}/.local/share/backintime | 652 | blacklist ${HOME}/.local/share/backintime |
640 | blacklist ${HOME}/.local/share/baloo | 653 | blacklist ${HOME}/.local/share/baloo |
641 | blacklist ${HOME}/.local/share/barrier | 654 | blacklist ${HOME}/.local/share/barrier |
@@ -662,7 +675,6 @@ blacklist ${HOME}/.local/share/dolphin-emu | |||
662 | blacklist ${HOME}/.local/share/emailidentities | 675 | blacklist ${HOME}/.local/share/emailidentities |
663 | blacklist ${HOME}/.local/share/epiphany | 676 | blacklist ${HOME}/.local/share/epiphany |
664 | blacklist ${HOME}/.local/share/evolution | 677 | blacklist ${HOME}/.local/share/evolution |
665 | blacklist ${HOME}/.local/share/FasterThanLight | ||
666 | blacklist ${HOME}/.local/share/feedreader | 678 | blacklist ${HOME}/.local/share/feedreader |
667 | blacklist ${HOME}/.local/share/feral-interactive | 679 | blacklist ${HOME}/.local/share/feral-interactive |
668 | blacklist ${HOME}/.local/share/five-or-more | 680 | blacklist ${HOME}/.local/share/five-or-more |
@@ -692,12 +704,13 @@ blacklist ${HOME}/.local/share/godot | |||
692 | blacklist ${HOME}/.local/share/gradio | 704 | blacklist ${HOME}/.local/share/gradio |
693 | blacklist ${HOME}/.local/share/gwenview | 705 | blacklist ${HOME}/.local/share/gwenview |
694 | blacklist ${HOME}/.local/share/i2p | 706 | blacklist ${HOME}/.local/share/i2p |
695 | blacklist ${HOME}/.local/share/IntoTheBreach | 707 | blacklist ${HOME}/.local/share/io.github.lainsce.Notejot |
696 | blacklist ${HOME}/.local/share/jami | 708 | blacklist ${HOME}/.local/share/jami |
697 | blacklist ${HOME}/.local/share/kaffeine | 709 | blacklist ${HOME}/.local/share/kaffeine |
698 | blacklist ${HOME}/.local/share/kalgebra | 710 | blacklist ${HOME}/.local/share/kalgebra |
699 | blacklist ${HOME}/.local/share/kate | 711 | blacklist ${HOME}/.local/share/kate |
700 | blacklist ${HOME}/.local/share/kdenlive | 712 | blacklist ${HOME}/.local/share/kdenlive |
713 | blacklist ${HOME}/.local/share/keepass | ||
701 | blacklist ${HOME}/.local/share/kget | 714 | blacklist ${HOME}/.local/share/kget |
702 | blacklist ${HOME}/.local/share/kiwix | 715 | blacklist ${HOME}/.local/share/kiwix |
703 | blacklist ${HOME}/.local/share/kiwix-desktop | 716 | blacklist ${HOME}/.local/share/kiwix-desktop |
@@ -748,14 +761,13 @@ blacklist ${HOME}/.local/share/onlyoffice | |||
748 | blacklist ${HOME}/.local/share/openmw | 761 | blacklist ${HOME}/.local/share/openmw |
749 | blacklist ${HOME}/.local/share/orage | 762 | blacklist ${HOME}/.local/share/orage |
750 | blacklist ${HOME}/.local/share/org.kde.gwenview | 763 | blacklist ${HOME}/.local/share/org.kde.gwenview |
751 | blacklist ${HOME}/.local/share/Paradox Interactive | ||
752 | blacklist ${HOME}/.local/share/pix | 764 | blacklist ${HOME}/.local/share/pix |
753 | blacklist ${HOME}/.local/share/plasma_notes | 765 | blacklist ${HOME}/.local/share/plasma_notes |
754 | blacklist ${HOME}/.local/share/profanity | 766 | blacklist ${HOME}/.local/share/profanity |
755 | blacklist ${HOME}/.local/share/psi | 767 | blacklist ${HOME}/.local/share/psi |
756 | blacklist ${HOME}/.local/share/psi+ | 768 | blacklist ${HOME}/.local/share/psi+ |
757 | blacklist ${HOME}/.local/share/quadrapassel | ||
758 | blacklist ${HOME}/.local/share/qpdfview | 769 | blacklist ${HOME}/.local/share/qpdfview |
770 | blacklist ${HOME}/.local/share/quadrapassel | ||
759 | blacklist ${HOME}/.local/share/qutebrowser | 771 | blacklist ${HOME}/.local/share/qutebrowser |
760 | blacklist ${HOME}/.local/share/remmina | 772 | blacklist ${HOME}/.local/share/remmina |
761 | blacklist ${HOME}/.local/share/rhythmbox | 773 | blacklist ${HOME}/.local/share/rhythmbox |
@@ -785,6 +797,7 @@ blacklist ${HOME}/.local/share/wormux | |||
785 | blacklist ${HOME}/.local/share/xplayer | 797 | blacklist ${HOME}/.local/share/xplayer |
786 | blacklist ${HOME}/.local/share/xreader | 798 | blacklist ${HOME}/.local/share/xreader |
787 | blacklist ${HOME}/.local/share/zathura | 799 | blacklist ${HOME}/.local/share/zathura |
800 | blacklist ${HOME}/.local/state/pipewire | ||
788 | blacklist ${HOME}/.lv2 | 801 | blacklist ${HOME}/.lv2 |
789 | blacklist ${HOME}/.lyx | 802 | blacklist ${HOME}/.lyx |
790 | blacklist ${HOME}/.magicor | 803 | blacklist ${HOME}/.magicor |
@@ -831,6 +844,7 @@ blacklist ${HOME}/.opera-beta | |||
831 | blacklist ${HOME}/.ostrichriders | 844 | blacklist ${HOME}/.ostrichriders |
832 | blacklist ${HOME}/.paradoxinteractive | 845 | blacklist ${HOME}/.paradoxinteractive |
833 | blacklist ${HOME}/.parallelrealities/blobwars | 846 | blacklist ${HOME}/.parallelrealities/blobwars |
847 | blacklist ${HOME}/.password-store | ||
834 | blacklist ${HOME}/.pcsxr | 848 | blacklist ${HOME}/.pcsxr |
835 | blacklist ${HOME}/.penguin-command | 849 | blacklist ${HOME}/.penguin-command |
836 | blacklist ${HOME}/.pine-crash | 850 | blacklist ${HOME}/.pine-crash |
@@ -850,6 +864,7 @@ blacklist ${HOME}/.qgis2 | |||
850 | blacklist ${HOME}/.qmmp | 864 | blacklist ${HOME}/.qmmp |
851 | blacklist ${HOME}/.quodlibet | 865 | blacklist ${HOME}/.quodlibet |
852 | blacklist ${HOME}/.redeclipse | 866 | blacklist ${HOME}/.redeclipse |
867 | blacklist ${HOME}/.rednotebook | ||
853 | blacklist ${HOME}/.remmina | 868 | blacklist ${HOME}/.remmina |
854 | blacklist ${HOME}/.repo_.gitconfig.json | 869 | blacklist ${HOME}/.repo_.gitconfig.json |
855 | blacklist ${HOME}/.repoconfig | 870 | blacklist ${HOME}/.repoconfig |
@@ -920,8 +935,22 @@ blacklist ${HOME}/.yarn-config | |||
920 | blacklist ${HOME}/.yarncache | 935 | blacklist ${HOME}/.yarncache |
921 | blacklist ${HOME}/.yarnrc | 936 | blacklist ${HOME}/.yarnrc |
922 | blacklist ${HOME}/.zoom | 937 | blacklist ${HOME}/.zoom |
923 | blacklist /tmp/akonadi-* | 938 | blacklist ${HOME}/Arduino |
939 | blacklist ${HOME}/Monero/wallets | ||
940 | blacklist ${HOME}/Nextcloud | ||
941 | blacklist ${HOME}/Nextcloud/Notes | ||
942 | blacklist ${HOME}/SoftMaker | ||
943 | blacklist ${HOME}/Standard Notes Backups | ||
944 | blacklist ${HOME}/TeamSpeak3-Client-linux_amd64 | ||
945 | blacklist ${HOME}/TeamSpeak3-Client-linux_x86 | ||
946 | blacklist ${HOME}/hyperrogue.ini | ||
947 | blacklist ${HOME}/i2p | ||
948 | blacklist ${HOME}/mps | ||
949 | blacklist ${HOME}/wallet.dat | ||
950 | blacklist ${HOME}/yt-dlp.conf | ||
951 | blacklist ${RUNUSER}/*firefox* | ||
924 | blacklist /tmp/.wine-* | 952 | blacklist /tmp/.wine-* |
953 | blacklist /tmp/akonadi-* | ||
925 | blacklist /var/games/nethack | 954 | blacklist /var/games/nethack |
926 | blacklist /var/games/slashem | 955 | blacklist /var/games/slashem |
927 | blacklist /var/games/vulturesclaw | 956 | blacklist /var/games/vulturesclaw |
@@ -940,14 +969,17 @@ blacklist ${HOME}/.cache/Enpass | |||
940 | blacklist ${HOME}/.cache/Ferdi | 969 | blacklist ${HOME}/.cache/Ferdi |
941 | blacklist ${HOME}/.cache/Flavio Tordini | 970 | blacklist ${HOME}/.cache/Flavio Tordini |
942 | blacklist ${HOME}/.cache/Franz | 971 | blacklist ${HOME}/.cache/Franz |
972 | blacklist ${HOME}/.cache/GoldenDict | ||
943 | blacklist ${HOME}/.cache/INRIA | 973 | blacklist ${HOME}/.cache/INRIA |
974 | blacklist ${HOME}/.cache/INRIA/Natron | ||
975 | blacklist ${HOME}/.cache/KDE/neochat | ||
976 | blacklist ${HOME}/.cache/Mendeley Ltd. | ||
944 | blacklist ${HOME}/.cache/MusicBrainz | 977 | blacklist ${HOME}/.cache/MusicBrainz |
945 | blacklist ${HOME}/.cache/NewsFlashGTK | 978 | blacklist ${HOME}/.cache/NewsFlashGTK |
946 | blacklist ${HOME}/.cache/Otter | 979 | blacklist ${HOME}/.cache/Otter |
947 | blacklist ${HOME}/.cache/PawelStolowski | 980 | blacklist ${HOME}/.cache/PawelStolowski |
948 | blacklist ${HOME}/.cache/Psi | 981 | blacklist ${HOME}/.cache/Psi |
949 | blacklist ${HOME}/.cache/QuiteRss | 982 | blacklist ${HOME}/.cache/QuiteRss |
950 | blacklist ${HOME}/.cache/quodlibet | ||
951 | blacklist ${HOME}/.cache/Quotient/quaternion | 983 | blacklist ${HOME}/.cache/Quotient/quaternion |
952 | blacklist ${HOME}/.cache/Shortwave | 984 | blacklist ${HOME}/.cache/Shortwave |
953 | blacklist ${HOME}/.cache/Tox | 985 | blacklist ${HOME}/.cache/Tox |
@@ -986,8 +1018,8 @@ blacklist ${HOME}/.cache/fractal | |||
986 | blacklist ${HOME}/.cache/freecol | 1018 | blacklist ${HOME}/.cache/freecol |
987 | blacklist ${HOME}/.cache/gajim | 1019 | blacklist ${HOME}/.cache/gajim |
988 | blacklist ${HOME}/.cache/geary | 1020 | blacklist ${HOME}/.cache/geary |
989 | blacklist ${HOME}/.cache/gegl-0.4 | ||
990 | blacklist ${HOME}/.cache/geeqie | 1021 | blacklist ${HOME}/.cache/geeqie |
1022 | blacklist ${HOME}/.cache/gegl-0.4 | ||
991 | blacklist ${HOME}/.cache/gfeeds | 1023 | blacklist ${HOME}/.cache/gfeeds |
992 | blacklist ${HOME}/.cache/gimp | 1024 | blacklist ${HOME}/.cache/gimp |
993 | blacklist ${HOME}/.cache/gnome-boxes | 1025 | blacklist ${HOME}/.cache/gnome-boxes |
@@ -1004,12 +1036,12 @@ blacklist ${HOME}/.cache/google-chrome-unstable | |||
1004 | blacklist ${HOME}/.cache/gradio | 1036 | blacklist ${HOME}/.cache/gradio |
1005 | blacklist ${HOME}/.cache/gummi | 1037 | blacklist ${HOME}/.cache/gummi |
1006 | blacklist ${HOME}/.cache/icedove | 1038 | blacklist ${HOME}/.cache/icedove |
1007 | blacklist ${HOME}/.cache/INRIA/Natron | ||
1008 | blacklist ${HOME}/.cache/inkscape | 1039 | blacklist ${HOME}/.cache/inkscape |
1009 | blacklist ${HOME}/.cache/inox | 1040 | blacklist ${HOME}/.cache/inox |
1041 | blacklist ${HOME}/.cache/io.github.lainsce.Notejot | ||
1010 | blacklist ${HOME}/.cache/iridium | 1042 | blacklist ${HOME}/.cache/iridium |
1043 | blacklist ${HOME}/.cache/JetBrains/CLion* | ||
1011 | blacklist ${HOME}/.cache/kcmshell5 | 1044 | blacklist ${HOME}/.cache/kcmshell5 |
1012 | blacklist ${HOME}/.cache/KDE/neochat | ||
1013 | blacklist ${HOME}/.cache/kdenlive | 1045 | blacklist ${HOME}/.cache/kdenlive |
1014 | blacklist ${HOME}/.cache/keepassxc | 1046 | blacklist ${HOME}/.cache/keepassxc |
1015 | blacklist ${HOME}/.cache/kfind | 1047 | blacklist ${HOME}/.cache/kfind |
@@ -1026,9 +1058,9 @@ blacklist ${HOME}/.cache/libgweather | |||
1026 | blacklist ${HOME}/.cache/librewolf | 1058 | blacklist ${HOME}/.cache/librewolf |
1027 | blacklist ${HOME}/.cache/liferea | 1059 | blacklist ${HOME}/.cache/liferea |
1028 | blacklist ${HOME}/.cache/lutris | 1060 | blacklist ${HOME}/.cache/lutris |
1029 | blacklist ${HOME}/.cache/Mendeley Ltd. | ||
1030 | blacklist ${HOME}/.cache/marker | 1061 | blacklist ${HOME}/.cache/marker |
1031 | blacklist ${HOME}/.cache/matrix-mirage | 1062 | blacklist ${HOME}/.cache/matrix-mirage |
1063 | blacklist ${HOME}/.cache/microsoft-edge-beta | ||
1032 | blacklist ${HOME}/.cache/microsoft-edge-dev | 1064 | blacklist ${HOME}/.cache/microsoft-edge-dev |
1033 | blacklist ${HOME}/.cache/midori | 1065 | blacklist ${HOME}/.cache/midori |
1034 | blacklist ${HOME}/.cache/minetest | 1066 | blacklist ${HOME}/.cache/minetest |
@@ -1045,8 +1077,8 @@ blacklist ${HOME}/.cache/ms-skype-online | |||
1045 | blacklist ${HOME}/.cache/ms-word-online | 1077 | blacklist ${HOME}/.cache/ms-word-online |
1046 | blacklist ${HOME}/.cache/mutt | 1078 | blacklist ${HOME}/.cache/mutt |
1047 | blacklist ${HOME}/.cache/mypaint | 1079 | blacklist ${HOME}/.cache/mypaint |
1048 | blacklist ${HOME}/.cache/nheko | ||
1049 | blacklist ${HOME}/.cache/netsurf | 1080 | blacklist ${HOME}/.cache/netsurf |
1081 | blacklist ${HOME}/.cache/nheko | ||
1050 | blacklist ${HOME}/.cache/okular | 1082 | blacklist ${HOME}/.cache/okular |
1051 | blacklist ${HOME}/.cache/opera | 1083 | blacklist ${HOME}/.cache/opera |
1052 | blacklist ${HOME}/.cache/opera-beta | 1084 | blacklist ${HOME}/.cache/opera-beta |
@@ -1061,8 +1093,10 @@ blacklist ${HOME}/.cache/plasmashell | |||
1061 | blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite* | 1093 | blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite* |
1062 | blacklist ${HOME}/.cache/psi | 1094 | blacklist ${HOME}/.cache/psi |
1063 | blacklist ${HOME}/.cache/qBittorrent | 1095 | blacklist ${HOME}/.cache/qBittorrent |
1096 | blacklist ${HOME}/.cache/quodlibet | ||
1064 | blacklist ${HOME}/.cache/qupzilla | 1097 | blacklist ${HOME}/.cache/qupzilla |
1065 | blacklist ${HOME}/.cache/qutebrowser | 1098 | blacklist ${HOME}/.cache/qutebrowser |
1099 | blacklist ${HOME}/.cache/rednotebook | ||
1066 | blacklist ${HOME}/.cache/rhythmbox | 1100 | blacklist ${HOME}/.cache/rhythmbox |
1067 | blacklist ${HOME}/.cache/shotwell | 1101 | blacklist ${HOME}/.cache/shotwell |
1068 | blacklist ${HOME}/.cache/simple-scan | 1102 | blacklist ${HOME}/.cache/simple-scan |
@@ -1070,8 +1104,8 @@ blacklist ${HOME}/.cache/slimjet | |||
1070 | blacklist ${HOME}/.cache/smuxi | 1104 | blacklist ${HOME}/.cache/smuxi |
1071 | blacklist ${HOME}/.cache/snox | 1105 | blacklist ${HOME}/.cache/snox |
1072 | blacklist ${HOME}/.cache/spotify | 1106 | blacklist ${HOME}/.cache/spotify |
1073 | blacklist ${HOME}/.cache/strawberry | ||
1074 | blacklist ${HOME}/.cache/straw-viewer | 1107 | blacklist ${HOME}/.cache/straw-viewer |
1108 | blacklist ${HOME}/.cache/strawberry | ||
1075 | blacklist ${HOME}/.cache/supertuxkart | 1109 | blacklist ${HOME}/.cache/supertuxkart |
1076 | blacklist ${HOME}/.cache/systemsettings | 1110 | blacklist ${HOME}/.cache/systemsettings |
1077 | blacklist ${HOME}/.cache/telepathy | 1111 | blacklist ${HOME}/.cache/telepathy |
@@ -1088,8 +1122,11 @@ blacklist ${HOME}/.cache/waterfox | |||
1088 | blacklist ${HOME}/.cache/wesnoth | 1122 | blacklist ${HOME}/.cache/wesnoth |
1089 | blacklist ${HOME}/.cache/winetricks | 1123 | blacklist ${HOME}/.cache/winetricks |
1090 | blacklist ${HOME}/.cache/xmms2 | 1124 | blacklist ${HOME}/.cache/xmms2 |
1125 | blacklist ${HOME}/.cache/xournalpp | ||
1091 | blacklist ${HOME}/.cache/xreader | 1126 | blacklist ${HOME}/.cache/xreader |
1092 | blacklist ${HOME}/.cache/yandex-browser | 1127 | blacklist ${HOME}/.cache/yandex-browser |
1093 | blacklist ${HOME}/.cache/yandex-browser-beta | 1128 | blacklist ${HOME}/.cache/yandex-browser-beta |
1094 | blacklist ${HOME}/.cache/youtube-dl | 1129 | blacklist ${HOME}/.cache/youtube-dl |
1095 | blacklist ${HOME}/.cache/youtube-viewer | 1130 | blacklist ${HOME}/.cache/youtube-viewer |
1131 | blacklist ${HOME}/.cache/yt-dlp | ||
1132 | blacklist ${HOME}/.cache/zim | ||
diff --git a/etc/inc/whitelist-common.inc b/etc/inc/whitelist-common.inc index 1d3728521..fedfb2bc2 100644 --- a/etc/inc/whitelist-common.inc +++ b/etc/inc/whitelist-common.inc | |||
@@ -23,6 +23,7 @@ read-only ${HOME}/.local/share/applications | |||
23 | whitelist ${HOME}/.local/share/icons | 23 | whitelist ${HOME}/.local/share/icons |
24 | whitelist ${HOME}/.local/share/mime | 24 | whitelist ${HOME}/.local/share/mime |
25 | whitelist ${HOME}/.mime.types | 25 | whitelist ${HOME}/.mime.types |
26 | whitelist ${HOME}/.sndio/cookie | ||
26 | whitelist ${HOME}/.uim.d | 27 | whitelist ${HOME}/.uim.d |
27 | 28 | ||
28 | # dconf | 29 | # dconf |
diff --git a/etc/inc/whitelist-run-common.inc b/etc/inc/whitelist-run-common.inc new file mode 100644 index 000000000..224d21064 --- /dev/null +++ b/etc/inc/whitelist-run-common.inc | |||
@@ -0,0 +1,11 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include whitelist-run-common.local | ||
4 | |||
5 | whitelist /run/NetworkManager/resolv.conf | ||
6 | whitelist /run/cups/cups.sock | ||
7 | whitelist /run/dbus/system_bus_socket | ||
8 | whitelist /run/media | ||
9 | whitelist /run/resolvconf/resolv.conf | ||
10 | whitelist /run/systemd/resolve/resolv.conf | ||
11 | whitelist /run/systemd/resolve/stub-resolv.conf | ||
diff --git a/etc/inc/whitelist-runuser-common.inc b/etc/inc/whitelist-runuser-common.inc index 48309ffe3..a8cab8d07 100644 --- a/etc/inc/whitelist-runuser-common.inc +++ b/etc/inc/whitelist-runuser-common.inc | |||
@@ -10,7 +10,7 @@ whitelist ${RUNUSER}/gdm/Xauthority | |||
10 | whitelist ${RUNUSER}/ICEauthority | 10 | whitelist ${RUNUSER}/ICEauthority |
11 | whitelist ${RUNUSER}/.mutter-Xwaylandauth.* | 11 | whitelist ${RUNUSER}/.mutter-Xwaylandauth.* |
12 | whitelist ${RUNUSER}/pulse/native | 12 | whitelist ${RUNUSER}/pulse/native |
13 | whitelist ${RUNUSER}/wayland-0 | 13 | whitelist ${RUNUSER}/pipewire-? |
14 | whitelist ${RUNUSER}/wayland-1 | 14 | whitelist ${RUNUSER}/wayland-? |
15 | whitelist ${RUNUSER}/xauth_* | 15 | whitelist ${RUNUSER}/xauth_* |
16 | whitelist ${RUNUSER}/[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]] | 16 | whitelist ${RUNUSER}/[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]] |
diff --git a/etc/inc/whitelist-usr-share-common.inc b/etc/inc/whitelist-usr-share-common.inc index fe0097934..0049ce804 100644 --- a/etc/inc/whitelist-usr-share-common.inc +++ b/etc/inc/whitelist-usr-share-common.inc | |||
@@ -45,6 +45,7 @@ whitelist /usr/share/myspell | |||
45 | whitelist /usr/share/p11-kit | 45 | whitelist /usr/share/p11-kit |
46 | whitelist /usr/share/perl | 46 | whitelist /usr/share/perl |
47 | whitelist /usr/share/perl5 | 47 | whitelist /usr/share/perl5 |
48 | whitelist /usr/share/pipewire | ||
48 | whitelist /usr/share/pixmaps | 49 | whitelist /usr/share/pixmaps |
49 | whitelist /usr/share/pki | 50 | whitelist /usr/share/pki |
50 | whitelist /usr/share/plasma | 51 | whitelist /usr/share/plasma |
diff --git a/etc/profile-a-l/0ad.profile b/etc/profile-a-l/0ad.profile index 4009853d3..ddc7ecad5 100644 --- a/etc/profile-a-l/0ad.profile +++ b/etc/profile-a-l/0ad.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-a-l/2048-qt.profile b/etc/profile-a-l/2048-qt.profile index 1d787cba7..80b032aee 100644 --- a/etc/profile-a-l/2048-qt.profile +++ b/etc/profile-a-l/2048-qt.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.config/2048-qt | 18 | mkdir ${HOME}/.config/2048-qt |
diff --git a/etc/profile-a-l/Cryptocat.profile b/etc/profile-a-l/Cryptocat.profile index 1d86b0fbf..39b39667c 100644 --- a/etc/profile-a-l/Cryptocat.profile +++ b/etc/profile-a-l/Cryptocat.profile | |||
@@ -10,7 +10,6 @@ noblacklist ${HOME}/.config/Cryptocat | |||
10 | include disable-common.inc | 10 | include disable-common.inc |
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | 14 | ||
16 | caps.drop all | 15 | caps.drop all |
diff --git a/etc/profile-a-l/Fritzing.profile b/etc/profile-a-l/Fritzing.profile index 7dc6b5ff0..3fe2ddcd5 100644 --- a/etc/profile-a-l/Fritzing.profile +++ b/etc/profile-a-l/Fritzing.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-a-l/JDownloader.profile b/etc/profile-a-l/JDownloader.profile index d10b70796..92f8e5c85 100644 --- a/etc/profile-a-l/JDownloader.profile +++ b/etc/profile-a-l/JDownloader.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-a-l/abiword.profile b/etc/profile-a-l/abiword.profile index 75da9a956..256e2115a 100644 --- a/etc/profile-a-l/abiword.profile +++ b/etc/profile-a-l/abiword.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
@@ -43,7 +42,7 @@ tracelog | |||
43 | private-bin abiword | 42 | private-bin abiword |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc fonts,gtk-3.0,passwd | 45 | private-etc fonts,gtk-3.0,ld.so.preload,passwd |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | # dbus-user none | 48 | # dbus-user none |
diff --git a/etc/profile-a-l/agetpkg.profile b/etc/profile-a-l/agetpkg.profile index 34f59769e..8652ae5f1 100644 --- a/etc/profile-a-l/agetpkg.profile +++ b/etc/profile-a-l/agetpkg.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
@@ -51,7 +50,7 @@ tracelog | |||
51 | private-bin agetpkg,python3 | 50 | private-bin agetpkg,python3 |
52 | private-cache | 51 | private-cache |
53 | private-dev | 52 | private-dev |
54 | private-etc ca-certificates,crypto-policies,pki,resolv.conf,ssl | 53 | private-etc ca-certificates,crypto-policies,ld.so.preload,pki,resolv.conf,ssl |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
57 | dbus-user none | 56 | dbus-user none |
diff --git a/etc/profile-a-l/akonadi_control.profile b/etc/profile-a-l/akonadi_control.profile index 37fdb38b5..168e81985 100644 --- a/etc/profile-a-l/akonadi_control.profile +++ b/etc/profile-a-l/akonadi_control.profile | |||
@@ -25,7 +25,6 @@ include disable-common.inc | |||
25 | include disable-devel.inc | 25 | include disable-devel.inc |
26 | include disable-exec.inc | 26 | include disable-exec.inc |
27 | include disable-interpreters.inc | 27 | include disable-interpreters.inc |
28 | include disable-passwdmgr.inc | ||
29 | include disable-programs.inc | 28 | include disable-programs.inc |
30 | 29 | ||
31 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/akregator.profile b/etc/profile-a-l/akregator.profile index 38fcd2dc1..d1e7df37b 100644 --- a/etc/profile-a-l/akregator.profile +++ b/etc/profile-a-l/akregator.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | 19 | ||
diff --git a/etc/profile-a-l/alacarte.profile b/etc/profile-a-l/alacarte.profile index 4c6d68020..9b74b4d29 100644 --- a/etc/profile-a-l/alacarte.profile +++ b/etc/profile-a-l/alacarte.profile | |||
@@ -15,7 +15,6 @@ include disable-devel.inc | |||
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
21 | # Whitelist your system icon directory,varies by distro | 20 | # Whitelist your system icon directory,varies by distro |
@@ -54,7 +53,7 @@ disable-mnt | |||
54 | # private-bin alacarte,bash,python*,sh | 53 | # private-bin alacarte,bash,python*,sh |
55 | private-cache | 54 | private-cache |
56 | private-dev | 55 | private-dev |
57 | private-etc alternatives,dconf,fonts,gtk-3.0,locale.alias,locale.conf,login.defs,mime.types,nsswitch.conf,passwd,pki,X11,xdg | 56 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload,locale.alias,locale.conf,login.defs,mime.types,nsswitch.conf,passwd,pki,X11,xdg |
58 | private-tmp | 57 | private-tmp |
59 | 58 | ||
60 | dbus-user none | 59 | dbus-user none |
diff --git a/etc/profile-a-l/alienarena.profile b/etc/profile-a-l/alienarena.profile index 81ee6bd46..62857a3e2 100644 --- a/etc/profile-a-l/alienarena.profile +++ b/etc/profile-a-l/alienarena.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/alpine.profile b/etc/profile-a-l/alpine.profile index 0b5cf0df0..61c3ad21d 100644 --- a/etc/profile-a-l/alpine.profile +++ b/etc/profile-a-l/alpine.profile | |||
@@ -37,7 +37,6 @@ include disable-common.inc | |||
37 | include disable-devel.inc | 37 | include disable-devel.inc |
38 | include disable-exec.inc | 38 | include disable-exec.inc |
39 | include disable-interpreters.inc | 39 | include disable-interpreters.inc |
40 | include disable-passwdmgr.inc | ||
41 | include disable-programs.inc | 40 | include disable-programs.inc |
42 | include disable-shell.inc | 41 | include disable-shell.inc |
43 | include disable-xdg.inc | 42 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/amarok.profile b/etc/profile-a-l/amarok.profile index a7caddc4c..e7b78f7d0 100644 --- a/etc/profile-a-l/amarok.profile +++ b/etc/profile-a-l/amarok.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${MUSIC} | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
17 | 16 | ||
diff --git a/etc/profile-a-l/amule.profile b/etc/profile-a-l/amule.profile index f6e399e9f..e82c145d1 100644 --- a/etc/profile-a-l/amule.profile +++ b/etc/profile-a-l/amule.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/.aMule | 17 | mkdir ${HOME}/.aMule |
diff --git a/etc/profile-a-l/android-studio.profile b/etc/profile-a-l/android-studio.profile index 5a21744cf..ad44d5f1d 100644 --- a/etc/profile-a-l/android-studio.profile +++ b/etc/profile-a-l/android-studio.profile | |||
@@ -20,7 +20,6 @@ include allow-common-devel.inc | |||
20 | include allow-ssh.inc | 20 | include allow-ssh.inc |
21 | 21 | ||
22 | include disable-common.inc | 22 | include disable-common.inc |
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | 23 | include disable-programs.inc |
25 | 24 | ||
26 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/anki.profile b/etc/profile-a-l/anki.profile index ef60e91c2..b6e931be5 100644 --- a/etc/profile-a-l/anki.profile +++ b/etc/profile-a-l/anki.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
@@ -46,13 +45,12 @@ protocol unix,inet,inet6 | |||
46 | # QtWebengine needs chroot to set up its own sandbox | 45 | # QtWebengine needs chroot to set up its own sandbox |
47 | seccomp !chroot | 46 | seccomp !chroot |
48 | shell none | 47 | shell none |
49 | tracelog | ||
50 | 48 | ||
51 | disable-mnt | 49 | disable-mnt |
52 | private-bin anki,python* | 50 | private-bin anki,python* |
53 | private-cache | 51 | private-cache |
54 | private-dev | 52 | private-dev |
55 | private-etc alternatives,ca-certificates,fonts,gtk-2.0,hostname,hosts,machine-id,pki,resolv.conf,ssl,Trolltech.conf | 53 | private-etc alternatives,ca-certificates,fonts,gtk-2.0,hostname,hosts,ld.so.preload,machine-id,pki,resolv.conf,ssl,Trolltech.conf |
56 | private-tmp | 54 | private-tmp |
57 | 55 | ||
58 | dbus-user none | 56 | dbus-user none |
diff --git a/etc/profile-a-l/anydesk.profile b/etc/profile-a-l/anydesk.profile index fdaf10259..5001b20cb 100644 --- a/etc/profile-a-l/anydesk.profile +++ b/etc/profile-a-l/anydesk.profile | |||
@@ -10,7 +10,6 @@ noblacklist ${HOME}/.anydesk | |||
10 | include disable-common.inc | 10 | include disable-common.inc |
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | 15 | ||
diff --git a/etc/profile-a-l/aosp.profile b/etc/profile-a-l/aosp.profile index e7b09283e..9668ba00a 100644 --- a/etc/profile-a-l/aosp.profile +++ b/etc/profile-a-l/aosp.profile | |||
@@ -20,7 +20,6 @@ include allow-common-devel.inc | |||
20 | include allow-ssh.inc | 20 | include allow-ssh.inc |
21 | 21 | ||
22 | include disable-common.inc | 22 | include disable-common.inc |
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | 23 | include disable-programs.inc |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
26 | 25 | ||
diff --git a/etc/profile-a-l/apktool.profile b/etc/profile-a-l/apktool.profile index 4ea43c434..1951748d4 100644 --- a/etc/profile-a-l/apktool.profile +++ b/etc/profile-a-l/apktool.profile | |||
@@ -9,7 +9,6 @@ include globals.local | |||
9 | 9 | ||
10 | include disable-common.inc | 10 | include disable-common.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-passwdmgr.inc | ||
13 | include disable-programs.inc | 12 | include disable-programs.inc |
14 | include disable-xdg.inc | 13 | include disable-xdg.inc |
15 | 14 | ||
diff --git a/etc/profile-a-l/apostrophe.profile b/etc/profile-a-l/apostrophe.profile index 01566314f..5d45a0804 100644 --- a/etc/profile-a-l/apostrophe.profile +++ b/etc/profile-a-l/apostrophe.profile | |||
@@ -26,7 +26,6 @@ include disable-common.inc | |||
26 | include disable-devel.inc | 26 | include disable-devel.inc |
27 | include disable-exec.inc | 27 | include disable-exec.inc |
28 | include disable-interpreters.inc | 28 | include disable-interpreters.inc |
29 | include disable-passwdmgr.inc | ||
30 | include disable-programs.inc | 29 | include disable-programs.inc |
31 | include disable-shell.inc | 30 | include disable-shell.inc |
32 | include disable-xdg.inc | 31 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/arch-audit.profile b/etc/profile-a-l/arch-audit.profile index accabb6f5..c164073c5 100644 --- a/etc/profile-a-l/arch-audit.profile +++ b/etc/profile-a-l/arch-audit.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/archaudit-report.profile b/etc/profile-a-l/archaudit-report.profile index 19c37f90e..3aebd685d 100644 --- a/etc/profile-a-l/archaudit-report.profile +++ b/etc/profile-a-l/archaudit-report.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-a-l/archiver-common.profile b/etc/profile-a-l/archiver-common.profile index 1fab4606b..81733220f 100644 --- a/etc/profile-a-l/archiver-common.profile +++ b/etc/profile-a-l/archiver-common.profile | |||
@@ -17,7 +17,6 @@ blacklist ${RUNUSER} | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | # Add the next line to your archiver-common.local if you don't need to compress files in disable-programs.inc. | 20 | # Add the next line to your archiver-common.local if you don't need to compress files in disable-programs.inc. |
22 | #include disable-programs.inc | 21 | #include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
diff --git a/etc/profile-a-l/ardour5.profile b/etc/profile-a-l/ardour5.profile index 84b1d6c18..78dea1cd0 100644 --- a/etc/profile-a-l/ardour5.profile +++ b/etc/profile-a-l/ardour5.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-a-l/arduino.profile b/etc/profile-a-l/arduino.profile index fd1ca9a09..01da63e8e 100644 --- a/etc/profile-a-l/arduino.profile +++ b/etc/profile-a-l/arduino.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-a-l/aria2c.profile b/etc/profile-a-l/aria2c.profile index 22b8ecd65..e96def048 100644 --- a/etc/profile-a-l/aria2c.profile +++ b/etc/profile-a-l/aria2c.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | 21 | ||
23 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
@@ -46,7 +45,7 @@ private-bin aria2c,gzip | |||
46 | # Add 'private-cache' to your aria2c.local if you don't use Lutris/winetricks (see issue #2772). | 45 | # Add 'private-cache' to your aria2c.local if you don't use Lutris/winetricks (see issue #2772). |
47 | #private-cache | 46 | #private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,ca-certificates,crypto-policies,groups,login.defs,machine-id,nsswitch.conf,passwd,pki,resolv.conf,ssl | 48 | private-etc alternatives,ca-certificates,crypto-policies,groups,ld.so.preload,login.defs,machine-id,nsswitch.conf,passwd,pki,resolv.conf,ssl |
50 | private-lib libreadline.so.* | 49 | private-lib libreadline.so.* |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
diff --git a/etc/profile-a-l/ark.profile b/etc/profile-a-l/ark.profile index a63dd8f5f..45071dc62 100644 --- a/etc/profile-a-l/ark.profile +++ b/etc/profile-a-l/ark.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | whitelist /usr/share/ark | 18 | whitelist /usr/share/ark |
diff --git a/etc/profile-a-l/arm.profile b/etc/profile-a-l/arm.profile index 2c8b630ce..98ae01950 100644 --- a/etc/profile-a-l/arm.profile +++ b/etc/profile-a-l/arm.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | mkdir ${HOME}/.arm | 21 | mkdir ${HOME}/.arm |
@@ -44,6 +43,6 @@ tracelog | |||
44 | disable-mnt | 43 | disable-mnt |
45 | private-bin arm,bash,ldconfig,lsof,ps,python*,sh,tor | 44 | private-bin arm,bash,ldconfig,lsof,ps,python*,sh,tor |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,ca-certificates,crypto-policies,passwd,pki,ssl,tor | 46 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,passwd,pki,ssl,tor |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
diff --git a/etc/profile-a-l/artha.profile b/etc/profile-a-l/artha.profile index fab72b7d3..adf4e16ee 100644 --- a/etc/profile-a-l/artha.profile +++ b/etc/profile-a-l/artha.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
@@ -57,7 +56,7 @@ disable-mnt | |||
57 | private-bin artha,enchant,notify-send | 56 | private-bin artha,enchant,notify-send |
58 | private-cache | 57 | private-cache |
59 | private-dev | 58 | private-dev |
60 | private-etc alternatives,fonts,machine-id | 59 | private-etc alternatives,fonts,ld.so.preload,machine-id |
61 | private-lib libnotify.so.* | 60 | private-lib libnotify.so.* |
62 | private-tmp | 61 | private-tmp |
63 | 62 | ||
diff --git a/etc/profile-a-l/assogiate.profile b/etc/profile-a-l/assogiate.profile index 977fe30a4..788a94302 100644 --- a/etc/profile-a-l/assogiate.profile +++ b/etc/profile-a-l/assogiate.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/asunder.profile b/etc/profile-a-l/asunder.profile index c97fd691a..fbc65ffc7 100644 --- a/etc/profile-a-l/asunder.profile +++ b/etc/profile-a-l/asunder.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-a-l/atool.profile b/etc/profile-a-l/atool.profile index e377de2c8..272f9906d 100644 --- a/etc/profile-a-l/atool.profile +++ b/etc/profile-a-l/atool.profile | |||
@@ -13,7 +13,7 @@ include allow-perl.inc | |||
13 | noroot | 13 | noroot |
14 | 14 | ||
15 | # without login.defs atool complains and uses UID/GID 1000 by default | 15 | # without login.defs atool complains and uses UID/GID 1000 by default |
16 | private-etc alternatives,group,login.defs,passwd | 16 | private-etc alternatives,group,ld.so.preload,login.defs,passwd |
17 | private-tmp | 17 | private-tmp |
18 | 18 | ||
19 | # Redirect | 19 | # Redirect |
diff --git a/etc/profile-a-l/atril.profile b/etc/profile-a-l/atril.profile index 1c3ed66ff..264bc0215 100644 --- a/etc/profile-a-l/atril.profile +++ b/etc/profile-a-l/atril.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
@@ -43,7 +42,7 @@ tracelog | |||
43 | 42 | ||
44 | private-bin 7z,7za,7zr,atril,atril-previewer,atril-thumbnailer,sh,tar,unrar,unzip,zipnote | 43 | private-bin 7z,7za,7zr,atril,atril-previewer,atril-thumbnailer,sh,tar,unrar,unzip,zipnote |
45 | private-dev | 44 | private-dev |
46 | private-etc alternatives,fonts,ld.so.cache | 45 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
47 | # atril uses webkit gtk to display epub files | 46 | # atril uses webkit gtk to display epub files |
48 | # waiting for globbing support in private-lib; for now hardcoding it to webkit2gtk-4.0 | 47 | # waiting for globbing support in private-lib; for now hardcoding it to webkit2gtk-4.0 |
49 | #private-lib webkit2gtk-4.0 - problems on Arch with the new version of WebKit | 48 | #private-lib webkit2gtk-4.0 - problems on Arch with the new version of WebKit |
diff --git a/etc/profile-a-l/audacious.profile b/etc/profile-a-l/audacious.profile index f9f209786..d71370b7e 100644 --- a/etc/profile-a-l/audacious.profile +++ b/etc/profile-a-l/audacious.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-a-l/audacity.profile b/etc/profile-a-l/audacity.profile index a2de8436a..264bfb9ab 100644 --- a/etc/profile-a-l/audacity.profile +++ b/etc/profile-a-l/audacity.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/audio-recorder.profile b/etc/profile-a-l/audio-recorder.profile index 2c7fdc812..58b2efde6 100644 --- a/etc/profile-a-l/audio-recorder.profile +++ b/etc/profile-a-l/audio-recorder.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-a-l/authenticator-rs.profile b/etc/profile-a-l/authenticator-rs.profile index 2ebe35dd5..8fefc1eb7 100644 --- a/etc/profile-a-l/authenticator-rs.profile +++ b/etc/profile-a-l/authenticator-rs.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -48,7 +47,7 @@ disable-mnt | |||
48 | private-bin authenticator-rs | 47 | private-bin authenticator-rs |
49 | private-cache | 48 | private-cache |
50 | private-dev | 49 | private-dev |
51 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,pki,resolv.conf,ssl,xdg | 50 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.preload,pki,resolv.conf,ssl,xdg |
52 | private-tmp | 51 | private-tmp |
53 | 52 | ||
54 | dbus-user filter | 53 | dbus-user filter |
diff --git a/etc/profile-a-l/authenticator.profile b/etc/profile-a-l/authenticator.profile index 42d9cd56a..f9a03ca68 100644 --- a/etc/profile-a-l/authenticator.profile +++ b/etc/profile-a-l/authenticator.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | 21 | ||
23 | # apparmor | 22 | # apparmor |
@@ -40,7 +39,7 @@ shell none | |||
40 | disable-mnt | 39 | disable-mnt |
41 | # private-bin authenticator,python* | 40 | # private-bin authenticator,python* |
42 | private-dev | 41 | private-dev |
43 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,pki,resolv.conf,ssl | 42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl |
44 | private-tmp | 43 | private-tmp |
45 | 44 | ||
46 | # makes settings immutable | 45 | # makes settings immutable |
diff --git a/etc/profile-a-l/autokey-common.profile b/etc/profile-a-l/autokey-common.profile index 891928e5a..abd535afe 100644 --- a/etc/profile-a-l/autokey-common.profile +++ b/etc/profile-a-l/autokey-common.profile | |||
@@ -19,7 +19,6 @@ include disable-devel.inc | |||
19 | # disable-exec.inc might break scripting functionality | 19 | # disable-exec.inc might break scripting functionality |
20 | #include disable-exec.inc | 20 | #include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
25 | 24 | ||
diff --git a/etc/profile-a-l/avidemux.profile b/etc/profile-a-l/avidemux.profile index 1ecc03da1..468a3fe9f 100644 --- a/etc/profile-a-l/avidemux.profile +++ b/etc/profile-a-l/avidemux.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -23,6 +22,7 @@ mkdir ${HOME}/.config/avidemux3_qt5rc | |||
23 | whitelist ${HOME}/.avidemux6 | 22 | whitelist ${HOME}/.avidemux6 |
24 | whitelist ${HOME}/.config/avidemux3_qt5rc | 23 | whitelist ${HOME}/.config/avidemux3_qt5rc |
25 | whitelist ${VIDEOS} | 24 | whitelist ${VIDEOS} |
25 | |||
26 | include whitelist-common.inc | 26 | include whitelist-common.inc |
27 | include whitelist-runuser-common.inc | 27 | include whitelist-runuser-common.inc |
28 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-a-l/aweather.profile b/etc/profile-a-l/aweather.profile index a57ad4014..e01ea5b5d 100644 --- a/etc/profile-a-l/aweather.profile +++ b/etc/profile-a-l/aweather.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${HOME}/.config/aweather | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | 16 | ||
diff --git a/etc/profile-a-l/ballbuster.profile b/etc/profile-a-l/ballbuster.profile index 3952921a3..daa13a7ed 100644 --- a/etc/profile-a-l/ballbuster.profile +++ b/etc/profile-a-l/ballbuster.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/baloo_file.profile b/etc/profile-a-l/baloo_file.profile index fe86d9b80..252016bec 100644 --- a/etc/profile-a-l/baloo_file.profile +++ b/etc/profile-a-l/baloo_file.profile | |||
@@ -23,7 +23,6 @@ include disable-common.inc | |||
23 | include disable-devel.inc | 23 | include disable-devel.inc |
24 | include disable-exec.inc | 24 | include disable-exec.inc |
25 | include disable-interpreters.inc | 25 | include disable-interpreters.inc |
26 | include disable-passwdmgr.inc | ||
27 | include disable-programs.inc | 26 | include disable-programs.inc |
28 | 27 | ||
29 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/balsa.profile b/etc/profile-a-l/balsa.profile index 8c69652c5..2080aad62 100644 --- a/etc/profile-a-l/balsa.profile +++ b/etc/profile-a-l/balsa.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
@@ -67,7 +66,7 @@ tracelog | |||
67 | private-bin balsa,balsa-ab,gpg,gpg-agent,gpg2,gpgsm | 66 | private-bin balsa,balsa-ab,gpg,gpg-agent,gpg2,gpgsm |
68 | private-cache | 67 | private-cache |
69 | private-dev | 68 | private-dev |
70 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,mailname,passwd,pki,resolv.conf,selinux,ssl,xdg | 69 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.preload,mailname,passwd,pki,resolv.conf,selinux,ssl,xdg |
71 | private-tmp | 70 | private-tmp |
72 | writable-run-user | 71 | writable-run-user |
73 | writable-var | 72 | writable-var |
@@ -80,4 +79,4 @@ dbus-user.talk org.freedesktop.secrets | |||
80 | dbus-user.talk org.gnome.keyring.SystemPrompter | 79 | dbus-user.talk org.gnome.keyring.SystemPrompter |
81 | dbus-system none | 80 | dbus-system none |
82 | 81 | ||
83 | read-only ${HOME}/.mozilla/firefox/profiles.ini \ No newline at end of file | 82 | read-only ${HOME}/.mozilla/firefox/profiles.ini |
diff --git a/etc/profile-a-l/baobab.profile b/etc/profile-a-l/baobab.profile index ac03c663a..c8dbcad4e 100644 --- a/etc/profile-a-l/baobab.profile +++ b/etc/profile-a-l/baobab.profile | |||
@@ -10,7 +10,6 @@ include globals.local | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | # include disable-programs.inc | 13 | # include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | # include disable-xdg.inc | 15 | # include disable-xdg.inc |
diff --git a/etc/profile-a-l/barrier.profile b/etc/profile-a-l/barrier.profile index 7b50e9199..f6775ee01 100644 --- a/etc/profile-a-l/barrier.profile +++ b/etc/profile-a-l/barrier.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-a-l/bcompare.profile b/etc/profile-a-l/bcompare.profile index 3ecaea7fe..87bcf9a19 100644 --- a/etc/profile-a-l/bcompare.profile +++ b/etc/profile-a-l/bcompare.profile | |||
@@ -17,7 +17,6 @@ noblacklist ${HOME}/.config/gwenviewrc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | # Add the next line to your bcompare.local if you don't need to compare files in disable-programs.inc. | 20 | # Add the next line to your bcompare.local if you don't need to compare files in disable-programs.inc. |
22 | #include disable-programs.inc | 21 | #include disable-programs.inc |
23 | #include disable-shell.inc - breaks launch | 22 | #include disable-shell.inc - breaks launch |
diff --git a/etc/profile-a-l/bibletime.profile b/etc/profile-a-l/bibletime.profile index c7a82afbd..24db11c7e 100644 --- a/etc/profile-a-l/bibletime.profile +++ b/etc/profile-a-l/bibletime.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | mkdir ${HOME}/.bibletime | 21 | mkdir ${HOME}/.bibletime |
@@ -53,7 +52,7 @@ disable-mnt | |||
53 | # private-bin bibletime,qt5ct | 52 | # private-bin bibletime,qt5ct |
54 | private-cache | 53 | private-cache |
55 | private-dev | 54 | private-dev |
56 | private-etc alternatives,ca-certificates,crypto-policies,fonts,login.defs,machine-id,passwd,pki,resolv.conf,ssl,sword,sword.conf | 55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,login.defs,machine-id,passwd,pki,resolv.conf,ssl,sword,sword.conf |
57 | private-tmp | 56 | private-tmp |
58 | 57 | ||
59 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-a-l/bijiben.profile b/etc/profile-a-l/bijiben.profile index 854fe5cb9..61cd792b1 100644 --- a/etc/profile-a-l/bijiben.profile +++ b/etc/profile-a-l/bijiben.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/bitcoin-qt.profile b/etc/profile-a-l/bitcoin-qt.profile index 932db9b73..ef6ef7a75 100644 --- a/etc/profile-a-l/bitcoin-qt.profile +++ b/etc/profile-a-l/bitcoin-qt.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | 18 | ||
diff --git a/etc/profile-a-l/bitlbee.profile b/etc/profile-a-l/bitlbee.profile index dd7651979..773fa7500 100644 --- a/etc/profile-a-l/bitlbee.profile +++ b/etc/profile-a-l/bitlbee.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-a-l/bitwarden.profile b/etc/profile-a-l/bitwarden.profile index bef25276d..91ce57966 100644 --- a/etc/profile-a-l/bitwarden.profile +++ b/etc/profile-a-l/bitwarden.profile | |||
@@ -6,54 +6,25 @@ include bitwarden.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Disabled until someone reported positive feedback | ||
10 | ignore include whitelist-usr-share-common.inc | ||
11 | |||
9 | ignore noexec /tmp | 12 | ignore noexec /tmp |
10 | 13 | ||
11 | noblacklist ${HOME}/.config/Bitwarden | 14 | noblacklist ${HOME}/.config/Bitwarden |
12 | 15 | ||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | 16 | include disable-shell.inc |
20 | include disable-xdg.inc | ||
21 | 17 | ||
22 | mkdir ${HOME}/.config/Bitwarden | 18 | mkdir ${HOME}/.config/Bitwarden |
23 | whitelist ${HOME}/.config/Bitwarden | 19 | whitelist ${HOME}/.config/Bitwarden |
24 | whitelist ${DOWNLOADS} | ||
25 | include whitelist-common.inc | ||
26 | include whitelist-var-common.inc | ||
27 | 20 | ||
28 | apparmor | ||
29 | caps.drop all | ||
30 | machine-id | 21 | machine-id |
31 | netfilter | ||
32 | no3d | 22 | no3d |
33 | nodvd | ||
34 | nogroups | ||
35 | noinput | ||
36 | nonewprivs | ||
37 | noroot | ||
38 | nosound | 23 | nosound |
39 | notv | 24 | |
40 | nou2f | ||
41 | novideo | ||
42 | protocol unix,inet,inet6,netlink | ||
43 | seccomp !chroot | ||
44 | shell none | ||
45 | #tracelog - breaks on Arch | ||
46 | |||
47 | private-bin bitwarden | ||
48 | private-cache | ||
49 | ?HAS_APPIMAGE: ignore private-dev | 25 | ?HAS_APPIMAGE: ignore private-dev |
50 | private-dev | 26 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hosts,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
51 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hosts,nsswitch.conf,pki,resolv.conf,ssl | ||
52 | private-opt Bitwarden | 27 | private-opt Bitwarden |
53 | private-tmp | ||
54 | |||
55 | # breaks appindicator (tray) functionality | ||
56 | # dbus-user none | ||
57 | # dbus-system none | ||
58 | 28 | ||
59 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 29 | # Redirect |
30 | include electron.profile | ||
diff --git a/etc/profile-a-l/bleachbit.profile b/etc/profile-a-l/bleachbit.profile index 09fa24577..28ce8fbea 100644 --- a/etc/profile-a-l/bleachbit.profile +++ b/etc/profile-a-l/bleachbit.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | # include disable-programs.inc | 17 | # include disable-programs.inc |
19 | 18 | ||
20 | caps.drop all | 19 | caps.drop all |
diff --git a/etc/profile-a-l/blender.profile b/etc/profile-a-l/blender.profile index 701ae431e..225fd7cdc 100644 --- a/etc/profile-a-l/blender.profile +++ b/etc/profile-a-l/blender.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | # Allow usage of AMD GPU by OpenCL | 21 | # Allow usage of AMD GPU by OpenCL |
diff --git a/etc/profile-a-l/bless.profile b/etc/profile-a-l/bless.profile index 80dc750f7..8d8787174 100644 --- a/etc/profile-a-l/bless.profile +++ b/etc/profile-a-l/bless.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | include whitelist-var-common.inc | 17 | include whitelist-var-common.inc |
@@ -36,7 +35,7 @@ shell none | |||
36 | # private-bin bash,bless,mono,sh | 35 | # private-bin bash,bless,mono,sh |
37 | private-cache | 36 | private-cache |
38 | private-dev | 37 | private-dev |
39 | private-etc alternatives,fonts,mono | 38 | private-etc alternatives,fonts,ld.so.preload,mono |
40 | private-tmp | 39 | private-tmp |
41 | 40 | ||
42 | dbus-user none | 41 | dbus-user none |
diff --git a/etc/profile-a-l/blobby.profile b/etc/profile-a-l/blobby.profile index 229c20293..7179bf4a5 100644 --- a/etc/profile-a-l/blobby.profile +++ b/etc/profile-a-l/blobby.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -42,7 +41,7 @@ tracelog | |||
42 | disable-mnt | 41 | disable-mnt |
43 | private-bin blobby | 42 | private-bin blobby |
44 | private-dev | 43 | private-dev |
45 | private-etc alsa,alternatives,asound.conf,drirc,group,hosts,login.defs,machine-id,passwd,pulse | 44 | private-etc alsa,alternatives,asound.conf,drirc,group,hosts,ld.so.preload,login.defs,machine-id,passwd,pulse |
46 | private-lib | 45 | private-lib |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
diff --git a/etc/profile-a-l/blobwars.profile b/etc/profile-a-l/blobwars.profile index 904710cb5..683a7858b 100644 --- a/etc/profile-a-l/blobwars.profile +++ b/etc/profile-a-l/blobwars.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin blobwars | 43 | private-bin blobwars |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc machine-id | 46 | private-etc ld.so.preload,machine-id |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-a-l/bluefish.profile b/etc/profile-a-l/bluefish.profile index f28435987..bc5219e29 100644 --- a/etc/profile-a-l/bluefish.profile +++ b/etc/profile-a-l/bluefish.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | 14 | ||
16 | include whitelist-var-common.inc | 15 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/brackets.profile b/etc/profile-a-l/brackets.profile index 0cbac049a..94afc9e0b 100644 --- a/etc/profile-a-l/brackets.profile +++ b/etc/profile-a-l/brackets.profile | |||
@@ -13,7 +13,6 @@ noblacklist ${HOME}/.config/Brackets | |||
13 | include allow-common-devel.inc | 13 | include allow-common-devel.inc |
14 | 14 | ||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | caps.drop all | 18 | caps.drop all |
diff --git a/etc/profile-a-l/brasero.profile b/etc/profile-a-l/brasero.profile index 417a6b3e0..656701909 100644 --- a/etc/profile-a-l/brasero.profile +++ b/etc/profile-a-l/brasero.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | include whitelist-var-common.inc | 17 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/bsdtar.profile b/etc/profile-a-l/bsdtar.profile index d731a6a6e..dbfc90996 100644 --- a/etc/profile-a-l/bsdtar.profile +++ b/etc/profile-a-l/bsdtar.profile | |||
@@ -6,7 +6,7 @@ include bsdtar.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | private-etc alternatives,group,localtime,passwd | 9 | private-etc alternatives,group,ld.so.preload,localtime,passwd |
10 | 10 | ||
11 | # Redirect | 11 | # Redirect |
12 | include archiver-common.profile | 12 | include archiver-common.profile |
diff --git a/etc/profile-a-l/bzflag.profile b/etc/profile-a-l/bzflag.profile index bda96bbb3..53cfde352 100644 --- a/etc/profile-a-l/bzflag.profile +++ b/etc/profile-a-l/bzflag.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/calibre.profile b/etc/profile-a-l/calibre.profile index 83571397b..cdc168384 100644 --- a/etc/profile-a-l/calibre.profile +++ b/etc/profile-a-l/calibre.profile | |||
@@ -13,7 +13,6 @@ noblacklist ${DOCUMENTS} | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-a-l/calligra.profile b/etc/profile-a-l/calligra.profile index fcff47662..280a61401 100644 --- a/etc/profile-a-l/calligra.profile +++ b/etc/profile-a-l/calligra.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${HOME}/.local/share/kxmlgui5/calligra | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | caps.drop all | 16 | caps.drop all |
diff --git a/etc/profile-a-l/cameramonitor.profile b/etc/profile-a-l/cameramonitor.profile index 74c7cc34b..d3c25d451 100644 --- a/etc/profile-a-l/cameramonitor.profile +++ b/etc/profile-a-l/cameramonitor.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -47,7 +46,7 @@ tracelog | |||
47 | disable-mnt | 46 | disable-mnt |
48 | private-bin cameramonitor,python* | 47 | private-bin cameramonitor,python* |
49 | private-cache | 48 | private-cache |
50 | private-etc alternatives,fonts | 49 | private-etc alternatives,fonts,ld.so.preload |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
53 | # dbus-user none | 52 | # dbus-user none |
diff --git a/etc/profile-a-l/cantata.profile b/etc/profile-a-l/cantata.profile index 96f88a7c4..69cf912ef 100644 --- a/etc/profile-a-l/cantata.profile +++ b/etc/profile-a-l/cantata.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/cargo.profile b/etc/profile-a-l/cargo.profile index 7cf04c550..ff46cd429 100644 --- a/etc/profile-a-l/cargo.profile +++ b/etc/profile-a-l/cargo.profile | |||
@@ -25,7 +25,6 @@ include allow-common-devel.inc | |||
25 | include disable-common.inc | 25 | include disable-common.inc |
26 | include disable-exec.inc | 26 | include disable-exec.inc |
27 | include disable-interpreters.inc | 27 | include disable-interpreters.inc |
28 | include disable-passwdmgr.inc | ||
29 | include disable-programs.inc | 28 | include disable-programs.inc |
30 | include disable-xdg.inc | 29 | include disable-xdg.inc |
31 | 30 | ||
diff --git a/etc/profile-a-l/catfish.profile b/etc/profile-a-l/catfish.profile index 009d3a049..38a670fdc 100644 --- a/etc/profile-a-l/catfish.profile +++ b/etc/profile-a-l/catfish.profile | |||
@@ -18,7 +18,6 @@ include allow-python3.inc | |||
18 | # include disable-common.inc | 18 | # include disable-common.inc |
19 | # include disable-devel.inc | 19 | # include disable-devel.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | # include disable-programs.inc | 21 | # include disable-programs.inc |
23 | 22 | ||
24 | whitelist /var/lib/mlocate | 23 | whitelist /var/lib/mlocate |
diff --git a/etc/profile-a-l/cawbird.profile b/etc/profile-a-l/cawbird.profile index 6e137010c..ceba03269 100644 --- a/etc/profile-a-l/cawbird.profile +++ b/etc/profile-a-l/cawbird.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -40,7 +39,7 @@ disable-mnt | |||
40 | private-bin cawbird | 39 | private-bin cawbird |
41 | private-cache | 40 | private-cache |
42 | private-dev | 41 | private-dev |
43 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,resolv.conf,ssl,X11,xdg | 42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,pki,resolv.conf,ssl,X11,xdg |
44 | private-tmp | 43 | private-tmp |
45 | 44 | ||
46 | # dbus-user none | 45 | # dbus-user none |
diff --git a/etc/profile-a-l/celluloid.profile b/etc/profile-a-l/celluloid.profile index 1c539cc93..1a9340632 100644 --- a/etc/profile-a-l/celluloid.profile +++ b/etc/profile-a-l/celluloid.profile | |||
@@ -23,10 +23,8 @@ include disable-common.inc | |||
23 | include disable-devel.inc | 23 | include disable-devel.inc |
24 | include disable-exec.inc | 24 | include disable-exec.inc |
25 | include disable-interpreters.inc | 25 | include disable-interpreters.inc |
26 | include disable-passwdmgr.inc | ||
27 | include disable-programs.inc | 26 | include disable-programs.inc |
28 | 27 | ||
29 | read-only ${DESKTOP} | ||
30 | mkdir ${HOME}/.config/celluloid | 28 | mkdir ${HOME}/.config/celluloid |
31 | mkdir ${HOME}/.config/gnome-mpv | 29 | mkdir ${HOME}/.config/gnome-mpv |
32 | mkdir ${HOME}/.config/youtube-dl | 30 | mkdir ${HOME}/.config/youtube-dl |
@@ -55,12 +53,13 @@ tracelog | |||
55 | 53 | ||
56 | private-bin celluloid,env,gnome-mpv,python*,youtube-dl | 54 | private-bin celluloid,env,gnome-mpv,python*,youtube-dl |
57 | private-cache | 55 | private-cache |
58 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,ld.so.cache,libva.conf,localtime,machine-id,pkcs11,pki,resolv.conf,selinux,ssl,xdg | 56 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.preload,libva.conf,localtime,machine-id,pkcs11,pki,resolv.conf,selinux,ssl,xdg |
59 | private-dev | 57 | private-dev |
60 | private-tmp | 58 | private-tmp |
61 | 59 | ||
62 | dbus-user filter | 60 | dbus-user filter |
63 | dbus-user.own io.github.celluloid_player.Celluloid | 61 | dbus-user.own io.github.celluloid_player.Celluloid |
62 | dbus-user.talk ca.desrt.dconf | ||
64 | dbus-user.talk org.gnome.SettingsDaemon.MediaKeys | 63 | dbus-user.talk org.gnome.SettingsDaemon.MediaKeys |
65 | dbus-system none | 64 | dbus-system none |
66 | 65 | ||
diff --git a/etc/profile-a-l/checkbashisms.profile b/etc/profile-a-l/checkbashisms.profile index 24939fc70..e89f488ea 100644 --- a/etc/profile-a-l/checkbashisms.profile +++ b/etc/profile-a-l/checkbashisms.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
24 | 23 | ||
diff --git a/etc/profile-a-l/cheese.profile b/etc/profile-a-l/cheese.profile index aca1f5876..978d727f4 100644 --- a/etc/profile-a-l/cheese.profile +++ b/etc/profile-a-l/cheese.profile | |||
@@ -9,18 +9,24 @@ include globals.local | |||
9 | noblacklist ${VIDEOS} | 9 | noblacklist ${VIDEOS} |
10 | noblacklist ${PICTURES} | 10 | noblacklist ${PICTURES} |
11 | 11 | ||
12 | include allow-python3.inc | ||
13 | |||
12 | include disable-common.inc | 14 | include disable-common.inc |
13 | include disable-devel.inc | 15 | include disable-devel.inc |
14 | include disable-exec.inc | 16 | include disable-exec.inc |
15 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 20 | include disable-xdg.inc |
19 | 21 | ||
20 | whitelist ${VIDEOS} | 22 | whitelist ${VIDEOS} |
21 | whitelist ${PICTURES} | 23 | whitelist ${PICTURES} |
24 | whitelist /run/udev/data | ||
25 | whitelist /usr/libexec/gstreamer-1.0/gst-plugin-scanner | ||
22 | whitelist /usr/share/gnome-video-effects | 26 | whitelist /usr/share/gnome-video-effects |
27 | whitelist /usr/share/gstreamer-1.0 | ||
23 | include whitelist-common.inc | 28 | include whitelist-common.inc |
29 | include whitelist-run-common.inc | ||
24 | include whitelist-runuser-common.inc | 30 | include whitelist-runuser-common.inc |
25 | include whitelist-usr-share-common.inc | 31 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 32 | include whitelist-var-common.inc |
@@ -31,21 +37,26 @@ machine-id | |||
31 | net none | 37 | net none |
32 | nodvd | 38 | nodvd |
33 | nogroups | 39 | nogroups |
40 | noinput | ||
34 | nonewprivs | 41 | nonewprivs |
35 | noroot | 42 | noroot |
43 | nosound | ||
36 | notv | 44 | notv |
37 | nou2f | 45 | nou2f |
38 | protocol unix | 46 | protocol unix |
39 | seccomp | 47 | seccomp |
48 | seccomp.block-secondary | ||
40 | shell none | 49 | shell none |
41 | tracelog | 50 | tracelog |
42 | 51 | ||
43 | disable-mnt | 52 | disable-mnt |
44 | private-bin cheese | 53 | private-bin cheese |
45 | private-cache | 54 | private-cache |
46 | private-etc alternatives,clutter-1.0,dconf,drirc,fonts,gtk-3.0 | 55 | private-dev |
56 | private-etc alternatives,clutter-1.0,dconf,drirc,fonts,gtk-3.0,ld.so.preload | ||
47 | private-tmp | 57 | private-tmp |
48 | 58 | ||
49 | dbus-user filter | 59 | dbus-user filter |
60 | dbus-user.own org.gnome.Cheese | ||
50 | dbus-user.talk ca.desrt.dconf | 61 | dbus-user.talk ca.desrt.dconf |
51 | dbus-system none | 62 | dbus-system none |
diff --git a/etc/profile-a-l/cherrytree.profile b/etc/profile-a-l/cherrytree.profile index 7621b3c8c..e68182b27 100644 --- a/etc/profile-a-l/cherrytree.profile +++ b/etc/profile-a-l/cherrytree.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-a-l/chromium-common-hardened.inc.profile b/etc/profile-a-l/chromium-common-hardened.inc.profile index 87a0a0994..19addd285 100644 --- a/etc/profile-a-l/chromium-common-hardened.inc.profile +++ b/etc/profile-a-l/chromium-common-hardened.inc.profile | |||
@@ -6,5 +6,4 @@ caps.drop all | |||
6 | nonewprivs | 6 | nonewprivs |
7 | noroot | 7 | noroot |
8 | protocol unix,inet,inet6,netlink | 8 | protocol unix,inet,inet6,netlink |
9 | # kcmp is required for ozone-platform=wayland, see #3783. | 9 | seccomp !chroot |
10 | seccomp !chroot,!kcmp | ||
diff --git a/etc/profile-a-l/chromium-common.profile b/etc/profile-a-l/chromium-common.profile index f7493aa82..c42243e02 100644 --- a/etc/profile-a-l/chromium-common.profile +++ b/etc/profile-a-l/chromium-common.profile | |||
@@ -20,7 +20,6 @@ include disable-common.inc | |||
20 | include disable-devel.inc | 20 | include disable-devel.inc |
21 | include disable-exec.inc | 21 | include disable-exec.inc |
22 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
23 | # include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | 23 | include disable-programs.inc |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
26 | 25 | ||
@@ -30,6 +29,7 @@ whitelist ${DOWNLOADS} | |||
30 | whitelist ${HOME}/.pki | 29 | whitelist ${HOME}/.pki |
31 | whitelist ${HOME}/.local/share/pki | 30 | whitelist ${HOME}/.local/share/pki |
32 | include whitelist-common.inc | 31 | include whitelist-common.inc |
32 | include whitelist-run-common.inc | ||
33 | include whitelist-runuser-common.inc | 33 | include whitelist-runuser-common.inc |
34 | include whitelist-usr-share-common.inc | 34 | include whitelist-usr-share-common.inc |
35 | include whitelist-var-common.inc | 35 | include whitelist-var-common.inc |
@@ -37,9 +37,6 @@ include whitelist-var-common.inc | |||
37 | # Add the next line to your chromium-common.local if your kernel allows unprivileged userns clone. | 37 | # Add the next line to your chromium-common.local if your kernel allows unprivileged userns clone. |
38 | #include chromium-common-hardened.inc.profile | 38 | #include chromium-common-hardened.inc.profile |
39 | 39 | ||
40 | # Add the next line to your chromium-common.local to allow screen sharing under wayland. | ||
41 | #whitelist ${RUNUSER}/pipewire-0 | ||
42 | |||
43 | apparmor | 40 | apparmor |
44 | caps.keep sys_admin,sys_chroot | 41 | caps.keep sys_admin,sys_chroot |
45 | netfilter | 42 | netfilter |
diff --git a/etc/profile-a-l/cin.profile b/etc/profile-a-l/cin.profile index e1f9523c4..7d3e0c100 100644 --- a/etc/profile-a-l/cin.profile +++ b/etc/profile-a-l/cin.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | caps.drop all | 16 | caps.drop all |
diff --git a/etc/profile-a-l/clawsker.profile b/etc/profile-a-l/clawsker.profile index 9b62a1f73..5eb2cb621 100644 --- a/etc/profile-a-l/clawsker.profile +++ b/etc/profile-a-l/clawsker.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | mkdir ${HOME}/.claws-mail | 20 | mkdir ${HOME}/.claws-mail |
@@ -45,7 +44,7 @@ disable-mnt | |||
45 | private-bin bash,clawsker,perl,sh,which | 44 | private-bin bash,clawsker,perl,sh,which |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc alternatives,fonts | 47 | private-etc alternatives,fonts,ld.so.preload |
49 | private-lib girepository-1.*,libdbus-glib-1.so.*,libetpan.so.*,libgirepository-1.*,libgtk-3.so.*,libgtk-x11-2.0.so.*,libstartup-notification-1.so.*,perl* | 48 | private-lib girepository-1.*,libdbus-glib-1.so.*,libetpan.so.*,libgirepository-1.*,libgtk-3.so.*,libgtk-x11-2.0.so.*,libstartup-notification-1.so.*,perl* |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
diff --git a/etc/profile-a-l/clementine.profile b/etc/profile-a-l/clementine.profile index fa33795c1..b1509f391 100644 --- a/etc/profile-a-l/clementine.profile +++ b/etc/profile-a-l/clementine.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-a-l/clion-eap.profile b/etc/profile-a-l/clion-eap.profile new file mode 100644 index 000000000..3602c3e7b --- /dev/null +++ b/etc/profile-a-l/clion-eap.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile for CLion EAP | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include clion-eap.local | ||
5 | # Persistent global definitions | ||
6 | # added by included profile | ||
7 | #include globals.local | ||
8 | |||
9 | # Redirect | ||
10 | include clion.profile | ||
diff --git a/etc/profile-a-l/clion.profile b/etc/profile-a-l/clion.profile index 22cecff09..15071d731 100644 --- a/etc/profile-a-l/clion.profile +++ b/etc/profile-a-l/clion.profile | |||
@@ -5,6 +5,9 @@ include clion.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | noblacklist ${HOME}/.config/JetBrains/CLion* | ||
9 | noblacklist ${HOME}/.cache/JetBrains/CLion* | ||
10 | noblacklist ${HOME}/.clion* | ||
8 | noblacklist ${HOME}/.CLion* | 11 | noblacklist ${HOME}/.CLion* |
9 | noblacklist ${HOME}/.config/git | 12 | noblacklist ${HOME}/.config/git |
10 | noblacklist ${HOME}/.gitconfig | 13 | noblacklist ${HOME}/.gitconfig |
@@ -17,7 +20,6 @@ noblacklist ${HOME}/.tooling | |||
17 | include allow-ssh.inc | 20 | include allow-ssh.inc |
18 | 21 | ||
19 | include disable-common.inc | 22 | include disable-common.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 23 | include disable-programs.inc |
22 | 24 | ||
23 | caps.drop all | 25 | caps.drop all |
diff --git a/etc/profile-a-l/clipgrab.profile b/etc/profile-a-l/clipgrab.profile index c8258da07..f3c77fa77 100644 --- a/etc/profile-a-l/clipgrab.profile +++ b/etc/profile-a-l/clipgrab.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-a-l/clipit.profile b/etc/profile-a-l/clipit.profile index d421903a3..4c7cb86bf 100644 --- a/etc/profile-a-l/clipit.profile +++ b/etc/profile-a-l/clipit.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-a-l/cmus.profile b/etc/profile-a-l/cmus.profile index bcd557787..e51dd6bed 100644 --- a/etc/profile-a-l/cmus.profile +++ b/etc/profile-a-l/cmus.profile | |||
@@ -12,7 +12,6 @@ noblacklist ${MUSIC} | |||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -28,4 +27,4 @@ seccomp | |||
28 | shell none | 27 | shell none |
29 | 28 | ||
30 | private-bin cmus | 29 | private-bin cmus |
31 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,machine-id,pki,pulse,resolv.conf,ssl | 30 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
diff --git a/etc/profile-a-l/code.profile b/etc/profile-a-l/code.profile index e19b78908..fdf94ec41 100644 --- a/etc/profile-a-l/code.profile +++ b/etc/profile-a-l/code.profile | |||
@@ -5,6 +5,21 @@ include code.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Disabled until someone reported positive feedback | ||
9 | ignore include disable-devel.inc | ||
10 | ignore include disable-exec.inc | ||
11 | ignore include disable-interpreters.inc | ||
12 | ignore include disable-xdg.inc | ||
13 | ignore whitelist ${DOWNLOADS} | ||
14 | ignore include whitelist-common.inc | ||
15 | ignore include whitelist-runuser-common.inc | ||
16 | ignore include whitelist-usr-share-common.inc | ||
17 | ignore include whitelist-var-common.inc | ||
18 | ignore apparmor | ||
19 | ignore disable-mnt | ||
20 | ignore dbus-user none | ||
21 | ignore dbus-system none | ||
22 | |||
8 | noblacklist ${HOME}/.config/Code | 23 | noblacklist ${HOME}/.config/Code |
9 | noblacklist ${HOME}/.config/Code - OSS | 24 | noblacklist ${HOME}/.config/Code - OSS |
10 | noblacklist ${HOME}/.vscode | 25 | noblacklist ${HOME}/.vscode |
@@ -13,31 +28,13 @@ noblacklist ${HOME}/.vscode-oss | |||
13 | # Allows files commonly used by IDEs | 28 | # Allows files commonly used by IDEs |
14 | include allow-common-devel.inc | 29 | include allow-common-devel.inc |
15 | 30 | ||
16 | include disable-common.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | |||
20 | caps.drop all | ||
21 | netfilter | ||
22 | nodvd | ||
23 | nogroups | ||
24 | noinput | ||
25 | nonewprivs | ||
26 | noroot | ||
27 | nosound | 31 | nosound |
28 | notv | ||
29 | nou2f | ||
30 | novideo | ||
31 | protocol unix,inet,inet6,netlink | ||
32 | seccomp | ||
33 | shell none | ||
34 | |||
35 | private-cache | ||
36 | private-dev | ||
37 | private-tmp | ||
38 | 32 | ||
39 | # Disabling noexec ${HOME} for now since it will | 33 | # Disabling noexec ${HOME} for now since it will |
40 | # probably interfere with running some programmes | 34 | # probably interfere with running some programmes |
41 | # in VS Code | 35 | # in VS Code |
42 | # noexec ${HOME} | 36 | # noexec ${HOME} |
43 | noexec /tmp | 37 | noexec /tmp |
38 | |||
39 | # Redirect | ||
40 | include electron.profile | ||
diff --git a/etc/profile-a-l/cola.profile b/etc/profile-a-l/cola.profile index e5debfd82..97bf6d394 100644 --- a/etc/profile-a-l/cola.profile +++ b/etc/profile-a-l/cola.profile | |||
@@ -7,4 +7,4 @@ include cola.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include git-cola.profile \ No newline at end of file | 10 | include git-cola.profile |
diff --git a/etc/profile-a-l/colorful.profile b/etc/profile-a-l/colorful.profile index bd6d8f5b0..33ee0d0ee 100644 --- a/etc/profile-a-l/colorful.profile +++ b/etc/profile-a-l/colorful.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/com.github.bleakgrey.tootle.profile b/etc/profile-a-l/com.github.bleakgrey.tootle.profile index c8bdfec23..6f08bc378 100644 --- a/etc/profile-a-l/com.github.bleakgrey.tootle.profile +++ b/etc/profile-a-l/com.github.bleakgrey.tootle.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin com.github.bleakgrey.tootle | 45 | private-bin com.github.bleakgrey.tootle |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,machine-id mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg | 48 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,machine-id mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | # Settings are immutable | 51 | # Settings are immutable |
diff --git a/etc/profile-a-l/com.github.dahenson.agenda.profile b/etc/profile-a-l/com.github.dahenson.agenda.profile index b467a0f7a..d33b89e7c 100644 --- a/etc/profile-a-l/com.github.dahenson.agenda.profile +++ b/etc/profile-a-l/com.github.dahenson.agenda.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -53,7 +52,7 @@ disable-mnt | |||
53 | private-bin com.github.dahenson.agenda | 52 | private-bin com.github.dahenson.agenda |
54 | private-cache | 53 | private-cache |
55 | private-dev | 54 | private-dev |
56 | private-etc dconf,fonts,gtk-3.0 | 55 | private-etc dconf,fonts,gtk-3.0,ld.so.preload |
57 | private-tmp | 56 | private-tmp |
58 | 57 | ||
59 | dbus-user filter | 58 | dbus-user filter |
diff --git a/etc/profile-a-l/com.github.johnfactotum.Foliate.profile b/etc/profile-a-l/com.github.johnfactotum.Foliate.profile index c13f9618b..c75a09a51 100644 --- a/etc/profile-a-l/com.github.johnfactotum.Foliate.profile +++ b/etc/profile-a-l/com.github.johnfactotum.Foliate.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
@@ -56,7 +55,7 @@ disable-mnt | |||
56 | private-bin com.github.johnfactotum.Foliate,gjs | 55 | private-bin com.github.johnfactotum.Foliate,gjs |
57 | private-cache | 56 | private-cache |
58 | private-dev | 57 | private-dev |
59 | private-etc dconf,fonts,gconf,gtk-3.0 | 58 | private-etc dconf,fonts,gconf,gtk-3.0,ld.so.preload |
60 | private-tmp | 59 | private-tmp |
61 | 60 | ||
62 | read-only ${HOME} | 61 | read-only ${HOME} |
diff --git a/etc/profile-a-l/com.github.phase1geo.minder.profile b/etc/profile-a-l/com.github.phase1geo.minder.profile index d0402d188..b10d1b5b0 100644 --- a/etc/profile-a-l/com.github.phase1geo.minder.profile +++ b/etc/profile-a-l/com.github.phase1geo.minder.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/conky.profile b/etc/profile-a-l/conky.profile index eaa18739d..7ccc101bf 100644 --- a/etc/profile-a-l/conky.profile +++ b/etc/profile-a-l/conky.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-a-l/corebird.profile b/etc/profile-a-l/corebird.profile index 2fb446e2a..537381f64 100644 --- a/etc/profile-a-l/corebird.profile +++ b/etc/profile-a-l/corebird.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/cower.profile b/etc/profile-a-l/cower.profile index 1635995dc..351ca0dab 100644 --- a/etc/profile-a-l/cower.profile +++ b/etc/profile-a-l/cower.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/coyim.profile b/etc/profile-a-l/coyim.profile index 7ece35c2b..1d623fa09 100644 --- a/etc/profile-a-l/coyim.profile +++ b/etc/profile-a-l/coyim.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -41,7 +40,7 @@ tracelog | |||
41 | disable-mnt | 40 | disable-mnt |
42 | private-cache | 41 | private-cache |
43 | private-dev | 42 | private-dev |
44 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,ssl | 43 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,machine-id,pki,ssl |
45 | private-tmp | 44 | private-tmp |
46 | 45 | ||
47 | dbus-user none | 46 | dbus-user none |
diff --git a/etc/profile-a-l/crawl.profile b/etc/profile-a-l/crawl.profile index b10216895..7cbbcd8d3 100644 --- a/etc/profile-a-l/crawl.profile +++ b/etc/profile-a-l/crawl.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-a-l/crow.profile b/etc/profile-a-l/crow.profile index 02b15ecc2..deb2c0ef8 100644 --- a/etc/profile-a-l/crow.profile +++ b/etc/profile-a-l/crow.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -40,7 +39,7 @@ shell none | |||
40 | disable-mnt | 39 | disable-mnt |
41 | private-bin crow | 40 | private-bin crow |
42 | private-dev | 41 | private-dev |
43 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl | 42 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,ld.so.preload,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl |
44 | private-opt none | 43 | private-opt none |
45 | private-tmp | 44 | private-tmp |
46 | private-srv none | 45 | private-srv none |
diff --git a/etc/profile-a-l/curl.profile b/etc/profile-a-l/curl.profile index c9867c5d7..448d8b655 100644 --- a/etc/profile-a-l/curl.profile +++ b/etc/profile-a-l/curl.profile | |||
@@ -20,7 +20,6 @@ blacklist ${RUNUSER} | |||
20 | 20 | ||
21 | include disable-common.inc | 21 | include disable-common.inc |
22 | include disable-exec.inc | 22 | include disable-exec.inc |
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | 23 | include disable-programs.inc |
25 | # Depending on workflow you can add 'include disable-xdg.inc' to your curl.local. | 24 | # Depending on workflow you can add 'include disable-xdg.inc' to your curl.local. |
26 | #include disable-xdg.inc | 25 | #include disable-xdg.inc |
diff --git a/etc/profile-a-l/d-feet.profile b/etc/profile-a-l/d-feet.profile index ba1e7adad..0e754c448 100644 --- a/etc/profile-a-l/d-feet.profile +++ b/etc/profile-a-l/d-feet.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
@@ -51,7 +50,7 @@ disable-mnt | |||
51 | private-bin d-feet,python* | 50 | private-bin d-feet,python* |
52 | private-cache | 51 | private-cache |
53 | private-dev | 52 | private-dev |
54 | private-etc alternatives,dbus-1,fonts,machine-id | 53 | private-etc alternatives,dbus-1,fonts,ld.so.preload,machine-id |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
57 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 56 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/profile-a-l/darktable.profile b/etc/profile-a-l/darktable.profile index 61fa52928..a3590281c 100644 --- a/etc/profile-a-l/darktable.profile +++ b/etc/profile-a-l/darktable.profile | |||
@@ -10,11 +10,12 @@ noblacklist ${HOME}/.cache/darktable | |||
10 | noblacklist ${HOME}/.config/darktable | 10 | noblacklist ${HOME}/.config/darktable |
11 | noblacklist ${PICTURES} | 11 | noblacklist ${PICTURES} |
12 | 12 | ||
13 | include allow-lua.inc | ||
14 | |||
13 | include disable-common.inc | 15 | include disable-common.inc |
14 | include disable-devel.inc | 16 | include disable-devel.inc |
15 | include disable-exec.inc | 17 | include disable-exec.inc |
16 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 19 | include disable-programs.inc |
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
diff --git a/etc/profile-a-l/dbus-send.profile b/etc/profile-a-l/dbus-send.profile index 67a61bb60..c2532ed3b 100644 --- a/etc/profile-a-l/dbus-send.profile +++ b/etc/profile-a-l/dbus-send.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-write-mnt.inc | 19 | include disable-write-mnt.inc |
@@ -52,7 +51,7 @@ private | |||
52 | private-bin dbus-send | 51 | private-bin dbus-send |
53 | private-cache | 52 | private-cache |
54 | private-dev | 53 | private-dev |
55 | private-etc alternatives,dbus-1 | 54 | private-etc alternatives,dbus-1,ld.so.preload |
56 | private-lib libpcre* | 55 | private-lib libpcre* |
57 | private-tmp | 56 | private-tmp |
58 | 57 | ||
diff --git a/etc/profile-a-l/dconf-editor.profile b/etc/profile-a-l/dconf-editor.profile index 0c221850a..2b43c5ea3 100644 --- a/etc/profile-a-l/dconf-editor.profile +++ b/etc/profile-a-l/dconf-editor.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin dconf-editor | 43 | private-bin dconf-editor |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,dconf,fonts,gtk-3.0,machine-id | 46 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload,machine-id |
48 | private-lib | 47 | private-lib |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
diff --git a/etc/profile-a-l/dconf.profile b/etc/profile-a-l/dconf.profile index be7514cbf..1cbeee763 100644 --- a/etc/profile-a-l/dconf.profile +++ b/etc/profile-a-l/dconf.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
@@ -47,7 +46,7 @@ disable-mnt | |||
47 | private-bin dconf,gsettings | 46 | private-bin dconf,gsettings |
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | private-etc alternatives,dconf | 49 | private-etc alternatives,dconf,ld.so.preload |
51 | private-lib | 50 | private-lib |
52 | private-tmp | 51 | private-tmp |
53 | 52 | ||
diff --git a/etc/profile-a-l/ddgtk.profile b/etc/profile-a-l/ddgtk.profile index 5b95b74be..0669a5a6c 100644 --- a/etc/profile-a-l/ddgtk.profile +++ b/etc/profile-a-l/ddgtk.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -46,7 +45,7 @@ tracelog | |||
46 | disable-mnt | 45 | disable-mnt |
47 | private-bin bash,dd,ddgtk,grep,lsblk,python*,sed,sh,tr | 46 | private-bin bash,dd,ddgtk,grep,lsblk,python*,sed,sh,tr |
48 | private-cache | 47 | private-cache |
49 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts,ld.so.preload |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-a-l/deadbeef.profile b/etc/profile-a-l/deadbeef.profile index a221ebbd7..d9ff941da 100644 --- a/etc/profile-a-l/deadbeef.profile +++ b/etc/profile-a-l/deadbeef.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-a-l/default.profile b/etc/profile-a-l/default.profile index 5bdf5df7f..0d8c224d7 100644 --- a/etc/profile-a-l/default.profile +++ b/etc/profile-a-l/default.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | # include disable-devel.inc | 12 | # include disable-devel.inc |
13 | # include disable-exec.inc | 13 | # include disable-exec.inc |
14 | # include disable-interpreters.inc | 14 | # include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | # include disable-shell.inc | 16 | # include disable-shell.inc |
18 | # include disable-write-mnt.inc | 17 | # include disable-write-mnt.inc |
diff --git a/etc/profile-a-l/deluge.profile b/etc/profile-a-l/deluge.profile index ad7aa6ed5..3697243e0 100644 --- a/etc/profile-a-l/deluge.profile +++ b/etc/profile-a-l/deluge.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | # include disable-devel.inc | 16 | # include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | mkdir ${HOME}/.config/deluge | 21 | mkdir ${HOME}/.config/deluge |
diff --git a/etc/profile-a-l/desktopeditors.profile b/etc/profile-a-l/desktopeditors.profile index 212cdab60..5175146db 100644 --- a/etc/profile-a-l/desktopeditors.profile +++ b/etc/profile-a-l/desktopeditors.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | include whitelist-usr-share-common.inc | 19 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-a-l/devhelp.profile b/etc/profile-a-l/devhelp.profile index 5007f8e74..562f6b105 100644 --- a/etc/profile-a-l/devhelp.profile +++ b/etc/profile-a-l/devhelp.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
@@ -43,7 +42,7 @@ disable-mnt | |||
43 | private-bin devhelp | 42 | private-bin devhelp |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc alternatives,dconf,fonts,ld.so.cache,machine-id,ssl | 45 | private-etc alternatives,dconf,fonts,ld.so.cache,ld.so.preload,machine-id,ssl |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | # makes settings immutable | 48 | # makes settings immutable |
diff --git a/etc/profile-a-l/devilspie.profile b/etc/profile-a-l/devilspie.profile index 6267b5709..19b6cffaf 100644 --- a/etc/profile-a-l/devilspie.profile +++ b/etc/profile-a-l/devilspie.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -49,7 +48,7 @@ disable-mnt | |||
49 | private-bin devilspie | 48 | private-bin devilspie |
50 | private-cache | 49 | private-cache |
51 | private-dev | 50 | private-dev |
52 | private-etc alternatives | 51 | private-etc alternatives,ld.so.preload |
53 | private-lib gconv | 52 | private-lib gconv |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
diff --git a/etc/profile-a-l/dex2jar.profile b/etc/profile-a-l/dex2jar.profile index 8f3703369..9c1cf72f0 100644 --- a/etc/profile-a-l/dex2jar.profile +++ b/etc/profile-a-l/dex2jar.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-a-l/dia.profile b/etc/profile-a-l/dia.profile index 531734b7d..902148756 100644 --- a/etc/profile-a-l/dia.profile +++ b/etc/profile-a-l/dia.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-a-l/dig.profile b/etc/profile-a-l/dig.profile index 247159a8a..a925781af 100644 --- a/etc/profile-a-l/dig.profile +++ b/etc/profile-a-l/dig.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | # include disable-devel.inc | 17 | # include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | # include disable-interpreters.inc | 19 | # include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-a-l/digikam.profile b/etc/profile-a-l/digikam.profile index 2ca7bd400..41625e12e 100644 --- a/etc/profile-a-l/digikam.profile +++ b/etc/profile-a-l/digikam.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-a-l/dillo.profile b/etc/profile-a-l/dillo.profile index 9871a6095..276ee251a 100644 --- a/etc/profile-a-l/dillo.profile +++ b/etc/profile-a-l/dillo.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${HOME}/.dillo | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | mkdir ${HOME}/.dillo | 16 | mkdir ${HOME}/.dillo |
diff --git a/etc/profile-a-l/dino.profile b/etc/profile-a-l/dino.profile index c3174b35f..b1a9550f1 100644 --- a/etc/profile-a-l/dino.profile +++ b/etc/profile-a-l/dino.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
diff --git a/etc/profile-a-l/discord-common.profile b/etc/profile-a-l/discord-common.profile index 19e7bd9ab..c04e38899 100644 --- a/etc/profile-a-l/discord-common.profile +++ b/etc/profile-a-l/discord-common.profile | |||
@@ -23,8 +23,8 @@ ignore novideo | |||
23 | whitelist ${HOME}/.config/BetterDiscord | 23 | whitelist ${HOME}/.config/BetterDiscord |
24 | whitelist ${HOME}/.local/share/betterdiscordctl | 24 | whitelist ${HOME}/.local/share/betterdiscordctl |
25 | 25 | ||
26 | private-bin bash,cut,echo,egrep,fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh | 26 | private-bin bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh |
27 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl | 27 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl |
28 | 28 | ||
29 | join-or-start discord | 29 | join-or-start discord |
30 | 30 | ||
diff --git a/etc/profile-a-l/display.profile b/etc/profile-a-l/display.profile index 11f3fd36e..6eff39d40 100644 --- a/etc/profile-a-l/display.profile +++ b/etc/profile-a-l/display.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -41,7 +40,7 @@ shell none | |||
41 | private-bin display,python* | 40 | private-bin display,python* |
42 | private-dev | 41 | private-dev |
43 | # On Debian-based systems, display is a symlink in /etc/alternatives | 42 | # On Debian-based systems, display is a symlink in /etc/alternatives |
44 | private-etc alternatives | 43 | private-etc alternatives,ld.so.preload |
45 | private-tmp | 44 | private-tmp |
46 | 45 | ||
47 | dbus-user none | 46 | dbus-user none |
diff --git a/etc/profile-a-l/dnscrypt-proxy.profile b/etc/profile-a-l/dnscrypt-proxy.profile index f8fb1a331..906089663 100644 --- a/etc/profile-a-l/dnscrypt-proxy.profile +++ b/etc/profile-a-l/dnscrypt-proxy.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-a-l/dnsmasq.profile b/etc/profile-a-l/dnsmasq.profile index 01398c2b2..2db1548a4 100644 --- a/etc/profile-a-l/dnsmasq.profile +++ b/etc/profile-a-l/dnsmasq.profile | |||
@@ -16,7 +16,6 @@ blacklist ${RUNUSER}/wayland-* | |||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-a-l/dolphin-emu.profile b/etc/profile-a-l/dolphin-emu.profile index 49feec32e..ac86ef75a 100644 --- a/etc/profile-a-l/dolphin-emu.profile +++ b/etc/profile-a-l/dolphin-emu.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-write-mnt.inc | 20 | include disable-write-mnt.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/dooble.profile b/etc/profile-a-l/dooble.profile index 37a4113cb..f1b630ac8 100644 --- a/etc/profile-a-l/dooble.profile +++ b/etc/profile-a-l/dooble.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.dooble | 18 | mkdir ${HOME}/.dooble |
diff --git a/etc/profile-a-l/dosbox.profile b/etc/profile-a-l/dosbox.profile index 988f66f28..ad7049d3d 100644 --- a/etc/profile-a-l/dosbox.profile +++ b/etc/profile-a-l/dosbox.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/dragon.profile b/etc/profile-a-l/dragon.profile index 8fa01d504..26243ab4e 100644 --- a/etc/profile-a-l/dragon.profile +++ b/etc/profile-a-l/dragon.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/drawio.profile b/etc/profile-a-l/drawio.profile index 82d96e405..253f5643e 100644 --- a/etc/profile-a-l/drawio.profile +++ b/etc/profile-a-l/drawio.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ shell none | |||
46 | private-bin drawio | 45 | private-bin drawio |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts,ld.so.preload |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-a-l/drill.profile b/etc/profile-a-l/drill.profile index 068bd88d8..2a09270f7 100644 --- a/etc/profile-a-l/drill.profile +++ b/etc/profile-a-l/drill.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | # include disable-devel.inc | 16 | # include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | # include disable-interpreters.inc | 18 | # include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-a-l/dropbox.profile b/etc/profile-a-l/dropbox.profile index b3b2aaf40..73d9cfbbc 100644 --- a/etc/profile-a-l/dropbox.profile +++ b/etc/profile-a-l/dropbox.profile | |||
@@ -15,7 +15,6 @@ include allow-python3.inc | |||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | mkdir ${HOME}/.dropbox | 20 | mkdir ${HOME}/.dropbox |
diff --git a/etc/profile-a-l/easystroke.profile b/etc/profile-a-l/easystroke.profile index 38e4b16f7..0345f2b24 100644 --- a/etc/profile-a-l/easystroke.profile +++ b/etc/profile-a-l/easystroke.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | #private-bin bash,easystroke,sh | 45 | #private-bin bash,easystroke,sh |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,fonts,group,passwd | 48 | private-etc alternatives,fonts,group,ld.so.preload,passwd |
50 | # breaks custom shell command functionality | 49 | # breaks custom shell command functionality |
51 | #private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* | 50 | #private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* |
52 | private-tmp | 51 | private-tmp |
diff --git a/etc/profile-a-l/electron-mail.profile b/etc/profile-a-l/electron-mail.profile index 278dd6cbd..e472f57b6 100644 --- a/etc/profile-a-l/electron-mail.profile +++ b/etc/profile-a-l/electron-mail.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ shell none | |||
46 | private-bin electron-mail | 45 | private-bin electron-mail |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,nsswitch.conf,pki,resolv.conf,selinux,ssl,xdg | 48 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,ld.so.preload,nsswitch.conf,pki,resolv.conf,selinux,ssl,xdg |
50 | private-opt ElectronMail | 49 | private-opt ElectronMail |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
diff --git a/etc/profile-a-l/electron.profile b/etc/profile-a-l/electron.profile index 493af79d4..05ae7e16d 100644 --- a/etc/profile-a-l/electron.profile +++ b/etc/profile-a-l/electron.profile | |||
@@ -8,7 +8,6 @@ include disable-common.inc | |||
8 | include disable-devel.inc | 8 | include disable-devel.inc |
9 | include disable-exec.inc | 9 | include disable-exec.inc |
10 | include disable-interpreters.inc | 10 | include disable-interpreters.inc |
11 | include disable-passwdmgr.inc | ||
12 | include disable-programs.inc | 11 | include disable-programs.inc |
13 | include disable-xdg.inc | 12 | include disable-xdg.inc |
14 | 13 | ||
diff --git a/etc/profile-a-l/electrum.profile b/etc/profile-a-l/electrum.profile index ad636d71a..8cfc9f797 100644 --- a/etc/profile-a-l/electrum.profile +++ b/etc/profile-a-l/electrum.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
@@ -48,7 +47,7 @@ private-bin electrum,python* | |||
48 | private-cache | 47 | private-cache |
49 | ?HAS_APPIMAGE: ignore private-dev | 48 | ?HAS_APPIMAGE: ignore private-dev |
50 | private-dev | 49 | private-dev |
51 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,machine-id,pki,resolv.conf,ssl | 50 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,ld.so.preload,machine-id,pki,resolv.conf,ssl |
52 | private-tmp | 51 | private-tmp |
53 | 52 | ||
54 | # dbus-user none | 53 | # dbus-user none |
diff --git a/etc/profile-a-l/emacs.profile b/etc/profile-a-l/emacs.profile index 55bf743ef..7e9be653d 100644 --- a/etc/profile-a-l/emacs.profile +++ b/etc/profile-a-l/emacs.profile | |||
@@ -15,7 +15,6 @@ noblacklist ${HOME}/.emacs.d | |||
15 | include allow-common-devel.inc | 15 | include allow-common-devel.inc |
16 | 16 | ||
17 | include disable-common.inc | 17 | include disable-common.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/profile-a-l/email-common.profile b/etc/profile-a-l/email-common.profile index 6c9a8a6ea..8673b65ca 100644 --- a/etc/profile-a-l/email-common.profile +++ b/etc/profile-a-l/email-common.profile | |||
@@ -7,11 +7,12 @@ include email-common.local | |||
7 | # added by caller profile | 7 | # added by caller profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | noblacklist ${HOME}/.bogofilter | ||
10 | noblacklist ${HOME}/.gnupg | 11 | noblacklist ${HOME}/.gnupg |
11 | noblacklist ${HOME}/.mozilla | 12 | noblacklist ${HOME}/.mozilla |
12 | noblacklist ${HOME}/.signature | 13 | noblacklist ${HOME}/.signature |
13 | # when storing mail outside the default ${HOME}/Mail path, 'noblacklist' the custom path in your email-common.local | 14 | # when storing mail outside the default ${HOME}/Mail path, 'noblacklist' the custom path in your email-common.local |
14 | # and 'blacklist' it in your disable-common.local too so it is kept hidden from other applications | 15 | # and 'blacklist' it in your disable-common.local too so it is kept hidden from other applications |
15 | noblacklist ${HOME}/Mail | 16 | noblacklist ${HOME}/Mail |
16 | 17 | ||
17 | noblacklist ${DOCUMENTS} | 18 | noblacklist ${DOCUMENTS} |
@@ -20,7 +21,6 @@ include disable-common.inc | |||
20 | include disable-devel.inc | 21 | include disable-devel.inc |
21 | include disable-exec.inc | 22 | include disable-exec.inc |
22 | include disable-interpreters.inc | 23 | include disable-interpreters.inc |
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | 24 | include disable-programs.inc |
25 | include disable-xdg.inc | 25 | include disable-xdg.inc |
26 | 26 | ||
@@ -66,7 +66,7 @@ tracelog | |||
66 | # disable-mnt | 66 | # disable-mnt |
67 | private-cache | 67 | private-cache |
68 | private-dev | 68 | private-dev |
69 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg | 69 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,ld.so.preload,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg |
70 | private-tmp | 70 | private-tmp |
71 | # encrypting and signing email | 71 | # encrypting and signing email |
72 | writable-run-user | 72 | writable-run-user |
diff --git a/etc/profile-a-l/enchant.profile b/etc/profile-a-l/enchant.profile index ac17b1726..0a2e23996 100644 --- a/etc/profile-a-l/enchant.profile +++ b/etc/profile-a-l/enchant.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -49,7 +48,7 @@ x11 none | |||
49 | private-bin enchant,enchant-* | 48 | private-bin enchant,enchant-* |
50 | private-cache | 49 | private-cache |
51 | private-dev | 50 | private-dev |
52 | private-etc alternatives | 51 | private-etc alternatives,ld.so.preload |
53 | private-lib | 52 | private-lib |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
diff --git a/etc/profile-a-l/engrampa.profile b/etc/profile-a-l/engrampa.profile index f926610e2..1aca416d8 100644 --- a/etc/profile-a-l/engrampa.profile +++ b/etc/profile-a-l/engrampa.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | 14 | ||
16 | include whitelist-var-common.inc | 15 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/enpass.profile b/etc/profile-a-l/enpass.profile index c4123b4c2..0d0d6f083 100644 --- a/etc/profile-a-l/enpass.profile +++ b/etc/profile-a-l/enpass.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-a-l/eo-common.profile b/etc/profile-a-l/eo-common.profile index fe7913e77..ddc0ce0b9 100644 --- a/etc/profile-a-l/eo-common.profile +++ b/etc/profile-a-l/eo-common.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-write-mnt.inc | 21 | include disable-write-mnt.inc |
23 | 22 | ||
@@ -48,6 +47,6 @@ tracelog | |||
48 | 47 | ||
49 | private-cache | 48 | private-cache |
50 | private-dev | 49 | private-dev |
51 | private-etc alternatives,dconf,fonts,gtk-3.0 | 50 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload |
52 | private-lib eog,eom,gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.* | 51 | private-lib eog,eom,gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.* |
53 | private-tmp | 52 | private-tmp |
diff --git a/etc/profile-a-l/eog.profile b/etc/profile-a-l/eog.profile index 5892374bd..65e5c6e69 100644 --- a/etc/profile-a-l/eog.profile +++ b/etc/profile-a-l/eog.profile | |||
@@ -18,7 +18,7 @@ whitelist /usr/share/eog | |||
18 | 18 | ||
19 | private-bin eog | 19 | private-bin eog |
20 | 20 | ||
21 | # broken on Debian 10 (buster) running LXDE got the folowing error: | 21 | # broken on Debian 10 (buster) running LXDE got the following error: |
22 | # Failed to register: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: org.freedesktop.DBus.Error.ServiceUnknown | 22 | # Failed to register: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: org.freedesktop.DBus.Error.ServiceUnknown |
23 | #dbus-user filter | 23 | #dbus-user filter |
24 | #dbus-user.own org.gnome.eog | 24 | #dbus-user.own org.gnome.eog |
diff --git a/etc/profile-a-l/equalx.profile b/etc/profile-a-l/equalx.profile index 964d3b7ca..fe7b912bd 100644 --- a/etc/profile-a-l/equalx.profile +++ b/etc/profile-a-l/equalx.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -55,7 +54,7 @@ disable-mnt | |||
55 | private-bin equalx,gs,pdflatex,pdftocairo | 54 | private-bin equalx,gs,pdflatex,pdftocairo |
56 | private-cache | 55 | private-cache |
57 | private-dev | 56 | private-dev |
58 | private-etc equalx,equalx.conf,fonts,gtk-2.0,latexmk.conf,machine-id,papersize,passwd,texlive,Trolltech.conf | 57 | private-etc equalx,equalx.conf,fonts,gtk-2.0,latexmk.conf,ld.so.preload,machine-id,papersize,passwd,texlive,Trolltech.conf |
59 | private-tmp | 58 | private-tmp |
60 | 59 | ||
61 | dbus-user none | 60 | dbus-user none |
diff --git a/etc/profile-a-l/etr.profile b/etc/profile-a-l/etr.profile index fdff1e4b5..edeed69bf 100644 --- a/etc/profile-a-l/etr.profile +++ b/etc/profile-a-l/etr.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/evince.profile b/etc/profile-a-l/evince.profile index a9e39b15c..63e456488 100644 --- a/etc/profile-a-l/evince.profile +++ b/etc/profile-a-l/evince.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-shell.inc | 23 | include disable-shell.inc |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
@@ -55,9 +54,9 @@ tracelog | |||
55 | private-bin evince,evince-previewer,evince-thumbnailer | 54 | private-bin evince,evince-previewer,evince-thumbnailer |
56 | private-cache | 55 | private-cache |
57 | private-dev | 56 | private-dev |
58 | private-etc alternatives,fonts,group,ld.so.cache,machine-id,passwd | 57 | private-etc alternatives,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd |
59 | # private-lib might break two-page-view on some systems | 58 | # private-lib might break two-page-view on some systems |
60 | private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* | 59 | private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libarchive.so.*,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* |
61 | private-tmp | 60 | private-tmp |
62 | 61 | ||
63 | # dbus-user filtering might break two-page-view on some systems | 62 | # dbus-user filtering might break two-page-view on some systems |
diff --git a/etc/profile-a-l/evolution.profile b/etc/profile-a-l/evolution.profile index 7222493ac..a80327234 100644 --- a/etc/profile-a-l/evolution.profile +++ b/etc/profile-a-l/evolution.profile | |||
@@ -20,7 +20,6 @@ include disable-common.inc | |||
20 | include disable-devel.inc | 20 | include disable-devel.inc |
21 | include disable-exec.inc | 21 | include disable-exec.inc |
22 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | 23 | include disable-programs.inc |
25 | 24 | ||
26 | include whitelist-runuser-common.inc | 25 | include whitelist-runuser-common.inc |
diff --git a/etc/profile-a-l/exiftool.profile b/etc/profile-a-l/exiftool.profile index 7b09a2c64..12c22ba5b 100644 --- a/etc/profile-a-l/exiftool.profile +++ b/etc/profile-a-l/exiftool.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | whitelist /usr/share/perl-image-exiftool | 20 | whitelist /usr/share/perl-image-exiftool |
@@ -49,7 +48,7 @@ x11 none | |||
49 | #private-bin exiftool,perl | 48 | #private-bin exiftool,perl |
50 | private-cache | 49 | private-cache |
51 | private-dev | 50 | private-dev |
52 | private-etc alternatives | 51 | private-etc alternatives,ld.so.preload |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
55 | dbus-user none | 54 | dbus-user none |
diff --git a/etc/profile-a-l/falkon.profile b/etc/profile-a-l/falkon.profile index b2061db79..62ea449a6 100644 --- a/etc/profile-a-l/falkon.profile +++ b/etc/profile-a-l/falkon.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
@@ -47,7 +46,7 @@ disable-mnt | |||
47 | # private-bin falkon | 46 | # private-bin falkon |
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | private-etc adobe,alternatives,asound.conf,ati,ca-certificates,crypto-policies,dconf,drirc,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg | 49 | private-etc adobe,alternatives,asound.conf,ati,ca-certificates,crypto-policies,dconf,drirc,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
53 | # dbus-user filter | 52 | # dbus-user filter |
diff --git a/etc/profile-a-l/fbreader.profile b/etc/profile-a-l/fbreader.profile index 8e81000fd..121c5ba26 100644 --- a/etc/profile-a-l/fbreader.profile +++ b/etc/profile-a-l/fbreader.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/fdns.profile b/etc/profile-a-l/fdns.profile index 31cb1776c..25e1082ad 100644 --- a/etc/profile-a-l/fdns.profile +++ b/etc/profile-a-l/fdns.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-a-l/feedreader.profile b/etc/profile-a-l/feedreader.profile index 664ec2da6..e45df21fc 100644 --- a/etc/profile-a-l/feedreader.profile +++ b/etc/profile-a-l/feedreader.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/feh-network.inc.profile b/etc/profile-a-l/feh-network.inc.profile index 690b39171..f9b3d58c9 100644 --- a/etc/profile-a-l/feh-network.inc.profile +++ b/etc/profile-a-l/feh-network.inc.profile | |||
@@ -5,4 +5,4 @@ include feh-network.inc.local | |||
5 | ignore net none | 5 | ignore net none |
6 | netfilter | 6 | netfilter |
7 | protocol unix,inet,inet6 | 7 | protocol unix,inet,inet6 |
8 | private-etc ca-certificates,crypto-policies,hosts,pki,resolv.conf,ssl | 8 | private-etc ca-certificates,crypto-policies,hosts,ld.so.preload,pki,resolv.conf,ssl |
diff --git a/etc/profile-a-l/feh.profile b/etc/profile-a-l/feh.profile index 2f2d8a4c7..f2770f294 100644 --- a/etc/profile-a-l/feh.profile +++ b/etc/profile-a-l/feh.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | 16 | ||
@@ -37,7 +36,7 @@ shell none | |||
37 | private-bin feh,jpegexiforient,jpegtran | 36 | private-bin feh,jpegexiforient,jpegtran |
38 | private-cache | 37 | private-cache |
39 | private-dev | 38 | private-dev |
40 | private-etc alternatives,feh | 39 | private-etc alternatives,feh,ld.so.preload |
41 | private-tmp | 40 | private-tmp |
42 | 41 | ||
43 | dbus-user none | 42 | dbus-user none |
diff --git a/etc/profile-a-l/fetchmail.profile b/etc/profile-a-l/fetchmail.profile index 7358ed5c7..babfeab61 100644 --- a/etc/profile-a-l/fetchmail.profile +++ b/etc/profile-a-l/fetchmail.profile | |||
@@ -12,7 +12,6 @@ noblacklist ${HOME}/.netrc | |||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | caps.drop all | 17 | caps.drop all |
diff --git a/etc/profile-a-l/ffmpeg.profile b/etc/profile-a-l/ffmpeg.profile index 13ef1beb9..637e6fbf5 100644 --- a/etc/profile-a-l/ffmpeg.profile +++ b/etc/profile-a-l/ffmpeg.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/ffplay.profile b/etc/profile-a-l/ffplay.profile index 04134cbf4..2284ccbe4 100644 --- a/etc/profile-a-l/ffplay.profile +++ b/etc/profile-a-l/ffplay.profile | |||
@@ -14,7 +14,7 @@ ignore nogroups | |||
14 | ignore nosound | 14 | ignore nosound |
15 | 15 | ||
16 | private-bin ffplay | 16 | private-bin ffplay |
17 | private-etc alsa,asound.conf,group | 17 | private-etc alsa,asound.conf,group,ld.so.preload |
18 | 18 | ||
19 | # Redirect | 19 | # Redirect |
20 | include ffmpeg.profile | 20 | include ffmpeg.profile |
diff --git a/etc/profile-a-l/file-manager-common.profile b/etc/profile-a-l/file-manager-common.profile index 23ec4a432..dbae06f19 100644 --- a/etc/profile-a-l/file-manager-common.profile +++ b/etc/profile-a-l/file-manager-common.profile | |||
@@ -26,7 +26,6 @@ include allow-python3.inc | |||
26 | include disable-devel.inc | 26 | include disable-devel.inc |
27 | include disable-exec.inc | 27 | include disable-exec.inc |
28 | include disable-interpreters.inc | 28 | include disable-interpreters.inc |
29 | include disable-passwdmgr.inc | ||
30 | #include disable-programs.inc | 29 | #include disable-programs.inc |
31 | 30 | ||
32 | allusers | 31 | allusers |
diff --git a/etc/profile-a-l/file-roller.profile b/etc/profile-a-l/file-roller.profile index 4e651ed61..54fa7dfa7 100644 --- a/etc/profile-a-l/file-roller.profile +++ b/etc/profile-a-l/file-roller.profile | |||
@@ -10,10 +10,10 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | 14 | ||
16 | whitelist /usr/libexec/file-roller | 15 | whitelist /usr/libexec/file-roller |
16 | whitelist /usr/libexec/p7zip | ||
17 | whitelist /usr/share/file-roller | 17 | whitelist /usr/share/file-roller |
18 | include whitelist-runuser-common.inc | 18 | include whitelist-runuser-common.inc |
19 | include whitelist-usr-share-common.inc | 19 | include whitelist-usr-share-common.inc |
@@ -43,7 +43,7 @@ tracelog | |||
43 | private-bin 7z,7za,7zr,ar,arj,atool,bash,brotli,bsdtar,bzip2,compress,cp,cpio,dpkg-deb,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,mv,p7zip,rar,rm,rzip,sh,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,unzstd,xz,xzdec,zip,zoo,zstd | 43 | private-bin 7z,7za,7zr,ar,arj,atool,bash,brotli,bsdtar,bzip2,compress,cp,cpio,dpkg-deb,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,mv,p7zip,rar,rm,rzip,sh,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,unzstd,xz,xzdec,zip,zoo,zstd |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc dconf,fonts,gtk-3.0,xdg | 46 | private-etc dconf,fonts,gtk-3.0,ld.so.preload,xdg |
47 | # private-tmp | 47 | # private-tmp |
48 | 48 | ||
49 | dbus-system none | 49 | dbus-system none |
diff --git a/etc/profile-a-l/file.profile b/etc/profile-a-l/file.profile index 5c7583605..397120a0b 100644 --- a/etc/profile-a-l/file.profile +++ b/etc/profile-a-l/file.profile | |||
@@ -11,7 +11,6 @@ blacklist ${RUNUSER} | |||
11 | 11 | ||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | apparmor | 16 | apparmor |
diff --git a/etc/profile-a-l/firefox-common-addons.profile b/etc/profile-a-l/firefox-common-addons.profile index d282f9a60..b2b7c362a 100644 --- a/etc/profile-a-l/firefox-common-addons.profile +++ b/etc/profile-a-l/firefox-common-addons.profile | |||
@@ -2,6 +2,7 @@ | |||
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include firefox-common-addons.local | 3 | include firefox-common-addons.local |
4 | 4 | ||
5 | ignore whitelist ${RUNUSER}/*firefox* | ||
5 | ignore include whitelist-runuser-common.inc | 6 | ignore include whitelist-runuser-common.inc |
6 | ignore private-cache | 7 | ignore private-cache |
7 | 8 | ||
diff --git a/etc/profile-a-l/firefox-common.profile b/etc/profile-a-l/firefox-common.profile index 8b74ed979..20ae039aa 100644 --- a/etc/profile-a-l/firefox-common.profile +++ b/etc/profile-a-l/firefox-common.profile | |||
@@ -27,6 +27,7 @@ whitelist ${DOWNLOADS} | |||
27 | whitelist ${HOME}/.pki | 27 | whitelist ${HOME}/.pki |
28 | whitelist ${HOME}/.local/share/pki | 28 | whitelist ${HOME}/.local/share/pki |
29 | include whitelist-common.inc | 29 | include whitelist-common.inc |
30 | include whitelist-run-common.inc | ||
30 | include whitelist-runuser-common.inc | 31 | include whitelist-runuser-common.inc |
31 | include whitelist-var-common.inc | 32 | include whitelist-var-common.inc |
32 | 33 | ||
diff --git a/etc/profile-a-l/firefox.profile b/etc/profile-a-l/firefox.profile index 7874c882f..9138fed90 100644 --- a/etc/profile-a-l/firefox.profile +++ b/etc/profile-a-l/firefox.profile | |||
@@ -16,6 +16,7 @@ include globals.local | |||
16 | 16 | ||
17 | noblacklist ${HOME}/.cache/mozilla | 17 | noblacklist ${HOME}/.cache/mozilla |
18 | noblacklist ${HOME}/.mozilla | 18 | noblacklist ${HOME}/.mozilla |
19 | noblacklist ${RUNUSER}/*firefox* | ||
19 | 20 | ||
20 | blacklist /usr/libexec | 21 | blacklist /usr/libexec |
21 | 22 | ||
@@ -35,6 +36,7 @@ whitelist /usr/share/gnome-shell/search-providers/firefox-search-provider.ini | |||
35 | whitelist /usr/share/gtk-doc/html | 36 | whitelist /usr/share/gtk-doc/html |
36 | whitelist /usr/share/mozilla | 37 | whitelist /usr/share/mozilla |
37 | whitelist /usr/share/webext | 38 | whitelist /usr/share/webext |
39 | whitelist ${RUNUSER}/*firefox* | ||
38 | include whitelist-usr-share-common.inc | 40 | include whitelist-usr-share-common.inc |
39 | 41 | ||
40 | # firefox requires a shell to launch on Arch - add the next line to your firefox.local to enable private-bin. | 42 | # firefox requires a shell to launch on Arch - add the next line to your firefox.local to enable private-bin. |
@@ -56,9 +58,8 @@ dbus-user.own org.mpris.MediaPlayer2.firefox.* | |||
56 | #dbus-user.own org.mpris.MediaPlayer2.plasma-browser-integration | 58 | #dbus-user.own org.mpris.MediaPlayer2.plasma-browser-integration |
57 | #dbus-user.talk org.kde.JobViewServer | 59 | #dbus-user.talk org.kde.JobViewServer |
58 | #dbus-user.talk org.kde.kuiserver | 60 | #dbus-user.talk org.kde.kuiserver |
59 | # Add the next two lines to your firefox.local to allow screen sharing under wayland. | 61 | # Add the next line to your firefox.local to allow screen sharing under wayland. |
60 | #whitelist ${RUNUSER}/pipewire-0 | 62 | #dbus-user.talk org.freedesktop.portal.Desktop |
61 | #dbus-user.talk org.freedesktop.portal.* | ||
62 | # Add the next line to your firefox.local if screen sharing sharing still does not work | 63 | # Add the next line to your firefox.local if screen sharing sharing still does not work |
63 | # with the above lines (might depend on the portal implementation). | 64 | # with the above lines (might depend on the portal implementation). |
64 | #ignore noroot | 65 | #ignore noroot |
diff --git a/etc/profile-a-l/flameshot.profile b/etc/profile-a-l/flameshot.profile index 55af96c84..5c7bc03d8 100644 --- a/etc/profile-a-l/flameshot.profile +++ b/etc/profile-a-l/flameshot.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -53,7 +52,7 @@ tracelog | |||
53 | disable-mnt | 52 | disable-mnt |
54 | private-bin flameshot | 53 | private-bin flameshot |
55 | private-cache | 54 | private-cache |
56 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.conf,machine-id,pki,resolv.conf,ssl | 55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.conf,ld.so.preload,machine-id,pki,resolv.conf,ssl |
57 | private-dev | 56 | private-dev |
58 | #private-tmp | 57 | #private-tmp |
59 | 58 | ||
diff --git a/etc/profile-a-l/flowblade.profile b/etc/profile-a-l/flowblade.profile index a4421e3ce..bc173d0f1 100644 --- a/etc/profile-a-l/flowblade.profile +++ b/etc/profile-a-l/flowblade.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | 21 | ||
23 | caps.drop all | 22 | caps.drop all |
diff --git a/etc/profile-a-l/font-manager.profile b/etc/profile-a-l/font-manager.profile index cd0129436..02db368b7 100644 --- a/etc/profile-a-l/font-manager.profile +++ b/etc/profile-a-l/font-manager.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/fontforge.profile b/etc/profile-a-l/fontforge.profile index bd1495877..6020464b3 100644 --- a/etc/profile-a-l/fontforge.profile +++ b/etc/profile-a-l/fontforge.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-a-l/fractal.profile b/etc/profile-a-l/fractal.profile index 1b1d031b4..265eec1ca 100644 --- a/etc/profile-a-l/fractal.profile +++ b/etc/profile-a-l/fractal.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/freecad.profile b/etc/profile-a-l/freecad.profile index 8043d0530..827dc8be9 100644 --- a/etc/profile-a-l/freecad.profile +++ b/etc/profile-a-l/freecad.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-a-l/freeciv.profile b/etc/profile-a-l/freeciv.profile index 23c19682c..5126e2d37 100644 --- a/etc/profile-a-l/freeciv.profile +++ b/etc/profile-a-l/freeciv.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-a-l/freecol.profile b/etc/profile-a-l/freecol.profile index 93fa7da03..4467b5869 100644 --- a/etc/profile-a-l/freecol.profile +++ b/etc/profile-a-l/freecol.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
24 | 23 | ||
diff --git a/etc/profile-a-l/freemind.profile b/etc/profile-a-l/freemind.profile index 699177039..fbe3d45e3 100644 --- a/etc/profile-a-l/freemind.profile +++ b/etc/profile-a-l/freemind.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-a-l/freetube.profile b/etc/profile-a-l/freetube.profile index e6aff533d..aeed313c8 100644 --- a/etc/profile-a-l/freetube.profile +++ b/etc/profile-a-l/freetube.profile | |||
@@ -8,13 +8,15 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.config/FreeTube | 9 | noblacklist ${HOME}/.config/FreeTube |
10 | 10 | ||
11 | include allow-bin-sh.inc | ||
12 | |||
11 | include disable-shell.inc | 13 | include disable-shell.inc |
12 | 14 | ||
13 | mkdir ${HOME}/.config/FreeTube | 15 | mkdir ${HOME}/.config/FreeTube |
14 | whitelist ${HOME}/.config/FreeTube | 16 | whitelist ${HOME}/.config/FreeTube |
15 | 17 | ||
16 | private-bin freetube | 18 | private-bin electron,electron[0-9],electron[0-9][0-9],freetube,sh |
17 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg | 19 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg |
18 | 20 | ||
19 | # Redirect | 21 | # Redirect |
20 | include electron.profile | 22 | include electron.profile |
diff --git a/etc/profile-a-l/frogatto.profile b/etc/profile-a-l/frogatto.profile index b4ad81046..efd5246d6 100644 --- a/etc/profile-a-l/frogatto.profile +++ b/etc/profile-a-l/frogatto.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin frogatto,sh | 45 | private-bin frogatto,sh |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc machine-id | 48 | private-etc ld.so.preload,machine-id |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-a-l/frozen-bubble.profile b/etc/profile-a-l/frozen-bubble.profile index 76352e41e..bb35c9447 100644 --- a/etc/profile-a-l/frozen-bubble.profile +++ b/etc/profile-a-l/frozen-bubble.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-a-l/funnyboat.profile b/etc/profile-a-l/funnyboat.profile index 8852925b1..1009f345b 100644 --- a/etc/profile-a-l/funnyboat.profile +++ b/etc/profile-a-l/funnyboat.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | # include disable-shell.inc | 19 | # include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/gajim.profile b/etc/profile-a-l/gajim.profile index ed3f0357d..6d764a0f9 100644 --- a/etc/profile-a-l/gajim.profile +++ b/etc/profile-a-l/gajim.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | # Add 'ignore include disable-xdg.inc' to your gajim.local if you need to whitelist folders other than ~/Downloads. | 23 | # Add 'ignore include disable-xdg.inc' to your gajim.local if you need to whitelist folders other than ~/Downloads. |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
@@ -60,7 +59,7 @@ disable-mnt | |||
60 | private-bin bash,gajim,gajim-history-manager,gpg,gpg2,paplay,python*,sh,zsh | 59 | private-bin bash,gajim,gajim-history-manager,gpg,gpg2,paplay,python*,sh,zsh |
61 | private-cache | 60 | private-cache |
62 | private-dev | 61 | private-dev |
63 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,hostname,hosts,ld.so.cache,ld.so.conf,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl,xdg | 62 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.preload,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl,xdg |
64 | private-tmp | 63 | private-tmp |
65 | writable-run-user | 64 | writable-run-user |
66 | 65 | ||
diff --git a/etc/profile-a-l/galculator.profile b/etc/profile-a-l/galculator.profile index 550b3808b..c6280c488 100644 --- a/etc/profile-a-l/galculator.profile +++ b/etc/profile-a-l/galculator.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ tracelog | |||
44 | private-bin galculator | 43 | private-bin galculator |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,fonts | 46 | private-etc alternatives,fonts,ld.so.preload |
48 | private-lib | 47 | private-lib |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
diff --git a/etc/profile-a-l/gallery-dl.profile b/etc/profile-a-l/gallery-dl.profile new file mode 100644 index 000000000..a31dde21c --- /dev/null +++ b/etc/profile-a-l/gallery-dl.profile | |||
@@ -0,0 +1,18 @@ | |||
1 | # Firejail profile for gallery-dl | ||
2 | # Description: Downloader of images from various sites | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include gallery-dl.local | ||
7 | # Persistent global definitions | ||
8 | # added by included profile | ||
9 | #include globals.local | ||
10 | |||
11 | noblacklist ${HOME}/.config/gallery-dl | ||
12 | noblacklist ${HOME}/.gallery-dl.conf | ||
13 | |||
14 | private-bin gallery-dl | ||
15 | private-etc gallery-dl.conf,ld.so.preload | ||
16 | |||
17 | # Redirect | ||
18 | include youtube-dl.profile | ||
diff --git a/etc/profile-a-l/gapplication.profile b/etc/profile-a-l/gapplication.profile index 3a8c055f2..e9eb55709 100644 --- a/etc/profile-a-l/gapplication.profile +++ b/etc/profile-a-l/gapplication.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ private | |||
50 | private-bin gapplication | 49 | private-bin gapplication |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc none | 52 | private-etc ld.so.preload,none |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
56 | # Add the next line to your gapplication.local to filter D-Bus names. | 55 | # Add the next line to your gapplication.local to filter D-Bus names. |
diff --git a/etc/profile-a-l/gcloud.profile b/etc/profile-a-l/gcloud.profile index 388f4c0df..297e5d345 100644 --- a/etc/profile-a-l/gcloud.profile +++ b/etc/profile-a-l/gcloud.profile | |||
@@ -36,7 +36,7 @@ tracelog | |||
36 | 36 | ||
37 | disable-mnt | 37 | disable-mnt |
38 | private-dev | 38 | private-dev |
39 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,localtime,nsswitch.conf,pki,resolv.conf,ssl | 39 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,pki,resolv.conf,ssl |
40 | private-tmp | 40 | private-tmp |
41 | 41 | ||
42 | dbus-user none | 42 | dbus-user none |
diff --git a/etc/profile-a-l/gconf.profile b/etc/profile-a-l/gconf.profile index fec1a555a..6532d85f0 100644 --- a/etc/profile-a-l/gconf.profile +++ b/etc/profile-a-l/gconf.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
24 | 23 | ||
@@ -55,7 +54,7 @@ disable-mnt | |||
55 | private-bin gconf-editor,gconf-merge-*,gconfpkg,gconftool-2,gsettings-*-convert,python2* | 54 | private-bin gconf-editor,gconf-merge-*,gconfpkg,gconftool-2,gsettings-*-convert,python2* |
56 | private-cache | 55 | private-cache |
57 | private-dev | 56 | private-dev |
58 | private-etc alternatives,fonts,gconf | 57 | private-etc alternatives,fonts,gconf,ld.so.preload |
59 | private-lib GConf,libpython*,python2* | 58 | private-lib GConf,libpython*,python2* |
60 | private-tmp | 59 | private-tmp |
61 | 60 | ||
diff --git a/etc/profile-a-l/geany.profile b/etc/profile-a-l/geany.profile index 6fdb9b37a..f244cb526 100644 --- a/etc/profile-a-l/geany.profile +++ b/etc/profile-a-l/geany.profile | |||
@@ -12,7 +12,6 @@ noblacklist ${HOME}/.config/geany | |||
12 | include allow-common-devel.inc | 12 | include allow-common-devel.inc |
13 | 13 | ||
14 | include disable-common.inc | 14 | include disable-common.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | caps.drop all | 17 | caps.drop all |
diff --git a/etc/profile-a-l/geary.profile b/etc/profile-a-l/geary.profile index 74e135a7c..b78f7e647 100644 --- a/etc/profile-a-l/geary.profile +++ b/etc/profile-a-l/geary.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-shell.inc | 23 | include disable-shell.inc |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
@@ -71,7 +70,7 @@ tracelog | |||
71 | private-bin geary | 70 | private-bin geary |
72 | private-cache | 71 | private-cache |
73 | private-dev | 72 | private-dev |
74 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,ssl,xdg | 73 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.preload,pki,resolv.conf,ssl,xdg |
75 | private-tmp | 74 | private-tmp |
76 | 75 | ||
77 | dbus-user filter | 76 | dbus-user filter |
diff --git a/etc/profile-a-l/gedit.profile b/etc/profile-a-l/gedit.profile index 108b7041d..0726d17bd 100644 --- a/etc/profile-a-l/gedit.profile +++ b/etc/profile-a-l/gedit.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | # include disable-devel.inc | 16 | # include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | # include disable-interpreters.inc | 18 | # include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | include whitelist-runuser-common.inc | 21 | include whitelist-runuser-common.inc |
diff --git a/etc/profile-a-l/geekbench.profile b/etc/profile-a-l/geekbench.profile index e0aadff24..4812e1368 100644 --- a/etc/profile-a-l/geekbench.profile +++ b/etc/profile-a-l/geekbench.profile | |||
@@ -6,14 +6,19 @@ include geekbench.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.geekbench5 | ||
10 | noblacklist /sbin | ||
11 | noblacklist /usr/sbin | ||
12 | |||
9 | include disable-common.inc | 13 | include disable-common.inc |
10 | include disable-devel.inc | 14 | include disable-devel.inc |
11 | include disable-exec.inc | 15 | include disable-exec.inc |
12 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 17 | include disable-programs.inc |
15 | include disable-xdg.inc | 18 | include disable-xdg.inc |
16 | 19 | ||
20 | mkdir ${HOME}/.geekbench5 | ||
21 | whitelist ${HOME}/.geekbench5 | ||
17 | include whitelist-common.inc | 22 | include whitelist-common.inc |
18 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
19 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
@@ -40,16 +45,14 @@ shell none | |||
40 | tracelog | 45 | tracelog |
41 | 46 | ||
42 | disable-mnt | 47 | disable-mnt |
43 | private-bin bash,geekbenc*,sh | 48 | #private-bin bash,geekbench*,sh -- #4576 |
44 | private-cache | 49 | private-cache |
45 | private-dev | 50 | private-dev |
46 | private-etc alternatives,group,lsb-release,passwd | 51 | private-etc alternatives,group,ld.so.preload,lsb-release,passwd |
47 | private-lib gcc/*/*/libstdc++.so.* | ||
48 | private-opt none | ||
49 | private-tmp | 52 | private-tmp |
50 | 53 | ||
51 | dbus-user none | 54 | dbus-user none |
52 | dbus-system none | 55 | dbus-system none |
53 | 56 | ||
54 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | ||
55 | read-only ${HOME} | 57 | read-only ${HOME} |
58 | read-write ${HOME}/.geekbench5 | ||
diff --git a/etc/profile-a-l/geeqie.profile b/etc/profile-a-l/geeqie.profile index dd33b3fb5..fbb509d89 100644 --- a/etc/profile-a-l/geeqie.profile +++ b/etc/profile-a-l/geeqie.profile | |||
@@ -13,7 +13,6 @@ noblacklist ${HOME}/.local/share/geeqie | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | caps.drop all | 18 | caps.drop all |
diff --git a/etc/profile-a-l/gfeeds.profile b/etc/profile-a-l/gfeeds.profile index f894a42ca..388f6496d 100644 --- a/etc/profile-a-l/gfeeds.profile +++ b/etc/profile-a-l/gfeeds.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/gget.profile b/etc/profile-a-l/gget.profile index d9c5a0d9a..d8ca4ae41 100644 --- a/etc/profile-a-l/gget.profile +++ b/etc/profile-a-l/gget.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ disable-mnt | |||
50 | private-bin gget | 49 | private-bin gget |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl | 52 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,pki,resolv.conf,ssl |
54 | private-lib | 53 | private-lib |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
diff --git a/etc/profile-a-l/ghostwriter.profile b/etc/profile-a-l/ghostwriter.profile index 276ab76df..3dfdc0184 100644 --- a/etc/profile-a-l/ghostwriter.profile +++ b/etc/profile-a-l/ghostwriter.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/gimp.profile b/etc/profile-a-l/gimp.profile index dfc1304d1..df9c2ac7a 100644 --- a/etc/profile-a-l/gimp.profile +++ b/etc/profile-a-l/gimp.profile | |||
@@ -13,7 +13,6 @@ include globals.local | |||
13 | #ignore net | 13 | #ignore net |
14 | #protocol unix,inet,inet6 | 14 | #protocol unix,inet,inet6 |
15 | 15 | ||
16 | |||
17 | # gimp plugins are installed by the user in ${HOME}/.gimp-2.8/plug-ins/ directory | 16 | # gimp plugins are installed by the user in ${HOME}/.gimp-2.8/plug-ins/ directory |
18 | # If you are not using external plugins, you can add 'noexec ${HOME}' to your gimp.local. | 17 | # If you are not using external plugins, you can add 'noexec ${HOME}' to your gimp.local. |
19 | ignore noexec ${HOME} | 18 | ignore noexec ${HOME} |
@@ -26,10 +25,13 @@ noblacklist ${HOME}/.gimp* | |||
26 | noblacklist ${DOCUMENTS} | 25 | noblacklist ${DOCUMENTS} |
27 | noblacklist ${PICTURES} | 26 | noblacklist ${PICTURES} |
28 | 27 | ||
28 | # See issue #4367, gimp 2.10.22-3: gegl:introspect broken | ||
29 | noblacklist /sbin | ||
30 | noblacklist /usr/sbin | ||
31 | |||
29 | include disable-common.inc | 32 | include disable-common.inc |
30 | include disable-exec.inc | 33 | include disable-exec.inc |
31 | include disable-devel.inc | 34 | include disable-devel.inc |
32 | include disable-passwdmgr.inc | ||
33 | include disable-programs.inc | 35 | include disable-programs.inc |
34 | include disable-xdg.inc | 36 | include disable-xdg.inc |
35 | 37 | ||
diff --git a/etc/profile-a-l/gist.profile b/etc/profile-a-l/gist.profile index 661c3a375..010cdae06 100644 --- a/etc/profile-a-l/gist.profile +++ b/etc/profile-a-l/gist.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
25 | 24 | ||
@@ -53,7 +52,7 @@ tracelog | |||
53 | disable-mnt | 52 | disable-mnt |
54 | private-cache | 53 | private-cache |
55 | private-dev | 54 | private-dev |
56 | private-etc alternatives | 55 | private-etc alternatives,ld.so.preload |
57 | private-tmp | 56 | private-tmp |
58 | 57 | ||
59 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-a-l/git-cola.profile b/etc/profile-a-l/git-cola.profile index 5e4249376..c13273321 100644 --- a/etc/profile-a-l/git-cola.profile +++ b/etc/profile-a-l/git-cola.profile | |||
@@ -28,7 +28,6 @@ include disable-common.inc | |||
28 | include disable-devel.inc | 28 | include disable-devel.inc |
29 | include disable-exec.inc | 29 | include disable-exec.inc |
30 | include disable-interpreters.inc | 30 | include disable-interpreters.inc |
31 | include disable-passwdmgr.inc | ||
32 | include disable-programs.inc | 31 | include disable-programs.inc |
33 | include disable-xdg.inc | 32 | include disable-xdg.inc |
34 | 33 | ||
@@ -71,7 +70,7 @@ tracelog | |||
71 | private-bin basename,bash,cola,envsubst,gettext,git,git-cola,git-dag,git-gui,gitk,gpg,gpg-agent,nano,ps,python*,sh,ssh,ssh-agent,tclsh,tr,wc,which,xed | 70 | private-bin basename,bash,cola,envsubst,gettext,git,git-cola,git-dag,git-gui,gitk,gpg,gpg-agent,nano,ps,python*,sh,ssh,ssh-agent,tclsh,tr,wc,which,xed |
72 | private-cache | 71 | private-cache |
73 | private-dev | 72 | private-dev |
74 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gitconfig,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,localtime,login.defs,machine-id,mime.types,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssh,ssl,X11,xdg | 73 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gitconfig,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,localtime,login.defs,machine-id,mime.types,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssh,ssl,X11,xdg |
75 | private-tmp | 74 | private-tmp |
76 | writable-run-user | 75 | writable-run-user |
77 | 76 | ||
diff --git a/etc/profile-a-l/git.profile b/etc/profile-a-l/git.profile index bfa0081c6..b0318e4a3 100644 --- a/etc/profile-a-l/git.profile +++ b/etc/profile-a-l/git.profile | |||
@@ -26,7 +26,6 @@ blacklist ${RUNUSER}/wayland-* | |||
26 | 26 | ||
27 | include disable-common.inc | 27 | include disable-common.inc |
28 | include disable-exec.inc | 28 | include disable-exec.inc |
29 | include disable-passwdmgr.inc | ||
30 | include disable-programs.inc | 29 | include disable-programs.inc |
31 | 30 | ||
32 | whitelist /usr/share/git | 31 | whitelist /usr/share/git |
diff --git a/etc/profile-a-l/gitg.profile b/etc/profile-a-l/gitg.profile index 05d7dffa9..314b797c0 100644 --- a/etc/profile-a-l/gitg.profile +++ b/etc/profile-a-l/gitg.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | 22 | ||
24 | #whitelist ${HOME}/YOUR_GIT_PROJECTS_DIRECTORY | 23 | #whitelist ${HOME}/YOUR_GIT_PROJECTS_DIRECTORY |
diff --git a/etc/profile-a-l/gitter.profile b/etc/profile-a-l/gitter.profile index 460e2b990..36b016e02 100644 --- a/etc/profile-a-l/gitter.profile +++ b/etc/profile-a-l/gitter.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/.config/Gitter | 17 | mkdir ${HOME}/.config/Gitter |
@@ -38,7 +37,7 @@ shell none | |||
38 | 37 | ||
39 | disable-mnt | 38 | disable-mnt |
40 | private-bin bash,env,gitter | 39 | private-bin bash,env,gitter |
41 | private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,pulse,resolv.conf,ssl | 40 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,pki,pulse,resolv.conf,ssl |
42 | private-opt Gitter | 41 | private-opt Gitter |
43 | private-dev | 42 | private-dev |
44 | private-tmp | 43 | private-tmp |
diff --git a/etc/profile-a-l/gjs.profile b/etc/profile-a-l/gjs.profile index ed68b3c2d..a52272852 100644 --- a/etc/profile-a-l/gjs.profile +++ b/etc/profile-a-l/gjs.profile | |||
@@ -19,7 +19,6 @@ include allow-gjs.inc | |||
19 | include disable-common.inc | 19 | include disable-common.inc |
20 | include disable-devel.inc | 20 | include disable-devel.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | 23 | ||
25 | include whitelist-runuser-common.inc | 24 | include whitelist-runuser-common.inc |
diff --git a/etc/profile-a-l/gl-117.profile b/etc/profile-a-l/gl-117.profile index c8cefc67e..35d969e6d 100644 --- a/etc/profile-a-l/gl-117.profile +++ b/etc/profile-a-l/gl-117.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/glaxium.profile b/etc/profile-a-l/glaxium.profile index ee7af0546..dec0daef2 100644 --- a/etc/profile-a-l/glaxium.profile +++ b/etc/profile-a-l/glaxium.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/globaltime.profile b/etc/profile-a-l/globaltime.profile index 14b3ef811..d07f0ace4 100644 --- a/etc/profile-a-l/globaltime.profile +++ b/etc/profile-a-l/globaltime.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
17 | 16 | ||
diff --git a/etc/profile-a-l/gmpc.profile b/etc/profile-a-l/gmpc.profile index b3aad8b2c..0a1264888 100644 --- a/etc/profile-a-l/gmpc.profile +++ b/etc/profile-a-l/gmpc.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
@@ -45,7 +44,7 @@ tracelog | |||
45 | disable-mnt | 44 | disable-mnt |
46 | #private-bin gmpc | 45 | #private-bin gmpc |
47 | private-cache | 46 | private-cache |
48 | private-etc alternatives,fonts | 47 | private-etc alternatives,fonts,ld.so.preload |
49 | private-tmp | 48 | private-tmp |
50 | writable-run-user | 49 | writable-run-user |
51 | 50 | ||
diff --git a/etc/profile-a-l/gnome-books.profile b/etc/profile-a-l/gnome-books.profile index 34a7f557c..5b7eaa78d 100644 --- a/etc/profile-a-l/gnome-books.profile +++ b/etc/profile-a-l/gnome-books.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-a-l/gnome-builder.profile b/etc/profile-a-l/gnome-builder.profile index 37ca5aeff..9fe9ed6ba 100644 --- a/etc/profile-a-l/gnome-builder.profile +++ b/etc/profile-a-l/gnome-builder.profile | |||
@@ -16,7 +16,6 @@ noblacklist ${HOME}/.local/share/gnome-builder | |||
16 | include allow-common-devel.inc | 16 | include allow-common-devel.inc |
17 | 17 | ||
18 | include disable-common.inc | 18 | include disable-common.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | include whitelist-runuser-common.inc | 21 | include whitelist-runuser-common.inc |
diff --git a/etc/profile-a-l/gnome-calculator.profile b/etc/profile-a-l/gnome-calculator.profile index 4c465cc49..ac130da21 100644 --- a/etc/profile-a-l/gnome-calculator.profile +++ b/etc/profile-a-l/gnome-calculator.profile | |||
@@ -10,7 +10,6 @@ include globals.local | |||
10 | include disable-common.inc | 10 | include disable-common.inc |
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
diff --git a/etc/profile-a-l/gnome-calendar.profile b/etc/profile-a-l/gnome-calendar.profile index eaf25b177..2c1dee50c 100644 --- a/etc/profile-a-l/gnome-calendar.profile +++ b/etc/profile-a-l/gnome-calendar.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ private | |||
46 | private-bin gnome-calendar | 45 | private-bin gnome-calendar |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,nsswitch.conf,pki,resolv.conf,ssl | 48 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,ld.so.preload,localtime,nsswitch.conf,pki,resolv.conf,ssl |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | dbus-user filter | 51 | dbus-user filter |
diff --git a/etc/profile-a-l/gnome-characters.profile b/etc/profile-a-l/gnome-characters.profile index 741fe9bf7..aaa1e3f5a 100644 --- a/etc/profile-a-l/gnome-characters.profile +++ b/etc/profile-a-l/gnome-characters.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/gnome-chess.profile b/etc/profile-a-l/gnome-chess.profile index bd39f625c..6261fcc27 100644 --- a/etc/profile-a-l/gnome-chess.profile +++ b/etc/profile-a-l/gnome-chess.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -51,5 +50,5 @@ disable-mnt | |||
51 | private-bin fairymax,gnome-chess,gnuchess,hoichess | 50 | private-bin fairymax,gnome-chess,gnuchess,hoichess |
52 | private-cache | 51 | private-cache |
53 | private-dev | 52 | private-dev |
54 | private-etc alternatives,dconf,fonts,gnome-chess,gtk-3.0 | 53 | private-etc alternatives,dconf,fonts,gnome-chess,gtk-3.0,ld.so.preload |
55 | private-tmp | 54 | private-tmp |
diff --git a/etc/profile-a-l/gnome-clocks.profile b/etc/profile-a-l/gnome-clocks.profile index 1e7c70b84..7d33ac94e 100644 --- a/etc/profile-a-l/gnome-clocks.profile +++ b/etc/profile-a-l/gnome-clocks.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -43,6 +42,6 @@ disable-mnt | |||
43 | private-bin gnome-clocks,gsound-play | 42 | private-bin gnome-clocks,gsound-play |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,localtime,machine-id,pkcs11,pki,ssl | 45 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.preload,localtime,machine-id,pkcs11,pki,ssl |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
diff --git a/etc/profile-a-l/gnome-contacts.profile b/etc/profile-a-l/gnome-contacts.profile index dcc6163b6..f96f750dd 100644 --- a/etc/profile-a-l/gnome-contacts.profile +++ b/etc/profile-a-l/gnome-contacts.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-a-l/gnome-documents.profile b/etc/profile-a-l/gnome-documents.profile index 29ad67af8..0ed3c7541 100644 --- a/etc/profile-a-l/gnome-documents.profile +++ b/etc/profile-a-l/gnome-documents.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
24 | 23 | ||
diff --git a/etc/profile-a-l/gnome-font-viewer.profile b/etc/profile-a-l/gnome-font-viewer.profile index aa0844b8b..294729152 100644 --- a/etc/profile-a-l/gnome-font-viewer.profile +++ b/etc/profile-a-l/gnome-font-viewer.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
17 | 16 | ||
diff --git a/etc/profile-a-l/gnome-hexgl.profile b/etc/profile-a-l/gnome-hexgl.profile index 2db956faf..28c7e3346 100644 --- a/etc/profile-a-l/gnome-hexgl.profile +++ b/etc/profile-a-l/gnome-hexgl.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -43,7 +42,7 @@ private | |||
43 | private-bin gnome-hexgl | 42 | private-bin gnome-hexgl |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc alsa,asound.conf,machine-id,pulse | 45 | private-etc alsa,asound.conf,ld.so.preload,machine-id,pulse |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-a-l/gnome-keyring.profile b/etc/profile-a-l/gnome-keyring.profile index 25b4c47de..b74325102 100644 --- a/etc/profile-a-l/gnome-keyring.profile +++ b/etc/profile-a-l/gnome-keyring.profile | |||
@@ -12,7 +12,6 @@ noblacklist ${HOME}/.gnupg | |||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/gnome-latex.profile b/etc/profile-a-l/gnome-latex.profile index 1a7eafeca..1d2366365 100644 --- a/etc/profile-a-l/gnome-latex.profile +++ b/etc/profile-a-l/gnome-latex.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | whitelist /usr/share/gnome-latex | 21 | whitelist /usr/share/gnome-latex |
@@ -49,6 +48,6 @@ tracelog | |||
49 | private-cache | 48 | private-cache |
50 | private-dev | 49 | private-dev |
51 | # passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed | 50 | # passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed |
52 | private-etc alternatives,dconf,fonts,gtk-3.0,latexmk.conf,login.defs,passwd,texlive | 51 | private-etc alternatives,dconf,fonts,gtk-3.0,latexmk.conf,ld.so.preload,login.defs,passwd,texlive |
53 | 52 | ||
54 | dbus-system none | 53 | dbus-system none |
diff --git a/etc/profile-a-l/gnome-logs.profile b/etc/profile-a-l/gnome-logs.profile index 9d2ea7b7b..3d8218e99 100644 --- a/etc/profile-a-l/gnome-logs.profile +++ b/etc/profile-a-l/gnome-logs.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -41,7 +40,7 @@ disable-mnt | |||
41 | private-bin gnome-logs | 40 | private-bin gnome-logs |
42 | private-cache | 41 | private-cache |
43 | private-dev | 42 | private-dev |
44 | private-etc alternatives,fonts,localtime,machine-id | 43 | private-etc alternatives,fonts,ld.so.preload,localtime,machine-id |
45 | private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* | 44 | private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* |
46 | private-tmp | 45 | private-tmp |
47 | writable-var-log | 46 | writable-var-log |
diff --git a/etc/profile-a-l/gnome-maps.profile b/etc/profile-a-l/gnome-maps.profile index 23aab343f..7732117ac 100644 --- a/etc/profile-a-l/gnome-maps.profile +++ b/etc/profile-a-l/gnome-maps.profile | |||
@@ -24,7 +24,6 @@ include disable-common.inc | |||
24 | include disable-devel.inc | 24 | include disable-devel.inc |
25 | include disable-exec.inc | 25 | include disable-exec.inc |
26 | include disable-interpreters.inc | 26 | include disable-interpreters.inc |
27 | include disable-passwdmgr.inc | ||
28 | include disable-programs.inc | 27 | include disable-programs.inc |
29 | include disable-shell.inc | 28 | include disable-shell.inc |
30 | include disable-xdg.inc | 29 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/gnome-mplayer.profile b/etc/profile-a-l/gnome-mplayer.profile index 43fe71f5e..f8f40ea54 100644 --- a/etc/profile-a-l/gnome-mplayer.profile +++ b/etc/profile-a-l/gnome-mplayer.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-a-l/gnome-music.profile b/etc/profile-a-l/gnome-music.profile index 2fcbe9910..fe8268530 100644 --- a/etc/profile-a-l/gnome-music.profile +++ b/etc/profile-a-l/gnome-music.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
@@ -43,6 +42,6 @@ tracelog | |||
43 | # private-bin calls a file manager - whatever is installed! | 42 | # private-bin calls a file manager - whatever is installed! |
44 | #private-bin env,gio-launch-desktop,gnome-music,python*,yelp | 43 | #private-bin env,gio-launch-desktop,gnome-music,python*,yelp |
45 | private-dev | 44 | private-dev |
46 | private-etc alternatives,asound.conf,dconf,fonts,fonts,gtk-3.0,machine-id,pulse,selinux,xdg | 45 | private-etc alternatives,asound.conf,dconf,fonts,fonts,gtk-3.0,ld.so.preload,machine-id,pulse,selinux,xdg |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
diff --git a/etc/profile-a-l/gnome-nettool.profile b/etc/profile-a-l/gnome-nettool.profile index 814751db3..abf3dd759 100644 --- a/etc/profile-a-l/gnome-nettool.profile +++ b/etc/profile-a-l/gnome-nettool.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-xdg.inc | 14 | include disable-xdg.inc |
16 | 15 | ||
diff --git a/etc/profile-a-l/gnome-passwordsafe.profile b/etc/profile-a-l/gnome-passwordsafe.profile index fee5f88b9..bdc09b5ac 100644 --- a/etc/profile-a-l/gnome-passwordsafe.profile +++ b/etc/profile-a-l/gnome-passwordsafe.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-shell.inc | 23 | include disable-shell.inc |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
@@ -54,7 +53,7 @@ disable-mnt | |||
54 | private-bin gnome-passwordsafe,python3* | 53 | private-bin gnome-passwordsafe,python3* |
55 | private-cache | 54 | private-cache |
56 | private-dev | 55 | private-dev |
57 | private-etc dconf,fonts,gtk-3.0,passwd | 56 | private-etc dconf,fonts,gtk-3.0,ld.so.preload,passwd |
58 | private-tmp | 57 | private-tmp |
59 | 58 | ||
60 | dbus-user filter | 59 | dbus-user filter |
diff --git a/etc/profile-a-l/gnome-photos.profile b/etc/profile-a-l/gnome-photos.profile index 58bf3f349..4fd78eaab 100644 --- a/etc/profile-a-l/gnome-photos.profile +++ b/etc/profile-a-l/gnome-photos.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | include whitelist-runuser-common.inc | 19 | include whitelist-runuser-common.inc |
diff --git a/etc/profile-a-l/gnome-pie.profile b/etc/profile-a-l/gnome-pie.profile index 41903b136..fb108ee97 100644 --- a/etc/profile-a-l/gnome-pie.profile +++ b/etc/profile-a-l/gnome-pie.profile | |||
@@ -12,7 +12,6 @@ noblacklist ${HOME}/.config/gnome-pie | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | #include disable-interpreters.inc | 14 | #include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | #include disable-programs.inc | 15 | #include disable-programs.inc |
17 | 16 | ||
18 | caps.drop all | 17 | caps.drop all |
@@ -35,7 +34,7 @@ shell none | |||
35 | disable-mnt | 34 | disable-mnt |
36 | private-cache | 35 | private-cache |
37 | private-dev | 36 | private-dev |
38 | private-etc alternatives,fonts,machine-id | 37 | private-etc alternatives,fonts,ld.so.preload,machine-id |
39 | private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* | 38 | private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* |
40 | private-tmp | 39 | private-tmp |
41 | 40 | ||
diff --git a/etc/profile-a-l/gnome-pomodoro.profile b/etc/profile-a-l/gnome-pomodoro.profile index c2ba7556d..256a0c69f 100644 --- a/etc/profile-a-l/gnome-pomodoro.profile +++ b/etc/profile-a-l/gnome-pomodoro.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-a-l/gnome-recipes.profile b/etc/profile-a-l/gnome-recipes.profile index 48c98ebe0..9a5f878fc 100644 --- a/etc/profile-a-l/gnome-recipes.profile +++ b/etc/profile-a-l/gnome-recipes.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | 19 | ||
@@ -48,7 +47,7 @@ shell none | |||
48 | disable-mnt | 47 | disable-mnt |
49 | private-bin gnome-recipes,tar | 48 | private-bin gnome-recipes,tar |
50 | private-dev | 49 | private-dev |
51 | private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl | 50 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,pki,ssl |
52 | private-lib gdk-pixbuf-2.0,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,libgnutls.so.*,libjpeg.so.*,libp11-kit.so.*,libproxy.so.*,librsvg-2.so.* | 51 | private-lib gdk-pixbuf-2.0,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,libgnutls.so.*,libjpeg.so.*,libp11-kit.so.*,libproxy.so.*,librsvg-2.so.* |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
diff --git a/etc/profile-a-l/gnome-ring.profile b/etc/profile-a-l/gnome-ring.profile index 78ceb9c4f..7ee01dec1 100644 --- a/etc/profile-a-l/gnome-ring.profile +++ b/etc/profile-a-l/gnome-ring.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | include whitelist-var-common.inc | 16 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/gnome-schedule.profile b/etc/profile-a-l/gnome-schedule.profile index 69c90b33d..8c3db651f 100644 --- a/etc/profile-a-l/gnome-schedule.profile +++ b/etc/profile-a-l/gnome-schedule.profile | |||
@@ -29,7 +29,6 @@ include disable-common.inc | |||
29 | include disable-devel.inc | 29 | include disable-devel.inc |
30 | include disable-exec.inc | 30 | include disable-exec.inc |
31 | include disable-interpreters.inc | 31 | include disable-interpreters.inc |
32 | include disable-passwdmgr.inc | ||
33 | include disable-programs.inc | 32 | include disable-programs.inc |
34 | include disable-xdg.inc | 33 | include disable-xdg.inc |
35 | 34 | ||
diff --git a/etc/profile-a-l/gnome-screenshot.profile b/etc/profile-a-l/gnome-screenshot.profile index b683b6f6c..a4e4ae38a 100644 --- a/etc/profile-a-l/gnome-screenshot.profile +++ b/etc/profile-a-l/gnome-screenshot.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -43,7 +42,7 @@ tracelog | |||
43 | disable-mnt | 42 | disable-mnt |
44 | private-bin gnome-screenshot | 43 | private-bin gnome-screenshot |
45 | private-dev | 44 | private-dev |
46 | private-etc dconf,fonts,gtk-3.0,localtime,machine-id | 45 | private-etc dconf,fonts,gtk-3.0,ld.so.preload,localtime,machine-id |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | dbus-user filter | 48 | dbus-user filter |
diff --git a/etc/profile-a-l/gnome-sound-recorder.profile b/etc/profile-a-l/gnome-sound-recorder.profile index 34f5fdeff..859d56bd9 100644 --- a/etc/profile-a-l/gnome-sound-recorder.profile +++ b/etc/profile-a-l/gnome-sound-recorder.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
@@ -41,5 +40,5 @@ tracelog | |||
41 | disable-mnt | 40 | disable-mnt |
42 | private-cache | 41 | private-cache |
43 | private-dev | 42 | private-dev |
44 | private-etc alsa,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,machine-id,openal,pango,pulse,xdg | 43 | private-etc alsa,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.preload,machine-id,openal,pango,pulse,xdg |
45 | private-tmp | 44 | private-tmp |
diff --git a/etc/profile-a-l/gnome-system-log.profile b/etc/profile-a-l/gnome-system-log.profile index 8a818695d..addd76f7f 100644 --- a/etc/profile-a-l/gnome-system-log.profile +++ b/etc/profile-a-l/gnome-system-log.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin gnome-system-log | 43 | private-bin gnome-system-log |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,fonts,localtime,machine-id | 46 | private-etc alternatives,fonts,ld.so.preload,localtime,machine-id |
48 | private-lib | 47 | private-lib |
49 | private-tmp | 48 | private-tmp |
50 | writable-var-log | 49 | writable-var-log |
diff --git a/etc/profile-a-l/gnome-todo.profile b/etc/profile-a-l/gnome-todo.profile index 3b147cd48..e7615e4f2 100644 --- a/etc/profile-a-l/gnome-todo.profile +++ b/etc/profile-a-l/gnome-todo.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -47,7 +46,7 @@ disable-mnt | |||
47 | private-bin gnome-todo | 46 | private-bin gnome-todo |
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | private-etc dconf,fonts,gtk-3.0,localtime,passwd,xdg | 49 | private-etc dconf,fonts,gtk-3.0,ld.so.preload,localtime,passwd,xdg |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
53 | dbus-user filter | 52 | dbus-user filter |
diff --git a/etc/profile-a-l/gnome-twitch.profile b/etc/profile-a-l/gnome-twitch.profile index b8ec195d3..aef6b0fdd 100644 --- a/etc/profile-a-l/gnome-twitch.profile +++ b/etc/profile-a-l/gnome-twitch.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.cache/gnome-twitch | 18 | mkdir ${HOME}/.cache/gnome-twitch |
diff --git a/etc/profile-a-l/gnome-weather.profile b/etc/profile-a-l/gnome-weather.profile index 2e08fa41d..5592879ec 100644 --- a/etc/profile-a-l/gnome-weather.profile +++ b/etc/profile-a-l/gnome-weather.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-a-l/gnome_games-common.profile b/etc/profile-a-l/gnome_games-common.profile index 5627842f5..a76fbbb2c 100644 --- a/etc/profile-a-l/gnome_games-common.profile +++ b/etc/profile-a-l/gnome_games-common.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -42,7 +41,7 @@ tracelog | |||
42 | disable-mnt | 41 | disable-mnt |
43 | private-cache | 42 | private-cache |
44 | private-dev | 43 | private-dev |
45 | private-etc dconf,fonts,gconf,gtk-2.0,gtk-3.0,machine-id,pango,passwd,X11 | 44 | private-etc dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.preload,machine-id,pango,passwd,X11 |
46 | private-tmp | 45 | private-tmp |
47 | 46 | ||
48 | dbus-user filter | 47 | dbus-user filter |
diff --git a/etc/profile-a-l/gnote.profile b/etc/profile-a-l/gnote.profile index c3014a288..deda06f8e 100644 --- a/etc/profile-a-l/gnote.profile +++ b/etc/profile-a-l/gnote.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -22,6 +21,7 @@ mkdir ${HOME}/.config/gnote | |||
22 | mkdir ${HOME}/.local/share/gnote | 21 | mkdir ${HOME}/.local/share/gnote |
23 | whitelist ${HOME}/.config/gnote | 22 | whitelist ${HOME}/.config/gnote |
24 | whitelist ${HOME}/.local/share/gnote | 23 | whitelist ${HOME}/.local/share/gnote |
24 | whitelist /usr/libexec/webkit2gtk-4.0 | ||
25 | whitelist /usr/share/gnote | 25 | whitelist /usr/share/gnote |
26 | include whitelist-common.inc | 26 | include whitelist-common.inc |
27 | include whitelist-runuser-common.inc | 27 | include whitelist-runuser-common.inc |
@@ -51,7 +51,7 @@ disable-mnt | |||
51 | private-bin gnote | 51 | private-bin gnote |
52 | private-cache | 52 | private-cache |
53 | private-dev | 53 | private-dev |
54 | private-etc dconf,fonts,gtk-3.0,pango,X11 | 54 | private-etc dconf,fonts,gtk-3.0,ld.so.preload,pango,X11 |
55 | private-tmp | 55 | private-tmp |
56 | 56 | ||
57 | dbus-user filter | 57 | dbus-user filter |
diff --git a/etc/profile-a-l/gnubik.profile b/etc/profile-a-l/gnubik.profile index 22851ce9f..e2e154216 100644 --- a/etc/profile-a-l/gnubik.profile +++ b/etc/profile-a-l/gnubik.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ private | |||
44 | private-bin gnubik | 43 | private-bin gnubik |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc drirc,fonts,gtk-2.0 | 46 | private-etc drirc,fonts,gtk-2.0,ld.so.preload |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-a-l/godot.profile b/etc/profile-a-l/godot.profile index 09ca17caa..f33f63497 100644 --- a/etc/profile-a-l/godot.profile +++ b/etc/profile-a-l/godot.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -39,7 +38,7 @@ tracelog | |||
39 | # private-bin godot | 38 | # private-bin godot |
40 | private-cache | 39 | private-cache |
41 | private-dev | 40 | private-dev |
42 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,machine-id,mono,nsswitch.conf,openal,pki,pulse,resolv.conf,ssl | 41 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,ld.so.preload,machine-id,mono,nsswitch.conf,openal,pki,pulse,resolv.conf,ssl |
43 | private-tmp | 42 | private-tmp |
44 | 43 | ||
45 | dbus-user none | 44 | dbus-user none |
diff --git a/etc/profile-a-l/goldendict.profile b/etc/profile-a-l/goldendict.profile new file mode 100644 index 000000000..59a572319 --- /dev/null +++ b/etc/profile-a-l/goldendict.profile | |||
@@ -0,0 +1,57 @@ | |||
1 | # Firejail profile for goldendict | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include goldendict.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | noblacklist ${HOME}/.goldendict | ||
9 | noblacklist ${HOME}/.cache/GoldenDict | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-programs.inc | ||
16 | include disable-shell.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.goldendict | ||
20 | mkdir ${HOME}/.cache/GoldenDict | ||
21 | whitelist ${HOME}/.goldendict | ||
22 | whitelist ${HOME}/.cache/GoldenDict | ||
23 | # The default path of dictionaries | ||
24 | whitelist /usr/share/stardict/dic | ||
25 | include whitelist-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | netfilter | ||
33 | # no3d leads to the libGL MESA-LOADER errors | ||
34 | #no3d | ||
35 | nodvd | ||
36 | nogroups | ||
37 | noinput | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix,inet,inet6,netlink | ||
44 | seccomp | ||
45 | seccomp.block-secondary | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | disable-mnt | ||
50 | private-bin goldendict | ||
51 | private-cache | ||
52 | private-dev | ||
53 | private-etc ca-certificates,crypto-policies,fonts,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl | ||
54 | private-tmp | ||
55 | |||
56 | dbus-user none | ||
57 | dbus-system none | ||
diff --git a/etc/profile-a-l/goobox.profile b/etc/profile-a-l/goobox.profile index 8399d77c4..2ff3bc8d9 100644 --- a/etc/profile-a-l/goobox.profile +++ b/etc/profile-a-l/goobox.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${MUSIC} | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
17 | 16 | ||
diff --git a/etc/profile-a-l/google-earth.profile b/etc/profile-a-l/google-earth.profile index 65ac04771..0153a58d1 100644 --- a/etc/profile-a-l/google-earth.profile +++ b/etc/profile-a-l/google-earth.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/.config/Google | 17 | mkdir ${HOME}/.config/Google |
diff --git a/etc/profile-a-l/google-play-music-desktop-player.profile b/etc/profile-a-l/google-play-music-desktop-player.profile index a7aabe105..fe61d727e 100644 --- a/etc/profile-a-l/google-play-music-desktop-player.profile +++ b/etc/profile-a-l/google-play-music-desktop-player.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | mkdir ${HOME}/.config/Google Play Music Desktop Player | 19 | mkdir ${HOME}/.config/Google Play Music Desktop Player |
diff --git a/etc/profile-a-l/googler-common.profile b/etc/profile-a-l/googler-common.profile index 2d0bce52b..a37c7ad77 100644 --- a/etc/profile-a-l/googler-common.profile +++ b/etc/profile-a-l/googler-common.profile | |||
@@ -21,7 +21,6 @@ include disable-common.inc | |||
21 | include disable-devel.inc | 21 | include disable-devel.inc |
22 | include disable-exec.inc | 22 | include disable-exec.inc |
23 | include disable-interpreters.inc | 23 | include disable-interpreters.inc |
24 | include disable-passwdmgr.inc | ||
25 | include disable-programs.inc | 24 | include disable-programs.inc |
26 | include disable-shell.inc | 25 | include disable-shell.inc |
27 | include disable-xdg.inc | 26 | include disable-xdg.inc |
@@ -55,7 +54,7 @@ disable-mnt | |||
55 | private-bin env,python3*,sh,w3m | 54 | private-bin env,python3*,sh,w3m |
56 | private-cache | 55 | private-cache |
57 | private-dev | 56 | private-dev |
58 | private-etc ca-certificates,crypto-policies,host.conf,hostname,hosts,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | 57 | private-etc ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl |
59 | private-tmp | 58 | private-tmp |
60 | 59 | ||
61 | dbus-user none | 60 | dbus-user none |
diff --git a/etc/profile-a-l/gpa.profile b/etc/profile-a-l/gpa.profile index 37b4f0b1c..091851fa8 100644 --- a/etc/profile-a-l/gpa.profile +++ b/etc/profile-a-l/gpa.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${HOME}/.gnupg | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | caps.drop all | 16 | caps.drop all |
diff --git a/etc/profile-a-l/gpg-agent.profile b/etc/profile-a-l/gpg-agent.profile index 7f0b614b1..c6ecef5ec 100644 --- a/etc/profile-a-l/gpg-agent.profile +++ b/etc/profile-a-l/gpg-agent.profile | |||
@@ -15,7 +15,6 @@ blacklist ${RUNUSER}/wayland-* | |||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-a-l/gpg.profile b/etc/profile-a-l/gpg.profile index 4a4d6527c..cf58ebdb0 100644 --- a/etc/profile-a-l/gpg.profile +++ b/etc/profile-a-l/gpg.profile | |||
@@ -15,7 +15,6 @@ blacklist ${RUNUSER}/wayland-* | |||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | whitelist ${RUNUSER}/gnupg | 20 | whitelist ${RUNUSER}/gnupg |
diff --git a/etc/profile-a-l/gpicview.profile b/etc/profile-a-l/gpicview.profile index fa53c26c8..436134e1b 100644 --- a/etc/profile-a-l/gpicview.profile +++ b/etc/profile-a-l/gpicview.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
@@ -42,7 +41,7 @@ tracelog | |||
42 | private-bin gpicview | 41 | private-bin gpicview |
43 | private-cache | 42 | private-cache |
44 | private-dev | 43 | private-dev |
45 | private-etc alternatives,fonts,group,passwd | 44 | private-etc alternatives,fonts,group,ld.so.preload,passwd |
46 | private-lib | 45 | private-lib |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
diff --git a/etc/profile-a-l/gpredict.profile b/etc/profile-a-l/gpredict.profile index 253d644f1..e421c6a0b 100644 --- a/etc/profile-a-l/gpredict.profile +++ b/etc/profile-a-l/gpredict.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
@@ -37,6 +36,6 @@ tracelog | |||
37 | 36 | ||
38 | private-bin gpredict | 37 | private-bin gpredict |
39 | private-dev | 38 | private-dev |
40 | private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssl | 39 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,pki,resolv.conf,ssl |
41 | private-tmp | 40 | private-tmp |
42 | 41 | ||
diff --git a/etc/profile-a-l/gradio.profile b/etc/profile-a-l/gradio.profile index 2b4c536d2..efb6b39c6 100644 --- a/etc/profile-a-l/gradio.profile +++ b/etc/profile-a-l/gradio.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin gradio | 45 | private-bin gradio |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,xdg | 48 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | dbus-user filter | 51 | dbus-user filter |
diff --git a/etc/profile-a-l/gramps.profile b/etc/profile-a-l/gramps.profile index c7e0c2977..4baca353b 100644 --- a/etc/profile-a-l/gramps.profile +++ b/etc/profile-a-l/gramps.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile b/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile index 890ba2560..10d41735a 100644 --- a/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile +++ b/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -41,7 +40,7 @@ private | |||
41 | private-bin gravity-beams-and-evaporating-stars | 40 | private-bin gravity-beams-and-evaporating-stars |
42 | private-cache | 41 | private-cache |
43 | private-dev | 42 | private-dev |
44 | private-etc fonts,machine-id | 43 | private-etc fonts,ld.so.preload,machine-id |
45 | private-tmp | 44 | private-tmp |
46 | 45 | ||
47 | dbus-user none | 46 | dbus-user none |
diff --git a/etc/profile-a-l/gthumb.profile b/etc/profile-a-l/gthumb.profile index 5927e8c4d..4218f8545 100644 --- a/etc/profile-a-l/gthumb.profile +++ b/etc/profile-a-l/gthumb.profile | |||
@@ -13,7 +13,6 @@ noblacklist ${HOME}/.steam | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | 18 | ||
diff --git a/etc/profile-a-l/gtk-update-icon-cache.profile b/etc/profile-a-l/gtk-update-icon-cache.profile index c8addae75..c6347efdf 100644 --- a/etc/profile-a-l/gtk-update-icon-cache.profile +++ b/etc/profile-a-l/gtk-update-icon-cache.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -47,7 +46,7 @@ disable-mnt | |||
47 | private-bin gtk-update-icon-cache | 46 | private-bin gtk-update-icon-cache |
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | private-etc none | 49 | private-etc ld.so.preload,none |
51 | private-lib | 50 | private-lib |
52 | private-tmp | 51 | private-tmp |
53 | 52 | ||
diff --git a/etc/profile-a-l/guayadeque.profile b/etc/profile-a-l/guayadeque.profile index 3d2b71e9d..39fb177dd 100644 --- a/etc/profile-a-l/guayadeque.profile +++ b/etc/profile-a-l/guayadeque.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/gucharmap.profile b/etc/profile-a-l/gucharmap.profile index 6adb79852..d47000e89 100644 --- a/etc/profile-a-l/gucharmap.profile +++ b/etc/profile-a-l/gucharmap.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/guvcview.profile b/etc/profile-a-l/guvcview.profile index 9221ca31c..8ddde3c47 100644 --- a/etc/profile-a-l/guvcview.profile +++ b/etc/profile-a-l/guvcview.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/gwenview.profile b/etc/profile-a-l/gwenview.profile index d33e2a673..8becf6d84 100644 --- a/etc/profile-a-l/gwenview.profile +++ b/etc/profile-a-l/gwenview.profile | |||
@@ -22,7 +22,6 @@ include disable-common.inc | |||
22 | include disable-devel.inc | 22 | include disable-devel.inc |
23 | include disable-exec.inc | 23 | include disable-exec.inc |
24 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
25 | include disable-passwdmgr.inc | ||
26 | include disable-programs.inc | 25 | include disable-programs.inc |
27 | include disable-shell.inc | 26 | include disable-shell.inc |
28 | 27 | ||
@@ -47,7 +46,7 @@ shell none | |||
47 | 46 | ||
48 | private-bin gimp*,gwenview,kbuildsycoca4,kdeinit4 | 47 | private-bin gimp*,gwenview,kbuildsycoca4,kdeinit4 |
49 | private-dev | 48 | private-dev |
50 | private-etc alternatives,fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,xdg | 49 | private-etc alternatives,fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,ld.so.preload,machine-id,passwd,pulse,xdg |
51 | 50 | ||
52 | # dbus-user none | 51 | # dbus-user none |
53 | # dbus-system none | 52 | # dbus-system none |
diff --git a/etc/profile-a-l/handbrake.profile b/etc/profile-a-l/handbrake.profile index 847e1ec1e..9ad9aef33 100644 --- a/etc/profile-a-l/handbrake.profile +++ b/etc/profile-a-l/handbrake.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-a-l/hashcat.profile b/etc/profile-a-l/hashcat.profile index aab4b0c21..3be349176 100644 --- a/etc/profile-a-l/hashcat.profile +++ b/etc/profile-a-l/hashcat.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-a-l/hasher-common.profile b/etc/profile-a-l/hasher-common.profile index 44584f26b..8c1ada1d1 100644 --- a/etc/profile-a-l/hasher-common.profile +++ b/etc/profile-a-l/hasher-common.profile | |||
@@ -17,7 +17,6 @@ blacklist ${RUNUSER} | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | # Add the next line to your hasher-common.local if you don't need to hash files in disable-programs.inc. | 20 | # Add the next line to your hasher-common.local if you don't need to hash files in disable-programs.inc. |
22 | #include disable-programs.inc | 21 | #include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
diff --git a/etc/profile-a-l/hedgewars.profile b/etc/profile-a-l/hedgewars.profile index c0675d8ec..9c6f162c6 100644 --- a/etc/profile-a-l/hedgewars.profile +++ b/etc/profile-a-l/hedgewars.profile | |||
@@ -13,7 +13,6 @@ include allow-lua.inc | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.hedgewars | 18 | mkdir ${HOME}/.hedgewars |
diff --git a/etc/profile-a-l/hexchat.profile b/etc/profile-a-l/hexchat.profile index b887de147..88448ad45 100644 --- a/etc/profile-a-l/hexchat.profile +++ b/etc/profile-a-l/hexchat.profile | |||
@@ -22,7 +22,6 @@ include disable-common.inc | |||
22 | include disable-devel.inc | 22 | include disable-devel.inc |
23 | include disable-exec.inc | 23 | include disable-exec.inc |
24 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
25 | include disable-passwdmgr.inc | ||
26 | include disable-programs.inc | 25 | include disable-programs.inc |
27 | include disable-shell.inc | 26 | include disable-shell.inc |
28 | include disable-xdg.inc | 27 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/highlight.profile b/etc/profile-a-l/highlight.profile index 643736ac7..0145f7ceb 100644 --- a/etc/profile-a-l/highlight.profile +++ b/etc/profile-a-l/highlight.profile | |||
@@ -11,7 +11,6 @@ blacklist ${RUNUSER} | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | 16 | ||
diff --git a/etc/profile-a-l/homebank.profile b/etc/profile-a-l/homebank.profile index 199b1a5e5..f2dac5881 100644 --- a/etc/profile-a-l/homebank.profile +++ b/etc/profile-a-l/homebank.profile | |||
@@ -13,7 +13,6 @@ include disable-devel.inc | |||
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-a-l/host.profile b/etc/profile-a-l/host.profile index 00d9f7a76..984e90e1f 100644 --- a/etc/profile-a-l/host.profile +++ b/etc/profile-a-l/host.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-a-l/hugin.profile b/etc/profile-a-l/hugin.profile index 267712c87..0a9c831f3 100644 --- a/etc/profile-a-l/hugin.profile +++ b/etc/profile-a-l/hugin.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/hyperrogue.profile b/etc/profile-a-l/hyperrogue.profile index e66ffd7e1..0baebdae1 100644 --- a/etc/profile-a-l/hyperrogue.profile +++ b/etc/profile-a-l/hyperrogue.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -45,7 +44,7 @@ private-bin hyperrogue | |||
45 | private-cache | 44 | private-cache |
46 | private-cwd ${HOME} | 45 | private-cwd ${HOME} |
47 | private-dev | 46 | private-dev |
48 | private-etc fonts,machine-id | 47 | private-etc fonts,ld.so.preload,machine-id |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-a-l/i2prouter.profile b/etc/profile-a-l/i2prouter.profile index 47c984175..200b4c8b1 100644 --- a/etc/profile-a-l/i2prouter.profile +++ b/etc/profile-a-l/i2prouter.profile | |||
@@ -28,7 +28,6 @@ include disable-common.inc | |||
28 | include disable-devel.inc | 28 | include disable-devel.inc |
29 | include disable-exec.inc | 29 | include disable-exec.inc |
30 | include disable-interpreters.inc | 30 | include disable-interpreters.inc |
31 | include disable-passwdmgr.inc | ||
32 | include disable-programs.inc | 31 | include disable-programs.inc |
33 | include disable-xdg.inc | 32 | include disable-xdg.inc |
34 | 33 | ||
@@ -69,5 +68,5 @@ shell none | |||
69 | disable-mnt | 68 | disable-mnt |
70 | private-cache | 69 | private-cache |
71 | private-dev | 70 | private-dev |
72 | private-etc alternatives,ca-certificates,crypto-policies,dconf,group,hostname,hosts,i2p,java-10-openjdk,java-11-openjdk,java-12-openjdk,java-13-openjdk,java-8-openjdk,java-9-openjdk,java-openjdk,ld.so.cache,localtime,machine-id,nsswitch.conf,passwd,pki,resolv.conf,ssl | 71 | private-etc alternatives,ca-certificates,crypto-policies,dconf,group,hostname,hosts,i2p,java-10-openjdk,java-11-openjdk,java-12-openjdk,java-13-openjdk,java-8-openjdk,java-9-openjdk,java-openjdk,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,resolv.conf,ssl |
73 | private-tmp | 72 | private-tmp |
diff --git a/etc/profile-a-l/iagno.profile b/etc/profile-a-l/iagno.profile index 363d3dc2e..863dc8acf 100644 --- a/etc/profile-a-l/iagno.profile +++ b/etc/profile-a-l/iagno.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | 15 | ||
diff --git a/etc/profile-a-l/idea.sh.profile b/etc/profile-a-l/idea.sh.profile index 680b8e777..7716a5f1a 100644 --- a/etc/profile-a-l/idea.sh.profile +++ b/etc/profile-a-l/idea.sh.profile | |||
@@ -19,7 +19,6 @@ include allow-common-devel.inc | |||
19 | include allow-ssh.inc | 19 | include allow-ssh.inc |
20 | 20 | ||
21 | include disable-common.inc | 21 | include disable-common.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | 23 | ||
25 | caps.drop all | 24 | caps.drop all |
diff --git a/etc/profile-a-l/imagej.profile b/etc/profile-a-l/imagej.profile index 12ce7976b..4da127fab 100644 --- a/etc/profile-a-l/imagej.profile +++ b/etc/profile-a-l/imagej.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/profile-a-l/img2txt.profile b/etc/profile-a-l/img2txt.profile index c26958d06..54cad08c7 100644 --- a/etc/profile-a-l/img2txt.profile +++ b/etc/profile-a-l/img2txt.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-a-l/impressive.profile b/etc/profile-a-l/impressive.profile index c152be01c..31ad641c1 100644 --- a/etc/profile-a-l/impressive.profile +++ b/etc/profile-a-l/impressive.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
24 | 23 | ||
diff --git a/etc/profile-a-l/inkscape.profile b/etc/profile-a-l/inkscape.profile index 35dd86b32..e0015e69a 100644 --- a/etc/profile-a-l/inkscape.profile +++ b/etc/profile-a-l/inkscape.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for inkscape | 1 | # Firejail profile for inkscape |
2 | # Description: Vector-based drawing program | 2 | # Description: Vector-based drawing program |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include inkscape.local | 6 | include inkscape.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
@@ -24,7 +25,6 @@ include disable-common.inc | |||
24 | include disable-devel.inc | 25 | include disable-devel.inc |
25 | include disable-exec.inc | 26 | include disable-exec.inc |
26 | include disable-interpreters.inc | 27 | include disable-interpreters.inc |
27 | include disable-passwdmgr.inc | ||
28 | include disable-programs.inc | 28 | include disable-programs.inc |
29 | include disable-xdg.inc | 29 | include disable-xdg.inc |
30 | 30 | ||
diff --git a/etc/profile-a-l/io.github.lainsce.Notejot.profile b/etc/profile-a-l/io.github.lainsce.Notejot.profile new file mode 100644 index 000000000..6753cb332 --- /dev/null +++ b/etc/profile-a-l/io.github.lainsce.Notejot.profile | |||
@@ -0,0 +1,60 @@ | |||
1 | # Firejail profile for notejot | ||
2 | # Description: Jot your ideas | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include io.github.lainsce.Notejot.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/io.github.lainsce.Notejot | ||
10 | noblacklist ${HOME}/.local/share/io.github.lainsce.Notejot | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.cache/io.github.lainsce.Notejot | ||
21 | mkdir ${HOME}/.local/share/io.github.lainsce.Notejot | ||
22 | whitelist ${HOME}/.cache/io.github.lainsce.Notejot | ||
23 | whitelist ${HOME}/.local/share/io.github.lainsce.Notejot | ||
24 | whitelist /usr/libexec/webkit2gtk-4.0 | ||
25 | include whitelist-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | machine-id | ||
33 | net none | ||
34 | no3d | ||
35 | nodvd | ||
36 | nogroups | ||
37 | noinput | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | nosound | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix | ||
45 | seccomp | ||
46 | seccomp.block-secondary | ||
47 | shell none | ||
48 | tracelog | ||
49 | |||
50 | disable-mnt | ||
51 | private-bin io.github.lainsce.Notejot | ||
52 | private-cache | ||
53 | private-dev | ||
54 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11 | ||
55 | private-tmp | ||
56 | |||
57 | dbus-user filter | ||
58 | dbus-user.own io.github.lainsce.Notejot | ||
59 | dbus-user.talk ca.desrt.dconf | ||
60 | dbus-system none | ||
diff --git a/etc/profile-a-l/ipcalc.profile b/etc/profile-a-l/ipcalc.profile index 791065c1a..2997328e8 100644 --- a/etc/profile-a-l/ipcalc.profile +++ b/etc/profile-a-l/ipcalc.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | # include disable-shell.inc | 17 | # include disable-shell.inc |
19 | include disable-write-mnt.inc | 18 | include disable-write-mnt.inc |
@@ -51,7 +50,7 @@ private-bin bash,ipcalc,ipcalc-ng,perl,sh | |||
51 | # private-cache | 50 | # private-cache |
52 | private-dev | 51 | private-dev |
53 | # empty etc directory | 52 | # empty etc directory |
54 | private-etc none | 53 | private-etc ld.so.preload,none |
55 | private-lib | 54 | private-lib |
56 | private-opt none | 55 | private-opt none |
57 | private-tmp | 56 | private-tmp |
diff --git a/etc/profile-a-l/itch.profile b/etc/profile-a-l/itch.profile index e02dcbdb1..37cde1577 100644 --- a/etc/profile-a-l/itch.profile +++ b/etc/profile-a-l/itch.profile | |||
@@ -14,7 +14,6 @@ noblacklist ${HOME}/.config/itch | |||
14 | include disable-common.inc | 14 | include disable-common.inc |
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | mkdir ${HOME}/.itch | 19 | mkdir ${HOME}/.itch |
diff --git a/etc/profile-a-l/jami-gnome.profile b/etc/profile-a-l/jami-gnome.profile index 3e9abf369..5c4cc74c2 100644 --- a/etc/profile-a-l/jami-gnome.profile +++ b/etc/profile-a-l/jami-gnome.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | #include disable-interpreters.inc | 15 | #include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.config/jami | 18 | mkdir ${HOME}/.config/jami |
diff --git a/etc/profile-a-l/jd-gui.profile b/etc/profile-a-l/jd-gui.profile index 7d29f1068..37f99c2f0 100644 --- a/etc/profile-a-l/jd-gui.profile +++ b/etc/profile-a-l/jd-gui.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-a-l/jerry.profile b/etc/profile-a-l/jerry.profile index 85b1f2120..59260dc64 100644 --- a/etc/profile-a-l/jerry.profile +++ b/etc/profile-a-l/jerry.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
@@ -35,7 +34,7 @@ tracelog | |||
35 | 34 | ||
36 | private-bin bash,jerry,sh,stockfish | 35 | private-bin bash,jerry,sh,stockfish |
37 | private-dev | 36 | private-dev |
38 | private-etc fonts,gtk-2.0,gtk-3.0 | 37 | private-etc fonts,gtk-2.0,gtk-3.0,ld.so.preload |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
41 | dbus-user none | 40 | dbus-user none |
diff --git a/etc/profile-a-l/jitsi.profile b/etc/profile-a-l/jitsi.profile index 223c360b8..0e578909a 100644 --- a/etc/profile-a-l/jitsi.profile +++ b/etc/profile-a-l/jitsi.profile | |||
@@ -13,7 +13,6 @@ include allow-java.inc | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | caps.drop all | 18 | caps.drop all |
diff --git a/etc/profile-a-l/jumpnbump.profile b/etc/profile-a-l/jumpnbump.profile index 9954b8aea..b9bc8f219 100644 --- a/etc/profile-a-l/jumpnbump.profile +++ b/etc/profile-a-l/jumpnbump.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
@@ -43,7 +42,7 @@ disable-mnt | |||
43 | private-bin jumpnbump | 42 | private-bin jumpnbump |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc none | 45 | private-etc ld.so.preload,none |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-a-l/k3b.profile b/etc/profile-a-l/k3b.profile index 5ae90dff6..655257f08 100644 --- a/etc/profile-a-l/k3b.profile +++ b/etc/profile-a-l/k3b.profile | |||
@@ -15,7 +15,6 @@ noblacklist ${MUSIC} | |||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-a-l/kaffeine.profile b/etc/profile-a-l/kaffeine.profile index d55fd22cb..8799a6f24 100644 --- a/etc/profile-a-l/kaffeine.profile +++ b/etc/profile-a-l/kaffeine.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
25 | 24 | ||
diff --git a/etc/profile-a-l/kalgebra.profile b/etc/profile-a-l/kalgebra.profile index 503dac4b6..5253a78b0 100644 --- a/etc/profile-a-l/kalgebra.profile +++ b/etc/profile-a-l/kalgebra.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
@@ -43,7 +42,7 @@ disable-mnt | |||
43 | private-bin kalgebra,kalgebramobile | 42 | private-bin kalgebra,kalgebramobile |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc fonts,machine-id | 45 | private-etc fonts,ld.so.preload,machine-id |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-a-l/kate.profile b/etc/profile-a-l/kate.profile index 27b87e7c3..d8b2dddb1 100644 --- a/etc/profile-a-l/kate.profile +++ b/etc/profile-a-l/kate.profile | |||
@@ -27,7 +27,6 @@ include disable-common.inc | |||
27 | # include disable-devel.inc | 27 | # include disable-devel.inc |
28 | include disable-exec.inc | 28 | include disable-exec.inc |
29 | # include disable-interpreters.inc | 29 | # include disable-interpreters.inc |
30 | include disable-passwdmgr.inc | ||
31 | include disable-programs.inc | 30 | include disable-programs.inc |
32 | 31 | ||
33 | include whitelist-var-common.inc | 32 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/kazam.profile b/etc/profile-a-l/kazam.profile index 9795cf168..d88631005 100644 --- a/etc/profile-a-l/kazam.profile +++ b/etc/profile-a-l/kazam.profile | |||
@@ -21,7 +21,6 @@ include disable-devel.inc | |||
21 | include disable-exec.inc | 21 | include disable-exec.inc |
22 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
23 | include disable-programs.inc | 23 | include disable-programs.inc |
24 | include disable-passwdmgr.inc | ||
25 | include disable-shell.inc | 24 | include disable-shell.inc |
26 | include disable-xdg.inc | 25 | include disable-xdg.inc |
27 | 26 | ||
@@ -50,7 +49,7 @@ disable-mnt | |||
50 | # private-bin kazam,python* | 49 | # private-bin kazam,python* |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,machine-id,pulse,selinux,X11,xdg | 52 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.preload,machine-id,pulse,selinux,X11,xdg |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
56 | dbus-system none | 55 | dbus-system none |
diff --git a/etc/profile-a-l/kcalc.profile b/etc/profile-a-l/kcalc.profile index e36ee5ed2..c551dbdbe 100644 --- a/etc/profile-a-l/kcalc.profile +++ b/etc/profile-a-l/kcalc.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -56,7 +55,7 @@ disable-mnt | |||
56 | private-bin kcalc | 55 | private-bin kcalc |
57 | private-cache | 56 | private-cache |
58 | private-dev | 57 | private-dev |
59 | private-etc alternatives,fonts,ld.so.cache,locale,locale.conf | 58 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,locale,locale.conf |
60 | # private-lib - problems on Arch | 59 | # private-lib - problems on Arch |
61 | private-tmp | 60 | private-tmp |
62 | 61 | ||
diff --git a/etc/profile-a-l/kdeinit4.profile b/etc/profile-a-l/kdeinit4.profile index 925ab3517..4ddd5dac5 100644 --- a/etc/profile-a-l/kdeinit4.profile +++ b/etc/profile-a-l/kdeinit4.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | 16 | ||
diff --git a/etc/profile-a-l/kdenlive.profile b/etc/profile-a-l/kdenlive.profile index d2a08a269..87808ced7 100644 --- a/etc/profile-a-l/kdenlive.profile +++ b/etc/profile-a-l/kdenlive.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | 21 | ||
23 | apparmor | 22 | apparmor |
diff --git a/etc/profile-a-l/kdiff3.profile b/etc/profile-a-l/kdiff3.profile index 7c1cb2294..fa50b0a20 100644 --- a/etc/profile-a-l/kdiff3.profile +++ b/etc/profile-a-l/kdiff3.profile | |||
@@ -18,7 +18,6 @@ blacklist ${HOME}/.gnupg | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | # Add the next line to your kdiff3.local if you don't need to compare files in disable-programs.inc. | 21 | # Add the next line to your kdiff3.local if you don't need to compare files in disable-programs.inc. |
23 | #include disable-programs.inc | 22 | #include disable-programs.inc |
24 | include disable-shell.inc | 23 | include disable-shell.inc |
@@ -49,7 +48,7 @@ shell none | |||
49 | tracelog | 48 | tracelog |
50 | 49 | ||
51 | disable-mnt | 50 | disable-mnt |
52 | private-bin kdiff3 | 51 | private-bin kdiff3 |
53 | private-cache | 52 | private-cache |
54 | private-dev | 53 | private-dev |
55 | 54 | ||
diff --git a/etc/profile-a-l/keepass.profile b/etc/profile-a-l/keepass.profile index ae8971ab4..f26c10be3 100644 --- a/etc/profile-a-l/keepass.profile +++ b/etc/profile-a-l/keepass.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
25 | 24 | ||
diff --git a/etc/profile-a-l/keepassx.profile b/etc/profile-a-l/keepassx.profile index ac364986d..616b87d7e 100644 --- a/etc/profile-a-l/keepassx.profile +++ b/etc/profile-a-l/keepassx.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
@@ -42,7 +41,7 @@ tracelog | |||
42 | 41 | ||
43 | private-bin keepassx,keepassx2 | 42 | private-bin keepassx,keepassx2 |
44 | private-dev | 43 | private-dev |
45 | private-etc alternatives,fonts,machine-id | 44 | private-etc alternatives,fonts,ld.so.preload,machine-id |
46 | private-tmp | 45 | private-tmp |
47 | 46 | ||
48 | dbus-user none | 47 | dbus-user none |
diff --git a/etc/profile-a-l/keepassxc.profile b/etc/profile-a-l/keepassxc.profile index f71dcf82b..0f3e6605b 100644 --- a/etc/profile-a-l/keepassxc.profile +++ b/etc/profile-a-l/keepassxc.profile | |||
@@ -28,7 +28,6 @@ include disable-common.inc | |||
28 | include disable-devel.inc | 28 | include disable-devel.inc |
29 | include disable-exec.inc | 29 | include disable-exec.inc |
30 | include disable-interpreters.inc | 30 | include disable-interpreters.inc |
31 | include disable-passwdmgr.inc | ||
32 | include disable-programs.inc | 31 | include disable-programs.inc |
33 | include disable-shell.inc | 32 | include disable-shell.inc |
34 | include disable-xdg.inc | 33 | include disable-xdg.inc |
@@ -38,16 +37,22 @@ include disable-xdg.inc | |||
38 | #mkdir ${HOME}/Documents/KeePassXC | 37 | #mkdir ${HOME}/Documents/KeePassXC |
39 | #whitelist ${HOME}/Documents/KeePassXC | 38 | #whitelist ${HOME}/Documents/KeePassXC |
40 | # Needed for KeePassXC-Browser. | 39 | # Needed for KeePassXC-Browser. |
40 | #mkdir ${HOME}/.config/BraveSoftware/Brave-Browser/NativeMessagingHosts | ||
41 | #mkfile ${HOME}/.config/BraveSoftware/Brave-Browser/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json | 41 | #mkfile ${HOME}/.config/BraveSoftware/Brave-Browser/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json |
42 | #whitelist ${HOME}/.config/BraveSoftware/Brave-Browser/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json | 42 | #whitelist ${HOME}/.config/BraveSoftware/Brave-Browser/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json |
43 | #mkdir ${HOME}/.config/chromium/NativeMessagingHosts | ||
43 | #mkfile ${HOME}/.config/chromium/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json | 44 | #mkfile ${HOME}/.config/chromium/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json |
44 | #whitelist ${HOME}/.config/chromium/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json | 45 | #whitelist ${HOME}/.config/chromium/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json |
46 | #mkdir ${HOME}/.config/google-chrome/NativeMessagingHosts | ||
45 | #mkfile ${HOME}/.config/google-chrome/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json | 47 | #mkfile ${HOME}/.config/google-chrome/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json |
46 | #whitelist ${HOME}/.config/google-chrome/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json | 48 | #whitelist ${HOME}/.config/google-chrome/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json |
49 | #mkdir ${HOME}/.config/vivaldi/NativeMessagingHosts | ||
47 | #mkfile ${HOME}/.config/vivaldi/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json | 50 | #mkfile ${HOME}/.config/vivaldi/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json |
48 | #whitelist ${HOME}/.config/vivaldi/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json | 51 | #whitelist ${HOME}/.config/vivaldi/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json |
52 | #mkdir ${HOME}/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Data/Browser/.mozilla/native-messaging-hosts | ||
49 | #mkfile ${HOME}/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Data/Browser/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json | 53 | #mkfile ${HOME}/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Data/Browser/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json |
50 | #whitelist ${HOME}/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Data/Browser/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json | 54 | #whitelist ${HOME}/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Data/Browser/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json |
55 | #mkdir ${HOME}/.mozilla/native-messaging-hosts | ||
51 | #mkfile ${HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json | 56 | #mkfile ${HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json |
52 | #whitelist ${HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json | 57 | #whitelist ${HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json |
53 | #mkdir ${HOME}/.cache/keepassxc | 58 | #mkdir ${HOME}/.cache/keepassxc |
@@ -58,6 +63,7 @@ include disable-xdg.inc | |||
58 | #include whitelist-common.inc | 63 | #include whitelist-common.inc |
59 | 64 | ||
60 | whitelist /usr/share/keepassxc | 65 | whitelist /usr/share/keepassxc |
66 | include whitelist-run-common.inc | ||
61 | include whitelist-usr-share-common.inc | 67 | include whitelist-usr-share-common.inc |
62 | include whitelist-var-common.inc | 68 | include whitelist-var-common.inc |
63 | 69 | ||
@@ -74,7 +80,7 @@ nosound | |||
74 | notv | 80 | notv |
75 | nou2f | 81 | nou2f |
76 | novideo | 82 | novideo |
77 | protocol unix,netlink | 83 | protocol unix |
78 | seccomp !name_to_handle_at | 84 | seccomp !name_to_handle_at |
79 | seccomp.block-secondary | 85 | seccomp.block-secondary |
80 | shell none | 86 | shell none |
@@ -82,24 +88,23 @@ tracelog | |||
82 | 88 | ||
83 | private-bin keepassxc,keepassxc-cli,keepassxc-proxy | 89 | private-bin keepassxc,keepassxc-cli,keepassxc-proxy |
84 | private-dev | 90 | private-dev |
85 | private-etc alternatives,fonts,ld.so.cache,machine-id | 91 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
86 | private-tmp | 92 | private-tmp |
87 | 93 | ||
88 | dbus-user filter | 94 | dbus-user filter |
89 | #dbus-user.own org.keepassxc.KeePassXC | 95 | dbus-user.own org.keepassxc.KeePassXC.* |
90 | dbus-user.talk com.canonical.Unity.Session | 96 | dbus-user.talk com.canonical.Unity |
91 | dbus-user.talk org.freedesktop.ScreenSaver | 97 | dbus-user.talk org.freedesktop.ScreenSaver |
92 | dbus-user.talk org.freedesktop.login1.Manager | ||
93 | dbus-user.talk org.freedesktop.login1.Session | ||
94 | dbus-user.talk org.gnome.ScreenSaver | 98 | dbus-user.talk org.gnome.ScreenSaver |
95 | dbus-user.talk org.gnome.SessionManager | 99 | dbus-user.talk org.gnome.SessionManager |
96 | dbus-user.talk org.gnome.SessionManager.Presence | 100 | dbus-user.talk org.xfce.ScreenSaver |
97 | # Add the next line to your keepassxc.local to allow notifications. | 101 | # Add the next line to your keepassxc.local to allow notifications. |
98 | #dbus-user.talk org.freedesktop.Notifications | 102 | #dbus-user.talk org.freedesktop.Notifications |
99 | # Add the next line to your keepassxc.local to allow the tray menu. | 103 | # Add the next line to your keepassxc.local to allow the tray menu. |
100 | #dbus-user.talk org.kde.StatusNotifierWatcher | 104 | #dbus-user.talk org.kde.StatusNotifierWatcher |
101 | #dbus-user.own org.kde.* | 105 | #dbus-user.own org.kde.* |
102 | dbus-system none | 106 | dbus-system filter |
107 | dbus-system.talk org.freedesktop.login1 | ||
103 | 108 | ||
104 | # Mutex is stored in /tmp by default, which is broken by private-tmp. | 109 | # Mutex is stored in /tmp by default, which is broken by private-tmp. |
105 | join-or-start keepassxc | 110 | join-or-start keepassxc |
diff --git a/etc/profile-a-l/kfind.profile b/etc/profile-a-l/kfind.profile index 6f6fe8d0a..40fe65e3f 100644 --- a/etc/profile-a-l/kfind.profile +++ b/etc/profile-a-l/kfind.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | # include disable-programs.inc | 21 | # include disable-programs.inc |
23 | 22 | ||
24 | apparmor | 23 | apparmor |
diff --git a/etc/profile-a-l/kget.profile b/etc/profile-a-l/kget.profile index 2c684504b..ec315b431 100644 --- a/etc/profile-a-l/kget.profile +++ b/etc/profile-a-l/kget.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | 22 | ||
24 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/kid3.profile b/etc/profile-a-l/kid3.profile index e18292e99..8b35a8946 100644 --- a/etc/profile-a-l/kid3.profile +++ b/etc/profile-a-l/kid3.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -38,7 +37,7 @@ tracelog | |||
38 | 37 | ||
39 | private-cache | 38 | private-cache |
40 | private-dev | 39 | private-dev |
41 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hostname,hosts,kde5rc,machine-id,pki,pulse,resolv.conf,ssl | 40 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hostname,hosts,kde5rc,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
42 | private-tmp | 41 | private-tmp |
43 | private-opt none | 42 | private-opt none |
44 | private-srv none | 43 | private-srv none |
diff --git a/etc/profile-a-l/kino.profile b/etc/profile-a-l/kino.profile index 74014ffe6..1f42526d3 100644 --- a/etc/profile-a-l/kino.profile +++ b/etc/profile-a-l/kino.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/kiwix-desktop.profile b/etc/profile-a-l/kiwix-desktop.profile index 40ee0bbc7..837ea9e36 100644 --- a/etc/profile-a-l/kiwix-desktop.profile +++ b/etc/profile-a-l/kiwix-desktop.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
@@ -45,7 +44,7 @@ shell none | |||
45 | disable-mnt | 44 | disable-mnt |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,machine-id,pki,pulse,resolv.conf,ssl | 47 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-a-l/klatexformula.profile b/etc/profile-a-l/klatexformula.profile index c6a9023f1..f089658af 100644 --- a/etc/profile-a-l/klatexformula.profile +++ b/etc/profile-a-l/klatexformula.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | 21 | ||
23 | apparmor | 22 | apparmor |
diff --git a/etc/profile-a-l/klavaro.profile b/etc/profile-a-l/klavaro.profile index f5cd3a48c..964175274 100644 --- a/etc/profile-a-l/klavaro.profile +++ b/etc/profile-a-l/klavaro.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin bash,klavaro,sh,tclsh,tclsh* | 45 | private-bin bash,klavaro,sh,tclsh,tclsh* |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts,ld.so.preload |
50 | private-tmp | 49 | private-tmp |
51 | private-opt none | 50 | private-opt none |
52 | private-srv none | 51 | private-srv none |
diff --git a/etc/profile-a-l/kmail.profile b/etc/profile-a-l/kmail.profile index 95ae98e53..2c645677c 100644 --- a/etc/profile-a-l/kmail.profile +++ b/etc/profile-a-l/kmail.profile | |||
@@ -35,7 +35,6 @@ include disable-common.inc | |||
35 | include disable-devel.inc | 35 | include disable-devel.inc |
36 | include disable-exec.inc | 36 | include disable-exec.inc |
37 | include disable-interpreters.inc | 37 | include disable-interpreters.inc |
38 | include disable-passwdmgr.inc | ||
39 | include disable-programs.inc | 38 | include disable-programs.inc |
40 | 39 | ||
41 | include whitelist-var-common.inc | 40 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/kmplayer.profile b/etc/profile-a-l/kmplayer.profile index e88b53499..8d462c44c 100644 --- a/etc/profile-a-l/kmplayer.profile +++ b/etc/profile-a-l/kmplayer.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-a-l/kodi.profile b/etc/profile-a-l/kodi.profile index b7091f1fc..f901637f3 100644 --- a/etc/profile-a-l/kodi.profile +++ b/etc/profile-a-l/kodi.profile | |||
@@ -12,6 +12,12 @@ ignore noexec ${HOME} | |||
12 | #ignore nogroups | 12 | #ignore nogroups |
13 | #ignore noroot | 13 | #ignore noroot |
14 | #ignore private-dev | 14 | #ignore private-dev |
15 | # Add the following to your kodi.local if you use the Lutris Kodi Addon | ||
16 | #noblacklist /sbin | ||
17 | #noblacklist /usr/sbin | ||
18 | #noblacklist ${HOME}/.cache/lutris | ||
19 | #noblacklist ${HOME}/.config/lutris | ||
20 | #noblacklist ${HOME}/.local/share/lutris | ||
15 | 21 | ||
16 | noblacklist ${HOME}/.kodi | 22 | noblacklist ${HOME}/.kodi |
17 | noblacklist ${MUSIC} | 23 | noblacklist ${MUSIC} |
@@ -26,7 +32,6 @@ include disable-common.inc | |||
26 | include disable-devel.inc | 32 | include disable-devel.inc |
27 | include disable-exec.inc | 33 | include disable-exec.inc |
28 | include disable-interpreters.inc | 34 | include disable-interpreters.inc |
29 | include disable-passwdmgr.inc | ||
30 | include disable-programs.inc | 35 | include disable-programs.inc |
31 | include disable-xdg.inc | 36 | include disable-xdg.inc |
32 | 37 | ||
diff --git a/etc/profile-a-l/konversation.profile b/etc/profile-a-l/konversation.profile index 5b5ed6e24..723fef0d2 100644 --- a/etc/profile-a-l/konversation.profile +++ b/etc/profile-a-l/konversation.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/kopete.profile b/etc/profile-a-l/kopete.profile index 88f47d1bf..9e75b03eb 100644 --- a/etc/profile-a-l/kopete.profile +++ b/etc/profile-a-l/kopete.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | whitelist /var/lib/winpopup | 21 | whitelist /var/lib/winpopup |
diff --git a/etc/profile-a-l/krita.profile b/etc/profile-a-l/krita.profile index 8604e63d0..2d3225421 100644 --- a/etc/profile-a-l/krita.profile +++ b/etc/profile-a-l/krita.profile | |||
@@ -22,7 +22,6 @@ include disable-common.inc | |||
22 | include disable-devel.inc | 22 | include disable-devel.inc |
23 | include disable-exec.inc | 23 | include disable-exec.inc |
24 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
25 | include disable-passwdmgr.inc | ||
26 | include disable-programs.inc | 25 | include disable-programs.inc |
27 | include disable-xdg.inc | 26 | include disable-xdg.inc |
28 | 27 | ||
diff --git a/etc/profile-a-l/krunner.profile b/etc/profile-a-l/krunner.profile index 9cb5eff87..96eb6978d 100644 --- a/etc/profile-a-l/krunner.profile +++ b/etc/profile-a-l/krunner.profile | |||
@@ -22,7 +22,6 @@ noblacklist ${HOME}/.kde4/share/config/krunnerrc | |||
22 | include disable-common.inc | 22 | include disable-common.inc |
23 | # include disable-devel.inc | 23 | # include disable-devel.inc |
24 | # include disable-interpreters.inc | 24 | # include disable-interpreters.inc |
25 | # include disable-passwdmgr.inc | ||
26 | # include disable-programs.inc | 25 | # include disable-programs.inc |
27 | 26 | ||
28 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/ktorrent.profile b/etc/profile-a-l/ktorrent.profile index 5a85194e0..9d8aa1bd7 100644 --- a/etc/profile-a-l/ktorrent.profile +++ b/etc/profile-a-l/ktorrent.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | 23 | ||
diff --git a/etc/profile-a-l/ktouch.profile b/etc/profile-a-l/ktouch.profile index 4cf72b74c..78eb2e8f5 100644 --- a/etc/profile-a-l/ktouch.profile +++ b/etc/profile-a-l/ktouch.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -47,7 +46,7 @@ disable-mnt | |||
47 | private-bin ktouch | 46 | private-bin ktouch |
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | private-etc alternatives,fonts,kde5rc,machine-id | 49 | private-etc alternatives,fonts,kde5rc,ld.so.preload,machine-id |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
53 | dbus-user none | 52 | dbus-user none |
diff --git a/etc/profile-a-l/kube.profile b/etc/profile-a-l/kube.profile index 4e9a12e5f..ad6b2f5fe 100644 --- a/etc/profile-a-l/kube.profile +++ b/etc/profile-a-l/kube.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
@@ -69,7 +68,7 @@ tracelog | |||
69 | private-bin kube,sink_synchronizer | 68 | private-bin kube,sink_synchronizer |
70 | private-cache | 69 | private-cache |
71 | private-dev | 70 | private-dev |
72 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gcrypt,gtk-2.0,gtk-3.0,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg | 71 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gcrypt,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.preload,pki,resolv.conf,selinux,ssl,xdg |
73 | private-tmp | 72 | private-tmp |
74 | writable-run-user | 73 | writable-run-user |
75 | 74 | ||
diff --git a/etc/profile-a-l/kwin_x11.profile b/etc/profile-a-l/kwin_x11.profile index 15e7ceb17..32e9870e5 100644 --- a/etc/profile-a-l/kwin_x11.profile +++ b/etc/profile-a-l/kwin_x11.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
@@ -43,5 +42,5 @@ tracelog | |||
43 | disable-mnt | 42 | disable-mnt |
44 | private-bin kwin_x11 | 43 | private-bin kwin_x11 |
45 | private-dev | 44 | private-dev |
46 | private-etc alternatives,drirc,fonts,kde5rc,ld.so.cache,machine-id,xdg | 45 | private-etc alternatives,drirc,fonts,kde5rc,ld.so.cache,ld.so.preload,machine-id,xdg |
47 | private-tmp | 46 | private-tmp |
diff --git a/etc/profile-a-l/kwrite.profile b/etc/profile-a-l/kwrite.profile index 804ffafeb..cd5ce7034 100644 --- a/etc/profile-a-l/kwrite.profile +++ b/etc/profile-a-l/kwrite.profile | |||
@@ -20,7 +20,6 @@ include disable-common.inc | |||
20 | include disable-devel.inc | 20 | include disable-devel.inc |
21 | include disable-exec.inc | 21 | include disable-exec.inc |
22 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | 23 | include disable-programs.inc |
25 | include disable-shell.inc | 24 | include disable-shell.inc |
26 | include disable-xdg.inc | 25 | include disable-xdg.inc |
@@ -47,7 +46,7 @@ tracelog | |||
47 | 46 | ||
48 | private-bin kbuildsycoca4,kdeinit4,kwrite | 47 | private-bin kbuildsycoca4,kdeinit4,kwrite |
49 | private-dev | 48 | private-dev |
50 | private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,pulse,xdg | 49 | private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,ld.so.preload,machine-id,pulse,xdg |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
53 | # dbus-user none | 52 | # dbus-user none |
diff --git a/etc/profile-a-l/latex-common.profile b/etc/profile-a-l/latex-common.profile index ac1b8785d..7993e97e3 100644 --- a/etc/profile-a-l/latex-common.profile +++ b/etc/profile-a-l/latex-common.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | 14 | ||
16 | whitelist /var/lib | 15 | whitelist /var/lib |
diff --git a/etc/profile-a-l/leafpad.profile b/etc/profile-a-l/leafpad.profile index 4bbb0a86d..75105abf2 100644 --- a/etc/profile-a-l/leafpad.profile +++ b/etc/profile-a-l/leafpad.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
diff --git a/etc/profile-a-l/less.profile b/etc/profile-a-l/less.profile index 8eb5ad0c2..db61bf941 100644 --- a/etc/profile-a-l/less.profile +++ b/etc/profile-a-l/less.profile | |||
@@ -14,7 +14,6 @@ noblacklist ${HOME}/.lesshst | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | 17 | ||
19 | apparmor | 18 | apparmor |
20 | caps.drop all | 19 | caps.drop all |
diff --git a/etc/profile-a-l/librecad.profile b/etc/profile-a-l/librecad.profile index c57eae73d..c1ce4bb8d 100644 --- a/etc/profile-a-l/librecad.profile +++ b/etc/profile-a-l/librecad.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/libreoffice.profile b/etc/profile-a-l/libreoffice.profile index b1a24888c..328307705 100644 --- a/etc/profile-a-l/libreoffice.profile +++ b/etc/profile-a-l/libreoffice.profile | |||
@@ -19,7 +19,6 @@ blacklist /usr/libexec | |||
19 | include disable-common.inc | 19 | include disable-common.inc |
20 | include disable-devel.inc | 20 | include disable-devel.inc |
21 | include disable-exec.inc | 21 | include disable-exec.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | 23 | ||
25 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/librewolf.profile b/etc/profile-a-l/librewolf.profile index 8e3e58f19..ebffbbabf 100644 --- a/etc/profile-a-l/librewolf.profile +++ b/etc/profile-a-l/librewolf.profile | |||
@@ -36,6 +36,7 @@ include whitelist-usr-share-common.inc | |||
36 | #private-etc librewolf | 36 | #private-etc librewolf |
37 | 37 | ||
38 | dbus-user filter | 38 | dbus-user filter |
39 | dbus-user.own org.mozilla.librewolf.* | ||
39 | # Add the next line to your librewolf.local to enable native notifications. | 40 | # Add the next line to your librewolf.local to enable native notifications. |
40 | #dbus-user.talk org.freedesktop.Notifications | 41 | #dbus-user.talk org.freedesktop.Notifications |
41 | # Add the next line to your librewolf.local to allow inhibiting screensavers. | 42 | # Add the next line to your librewolf.local to allow inhibiting screensavers. |
@@ -44,9 +45,8 @@ dbus-user filter | |||
44 | #dbus-user.own org.mpris.MediaPlayer2.plasma-browser-integration | 45 | #dbus-user.own org.mpris.MediaPlayer2.plasma-browser-integration |
45 | #dbus-user.talk org.kde.JobViewServer | 46 | #dbus-user.talk org.kde.JobViewServer |
46 | #dbus-user.talk org.kde.kuiserver | 47 | #dbus-user.talk org.kde.kuiserver |
47 | # Add the next lines to your librewolf.local to allow screensharing under Wayland. | 48 | # Add the next line to your librewolf.local to allow screensharing under Wayland. |
48 | #whitelist ${RUNUSER}/pipewire-0 | 49 | #dbus-user.talk org.freedesktop.portal.Desktop |
49 | #dbus-user.talk org.freedesktop.portal.* | ||
50 | # Also add the next line to your librewolf.local if screensharing does not work with | 50 | # Also add the next line to your librewolf.local if screensharing does not work with |
51 | # the above lines (depends on the portal implementation). | 51 | # the above lines (depends on the portal implementation). |
52 | #ignore noroot | 52 | #ignore noroot |
diff --git a/etc/profile-a-l/lifeograph.profile b/etc/profile-a-l/lifeograph.profile new file mode 100644 index 000000000..747fd85fa --- /dev/null +++ b/etc/profile-a-l/lifeograph.profile | |||
@@ -0,0 +1,57 @@ | |||
1 | # Firejail profile for lifeograph | ||
2 | # Description: Lifeograph is a diary program to take personal notes | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include lifeograph.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${DOCUMENTS} | ||
10 | |||
11 | blacklist /usr/libexec | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | whitelist ${DOCUMENTS} | ||
22 | whitelist /usr/share/lifeograph | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
26 | include whitelist-var-common.inc | ||
27 | |||
28 | apparmor | ||
29 | caps.drop all | ||
30 | machine-id | ||
31 | net none | ||
32 | no3d | ||
33 | nodvd | ||
34 | nogroups | ||
35 | noinput | ||
36 | nonewprivs | ||
37 | noroot | ||
38 | nosound | ||
39 | notv | ||
40 | nou2f | ||
41 | novideo | ||
42 | protocol unix | ||
43 | seccomp | ||
44 | seccomp.block-secondary | ||
45 | shell none | ||
46 | tracelog | ||
47 | |||
48 | disable-mnt | ||
49 | private-bin lifeograph | ||
50 | private-cache | ||
51 | private-dev | ||
52 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11 | ||
53 | private-tmp | ||
54 | |||
55 | dbus-user filter | ||
56 | dbus-user.talk ca.desrt.dconf | ||
57 | dbus-system none | ||
diff --git a/etc/profile-a-l/liferea.profile b/etc/profile-a-l/liferea.profile index 7afca1d5f..f7955e352 100644 --- a/etc/profile-a-l/liferea.profile +++ b/etc/profile-a-l/liferea.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | 22 | ||
24 | mkdir ${HOME}/.cache/liferea | 23 | mkdir ${HOME}/.cache/liferea |
diff --git a/etc/profile-a-l/lincity-ng.profile b/etc/profile-a-l/lincity-ng.profile index 4254b7f33..073d814ec 100644 --- a/etc/profile-a-l/lincity-ng.profile +++ b/etc/profile-a-l/lincity-ng.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/links-common.profile b/etc/profile-a-l/links-common.profile index cd885b1d4..dac3eaee3 100644 --- a/etc/profile-a-l/links-common.profile +++ b/etc/profile-a-l/links-common.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | # Additional noblacklist files/directories (blacklisted in disable-programs.inc) | 14 | # Additional noblacklist files/directories (blacklisted in disable-programs.inc) |
16 | # used as associated programs can be added in your links-common.local. | 15 | # used as associated programs can be added in your links-common.local. |
17 | include disable-programs.inc | 16 | include disable-programs.inc |
@@ -48,11 +47,11 @@ shell none | |||
48 | tracelog | 47 | tracelog |
49 | 48 | ||
50 | disable-mnt | 49 | disable-mnt |
51 | # Add 'private-bin PROGRAM1,PROGRAM2' to your links-common.local if you want to use user-configured programs. | 50 | # Add 'private-bin PROGRAM1,PROGRAM2' to your links-common.local if you want to use user-configured programs. |
52 | private-bin sh | 51 | private-bin sh |
53 | private-cache | 52 | private-cache |
54 | private-dev | 53 | private-dev |
55 | private-etc alternatives,ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl | 54 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
56 | # Add the next line to your links-common.local to allow external media players. | 55 | # Add the next line to your links-common.local to allow external media players. |
57 | # private-etc alsa,asound.conf,machine-id,openal,pulse | 56 | # private-etc alsa,asound.conf,machine-id,openal,pulse |
58 | private-tmp | 57 | private-tmp |
diff --git a/etc/profile-a-l/linphone.profile b/etc/profile-a-l/linphone.profile index 7ebdbef4c..f821c7512 100644 --- a/etc/profile-a-l/linphone.profile +++ b/etc/profile-a-l/linphone.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | # linphone 4.0 (released 2017-06-26) moved config and database files to respect | 20 | # linphone 4.0 (released 2017-06-26) moved config and database files to respect |
diff --git a/etc/profile-a-l/lmms.profile b/etc/profile-a-l/lmms.profile index 48b0e14dc..d1a754a6e 100644 --- a/etc/profile-a-l/lmms.profile +++ b/etc/profile-a-l/lmms.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-a-l/lollypop.profile b/etc/profile-a-l/lollypop.profile index f2676fec5..a590c5fb7 100644 --- a/etc/profile-a-l/lollypop.profile +++ b/etc/profile-a-l/lollypop.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
@@ -38,6 +37,6 @@ seccomp | |||
38 | shell none | 37 | shell none |
39 | 38 | ||
40 | private-dev | 39 | private-dev |
41 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,xdg | 40 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg |
42 | private-tmp | 41 | private-tmp |
43 | 42 | ||
diff --git a/etc/profile-a-l/lugaru.profile b/etc/profile-a-l/lugaru.profile index 174c65a65..3d52d1266 100644 --- a/etc/profile-a-l/lugaru.profile +++ b/etc/profile-a-l/lugaru.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
diff --git a/etc/profile-a-l/luminance-hdr.profile b/etc/profile-a-l/luminance-hdr.profile index 31067034e..179bc37f2 100644 --- a/etc/profile-a-l/luminance-hdr.profile +++ b/etc/profile-a-l/luminance-hdr.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-a-l/lutris.profile b/etc/profile-a-l/lutris.profile index 80a3aba86..bf8ab9e64 100644 --- a/etc/profile-a-l/lutris.profile +++ b/etc/profile-a-l/lutris.profile | |||
@@ -29,7 +29,6 @@ include disable-common.inc | |||
29 | include disable-devel.inc | 29 | include disable-devel.inc |
30 | include disable-exec.inc | 30 | include disable-exec.inc |
31 | include disable-interpreters.inc | 31 | include disable-interpreters.inc |
32 | include disable-passwdmgr.inc | ||
33 | include disable-programs.inc | 32 | include disable-programs.inc |
34 | include disable-xdg.inc | 33 | include disable-xdg.inc |
35 | 34 | ||
diff --git a/etc/profile-a-l/lximage-qt.profile b/etc/profile-a-l/lximage-qt.profile index b2a56012e..404535f91 100644 --- a/etc/profile-a-l/lximage-qt.profile +++ b/etc/profile-a-l/lximage-qt.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include whitelist-var-common.inc | 16 | include whitelist-var-common.inc |
18 | 17 | ||
diff --git a/etc/profile-a-l/lxmusic.profile b/etc/profile-a-l/lxmusic.profile index cc4b95551..0651b8329 100644 --- a/etc/profile-a-l/lxmusic.profile +++ b/etc/profile-a-l/lxmusic.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-a-l/lynx.profile b/etc/profile-a-l/lynx.profile index a919e924b..05a92e39d 100644 --- a/etc/profile-a-l/lynx.profile +++ b/etc/profile-a-l/lynx.profile | |||
@@ -13,7 +13,6 @@ blacklist ${RUNUSER}/wayland-* | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-a-l/lyx.profile b/etc/profile-a-l/lyx.profile index fa69463d1..3213f3674 100644 --- a/etc/profile-a-l/lyx.profile +++ b/etc/profile-a-l/lyx.profile | |||
@@ -32,7 +32,7 @@ apparmor | |||
32 | machine-id | 32 | machine-id |
33 | 33 | ||
34 | # private-bin atril,dvilualatex,env,latex,lua*,luatex,lyx,lyxclient,okular,pdf2latex,pdflatex,pdftex,perl*,python*,qpdf,qpdfview,sh,tex2lyx,texmf,xelatex | 34 | # private-bin atril,dvilualatex,env,latex,lua*,luatex,lyx,lyxclient,okular,pdf2latex,pdflatex,pdftex,perl*,python*,qpdf,qpdfview,sh,tex2lyx,texmf,xelatex |
35 | private-etc alternatives,dconf,fonts,gtk-2.0,gtk-3.0,locale,locale.alias,locale.conf,lyx,machine-id,mime.types,passwd,texmf,X11,xdg | 35 | private-etc alternatives,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.preload,locale,locale.alias,locale.conf,lyx,machine-id,mime.types,passwd,texmf,X11,xdg |
36 | 36 | ||
37 | # Redirect | 37 | # Redirect |
38 | include latex-common.profile | 38 | include latex-common.profile |
diff --git a/etc/profile-m-z/Maelstrom.profile b/etc/profile-m-z/Maelstrom.profile index 62d0a8b3a..3acb88e0e 100644 --- a/etc/profile-m-z/Maelstrom.profile +++ b/etc/profile-m-z/Maelstrom.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/Mathematica.profile b/etc/profile-m-z/Mathematica.profile index c2734b1c1..6286f066e 100644 --- a/etc/profile-m-z/Mathematica.profile +++ b/etc/profile-m-z/Mathematica.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${HOME}/.Wolfram Research | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | mkdir ${HOME}/.Mathematica | 16 | mkdir ${HOME}/.Mathematica |
diff --git a/etc/profile-m-z/PCSX2.profile b/etc/profile-m-z/PCSX2.profile index e678b7204..59150f4c4 100644 --- a/etc/profile-m-z/PCSX2.profile +++ b/etc/profile-m-z/PCSX2.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-write-mnt.inc | 19 | include disable-write-mnt.inc |
diff --git a/etc/profile-m-z/QMediathekView.profile b/etc/profile-m-z/QMediathekView.profile index 86120587b..17ea38073 100644 --- a/etc/profile-m-z/QMediathekView.profile +++ b/etc/profile-m-z/QMediathekView.profile | |||
@@ -23,7 +23,6 @@ include disable-common.inc | |||
23 | include disable-devel.inc | 23 | include disable-devel.inc |
24 | include disable-exec.inc | 24 | include disable-exec.inc |
25 | include disable-interpreters.inc | 25 | include disable-interpreters.inc |
26 | include disable-passwdmgr.inc | ||
27 | include disable-programs.inc | 26 | include disable-programs.inc |
28 | include disable-shell.inc | 27 | include disable-shell.inc |
29 | include disable-xdg.inc | 28 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/QOwnNotes.profile b/etc/profile-m-z/QOwnNotes.profile index 660378089..235640eeb 100644 --- a/etc/profile-m-z/QOwnNotes.profile +++ b/etc/profile-m-z/QOwnNotes.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -51,6 +50,6 @@ tracelog | |||
51 | disable-mnt | 50 | disable-mnt |
52 | private-bin gio,QOwnNotes | 51 | private-bin gio,QOwnNotes |
53 | private-dev | 52 | private-dev |
54 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hosts,ld.so.cache,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl | 53 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hosts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
diff --git a/etc/profile-m-z/Viber.profile b/etc/profile-m-z/Viber.profile index 3195e39fa..ca7165a5d 100644 --- a/etc/profile-m-z/Viber.profile +++ b/etc/profile-m-z/Viber.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/.ViberPC | 17 | mkdir ${HOME}/.ViberPC |
@@ -34,5 +33,5 @@ shell none | |||
34 | 33 | ||
35 | disable-mnt | 34 | disable-mnt |
36 | private-bin awk,bash,dig,sh,Viber | 35 | private-bin awk,bash,dig,sh,Viber |
37 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hosts,localtime,machine-id,mailcap,nsswitch.conf,pki,proxychains.conf,pulse,resolv.conf,ssl,X11 | 36 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hosts,ld.so.preload,localtime,machine-id,mailcap,nsswitch.conf,pki,proxychains.conf,pulse,resolv.conf,ssl,X11 |
38 | private-tmp | 37 | private-tmp |
diff --git a/etc/profile-m-z/XMind.profile b/etc/profile-m-z/XMind.profile index d78e04595..9c797a3e5 100644 --- a/etc/profile-m-z/XMind.profile +++ b/etc/profile-m-z/XMind.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | mkdir ${HOME}/.xmind | 16 | mkdir ${HOME}/.xmind |
diff --git a/etc/profile-m-z/Xvfb.profile b/etc/profile-m-z/Xvfb.profile index 1acd43023..722e12d9c 100644 --- a/etc/profile-m-z/Xvfb.profile +++ b/etc/profile-m-z/Xvfb.profile | |||
@@ -43,5 +43,5 @@ private | |||
43 | # private-bin sh,xkbcomp,Xvfb | 43 | # private-bin sh,xkbcomp,Xvfb |
44 | # private-bin bash,cat,ls,sh,strace,xkbcomp,Xvfb | 44 | # private-bin bash,cat,ls,sh,strace,xkbcomp,Xvfb |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,nsswitch.conf,resolv.conf | 46 | private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.preload,nsswitch.conf,resolv.conf |
47 | private-tmp | 47 | private-tmp |
diff --git a/etc/profile-m-z/ZeGrapher.profile b/etc/profile-m-z/ZeGrapher.profile index 7686c3442..21482a161 100644 --- a/etc/profile-m-z/ZeGrapher.profile +++ b/etc/profile-m-z/ZeGrapher.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/macrofusion.profile b/etc/profile-m-z/macrofusion.profile index d1dcb6fe0..88b68d43f 100644 --- a/etc/profile-m-z/macrofusion.profile +++ b/etc/profile-m-z/macrofusion.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/magicor.profile b/etc/profile-m-z/magicor.profile index 8a27b2626..b7cba2421 100644 --- a/etc/profile-m-z/magicor.profile +++ b/etc/profile-m-z/magicor.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin magicor,python2* | 45 | private-bin magicor,python2* |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc machine-id | 48 | private-etc ld.so.preload,machine-id |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-m-z/makepkg.profile b/etc/profile-m-z/makepkg.profile index 513fcae55..3a68cce00 100644 --- a/etc/profile-m-z/makepkg.profile +++ b/etc/profile-m-z/makepkg.profile | |||
@@ -32,7 +32,6 @@ noblacklist /var/lib/pacman | |||
32 | 32 | ||
33 | include disable-common.inc | 33 | include disable-common.inc |
34 | include disable-exec.inc | 34 | include disable-exec.inc |
35 | include disable-passwdmgr.inc | ||
36 | include disable-programs.inc | 35 | include disable-programs.inc |
37 | 36 | ||
38 | caps.drop all | 37 | caps.drop all |
diff --git a/etc/profile-m-z/man.profile b/etc/profile-m-z/man.profile index bd510fcac..b6038cc91 100644 --- a/etc/profile-m-z/man.profile +++ b/etc/profile-m-z/man.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
@@ -59,7 +58,7 @@ disable-mnt | |||
59 | #private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim | 58 | #private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim |
60 | private-cache | 59 | private-cache |
61 | private-dev | 60 | private-dev |
62 | private-etc alternatives,fonts,groff,locale,locale.alias,locale.conf,man_db.conf,manpath.config,selinux,sysless,xdg | 61 | private-etc alternatives,fonts,groff,ld.so.preload,locale,locale.alias,locale.conf,man_db.conf,manpath.config,selinux,sysless,xdg |
63 | #private-tmp | 62 | #private-tmp |
64 | 63 | ||
65 | dbus-user none | 64 | dbus-user none |
diff --git a/etc/profile-m-z/manaplus.profile b/etc/profile-m-z/manaplus.profile index f59a56ac6..28dc5d914 100644 --- a/etc/profile-m-z/manaplus.profile +++ b/etc/profile-m-z/manaplus.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/marker.profile b/etc/profile-m-z/marker.profile index bd56a8221..746135ae5 100644 --- a/etc/profile-m-z/marker.profile +++ b/etc/profile-m-z/marker.profile | |||
@@ -20,7 +20,6 @@ include disable-common.inc | |||
20 | include disable-devel.inc | 20 | include disable-devel.inc |
21 | include disable-exec.inc | 21 | include disable-exec.inc |
22 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | 23 | include disable-programs.inc |
25 | include disable-shell.inc | 24 | include disable-shell.inc |
26 | include disable-xdg.inc | 25 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/masterpdfeditor.profile b/etc/profile-m-z/masterpdfeditor.profile index de1135071..dc2088a18 100644 --- a/etc/profile-m-z/masterpdfeditor.profile +++ b/etc/profile-m-z/masterpdfeditor.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
@@ -37,6 +36,6 @@ tracelog | |||
37 | 36 | ||
38 | private-cache | 37 | private-cache |
39 | private-dev | 38 | private-dev |
40 | private-etc alternatives,fonts | 39 | private-etc alternatives,fonts,ld.so.preload |
41 | private-tmp | 40 | private-tmp |
42 | 41 | ||
diff --git a/etc/profile-m-z/mate-calc.profile b/etc/profile-m-z/mate-calc.profile index 39ee7439d..cb14c6584 100644 --- a/etc/profile-m-z/mate-calc.profile +++ b/etc/profile-m-z/mate-calc.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/.cache/mate-calc | 17 | mkdir ${HOME}/.cache/mate-calc |
@@ -43,7 +42,7 @@ shell none | |||
43 | 42 | ||
44 | disable-mnt | 43 | disable-mnt |
45 | private-bin mate-calc,mate-calculator | 44 | private-bin mate-calc,mate-calculator |
46 | private-etc alternatives,dconf,fonts,gtk-3.0 | 45 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload |
47 | private-dev | 46 | private-dev |
48 | private-opt none | 47 | private-opt none |
49 | private-tmp | 48 | private-tmp |
diff --git a/etc/profile-m-z/mate-color-select.profile b/etc/profile-m-z/mate-color-select.profile index 007bab30d..97793abd5 100644 --- a/etc/profile-m-z/mate-color-select.profile +++ b/etc/profile-m-z/mate-color-select.profile | |||
@@ -9,7 +9,6 @@ include disable-common.inc | |||
9 | include disable-devel.inc | 9 | include disable-devel.inc |
10 | include disable-exec.inc | 10 | include disable-exec.inc |
11 | include disable-interpreters.inc | 11 | include disable-interpreters.inc |
12 | include disable-passwdmgr.inc | ||
13 | include disable-programs.inc | 12 | include disable-programs.inc |
14 | include disable-shell.inc | 13 | include disable-shell.inc |
15 | 14 | ||
@@ -34,7 +33,7 @@ shell none | |||
34 | 33 | ||
35 | disable-mnt | 34 | disable-mnt |
36 | private-bin mate-color-select | 35 | private-bin mate-color-select |
37 | private-etc alternatives,fonts | 36 | private-etc alternatives,fonts,ld.so.preload |
38 | private-dev | 37 | private-dev |
39 | private-lib | 38 | private-lib |
40 | private-tmp | 39 | private-tmp |
diff --git a/etc/profile-m-z/mate-dictionary.profile b/etc/profile-m-z/mate-dictionary.profile index ae1fcbf62..cb0002af6 100644 --- a/etc/profile-m-z/mate-dictionary.profile +++ b/etc/profile-m-z/mate-dictionary.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | 16 | ||
@@ -38,7 +37,7 @@ shell none | |||
38 | 37 | ||
39 | disable-mnt | 38 | disable-mnt |
40 | private-bin mate-dictionary | 39 | private-bin mate-dictionary |
41 | private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssl | 40 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,pki,resolv.conf,ssl |
42 | private-opt mate-dictionary | 41 | private-opt mate-dictionary |
43 | private-dev | 42 | private-dev |
44 | private-tmp | 43 | private-tmp |
diff --git a/etc/profile-m-z/mcabber.profile b/etc/profile-m-z/mcabber.profile index 38d2d8d63..87083f1e3 100644 --- a/etc/profile-m-z/mcabber.profile +++ b/etc/profile-m-z/mcabber.profile | |||
@@ -12,7 +12,6 @@ noblacklist ${HOME}/.mcabberrc | |||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
@@ -32,4 +31,4 @@ shell none | |||
32 | 31 | ||
33 | private-bin mcabber | 32 | private-bin mcabber |
34 | private-dev | 33 | private-dev |
35 | private-etc alternatives,ca-certificates,crypto-policies,pki,ssl | 34 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,pki,ssl |
diff --git a/etc/profile-m-z/mcomix.profile b/etc/profile-m-z/mcomix.profile index fcd1e24e5..5c965f55c 100644 --- a/etc/profile-m-z/mcomix.profile +++ b/etc/profile-m-z/mcomix.profile | |||
@@ -22,7 +22,6 @@ include disable-common.inc | |||
22 | include disable-devel.inc | 22 | include disable-devel.inc |
23 | include disable-exec.inc | 23 | include disable-exec.inc |
24 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
25 | include disable-passwdmgr.inc | ||
26 | include disable-programs.inc | 25 | include disable-programs.inc |
27 | include disable-shell.inc | 26 | include disable-shell.inc |
28 | include disable-write-mnt.inc | 27 | include disable-write-mnt.inc |
diff --git a/etc/profile-m-z/mdr.profile b/etc/profile-m-z/mdr.profile index 5d3f8dc41..da5e0ffa8 100644 --- a/etc/profile-m-z/mdr.profile +++ b/etc/profile-m-z/mdr.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin mdr | 45 | private-bin mdr |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc none | 48 | private-etc ld.so.preload,none |
50 | private-lib | 49 | private-lib |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
diff --git a/etc/profile-m-z/mediainfo.profile b/etc/profile-m-z/mediainfo.profile index 17363624f..9403321e2 100644 --- a/etc/profile-m-z/mediainfo.profile +++ b/etc/profile-m-z/mediainfo.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
@@ -43,7 +42,7 @@ x11 none | |||
43 | private-bin mediainfo | 42 | private-bin mediainfo |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc alternatives | 45 | private-etc alternatives,ld.so.preload |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-m-z/mediathekview.profile b/etc/profile-m-z/mediathekview.profile index 0063badd8..f73ef0935 100644 --- a/etc/profile-m-z/mediathekview.profile +++ b/etc/profile-m-z/mediathekview.profile | |||
@@ -24,7 +24,6 @@ include disable-common.inc | |||
24 | include disable-devel.inc | 24 | include disable-devel.inc |
25 | include disable-exec.inc | 25 | include disable-exec.inc |
26 | include disable-interpreters.inc | 26 | include disable-interpreters.inc |
27 | include disable-passwdmgr.inc | ||
28 | include disable-programs.inc | 27 | include disable-programs.inc |
29 | include disable-xdg.inc | 28 | include disable-xdg.inc |
30 | 29 | ||
diff --git a/etc/profile-m-z/megaglest.profile b/etc/profile-m-z/megaglest.profile index f07b9166a..d55745698 100644 --- a/etc/profile-m-z/megaglest.profile +++ b/etc/profile-m-z/megaglest.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/meld.profile b/etc/profile-m-z/meld.profile index 2a8bb3acf..4aeca0f28 100644 --- a/etc/profile-m-z/meld.profile +++ b/etc/profile-m-z/meld.profile | |||
@@ -36,7 +36,6 @@ blacklist /usr/libexec | |||
36 | include disable-devel.inc | 36 | include disable-devel.inc |
37 | include disable-exec.inc | 37 | include disable-exec.inc |
38 | include disable-interpreters.inc | 38 | include disable-interpreters.inc |
39 | include disable-passwdmgr.inc | ||
40 | # Add the next line to your meld.local if you don't need to compare files in disable-programs.inc. | 39 | # Add the next line to your meld.local if you don't need to compare files in disable-programs.inc. |
41 | #include disable-programs.inc | 40 | #include disable-programs.inc |
42 | include disable-shell.inc | 41 | include disable-shell.inc |
diff --git a/etc/profile-m-z/mencoder.profile b/etc/profile-m-z/mencoder.profile index caf238785..3909e543e 100644 --- a/etc/profile-m-z/mencoder.profile +++ b/etc/profile-m-z/mencoder.profile | |||
@@ -11,7 +11,6 @@ include mencoder.local | |||
11 | #include disable-common.inc | 11 | #include disable-common.inc |
12 | #include disable-devel.inc | 12 | #include disable-devel.inc |
13 | #include disable-interpreters.inc | 13 | #include disable-interpreters.inc |
14 | #include disable-passwdmgr.inc | ||
15 | #include disable-programs.inc | 14 | #include disable-programs.inc |
16 | 15 | ||
17 | ipc-namespace | 16 | ipc-namespace |
diff --git a/etc/profile-m-z/mendeleydesktop.profile b/etc/profile-m-z/mendeleydesktop.profile index c0bdbb230..446109e9a 100644 --- a/etc/profile-m-z/mendeleydesktop.profile +++ b/etc/profile-m-z/mendeleydesktop.profile | |||
@@ -22,7 +22,6 @@ include disable-common.inc | |||
22 | include disable-devel.inc | 22 | include disable-devel.inc |
23 | include disable-exec.inc | 23 | include disable-exec.inc |
24 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
25 | include disable-passwdmgr.inc | ||
26 | include disable-programs.inc | 25 | include disable-programs.inc |
27 | 26 | ||
28 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/menulibre.profile b/etc/profile-m-z/menulibre.profile index 2081b8c96..f9f7db3cb 100644 --- a/etc/profile-m-z/menulibre.profile +++ b/etc/profile-m-z/menulibre.profile | |||
@@ -15,7 +15,6 @@ include disable-devel.inc | |||
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
21 | # Whitelist your system icon directory,varies by distro | 20 | # Whitelist your system icon directory,varies by distro |
@@ -53,7 +52,7 @@ tracelog | |||
53 | disable-mnt | 52 | disable-mnt |
54 | private-cache | 53 | private-cache |
55 | private-dev | 54 | private-dev |
56 | private-etc alternatives,dconf,fonts,gtk-3.0,locale.alias,locale.conf,mime.types,nsswitch.conf,passwd,pki,selinux,X11,xdg | 55 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload,locale.alias,locale.conf,mime.types,nsswitch.conf,passwd,pki,selinux,X11,xdg |
57 | private-tmp | 56 | private-tmp |
58 | 57 | ||
59 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-m-z/meteo-qt.profile b/etc/profile-m-z/meteo-qt.profile index 85ed7bc74..bdd36949b 100644 --- a/etc/profile-m-z/meteo-qt.profile +++ b/etc/profile-m-z/meteo-qt.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/microsoft-edge-beta.profile b/etc/profile-m-z/microsoft-edge-beta.profile new file mode 100644 index 000000000..095038f08 --- /dev/null +++ b/etc/profile-m-z/microsoft-edge-beta.profile | |||
@@ -0,0 +1,20 @@ | |||
1 | # Firejail profile for Microsoft Edge Beta | ||
2 | # Description: Web browser from Microsoft,beta channel | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include microsoft-edge-beta.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/microsoft-edge-beta | ||
10 | noblacklist ${HOME}/.config/microsoft-edge-beta | ||
11 | |||
12 | mkdir ${HOME}/.cache/microsoft-edge-beta | ||
13 | mkdir ${HOME}/.config/microsoft-edge-beta | ||
14 | whitelist ${HOME}/.cache/microsoft-edge-beta | ||
15 | whitelist ${HOME}/.config/microsoft-edge-beta | ||
16 | |||
17 | private-opt microsoft | ||
18 | |||
19 | # Redirect | ||
20 | include chromium-common.profile | ||
diff --git a/etc/profile-m-z/midori.profile b/etc/profile-m-z/midori.profile index e15259608..7928d124e 100644 --- a/etc/profile-m-z/midori.profile +++ b/etc/profile-m-z/midori.profile | |||
@@ -25,7 +25,6 @@ include disable-common.inc | |||
25 | include disable-devel.inc | 25 | include disable-devel.inc |
26 | include disable-exec.inc | 26 | include disable-exec.inc |
27 | include disable-interpreters.inc | 27 | include disable-interpreters.inc |
28 | #include disable-passwdmgr.inc | ||
29 | include disable-programs.inc | 28 | include disable-programs.inc |
30 | include disable-xdg.inc | 29 | include disable-xdg.inc |
31 | 30 | ||
diff --git a/etc/profile-m-z/mindless.profile b/etc/profile-m-z/mindless.profile index fbf6b58e8..bcc7b232b 100644 --- a/etc/profile-m-z/mindless.profile +++ b/etc/profile-m-z/mindless.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -43,7 +42,7 @@ private | |||
43 | private-bin mindless | 42 | private-bin mindless |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc fonts | 45 | private-etc fonts,ld.so.preload |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-m-z/minecraft-launcher.profile b/etc/profile-m-z/minecraft-launcher.profile index 1028e374a..d4f3e344e 100644 --- a/etc/profile-m-z/minecraft-launcher.profile +++ b/etc/profile-m-z/minecraft-launcher.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-shell.inc | 23 | include disable-shell.inc |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/minetest.profile b/etc/profile-m-z/minetest.profile index cad1adbda..ec5de821a 100644 --- a/etc/profile-m-z/minetest.profile +++ b/etc/profile-m-z/minetest.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-shell.inc | 23 | include disable-shell.inc |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/minitube.profile b/etc/profile-m-z/minitube.profile index 3fe3428d0..581af9b81 100644 --- a/etc/profile-m-z/minitube.profile +++ b/etc/profile-m-z/minitube.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
@@ -47,7 +46,7 @@ notv | |||
47 | nou2f | 46 | nou2f |
48 | novideo | 47 | novideo |
49 | protocol unix,inet,inet6,netlink | 48 | protocol unix,inet,inet6,netlink |
50 | seccomp !kcmp | 49 | seccomp |
51 | shell none | 50 | shell none |
52 | tracelog | 51 | tracelog |
53 | 52 | ||
diff --git a/etc/profile-m-z/mirage.profile b/etc/profile-m-z/mirage.profile index 505009283..5a8544965 100644 --- a/etc/profile-m-z/mirage.profile +++ b/etc/profile-m-z/mirage.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-shell.inc | 23 | include disable-shell.inc |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/mirrormagic.profile b/etc/profile-m-z/mirrormagic.profile index 58dfd56f5..133a17350 100644 --- a/etc/profile-m-z/mirrormagic.profile +++ b/etc/profile-m-z/mirrormagic.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -45,7 +44,7 @@ private | |||
45 | private-bin mirrormagic | 44 | private-bin mirrormagic |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc machine-id | 47 | private-etc ld.so.preload,machine-id |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-m-z/mocp.profile b/etc/profile-m-z/mocp.profile index e71ba4569..79f603f92 100644 --- a/etc/profile-m-z/mocp.profile +++ b/etc/profile-m-z/mocp.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -43,7 +42,7 @@ tracelog | |||
43 | private-bin mocp | 42 | private-bin mocp |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,machine-id,pki,pulse,resolv.conf,ssl | 45 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-m-z/mousepad.profile b/etc/profile-m-z/mousepad.profile index 98063fa7c..2939d9bde 100644 --- a/etc/profile-m-z/mousepad.profile +++ b/etc/profile-m-z/mousepad.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/mp3splt-gtk.profile b/etc/profile-m-z/mp3splt-gtk.profile index 37ce60e04..445691f6a 100644 --- a/etc/profile-m-z/mp3splt-gtk.profile +++ b/etc/profile-m-z/mp3splt-gtk.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
@@ -38,7 +37,7 @@ tracelog | |||
38 | private-bin mp3splt-gtk | 37 | private-bin mp3splt-gtk |
39 | private-cache | 38 | private-cache |
40 | private-dev | 39 | private-dev |
41 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-3.0,machine-id,openal,pulse | 40 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-3.0,ld.so.preload,machine-id,openal,pulse |
42 | private-tmp | 41 | private-tmp |
43 | 42 | ||
44 | dbus-user none | 43 | dbus-user none |
diff --git a/etc/profile-m-z/mp3splt.profile b/etc/profile-m-z/mp3splt.profile index 070de8451..4d6109250 100644 --- a/etc/profile-m-z/mp3splt.profile +++ b/etc/profile-m-z/mp3splt.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -45,7 +44,7 @@ disable-mnt | |||
45 | private-bin flacsplt,mp3splt,mp3wrap,oggsplt | 44 | private-bin flacsplt,mp3splt,mp3wrap,oggsplt |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc alternatives | 47 | private-etc alternatives,ld.so.preload |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | memory-deny-write-execute | 50 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/mpDris2.profile b/etc/profile-m-z/mpDris2.profile index 55a0b5897..597390914 100644 --- a/etc/profile-m-z/mpDris2.profile +++ b/etc/profile-m-z/mpDris2.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ shell none | |||
50 | private-bin mpDris2,notify-send,python* | 49 | private-bin mpDris2,notify-send,python* |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc alternatives,hosts,nsswitch.conf | 52 | private-etc alternatives,hosts,ld.so.preload,nsswitch.conf |
54 | private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotify.so.*,libpython*,python2*,python3* | 53 | private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotify.so.*,libpython*,python2*,python3* |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
diff --git a/etc/profile-m-z/mpd.profile b/etc/profile-m-z/mpd.profile index b517d4ab2..761d5b041 100644 --- a/etc/profile-m-z/mpd.profile +++ b/etc/profile-m-z/mpd.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-m-z/mpg123.profile b/etc/profile-m-z/mpg123.profile index 25187e894..c3bff23bc 100644 --- a/etc/profile-m-z/mpg123.profile +++ b/etc/profile-m-z/mpg123.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/mplayer.profile b/etc/profile-m-z/mplayer.profile index 5d023b7f1..2d51d9884 100644 --- a/etc/profile-m-z/mplayer.profile +++ b/etc/profile-m-z/mplayer.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | read-only ${DESKTOP} | 17 | read-only ${DESKTOP} |
diff --git a/etc/profile-m-z/mpsyt.profile b/etc/profile-m-z/mpsyt.profile index bfe57a132..cadfd9b7f 100644 --- a/etc/profile-m-z/mpsyt.profile +++ b/etc/profile-m-z/mpsyt.profile | |||
@@ -27,7 +27,6 @@ include disable-common.inc | |||
27 | include disable-devel.inc | 27 | include disable-devel.inc |
28 | include disable-exec.inc | 28 | include disable-exec.inc |
29 | include disable-interpreters.inc | 29 | include disable-interpreters.inc |
30 | include disable-passwdmgr.inc | ||
31 | include disable-programs.inc | 30 | include disable-programs.inc |
32 | include disable-shell.inc | 31 | include disable-shell.inc |
33 | include disable-xdg.inc | 32 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/mpv.profile b/etc/profile-m-z/mpv.profile index af5c214f7..74402a8de 100644 --- a/etc/profile-m-z/mpv.profile +++ b/etc/profile-m-z/mpv.profile | |||
@@ -11,7 +11,7 @@ include globals.local | |||
11 | # edit ~/.config/mpv/foobar.conf: | 11 | # edit ~/.config/mpv/foobar.conf: |
12 | # screenshot-directory=~/Pictures | 12 | # screenshot-directory=~/Pictures |
13 | 13 | ||
14 | # Mpv has a powerfull lua-API, some off these lua-scripts interact | 14 | # Mpv has a powerful lua-API, some off these lua-scripts interact |
15 | # with external resources which are blocked by firejail. In such cases | 15 | # with external resources which are blocked by firejail. In such cases |
16 | # you need to allow these resources by | 16 | # you need to allow these resources by |
17 | # - adding additional binaries to private-bin | 17 | # - adding additional binaries to private-bin |
@@ -41,7 +41,6 @@ include disable-common.inc | |||
41 | include disable-devel.inc | 41 | include disable-devel.inc |
42 | include disable-exec.inc | 42 | include disable-exec.inc |
43 | include disable-interpreters.inc | 43 | include disable-interpreters.inc |
44 | include disable-passwdmgr.inc | ||
45 | include disable-programs.inc | 44 | include disable-programs.inc |
46 | include disable-shell.inc | 45 | include disable-shell.inc |
47 | 46 | ||
diff --git a/etc/profile-m-z/mrrescue.profile b/etc/profile-m-z/mrrescue.profile index e3ceb3bd4..16dc97d0c 100644 --- a/etc/profile-m-z/mrrescue.profile +++ b/etc/profile-m-z/mrrescue.profile | |||
@@ -20,7 +20,6 @@ include disable-common.inc | |||
20 | include disable-devel.inc | 20 | include disable-devel.inc |
21 | include disable-exec.inc | 21 | include disable-exec.inc |
22 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | 23 | include disable-programs.inc |
25 | include disable-shell.inc | 24 | include disable-shell.inc |
26 | include disable-xdg.inc | 25 | include disable-xdg.inc |
@@ -54,7 +53,7 @@ disable-mnt | |||
54 | private-bin love,mrrescue,sh | 53 | private-bin love,mrrescue,sh |
55 | private-cache | 54 | private-cache |
56 | private-dev | 55 | private-dev |
57 | private-etc machine-id | 56 | private-etc ld.so.preload,machine-id |
58 | private-tmp | 57 | private-tmp |
59 | 58 | ||
60 | dbus-user none | 59 | dbus-user none |
diff --git a/etc/profile-m-z/ms-office.profile b/etc/profile-m-z/ms-office.profile index 38fc84ecc..7b4a305e9 100644 --- a/etc/profile-m-z/ms-office.profile +++ b/etc/profile-m-z/ms-office.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | caps.drop all | 21 | caps.drop all |
@@ -36,7 +35,7 @@ tracelog | |||
36 | 35 | ||
37 | disable-mnt | 36 | disable-mnt |
38 | private-bin bash,env,fonts,jak,ms-office,python*,sh | 37 | private-bin bash,env,fonts,jak,ms-office,python*,sh |
39 | private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl | 38 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,pki,resolv.conf,ssl |
40 | private-dev | 39 | private-dev |
41 | private-tmp | 40 | private-tmp |
42 | 41 | ||
diff --git a/etc/profile-m-z/mtpaint.profile b/etc/profile-m-z/mtpaint.profile index 85c3ee9f2..126336cb3 100644 --- a/etc/profile-m-z/mtpaint.profile +++ b/etc/profile-m-z/mtpaint.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/multimc5.profile b/etc/profile-m-z/multimc5.profile index 6df681df1..a61f9001d 100644 --- a/etc/profile-m-z/multimc5.profile +++ b/etc/profile-m-z/multimc5.profile | |||
@@ -9,6 +9,10 @@ noblacklist ${HOME}/.local/share/multimc | |||
9 | noblacklist ${HOME}/.local/share/multimc5 | 9 | noblacklist ${HOME}/.local/share/multimc5 |
10 | noblacklist ${HOME}/.multimc5 | 10 | noblacklist ${HOME}/.multimc5 |
11 | 11 | ||
12 | # Ignore noexec on ${HOME} as MultiMC installs LWJGL native | ||
13 | # libraries in ${HOME}/.local/share/multimc | ||
14 | ignore noexec ${HOME} | ||
15 | |||
12 | # Allow java (blacklisted by disable-devel.inc) | 16 | # Allow java (blacklisted by disable-devel.inc) |
13 | include allow-java.inc | 17 | include allow-java.inc |
14 | 18 | ||
@@ -16,7 +20,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 20 | include disable-devel.inc |
17 | include disable-exec.inc | 21 | include disable-exec.inc |
18 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 23 | include disable-programs.inc |
21 | 24 | ||
22 | mkdir ${HOME}/.local/share/multimc | 25 | mkdir ${HOME}/.local/share/multimc |
diff --git a/etc/profile-m-z/mumble.profile b/etc/profile-m-z/mumble.profile index c7f59c5ee..ad0920979 100644 --- a/etc/profile-m-z/mumble.profile +++ b/etc/profile-m-z/mumble.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/mupdf-x11-curl.profile b/etc/profile-m-z/mupdf-x11-curl.profile index a04d386a2..b95ab2194 100644 --- a/etc/profile-m-z/mupdf-x11-curl.profile +++ b/etc/profile-m-z/mupdf-x11-curl.profile | |||
@@ -12,7 +12,7 @@ ignore net none | |||
12 | netfilter | 12 | netfilter |
13 | protocol unix,inet,inet6 | 13 | protocol unix,inet,inet6 |
14 | 14 | ||
15 | private-etc ca-certificates,crypto-policies,hosts,nsswitch.conf,pki,resolv.conf,ssl | 15 | private-etc ca-certificates,crypto-policies,hosts,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
16 | 16 | ||
17 | # Redirect | 17 | # Redirect |
18 | include mupdf.profile | 18 | include mupdf.profile |
diff --git a/etc/profile-m-z/mupdf.profile b/etc/profile-m-z/mupdf.profile index 9e4609c48..857b9e7df 100644 --- a/etc/profile-m-z/mupdf.profile +++ b/etc/profile-m-z/mupdf.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/mupen64plus.profile b/etc/profile-m-z/mupen64plus.profile index 00983a8f3..093767c27 100644 --- a/etc/profile-m-z/mupen64plus.profile +++ b/etc/profile-m-z/mupen64plus.profile | |||
@@ -11,8 +11,6 @@ noblacklist ${HOME}/.local/share/mupen64plus | |||
11 | 11 | ||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 14 | include disable-programs.inc |
17 | 15 | ||
18 | # you'll need to manually whitelist ROM files | 16 | # you'll need to manually whitelist ROM files |
diff --git a/etc/profile-m-z/musescore.profile b/etc/profile-m-z/musescore.profile index 679e82ae8..12bb653a8 100644 --- a/etc/profile-m-z/musescore.profile +++ b/etc/profile-m-z/musescore.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-m-z/musictube.profile b/etc/profile-m-z/musictube.profile index 04500ac6a..226fb4810 100644 --- a/etc/profile-m-z/musictube.profile +++ b/etc/profile-m-z/musictube.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/musixmatch.profile b/etc/profile-m-z/musixmatch.profile index 74b3e9a5f..aab2ac19d 100644 --- a/etc/profile-m-z/musixmatch.profile +++ b/etc/profile-m-z/musixmatch.profile | |||
@@ -10,7 +10,6 @@ noblacklist ${MUSIC} | |||
10 | include disable-common.inc | 10 | include disable-common.inc |
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-xdg.inc | 14 | include disable-xdg.inc |
16 | 15 | ||
@@ -30,9 +29,9 @@ notv | |||
30 | nou2f | 29 | nou2f |
31 | novideo | 30 | novideo |
32 | protocol unix,inet,inet6,netlink | 31 | protocol unix,inet,inet6,netlink |
33 | seccomp | 32 | seccomp !chroot |
34 | 33 | ||
35 | disable-mnt | 34 | disable-mnt |
36 | private-dev | 35 | private-dev |
37 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,machine-id,pki,pulse,ssl | 36 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,ld.so.preload,machine-id,pki,pulse,ssl |
38 | 37 | ||
diff --git a/etc/profile-m-z/mutt.profile b/etc/profile-m-z/mutt.profile index debf81659..fb923051f 100644 --- a/etc/profile-m-z/mutt.profile +++ b/etc/profile-m-z/mutt.profile | |||
@@ -47,7 +47,6 @@ include disable-common.inc | |||
47 | include disable-devel.inc | 47 | include disable-devel.inc |
48 | include disable-exec.inc | 48 | include disable-exec.inc |
49 | include disable-interpreters.inc | 49 | include disable-interpreters.inc |
50 | include disable-passwdmgr.inc | ||
51 | include disable-programs.inc | 50 | include disable-programs.inc |
52 | include disable-xdg.inc | 51 | include disable-xdg.inc |
53 | 52 | ||
@@ -135,7 +134,7 @@ tracelog | |||
135 | # disable-mnt | 134 | # disable-mnt |
136 | private-cache | 135 | private-cache |
137 | private-dev | 136 | private-dev |
138 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gai.conf,gcrypt,gnupg,gnutls,hostname,hosts,hosts.conf,mail,mailname,Mutt,Muttrc,Muttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,terminfo,xdg | 137 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gai.conf,gcrypt,gnupg,gnutls,hostname,hosts,hosts.conf,ld.so.preload,mail,mailname,Mutt,Muttrc,Muttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,terminfo,xdg |
139 | private-tmp | 138 | private-tmp |
140 | writable-run-user | 139 | writable-run-user |
141 | writable-var | 140 | writable-var |
diff --git a/etc/profile-m-z/mypaint.profile b/etc/profile-m-z/mypaint.profile index d8d487fe7..bf01aaa0e 100644 --- a/etc/profile-m-z/mypaint.profile +++ b/etc/profile-m-z/mypaint.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
25 | 24 | ||
@@ -44,7 +43,7 @@ tracelog | |||
44 | 43 | ||
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,dconf,fonts,gtk-3.0 | 46 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/nano.profile b/etc/profile-m-z/nano.profile index 4698c2287..23a30bf97 100644 --- a/etc/profile-m-z/nano.profile +++ b/etc/profile-m-z/nano.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | whitelist /usr/share/nano | 21 | whitelist /usr/share/nano |
@@ -50,7 +49,7 @@ private-dev | |||
50 | # Add the next lines to your nano.local if you want to edit files in /etc directly. | 49 | # Add the next lines to your nano.local if you want to edit files in /etc directly. |
51 | #ignore private-etc | 50 | #ignore private-etc |
52 | #writable-etc | 51 | #writable-etc |
53 | private-etc alternatives,nanorc | 52 | private-etc alternatives,ld.so.preload,nanorc |
54 | # Add the next line to your nano.local if you want to edit files in /var directly. | 53 | # Add the next line to your nano.local if you want to edit files in /var directly. |
55 | #writable-var | 54 | #writable-var |
56 | 55 | ||
diff --git a/etc/profile-m-z/natron.profile b/etc/profile-m-z/natron.profile index 5bf152f84..2464844c4 100644 --- a/etc/profile-m-z/natron.profile +++ b/etc/profile-m-z/natron.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | 21 | ||
23 | caps.drop all | 22 | caps.drop all |
diff --git a/etc/profile-m-z/ncdu2.profile b/etc/profile-m-z/ncdu2.profile new file mode 100644 index 000000000..5b6364c5d --- /dev/null +++ b/etc/profile-m-z/ncdu2.profile | |||
@@ -0,0 +1,11 @@ | |||
1 | # Firejail profile for ncdu2 | ||
2 | # Description: Ncurses disk usage viewer (zig rewrite) | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ncdu2.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | # Redirect | ||
11 | include ncdu.profile | ||
diff --git a/etc/profile-m-z/neochat.profile b/etc/profile-m-z/neochat.profile index 9f00448c8..58cc716d9 100644 --- a/etc/profile-m-z/neochat.profile +++ b/etc/profile-m-z/neochat.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/neomutt.profile b/etc/profile-m-z/neomutt.profile index fafa129e4..1e59a1490 100644 --- a/etc/profile-m-z/neomutt.profile +++ b/etc/profile-m-z/neomutt.profile | |||
@@ -46,7 +46,6 @@ include disable-common.inc | |||
46 | include disable-devel.inc | 46 | include disable-devel.inc |
47 | include disable-exec.inc | 47 | include disable-exec.inc |
48 | include disable-interpreters.inc | 48 | include disable-interpreters.inc |
49 | include disable-passwdmgr.inc | ||
50 | include disable-programs.inc | 49 | include disable-programs.inc |
51 | include disable-xdg.inc | 50 | include disable-xdg.inc |
52 | 51 | ||
@@ -138,7 +137,7 @@ tracelog | |||
138 | # disable-mnt | 137 | # disable-mnt |
139 | private-cache | 138 | private-cache |
140 | private-dev | 139 | private-dev |
141 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,hostname,hosts,hosts.conf,mail,mailname,Mutt,Muttrc,Muttrc.d,neomuttrc,neomuttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,xdg | 140 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,hostname,hosts,hosts.conf,ld.so.preload,mail,mailname,Mutt,Muttrc,Muttrc.d,neomuttrc,neomuttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,xdg |
142 | private-tmp | 141 | private-tmp |
143 | writable-run-user | 142 | writable-run-user |
144 | writable-var | 143 | writable-var |
diff --git a/etc/profile-m-z/netactview.profile b/etc/profile-m-z/netactview.profile index 5d45dd7bc..57f026a0b 100644 --- a/etc/profile-m-z/netactview.profile +++ b/etc/profile-m-z/netactview.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin netactview,netactview_polkit | 45 | private-bin netactview,netactview_polkit |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts,ld.so.preload |
50 | private-lib | 49 | private-lib |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
diff --git a/etc/profile-m-z/nethack-vultures.profile b/etc/profile-m-z/nethack-vultures.profile index c9a537370..4da43a2d0 100644 --- a/etc/profile-m-z/nethack-vultures.profile +++ b/etc/profile-m-z/nethack-vultures.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/.vultures | 17 | mkdir ${HOME}/.vultures |
diff --git a/etc/profile-m-z/nethack.profile b/etc/profile-m-z/nethack.profile index b57abe260..5037133f2 100644 --- a/etc/profile-m-z/nethack.profile +++ b/etc/profile-m-z/nethack.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | whitelist /var/games/nethack | 17 | whitelist /var/games/nethack |
diff --git a/etc/profile-m-z/neverball.profile b/etc/profile-m-z/neverball.profile index ecfbb14e4..9b7826fd0 100644 --- a/etc/profile-m-z/neverball.profile +++ b/etc/profile-m-z/neverball.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/newsboat.profile b/etc/profile-m-z/newsboat.profile index 13bc3a615..34c6110cf 100644 --- a/etc/profile-m-z/newsboat.profile +++ b/etc/profile-m-z/newsboat.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
@@ -54,7 +53,7 @@ disable-mnt | |||
54 | private-bin gzip,lynx,newsboat,sh,w3m | 53 | private-bin gzip,lynx,newsboat,sh,w3m |
55 | private-cache | 54 | private-cache |
56 | private-dev | 55 | private-dev |
57 | private-etc alternatives,ca-certificates,crypto-policies,lynx.cfg,lynx.lss,pki,resolv.conf,ssl,terminfo | 56 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,lynx.cfg,lynx.lss,pki,resolv.conf,ssl,terminfo |
58 | private-tmp | 57 | private-tmp |
59 | 58 | ||
60 | dbus-user none | 59 | dbus-user none |
diff --git a/etc/profile-m-z/newsflash.profile b/etc/profile-m-z/newsflash.profile index 18d8c6ed4..56cedec03 100644 --- a/etc/profile-m-z/newsflash.profile +++ b/etc/profile-m-z/newsflash.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/nextcloud.profile b/etc/profile-m-z/nextcloud.profile index 9fd76fbe7..d0eef9704 100644 --- a/etc/profile-m-z/nextcloud.profile +++ b/etc/profile-m-z/nextcloud.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-shell.inc | 23 | include disable-shell.inc |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
@@ -44,7 +43,6 @@ apparmor | |||
44 | caps.drop all | 43 | caps.drop all |
45 | machine-id | 44 | machine-id |
46 | netfilter | 45 | netfilter |
47 | no3d | ||
48 | nodvd | 46 | nodvd |
49 | nogroups | 47 | nogroups |
50 | noinput | 48 | noinput |
@@ -63,10 +61,12 @@ tracelog | |||
63 | disable-mnt | 61 | disable-mnt |
64 | private-bin nextcloud,nextcloud-desktop | 62 | private-bin nextcloud,nextcloud-desktop |
65 | private-cache | 63 | private-cache |
66 | private-etc alternatives,ca-certificates,crypto-policies,drirc,fonts,gcrypt,host.conf,hosts,ld.so.cache,machine-id,Nextcloud,nsswitch.conf,os-release,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg | 64 | private-etc alternatives,ca-certificates,crypto-policies,drirc,fonts,gcrypt,host.conf,hosts,ld.so.cache,ld.so.preload,machine-id,Nextcloud,nsswitch.conf,os-release,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg |
67 | private-dev | 65 | private-dev |
68 | private-tmp | 66 | private-tmp |
69 | 67 | ||
70 | dbus-user filter | 68 | dbus-user filter |
71 | dbus-user.talk org.freedesktop.secrets | 69 | dbus-user.talk org.freedesktop.secrets |
70 | # Add the next line to your nextcloud.local for tray icon support | ||
71 | #dbus-user.talk org.kde.StatusNotifierWatcher | ||
72 | dbus-system none | 72 | dbus-system none |
diff --git a/etc/profile-m-z/nheko.profile b/etc/profile-m-z/nheko.profile index f8062891c..2f305dae9 100644 --- a/etc/profile-m-z/nheko.profile +++ b/etc/profile-m-z/nheko.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -52,11 +51,10 @@ private-dev | |||
52 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 51 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
55 | 54 | dbus-user filter | |
56 | # Add the next lines to your nheko.local to enable notification support. | 55 | dbus-user.talk org.freedesktop.secrets |
57 | #ignore dbus-user none | 56 | # Add the next line to your nheko.local to enable notification support. |
58 | #dbus-user filter | ||
59 | #dbus-user.talk org.freedesktop.Notifications | 57 | #dbus-user.talk org.freedesktop.Notifications |
58 | # Add the next line to your nheko.local to enable tray icon support. | ||
60 | #dbus-user.talk org.kde.StatusNotifierWatcher | 59 | #dbus-user.talk org.kde.StatusNotifierWatcher |
61 | dbus-user none | ||
62 | dbus-system none | 60 | dbus-system none |
diff --git a/etc/profile-m-z/nicotine.profile b/etc/profile-m-z/nicotine.profile index 1c7dbc009..0b55a0d3a 100644 --- a/etc/profile-m-z/nicotine.profile +++ b/etc/profile-m-z/nicotine.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/nitroshare.profile b/etc/profile-m-z/nitroshare.profile index 8dba84f02..d6234cd04 100644 --- a/etc/profile-m-z/nitroshare.profile +++ b/etc/profile-m-z/nitroshare.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | 21 | ||
23 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
@@ -43,7 +42,7 @@ disable-mnt | |||
43 | private-bin awk,grep,nitroshare,nitroshare-cli,nitroshare-nmh,nitroshare-send,nitroshare-ui | 42 | private-bin awk,grep,nitroshare,nitroshare-cli,nitroshare-nmh,nitroshare-send,nitroshare-ui |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc alternatives,ca-certificates,dconf,fonts,hostname,hosts,ld.so.cache,machine-id,nsswitch.conf,ssl | 45 | private-etc alternatives,ca-certificates,dconf,fonts,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,ssl |
47 | # private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare | 46 | # private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
diff --git a/etc/profile-m-z/nodejs-common.profile b/etc/profile-m-z/nodejs-common.profile index fa69f9214..ab69136f6 100644 --- a/etc/profile-m-z/nodejs-common.profile +++ b/etc/profile-m-z/nodejs-common.profile | |||
@@ -30,7 +30,6 @@ include allow-bin-sh.inc | |||
30 | 30 | ||
31 | include disable-common.inc | 31 | include disable-common.inc |
32 | include disable-exec.inc | 32 | include disable-exec.inc |
33 | include disable-passwdmgr.inc | ||
34 | include disable-programs.inc | 33 | include disable-programs.inc |
35 | include disable-shell.inc | 34 | include disable-shell.inc |
36 | include disable-xdg.inc | 35 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/nomacs.profile b/etc/profile-m-z/nomacs.profile index a36dee874..0bed12b1f 100644 --- a/etc/profile-m-z/nomacs.profile +++ b/etc/profile-m-z/nomacs.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
@@ -42,5 +41,5 @@ tracelog | |||
42 | #private-bin nomacs | 41 | #private-bin nomacs |
43 | private-cache | 42 | private-cache |
44 | private-dev | 43 | private-dev |
45 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,login.defs,machine-id,pki,resolv.conf,ssl | 44 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,ld.so.preload,login.defs,machine-id,pki,resolv.conf,ssl |
46 | private-tmp | 45 | private-tmp |
diff --git a/etc/profile-m-z/notify-send.profile b/etc/profile-m-z/notify-send.profile index 650118c98..a7bb93a02 100644 --- a/etc/profile-m-z/notify-send.profile +++ b/etc/profile-m-z/notify-send.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-write-mnt.inc | 18 | include disable-write-mnt.inc |
@@ -50,7 +49,7 @@ private | |||
50 | private-bin notify-send | 49 | private-bin notify-send |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc none | 52 | private-etc ld.so.preload,none |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
56 | dbus-user filter | 55 | dbus-user filter |
diff --git a/etc/profile-m-z/nslookup.profile b/etc/profile-m-z/nslookup.profile index c7a131a2c..baa8ddfeb 100644 --- a/etc/profile-m-z/nslookup.profile +++ b/etc/profile-m-z/nslookup.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-m-z/nuclear.profile b/etc/profile-m-z/nuclear.profile index 886403b9e..9e3093ea7 100644 --- a/etc/profile-m-z/nuclear.profile +++ b/etc/profile-m-z/nuclear.profile | |||
@@ -18,7 +18,7 @@ whitelist ${HOME}/.config/nuclear | |||
18 | no3d | 18 | no3d |
19 | 19 | ||
20 | # private-bin nuclear | 20 | # private-bin nuclear |
21 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 21 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
22 | private-opt nuclear | 22 | private-opt nuclear |
23 | 23 | ||
24 | # Redirect | 24 | # Redirect |
diff --git a/etc/profile-m-z/nylas.profile b/etc/profile-m-z/nylas.profile index fe0c2116b..3474a075f 100644 --- a/etc/profile-m-z/nylas.profile +++ b/etc/profile-m-z/nylas.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${HOME}/.nylas-mail | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | mkdir ${HOME}/.config/Nylas Mail | 16 | mkdir ${HOME}/.config/Nylas Mail |
diff --git a/etc/profile-m-z/nyx.profile b/etc/profile-m-z/nyx.profile index d040d42af..9b431d76d 100644 --- a/etc/profile-m-z/nyx.profile +++ b/etc/profile-m-z/nyx.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin nyx,python* | 45 | private-bin nyx,python* |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,fonts,passwd,tor | 48 | private-etc alternatives,fonts,ld.so.preload,passwd,tor |
50 | private-opt none | 49 | private-opt none |
51 | private-srv none | 50 | private-srv none |
52 | private-tmp | 51 | private-tmp |
diff --git a/etc/profile-m-z/obs.profile b/etc/profile-m-z/obs.profile index 9345cee4f..1ff9ad48a 100644 --- a/etc/profile-m-z/obs.profile +++ b/etc/profile-m-z/obs.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
24 | 23 | ||
diff --git a/etc/profile-m-z/ocenaudio.profile b/etc/profile-m-z/ocenaudio.profile index 7be68a201..0bfb35333 100644 --- a/etc/profile-m-z/ocenaudio.profile +++ b/etc/profile-m-z/ocenaudio.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ tracelog | |||
46 | private-bin ocenaudio | 45 | private-bin ocenaudio |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,asound.conf,fonts,ld.so.cache,pulse | 48 | private-etc alternatives,asound.conf,fonts,ld.so.cache,ld.so.preload,pulse |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | # breaks preferences | 51 | # breaks preferences |
diff --git a/etc/profile-m-z/odt2txt.profile b/etc/profile-m-z/odt2txt.profile index 6163d2e22..7d2374ccf 100644 --- a/etc/profile-m-z/odt2txt.profile +++ b/etc/profile-m-z/odt2txt.profile | |||
@@ -13,7 +13,6 @@ noblacklist ${DOCUMENTS} | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -39,7 +38,7 @@ x11 none | |||
39 | private-bin odt2txt | 38 | private-bin odt2txt |
40 | private-cache | 39 | private-cache |
41 | private-dev | 40 | private-dev |
42 | private-etc alternatives | 41 | private-etc alternatives,ld.so.preload |
43 | private-tmp | 42 | private-tmp |
44 | 43 | ||
45 | dbus-user none | 44 | dbus-user none |
diff --git a/etc/profile-m-z/okular.profile b/etc/profile-m-z/okular.profile index ab8ccf623..0a200b46e 100644 --- a/etc/profile-m-z/okular.profile +++ b/etc/profile-m-z/okular.profile | |||
@@ -23,7 +23,6 @@ include disable-common.inc | |||
23 | include disable-devel.inc | 23 | include disable-devel.inc |
24 | include disable-exec.inc | 24 | include disable-exec.inc |
25 | include disable-interpreters.inc | 25 | include disable-interpreters.inc |
26 | include disable-passwdmgr.inc | ||
27 | include disable-programs.inc | 26 | include disable-programs.inc |
28 | include disable-shell.inc | 27 | include disable-shell.inc |
29 | include disable-xdg.inc | 28 | include disable-xdg.inc |
@@ -62,7 +61,7 @@ tracelog | |||
62 | 61 | ||
63 | private-bin kbuildsycoca4,kdeinit4,lpr,okular,unar,unrar | 62 | private-bin kbuildsycoca4,kdeinit4,lpr,okular,unar,unrar |
64 | private-dev | 63 | private-dev |
65 | private-etc alternatives,cups,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,xdg | 64 | private-etc alternatives,cups,fonts,kde4rc,kde5rc,ld.so.cache,ld.so.preload,machine-id,passwd,xdg |
66 | # private-tmp - on KDE we need access to the real /tmp for data exchange with email clients | 65 | # private-tmp - on KDE we need access to the real /tmp for data exchange with email clients |
67 | 66 | ||
68 | # dbus-user none | 67 | # dbus-user none |
diff --git a/etc/profile-m-z/onboard.profile b/etc/profile-m-z/onboard.profile index 5b367b639..e70e5e81e 100644 --- a/etc/profile-m-z/onboard.profile +++ b/etc/profile-m-z/onboard.profile | |||
@@ -17,7 +17,6 @@ include disable-devel.inc | |||
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
@@ -51,7 +50,7 @@ disable-mnt | |||
51 | private-cache | 50 | private-cache |
52 | private-bin onboard,python*,tput | 51 | private-bin onboard,python*,tput |
53 | private-dev | 52 | private-dev |
54 | private-etc alternatives,dbus-1,dconf,fonts,gtk-2.0,gtk-3.0,locale,locale.alias,locale.conf,mime.types,selinux,X11,xdg | 53 | private-etc alternatives,dbus-1,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.preload,locale,locale.alias,locale.conf,mime.types,selinux,X11,xdg |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
57 | dbus-system none | 56 | dbus-system none |
diff --git a/etc/profile-m-z/onionshare-gui.profile b/etc/profile-m-z/onionshare-gui.profile index 960df9034..cf4d7db30 100644 --- a/etc/profile-m-z/onionshare-gui.profile +++ b/etc/profile-m-z/onionshare-gui.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/open-invaders.profile b/etc/profile-m-z/open-invaders.profile index 7a840d4a9..12c7ea3d0 100644 --- a/etc/profile-m-z/open-invaders.profile +++ b/etc/profile-m-z/open-invaders.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/openarena.profile b/etc/profile-m-z/openarena.profile index 36ce0316f..de334defd 100644 --- a/etc/profile-m-z/openarena.profile +++ b/etc/profile-m-z/openarena.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin bash,cut,glxinfo,grep,head,openarena,openarena_ded,quake3,zenity | 43 | private-bin bash,cut,glxinfo,grep,head,openarena,openarena_ded,quake3,zenity |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc drirc,machine-id,openal,passwd,selinux,udev,xdg | 46 | private-etc drirc,ld.so.preload,machine-id,openal,passwd,selinux,udev,xdg |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/opencity.profile b/etc/profile-m-z/opencity.profile index a3d371e15..560bc6cbc 100644 --- a/etc/profile-m-z/opencity.profile +++ b/etc/profile-m-z/opencity.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/openclonk.profile b/etc/profile-m-z/openclonk.profile index 32b40df42..253465991 100644 --- a/etc/profile-m-z/openclonk.profile +++ b/etc/profile-m-z/openclonk.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/openmw.profile b/etc/profile-m-z/openmw.profile index d1fe67aed..ce3399ad6 100644 --- a/etc/profile-m-z/openmw.profile +++ b/etc/profile-m-z/openmw.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-write-mnt.inc | 18 | include disable-write-mnt.inc |
diff --git a/etc/profile-m-z/openshot.profile b/etc/profile-m-z/openshot.profile index 6118630c4..e2af2e714 100644 --- a/etc/profile-m-z/openshot.profile +++ b/etc/profile-m-z/openshot.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | whitelist /usr/share/blender | 21 | whitelist /usr/share/blender |
diff --git a/etc/profile-m-z/openttd.profile b/etc/profile-m-z/openttd.profile index 546958bb7..6c31ebf65 100644 --- a/etc/profile-m-z/openttd.profile +++ b/etc/profile-m-z/openttd.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/orage.profile b/etc/profile-m-z/orage.profile index 4e4d8bea5..a3ec6a386 100644 --- a/etc/profile-m-z/orage.profile +++ b/etc/profile-m-z/orage.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/ostrichriders.profile b/etc/profile-m-z/ostrichriders.profile index 310b90919..de6a6d3f5 100644 --- a/etc/profile-m-z/ostrichriders.profile +++ b/etc/profile-m-z/ostrichriders.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/otter-browser.profile b/etc/profile-m-z/otter-browser.profile index 20a4e25ed..78f92a860 100644 --- a/etc/profile-m-z/otter-browser.profile +++ b/etc/profile-m-z/otter-browser.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-m-z/pandoc.profile b/etc/profile-m-z/pandoc.profile index 513b4119e..460f60beb 100644 --- a/etc/profile-m-z/pandoc.profile +++ b/etc/profile-m-z/pandoc.profile | |||
@@ -11,15 +11,17 @@ blacklist ${RUNUSER} | |||
11 | 11 | ||
12 | noblacklist ${DOCUMENTS} | 12 | noblacklist ${DOCUMENTS} |
13 | 13 | ||
14 | include allow-bin-sh.inc | ||
15 | |||
14 | include disable-common.inc | 16 | include disable-common.inc |
15 | include disable-devel.inc | 17 | include disable-devel.inc |
16 | include disable-exec.inc | 18 | include disable-exec.inc |
17 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 20 | include disable-programs.inc |
20 | include disable-shell.inc | 21 | include disable-shell.inc |
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
24 | include whitelist-runuser-common.inc | ||
23 | # breaks pdf output | 25 | # breaks pdf output |
24 | #include whitelist-var-common.inc | 26 | #include whitelist-var-common.inc |
25 | 27 | ||
@@ -40,15 +42,15 @@ nou2f | |||
40 | novideo | 42 | novideo |
41 | protocol unix | 43 | protocol unix |
42 | seccomp | 44 | seccomp |
45 | seccomp.block-secondary | ||
43 | shell none | 46 | shell none |
44 | tracelog | 47 | tracelog |
45 | x11 none | 48 | x11 none |
46 | 49 | ||
47 | disable-mnt | 50 | disable-mnt |
48 | private-bin context,latex,mktexfmt,pandoc,pdflatex,pdfroff,prince,weasyprint,wkhtmltopdf | ||
49 | private-cache | 51 | private-cache |
50 | private-dev | 52 | private-dev |
51 | private-etc alternatives,texlive,texmf | 53 | private-etc alternatives,ld.so.preload,texlive,texmf |
52 | private-tmp | 54 | private-tmp |
53 | 55 | ||
54 | dbus-user none | 56 | dbus-user none |
diff --git a/etc/profile-m-z/parole.profile b/etc/profile-m-z/parole.profile index 0a4422a73..a4737d388 100644 --- a/etc/profile-m-z/parole.profile +++ b/etc/profile-m-z/parole.profile | |||
@@ -12,7 +12,6 @@ noblacklist ${VIDEOS} | |||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -28,4 +27,4 @@ shell none | |||
28 | 27 | ||
29 | private-bin dbus-launch,parole | 28 | private-bin dbus-launch,parole |
30 | private-cache | 29 | private-cache |
31 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,machine-id,passwd,pki,pulse,ssl | 30 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.preload,machine-id,passwd,pki,pulse,ssl |
diff --git a/etc/profile-m-z/patch.profile b/etc/profile-m-z/patch.profile index 0de968185..3973c1b4a 100644 --- a/etc/profile-m-z/patch.profile +++ b/etc/profile-m-z/patch.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-m-z/pavucontrol.profile b/etc/profile-m-z/pavucontrol.profile index b46fb3026..76f1c9704 100644 --- a/etc/profile-m-z/pavucontrol.profile +++ b/etc/profile-m-z/pavucontrol.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin pavucontrol | 45 | private-bin pavucontrol |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,asound.conf,avahi,fonts,machine-id,pulse | 48 | private-etc alternatives,asound.conf,avahi,fonts,ld.so.preload,machine-id,pulse |
50 | private-lib | 49 | private-lib |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
diff --git a/etc/profile-m-z/pcsxr.profile b/etc/profile-m-z/pcsxr.profile index a6dab2a9a..e52a1c4a9 100644 --- a/etc/profile-m-z/pcsxr.profile +++ b/etc/profile-m-z/pcsxr.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-write-mnt.inc | 19 | include disable-write-mnt.inc |
diff --git a/etc/profile-m-z/pdfchain.profile b/etc/profile-m-z/pdfchain.profile index d72417914..400fc3d77 100644 --- a/etc/profile-m-z/pdfchain.profile +++ b/etc/profile-m-z/pdfchain.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
17 | 16 | ||
@@ -35,7 +34,7 @@ shell none | |||
35 | 34 | ||
36 | private-bin pdfchain,pdftk,sh | 35 | private-bin pdfchain,pdftk,sh |
37 | private-dev | 36 | private-dev |
38 | private-etc alternatives,dconf,fonts,gtk-3.0,xdg | 37 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.preload,xdg |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
41 | dbus-user none | 40 | dbus-user none |
diff --git a/etc/profile-m-z/pdfmod.profile b/etc/profile-m-z/pdfmod.profile index a19826555..c8397a31e 100644 --- a/etc/profile-m-z/pdfmod.profile +++ b/etc/profile-m-z/pdfmod.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/pdfsam.profile b/etc/profile-m-z/pdfsam.profile index e2808d4d2..0c2ce0588 100644 --- a/etc/profile-m-z/pdfsam.profile +++ b/etc/profile-m-z/pdfsam.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-m-z/pdftotext.profile b/etc/profile-m-z/pdftotext.profile index d3902a51c..b1c2dfb1c 100644 --- a/etc/profile-m-z/pdftotext.profile +++ b/etc/profile-m-z/pdftotext.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -49,7 +48,7 @@ x11 none | |||
49 | private-bin pdftotext | 48 | private-bin pdftotext |
50 | private-cache | 49 | private-cache |
51 | private-dev | 50 | private-dev |
52 | private-etc alternatives | 51 | private-etc alternatives,ld.so.preload |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
55 | dbus-user none | 54 | dbus-user none |
diff --git a/etc/profile-m-z/peek.profile b/etc/profile-m-z/peek.profile index c33953687..e216742a4 100644 --- a/etc/profile-m-z/peek.profile +++ b/etc/profile-m-z/peek.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
@@ -49,7 +48,7 @@ tracelog | |||
49 | disable-mnt | 48 | disable-mnt |
50 | private-bin bash,convert,ffmpeg,firejail,fish,peek,sh,which,zsh | 49 | private-bin bash,convert,ffmpeg,firejail,fish,peek,sh,which,zsh |
51 | private-dev | 50 | private-dev |
52 | private-etc dconf,firejail,fonts,gtk-3.0,login.defs,pango,passwd,X11 | 51 | private-etc dconf,firejail,fonts,gtk-3.0,ld.so.preload,login.defs,pango,passwd,X11 |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
55 | dbus-user filter | 54 | dbus-user filter |
diff --git a/etc/profile-m-z/penguin-command.profile b/etc/profile-m-z/penguin-command.profile index f5ad0321d..13e89616e 100644 --- a/etc/profile-m-z/penguin-command.profile +++ b/etc/profile-m-z/penguin-command.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/photoflare.profile b/etc/profile-m-z/photoflare.profile index 40068ff78..c0d0ae4df 100644 --- a/etc/profile-m-z/photoflare.profile +++ b/etc/profile-m-z/photoflare.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin photoflare | 43 | private-bin photoflare |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,fonts,locale,locale.alias,locale.conf,mime.types,X11 | 46 | private-etc alternatives,fonts,ld.so.preload,locale,locale.alias,locale.conf,mime.types,X11 |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/picard.profile b/etc/profile-m-z/picard.profile index a5ea47088..dbbfc5275 100644 --- a/etc/profile-m-z/picard.profile +++ b/etc/profile-m-z/picard.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
24 | 23 | ||
diff --git a/etc/profile-m-z/pidgin.profile b/etc/profile-m-z/pidgin.profile index 26872e9a1..904c17e09 100644 --- a/etc/profile-m-z/pidgin.profile +++ b/etc/profile-m-z/pidgin.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-m-z/pinball.profile b/etc/profile-m-z/pinball.profile index 2e17be2ce..3c76ad99c 100644 --- a/etc/profile-m-z/pinball.profile +++ b/etc/profile-m-z/pinball.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/ping.profile b/etc/profile-m-z/ping.profile index e914007c0..b4923c38a 100644 --- a/etc/profile-m-z/ping.profile +++ b/etc/profile-m-z/ping.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/pingus.profile b/etc/profile-m-z/pingus.profile index f1fdfcbad..fb50e66ca 100644 --- a/etc/profile-m-z/pingus.profile +++ b/etc/profile-m-z/pingus.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
@@ -51,7 +50,7 @@ disable-mnt | |||
51 | private-bin pingus,pingus.bin,sh | 50 | private-bin pingus,pingus.bin,sh |
52 | private-cache | 51 | private-cache |
53 | private-dev | 52 | private-dev |
54 | private-etc machine-id | 53 | private-etc ld.so.preload,machine-id |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
57 | dbus-user none | 56 | dbus-user none |
diff --git a/etc/profile-m-z/pinta.profile b/etc/profile-m-z/pinta.profile index 19406c399..f52803d50 100644 --- a/etc/profile-m-z/pinta.profile +++ b/etc/profile-m-z/pinta.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/pioneer.profile b/etc/profile-m-z/pioneer.profile index 721b3944a..7c9bb352b 100644 --- a/etc/profile-m-z/pioneer.profile +++ b/etc/profile-m-z/pioneer.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/pithos.profile b/etc/profile-m-z/pithos.profile index 18990f0b2..91814d8bb 100644 --- a/etc/profile-m-z/pithos.profile +++ b/etc/profile-m-z/pithos.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/pitivi.profile b/etc/profile-m-z/pitivi.profile index a2dd809c4..245ffae22 100644 --- a/etc/profile-m-z/pitivi.profile +++ b/etc/profile-m-z/pitivi.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | include whitelist-runuser-common.inc | 21 | include whitelist-runuser-common.inc |
diff --git a/etc/profile-m-z/pix.profile b/etc/profile-m-z/pix.profile index 81d3e9370..6bd1ad02e 100644 --- a/etc/profile-m-z/pix.profile +++ b/etc/profile-m-z/pix.profile | |||
@@ -13,7 +13,6 @@ noblacklist ${HOME}/.steam | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/pkglog.profile b/etc/profile-m-z/pkglog.profile index 4eb41b3bd..23e21f347 100644 --- a/etc/profile-m-z/pkglog.profile +++ b/etc/profile-m-z/pkglog.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
@@ -45,7 +44,7 @@ private | |||
45 | private-bin pkglog,python* | 44 | private-bin pkglog,python* |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc alternatives | 47 | private-etc alternatives,ld.so.preload |
49 | private-opt none | 48 | private-opt none |
50 | private-tmp | 49 | private-tmp |
51 | writable-var-log | 50 | writable-var-log |
diff --git a/etc/profile-m-z/pluma.profile b/etc/profile-m-z/pluma.profile index 10e12e5b1..567725be4 100644 --- a/etc/profile-m-z/pluma.profile +++ b/etc/profile-m-z/pluma.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | 21 | ||
diff --git a/etc/profile-m-z/plv.profile b/etc/profile-m-z/plv.profile index 5201fd853..a6b0768f1 100644 --- a/etc/profile-m-z/plv.profile +++ b/etc/profile-m-z/plv.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
@@ -47,7 +46,7 @@ disable-mnt | |||
47 | private-bin plv | 46 | private-bin plv |
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | private-etc alternatives,fonts | 49 | private-etc alternatives,fonts,ld.so.preload |
51 | private-opt none | 50 | private-opt none |
52 | private-tmp | 51 | private-tmp |
53 | writable-var-log | 52 | writable-var-log |
diff --git a/etc/profile-m-z/pngquant.profile b/etc/profile-m-z/pngquant.profile index 8a181d5a8..534cc5943 100644 --- a/etc/profile-m-z/pngquant.profile +++ b/etc/profile-m-z/pngquant.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -39,9 +38,8 @@ nosound | |||
39 | notv | 38 | notv |
40 | nou2f | 39 | nou2f |
41 | novideo | 40 | novideo |
42 | # protocol can be empty, but this is not yet supported see #639 | 41 | # block the socket syscall to simulate an be empty protocol line, see #639 |
43 | protocol inet | 42 | seccomp socket |
44 | seccomp | ||
45 | shell none | 43 | shell none |
46 | tracelog | 44 | tracelog |
47 | x11 none | 45 | x11 none |
@@ -49,7 +47,7 @@ x11 none | |||
49 | private-bin pngquant | 47 | private-bin pngquant |
50 | private-cache | 48 | private-cache |
51 | private-dev | 49 | private-dev |
52 | private-etc alternatives | 50 | private-etc alternatives,ld.so.preload |
53 | private-tmp | 51 | private-tmp |
54 | 52 | ||
55 | dbus-user none | 53 | dbus-user none |
diff --git a/etc/profile-m-z/ppsspp.profile b/etc/profile-m-z/ppsspp.profile index 1f73c1d89..3e06cf300 100644 --- a/etc/profile-m-z/ppsspp.profile +++ b/etc/profile-m-z/ppsspp.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-write-mnt.inc | 18 | include disable-write-mnt.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/pragha.profile b/etc/profile-m-z/pragha.profile index f138d785e..c9793433e 100644 --- a/etc/profile-m-z/pragha.profile +++ b/etc/profile-m-z/pragha.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
@@ -34,6 +33,6 @@ seccomp | |||
34 | shell none | 33 | shell none |
35 | 34 | ||
36 | private-dev | 35 | private-dev |
37 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,xdg | 36 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg |
38 | private-tmp | 37 | private-tmp |
39 | 38 | ||
diff --git a/etc/profile-m-z/profanity.profile b/etc/profile-m-z/profanity.profile index 743458725..af0ca5d8f 100644 --- a/etc/profile-m-z/profanity.profile +++ b/etc/profile-m-z/profanity.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
@@ -45,7 +44,7 @@ shell none | |||
45 | private-bin profanity | 44 | private-bin profanity |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc alternatives,ca-certificates,crypto-policies,localtime,mime.types,nsswitch.conf,pki,resolv.conf,ssl | 47 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,localtime,mime.types,nsswitch.conf,pki,resolv.conf,ssl |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-m-z/psi-plus.profile b/etc/profile-m-z/psi-plus.profile index 5ac58b0ac..5f598cec5 100644 --- a/etc/profile-m-z/psi-plus.profile +++ b/etc/profile-m-z/psi-plus.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.cache/psi+ | 18 | mkdir ${HOME}/.cache/psi+ |
diff --git a/etc/profile-m-z/psi.profile b/etc/profile-m-z/psi.profile index 7e0ef99fc..99a72adee 100644 --- a/etc/profile-m-z/psi.profile +++ b/etc/profile-m-z/psi.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
@@ -72,7 +71,7 @@ disable-mnt | |||
72 | private-bin getopt,psi | 71 | private-bin getopt,psi |
73 | private-cache | 72 | private-cache |
74 | private-dev | 73 | private-dev |
75 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,gcrypt,group,hostname,hosts,ld.so.cache,ld.so.conf,machine-id,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg | 74 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,gcrypt,group,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.preload,machine-id,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg |
76 | private-tmp | 75 | private-tmp |
77 | 76 | ||
78 | dbus-user none | 77 | dbus-user none |
diff --git a/etc/profile-m-z/pybitmessage.profile b/etc/profile-m-z/pybitmessage.profile index 60ae37930..8d8729d4a 100644 --- a/etc/profile-m-z/pybitmessage.profile +++ b/etc/profile-m-z/pybitmessage.profile | |||
@@ -16,7 +16,6 @@ include allow-python3.inc | |||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
22 | 21 | ||
diff --git a/etc/profile-m-z/pycharm-community.profile b/etc/profile-m-z/pycharm-community.profile index 00d7239ae..f3d40e7f3 100644 --- a/etc/profile-m-z/pycharm-community.profile +++ b/etc/profile-m-z/pycharm-community.profile | |||
@@ -15,7 +15,6 @@ include allow-common-devel.inc | |||
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/profile-m-z/qbittorrent.profile b/etc/profile-m-z/qbittorrent.profile index 506b738cc..8778ec5fb 100644 --- a/etc/profile-m-z/qbittorrent.profile +++ b/etc/profile-m-z/qbittorrent.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-shell.inc | 23 | include disable-shell.inc |
25 | 24 | ||
diff --git a/etc/profile-m-z/qcomicbook.profile b/etc/profile-m-z/qcomicbook.profile index 0e52d7fc4..4d4d3694b 100644 --- a/etc/profile-m-z/qcomicbook.profile +++ b/etc/profile-m-z/qcomicbook.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-write-mnt.inc | 23 | include disable-write-mnt.inc |
diff --git a/etc/profile-m-z/qemu-launcher.profile b/etc/profile-m-z/qemu-launcher.profile index ac60384fd..2aea715dc 100644 --- a/etc/profile-m-z/qemu-launcher.profile +++ b/etc/profile-m-z/qemu-launcher.profile | |||
@@ -8,7 +8,6 @@ include globals.local | |||
8 | noblacklist ${HOME}/.qemu-launcher | 8 | noblacklist ${HOME}/.qemu-launcher |
9 | 9 | ||
10 | include disable-common.inc | 10 | include disable-common.inc |
11 | include disable-passwdmgr.inc | ||
12 | include disable-programs.inc | 11 | include disable-programs.inc |
13 | 12 | ||
14 | caps.drop all | 13 | caps.drop all |
diff --git a/etc/profile-m-z/qemu-system-x86_64.profile b/etc/profile-m-z/qemu-system-x86_64.profile index d7d7905dd..2333e07d9 100644 --- a/etc/profile-m-z/qemu-system-x86_64.profile +++ b/etc/profile-m-z/qemu-system-x86_64.profile | |||
@@ -7,7 +7,6 @@ include qemu-system-x86_64.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | include disable-common.inc | 9 | include disable-common.inc |
10 | include disable-passwdmgr.inc | ||
11 | include disable-programs.inc | 10 | include disable-programs.inc |
12 | 11 | ||
13 | caps.drop all | 12 | caps.drop all |
diff --git a/etc/profile-m-z/qgis.profile b/etc/profile-m-z/qgis.profile index 2e97daea2..4ebd556d6 100644 --- a/etc/profile-m-z/qgis.profile +++ b/etc/profile-m-z/qgis.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
24 | 23 | ||
@@ -53,7 +52,7 @@ tracelog | |||
53 | disable-mnt | 52 | disable-mnt |
54 | private-cache | 53 | private-cache |
55 | private-dev | 54 | private-dev |
56 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,QGIS,QGIS.conf,resolv.conf,ssl,Trolltech.conf | 55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,machine-id,pki,QGIS,QGIS.conf,resolv.conf,ssl,Trolltech.conf |
57 | private-tmp | 56 | private-tmp |
58 | 57 | ||
59 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-m-z/qlipper.profile b/etc/profile-m-z/qlipper.profile index 6e94d5845..7176d8a39 100644 --- a/etc/profile-m-z/qlipper.profile +++ b/etc/profile-m-z/qlipper.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/qmmp.profile b/etc/profile-m-z/qmmp.profile index c3d982c17..af85c95e7 100644 --- a/etc/profile-m-z/qmmp.profile +++ b/etc/profile-m-z/qmmp.profile | |||
@@ -12,7 +12,6 @@ noblacklist ${MUSIC} | |||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/qnapi.profile b/etc/profile-m-z/qnapi.profile index ca11df5be..89cb5baa8 100644 --- a/etc/profile-m-z/qnapi.profile +++ b/etc/profile-m-z/qnapi.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -48,7 +47,7 @@ tracelog | |||
48 | private-bin 7z,qnapi | 47 | private-bin 7z,qnapi |
49 | private-cache | 48 | private-cache |
50 | private-dev | 49 | private-dev |
51 | private-etc alternatives,fonts | 50 | private-etc alternatives,fonts,ld.so.preload |
52 | private-opt none | 51 | private-opt none |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
diff --git a/etc/profile-m-z/qpdfview.profile b/etc/profile-m-z/qpdfview.profile index be690ffa4..3ad8a19c8 100644 --- a/etc/profile-m-z/qpdfview.profile +++ b/etc/profile-m-z/qpdfview.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/qrencode.profile b/etc/profile-m-z/qrencode.profile index 6cbf8519f..691449b9f 100644 --- a/etc/profile-m-z/qrencode.profile +++ b/etc/profile-m-z/qrencode.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-write-mnt.inc | 18 | include disable-write-mnt.inc |
@@ -48,7 +47,7 @@ disable-mnt | |||
48 | private-bin qrencode | 47 | private-bin qrencode |
49 | private-cache | 48 | private-cache |
50 | private-dev | 49 | private-dev |
51 | private-etc none | 50 | private-etc ld.so.preload,none |
52 | private-lib libpcre* | 51 | private-lib libpcre* |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
diff --git a/etc/profile-m-z/qtox.profile b/etc/profile-m-z/qtox.profile index 8ffe24d11..60e1539fa 100644 --- a/etc/profile-m-z/qtox.profile +++ b/etc/profile-m-z/qtox.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin qtox | 43 | private-bin qtox |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl | 46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,pulse,resolv.conf,ssl |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/quaternion.profile b/etc/profile-m-z/quaternion.profile index 1d146aa39..dfb46ddae 100644 --- a/etc/profile-m-z/quaternion.profile +++ b/etc/profile-m-z/quaternion.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/quiterss.profile b/etc/profile-m-z/quiterss.profile index 9490089b2..8f89931c7 100644 --- a/etc/profile-m-z/quiterss.profile +++ b/etc/profile-m-z/quiterss.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | 20 | ||
diff --git a/etc/profile-m-z/quodlibet.profile b/etc/profile-m-z/quodlibet.profile index 92b02b2bf..bc435653d 100644 --- a/etc/profile-m-z/quodlibet.profile +++ b/etc/profile-m-z/quodlibet.profile | |||
@@ -21,7 +21,6 @@ include disable-common.inc | |||
21 | include disable-devel.inc | 21 | include disable-devel.inc |
22 | include disable-exec.inc | 22 | include disable-exec.inc |
23 | include disable-interpreters.inc | 23 | include disable-interpreters.inc |
24 | include disable-passwdmgr.inc | ||
25 | include disable-programs.inc | 24 | include disable-programs.inc |
26 | include disable-shell.inc | 25 | include disable-shell.inc |
27 | include disable-xdg.inc | 26 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/qupzilla.profile b/etc/profile-m-z/qupzilla.profile index 7aa71c848..c29d87a73 100644 --- a/etc/profile-m-z/qupzilla.profile +++ b/etc/profile-m-z/qupzilla.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.cache/qupzilla | 18 | mkdir ${HOME}/.cache/qupzilla |
diff --git a/etc/profile-m-z/redeclipse.profile b/etc/profile-m-z/redeclipse.profile index 9bc196a16..436b98f29 100644 --- a/etc/profile-m-z/redeclipse.profile +++ b/etc/profile-m-z/redeclipse.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/rednotebook.profile b/etc/profile-m-z/rednotebook.profile new file mode 100644 index 000000000..d1dd365ab --- /dev/null +++ b/etc/profile-m-z/rednotebook.profile | |||
@@ -0,0 +1,66 @@ | |||
1 | # Firejail profile for rednotebook | ||
2 | # Description: Daily journal with calendar, templates and keyword searching | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include rednotebook.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/rednotebook | ||
10 | noblacklist ${HOME}/.rednotebook | ||
11 | |||
12 | # Allow python (blacklisted by disable-interpreters.inc) | ||
13 | include allow-python3.inc | ||
14 | |||
15 | include disable-common.inc | ||
16 | include disable-devel.inc | ||
17 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-shell.inc | ||
21 | |||
22 | mkdir ${HOME}/.cache/rednotebook | ||
23 | mkdir ${HOME}/.rednotebook | ||
24 | whitelist ${HOME}/.cache/rednotebook | ||
25 | whitelist ${HOME}/.rednotebook | ||
26 | whitelist ${DESKTOP} | ||
27 | whitelist ${DOCUMENTS} | ||
28 | whitelist ${DOWNLOADS} | ||
29 | whitelist ${MUSIC} | ||
30 | whitelist ${PICTURES} | ||
31 | whitelist ${VIDEOS} | ||
32 | whitelist /usr/libexec/webkit2gtk-4.0 | ||
33 | include whitelist-common.inc | ||
34 | include whitelist-runuser-common.inc | ||
35 | include whitelist-usr-share-common.inc | ||
36 | include whitelist-var-common.inc | ||
37 | |||
38 | apparmor | ||
39 | caps.drop all | ||
40 | machine-id | ||
41 | net none | ||
42 | no3d | ||
43 | nodvd | ||
44 | nogroups | ||
45 | noinput | ||
46 | nonewprivs | ||
47 | noroot | ||
48 | nosound | ||
49 | notv | ||
50 | nou2f | ||
51 | novideo | ||
52 | protocol unix | ||
53 | seccomp | ||
54 | seccomp.block-secondary | ||
55 | shell none | ||
56 | tracelog | ||
57 | |||
58 | disable-mnt | ||
59 | private-bin python3*,rednotebook | ||
60 | private-cache | ||
61 | private-dev | ||
62 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11 | ||
63 | private-tmp | ||
64 | |||
65 | dbus-user none | ||
66 | dbus-system none | ||
diff --git a/etc/profile-m-z/redshift.profile b/etc/profile-m-z/redshift.profile index f87c5f67c..06ae67ae1 100644 --- a/etc/profile-m-z/redshift.profile +++ b/etc/profile-m-z/redshift.profile | |||
@@ -13,7 +13,6 @@ noblacklist ${HOME}/.config/redshift.conf | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/regextester.profile b/etc/profile-m-z/regextester.profile index f5131c5d0..6b9144791 100644 --- a/etc/profile-m-z/regextester.profile +++ b/etc/profile-m-z/regextester.profile | |||
@@ -9,7 +9,6 @@ include globals.local | |||
9 | include disable-common.inc | 9 | include disable-common.inc |
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-passwdmgr.inc | ||
13 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin regextester | 43 | private-bin regextester |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,fonts | 46 | private-etc alternatives,fonts,ld.so.preload |
48 | private-lib libgranite.so.* | 47 | private-lib libgranite.so.* |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
diff --git a/etc/profile-m-z/remmina.profile b/etc/profile-m-z/remmina.profile index aca22f187..16da40daf 100644 --- a/etc/profile-m-z/remmina.profile +++ b/etc/profile-m-z/remmina.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-m-z/rhythmbox.profile b/etc/profile-m-z/rhythmbox.profile index 970e8ffba..26b62e456 100644 --- a/etc/profile-m-z/rhythmbox.profile +++ b/etc/profile-m-z/rhythmbox.profile | |||
@@ -21,7 +21,6 @@ include disable-common.inc | |||
21 | include disable-devel.inc | 21 | include disable-devel.inc |
22 | include disable-exec.inc | 22 | include disable-exec.inc |
23 | include disable-interpreters.inc | 23 | include disable-interpreters.inc |
24 | include disable-passwdmgr.inc | ||
25 | include disable-programs.inc | 24 | include disable-programs.inc |
26 | include disable-shell.inc | 25 | include disable-shell.inc |
27 | include disable-xdg.inc | 26 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/ricochet.profile b/etc/profile-m-z/ricochet.profile index b664a2be3..705ca0045 100644 --- a/etc/profile-m-z/ricochet.profile +++ b/etc/profile-m-z/ricochet.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | 16 | ||
diff --git a/etc/profile-m-z/ripperx.profile b/etc/profile-m-z/ripperx.profile index be815e714..81aef5a65 100644 --- a/etc/profile-m-z/ripperx.profile +++ b/etc/profile-m-z/ripperx.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/ristretto.profile b/etc/profile-m-z/ristretto.profile index 5572cab5a..79f090d95 100644 --- a/etc/profile-m-z/ristretto.profile +++ b/etc/profile-m-z/ristretto.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/rsync-download_only.profile b/etc/profile-m-z/rsync-download_only.profile index 690b44bb1..e49f10b7b 100644 --- a/etc/profile-m-z/rsync-download_only.profile +++ b/etc/profile-m-z/rsync-download_only.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ disable-mnt | |||
50 | private-bin rsync | 49 | private-bin rsync |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | 52 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
56 | dbus-user none | 55 | dbus-user none |
diff --git a/etc/profile-m-z/rtorrent.profile b/etc/profile-m-z/rtorrent.profile index 6ef51b7f1..757624938 100644 --- a/etc/profile-m-z/rtorrent.profile +++ b/etc/profile-m-z/rtorrent.profile | |||
@@ -10,7 +10,6 @@ include globals.local | |||
10 | include disable-common.inc | 10 | include disable-common.inc |
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | 15 | ||
diff --git a/etc/profile-m-z/rtv-addons.profile b/etc/profile-m-z/rtv-addons.profile index c9da0b628..cc6db5043 100644 --- a/etc/profile-m-z/rtv-addons.profile +++ b/etc/profile-m-z/rtv-addons.profile | |||
@@ -21,3 +21,8 @@ whitelist ${HOME}/.config/mpv | |||
21 | whitelist ${HOME}/.mailcap | 21 | whitelist ${HOME}/.mailcap |
22 | whitelist ${HOME}/.netrc | 22 | whitelist ${HOME}/.netrc |
23 | whitelist ${HOME}/.w3m | 23 | whitelist ${HOME}/.w3m |
24 | |||
25 | #private-bin w3m,mpv,youtube-dl | ||
26 | |||
27 | # tells rtv, which browser to use | ||
28 | #env RTV_BROWSER=w3m | ||
diff --git a/etc/profile-m-z/rtv.profile b/etc/profile-m-z/rtv.profile index f0b8d31e9..03d812270 100644 --- a/etc/profile-m-z/rtv.profile +++ b/etc/profile-m-z/rtv.profile | |||
@@ -12,6 +12,9 @@ blacklist ${RUNUSER}/wayland-* | |||
12 | noblacklist ${HOME}/.config/rtv | 12 | noblacklist ${HOME}/.config/rtv |
13 | noblacklist ${HOME}/.local/share/rtv | 13 | noblacklist ${HOME}/.local/share/rtv |
14 | 14 | ||
15 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
16 | include allow-bin-sh.inc | ||
17 | |||
15 | # Allow python (blacklisted by disable-interpreters.inc) | 18 | # Allow python (blacklisted by disable-interpreters.inc) |
16 | include allow-python2.inc | 19 | include allow-python2.inc |
17 | include allow-python3.inc | 20 | include allow-python3.inc |
@@ -24,7 +27,6 @@ include disable-common.inc | |||
24 | include disable-devel.inc | 27 | include disable-devel.inc |
25 | include disable-exec.inc | 28 | include disable-exec.inc |
26 | include disable-interpreters.inc | 29 | include disable-interpreters.inc |
27 | include disable-passwdmgr.inc | ||
28 | include disable-programs.inc | 30 | include disable-programs.inc |
29 | include disable-xdg.inc | 31 | include disable-xdg.inc |
30 | 32 | ||
@@ -54,10 +56,10 @@ shell none | |||
54 | tracelog | 56 | tracelog |
55 | 57 | ||
56 | disable-mnt | 58 | disable-mnt |
57 | private-bin python*,rtv,sh,xdg-settings | 59 | private-bin less,python*,rtv,sh,xdg-settings |
58 | private-cache | 60 | private-cache |
59 | private-dev | 61 | private-dev |
60 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,terminfo,xdg | 62 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mailcap,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,terminfo,xdg |
61 | 63 | ||
62 | dbus-user none | 64 | dbus-user none |
63 | dbus-system none | 65 | dbus-system none |
diff --git a/etc/profile-m-z/sayonara.profile b/etc/profile-m-z/sayonara.profile index de79913cc..d447be443 100644 --- a/etc/profile-m-z/sayonara.profile +++ b/etc/profile-m-z/sayonara.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${MUSIC} | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/scallion.profile b/etc/profile-m-z/scallion.profile index eb8468c3b..1fa45a747 100644 --- a/etc/profile-m-z/scallion.profile +++ b/etc/profile-m-z/scallion.profile | |||
@@ -14,7 +14,6 @@ noblacklist ${DOCUMENTS} | |||
14 | include disable-common.inc | 14 | include disable-common.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/scorched3d.profile b/etc/profile-m-z/scorched3d.profile index b1989e474..77b3d8923 100644 --- a/etc/profile-m-z/scorched3d.profile +++ b/etc/profile-m-z/scorched3d.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/scorchwentbonkers.profile b/etc/profile-m-z/scorchwentbonkers.profile index 2cb1df6b5..d256b2efe 100644 --- a/etc/profile-m-z/scorchwentbonkers.profile +++ b/etc/profile-m-z/scorchwentbonkers.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin scorchwentbonkers | 43 | private-bin scorchwentbonkers |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alsa,asound.conf,machine-id,pulse | 46 | private-etc alsa,asound.conf,ld.so.preload,machine-id,pulse |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/scribus.profile b/etc/profile-m-z/scribus.profile index 1fdeaa145..5cf60baea 100644 --- a/etc/profile-m-z/scribus.profile +++ b/etc/profile-m-z/scribus.profile | |||
@@ -34,7 +34,6 @@ include disable-common.inc | |||
34 | include disable-devel.inc | 34 | include disable-devel.inc |
35 | include disable-exec.inc | 35 | include disable-exec.inc |
36 | include disable-interpreters.inc | 36 | include disable-interpreters.inc |
37 | include disable-passwdmgr.inc | ||
38 | include disable-programs.inc | 37 | include disable-programs.inc |
39 | include disable-xdg.inc | 38 | include disable-xdg.inc |
40 | 39 | ||
diff --git a/etc/profile-m-z/sdat2img.profile b/etc/profile-m-z/sdat2img.profile index aa2fa9b1b..81a7dc929 100644 --- a/etc/profile-m-z/sdat2img.profile +++ b/etc/profile-m-z/sdat2img.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/seahorse-adventures.profile b/etc/profile-m-z/seahorse-adventures.profile index 7799ab7ed..cb3378597 100644 --- a/etc/profile-m-z/seahorse-adventures.profile +++ b/etc/profile-m-z/seahorse-adventures.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
@@ -49,7 +48,7 @@ private | |||
49 | private-bin bash,dash,python*,seahorse-adventures,sh | 48 | private-bin bash,dash,python*,seahorse-adventures,sh |
50 | private-cache | 49 | private-cache |
51 | private-dev | 50 | private-dev |
52 | private-etc machine-id | 51 | private-etc ld.so.preload,machine-id |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
55 | dbus-user none | 54 | dbus-user none |
diff --git a/etc/profile-m-z/seahorse-tool.profile b/etc/profile-m-z/seahorse-tool.profile index 96ff74edf..f08b852db 100644 --- a/etc/profile-m-z/seahorse-tool.profile +++ b/etc/profile-m-z/seahorse-tool.profile | |||
@@ -8,7 +8,7 @@ include seahorse-tool.local | |||
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | # private-etc workaround for: #2877 | 10 | # private-etc workaround for: #2877 |
11 | private-etc firejail,login.defs,passwd | 11 | private-etc firejail,ld.so.preload,login.defs,passwd |
12 | private-tmp | 12 | private-tmp |
13 | 13 | ||
14 | # Redirect | 14 | # Redirect |
diff --git a/etc/profile-m-z/seahorse.profile b/etc/profile-m-z/seahorse.profile index d3d8e453f..94a27da87 100644 --- a/etc/profile-m-z/seahorse.profile +++ b/etc/profile-m-z/seahorse.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-m-z/server.profile b/etc/profile-m-z/server.profile index 7d56684db..3c9ef3a86 100644 --- a/etc/profile-m-z/server.profile +++ b/etc/profile-m-z/server.profile | |||
@@ -7,7 +7,6 @@ | |||
7 | # [sudo] password for netblue: | 7 | # [sudo] password for netblue: |
8 | # Reading profile /etc/firejail/server.profile | 8 | # Reading profile /etc/firejail/server.profile |
9 | # Reading profile /etc/firejail/disable-common.inc | 9 | # Reading profile /etc/firejail/disable-common.inc |
10 | # Reading profile /etc/firejail/disable-passwdmgr.inc | ||
11 | # Reading profile /etc/firejail/disable-programs.inc | 10 | # Reading profile /etc/firejail/disable-programs.inc |
12 | # | 11 | # |
13 | # ** Note: you can use --noprofile to disable server.profile ** | 12 | # ** Note: you can use --noprofile to disable server.profile ** |
@@ -43,7 +42,6 @@ include disable-common.inc | |||
43 | # include disable-devel.inc | 42 | # include disable-devel.inc |
44 | # include disable-exec.inc | 43 | # include disable-exec.inc |
45 | # include disable-interpreters.inc | 44 | # include disable-interpreters.inc |
46 | include disable-passwdmgr.inc | ||
47 | include disable-programs.inc | 45 | include disable-programs.inc |
48 | include disable-write-mnt.inc | 46 | include disable-write-mnt.inc |
49 | include disable-xdg.inc | 47 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/servo.profile b/etc/profile-m-z/servo.profile index df8fbc3e3..7788974ce 100644 --- a/etc/profile-m-z/servo.profile +++ b/etc/profile-m-z/servo.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/shellcheck.profile b/etc/profile-m-z/shellcheck.profile index b7f398f45..f2469048f 100644 --- a/etc/profile-m-z/shellcheck.profile +++ b/etc/profile-m-z/shellcheck.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-m-z/shortwave.profile b/etc/profile-m-z/shortwave.profile index d629240ec..0bcf5f693 100644 --- a/etc/profile-m-z/shortwave.profile +++ b/etc/profile-m-z/shortwave.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/shotcut.profile b/etc/profile-m-z/shotcut.profile index 63af4d367..e5dbf5c5f 100644 --- a/etc/profile-m-z/shotcut.profile +++ b/etc/profile-m-z/shotcut.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | caps.drop all | 19 | caps.drop all |
diff --git a/etc/profile-m-z/shotwell.profile b/etc/profile-m-z/shotwell.profile index ddc8a7743..304a1cda2 100644 --- a/etc/profile-m-z/shotwell.profile +++ b/etc/profile-m-z/shotwell.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ tracelog | |||
50 | private-bin shotwell | 49 | private-bin shotwell |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc alternatives,fonts,machine-id | 52 | private-etc alternatives,fonts,ld.so.preload,machine-id |
54 | private-opt none | 53 | private-opt none |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
diff --git a/etc/profile-m-z/signal-cli.profile b/etc/profile-m-z/signal-cli.profile index 478377344..24f1464f9 100644 --- a/etc/profile-m-z/signal-cli.profile +++ b/etc/profile-m-z/signal-cli.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-m-z/silentarmy.profile b/etc/profile-m-z/silentarmy.profile index 3f3e2a75d..4351a4d43 100644 --- a/etc/profile-m-z/silentarmy.profile +++ b/etc/profile-m-z/silentarmy.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | # include disable-devel.inc | 10 | # include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/simple-scan.profile b/etc/profile-m-z/simple-scan.profile index 17920677b..b0ab0d039 100644 --- a/etc/profile-m-z/simple-scan.profile +++ b/etc/profile-m-z/simple-scan.profile | |||
@@ -12,7 +12,6 @@ noblacklist ${DOCUMENTS} | |||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/simplescreenrecorder.profile b/etc/profile-m-z/simplescreenrecorder.profile index d664f8bf5..03a350327 100644 --- a/etc/profile-m-z/simplescreenrecorder.profile +++ b/etc/profile-m-z/simplescreenrecorder.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/simutrans.profile b/etc/profile-m-z/simutrans.profile index afaa0f6d8..55e472dbe 100644 --- a/etc/profile-m-z/simutrans.profile +++ b/etc/profile-m-z/simutrans.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/.simutrans | 17 | mkdir ${HOME}/.simutrans |
diff --git a/etc/profile-m-z/skanlite.profile b/etc/profile-m-z/skanlite.profile index 093a61398..4965d3882 100644 --- a/etc/profile-m-z/skanlite.profile +++ b/etc/profile-m-z/skanlite.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${DOCUMENTS} | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
17 | 16 | ||
diff --git a/etc/profile-m-z/slack.profile b/etc/profile-m-z/slack.profile index 51f6c8b00..a511ebb1c 100644 --- a/etc/profile-m-z/slack.profile +++ b/etc/profile-m-z/slack.profile | |||
@@ -26,7 +26,7 @@ mkdir ${HOME}/.config/Slack | |||
26 | whitelist ${HOME}/.config/Slack | 26 | whitelist ${HOME}/.config/Slack |
27 | 27 | ||
28 | private-bin electron,electron[0-9],electron[0-9][0-9],locale,sh,slack | 28 | private-bin electron,electron[0-9],electron[0-9][0-9],locale,sh,slack |
29 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fedora-release,fonts,group,ld.so.cache,ld.so.conf,localtime,machine-id,os-release,passwd,pki,pulse,redhat-release,resolv.conf,ssl,system-release,system-release-cpe | 29 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fedora-release,fonts,group,ld.so.cache,ld.so.conf,ld.so.preload,localtime,machine-id,os-release,passwd,pki,pulse,redhat-release,resolv.conf,ssl,system-release,system-release-cpe |
30 | 30 | ||
31 | # Redirect | 31 | # Redirect |
32 | include electron.profile | 32 | include electron.profile |
diff --git a/etc/profile-m-z/slashem.profile b/etc/profile-m-z/slashem.profile index c5a31c237..bebf77ccc 100644 --- a/etc/profile-m-z/slashem.profile +++ b/etc/profile-m-z/slashem.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | whitelist /var/games/slashem | 17 | whitelist /var/games/slashem |
diff --git a/etc/profile-m-z/smplayer.profile b/etc/profile-m-z/smplayer.profile index 01547e5c1..7c1e18ac3 100644 --- a/etc/profile-m-z/smplayer.profile +++ b/etc/profile-m-z/smplayer.profile | |||
@@ -24,7 +24,6 @@ include disable-common.inc | |||
24 | include disable-devel.inc | 24 | include disable-devel.inc |
25 | include disable-exec.inc | 25 | include disable-exec.inc |
26 | include disable-interpreters.inc | 26 | include disable-interpreters.inc |
27 | include disable-passwdmgr.inc | ||
28 | include disable-programs.inc | 27 | include disable-programs.inc |
29 | include disable-shell.inc | 28 | include disable-shell.inc |
30 | include disable-xdg.inc | 29 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/smtube.profile b/etc/profile-m-z/smtube.profile index 196950eaf..65e6d38e4 100644 --- a/etc/profile-m-z/smtube.profile +++ b/etc/profile-m-z/smtube.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
25 | 24 | ||
diff --git a/etc/profile-m-z/smuxi-frontend-gnome.profile b/etc/profile-m-z/smuxi-frontend-gnome.profile index c3a9bb858..0cdb5537e 100644 --- a/etc/profile-m-z/smuxi-frontend-gnome.profile +++ b/etc/profile-m-z/smuxi-frontend-gnome.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -49,7 +48,7 @@ disable-mnt | |||
49 | private-bin bash,mono,mono-sgen,sh,smuxi-frontend-gnome | 48 | private-bin bash,mono,mono-sgen,sh,smuxi-frontend-gnome |
50 | private-cache | 49 | private-cache |
51 | private-dev | 50 | private-dev |
52 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.conf,machine-id,mono,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg | 51 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.preload,machine-id,mono,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
55 | dbus-user none | 54 | dbus-user none |
diff --git a/etc/profile-m-z/softmaker-common.profile b/etc/profile-m-z/softmaker-common.profile index 83315231f..47468a531 100644 --- a/etc/profile-m-z/softmaker-common.profile +++ b/etc/profile-m-z/softmaker-common.profile | |||
@@ -6,9 +6,9 @@ include softmaker-common.local | |||
6 | # added by caller profile | 6 | # added by caller profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | # The offical packages install the desktop file under /usr/local/share/applications | 9 | # The official packages install the desktop file under /usr/local/share/applications |
10 | # with an absolute Exec line. These files are NOT handelt by firecfg, | 10 | # with an absolute Exec line. These files are NOT handled by firecfg, |
11 | # therefore you must manualy copy them in you home and remove '/usr/bin/'. | 11 | # therefore you must manually copy them in you home and remove '/usr/bin/'. |
12 | 12 | ||
13 | noblacklist ${HOME}/SoftMaker | 13 | noblacklist ${HOME}/SoftMaker |
14 | 14 | ||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | whitelist /usr/share/office2018 | 21 | whitelist /usr/share/office2018 |
diff --git a/etc/profile-m-z/sol.profile b/etc/profile-m-z/sol.profile index 6b8a17813..0af88e048 100644 --- a/etc/profile-m-z/sol.profile +++ b/etc/profile-m-z/sol.profile | |||
@@ -9,7 +9,6 @@ include disable-common.inc | |||
9 | include disable-devel.inc | 9 | include disable-devel.inc |
10 | include disable-exec.inc | 10 | include disable-exec.inc |
11 | include disable-interpreters.inc | 11 | include disable-interpreters.inc |
12 | include disable-passwdmgr.inc | ||
13 | include disable-programs.inc | 12 | include disable-programs.inc |
14 | include disable-shell.inc | 13 | include disable-shell.inc |
15 | include disable-xdg.inc | 14 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/sound-juicer.profile b/etc/profile-m-z/sound-juicer.profile index ef00fdfff..4c37ece8a 100644 --- a/etc/profile-m-z/sound-juicer.profile +++ b/etc/profile-m-z/sound-juicer.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/soundconverter.profile b/etc/profile-m-z/soundconverter.profile index 4dbf34100..e5ff26327 100644 --- a/etc/profile-m-z/soundconverter.profile +++ b/etc/profile-m-z/soundconverter.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-m-z/spectacle.profile b/etc/profile-m-z/spectacle.profile index 4468f21e7..fc4ae2b04 100644 --- a/etc/profile-m-z/spectacle.profile +++ b/etc/profile-m-z/spectacle.profile | |||
@@ -19,11 +19,10 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
25 | 24 | ||
26 | mkfile ${HOME}/.config/spectaclerc | 25 | mkfile ${HOME}/.config/spectaclerc |
27 | whitelist ${HOME}/.config/spectaclerc | 26 | whitelist ${HOME}/.config/spectaclerc |
28 | whitelist ${PICTURES} | 27 | whitelist ${PICTURES} |
29 | whitelist /usr/share/kconf_update/spectacle_newConfig.upd | 28 | whitelist /usr/share/kconf_update/spectacle_newConfig.upd |
@@ -57,7 +56,7 @@ disable-mnt | |||
57 | private-bin spectacle | 56 | private-bin spectacle |
58 | private-cache | 57 | private-cache |
59 | private-dev | 58 | private-dev |
60 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d | 59 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload |
61 | private-tmp | 60 | private-tmp |
62 | 61 | ||
63 | dbus-user filter | 62 | dbus-user filter |
diff --git a/etc/profile-m-z/spectral.profile b/etc/profile-m-z/spectral.profile index 283674517..5f17b73dc 100644 --- a/etc/profile-m-z/spectral.profile +++ b/etc/profile-m-z/spectral.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/spectre-meltdown-checker.profile b/etc/profile-m-z/spectre-meltdown-checker.profile index 984461f90..19d7f8ae3 100644 --- a/etc/profile-m-z/spectre-meltdown-checker.profile +++ b/etc/profile-m-z/spectre-meltdown-checker.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
24 | 23 | ||
diff --git a/etc/profile-m-z/spotify.profile b/etc/profile-m-z/spotify.profile index 01bc2bc05..0ce918161 100644 --- a/etc/profile-m-z/spotify.profile +++ b/etc/profile-m-z/spotify.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | mkdir ${HOME}/.cache/spotify | 20 | mkdir ${HOME}/.cache/spotify |
@@ -45,7 +44,7 @@ disable-mnt | |||
45 | private-bin bash,cat,dirname,find,grep,head,rm,sh,spotify,tclsh,touch,zenity | 44 | private-bin bash,cat,dirname,find,grep,head,rm,sh,spotify,tclsh,touch,zenity |
46 | private-dev | 45 | private-dev |
47 | # If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local. | 46 | # If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local. |
48 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,host.conf,hosts,ld.so.cache,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl | 47 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,host.conf,hosts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl |
49 | private-opt spotify | 48 | private-opt spotify |
50 | private-srv none | 49 | private-srv none |
51 | private-tmp | 50 | private-tmp |
diff --git a/etc/profile-m-z/sqlitebrowser.profile b/etc/profile-m-z/sqlitebrowser.profile index 4dd2c7262..21a77a0d1 100644 --- a/etc/profile-m-z/sqlitebrowser.profile +++ b/etc/profile-m-z/sqlitebrowser.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -43,7 +42,7 @@ shell none | |||
43 | private-bin sqlitebrowser | 42 | private-bin sqlitebrowser |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,machine-id,passwd,pki,ssl | 45 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.preload,machine-id,passwd,pki,ssl |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | # breaks proxy creation | 48 | # breaks proxy creation |
diff --git a/etc/profile-m-z/ssh-agent.profile b/etc/profile-m-z/ssh-agent.profile index 5802299a3..11723664f 100644 --- a/etc/profile-m-z/ssh-agent.profile +++ b/etc/profile-m-z/ssh-agent.profile | |||
@@ -13,7 +13,6 @@ blacklist /tmp/.X11-unix | |||
13 | blacklist ${RUNUSER}/wayland-* | 13 | blacklist ${RUNUSER}/wayland-* |
14 | 14 | ||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | include whitelist-usr-share-common.inc | 18 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-m-z/ssh.profile b/etc/profile-m-z/ssh.profile index a58642192..9295013e7 100644 --- a/etc/profile-m-z/ssh.profile +++ b/etc/profile-m-z/ssh.profile | |||
@@ -16,7 +16,6 @@ include allow-ssh.inc | |||
16 | 16 | ||
17 | include disable-common.inc | 17 | include disable-common.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh | 21 | whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh |
diff --git a/etc/profile-m-z/standardnotes-desktop.profile b/etc/profile-m-z/standardnotes-desktop.profile index 48a532876..7a59274bf 100644 --- a/etc/profile-m-z/standardnotes-desktop.profile +++ b/etc/profile-m-z/standardnotes-desktop.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/Standard Notes Backups | 17 | mkdir ${HOME}/Standard Notes Backups |
@@ -39,7 +38,7 @@ seccomp !chroot | |||
39 | disable-mnt | 38 | disable-mnt |
40 | private-dev | 39 | private-dev |
41 | private-tmp | 40 | private-tmp |
42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,pki,resolv.conf,ssl,xdg | 41 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl,xdg |
43 | 42 | ||
44 | dbus-user none | 43 | dbus-user none |
45 | dbus-system none | 44 | dbus-system none |
diff --git a/etc/profile-m-z/steam.profile b/etc/profile-m-z/steam.profile index 06d08f3a2..dfefd7c2c 100644 --- a/etc/profile-m-z/steam.profile +++ b/etc/profile-m-z/steam.profile | |||
@@ -51,7 +51,6 @@ include allow-python3.inc | |||
51 | include disable-common.inc | 51 | include disable-common.inc |
52 | include disable-devel.inc | 52 | include disable-devel.inc |
53 | include disable-interpreters.inc | 53 | include disable-interpreters.inc |
54 | include disable-passwdmgr.inc | ||
55 | include disable-programs.inc | 54 | include disable-programs.inc |
56 | 55 | ||
57 | mkdir ${HOME}/.config/Epic | 56 | mkdir ${HOME}/.config/Epic |
diff --git a/etc/profile-m-z/stellarium.profile b/etc/profile-m-z/stellarium.profile index a752ab53c..d2ebce45f 100644 --- a/etc/profile-m-z/stellarium.profile +++ b/etc/profile-m-z/stellarium.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/straw-viewer.profile b/etc/profile-m-z/straw-viewer.profile index d73927f2a..513abc21b 100644 --- a/etc/profile-m-z/straw-viewer.profile +++ b/etc/profile-m-z/straw-viewer.profile | |||
@@ -18,4 +18,4 @@ whitelist ${HOME}/.config/straw-viewer | |||
18 | private-bin gtk-straw-viewer,straw-viewer | 18 | private-bin gtk-straw-viewer,straw-viewer |
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
21 | include youtube-viewers-common.profile \ No newline at end of file | 21 | include youtube-viewers-common.profile |
diff --git a/etc/profile-m-z/strawberry.profile b/etc/profile-m-z/strawberry.profile index b87906f55..50ecc3432 100644 --- a/etc/profile-m-z/strawberry.profile +++ b/etc/profile-m-z/strawberry.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin strawberry,strawberry-tagreader | 43 | private-bin strawberry,strawberry-tagreader |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,nsswitch.conf,pki,resolv.conf,ssl | 46 | private-etc ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-system none | 49 | dbus-system none |
diff --git a/etc/profile-m-z/strings.profile b/etc/profile-m-z/strings.profile index 1ebcded7f..9298e6614 100644 --- a/etc/profile-m-z/strings.profile +++ b/etc/profile-m-z/strings.profile | |||
@@ -13,7 +13,6 @@ blacklist ${RUNUSER} | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | #include disable-programs.inc | 16 | #include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | #include disable-xdg.inc | 18 | #include disable-xdg.inc |
diff --git a/etc/profile-m-z/subdownloader.profile b/etc/profile-m-z/subdownloader.profile index bbe92fd38..65cb678d0 100644 --- a/etc/profile-m-z/subdownloader.profile +++ b/etc/profile-m-z/subdownloader.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
@@ -45,7 +44,7 @@ tracelog | |||
45 | 44 | ||
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc alternatives,fonts | 47 | private-etc alternatives,fonts,ld.so.preload |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-m-z/supertux2.profile b/etc/profile-m-z/supertux2.profile index cfd7a63ea..323849e35 100644 --- a/etc/profile-m-z/supertux2.profile +++ b/etc/profile-m-z/supertux2.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ tracelog | |||
46 | disable-mnt | 45 | disable-mnt |
47 | # private-bin supertux2 | 46 | # private-bin supertux2 |
48 | private-cache | 47 | private-cache |
49 | private-etc machine-id | 48 | private-etc ld.so.preload,machine-id |
50 | private-dev | 49 | private-dev |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
diff --git a/etc/profile-m-z/supertuxkart.profile b/etc/profile-m-z/supertuxkart.profile index 4eb8f921c..5b5b4aae5 100644 --- a/etc/profile-m-z/supertuxkart.profile +++ b/etc/profile-m-z/supertuxkart.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
@@ -55,7 +54,7 @@ private-bin supertuxkart | |||
55 | private-cache | 54 | private-cache |
56 | # Add the next line to your supertuxkart.local if you do not need controller support. | 55 | # Add the next line to your supertuxkart.local if you do not need controller support. |
57 | #private-dev | 56 | #private-dev |
58 | private-etc alternatives,ca-certificates,crypto-policies,drirc,hosts,machine-id,openal,pki,resolv.conf,ssl | 57 | private-etc alternatives,ca-certificates,crypto-policies,drirc,hosts,ld.so.preload,machine-id,openal,pki,resolv.conf,ssl |
59 | private-tmp | 58 | private-tmp |
60 | private-opt none | 59 | private-opt none |
61 | private-srv none | 60 | private-srv none |
diff --git a/etc/profile-m-z/surf.profile b/etc/profile-m-z/surf.profile index 8db7d2433..cfecb6f62 100644 --- a/etc/profile-m-z/surf.profile +++ b/etc/profile-m-z/surf.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${HOME}/.surf | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | mkdir ${HOME}/.surf | 16 | mkdir ${HOME}/.surf |
@@ -35,6 +34,6 @@ tracelog | |||
35 | disable-mnt | 34 | disable-mnt |
36 | private-bin bash,curl,dmenu,ls,printf,sed,sh,sleep,st,stterm,surf,xargs,xprop | 35 | private-bin bash,curl,dmenu,ls,printf,sed,sh,sleep,st,stterm,surf,xargs,xprop |
37 | private-dev | 36 | private-dev |
38 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,resolv.conf,ssl | 37 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,ld.so.preload,machine-id,passwd,pki,resolv.conf,ssl |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
diff --git a/etc/profile-m-z/sushi.profile b/etc/profile-m-z/sushi.profile index 2a15a5d09..621622043 100644 --- a/etc/profile-m-z/sushi.profile +++ b/etc/profile-m-z/sushi.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | # include disable-programs.inc | 16 | # include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | 18 | ||
diff --git a/etc/profile-a-l/sway.profile b/etc/profile-m-z/sway.profile index 4637419bf..046d1b4be 100644 --- a/etc/profile-a-l/sway.profile +++ b/etc/profile-m-z/sway.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for Sway | 1 | # Firejail profile for Sway |
2 | # Description: i3-compatible Wayland compositor | 2 | # Description: i3-compatible Wayland compositor |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include sway.local | 5 | include sway.local |
diff --git a/etc/profile-m-z/synfigstudio.profile b/etc/profile-m-z/synfigstudio.profile index c60186c42..7f23992a8 100644 --- a/etc/profile-m-z/synfigstudio.profile +++ b/etc/profile-m-z/synfigstudio.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | caps.drop all | 18 | caps.drop all |
diff --git a/etc/profile-m-z/sysprof.profile b/etc/profile-m-z/sysprof.profile index b52b25b96..c7119ae0f 100644 --- a/etc/profile-m-z/sysprof.profile +++ b/etc/profile-m-z/sysprof.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
17 | 16 | ||
@@ -64,7 +63,7 @@ disable-mnt | |||
64 | #private-bin sysprof - breaks help menu | 63 | #private-bin sysprof - breaks help menu |
65 | private-cache | 64 | private-cache |
66 | private-dev | 65 | private-dev |
67 | private-etc alternatives,fonts,ld.so.cache,machine-id,ssl | 66 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id,ssl |
68 | # private-lib - breaks help menu | 67 | # private-lib - breaks help menu |
69 | #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so | 68 | #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so |
70 | private-tmp | 69 | private-tmp |
diff --git a/etc/profile-m-z/tar.profile b/etc/profile-m-z/tar.profile index 0d3a900e9..388805f31 100644 --- a/etc/profile-m-z/tar.profile +++ b/etc/profile-m-z/tar.profile | |||
@@ -14,7 +14,7 @@ ignore include disable-shell.inc | |||
14 | # all capabilities this is automatically read-only. | 14 | # all capabilities this is automatically read-only. |
15 | noblacklist /var/lib/pacman | 15 | noblacklist /var/lib/pacman |
16 | 16 | ||
17 | private-etc alternatives,group,localtime,login.defs,passwd | 17 | private-etc alternatives,group,ld.so.preload,localtime,login.defs,passwd |
18 | #private-lib libfakeroot,liblzma.so.*,libreadline.so.* | 18 | #private-lib libfakeroot,liblzma.so.*,libreadline.so.* |
19 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) | 19 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) |
20 | writable-var | 20 | writable-var |
diff --git a/etc/profile-m-z/tcpdump.profile b/etc/profile-m-z/tcpdump.profile index e2ba5893c..57301a54d 100644 --- a/etc/profile-m-z/tcpdump.profile +++ b/etc/profile-m-z/tcpdump.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/teams-for-linux.profile b/etc/profile-m-z/teams-for-linux.profile index eee083332..310c440b1 100644 --- a/etc/profile-m-z/teams-for-linux.profile +++ b/etc/profile-m-z/teams-for-linux.profile | |||
@@ -19,8 +19,8 @@ noblacklist ${HOME}/.config/teams-for-linux | |||
19 | mkdir ${HOME}/.config/teams-for-linux | 19 | mkdir ${HOME}/.config/teams-for-linux |
20 | whitelist ${HOME}/.config/teams-for-linux | 20 | whitelist ${HOME}/.config/teams-for-linux |
21 | 21 | ||
22 | private-bin bash,cut,echo,egrep,grep,head,sed,sh,teams-for-linux,tr,xdg-mime,xdg-open,zsh | 22 | private-bin bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,teams-for-linux,tr,xdg-mime,xdg-open,zsh |
23 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,resolv.conf,ssl | 23 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,resolv.conf,ssl |
24 | 24 | ||
25 | # Redirect | 25 | # Redirect |
26 | include electron.profile | 26 | include electron.profile |
diff --git a/etc/profile-m-z/teamspeak3.profile b/etc/profile-m-z/teamspeak3.profile index 02a2c8ae4..c149473f6 100644 --- a/etc/profile-m-z/teamspeak3.profile +++ b/etc/profile-m-z/teamspeak3.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.ts3client | 18 | mkdir ${HOME}/.ts3client |
diff --git a/etc/profile-m-z/teeworlds.profile b/etc/profile-m-z/teeworlds.profile index be01aee12..df54fb9ba 100644 --- a/etc/profile-m-z/teeworlds.profile +++ b/etc/profile-m-z/teeworlds.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/telegram.profile b/etc/profile-m-z/telegram.profile index 05c621fb2..fd4b82524 100644 --- a/etc/profile-m-z/telegram.profile +++ b/etc/profile-m-z/telegram.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -22,6 +21,7 @@ mkdir ${HOME}/.local/share/TelegramDesktop | |||
22 | whitelist ${HOME}/.TelegramDesktop | 21 | whitelist ${HOME}/.TelegramDesktop |
23 | whitelist ${HOME}/.local/share/TelegramDesktop | 22 | whitelist ${HOME}/.local/share/TelegramDesktop |
24 | whitelist ${DOWNLOADS} | 23 | whitelist ${DOWNLOADS} |
24 | whitelist /usr/share/TelegramDesktop | ||
25 | include whitelist-common.inc | 25 | include whitelist-common.inc |
26 | include whitelist-runuser-common.inc | 26 | include whitelist-runuser-common.inc |
27 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
@@ -39,16 +39,16 @@ protocol unix,inet,inet6,netlink | |||
39 | seccomp | 39 | seccomp |
40 | seccomp.block-secondary | 40 | seccomp.block-secondary |
41 | shell none | 41 | shell none |
42 | tracelog | ||
43 | 42 | ||
44 | disable-mnt | 43 | disable-mnt |
45 | #private-bin telegram,Telegram,telegram-desktop | 44 | private-bin telegram,Telegram,telegram-desktop |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc alsa,alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,machine-id,os-release,passwd,pki,pulse,resolv.conf,ssl,xdg | 47 | private-etc alsa,alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,machine-id,os-release,passwd,pki,pulse,resolv.conf,ssl,xdg |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | dbus-user filter | 50 | dbus-user filter |
51 | dbus-user.own org.telegram.desktop.* | ||
52 | dbus-user.talk org.freedesktop.Notifications | 52 | dbus-user.talk org.freedesktop.Notifications |
53 | dbus-user.talk org.kde.StatusNotifierWatcher | 53 | dbus-user.talk org.kde.StatusNotifierWatcher |
54 | dbus-user.talk org.gnome.Mutter.IdleMonitor | 54 | dbus-user.talk org.gnome.Mutter.IdleMonitor |
diff --git a/etc/profile-m-z/terasology.profile b/etc/profile-m-z/terasology.profile index ce2ca1d17..0f6691b49 100644 --- a/etc/profile-m-z/terasology.profile +++ b/etc/profile-m-z/terasology.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | mkdir ${HOME}/.java | 21 | mkdir ${HOME}/.java |
diff --git a/etc/profile-m-z/thunderbird.profile b/etc/profile-m-z/thunderbird.profile index b478fbe1e..b66b81fdf 100644 --- a/etc/profile-m-z/thunderbird.profile +++ b/etc/profile-m-z/thunderbird.profile | |||
@@ -31,7 +31,6 @@ noblacklist ${HOME}/.gnupg | |||
31 | # noblacklist ${HOME}/.icedove | 31 | # noblacklist ${HOME}/.icedove |
32 | noblacklist ${HOME}/.thunderbird | 32 | noblacklist ${HOME}/.thunderbird |
33 | 33 | ||
34 | include disable-passwdmgr.inc | ||
35 | include disable-xdg.inc | 34 | include disable-xdg.inc |
36 | 35 | ||
37 | # If you have setup Thunderbird to archive emails to a local folder, | 36 | # If you have setup Thunderbird to archive emails to a local folder, |
diff --git a/etc/profile-m-z/tilp.profile b/etc/profile-m-z/tilp.profile index dd4a372c4..07212a452 100644 --- a/etc/profile-m-z/tilp.profile +++ b/etc/profile-m-z/tilp.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | 16 | ||
@@ -31,6 +30,6 @@ tracelog | |||
31 | disable-mnt | 30 | disable-mnt |
32 | private-bin tilp | 31 | private-bin tilp |
33 | private-cache | 32 | private-cache |
34 | private-etc alternatives,fonts | 33 | private-etc alternatives,fonts,ld.so.preload |
35 | private-tmp | 34 | private-tmp |
36 | 35 | ||
diff --git a/etc/profile-m-z/tin.profile b/etc/profile-m-z/tin.profile index e0ed3090a..a43e53aae 100644 --- a/etc/profile-m-z/tin.profile +++ b/etc/profile-m-z/tin.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
@@ -59,7 +58,7 @@ disable-mnt | |||
59 | private-bin rtin,tin | 58 | private-bin rtin,tin |
60 | private-cache | 59 | private-cache |
61 | private-dev | 60 | private-dev |
62 | private-etc passwd,resolv.conf,terminfo,tin | 61 | private-etc ld.so.preload,passwd,resolv.conf,terminfo,tin |
63 | private-lib terminfo | 62 | private-lib terminfo |
64 | private-tmp | 63 | private-tmp |
65 | 64 | ||
diff --git a/etc/profile-m-z/tmux.profile b/etc/profile-m-z/tmux.profile index 0139d7515..1e783d2b9 100644 --- a/etc/profile-m-z/tmux.profile +++ b/etc/profile-m-z/tmux.profile | |||
@@ -15,7 +15,6 @@ noblacklist /tmp/tmux-* | |||
15 | # include disable-common.inc | 15 | # include disable-common.inc |
16 | # include disable-devel.inc | 16 | # include disable-devel.inc |
17 | # include disable-exec.inc | 17 | # include disable-exec.inc |
18 | include disable-passwdmgr.inc | ||
19 | # include disable-programs.inc | 18 | # include disable-programs.inc |
20 | 19 | ||
21 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/profile-m-z/tor.profile b/etc/profile-m-z/tor.profile index 73ef290f4..312123f59 100644 --- a/etc/profile-m-z/tor.profile +++ b/etc/profile-m-z/tor.profile | |||
@@ -21,7 +21,6 @@ include disable-common.inc | |||
21 | include disable-devel.inc | 21 | include disable-devel.inc |
22 | include disable-exec.inc | 22 | include disable-exec.inc |
23 | include disable-interpreters.inc | 23 | include disable-interpreters.inc |
24 | include disable-passwdmgr.inc | ||
25 | include disable-programs.inc | 24 | include disable-programs.inc |
26 | include disable-xdg.inc | 25 | include disable-xdg.inc |
27 | 26 | ||
@@ -47,6 +46,6 @@ private | |||
47 | private-bin bash,tor | 46 | private-bin bash,tor |
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | private-etc alternatives,ca-certificates,crypto-policies,passwd,pki,ssl,tor | 49 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,passwd,pki,ssl,tor |
51 | private-tmp | 50 | private-tmp |
52 | writable-var | 51 | writable-var |
diff --git a/etc/profile-m-z/torbrowser-launcher.profile b/etc/profile-m-z/torbrowser-launcher.profile index 7659ed1e9..e7b8ecd3f 100644 --- a/etc/profile-m-z/torbrowser-launcher.profile +++ b/etc/profile-m-z/torbrowser-launcher.profile | |||
@@ -22,7 +22,6 @@ include disable-common.inc | |||
22 | include disable-devel.inc | 22 | include disable-devel.inc |
23 | include disable-exec.inc | 23 | include disable-exec.inc |
24 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
25 | include disable-passwdmgr.inc | ||
26 | include disable-programs.inc | 25 | include disable-programs.inc |
27 | include disable-xdg.inc | 26 | include disable-xdg.inc |
28 | 27 | ||
diff --git a/etc/profile-m-z/torcs.profile b/etc/profile-m-z/torcs.profile index 0f98a8f64..a7ebaf2af 100644 --- a/etc/profile-m-z/torcs.profile +++ b/etc/profile-m-z/torcs.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/totem.profile b/etc/profile-m-z/totem.profile index 70d9e0aee..dac753fd1 100644 --- a/etc/profile-m-z/totem.profile +++ b/etc/profile-m-z/totem.profile | |||
@@ -20,7 +20,6 @@ include disable-common.inc | |||
20 | include disable-devel.inc | 20 | include disable-devel.inc |
21 | include disable-exec.inc | 21 | include disable-exec.inc |
22 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | 23 | include disable-programs.inc |
25 | include disable-shell.inc | 24 | include disable-shell.inc |
26 | 25 | ||
diff --git a/etc/profile-m-z/tracker.profile b/etc/profile-m-z/tracker.profile index 87c5de076..ba44224f9 100644 --- a/etc/profile-m-z/tracker.profile +++ b/etc/profile-m-z/tracker.profile | |||
@@ -14,7 +14,6 @@ blacklist ${RUNUSER}/wayland-* | |||
14 | include disable-common.inc | 14 | include disable-common.inc |
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/transgui.profile b/etc/profile-m-z/transgui.profile index ea118a9f0..0e23b7843 100644 --- a/etc/profile-m-z/transgui.profile +++ b/etc/profile-m-z/transgui.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ tracelog | |||
46 | private-bin geoiplookup,geoiplookup6,transgui | 45 | private-bin geoiplookup,geoiplookup6,transgui |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts,ld.so.preload |
50 | private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.* | 49 | private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.* |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
diff --git a/etc/profile-m-z/transmission-cli.profile b/etc/profile-m-z/transmission-cli.profile index 486be5fe6..b3fab083c 100644 --- a/etc/profile-m-z/transmission-cli.profile +++ b/etc/profile-m-z/transmission-cli.profile | |||
@@ -8,7 +8,7 @@ include transmission-cli.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | private-bin transmission-cli | 10 | private-bin transmission-cli |
11 | private-etc alternatives,ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl | 11 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
12 | 12 | ||
13 | # Redirect | 13 | # Redirect |
14 | include transmission-common.profile | 14 | include transmission-common.profile |
diff --git a/etc/profile-m-z/transmission-common.profile b/etc/profile-m-z/transmission-common.profile index 82671b709..9d9b8cc2c 100644 --- a/etc/profile-m-z/transmission-common.profile +++ b/etc/profile-m-z/transmission-common.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | mkdir ${HOME}/.cache/transmission | 19 | mkdir ${HOME}/.cache/transmission |
diff --git a/etc/profile-m-z/transmission-daemon.profile b/etc/profile-m-z/transmission-daemon.profile index 348d3cb80..9d91b8b81 100644 --- a/etc/profile-m-z/transmission-daemon.profile +++ b/etc/profile-m-z/transmission-daemon.profile | |||
@@ -17,7 +17,7 @@ caps.keep ipc_lock,net_bind_service,setgid,setuid,sys_chroot | |||
17 | protocol packet | 17 | protocol packet |
18 | 18 | ||
19 | private-bin transmission-daemon | 19 | private-bin transmission-daemon |
20 | private-etc alternatives,ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl | 20 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
21 | 21 | ||
22 | read-write /var/lib/transmission | 22 | read-write /var/lib/transmission |
23 | writable-var-log | 23 | writable-var-log |
diff --git a/etc/profile-m-z/transmission-remote-gtk.profile b/etc/profile-m-z/transmission-remote-gtk.profile index a6400e2c0..20d54500f 100644 --- a/etc/profile-m-z/transmission-remote-gtk.profile +++ b/etc/profile-m-z/transmission-remote-gtk.profile | |||
@@ -12,7 +12,7 @@ noblacklist ${HOME}/.config/transmission-remote-gtk | |||
12 | mkdir ${HOME}/.config/transmission-remote-gtk | 12 | mkdir ${HOME}/.config/transmission-remote-gtk |
13 | whitelist ${HOME}/.config/transmission-remote-gtk | 13 | whitelist ${HOME}/.config/transmission-remote-gtk |
14 | 14 | ||
15 | private-etc fonts,hostname,hosts,resolv.conf | 15 | private-etc fonts,hostname,hosts,ld.so.preload,resolv.conf |
16 | # Problems with private-lib (see issue #2889) | 16 | # Problems with private-lib (see issue #2889) |
17 | ignore private-lib | 17 | ignore private-lib |
18 | 18 | ||
diff --git a/etc/profile-m-z/transmission-remote.profile b/etc/profile-m-z/transmission-remote.profile index fee4999e6..ad4ad2172 100644 --- a/etc/profile-m-z/transmission-remote.profile +++ b/etc/profile-m-z/transmission-remote.profile | |||
@@ -8,7 +8,7 @@ include transmission-remote.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | private-bin transmission-remote | 10 | private-bin transmission-remote |
11 | private-etc alternatives,hosts,nsswitch.conf | 11 | private-etc alternatives,hosts,ld.so.preload,nsswitch.conf |
12 | 12 | ||
13 | # Redirect | 13 | # Redirect |
14 | include transmission-common.profile | 14 | include transmission-common.profile |
diff --git a/etc/profile-m-z/transmission-show.profile b/etc/profile-m-z/transmission-show.profile index 5a3c83f58..822a368da 100644 --- a/etc/profile-m-z/transmission-show.profile +++ b/etc/profile-m-z/transmission-show.profile | |||
@@ -8,7 +8,7 @@ include transmission-show.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | private-bin transmission-show | 10 | private-bin transmission-show |
11 | private-etc alternatives,hosts,nsswitch.conf | 11 | private-etc alternatives,hosts,ld.so.preload,nsswitch.conf |
12 | 12 | ||
13 | # Redirect | 13 | # Redirect |
14 | include transmission-common.profile | 14 | include transmission-common.profile |
diff --git a/etc/profile-m-z/tremulous.profile b/etc/profile-m-z/tremulous.profile index aba563fac..4e16df553 100644 --- a/etc/profile-m-z/tremulous.profile +++ b/etc/profile-m-z/tremulous.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/trojita.profile b/etc/profile-m-z/trojita.profile index 2d95081f6..1959aee1e 100644 --- a/etc/profile-m-z/trojita.profile +++ b/etc/profile-m-z/trojita.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -55,7 +54,7 @@ tracelog | |||
55 | private-bin trojita | 54 | private-bin trojita |
56 | private-cache | 55 | private-cache |
57 | private-dev | 56 | private-dev |
58 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg | 57 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.preload,pki,resolv.conf,selinux,ssl,xdg |
59 | private-tmp | 58 | private-tmp |
60 | 59 | ||
61 | dbus-user filter | 60 | dbus-user filter |
diff --git a/etc/profile-m-z/truecraft.profile b/etc/profile-m-z/truecraft.profile index 749626475..503e1ae64 100644 --- a/etc/profile-m-z/truecraft.profile +++ b/etc/profile-m-z/truecraft.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/.config/mono | 17 | mkdir ${HOME}/.config/mono |
diff --git a/etc/profile-m-z/tuxguitar.profile b/etc/profile-m-z/tuxguitar.profile index 3cd496412..807d43281 100644 --- a/etc/profile-m-z/tuxguitar.profile +++ b/etc/profile-m-z/tuxguitar.profile | |||
@@ -20,7 +20,6 @@ include disable-common.inc | |||
20 | include disable-devel.inc | 20 | include disable-devel.inc |
21 | include disable-exec.inc | 21 | include disable-exec.inc |
22 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | 23 | include disable-programs.inc |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
26 | 25 | ||
diff --git a/etc/profile-m-z/tvbrowser.profile b/etc/profile-m-z/tvbrowser.profile index dae7d86da..8a18519ac 100644 --- a/etc/profile-m-z/tvbrowser.profile +++ b/etc/profile-m-z/tvbrowser.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-m-z/twitch.profile b/etc/profile-m-z/twitch.profile index 2f573c872..bd2f1bcf9 100644 --- a/etc/profile-m-z/twitch.profile +++ b/etc/profile-m-z/twitch.profile | |||
@@ -17,8 +17,8 @@ include disable-shell.inc | |||
17 | mkdir ${HOME}/.config/Twitch | 17 | mkdir ${HOME}/.config/Twitch |
18 | whitelist ${HOME}/.config/Twitch | 18 | whitelist ${HOME}/.config/Twitch |
19 | 19 | ||
20 | private-bin twitch | 20 | private-bin electron,electron[0-9],electron[0-9][0-9],twitch |
21 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 21 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
22 | private-opt Twitch | 22 | private-opt Twitch |
23 | 23 | ||
24 | # Redirect | 24 | # Redirect |
diff --git a/etc/profile-m-z/udiskie.profile b/etc/profile-m-z/udiskie.profile index 601b818c2..02f05af16 100644 --- a/etc/profile-m-z/udiskie.profile +++ b/etc/profile-m-z/udiskie.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/uefitool.profile b/etc/profile-m-z/uefitool.profile index 3e4fdbb03..2e5630f3d 100644 --- a/etc/profile-m-z/uefitool.profile +++ b/etc/profile-m-z/uefitool.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
17 | 16 | ||
diff --git a/etc/profile-m-z/unbound.profile b/etc/profile-m-z/unbound.profile index 0c077babf..e8424cd7d 100644 --- a/etc/profile-m-z/unbound.profile +++ b/etc/profile-m-z/unbound.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-m-z/unf.profile b/etc/profile-m-z/unf.profile index 6db7ba362..685e74e25 100644 --- a/etc/profile-m-z/unf.profile +++ b/etc/profile-m-z/unf.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ private-bin unf | |||
50 | private-cache | 49 | private-cache |
51 | ?HAS_APPIMAGE: ignore private-dev | 50 | ?HAS_APPIMAGE: ignore private-dev |
52 | private-dev | 51 | private-dev |
53 | private-etc alternatives | 52 | private-etc alternatives,ld.so.preload |
54 | private-lib gcc/*/*/libgcc_s.so.* | 53 | private-lib gcc/*/*/libgcc_s.so.* |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
diff --git a/etc/profile-m-z/unknown-horizons.profile b/etc/profile-m-z/unknown-horizons.profile index 956492f52..b8f4dc431 100644 --- a/etc/profile-m-z/unknown-horizons.profile +++ b/etc/profile-m-z/unknown-horizons.profile | |||
@@ -10,7 +10,6 @@ noblacklist ${HOME}/.unknown-horizons | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | 14 | ||
16 | mkdir ${HOME}/.unknown-horizons | 15 | mkdir ${HOME}/.unknown-horizons |
diff --git a/etc/profile-m-z/unrar.profile b/etc/profile-m-z/unrar.profile index 9d3d9b40e..761ee91c5 100644 --- a/etc/profile-m-z/unrar.profile +++ b/etc/profile-m-z/unrar.profile | |||
@@ -8,7 +8,7 @@ include unrar.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | private-bin unrar | 10 | private-bin unrar |
11 | private-etc alternatives,group,localtime,passwd | 11 | private-etc alternatives,group,ld.so.preload,localtime,passwd |
12 | private-tmp | 12 | private-tmp |
13 | 13 | ||
14 | # Redirect | 14 | # Redirect |
diff --git a/etc/profile-m-z/unzip.profile b/etc/profile-m-z/unzip.profile index 0231e3dba..981826b16 100644 --- a/etc/profile-m-z/unzip.profile +++ b/etc/profile-m-z/unzip.profile | |||
@@ -10,7 +10,7 @@ include globals.local | |||
10 | # GNOME Shell integration (chrome-gnome-shell) | 10 | # GNOME Shell integration (chrome-gnome-shell) |
11 | noblacklist ${HOME}/.local/share/gnome-shell | 11 | noblacklist ${HOME}/.local/share/gnome-shell |
12 | 12 | ||
13 | private-etc alternatives,group,localtime,passwd | 13 | private-etc alternatives,group,ld.so.preload,localtime,passwd |
14 | 14 | ||
15 | # Redirect | 15 | # Redirect |
16 | include archiver-common.profile | 16 | include archiver-common.profile |
diff --git a/etc/profile-m-z/utox.profile b/etc/profile-m-z/utox.profile index dd881f091..5a867a683 100644 --- a/etc/profile-m-z/utox.profile +++ b/etc/profile-m-z/utox.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin utox | 43 | private-bin utox |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,openal,pki,pulse,resolv.conf,ssl | 46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,localtime,machine-id,openal,pki,pulse,resolv.conf,ssl |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | memory-deny-write-execute | 49 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/uudeview.profile b/etc/profile-m-z/uudeview.profile index 2adc044e5..3b38f16e0 100644 --- a/etc/profile-m-z/uudeview.profile +++ b/etc/profile-m-z/uudeview.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/viewnior.profile b/etc/profile-m-z/viewnior.profile index a9ba344dd..ed2f0103b 100644 --- a/etc/profile-m-z/viewnior.profile +++ b/etc/profile-m-z/viewnior.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | 21 | ||
@@ -44,7 +43,7 @@ tracelog | |||
44 | private-bin viewnior | 43 | private-bin viewnior |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,fonts,machine-id | 46 | private-etc alternatives,fonts,ld.so.preload,machine-id |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/viking.profile b/etc/profile-m-z/viking.profile index 8f8ef5939..fd15228cf 100644 --- a/etc/profile-m-z/viking.profile +++ b/etc/profile-m-z/viking.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/vim.profile b/etc/profile-m-z/vim.profile index c3cfe5980..a6e05a32a 100644 --- a/etc/profile-m-z/vim.profile +++ b/etc/profile-m-z/vim.profile | |||
@@ -14,7 +14,6 @@ noblacklist ${HOME}/.vimrc | |||
14 | include allow-common-devel.inc | 14 | include allow-common-devel.inc |
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | include whitelist-runuser-common.inc | 19 | include whitelist-runuser-common.inc |
diff --git a/etc/profile-m-z/virtualbox.profile b/etc/profile-m-z/virtualbox.profile index c22fb0ff9..a6d3eaafd 100644 --- a/etc/profile-m-z/virtualbox.profile +++ b/etc/profile-m-z/virtualbox.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
@@ -46,7 +45,7 @@ tracelog | |||
46 | #disable-mnt | 45 | #disable-mnt |
47 | #private-bin awk,basename,bash,env,gawk,grep,ps,readlink,sh,virtualbox,VirtualBox,VBox*,vbox*,whoami | 46 | #private-bin awk,basename,bash,env,gawk,grep,ps,readlink,sh,virtualbox,VirtualBox,VBox*,vbox*,whoami |
48 | private-cache | 47 | private-cache |
49 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl | 48 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,pulse,resolv.conf,ssl |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-m-z/vlc.profile b/etc/profile-m-z/vlc.profile index cd7dccd8a..68db032aa 100644 --- a/etc/profile-m-z/vlc.profile +++ b/etc/profile-m-z/vlc.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | read-only ${DESKTOP} | 20 | read-only ${DESKTOP} |
diff --git a/etc/profile-m-z/vmware-view.profile b/etc/profile-m-z/vmware-view.profile index f07c31b68..b2b019ff4 100644 --- a/etc/profile-m-z/vmware-view.profile +++ b/etc/profile-m-z/vmware-view.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/vmware.profile b/etc/profile-m-z/vmware.profile index 5241e27b3..8e25daee0 100644 --- a/etc/profile-m-z/vmware.profile +++ b/etc/profile-m-z/vmware.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
@@ -39,6 +38,6 @@ tracelog | |||
39 | #disable-mnt | 38 | #disable-mnt |
40 | # Add the next line to your vmware.local to enable private-bin. | 39 | # Add the next line to your vmware.local to enable private-bin. |
41 | #private-bin env,bash,sh,ovftool,vmafossexec,vmaf_*,vmnet-*,vmplayer,vmrest,vmrun,vmss2core,vmstat,vmware,vmware-* | 40 | #private-bin env,bash,sh,ovftool,vmafossexec,vmaf_*,vmnet-*,vmplayer,vmrest,vmrun,vmss2core,vmstat,vmware,vmware-* |
42 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl,vmware,vmware-installer,vmware-vix | 41 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl,vmware,vmware-installer,vmware-vix |
43 | dbus-user none | 42 | dbus-user none |
44 | dbus-system none | 43 | dbus-system none |
diff --git a/etc/profile-m-z/vym.profile b/etc/profile-m-z/vym.profile index 5421c4e4b..6632ccb6b 100644 --- a/etc/profile-m-z/vym.profile +++ b/etc/profile-m-z/vym.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | caps.drop all | 17 | caps.drop all |
diff --git a/etc/profile-m-z/w3m.profile b/etc/profile-m-z/w3m.profile index 69b2c6c59..d2e30e824 100644 --- a/etc/profile-m-z/w3m.profile +++ b/etc/profile-m-z/w3m.profile | |||
@@ -27,7 +27,6 @@ include disable-common.inc | |||
27 | include disable-devel.inc | 27 | include disable-devel.inc |
28 | include disable-exec.inc | 28 | include disable-exec.inc |
29 | include disable-interpreters.inc | 29 | include disable-interpreters.inc |
30 | include disable-passwdmgr.inc | ||
31 | include disable-programs.inc | 30 | include disable-programs.inc |
32 | include disable-shell.inc | 31 | include disable-shell.inc |
33 | include disable-xdg.inc | 32 | include disable-xdg.inc |
@@ -63,7 +62,7 @@ disable-mnt | |||
63 | private-bin perl,sh,w3m | 62 | private-bin perl,sh,w3m |
64 | private-cache | 63 | private-cache |
65 | private-dev | 64 | private-dev |
66 | private-etc alternatives,ca-certificates,crypto-policies,mailcap,nsswitch.conf,pki,resolv.conf,ssl | 65 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,mailcap,nsswitch.conf,pki,resolv.conf,ssl |
67 | private-tmp | 66 | private-tmp |
68 | 67 | ||
69 | dbus-user none | 68 | dbus-user none |
diff --git a/etc/profile-m-z/warmux.profile b/etc/profile-m-z/warmux.profile index 1227a202c..fc59b7239 100644 --- a/etc/profile-m-z/warmux.profile +++ b/etc/profile-m-z/warmux.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ disable-mnt | |||
50 | private-bin warmux | 49 | private-bin warmux |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc ca-certificates,crypto-policies,host.conf,hostname,hosts,machine-id,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | 52 | private-etc ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.preload,machine-id,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
56 | dbus-user none | 55 | dbus-user none |
diff --git a/etc/profile-m-z/warsow.profile b/etc/profile-m-z/warsow.profile index e0cd3daad..5659ec69c 100644 --- a/etc/profile-m-z/warsow.profile +++ b/etc/profile-m-z/warsow.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/warzone2100.profile b/etc/profile-m-z/warzone2100.profile index 420e8927e..46dca0547 100644 --- a/etc/profile-m-z/warzone2100.profile +++ b/etc/profile-m-z/warzone2100.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/webstorm.profile b/etc/profile-m-z/webstorm.profile index 69e96d0cd..4d849c582 100644 --- a/etc/profile-m-z/webstorm.profile +++ b/etc/profile-m-z/webstorm.profile | |||
@@ -24,7 +24,6 @@ noblacklist ${HOME}/.nvm | |||
24 | include disable-common.inc | 24 | include disable-common.inc |
25 | include disable-devel.inc | 25 | include disable-devel.inc |
26 | include disable-interpreters.inc | 26 | include disable-interpreters.inc |
27 | include disable-passwdmgr.inc | ||
28 | include disable-programs.inc | 27 | include disable-programs.inc |
29 | 28 | ||
30 | caps.drop all | 29 | caps.drop all |
diff --git a/etc/profile-m-z/webui-aria2.profile b/etc/profile-m-z/webui-aria2.profile index d5a998f35..2fe727b9c 100644 --- a/etc/profile-m-z/webui-aria2.profile +++ b/etc/profile-m-z/webui-aria2.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/wesnoth.profile b/etc/profile-m-z/wesnoth.profile index 199b3c6f0..345b26a2c 100644 --- a/etc/profile-m-z/wesnoth.profile +++ b/etc/profile-m-z/wesnoth.profile | |||
@@ -13,7 +13,6 @@ noblacklist ${HOME}/.local/share/wesnoth | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.cache/wesnoth | 18 | mkdir ${HOME}/.cache/wesnoth |
diff --git a/etc/profile-m-z/wget.profile b/etc/profile-m-z/wget.profile index 53c4711bd..4c21d6965 100644 --- a/etc/profile-m-z/wget.profile +++ b/etc/profile-m-z/wget.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | # Depending on workflow you can add the next line to your wget.local. | 23 | # Depending on workflow you can add the next line to your wget.local. |
diff --git a/etc/profile-m-z/whalebird.profile b/etc/profile-m-z/whalebird.profile index 22a84274d..ae3944561 100644 --- a/etc/profile-m-z/whalebird.profile +++ b/etc/profile-m-z/whalebird.profile | |||
@@ -20,8 +20,8 @@ whitelist ${HOME}/.config/Whalebird | |||
20 | 20 | ||
21 | no3d | 21 | no3d |
22 | 22 | ||
23 | private-bin whalebird | 23 | private-bin electron,electron[0-9],electron[0-9][0-9],whalebird |
24 | private-etc fonts,machine-id | 24 | private-etc fonts,ld.so.preload,machine-id |
25 | 25 | ||
26 | # Redirect | 26 | # Redirect |
27 | include electron.profile | 27 | include electron.profile |
diff --git a/etc/profile-m-z/whois.profile b/etc/profile-m-z/whois.profile index 93871a5a4..0650e41ad 100644 --- a/etc/profile-m-z/whois.profile +++ b/etc/profile-m-z/whois.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -48,7 +47,7 @@ private | |||
48 | private-bin bash,sh,whois | 47 | private-bin bash,sh,whois |
49 | private-cache | 48 | private-cache |
50 | private-dev | 49 | private-dev |
51 | private-etc alternatives,hosts,jwhois.conf,resolv.conf,services,whois.conf | 50 | private-etc alternatives,hosts,jwhois.conf,ld.so.preload,resolv.conf,services,whois.conf |
52 | private-lib gconv | 51 | private-lib gconv |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
diff --git a/etc/profile-m-z/widelands.profile b/etc/profile-m-z/widelands.profile index 0dc26b11d..6561be784 100644 --- a/etc/profile-m-z/widelands.profile +++ b/etc/profile-m-z/widelands.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/wine.profile b/etc/profile-m-z/wine.profile index 0ea24aafd..1e9b9341b 100644 --- a/etc/profile-m-z/wine.profile +++ b/etc/profile-m-z/wine.profile | |||
@@ -17,7 +17,6 @@ noblacklist /tmp/.wine-* | |||
17 | include disable-common.inc | 17 | include disable-common.inc |
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | 21 | ||
23 | # whitelist /usr/share/wine | 22 | # whitelist /usr/share/wine |
diff --git a/etc/profile-m-z/wire-desktop.profile b/etc/profile-m-z/wire-desktop.profile index 151cd2adb..eebad4a19 100644 --- a/etc/profile-m-z/wire-desktop.profile +++ b/etc/profile-m-z/wire-desktop.profile | |||
@@ -26,7 +26,7 @@ mkdir ${HOME}/.config/Wire | |||
26 | whitelist ${HOME}/.config/Wire | 26 | whitelist ${HOME}/.config/Wire |
27 | 27 | ||
28 | private-bin bash,electron,electron[0-9],electron[0-9][0-9],env,sh,wire-desktop | 28 | private-bin bash,electron,electron[0-9],electron[0-9][0-9],env,sh,wire-desktop |
29 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl | 29 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,machine-id,pki,resolv.conf,ssl |
30 | 30 | ||
31 | # Redirect | 31 | # Redirect |
32 | include electron.profile | 32 | include electron.profile |
diff --git a/etc/profile-m-z/wireshark.profile b/etc/profile-m-z/wireshark.profile index 1824026a8..16875ad9b 100644 --- a/etc/profile-m-z/wireshark.profile +++ b/etc/profile-m-z/wireshark.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-m-z/wordwarvi.profile b/etc/profile-m-z/wordwarvi.profile index 9c724a5d2..374290ed0 100644 --- a/etc/profile-m-z/wordwarvi.profile +++ b/etc/profile-m-z/wordwarvi.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ private | |||
46 | private-bin wordwarvi | 45 | private-bin wordwarvi |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alsa,asound.conf,machine-id,pulse | 48 | private-etc alsa,asound.conf,ld.so.preload,machine-id,pulse |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-m-z/wps.profile b/etc/profile-m-z/wps.profile index a44b6490e..cb0301378 100644 --- a/etc/profile-m-z/wps.profile +++ b/etc/profile-m-z/wps.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | include whitelist-usr-share-common.inc | 19 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-m-z/x2goclient.profile b/etc/profile-m-z/x2goclient.profile index 557f07cd9..3fcac351d 100644 --- a/etc/profile-m-z/x2goclient.profile +++ b/etc/profile-m-z/x2goclient.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | apparmor | 21 | apparmor |
diff --git a/etc/profile-m-z/xbill.profile b/etc/profile-m-z/xbill.profile index 384f76acc..738b5ca13 100644 --- a/etc/profile-m-z/xbill.profile +++ b/etc/profile-m-z/xbill.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -45,7 +44,7 @@ private | |||
45 | private-bin xbill | 44 | private-bin xbill |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc none | 47 | private-etc ld.so.preload,none |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-m-z/xcalc.profile b/etc/profile-m-z/xcalc.profile index 7fb483289..3f8aa2d34 100644 --- a/etc/profile-m-z/xcalc.profile +++ b/etc/profile-m-z/xcalc.profile | |||
@@ -9,7 +9,6 @@ include disable-common.inc | |||
9 | include disable-devel.inc | 9 | include disable-devel.inc |
10 | include disable-exec.inc | 10 | include disable-exec.inc |
11 | include disable-interpreters.inc | 11 | include disable-interpreters.inc |
12 | include disable-passwdmgr.inc | ||
13 | include disable-programs.inc | 12 | include disable-programs.inc |
14 | include disable-shell.inc | 13 | include disable-shell.inc |
15 | include disable-xdg.inc | 14 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/xed.profile b/etc/profile-m-z/xed.profile index 4a3022e83..26383bda3 100644 --- a/etc/profile-m-z/xed.profile +++ b/etc/profile-m-z/xed.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | 23 | ||
diff --git a/etc/profile-m-z/xfburn.profile b/etc/profile-m-z/xfburn.profile index cd9561e74..91e25048d 100644 --- a/etc/profile-m-z/xfburn.profile +++ b/etc/profile-m-z/xfburn.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${HOME}/.config/xfburn | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | caps.drop all | 16 | caps.drop all |
diff --git a/etc/profile-m-z/xfce4-dict.profile b/etc/profile-m-z/xfce4-dict.profile index ecd321c7e..fcfec10d0 100644 --- a/etc/profile-m-z/xfce4-dict.profile +++ b/etc/profile-m-z/xfce4-dict.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | include whitelist-var-common.inc | 17 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/xfce4-mixer.profile b/etc/profile-m-z/xfce4-mixer.profile index bb38dbebd..21857dbe6 100644 --- a/etc/profile-m-z/xfce4-mixer.profile +++ b/etc/profile-m-z/xfce4-mixer.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -47,7 +46,7 @@ disable-mnt | |||
47 | private-bin xfce4-mixer,xfconf-query | 46 | private-bin xfce4-mixer,xfconf-query |
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | private-etc alternatives,asound.conf,fonts,machine-id,pulse | 49 | private-etc alternatives,asound.conf,fonts,ld.so.preload,machine-id,pulse |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
53 | dbus-user filter | 52 | dbus-user filter |
diff --git a/etc/profile-m-z/xfce4-notes.profile b/etc/profile-m-z/xfce4-notes.profile index ebfb4333c..5004b8fb6 100644 --- a/etc/profile-m-z/xfce4-notes.profile +++ b/etc/profile-m-z/xfce4-notes.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/xfce4-screenshooter.profile b/etc/profile-m-z/xfce4-screenshooter.profile index b1e5bafbf..ad3058ce2 100644 --- a/etc/profile-m-z/xfce4-screenshooter.profile +++ b/etc/profile-m-z/xfce4-screenshooter.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -43,7 +42,7 @@ tracelog | |||
43 | disable-mnt | 42 | disable-mnt |
44 | private-bin xfce4-screenshooter,xfconf-query | 43 | private-bin xfce4-screenshooter,xfconf-query |
45 | private-dev | 44 | private-dev |
46 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,pki,resolv.conf,ssl | 45 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,ld.so.preload,pki,resolv.conf,ssl |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-m-z/xiphos.profile b/etc/profile-m-z/xiphos.profile index 81d98db7a..9b7a006d2 100644 --- a/etc/profile-m-z/xiphos.profile +++ b/etc/profile-m-z/xiphos.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | 20 | ||
@@ -48,5 +47,5 @@ disable-mnt | |||
48 | private-bin xiphos | 47 | private-bin xiphos |
49 | private-cache | 48 | private-cache |
50 | private-dev | 49 | private-dev |
51 | private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssli,sword,sword.conf | 50 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.preload,pki,resolv.conf,ssli,sword,sword.conf |
52 | private-tmp | 51 | private-tmp |
diff --git a/etc/profile-m-z/xlinks.profile b/etc/profile-m-z/xlinks.profile index d5e25cfe7..1c9310986 100644 --- a/etc/profile-m-z/xlinks.profile +++ b/etc/profile-m-z/xlinks.profile | |||
@@ -14,7 +14,7 @@ include whitelist-common.inc | |||
14 | # if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' | 14 | # if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' |
15 | # to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line | 15 | # to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line |
16 | private-bin xlinks | 16 | private-bin xlinks |
17 | private-etc fonts | 17 | private-etc fonts,ld.so.preload |
18 | 18 | ||
19 | # Redirect | 19 | # Redirect |
20 | include links.profile | 20 | include links.profile |
diff --git a/etc/profile-m-z/xlinks2 b/etc/profile-m-z/xlinks2 index 1ae6a60ca..bbf660e29 100644 --- a/etc/profile-m-z/xlinks2 +++ b/etc/profile-m-z/xlinks2 | |||
@@ -14,7 +14,7 @@ include whitelist-common.inc | |||
14 | # if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' | 14 | # if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' |
15 | # to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line | 15 | # to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line |
16 | private-bin xlinks2 | 16 | private-bin xlinks2 |
17 | private-etc fonts | 17 | private-etc fonts,ld.so.preload |
18 | 18 | ||
19 | # Redirect | 19 | # Redirect |
20 | include links2.profile | 20 | include links2.profile |
diff --git a/etc/profile-m-z/xmms.profile b/etc/profile-m-z/xmms.profile index 25261d925..4003f69a2 100644 --- a/etc/profile-m-z/xmms.profile +++ b/etc/profile-m-z/xmms.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${MUSIC} | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/xmr-stak.profile b/etc/profile-m-z/xmr-stak.profile index e7020f36b..2a9fbf171 100644 --- a/etc/profile-m-z/xmr-stak.profile +++ b/etc/profile-m-z/xmr-stak.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
@@ -39,7 +38,7 @@ disable-mnt | |||
39 | private ${HOME}/.xmr-stak | 38 | private ${HOME}/.xmr-stak |
40 | private-bin xmr-stak | 39 | private-bin xmr-stak |
41 | private-dev | 40 | private-dev |
42 | private-etc alternatives,ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl | 41 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
43 | #private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend | 42 | #private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend |
44 | private-opt cuda | 43 | private-opt cuda |
45 | private-tmp | 44 | private-tmp |
diff --git a/etc/profile-m-z/xonotic.profile b/etc/profile-m-z/xonotic.profile index 53c9a0a08..6ffe9ece9 100644 --- a/etc/profile-m-z/xonotic.profile +++ b/etc/profile-m-z/xonotic.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/xournal.profile b/etc/profile-m-z/xournal.profile index c4f092d50..fe7395078 100644 --- a/etc/profile-m-z/xournal.profile +++ b/etc/profile-m-z/xournal.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ tracelog | |||
44 | private-bin xournal | 43 | private-bin xournal |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,fonts,group,machine-id,passwd | 46 | private-etc alternatives,fonts,group,ld.so.preload,machine-id,passwd |
48 | # TODO should use private-lib | 47 | # TODO should use private-lib |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
diff --git a/etc/profile-m-z/xournalpp.profile b/etc/profile-m-z/xournalpp.profile index 988b878b9..a23ad68df 100644 --- a/etc/profile-m-z/xournalpp.profile +++ b/etc/profile-m-z/xournalpp.profile | |||
@@ -7,6 +7,8 @@ include xournalpp.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | noblacklist ${HOME}/.cache/xournalpp | ||
11 | noblacklist ${HOME}/.config/xournalpp | ||
10 | noblacklist ${HOME}/.xournalpp | 12 | noblacklist ${HOME}/.xournalpp |
11 | 13 | ||
12 | include allow-lua.inc | 14 | include allow-lua.inc |
@@ -16,14 +18,17 @@ whitelist /usr/share/xournalpp | |||
16 | whitelist /var/lib/texmf | 18 | whitelist /var/lib/texmf |
17 | include whitelist-runuser-common.inc | 19 | include whitelist-runuser-common.inc |
18 | 20 | ||
19 | #mkdir ${HOME}/.xournalpp | 21 | #mkdir ${HOME}/.cache/xournalpp |
22 | #mkdir ${HOME}/.config/xournalpp | ||
23 | #whitelist ${HOME}/.cache/xournalpp | ||
24 | #whitelist ${HOME}/.config/xournalpp | ||
20 | #whitelist ${HOME}/.xournalpp | 25 | #whitelist ${HOME}/.xournalpp |
21 | #whitelist ${HOME}/.texlive20* | 26 | #whitelist ${HOME}/.texlive20* |
22 | #whitelist ${DOCUMENTS} | 27 | #whitelist ${DOCUMENTS} |
23 | #include whitelist-common.inc | 28 | #include whitelist-common.inc |
24 | 29 | ||
25 | private-bin kpsewhich,pdflatex,xournalpp | 30 | private-bin kpsewhich,pdflatex,xournalpp |
26 | private-etc latexmk.conf,texlive | 31 | private-etc alternatives,latexmk.conf,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,texlive |
27 | 32 | ||
28 | # Redirect | 33 | # Redirect |
29 | include xournal.profile | 34 | include xournal.profile |
diff --git a/etc/profile-m-z/xpdf.profile b/etc/profile-m-z/xpdf.profile index 1447ec9a7..0149d36a3 100644 --- a/etc/profile-m-z/xpdf.profile +++ b/etc/profile-m-z/xpdf.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/xplayer.profile b/etc/profile-m-z/xplayer.profile index c3bb3292c..d1ea2c9d5 100644 --- a/etc/profile-m-z/xplayer.profile +++ b/etc/profile-m-z/xplayer.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | read-only ${DESKTOP} | 21 | read-only ${DESKTOP} |
diff --git a/etc/profile-m-z/xpra.profile b/etc/profile-m-z/xpra.profile index 6e409e1aa..aed6c102f 100644 --- a/etc/profile-m-z/xpra.profile +++ b/etc/profile-m-z/xpra.profile | |||
@@ -22,7 +22,6 @@ include allow-python3.inc | |||
22 | include disable-common.inc | 22 | include disable-common.inc |
23 | include disable-devel.inc | 23 | include disable-devel.inc |
24 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
25 | include disable-passwdmgr.inc | ||
26 | include disable-programs.inc | 25 | include disable-programs.inc |
27 | 26 | ||
28 | whitelist /var/lib/xkb | 27 | whitelist /var/lib/xkb |
diff --git a/etc/profile-m-z/xreader.profile b/etc/profile-m-z/xreader.profile index 3ab35edfc..8b880426f 100644 --- a/etc/profile-m-z/xreader.profile +++ b/etc/profile-m-z/xreader.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -40,7 +39,7 @@ tracelog | |||
40 | 39 | ||
41 | private-bin xreader,xreader-previewer,xreader-thumbnailer | 40 | private-bin xreader,xreader-previewer,xreader-thumbnailer |
42 | private-dev | 41 | private-dev |
43 | private-etc alternatives,fonts,ld.so.cache | 42 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
44 | private-tmp | 43 | private-tmp |
45 | 44 | ||
46 | memory-deny-write-execute | 45 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/xviewer.profile b/etc/profile-m-z/xviewer.profile index 4d454f81c..5c8d6a47e 100644 --- a/etc/profile-m-z/xviewer.profile +++ b/etc/profile-m-z/xviewer.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/yelp.profile b/etc/profile-m-z/yelp.profile index dee154409..c5e44c6b4 100644 --- a/etc/profile-m-z/yelp.profile +++ b/etc/profile-m-z/yelp.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -57,7 +56,7 @@ disable-mnt | |||
57 | private-bin groff,man,tbl,troff,yelp | 56 | private-bin groff,man,tbl,troff,yelp |
58 | private-cache | 57 | private-cache |
59 | private-dev | 58 | private-dev |
60 | private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,groff,gtk-3.0,machine-id,man_db.conf,openal,os-release,pulse,sgml,xml | 59 | private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,groff,gtk-3.0,ld.so.preload,machine-id,man_db.conf,openal,os-release,pulse,sgml,xml |
61 | private-tmp | 60 | private-tmp |
62 | 61 | ||
63 | dbus-user filter | 62 | dbus-user filter |
diff --git a/etc/profile-m-z/youtube-dl-gui.profile b/etc/profile-m-z/youtube-dl-gui.profile index b52271a2c..94f37a92b 100644 --- a/etc/profile-m-z/youtube-dl-gui.profile +++ b/etc/profile-m-z/youtube-dl-gui.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ disable-mnt | |||
50 | private-bin atomicparsley,ffmpeg,ffprobe,python*,youtube-dl-gui | 49 | private-bin atomicparsley,ffmpeg,ffprobe,python*,youtube-dl-gui |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,locale,locale.conf,passwd,pki,resolv.conf,ssl | 52 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,locale,locale.conf,passwd,pki,resolv.conf,ssl |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
56 | dbus-user none | 55 | dbus-user none |
diff --git a/etc/profile-m-z/youtube-dl.profile b/etc/profile-m-z/youtube-dl.profile index 24c4d6db3..71e50ab11 100644 --- a/etc/profile-m-z/youtube-dl.profile +++ b/etc/profile-m-z/youtube-dl.profile | |||
@@ -27,7 +27,6 @@ include disable-common.inc | |||
27 | include disable-devel.inc | 27 | include disable-devel.inc |
28 | include disable-exec.inc | 28 | include disable-exec.inc |
29 | include disable-interpreters.inc | 29 | include disable-interpreters.inc |
30 | include disable-passwdmgr.inc | ||
31 | include disable-programs.inc | 30 | include disable-programs.inc |
32 | include disable-shell.inc | 31 | include disable-shell.inc |
33 | include disable-xdg.inc | 32 | include disable-xdg.inc |
@@ -59,7 +58,7 @@ tracelog | |||
59 | private-bin env,ffmpeg,python*,youtube-dl | 58 | private-bin env,ffmpeg,python*,youtube-dl |
60 | private-cache | 59 | private-cache |
61 | private-dev | 60 | private-dev |
62 | private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,ld.so.cache,mime.types,pki,resolv.conf,ssl,youtube-dl.conf | 61 | private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,pki,resolv.conf,ssl,youtube-dl.conf |
63 | private-tmp | 62 | private-tmp |
64 | 63 | ||
65 | dbus-user none | 64 | dbus-user none |
diff --git a/etc/profile-m-z/youtube-viewer.profile b/etc/profile-m-z/youtube-viewer.profile index b54dd37ad..825599fcc 100644 --- a/etc/profile-m-z/youtube-viewer.profile +++ b/etc/profile-m-z/youtube-viewer.profile | |||
@@ -18,4 +18,4 @@ whitelist ${HOME}/.config/youtube-viewer | |||
18 | private-bin gtk-youtube-viewer,gtk2-youtube-viewer,gtk3-youtube-viewer,youtube-viewer | 18 | private-bin gtk-youtube-viewer,gtk2-youtube-viewer,gtk3-youtube-viewer,youtube-viewer |
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
21 | include youtube-viewers-common.profile \ No newline at end of file | 21 | include youtube-viewers-common.profile |
diff --git a/etc/profile-m-z/youtube-viewers-common.profile b/etc/profile-m-z/youtube-viewers-common.profile index 25a073d4a..3224f8fc6 100644 --- a/etc/profile-m-z/youtube-viewers-common.profile +++ b/etc/profile-m-z/youtube-viewers-common.profile | |||
@@ -23,7 +23,6 @@ include disable-common.inc | |||
23 | include disable-devel.inc | 23 | include disable-devel.inc |
24 | include disable-exec.inc | 24 | include disable-exec.inc |
25 | include disable-interpreters.inc | 25 | include disable-interpreters.inc |
26 | include disable-passwdmgr.inc | ||
27 | include disable-programs.inc | 26 | include disable-programs.inc |
28 | include disable-xdg.inc | 27 | include disable-xdg.inc |
29 | 28 | ||
@@ -51,10 +50,10 @@ shell none | |||
51 | tracelog | 50 | tracelog |
52 | 51 | ||
53 | disable-mnt | 52 | disable-mnt |
54 | private-bin bash,ffmpeg,ffprobe,firefox,mpv,perl,python*,sh,smplayer,stty,wget,which,xterm,youtube-dl | 53 | private-bin bash,ffmpeg,ffprobe,firefox,mpv,perl,python*,sh,smplayer,stty,wget,which,xterm,youtube-dl,yt-dlp |
55 | private-cache | 54 | private-cache |
56 | private-dev | 55 | private-dev |
57 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg | 56 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg |
58 | private-tmp | 57 | private-tmp |
59 | 58 | ||
60 | dbus-user none | 59 | dbus-user none |
diff --git a/etc/profile-m-z/youtube.profile b/etc/profile-m-z/youtube.profile index ad7ceaee4..c7dbec968 100644 --- a/etc/profile-m-z/youtube.profile +++ b/etc/profile-m-z/youtube.profile | |||
@@ -16,8 +16,8 @@ include disable-shell.inc | |||
16 | mkdir ${HOME}/.config/Youtube | 16 | mkdir ${HOME}/.config/Youtube |
17 | whitelist ${HOME}/.config/Youtube | 17 | whitelist ${HOME}/.config/Youtube |
18 | 18 | ||
19 | private-bin youtube | 19 | private-bin electron,electron[0-9],electron[0-9][0-9],youtube |
20 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 20 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
21 | private-opt Youtube | 21 | private-opt Youtube |
22 | 22 | ||
23 | # Redirect | 23 | # Redirect |
diff --git a/etc/profile-m-z/youtubemusic-nativefier.profile b/etc/profile-m-z/youtubemusic-nativefier.profile index 74b0e38b9..35ecf059d 100644 --- a/etc/profile-m-z/youtubemusic-nativefier.profile +++ b/etc/profile-m-z/youtubemusic-nativefier.profile | |||
@@ -13,8 +13,8 @@ include disable-shell.inc | |||
13 | mkdir ${HOME}/.config/youtubemusic-nativefier-040164 | 13 | mkdir ${HOME}/.config/youtubemusic-nativefier-040164 |
14 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 | 14 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 |
15 | 15 | ||
16 | private-bin youtubemusic-nativefier | 16 | private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier |
17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
18 | private-opt youtubemusic-nativefier | 18 | private-opt youtubemusic-nativefier |
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
diff --git a/etc/profile-m-z/yt-dlp.profile b/etc/profile-m-z/yt-dlp.profile new file mode 100644 index 000000000..bfb24b488 --- /dev/null +++ b/etc/profile-m-z/yt-dlp.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for yt-dlp | ||
2 | # Description: Downloader of videos of various sites | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include yt-dlp.local | ||
7 | # Persistent global definitions | ||
8 | # added by included profile | ||
9 | #include globals.local | ||
10 | |||
11 | noblacklist ${HOME}/.cache/yt-dlp | ||
12 | noblacklist ${HOME}/.config/yt-dlp | ||
13 | noblacklist ${HOME}/yt-dlp.conf | ||
14 | |||
15 | private-bin yt-dlp | ||
16 | private-etc ld.so.preload,yt-dlp.conf | ||
17 | |||
18 | # Redirect | ||
19 | include youtube-dl.profile | ||
diff --git a/etc/profile-m-z/ytmdesktop.profile b/etc/profile-m-z/ytmdesktop.profile index ab46fccc2..84f2f3cb2 100644 --- a/etc/profile-m-z/ytmdesktop.profile +++ b/etc/profile-m-z/ytmdesktop.profile | |||
@@ -14,7 +14,7 @@ mkdir ${HOME}/.config/youtube-music-desktop-app | |||
14 | whitelist ${HOME}/.config/youtube-music-desktop-app | 14 | whitelist ${HOME}/.config/youtube-music-desktop-app |
15 | 15 | ||
16 | # private-bin env,ytmdesktop | 16 | # private-bin env,ytmdesktop |
17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
18 | # private-opt | 18 | # private-opt |
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
diff --git a/etc/profile-m-z/zaproxy.profile b/etc/profile-m-z/zaproxy.profile index 5a168feb6..1f11f133f 100644 --- a/etc/profile-m-z/zaproxy.profile +++ b/etc/profile-m-z/zaproxy.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | mkdir ${HOME}/.java | 20 | mkdir ${HOME}/.java |
diff --git a/etc/profile-m-z/zart.profile b/etc/profile-m-z/zart.profile index 10f83aa30..f534aee8f 100644 --- a/etc/profile-m-z/zart.profile +++ b/etc/profile-m-z/zart.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/zathura.profile b/etc/profile-m-z/zathura.profile index d0e68c980..68c9b0a93 100644 --- a/etc/profile-m-z/zathura.profile +++ b/etc/profile-m-z/zathura.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-write-mnt.inc | 19 | include disable-write-mnt.inc |
diff --git a/etc/profile-m-z/zeal.profile b/etc/profile-m-z/zeal.profile index 2c6f6910f..c148e717b 100644 --- a/etc/profile-m-z/zeal.profile +++ b/etc/profile-m-z/zeal.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/zim.profile b/etc/profile-m-z/zim.profile new file mode 100644 index 000000000..fa67b76c7 --- /dev/null +++ b/etc/profile-m-z/zim.profile | |||
@@ -0,0 +1,71 @@ | |||
1 | # Firejail profile for Zim | ||
2 | # Description: Desktop wiki & notekeeper | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include zim.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/zim | ||
10 | noblacklist ${HOME}/.config/zim | ||
11 | |||
12 | # Allow python (blacklisted by disable-interpreters.inc) | ||
13 | include allow-python2.inc | ||
14 | include allow-python3.inc | ||
15 | |||
16 | blacklist /usr/libexec | ||
17 | |||
18 | include disable-common.inc | ||
19 | include disable-devel.inc | ||
20 | include disable-exec.inc | ||
21 | include disable-interpreters.inc | ||
22 | include disable-programs.inc | ||
23 | include disable-shell.inc | ||
24 | |||
25 | mkdir ${HOME}/.cache/zim | ||
26 | mkdir ${HOME}/.config/zim | ||
27 | mkdir ${HOME}/Notebooks | ||
28 | whitelist ${HOME}/.cache/zim | ||
29 | whitelist ${HOME}/.config/zim | ||
30 | whitelist ${HOME}/Notebooks | ||
31 | whitelist ${DESKTOP} | ||
32 | whitelist ${DOCUMENTS} | ||
33 | whitelist ${DOWNLOADS} | ||
34 | whitelist ${MUSIC} | ||
35 | whitelist ${PICTURES} | ||
36 | whitelist ${VIDEOS} | ||
37 | whitelist /usr/share/zim | ||
38 | include whitelist-common.inc | ||
39 | include whitelist-runuser-common.inc | ||
40 | include whitelist-usr-share-common.inc | ||
41 | include whitelist-var-common.inc | ||
42 | |||
43 | apparmor | ||
44 | caps.drop all | ||
45 | machine-id | ||
46 | net none | ||
47 | no3d | ||
48 | nodvd | ||
49 | nogroups | ||
50 | noinput | ||
51 | nonewprivs | ||
52 | noroot | ||
53 | nosound | ||
54 | notv | ||
55 | nou2f | ||
56 | novideo | ||
57 | protocol unix | ||
58 | seccomp | ||
59 | seccomp.block-secondary | ||
60 | shell none | ||
61 | tracelog | ||
62 | |||
63 | disable-mnt | ||
64 | private-bin python*,zim | ||
65 | private-cache | ||
66 | private-dev | ||
67 | private-etc alternatives,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11 | ||
68 | private-tmp | ||
69 | |||
70 | dbus-user none | ||
71 | dbus-system none | ||
diff --git a/etc/profile-m-z/zulip.profile b/etc/profile-m-z/zulip.profile index 093da5212..c1c94d74f 100644 --- a/etc/profile-m-z/zulip.profile +++ b/etc/profile-m-z/zulip.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -45,5 +44,5 @@ disable-mnt | |||
45 | private-bin locale,zulip | 44 | private-bin locale,zulip |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc asound.conf,fonts,machine-id | 47 | private-etc asound.conf,fonts,ld.so.preload,machine-id |
49 | private-tmp | 48 | private-tmp |
diff --git a/etc/templates/profile.template b/etc/templates/profile.template index 18e4e8bce..7628313e0 100644 --- a/etc/templates/profile.template +++ b/etc/templates/profile.template | |||
@@ -102,8 +102,6 @@ include globals.local | |||
102 | #include allow-ssh.inc | 102 | #include allow-ssh.inc |
103 | 103 | ||
104 | ##blacklist PATH | 104 | ##blacklist PATH |
105 | # Disable X11 (CLI only), see also 'x11 none' below | ||
106 | #blacklist /tmp/.X11-unix | ||
107 | # Disable Wayland | 105 | # Disable Wayland |
108 | #blacklist ${RUNUSER}/wayland-* | 106 | #blacklist ${RUNUSER}/wayland-* |
109 | # Disable RUNUSER (cli only; supersedes Disable Wayland) | 107 | # Disable RUNUSER (cli only; supersedes Disable Wayland) |
@@ -118,10 +116,10 @@ include globals.local | |||
118 | #include disable-devel.inc | 116 | #include disable-devel.inc |
119 | #include disable-exec.inc | 117 | #include disable-exec.inc |
120 | #include disable-interpreters.inc | 118 | #include disable-interpreters.inc |
121 | #include disable-passwdmgr.inc | ||
122 | #include disable-programs.inc | 119 | #include disable-programs.inc |
123 | #include disable-shell.inc | 120 | #include disable-shell.inc |
124 | #include disable-write-mnt.inc | 121 | #include disable-write-mnt.inc |
122 | #include disable-X11.inc | ||
125 | #include disable-xdg.inc | 123 | #include disable-xdg.inc |
126 | 124 | ||
127 | # This section often mirrors noblacklist section above. The idea is | 125 | # This section often mirrors noblacklist section above. The idea is |
@@ -133,6 +131,7 @@ include globals.local | |||
133 | ##mkfile PATH | 131 | ##mkfile PATH |
134 | #whitelist PATH | 132 | #whitelist PATH |
135 | #include whitelist-common.inc | 133 | #include whitelist-common.inc |
134 | #include whitelist-run-common.inc | ||
136 | #include whitelist-runuser-common.inc | 135 | #include whitelist-runuser-common.inc |
137 | #include whitelist-usr-share-common.inc | 136 | #include whitelist-usr-share-common.inc |
138 | #include whitelist-var-common.inc | 137 | #include whitelist-var-common.inc |
@@ -173,7 +172,7 @@ include globals.local | |||
173 | ##seccomp-error-action log (only for debugging seccomp issues) | 172 | ##seccomp-error-action log (only for debugging seccomp issues) |
174 | #shell none | 173 | #shell none |
175 | #tracelog | 174 | #tracelog |
176 | # Prefer 'x11 none' instead of 'blacklist /tmp/.X11-unix' if 'net none' is set | 175 | # Prefer 'x11 none' instead of 'disable-X11.inc' if 'net none' is set |
177 | ##x11 none | 176 | ##x11 none |
178 | 177 | ||
179 | #disable-mnt | 178 | #disable-mnt |
@@ -205,7 +204,7 @@ include globals.local | |||
205 | 204 | ||
206 | # Since 0.9.63 also a more granular control of dbus is supported. | 205 | # Since 0.9.63 also a more granular control of dbus is supported. |
207 | # To get the dbus-addresses an application needs access to you can | 206 | # To get the dbus-addresses an application needs access to you can |
208 | # check with flatpak (when the application is distriputed that way): | 207 | # check with flatpak (when the application is distributed that way): |
209 | # flatpak remote-info --show-metadata flathub <APP-ID> | 208 | # flatpak remote-info --show-metadata flathub <APP-ID> |
210 | # Notes: | 209 | # Notes: |
211 | # - flatpak implicitly allows an app to own <APP-ID> on the session bus | 210 | # - flatpak implicitly allows an app to own <APP-ID> on the session bus |
diff --git a/etc/templates/syscalls.txt b/etc/templates/syscalls.txt index 0775f60ff..827b075e5 100644 --- a/etc/templates/syscalls.txt +++ b/etc/templates/syscalls.txt | |||
@@ -33,7 +33,7 @@ Definition of groups | |||
33 | @clock=adjtimex,clock_adjtime,clock_settime,settimeofday,stime | 33 | @clock=adjtimex,clock_adjtime,clock_settime,settimeofday,stime |
34 | @cpu-emulation=modify_ldt,subpage_prot,switch_endian,vm86,vm86old | 34 | @cpu-emulation=modify_ldt,subpage_prot,switch_endian,vm86,vm86old |
35 | @debug=lookup_dcookie,perf_event_open,process_vm_writev,rtas,s390_runtime_instr,sys_debug_setcontext | 35 | @debug=lookup_dcookie,perf_event_open,process_vm_writev,rtas,s390_runtime_instr,sys_debug_setcontext |
36 | @default=@clock,@cpu-emulation,@debug,@module,@mount,@obsolete,@raw-io,@reboot,@swap,open_by_handle_at,name_to_handle_at,ioprio_set,ni_syscall,syslog,fanotify_init,kcmp,add_key,request_key,mbind,migrate_pages,move_pages,keyctl,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,set_mempolicyvmsplice,userfaultfd,acct,bpf,nfsservctl,setdomainname,sethostname,vhangup | 36 | @default=@clock,@cpu-emulation,@debug,@module,@mount,@obsolete,@raw-io,@reboot,@swap,open_by_handle_at,name_to_handle_at,ioprio_set,ni_syscall,syslog,fanotify_init,add_key,request_key,mbind,migrate_pages,move_pages,keyctl,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,set_mempolicyvmsplice,userfaultfd,acct,bpf,nfsservctl,setdomainname,sethostname,vhangup |
37 | @default-nodebuggers=@default,ptrace,personality,process_vm_readv | 37 | @default-nodebuggers=@default,ptrace,personality,process_vm_readv |
38 | @default-keep=execveat,execve,prctl | 38 | @default-keep=execveat,execve,prctl |
39 | @file-system=access,chdir,chmod,close,creat,faccessat,faccessat2,fallocate,fchdir,fchmod,fchmodat,fcntl,fcntl64,fgetxattr,flistxattr,fremovexattr,fsetxattr,fstat,fstat64,fstatat64,fstatfs,fstatfs64,ftruncate,ftruncate64,futimesat,getcwd,getdents,getdents64,getxattr,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,lgetxattr,link,linkat,listxattr,llistxattr,lremovexattr,lsetxattr,lstat,lstat64,mkdir,mkdirat,mknod,mknodat,mmap,mmap2,munmap,newfstatat,oldfstat,oldlstat,oldstat,open,openat,readlink,readlinkat,removexattr,rename,renameat,renameat2,rmdir,setxattr,stat,stat64,statfs,statfs64,statx,symlink,symlinkat,truncate,truncate64,unlink,unlinkat,utime,utimensat,utimes | 39 | @file-system=access,chdir,chmod,close,creat,faccessat,faccessat2,fallocate,fchdir,fchmod,fchmodat,fcntl,fcntl64,fgetxattr,flistxattr,fremovexattr,fsetxattr,fstat,fstat64,fstatat64,fstatfs,fstatfs64,ftruncate,ftruncate64,futimesat,getcwd,getdents,getdents64,getxattr,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,lgetxattr,link,linkat,listxattr,llistxattr,lremovexattr,lsetxattr,lstat,lstat64,mkdir,mkdirat,mknod,mknodat,mmap,mmap2,munmap,newfstatat,oldfstat,oldlstat,oldstat,open,openat,readlink,readlinkat,removexattr,rename,renameat,renameat2,rmdir,setxattr,stat,stat64,statfs,statfs64,statx,symlink,symlinkat,truncate,truncate64,unlink,unlinkat,utime,utimensat,utimes |
@@ -89,18 +89,24 @@ Inheritance of groups | |||
89 | What to do if seccomp breaks a program | 89 | What to do if seccomp breaks a program |
90 | -------------------------------------- | 90 | -------------------------------------- |
91 | 91 | ||
92 | Start `journalctl --grep=SECCOMP --follow` in a terminal and run | ||
93 | `firejail --seccomp-error-action=log /path/to/program` in a second terminal. | ||
94 | Now switch back to the first terminal (where `journalctl` is running) and look | ||
95 | for the numbers of the blocked syscall(s) (`syscall=<NUMBER>`). As soon as you | ||
96 | have found them, you can stop `journalctl` (^C) and execute | ||
97 | `firejail --debug-syscalls | grep NUMBER` to get the name of the syscall. | ||
98 | In the particular case that it is a 32bit syscall on a 64bit system, use `firejail --debug-syscalls32 | grep NUMBER`. | ||
99 | Now you can add a seccomp exception using `seccomp !NAME`. | ||
100 | |||
101 | If the blocked syscall is ptrace, consider to add allow-debuggers to the profile. | ||
102 | |||
92 | ``` | 103 | ``` |
93 | $ journalctl --grep=syscall --follow | 104 | term1$ journalctl --grep=SECCOMP --follow |
94 | <...> audit[…]: SECCOMP <...> syscall=161 <...> | 105 | term2$ firejail --seccomp-error-action=log /usr/bin/signal-desktop |
95 | $ firejail --debug-syscalls | grep 161 | 106 | term1$ (journalctl --grep=SECCOMP --follow) |
96 | 161 - chroot | 107 | audit[1234]: SECCOMP ... comm="signal-desktop" exe="/usr/bin/signal-desktop" sig=31 arch=c000003e syscall=161 ... |
108 | ^C | ||
109 | term1$ firejail --debug-syscalls | grep "^161[[:space:]]" | ||
110 | 161 - chroot | ||
97 | ``` | 111 | ``` |
98 | Profile: `seccomp -> seccomp !chroot` | 112 | Profile: `seccomp -> seccomp !chroot` |
99 | |||
100 | Start `journalctl --grep=syscall --follow` in a terminal, then start the broken | ||
101 | program. Now you see one or more long lines containing `syscall=NUMBER` somewhere. | ||
102 | Stop journalctl (^C) and execute `firejail --debug-syscalls | grep NUMBER`. You | ||
103 | will see something like `NUMBER - NAME`, because you now know the name of the | ||
104 | syscall, you can add an exception to seccomp by putting `!NAME` to seccomp. | ||
105 | |||
106 | If the blocked syscall is ptrace, consider to add allow-debuggers to the profile. | ||
@@ -24,8 +24,8 @@ gcov_init() { | |||
24 | } | 24 | } |
25 | 25 | ||
26 | generate() { | 26 | generate() { |
27 | lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder -d src/fcopy -d src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file-new | 27 | lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder -d src/fcopy -d src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file-new |
28 | lcov --add-tracefile gcov-file-old --add-tracefile gcov-file-new --output-file gcov-file | 28 | lcov --add-tracefile gcov-file-old --add-tracefile gcov-file-new --output-file gcov-file |
29 | rm -fr gcov-dir | 29 | rm -fr gcov-dir |
30 | genhtml -q gcov-file --output-directory gcov-dir | 30 | genhtml -q gcov-file --output-directory gcov-dir |
31 | sudo rm `find . -name *.gcda` | 31 | sudo rm `find . -name *.gcda` |
@@ -35,7 +35,7 @@ generate() { | |||
35 | 35 | ||
36 | 36 | ||
37 | gcov_init | 37 | gcov_init |
38 | lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder -d src/fcopy -d src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file-old | 38 | lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder -d src/fcopy -d src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file-old |
39 | 39 | ||
40 | #make test-utils | 40 | #make test-utils |
41 | #generate | 41 | #generate |
diff --git a/linecnt.sh b/linecnt.sh index ccce2da82..86bccbc07 100755 --- a/linecnt.sh +++ b/linecnt.sh | |||
@@ -26,6 +26,6 @@ gcov_init() { | |||
26 | rm -fr gcov-dir | 26 | rm -fr gcov-dir |
27 | gcov_init | 27 | gcov_init |
28 | lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder \ | 28 | lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder \ |
29 | -d src/fcopy -d src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp \ | 29 | -d src/fcopy -d src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp \ |
30 | -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file | 30 | -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file |
31 | genhtml -q gcov-file --output-directory gcov-dir | 31 | genhtml -q gcov-file --output-directory gcov-dir |
diff --git a/src/bash_completion/firejail.bash_completion.in b/src/bash_completion/firejail.bash_completion.in index f68edf380..ff411c807 100644 --- a/src/bash_completion/firejail.bash_completion.in +++ b/src/bash_completion/firejail.bash_completion.in | |||
@@ -5,7 +5,7 @@ | |||
5 | # http://bash-completion.alioth.debian.org | 5 | # http://bash-completion.alioth.debian.org |
6 | #******************************************************************* | 6 | #******************************************************************* |
7 | 7 | ||
8 | __interfaces(){ | 8 | __interfaces() { |
9 | cut -f 1 -d ':' /proc/net/dev | tail -n +3 | grep -v lo | xargs | 9 | cut -f 1 -d ':' /proc/net/dev | tail -n +3 | grep -v lo | xargs |
10 | } | 10 | } |
11 | 11 | ||
@@ -90,11 +90,11 @@ _firejail() | |||
90 | _filedir | 90 | _filedir |
91 | return 0 | 91 | return 0 |
92 | ;; | 92 | ;; |
93 | --net) | 93 | --net) |
94 | comps=$(__interfaces) | 94 | comps=$(__interfaces) |
95 | COMPREPLY=( $(compgen -W '$comps' -- "$cur") ) | 95 | COMPREPLY=( $(compgen -W '$comps' -- "$cur") ) |
96 | return 0 | 96 | return 0 |
97 | ;; | 97 | ;; |
98 | esac | 98 | esac |
99 | 99 | ||
100 | $split && return 0 | 100 | $split && return 0 |
diff --git a/src/common.mk.in b/src/common.mk.in index f88da55ac..d117433dc 100644 --- a/src/common.mk.in +++ b/src/common.mk.in | |||
@@ -15,7 +15,6 @@ HAVE_NETWORK=@HAVE_NETWORK@ | |||
15 | HAVE_USERNS=@HAVE_USERNS@ | 15 | HAVE_USERNS=@HAVE_USERNS@ |
16 | HAVE_X11=@HAVE_X11@ | 16 | HAVE_X11=@HAVE_X11@ |
17 | HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@ | 17 | HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@ |
18 | HAVE_WHITELIST=@HAVE_WHITELIST@ | ||
19 | HAVE_GLOBALCFG=@HAVE_GLOBALCFG@ | 18 | HAVE_GLOBALCFG=@HAVE_GLOBALCFG@ |
20 | HAVE_APPARMOR=@HAVE_APPARMOR@ | 19 | HAVE_APPARMOR=@HAVE_APPARMOR@ |
21 | HAVE_OVERLAYFS=@HAVE_OVERLAYFS@ | 20 | HAVE_OVERLAYFS=@HAVE_OVERLAYFS@ |
@@ -41,8 +40,8 @@ BINOBJS = $(foreach file, $(OBJS), $file) | |||
41 | 40 | ||
42 | CFLAGS = @CFLAGS@ | 41 | CFLAGS = @CFLAGS@ |
43 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) | 42 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) |
44 | CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"' | 43 | CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"' -DVARDIR='"/var/lib/firejail"' |
45 | MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_FORCE_NONEWPRIVS) | 44 | MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_FORCE_NONEWPRIVS) |
46 | CFLAGS += $(MANFLAGS) | 45 | CFLAGS += $(MANFLAGS) |
47 | CFLAGS += -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -Wformat -Wformat-security | 46 | CFLAGS += -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -Wformat -Wformat-security |
48 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now -lpthread | 47 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now -lpthread |
diff --git a/src/fbuilder/build_fs.c b/src/fbuilder/build_fs.c index 8700e0ba1..019c3ac5a 100644 --- a/src/fbuilder/build_fs.c +++ b/src/fbuilder/build_fs.c | |||
@@ -182,12 +182,12 @@ static void var_callback(char *ptr) { | |||
182 | void build_var(const char *fname, FILE *fp) { | 182 | void build_var(const char *fname, FILE *fp) { |
183 | assert(fname); | 183 | assert(fname); |
184 | 184 | ||
185 | var_skip = filedb_load_whitelist(var_skip, "whitelist-var-common.inc", "whitelist /var/"); | 185 | var_skip = filedb_load_whitelist(var_skip, "whitelist-var-common.inc", "allow /var/"); |
186 | process_files(fname, "/var", var_callback); | 186 | process_files(fname, "/var", var_callback); |
187 | 187 | ||
188 | // always whitelist /var | 188 | // always whitelist /var |
189 | if (var_out) | 189 | if (var_out) |
190 | filedb_print(var_out, "whitelist /var/", fp); | 190 | filedb_print(var_out, "allow /var/", fp); |
191 | fprintf(fp, "include whitelist-var-common.inc\n"); | 191 | fprintf(fp, "include whitelist-var-common.inc\n"); |
192 | } | 192 | } |
193 | 193 | ||
@@ -222,12 +222,12 @@ static void share_callback(char *ptr) { | |||
222 | void build_share(const char *fname, FILE *fp) { | 222 | void build_share(const char *fname, FILE *fp) { |
223 | assert(fname); | 223 | assert(fname); |
224 | 224 | ||
225 | share_skip = filedb_load_whitelist(share_skip, "whitelist-usr-share-common.inc", "whitelist /usr/share/"); | 225 | share_skip = filedb_load_whitelist(share_skip, "whitelist-usr-share-common.inc", "allow /usr/share/"); |
226 | process_files(fname, "/usr/share", share_callback); | 226 | process_files(fname, "/usr/share", share_callback); |
227 | 227 | ||
228 | // always whitelist /usr/share | 228 | // always whitelist /usr/share |
229 | if (share_out) | 229 | if (share_out) |
230 | filedb_print(share_out, "whitelist /usr/share/", fp); | 230 | filedb_print(share_out, "allow /usr/share/", fp); |
231 | fprintf(fp, "include whitelist-usr-share-common.inc\n"); | 231 | fprintf(fp, "include whitelist-usr-share-common.inc\n"); |
232 | } | 232 | } |
233 | 233 | ||
diff --git a/src/fbuilder/build_home.c b/src/fbuilder/build_home.c index b3ec6cffd..c85474779 100644 --- a/src/fbuilder/build_home.c +++ b/src/fbuilder/build_home.c | |||
@@ -68,6 +68,8 @@ void process_home(const char *fname, char *home, int home_len) { | |||
68 | ptr += 7; | 68 | ptr += 7; |
69 | else if (strncmp(ptr, "open /home", 10) == 0) | 69 | else if (strncmp(ptr, "open /home", 10) == 0) |
70 | ptr += 5; | 70 | ptr += 5; |
71 | else if (strncmp(ptr, "opendir /home", 13) == 0) | ||
72 | ptr += 8; | ||
71 | else | 73 | else |
72 | continue; | 74 | continue; |
73 | 75 | ||
@@ -138,7 +140,7 @@ void build_home(const char *fname, FILE *fp) { | |||
138 | assert(fname); | 140 | assert(fname); |
139 | 141 | ||
140 | // load whitelist common | 142 | // load whitelist common |
141 | db_skip = filedb_load_whitelist(db_skip, "whitelist-common.inc", "whitelist ${HOME}/"); | 143 | db_skip = filedb_load_whitelist(db_skip, "whitelist-common.inc", "allow ${HOME}/"); |
142 | 144 | ||
143 | // find user home directory | 145 | // find user home directory |
144 | struct passwd *pw = getpwuid(getuid()); | 146 | struct passwd *pw = getpwuid(getuid()); |
@@ -166,7 +168,7 @@ void build_home(const char *fname, FILE *fp) { | |||
166 | 168 | ||
167 | // print the out list if any | 169 | // print the out list if any |
168 | if (db_out) { | 170 | if (db_out) { |
169 | filedb_print(db_out, "whitelist ${HOME}/", fp); | 171 | filedb_print(db_out, "allow ${HOME}/", fp); |
170 | fprintf(fp, "include whitelist-common.inc\n"); | 172 | fprintf(fp, "include whitelist-common.inc\n"); |
171 | } | 173 | } |
172 | else | 174 | else |
diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c index 5df19f511..0b9a99739 100644 --- a/src/fbuilder/build_profile.c +++ b/src/fbuilder/build_profile.c | |||
@@ -32,53 +32,25 @@ void build_profile(int argc, char **argv, int index, FILE *fp) { | |||
32 | } | 32 | } |
33 | 33 | ||
34 | char trace_output[] = "/tmp/firejail-trace.XXXXXX"; | 34 | char trace_output[] = "/tmp/firejail-trace.XXXXXX"; |
35 | char strace_output[] = "/tmp/firejail-strace.XXXXXX"; | ||
36 | |||
37 | int tfile = mkstemp(trace_output); | 35 | int tfile = mkstemp(trace_output); |
38 | int stfile = mkstemp(strace_output); | 36 | if(tfile == -1) |
39 | if(tfile == -1 || stfile == -1) | ||
40 | errExit("mkstemp"); | 37 | errExit("mkstemp"); |
41 | |||
42 | // close the files, firejail/strace will overwrite them! | ||
43 | close(tfile); | 38 | close(tfile); |
44 | close(stfile); | ||
45 | |||
46 | 39 | ||
47 | char *output; | 40 | char *output; |
48 | char *stroutput; | ||
49 | if(asprintf(&output,"--trace=%s",trace_output) == -1) | 41 | if(asprintf(&output,"--trace=%s",trace_output) == -1) |
50 | errExit("asprintf"); | 42 | errExit("asprintf"); |
51 | if(asprintf(&stroutput,"-o%s",strace_output) == -1) | ||
52 | errExit("asprintf"); | ||
53 | 43 | ||
54 | char *cmdlist[] = { | 44 | char *cmdlist[] = { |
55 | BINDIR "/firejail", | 45 | BINDIR "/firejail", |
56 | "--quiet", | 46 | "--quiet", |
57 | "--noprofile", | 47 | "--noprofile", |
58 | "--caps.drop=all", | 48 | "--caps.drop=all", |
59 | "--nonewprivs", | 49 | "--seccomp", |
60 | output, | 50 | output, |
61 | "--shell=none", | 51 | "--shell=none", |
62 | "/usr/bin/strace", // also used as a marker in build_profile() | ||
63 | "-c", | ||
64 | "-f", | ||
65 | stroutput, | ||
66 | }; | 52 | }; |
67 | 53 | ||
68 | // detect strace and check if Yama LSM allows us to use it | ||
69 | int have_strace = 0; | ||
70 | int have_yama_permission = 1; | ||
71 | if (access("/usr/bin/strace", X_OK) == 0) { | ||
72 | have_strace = 1; | ||
73 | FILE *ps = fopen("/proc/sys/kernel/yama/ptrace_scope", "r"); | ||
74 | if (ps) { | ||
75 | unsigned val; | ||
76 | if (fscanf(ps, "%u", &val) == 1) | ||
77 | have_yama_permission = (val < 2); | ||
78 | fclose(ps); | ||
79 | } | ||
80 | } | ||
81 | |||
82 | // calculate command length | 54 | // calculate command length |
83 | unsigned len = (int) sizeof(cmdlist) / sizeof(char*) + argc - index + 1; | 55 | unsigned len = (int) sizeof(cmdlist) / sizeof(char*) + argc - index + 1; |
84 | if (arg_debug) | 56 | if (arg_debug) |
@@ -87,14 +59,9 @@ void build_profile(int argc, char **argv, int index, FILE *fp) { | |||
87 | cmd[0] = cmdlist[0]; // explicit assignment to clean scan-build error | 59 | cmd[0] = cmdlist[0]; // explicit assignment to clean scan-build error |
88 | 60 | ||
89 | // build command | 61 | // build command |
90 | // skip strace if not installed, or no permission to use it | ||
91 | int skip_strace = !(have_strace && have_yama_permission); | ||
92 | unsigned i = 0; | 62 | unsigned i = 0; |
93 | for (i = 0; i < (int) sizeof(cmdlist) / sizeof(char*); i++) { | 63 | for (i = 0; i < (int) sizeof(cmdlist) / sizeof(char*); i++) |
94 | if (skip_strace && strcmp(cmdlist[i], "/usr/bin/strace") == 0) | ||
95 | break; | ||
96 | cmd[i] = cmdlist[i]; | 64 | cmd[i] = cmdlist[i]; |
97 | } | ||
98 | 65 | ||
99 | int i2 = index; | 66 | int i2 = index; |
100 | for (; i < (len - 1); i++, i2++) | 67 | for (; i < (len - 1); i++, i2++) |
@@ -147,7 +114,6 @@ void build_profile(int argc, char **argv, int index, FILE *fp) { | |||
147 | fprintf(fp, "#include disable-devel.inc\t# development tools such as gcc and gdb\n"); | 114 | fprintf(fp, "#include disable-devel.inc\t# development tools such as gcc and gdb\n"); |
148 | fprintf(fp, "#include disable-exec.inc\t# non-executable directories such as /var, /tmp, and /home\n"); | 115 | fprintf(fp, "#include disable-exec.inc\t# non-executable directories such as /var, /tmp, and /home\n"); |
149 | fprintf(fp, "#include disable-interpreters.inc\t# perl, python, lua etc.\n"); | 116 | fprintf(fp, "#include disable-interpreters.inc\t# perl, python, lua etc.\n"); |
150 | fprintf(fp, "include disable-passwdmgr.inc\t# password managers\n"); | ||
151 | fprintf(fp, "include disable-programs.inc\t# user configuration for programs such as firefox, vlc etc.\n"); | 117 | fprintf(fp, "include disable-programs.inc\t# user configuration for programs such as firefox, vlc etc.\n"); |
152 | fprintf(fp, "#include disable-shell.inc\t# sh, bash, zsh etc.\n"); | 118 | fprintf(fp, "#include disable-shell.inc\t# sh, bash, zsh etc.\n"); |
153 | fprintf(fp, "#include disable-xdg.inc\t# standard user directories: Documents, Pictures, Videos, Music\n"); | 119 | fprintf(fp, "#include disable-xdg.inc\t# standard user directories: Documents, Pictures, Videos, Music\n"); |
@@ -180,14 +146,6 @@ void build_profile(int argc, char **argv, int index, FILE *fp) { | |||
180 | fprintf(fp, "#novideo\t# disable video capture devices\n"); | 146 | fprintf(fp, "#novideo\t# disable video capture devices\n"); |
181 | build_protocol(trace_output, fp); | 147 | build_protocol(trace_output, fp); |
182 | fprintf(fp, "seccomp\n"); | 148 | fprintf(fp, "seccomp\n"); |
183 | if (!have_strace) { | ||
184 | fprintf(fp, "### If you install strace on your system, Firejail will also create a\n"); | ||
185 | fprintf(fp, "### whitelisted seccomp filter.\n"); | ||
186 | } | ||
187 | else if (!have_yama_permission) | ||
188 | fprintf(fp, "### Yama security module prevents creation of a whitelisted seccomp filter\n"); | ||
189 | else | ||
190 | build_seccomp(strace_output, fp); | ||
191 | fprintf(fp, "shell none\n"); | 149 | fprintf(fp, "shell none\n"); |
192 | fprintf(fp, "tracelog\n"); | 150 | fprintf(fp, "tracelog\n"); |
193 | fprintf(fp, "\n"); | 151 | fprintf(fp, "\n"); |
@@ -206,10 +164,8 @@ void build_profile(int argc, char **argv, int index, FILE *fp) { | |||
206 | fprintf(fp, "\n"); | 164 | fprintf(fp, "\n"); |
207 | fprintf(fp, "#memory-deny-write-execute\n"); | 165 | fprintf(fp, "#memory-deny-write-execute\n"); |
208 | 166 | ||
209 | if (!arg_debug) { | 167 | if (!arg_debug) |
210 | unlink(trace_output); | 168 | unlink(trace_output); |
211 | unlink(strace_output); | ||
212 | } | ||
213 | } | 169 | } |
214 | else { | 170 | else { |
215 | fprintf(stderr, "Error: cannot run the sandbox\n"); | 171 | fprintf(stderr, "Error: cannot run the sandbox\n"); |
diff --git a/src/fbuilder/build_seccomp.c b/src/fbuilder/build_seccomp.c index b3187227e..daf8d63ac 100644 --- a/src/fbuilder/build_seccomp.c +++ b/src/fbuilder/build_seccomp.c | |||
@@ -20,6 +20,7 @@ | |||
20 | 20 | ||
21 | #include "fbuilder.h" | 21 | #include "fbuilder.h" |
22 | 22 | ||
23 | #if 0 | ||
23 | void build_seccomp(const char *fname, FILE *fp) { | 24 | void build_seccomp(const char *fname, FILE *fp) { |
24 | assert(fname); | 25 | assert(fname); |
25 | assert(fp); | 26 | assert(fp); |
@@ -78,6 +79,7 @@ void build_seccomp(const char *fname, FILE *fp) { | |||
78 | 79 | ||
79 | fclose(fp2); | 80 | fclose(fp2); |
80 | } | 81 | } |
82 | #endif | ||
81 | 83 | ||
82 | //*************************************** | 84 | //*************************************** |
83 | // protocol | 85 | // protocol |
diff --git a/src/fcopy/main.c b/src/fcopy/main.c index 31810de9a..f279af89f 100644 --- a/src/fcopy/main.c +++ b/src/fcopy/main.c | |||
@@ -88,7 +88,8 @@ static void selinux_relabel_path(const char *path, const char *inside_path) { | |||
88 | if (arg_debug) | 88 | if (arg_debug) |
89 | printf("Relabeling %s as %s (%s)\n", path, inside_path, fcon); | 89 | printf("Relabeling %s as %s (%s)\n", path, inside_path, fcon); |
90 | 90 | ||
91 | setfilecon_raw(procfs_path, fcon); | 91 | if (setfilecon_raw(procfs_path, fcon) != 0 && arg_debug) |
92 | printf("Cannot relabel %s: %s\n", path, strerror(errno)); | ||
92 | } | 93 | } |
93 | freecon(fcon); | 94 | freecon(fcon); |
94 | close: | 95 | close: |
diff --git a/src/fids/Makefile.in b/src/fids/Makefile.in new file mode 100644 index 000000000..5530bcee2 --- /dev/null +++ b/src/fids/Makefile.in | |||
@@ -0,0 +1,18 @@ | |||
1 | .PHONY: all | ||
2 | all: fids | ||
3 | |||
4 | include ../common.mk | ||
5 | |||
6 | %.o : %.c $(H_FILE_LIST) ../include/common.h | ||
7 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
8 | |||
9 | #fseccomp: $(OBJS) ../lib/common.o ../lib/errno.o ../lib/syscall.o | ||
10 | fids: $(OBJS) | ||
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | ||
12 | |||
13 | .PHONY: clean | ||
14 | clean:; rm -fr *.o fids *.gcov *.gcda *.gcno *.plist | ||
15 | |||
16 | .PHONY: distclean | ||
17 | distclean: clean | ||
18 | rm -fr Makefile | ||
diff --git a/src/fids/blake2b.c b/src/fids/blake2b.c new file mode 100644 index 000000000..f2aa5ae66 --- /dev/null +++ b/src/fids/blake2b.c | |||
@@ -0,0 +1,176 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014-2021 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | |||
21 | /* A simple unkeyed BLAKE2b Implementation based on the official reference | ||
22 | * from https://github.com/BLAKE2/BLAKE2. | ||
23 | * | ||
24 | * The original code was released under CC0 1.0 Universal license (Creative Commons), | ||
25 | * a public domain license. | ||
26 | */ | ||
27 | |||
28 | #include "fids.h" | ||
29 | |||
30 | // little-endian vs big-endian is irrelevant since the checksum is calculated and checked on the same computer. | ||
31 | static inline uint64_t load64( const void *src ) { | ||
32 | uint64_t w; | ||
33 | memcpy( &w, src, sizeof( w ) ); | ||
34 | return w; | ||
35 | } | ||
36 | |||
37 | // mixing function | ||
38 | #define ROTR64(x, y) (((x) >> (y)) ^ ((x) << (64 - (y)))) | ||
39 | #define G(a, b, c, d, x, y) { \ | ||
40 | v[a] = v[a] + v[b] + x; \ | ||
41 | v[d] = ROTR64(v[d] ^ v[a], 32); \ | ||
42 | v[c] = v[c] + v[d]; \ | ||
43 | v[b] = ROTR64(v[b] ^ v[c], 24); \ | ||
44 | v[a] = v[a] + v[b] + y; \ | ||
45 | v[d] = ROTR64(v[d] ^ v[a], 16); \ | ||
46 | v[c] = v[c] + v[d]; \ | ||
47 | v[b] = ROTR64(v[b] ^ v[c], 63); } | ||
48 | |||
49 | // init vector | ||
50 | static const uint64_t iv[8] = { | ||
51 | 0x6A09E667F3BCC908, 0xBB67AE8584CAA73B, | ||
52 | 0x3C6EF372FE94F82B, 0xA54FF53A5F1D36F1, | ||
53 | 0x510E527FADE682D1, 0x9B05688C2B3E6C1F, | ||
54 | 0x1F83D9ABFB41BD6B, 0x5BE0CD19137E2179 | ||
55 | }; | ||
56 | |||
57 | |||
58 | const uint8_t sigma[12][16] = { | ||
59 | { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }, | ||
60 | { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }, | ||
61 | { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 }, | ||
62 | { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 }, | ||
63 | { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 }, | ||
64 | { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 }, | ||
65 | { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 }, | ||
66 | { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 }, | ||
67 | { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 }, | ||
68 | { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 }, | ||
69 | { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }, | ||
70 | { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } | ||
71 | }; | ||
72 | |||
73 | // blake2b context | ||
74 | typedef struct { | ||
75 | uint8_t b[128]; // input buffer | ||
76 | uint64_t h[8]; // chained state | ||
77 | uint64_t t[2]; // total number of bytes | ||
78 | size_t c; // pointer for b[] | ||
79 | size_t outlen; // digest size | ||
80 | } CTX; | ||
81 | |||
82 | // compress function | ||
83 | static void compress(CTX *ctx, int last) { | ||
84 | uint64_t m[16]; | ||
85 | uint64_t v[16]; | ||
86 | size_t i; | ||
87 | |||
88 | for (i = 0; i < 16; i++) | ||
89 | m[i] = load64(&ctx->b[8 * i]); | ||
90 | |||
91 | for (i = 0; i < 8; i++) { | ||
92 | v[i] = ctx->h[i]; | ||
93 | v[i + 8] = iv[i]; | ||
94 | } | ||
95 | |||
96 | v[12] ^= ctx->t[0]; | ||
97 | v[13] ^= ctx->t[1]; | ||
98 | if (last) | ||
99 | v[14] = ~v[14]; | ||
100 | |||
101 | for (i = 0; i < 12; i++) { | ||
102 | G( 0, 4, 8, 12, m[sigma[i][ 0]], m[sigma[i][ 1]]); | ||
103 | G( 1, 5, 9, 13, m[sigma[i][ 2]], m[sigma[i][ 3]]); | ||
104 | G( 2, 6, 10, 14, m[sigma[i][ 4]], m[sigma[i][ 5]]); | ||
105 | G( 3, 7, 11, 15, m[sigma[i][ 6]], m[sigma[i][ 7]]); | ||
106 | G( 0, 5, 10, 15, m[sigma[i][ 8]], m[sigma[i][ 9]]); | ||
107 | G( 1, 6, 11, 12, m[sigma[i][10]], m[sigma[i][11]]); | ||
108 | G( 2, 7, 8, 13, m[sigma[i][12]], m[sigma[i][13]]); | ||
109 | G( 3, 4, 9, 14, m[sigma[i][14]], m[sigma[i][15]]); | ||
110 | } | ||
111 | |||
112 | for( i = 0; i < 8; ++i ) | ||
113 | ctx->h[i] ^= v[i] ^ v[i + 8]; | ||
114 | } | ||
115 | |||
116 | static int init(CTX *ctx, size_t outlen) { // (keylen=0: no key) | ||
117 | size_t i; | ||
118 | |||
119 | if (outlen == 0 || outlen > 64) | ||
120 | return -1; | ||
121 | |||
122 | for (i = 0; i < 8; i++) | ||
123 | ctx->h[i] = iv[i]; | ||
124 | ctx->h[0] ^= 0x01010000 ^ outlen; | ||
125 | |||
126 | ctx->t[0] = 0; | ||
127 | ctx->t[1] = 0; | ||
128 | ctx->c = 0; | ||
129 | ctx->outlen = outlen; | ||
130 | |||
131 | return 0; | ||
132 | } | ||
133 | |||
134 | static void update(CTX *ctx, const void *in, size_t inlen) { | ||
135 | size_t i; | ||
136 | |||
137 | for (i = 0; i < inlen; i++) { | ||
138 | if (ctx->c == 128) { | ||
139 | ctx->t[0] += ctx->c; | ||
140 | if (ctx->t[0] < ctx->c) | ||
141 | ctx->t[1]++; | ||
142 | compress(ctx, 0); | ||
143 | ctx->c = 0; | ||
144 | } | ||
145 | ctx->b[ctx->c++] = ((const uint8_t *) in)[i]; | ||
146 | } | ||
147 | } | ||
148 | |||
149 | static void final(CTX *ctx, void *out) { | ||
150 | size_t i; | ||
151 | |||
152 | ctx->t[0] += ctx->c; | ||
153 | if (ctx->t[0] < ctx->c) | ||
154 | ctx->t[1]++; | ||
155 | |||
156 | while (ctx->c < 128) | ||
157 | ctx->b[ctx->c++] = 0; | ||
158 | compress(ctx, 1); | ||
159 | |||
160 | for (i = 0; i < ctx->outlen; i++) { | ||
161 | ((uint8_t *) out)[i] = | ||
162 | (ctx->h[i >> 3] >> (8 * (i & 7))) & 0xFF; | ||
163 | } | ||
164 | } | ||
165 | |||
166 | // public function | ||
167 | int blake2b(void *out, size_t outlen, const void *in, size_t inlen) { | ||
168 | CTX ctx; | ||
169 | |||
170 | if (init(&ctx, outlen)) | ||
171 | return -1; | ||
172 | update(&ctx, in, inlen); | ||
173 | final(&ctx, out); | ||
174 | |||
175 | return 0; | ||
176 | } | ||
diff --git a/src/fids/config b/src/fids/config new file mode 100644 index 000000000..c18c97260 --- /dev/null +++ b/src/fids/config | |||
@@ -0,0 +1,16 @@ | |||
1 | /bin | ||
2 | /sbin | ||
3 | /usr/bin | ||
4 | /usr/sbin | ||
5 | /usr/games | ||
6 | /opt | ||
7 | /usr/share/ca-certificates | ||
8 | |||
9 | |||
10 | /home/netblue/.bashrc | ||
11 | /home/netblue/.config/firejail | ||
12 | /home/netblue/.config/autostart | ||
13 | /home/netblue/Desktop/*.desktop | ||
14 | /home/netblue/.ssh | ||
15 | /home/netblue/.gnupg | ||
16 | |||
diff --git a/src/fids/db.c b/src/fids/db.c new file mode 100644 index 000000000..35caf7eeb --- /dev/null +++ b/src/fids/db.c | |||
@@ -0,0 +1,158 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014-2021 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #include"fids.h" | ||
21 | |||
22 | typedef struct db_t { | ||
23 | struct db_t *next; | ||
24 | char *fname; | ||
25 | char *checksum; | ||
26 | char *mode; | ||
27 | int checked; | ||
28 | } DB; | ||
29 | |||
30 | #define MAXBUF 4096 | ||
31 | static DB *database[HASH_MAX] = {NULL}; | ||
32 | |||
33 | // djb2 hash function by Dan Bernstein | ||
34 | static unsigned hash(const char *str) { | ||
35 | unsigned long hash = 5381; | ||
36 | int c; | ||
37 | |||
38 | while ((c = *str++) != '\0') | ||
39 | hash = ((hash << 5) + hash) + c; /* hash * 33 + c */ | ||
40 | |||
41 | return hash & (HASH_MAX - 1); | ||
42 | } | ||
43 | |||
44 | #if 0 | ||
45 | // for testing the hash table | ||
46 | static void db_print(void) { | ||
47 | int i; | ||
48 | for (i = 0; i < HASH_MAX; i++) { | ||
49 | int cnt = 0; | ||
50 | DB *ptr = database[i]; | ||
51 | while (ptr) { | ||
52 | cnt++; | ||
53 | ptr = ptr->next; | ||
54 | } | ||
55 | printf("%d ", cnt); | ||
56 | fflush(0); | ||
57 | } | ||
58 | printf("\n"); | ||
59 | } | ||
60 | #endif | ||
61 | |||
62 | static void db_add(const char *fname, const char *checksum, const char *mode) { | ||
63 | DB *ptr = malloc(sizeof(DB)); | ||
64 | if (!ptr) | ||
65 | errExit("malloc"); | ||
66 | ptr->fname = strdup(fname); | ||
67 | ptr->checksum = strdup(checksum); | ||
68 | ptr->mode = strdup(mode); | ||
69 | ptr->checked = 0; | ||
70 | if (!ptr->fname || !ptr->checksum || !ptr->mode) | ||
71 | errExit("strdup"); | ||
72 | |||
73 | unsigned h = hash(fname); | ||
74 | ptr->next = database[h]; | ||
75 | database[h] = ptr; | ||
76 | } | ||
77 | |||
78 | void db_check(const char *fname, const char *checksum, const char *mode) { | ||
79 | assert(fname); | ||
80 | assert(checksum); | ||
81 | assert(mode); | ||
82 | |||
83 | unsigned h =hash(fname); | ||
84 | DB *ptr = database[h]; | ||
85 | while (ptr) { | ||
86 | if (strcmp(fname, ptr->fname) == 0) { | ||
87 | ptr->checked = 1; | ||
88 | break; | ||
89 | } | ||
90 | ptr = ptr->next; | ||
91 | } | ||
92 | |||
93 | if (ptr ) { | ||
94 | if (strcmp(checksum, ptr->checksum)) { | ||
95 | f_modified++; | ||
96 | fprintf(stderr, "\nWarning: modified %s\n", fname); | ||
97 | } | ||
98 | if (strcmp(mode, ptr->mode)) { | ||
99 | f_permissions++; | ||
100 | fprintf(stderr, "\nWarning: permissions %s: old %s, new %s\n", | ||
101 | fname, ptr->mode, mode); | ||
102 | } | ||
103 | } | ||
104 | else { | ||
105 | f_new++; | ||
106 | fprintf(stderr, "\nWarning: new file %s\n", fname); | ||
107 | } | ||
108 | } | ||
109 | |||
110 | void db_missing(void) { | ||
111 | int i; | ||
112 | for (i = 0; i < HASH_MAX; i++) { | ||
113 | DB *ptr = database[i]; | ||
114 | while (ptr) { | ||
115 | if (!ptr->checked) { | ||
116 | f_removed++; | ||
117 | fprintf(stderr, "Warning: removed %s\n", ptr->fname); | ||
118 | } | ||
119 | ptr = ptr->next; | ||
120 | } | ||
121 | } | ||
122 | } | ||
123 | |||
124 | // return 0 if ok, 1 if error | ||
125 | int db_init(void) { | ||
126 | char buf[MAXBUF]; | ||
127 | while(fgets(buf, MAXBUF, stdin)) { | ||
128 | // split - tab separated | ||
129 | |||
130 | char *mode = buf; | ||
131 | char *ptr = strchr(buf, '\t'); | ||
132 | if (!ptr) | ||
133 | goto errexit; | ||
134 | *ptr = '\0'; | ||
135 | |||
136 | char *checksum = ptr + 1; | ||
137 | ptr = strchr(checksum, '\t'); | ||
138 | if (!ptr) | ||
139 | goto errexit; | ||
140 | *ptr = '\0'; | ||
141 | |||
142 | char *fname = ptr + 1; | ||
143 | ptr = strchr(fname, '\n'); | ||
144 | if (!ptr) | ||
145 | goto errexit; | ||
146 | *ptr = '\0'; | ||
147 | |||
148 | db_add(fname, checksum, mode); | ||
149 | } | ||
150 | // db_print(); | ||
151 | |||
152 | return 0; | ||
153 | |||
154 | errexit: | ||
155 | fprintf(stderr, "Error fids: database corrupted\n"); | ||
156 | exit(1); | ||
157 | } | ||
158 | |||
diff --git a/src/fids/db_exclude.c b/src/fids/db_exclude.c new file mode 100644 index 000000000..994e6f9df --- /dev/null +++ b/src/fids/db_exclude.c | |||
@@ -0,0 +1,56 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014-2021 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #include"fids.h" | ||
21 | |||
22 | typedef struct db_exclude_t { | ||
23 | struct db_exclude_t *next; | ||
24 | char *fname; | ||
25 | int len; | ||
26 | } DB_EXCLUDE; | ||
27 | static DB_EXCLUDE *database = NULL; | ||
28 | |||
29 | void db_exclude_add(const char *fname) { | ||
30 | assert(fname); | ||
31 | |||
32 | DB_EXCLUDE *ptr = malloc(sizeof(DB_EXCLUDE)); | ||
33 | if (!ptr) | ||
34 | errExit("malloc"); | ||
35 | |||
36 | ptr->fname = strdup(fname); | ||
37 | if (!ptr->fname) | ||
38 | errExit("strdup"); | ||
39 | ptr->len = strlen(fname); | ||
40 | ptr->next = database; | ||
41 | database = ptr; | ||
42 | } | ||
43 | |||
44 | int db_exclude_check(const char *fname) { | ||
45 | assert(fname); | ||
46 | |||
47 | DB_EXCLUDE *ptr = database; | ||
48 | while (ptr != NULL) { | ||
49 | if (strncmp(fname, ptr->fname, ptr->len) == 0) | ||
50 | return 1; | ||
51 | ptr = ptr->next; | ||
52 | } | ||
53 | |||
54 | return 0; | ||
55 | } | ||
56 | |||
diff --git a/src/fids/fids.h b/src/fids/fids.h new file mode 100644 index 000000000..eaf2bbd29 --- /dev/null +++ b/src/fids/fids.h | |||
@@ -0,0 +1,51 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014-2021 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #ifndef FIDS_H | ||
21 | #define FIDS_H | ||
22 | |||
23 | #include "../include/common.h" | ||
24 | |||
25 | // main.c | ||
26 | #define MAX_DIR_LEVEL 20 // max directory tree depth | ||
27 | #define MAX_INCLUDE_LEVEL 10 // max include level for config files | ||
28 | extern int f_scanned; | ||
29 | extern int f_modified; | ||
30 | extern int f_new; | ||
31 | extern int f_removed; | ||
32 | extern int f_permissions; | ||
33 | |||
34 | // db.c | ||
35 | #define HASH_MAX 2048 // power of 2 | ||
36 | int db_init(void); | ||
37 | void db_check(const char *fname, const char *checksum, const char *mode); | ||
38 | void db_missing(void); | ||
39 | |||
40 | // db_exclude.c | ||
41 | void db_exclude_add(const char *fname); | ||
42 | int db_exclude_check(const char *fname); | ||
43 | |||
44 | |||
45 | // blake2b.c | ||
46 | //#define KEY_SIZE 128 // key size in bytes | ||
47 | #define KEY_SIZE 256 | ||
48 | //#define KEY_SIZE 512 | ||
49 | int blake2b(void *out, size_t outlen, const void *in, size_t inlen); | ||
50 | |||
51 | #endif | ||
diff --git a/src/fids/main.c b/src/fids/main.c new file mode 100644 index 000000000..c899b55e1 --- /dev/null +++ b/src/fids/main.c | |||
@@ -0,0 +1,371 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014-2021 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #include "fids.h" | ||
21 | #include <sys/types.h> | ||
22 | #include <sys/stat.h> | ||
23 | #include <unistd.h> | ||
24 | #include <fcntl.h> | ||
25 | #include <sys/mman.h> | ||
26 | #include <dirent.h> | ||
27 | #include <glob.h> | ||
28 | |||
29 | #define MAXBUF 4096 | ||
30 | |||
31 | static int dir_level = 1; | ||
32 | static int include_level = 0; | ||
33 | int arg_init = 0; | ||
34 | int arg_check = 0; | ||
35 | char *arg_homedir = NULL; | ||
36 | char *arg_dbfile = NULL; | ||
37 | |||
38 | int f_scanned = 0; | ||
39 | int f_modified = 0; | ||
40 | int f_new = 0; | ||
41 | int f_removed = 0; | ||
42 | int f_permissions = 0; | ||
43 | |||
44 | |||
45 | |||
46 | static inline int is_dir(const char *fname) { | ||
47 | assert(fname); | ||
48 | |||
49 | struct stat s; | ||
50 | if (stat(fname, &s) == 0) { | ||
51 | if (S_ISDIR(s.st_mode)) | ||
52 | return 1; | ||
53 | } | ||
54 | return 0; | ||
55 | } | ||
56 | |||
57 | static inline int is_link(const char *fname) { | ||
58 | assert(fname); | ||
59 | |||
60 | char c; | ||
61 | ssize_t rv = readlink(fname, &c, 1); | ||
62 | return (rv != -1); | ||
63 | } | ||
64 | |||
65 | // mode is an array of 10 chars or more | ||
66 | static inline void file_mode(const char *fname, char *mode) { | ||
67 | assert(fname); | ||
68 | assert(mode); | ||
69 | |||
70 | struct stat s; | ||
71 | if (stat(fname, &s)) { | ||
72 | *mode = '\0'; | ||
73 | return; | ||
74 | } | ||
75 | |||
76 | sprintf(mode, (s.st_mode & S_IRUSR) ? "r" : "-"); | ||
77 | sprintf(mode + 1, (s.st_mode & S_IWUSR) ? "w" : "-"); | ||
78 | sprintf(mode + 2, (s.st_mode & S_IXUSR) ? "x" : "-"); | ||
79 | sprintf(mode + 3, (s.st_mode & S_IRGRP) ? "r" : "-"); | ||
80 | sprintf(mode + 4, (s.st_mode & S_IWGRP) ? "w" : "-"); | ||
81 | sprintf(mode + 5, (s.st_mode & S_IXGRP) ? "x" : "-"); | ||
82 | sprintf(mode + 6, (s.st_mode & S_IROTH) ? "r" : "-"); | ||
83 | sprintf(mode + 7, (s.st_mode & S_IWOTH) ? "w" : "-"); | ||
84 | sprintf(mode + 8, (s.st_mode & S_IXOTH) ? "x" : "-"); | ||
85 | } | ||
86 | |||
87 | |||
88 | static void file_checksum(const char *fname) { | ||
89 | assert(fname); | ||
90 | |||
91 | int fd = open(fname, O_RDONLY); | ||
92 | if (fd == -1) | ||
93 | return; | ||
94 | |||
95 | off_t size = lseek(fd, 0, SEEK_END); | ||
96 | if (size < 0) { | ||
97 | close(fd); | ||
98 | return; | ||
99 | } | ||
100 | |||
101 | char *content = "empty"; | ||
102 | int mmapped = 0; | ||
103 | if (size == 0) { | ||
104 | // empty files don't mmap - use "empty" string as the file content | ||
105 | size = 6; // strlen("empty") + 1 | ||
106 | } | ||
107 | else { | ||
108 | content = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0); | ||
109 | close(fd); | ||
110 | mmapped = 1; | ||
111 | } | ||
112 | |||
113 | unsigned char checksum[KEY_SIZE / 8]; | ||
114 | blake2b(checksum, sizeof(checksum), content, size); | ||
115 | if (mmapped) | ||
116 | munmap(content, size); | ||
117 | |||
118 | // calculate blake2 checksum | ||
119 | char str_checksum[(KEY_SIZE / 8) * 2 + 1]; | ||
120 | int long unsigned i; | ||
121 | char *ptr = str_checksum; | ||
122 | for (i = 0; i < sizeof(checksum); i++, ptr += 2) | ||
123 | sprintf(ptr, "%02x", (unsigned char ) checksum[i]); | ||
124 | |||
125 | // build permissions string | ||
126 | char mode[10]; | ||
127 | file_mode(fname, mode); | ||
128 | |||
129 | if (arg_init) | ||
130 | printf("%s\t%s\t%s\n", mode, str_checksum, fname); | ||
131 | else if (arg_check) | ||
132 | db_check(fname, str_checksum, mode); | ||
133 | else | ||
134 | assert(0); | ||
135 | |||
136 | f_scanned++; | ||
137 | if (f_scanned % 500 == 0) | ||
138 | fprintf(stderr, "%d ", f_scanned); | ||
139 | fflush(0); | ||
140 | } | ||
141 | |||
142 | void list_directory(const char *fname) { | ||
143 | assert(fname); | ||
144 | if (dir_level > MAX_DIR_LEVEL) { | ||
145 | fprintf(stderr, "Warning fids: maximum depth level exceeded for %s\n", fname); | ||
146 | return; | ||
147 | } | ||
148 | |||
149 | if (db_exclude_check(fname)) | ||
150 | return; | ||
151 | |||
152 | if (is_link(fname)) | ||
153 | return; | ||
154 | |||
155 | if (!is_dir(fname)) { | ||
156 | file_checksum(fname); | ||
157 | return; | ||
158 | } | ||
159 | |||
160 | DIR *dir; | ||
161 | struct dirent *entry; | ||
162 | |||
163 | if (!(dir = opendir(fname))) | ||
164 | return; | ||
165 | |||
166 | dir_level++; | ||
167 | while ((entry = readdir(dir)) != NULL) { | ||
168 | if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) | ||
169 | continue; | ||
170 | char *path; | ||
171 | if (asprintf(&path, "%s/%s", fname, entry->d_name) == -1) | ||
172 | errExit("asprintf"); | ||
173 | list_directory(path); | ||
174 | free(path); | ||
175 | } | ||
176 | closedir(dir); | ||
177 | dir_level--; | ||
178 | } | ||
179 | |||
180 | void globbing(const char *fname) { | ||
181 | assert(fname); | ||
182 | |||
183 | // filter top directory | ||
184 | if (strcmp(fname, "/") == 0) | ||
185 | return; | ||
186 | |||
187 | glob_t globbuf; | ||
188 | int globerr = glob(fname, GLOB_NOCHECK | GLOB_NOSORT | GLOB_PERIOD, NULL, &globbuf); | ||
189 | if (globerr) { | ||
190 | fprintf(stderr, "Error fids: failed to glob pattern %s\n", fname); | ||
191 | exit(1); | ||
192 | } | ||
193 | |||
194 | long unsigned i; | ||
195 | for (i = 0; i < globbuf.gl_pathc; i++) { | ||
196 | char *path = globbuf.gl_pathv[i]; | ||
197 | assert(path); | ||
198 | |||
199 | list_directory(path); | ||
200 | } | ||
201 | |||
202 | globfree(&globbuf); | ||
203 | } | ||
204 | |||
205 | static void process_config(const char *fname) { | ||
206 | assert(fname); | ||
207 | |||
208 | if (++include_level >= MAX_INCLUDE_LEVEL) { | ||
209 | fprintf(stderr, "Error ids: maximum include level for config files exceeded\n"); | ||
210 | exit(1); | ||
211 | } | ||
212 | |||
213 | // make sure the file is owned by root | ||
214 | struct stat s; | ||
215 | if (stat(fname, &s)) { | ||
216 | if (include_level == 1) { | ||
217 | fprintf(stderr, "Error ids: config file not found\n"); | ||
218 | exit(1); | ||
219 | } | ||
220 | return; | ||
221 | } | ||
222 | if (s.st_uid || s.st_gid) { | ||
223 | fprintf(stderr, "Error ids: config file not owned by root\n"); | ||
224 | exit(1); | ||
225 | } | ||
226 | |||
227 | fprintf(stderr, "Loading %s config file\n", fname); | ||
228 | FILE *fp = fopen(fname, "r"); | ||
229 | if (!fp) { | ||
230 | fprintf(stderr, "Error fids: cannot open config file %s\n", fname); | ||
231 | exit(1); | ||
232 | } | ||
233 | |||
234 | char buf[MAXBUF]; | ||
235 | int line = 0; | ||
236 | while (fgets(buf, MAXBUF, fp)) { | ||
237 | line++; | ||
238 | |||
239 | // trim \n | ||
240 | char *ptr = strchr(buf, '\n'); | ||
241 | if (ptr) | ||
242 | *ptr = '\0'; | ||
243 | |||
244 | // comments | ||
245 | ptr = strchr(buf, '#'); | ||
246 | if (ptr) | ||
247 | *ptr = '\0'; | ||
248 | |||
249 | // empty space | ||
250 | ptr = buf; | ||
251 | while (*ptr == ' ' || *ptr == '\t') | ||
252 | ptr++; | ||
253 | char *start = ptr; | ||
254 | |||
255 | // empty line | ||
256 | if (*start == '\0') | ||
257 | continue; | ||
258 | |||
259 | // trailing spaces | ||
260 | ptr = start + strlen(start); | ||
261 | ptr--; | ||
262 | while (*ptr == ' ' || *ptr == '\t') | ||
263 | *ptr-- = '\0'; | ||
264 | |||
265 | // replace ${HOME} | ||
266 | if (strncmp(start, "include", 7) == 0) { | ||
267 | ptr = start + 7; | ||
268 | if ((*ptr != ' ' && *ptr != '\t') || *ptr == '\0') { | ||
269 | fprintf(stderr, "Error fids: invalid line %d in %s\n", line, fname); | ||
270 | exit(1); | ||
271 | } | ||
272 | while (*ptr == ' ' || *ptr == '\t') | ||
273 | ptr++; | ||
274 | |||
275 | if (*ptr == '/') | ||
276 | process_config(ptr); | ||
277 | else { | ||
278 | // assume the file is in /etc/firejail | ||
279 | char *tmp; | ||
280 | if (asprintf(&tmp, "/etc/firejail/%s", ptr) == -1) | ||
281 | errExit("asprintf"); | ||
282 | process_config(tmp); | ||
283 | free(tmp); | ||
284 | } | ||
285 | } | ||
286 | else if (*start == '!') { | ||
287 | // exclude file or dir | ||
288 | start++; | ||
289 | if (strncmp(start, "${HOME}", 7)) | ||
290 | db_exclude_add(start); | ||
291 | else { | ||
292 | char *fname; | ||
293 | if (asprintf(&fname, "%s%s", arg_homedir, start + 7) == -1) | ||
294 | errExit("asprintf"); | ||
295 | db_exclude_add(fname); | ||
296 | free(fname); | ||
297 | } | ||
298 | } | ||
299 | else if (strncmp(start, "${HOME}", 7)) | ||
300 | globbing(start); | ||
301 | else { | ||
302 | char *fname; | ||
303 | if (asprintf(&fname, "%s%s", arg_homedir, start + 7) == -1) | ||
304 | errExit("asprintf"); | ||
305 | globbing(fname); | ||
306 | free(fname); | ||
307 | } | ||
308 | } | ||
309 | |||
310 | fclose(fp); | ||
311 | include_level--; | ||
312 | } | ||
313 | |||
314 | |||
315 | |||
316 | void usage(void) { | ||
317 | printf("Usage: fids [--help|-h|-?] --init|--check homedir\n"); | ||
318 | } | ||
319 | |||
320 | int main(int argc, char **argv) { | ||
321 | int i; | ||
322 | for (i = 1; i < argc; i++) { | ||
323 | if (strcmp(argv[i], "-h") == 0 || | ||
324 | strcmp(argv[i], "-?") == 0 || | ||
325 | strcmp(argv[i], "--help") == 0) { | ||
326 | usage(); | ||
327 | return 0; | ||
328 | } | ||
329 | else if (strcmp(argv[i], "--init") == 0) | ||
330 | arg_init = 1; | ||
331 | else if (strcmp(argv[i], "--check") == 0) | ||
332 | arg_check = 1; | ||
333 | else if (strncmp(argv[i], "--", 2) == 0) { | ||
334 | fprintf(stderr, "Error fids: invalid argument %s\n", argv[i]); | ||
335 | exit(1); | ||
336 | } | ||
337 | } | ||
338 | |||
339 | if (argc != 3) { | ||
340 | fprintf(stderr, "Error fids: invalid number of arguments\n"); | ||
341 | exit(1); | ||
342 | } | ||
343 | arg_homedir = argv[2]; | ||
344 | |||
345 | int op = arg_check + arg_init; | ||
346 | if (op == 0 || op == 2) { | ||
347 | fprintf(stderr, "Error fids: use either --init or --check\n"); | ||
348 | exit(1); | ||
349 | } | ||
350 | |||
351 | if (arg_init) { | ||
352 | process_config(SYSCONFDIR"/ids.config"); | ||
353 | fprintf(stderr, "\n%d files scanned\n", f_scanned); | ||
354 | fprintf(stderr, "IDS database initialized\n"); | ||
355 | } | ||
356 | else if (arg_check) { | ||
357 | if (db_init()) { | ||
358 | fprintf(stderr, "Error: IDS database not initialized, please run \"firejail --ids-init\"\n"); | ||
359 | exit(1); | ||
360 | } | ||
361 | |||
362 | process_config(SYSCONFDIR"/ids.config"); | ||
363 | fprintf(stderr, "\n%d files scanned: modified %d, permissions %d, new %d, removed %d\n", | ||
364 | f_scanned, f_modified, f_permissions, f_new, f_removed); | ||
365 | db_missing(); | ||
366 | } | ||
367 | else | ||
368 | assert(0); | ||
369 | |||
370 | return 0; | ||
371 | } | ||
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index e58fe39ec..a544e25f2 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -45,8 +45,8 @@ amule | |||
45 | amuled | 45 | amuled |
46 | android-studio | 46 | android-studio |
47 | anydesk | 47 | anydesk |
48 | apostrophe | ||
49 | apktool | 48 | apktool |
49 | apostrophe | ||
50 | # ar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 50 | # ar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
51 | arch-audit | 51 | arch-audit |
52 | archaudit-report | 52 | archaudit-report |
@@ -94,6 +94,7 @@ bleachbit | |||
94 | blender | 94 | blender |
95 | blender-2.8 | 95 | blender-2.8 |
96 | bless | 96 | bless |
97 | blobby | ||
97 | blobwars | 98 | blobwars |
98 | bluefish | 99 | bluefish |
99 | bnox | 100 | bnox |
@@ -142,8 +143,9 @@ claws-mail | |||
142 | clawsker | 143 | clawsker |
143 | clementine | 144 | clementine |
144 | clion | 145 | clion |
145 | clipit | 146 | clion-eap |
146 | clipgrab | 147 | clipgrab |
148 | clipit | ||
147 | cliqz | 149 | cliqz |
148 | clocks | 150 | clocks |
149 | cmus | 151 | cmus |
@@ -167,6 +169,7 @@ crow | |||
167 | cryptocat | 169 | cryptocat |
168 | cvlc | 170 | cvlc |
169 | cyberfox | 171 | cyberfox |
172 | d-feet | ||
170 | darktable | 173 | darktable |
171 | dconf-editor | 174 | dconf-editor |
172 | ddgr | 175 | ddgr |
@@ -197,13 +200,12 @@ dragon | |||
197 | drawio | 200 | drawio |
198 | drill | 201 | drill |
199 | dropbox | 202 | dropbox |
200 | d-feet | ||
201 | easystroke | 203 | easystroke |
202 | ebook-viewer | ||
203 | ebook-convert | 204 | ebook-convert |
204 | ebook-edit | 205 | ebook-edit |
205 | ebook-meta | 206 | ebook-meta |
206 | ebook-polish | 207 | ebook-polish |
208 | ebook-viewer | ||
207 | electron-mail | 209 | electron-mail |
208 | electrum | 210 | electrum |
209 | element-desktop | 211 | element-desktop |
@@ -277,6 +279,7 @@ funnyboat | |||
277 | gajim | 279 | gajim |
278 | gajim-history-manager | 280 | gajim-history-manager |
279 | galculator | 281 | galculator |
282 | gallery-dl | ||
280 | gapplication | 283 | gapplication |
281 | gcalccmd | 284 | gcalccmd |
282 | gcloud | 285 | gcloud |
@@ -294,8 +297,8 @@ gimp-2.10 | |||
294 | gimp-2.8 | 297 | gimp-2.8 |
295 | gist | 298 | gist |
296 | gist-paste | 299 | gist-paste |
297 | gitg | ||
298 | git-cola | 300 | git-cola |
301 | gitg | ||
299 | github-desktop | 302 | github-desktop |
300 | gitter | 303 | gitter |
301 | # gjs -- https://github.com/netblue30/firejail/issues/3333#issuecomment-612601102 | 304 | # gjs -- https://github.com/netblue30/firejail/issues/3333#issuecomment-612601102 |
@@ -345,6 +348,7 @@ gnome-weather | |||
345 | gnote | 348 | gnote |
346 | gnubik | 349 | gnubik |
347 | godot | 350 | godot |
351 | goldendict | ||
348 | goobox | 352 | goobox |
349 | google-chrome | 353 | google-chrome |
350 | google-chrome-beta | 354 | google-chrome-beta |
@@ -386,14 +390,15 @@ icecat | |||
386 | icedove | 390 | icedove |
387 | iceweasel | 391 | iceweasel |
388 | idea | 392 | idea |
389 | ideaIC | ||
390 | idea.sh | 393 | idea.sh |
394 | ideaIC | ||
391 | imagej | 395 | imagej |
392 | img2txt | 396 | img2txt |
393 | impressive | 397 | impressive |
394 | inkscape | 398 | inkscape |
395 | inkview | 399 | inkview |
396 | inox | 400 | inox |
401 | io.github.lainsce.Notejot | ||
397 | ipcalc | 402 | ipcalc |
398 | ipcalc-ng | 403 | ipcalc-ng |
399 | iridium | 404 | iridium |
@@ -452,6 +457,7 @@ librecad | |||
452 | libreoffice | 457 | libreoffice |
453 | librewolf | 458 | librewolf |
454 | librewolf-nightly | 459 | librewolf-nightly |
460 | lifeograph | ||
455 | liferea | 461 | liferea |
456 | lightsoff | 462 | lightsoff |
457 | lincity-ng | 463 | lincity-ng |
@@ -507,6 +513,7 @@ mendeleydesktop | |||
507 | menulibre | 513 | menulibre |
508 | meteo-qt | 514 | meteo-qt |
509 | microsoft-edge | 515 | microsoft-edge |
516 | microsoft-edge-beta | ||
510 | microsoft-edge-dev | 517 | microsoft-edge-dev |
511 | midori | 518 | midori |
512 | min | 519 | min |
@@ -523,7 +530,6 @@ mp3splt-gtk | |||
523 | mp3wrap | 530 | mp3wrap |
524 | mpDris2 | 531 | mpDris2 |
525 | mpg123 | 532 | mpg123 |
526 | mpg123.bin | ||
527 | mpg123-alsa | 533 | mpg123-alsa |
528 | mpg123-id3dump | 534 | mpg123-id3dump |
529 | mpg123-jack | 535 | mpg123-jack |
@@ -533,6 +539,7 @@ mpg123-oss | |||
533 | mpg123-portaudio | 539 | mpg123-portaudio |
534 | mpg123-pulse | 540 | mpg123-pulse |
535 | mpg123-strip | 541 | mpg123-strip |
542 | mpg123.bin | ||
536 | mplayer | 543 | mplayer |
537 | mpsyt | 544 | mpsyt |
538 | mpv | 545 | mpv |
@@ -563,6 +570,7 @@ mypaint | |||
563 | mypaint-ora-thumbnailer | 570 | mypaint-ora-thumbnailer |
564 | natron | 571 | natron |
565 | ncdu | 572 | ncdu |
573 | ncdu2 | ||
566 | neochat | 574 | neochat |
567 | neomutt | 575 | neomutt |
568 | netactview | 576 | netactview |
@@ -674,6 +682,7 @@ qupzilla | |||
674 | qutebrowser | 682 | qutebrowser |
675 | rambox | 683 | rambox |
676 | redeclipse | 684 | redeclipse |
685 | rednotebook | ||
677 | redshift | 686 | redshift |
678 | regextester | 687 | regextester |
679 | remmina | 688 | remmina |
@@ -734,8 +743,8 @@ steam | |||
734 | steam-native | 743 | steam-native |
735 | steam-runtime | 744 | steam-runtime |
736 | stellarium | 745 | stellarium |
737 | strawberry | ||
738 | straw-viewer | 746 | straw-viewer |
747 | strawberry | ||
739 | strings | 748 | strings |
740 | studio.sh | 749 | studio.sh |
741 | subdownloader | 750 | subdownloader |
@@ -862,10 +871,10 @@ wire-desktop | |||
862 | wireshark | 871 | wireshark |
863 | wireshark-gtk | 872 | wireshark-gtk |
864 | wireshark-qt | 873 | wireshark-qt |
874 | wordwarvi | ||
865 | wpp | 875 | wpp |
866 | wps | 876 | wps |
867 | wpspdf | 877 | wpspdf |
868 | wordwarvi | ||
869 | x2goclient | 878 | x2goclient |
870 | xbill | 879 | xbill |
871 | xcalc | 880 | xcalc |
@@ -902,11 +911,13 @@ youtube-dl | |||
902 | youtube-dl-gui | 911 | youtube-dl-gui |
903 | youtube-viewer | 912 | youtube-viewer |
904 | youtubemusic-nativefier | 913 | youtubemusic-nativefier |
914 | yt-dlp | ||
905 | ytmdesktop | 915 | ytmdesktop |
906 | zaproxy | 916 | zaproxy |
907 | zart | 917 | zart |
908 | zathura | 918 | zathura |
909 | zeal | 919 | zeal |
920 | zim | ||
910 | zoom | 921 | zoom |
911 | # zpaq - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 922 | # zpaq - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
912 | # zstd - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 923 | # zstd - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c index a96415985..2266fa499 100644 --- a/src/firejail/appimage.c +++ b/src/firejail/appimage.c | |||
@@ -21,6 +21,7 @@ | |||
21 | // sudo mount -o loop krita-3.0-x86_64.appimage mnt | 21 | // sudo mount -o loop krita-3.0-x86_64.appimage mnt |
22 | 22 | ||
23 | #include "firejail.h" | 23 | #include "firejail.h" |
24 | #include "../include/gcov_wrapper.h" | ||
24 | #include <sys/types.h> | 25 | #include <sys/types.h> |
25 | #include <sys/stat.h> | 26 | #include <sys/stat.h> |
26 | #include <sys/mount.h> | 27 | #include <sys/mount.h> |
@@ -28,10 +29,6 @@ | |||
28 | #include <linux/loop.h> | 29 | #include <linux/loop.h> |
29 | #include <errno.h> | 30 | #include <errno.h> |
30 | 31 | ||
31 | #ifdef HAVE_GCOV | ||
32 | #include <gcov.h> | ||
33 | #endif | ||
34 | |||
35 | static char *devloop = NULL; // device file | 32 | static char *devloop = NULL; // device file |
36 | static long unsigned size = 0; // offset into appimage file | 33 | static long unsigned size = 0; // offset into appimage file |
37 | #define MAXBUF 4096 | 34 | #define MAXBUF 4096 |
@@ -144,9 +141,8 @@ void appimage_set(const char *appimage) { | |||
144 | 141 | ||
145 | if (cfg.cwd) | 142 | if (cfg.cwd) |
146 | env_store_name_val("OWD", cfg.cwd, SETENV); | 143 | env_store_name_val("OWD", cfg.cwd, SETENV); |
147 | #ifdef HAVE_GCOV | 144 | |
148 | __gcov_flush(); | 145 | __gcov_flush(); |
149 | #endif | ||
150 | #else | 146 | #else |
151 | fprintf(stderr, "Error: /dev/loop-control interface is not supported by your kernel\n"); | 147 | fprintf(stderr, "Error: /dev/loop-control interface is not supported by your kernel\n"); |
152 | exit(1); | 148 | exit(1); |
diff --git a/src/firejail/arp.c b/src/firejail/arp.c index bbab9a6d9..c259fc0ad 100644 --- a/src/firejail/arp.c +++ b/src/firejail/arp.c | |||
@@ -20,6 +20,7 @@ | |||
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include <sys/socket.h> | 21 | #include <sys/socket.h> |
22 | #include <sys/ioctl.h> | 22 | #include <sys/ioctl.h> |
23 | #include <sys/time.h> | ||
23 | #include <linux/if_ether.h> //TCP/IP Protocol Suite for Linux | 24 | #include <linux/if_ether.h> //TCP/IP Protocol Suite for Linux |
24 | #include <net/if.h> | 25 | #include <net/if.h> |
25 | #include <netinet/in.h> | 26 | #include <netinet/in.h> |
@@ -188,9 +189,14 @@ int arp_check(const char *dev, uint32_t destaddr) { | |||
188 | FD_SET(sock, &fds); | 189 | FD_SET(sock, &fds); |
189 | int maxfd = sock; | 190 | int maxfd = sock; |
190 | struct timeval ts; | 191 | struct timeval ts; |
191 | ts.tv_sec = 0; // 0.5 seconds wait time | 192 | gettimeofday(&ts, NULL); |
192 | ts.tv_usec = 500000; | 193 | double timerend = ts.tv_sec + ts.tv_usec / 1000000.0 + 0.5; |
193 | while (1) { | 194 | while (1) { |
195 | gettimeofday(&ts, NULL); | ||
196 | double now = ts.tv_sec + ts.tv_usec / 1000000.0; | ||
197 | double timeout = timerend - now; | ||
198 | ts.tv_sec = timeout; | ||
199 | ts.tv_usec = (timeout - ts.tv_sec) * 1000000; | ||
194 | int nready = select(maxfd + 1, &fds, (fd_set *) 0, (fd_set *) 0, &ts); | 200 | int nready = select(maxfd + 1, &fds, (fd_set *) 0, (fd_set *) 0, &ts); |
195 | if (nready < 0) | 201 | if (nready < 0) |
196 | errExit("select"); | 202 | errExit("select"); |
@@ -201,8 +207,8 @@ int arp_check(const char *dev, uint32_t destaddr) { | |||
201 | } | 207 | } |
202 | if (sendto (sock, frame, 14 + sizeof(ArpHdr), 0, (struct sockaddr *) &addr, sizeof (addr)) <= 0) | 208 | if (sendto (sock, frame, 14 + sizeof(ArpHdr), 0, (struct sockaddr *) &addr, sizeof (addr)) <= 0) |
203 | errExit("send"); | 209 | errExit("send"); |
204 | ts.tv_sec = 0; // 0.5 seconds wait time | 210 | gettimeofday(&ts, NULL); |
205 | ts.tv_usec = 500000; | 211 | timerend = ts.tv_sec + ts.tv_usec / 1000000.0 + 0.5; |
206 | fflush(0); | 212 | fflush(0); |
207 | } | 213 | } |
208 | else { | 214 | else { |
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c index f3ab0a6d8..06e6f0ccb 100644 --- a/src/firejail/checkcfg.c +++ b/src/firejail/checkcfg.c | |||
@@ -35,6 +35,7 @@ char *xvfb_extra_params = ""; | |||
35 | char *netfilter_default = NULL; | 35 | char *netfilter_default = NULL; |
36 | unsigned long join_timeout = 5000000; // microseconds | 36 | unsigned long join_timeout = 5000000; // microseconds |
37 | char *config_seccomp_error_action_str = "EPERM"; | 37 | char *config_seccomp_error_action_str = "EPERM"; |
38 | char *config_seccomp_filter_add = NULL; | ||
38 | char **whitelist_reject_topdirs = NULL; | 39 | char **whitelist_reject_topdirs = NULL; |
39 | 40 | ||
40 | int checkcfg(int val) { | 41 | int checkcfg(int val) { |
@@ -105,7 +106,6 @@ int checkcfg(int val) { | |||
105 | PARSE_YESNO(CFG_FIREJAIL_PROMPT, "firejail-prompt") | 106 | PARSE_YESNO(CFG_FIREJAIL_PROMPT, "firejail-prompt") |
106 | PARSE_YESNO(CFG_FORCE_NONEWPRIVS, "force-nonewprivs") | 107 | PARSE_YESNO(CFG_FORCE_NONEWPRIVS, "force-nonewprivs") |
107 | PARSE_YESNO(CFG_SECCOMP, "seccomp") | 108 | PARSE_YESNO(CFG_SECCOMP, "seccomp") |
108 | PARSE_YESNO(CFG_WHITELIST, "whitelist") | ||
109 | PARSE_YESNO(CFG_NETWORK, "network") | 109 | PARSE_YESNO(CFG_NETWORK, "network") |
110 | PARSE_YESNO(CFG_RESTRICTED_NETWORK, "restricted-network") | 110 | PARSE_YESNO(CFG_RESTRICTED_NETWORK, "restricted-network") |
111 | PARSE_YESNO(CFG_XEPHYR_WINDOW_TITLE, "xephyr-window-title") | 111 | PARSE_YESNO(CFG_XEPHYR_WINDOW_TITLE, "xephyr-window-title") |
@@ -225,6 +225,10 @@ int checkcfg(int val) { | |||
225 | else if (strncmp(ptr, "join-timeout ", 13) == 0) | 225 | else if (strncmp(ptr, "join-timeout ", 13) == 0) |
226 | join_timeout = strtoul(ptr + 13, NULL, 10) * 1000000; // seconds to microseconds | 226 | join_timeout = strtoul(ptr + 13, NULL, 10) * 1000000; // seconds to microseconds |
227 | 227 | ||
228 | // add rules to default seccomp filter | ||
229 | else if (strncmp(ptr, "seccomp-filter-add ", 19) == 0) | ||
230 | config_seccomp_filter_add = seccomp_check_list(ptr + 19); | ||
231 | |||
228 | // seccomp error action | 232 | // seccomp error action |
229 | else if (strncmp(ptr, "seccomp-error-action ", 21) == 0) { | 233 | else if (strncmp(ptr, "seccomp-error-action ", 21) == 0) { |
230 | if (strcmp(ptr + 21, "kill") == 0) | 234 | if (strcmp(ptr + 21, "kill") == 0) |
@@ -337,14 +341,6 @@ void print_compiletime_support(void) { | |||
337 | #endif | 341 | #endif |
338 | ); | 342 | ); |
339 | 343 | ||
340 | printf("\t- file and directory whitelisting support is %s\n", | ||
341 | #ifdef HAVE_WHITELIST | ||
342 | "enabled" | ||
343 | #else | ||
344 | "disabled" | ||
345 | #endif | ||
346 | ); | ||
347 | |||
348 | printf("\t- file transfer support is %s\n", | 344 | printf("\t- file transfer support is %s\n", |
349 | #ifdef HAVE_FILE_TRANSFER | 345 | #ifdef HAVE_FILE_TRANSFER |
350 | "enabled" | 346 | "enabled" |
diff --git a/src/firejail/chroot.c b/src/firejail/chroot.c index edc31cdea..37ec22117 100644 --- a/src/firejail/chroot.c +++ b/src/firejail/chroot.c | |||
@@ -20,6 +20,7 @@ | |||
20 | 20 | ||
21 | #ifdef HAVE_CHROOT | 21 | #ifdef HAVE_CHROOT |
22 | #include "firejail.h" | 22 | #include "firejail.h" |
23 | #include "../include/gcov_wrapper.h" | ||
23 | #include <sys/mount.h> | 24 | #include <sys/mount.h> |
24 | #include <sys/sendfile.h> | 25 | #include <sys/sendfile.h> |
25 | #include <errno.h> | 26 | #include <errno.h> |
@@ -29,10 +30,6 @@ | |||
29 | #define O_PATH 010000000 | 30 | #define O_PATH 010000000 |
30 | #endif | 31 | #endif |
31 | 32 | ||
32 | #ifdef HAVE_GCOV | ||
33 | #include <gcov.h> | ||
34 | #endif | ||
35 | |||
36 | // exit if error | 33 | // exit if error |
37 | void fs_check_chroot_dir(void) { | 34 | void fs_check_chroot_dir(void) { |
38 | EUID_ASSERT(); | 35 | EUID_ASSERT(); |
@@ -263,9 +260,8 @@ void fs_chroot(const char *rootdir) { | |||
263 | // update chroot resolv.conf | 260 | // update chroot resolv.conf |
264 | update_file(parentfd, "etc/resolv.conf"); | 261 | update_file(parentfd, "etc/resolv.conf"); |
265 | 262 | ||
266 | #ifdef HAVE_GCOV | ||
267 | __gcov_flush(); | 263 | __gcov_flush(); |
268 | #endif | 264 | |
269 | // create /run/firejail/mnt/oroot | 265 | // create /run/firejail/mnt/oroot |
270 | char *oroot = RUN_OVERLAY_ROOT; | 266 | char *oroot = RUN_OVERLAY_ROOT; |
271 | if (mkdir(oroot, 0755) == -1) | 267 | if (mkdir(oroot, 0755) == -1) |
diff --git a/src/firejail/dbus.c b/src/firejail/dbus.c index 9a4cb2e6b..735ff54fa 100644 --- a/src/firejail/dbus.c +++ b/src/firejail/dbus.c | |||
@@ -180,7 +180,7 @@ static void dbus_check_bus_profile(char const *prefix, DbusPolicy *policy) { | |||
180 | } | 180 | } |
181 | } | 181 | } |
182 | 182 | ||
183 | if (num_matches > 0) { | 183 | if (num_matches > 0 && !arg_quiet) { |
184 | assert(first_match != NULL); | 184 | assert(first_match != NULL); |
185 | if (num_matches == 1) { | 185 | if (num_matches == 1) { |
186 | fprintf(stderr, "Ignoring \"%s\".\n", first_match); | 186 | fprintf(stderr, "Ignoring \"%s\".\n", first_match); |
diff --git a/src/firejail/env.c b/src/firejail/env.c index f5e9dd980..ad16de037 100644 --- a/src/firejail/env.c +++ b/src/firejail/env.c | |||
@@ -262,7 +262,7 @@ static const char * const env_whitelist[] = { | |||
262 | "LANG", | 262 | "LANG", |
263 | "LANGUAGE", | 263 | "LANGUAGE", |
264 | "LC_MESSAGES", | 264 | "LC_MESSAGES", |
265 | "PATH", | 265 | // "PATH", |
266 | "DISPLAY" // required by X11 | 266 | "DISPLAY" // required by X11 |
267 | }; | 267 | }; |
268 | 268 | ||
@@ -311,6 +311,10 @@ void env_apply_whitelist(void) { | |||
311 | errExit("clearenv"); | 311 | errExit("clearenv"); |
312 | 312 | ||
313 | env_apply_list(env_whitelist, ARRAY_SIZE(env_whitelist)); | 313 | env_apply_list(env_whitelist, ARRAY_SIZE(env_whitelist)); |
314 | |||
315 | // hardcoding PATH | ||
316 | if (setenv("PATH", "/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin", 1) < 0) | ||
317 | errExit("setenv"); | ||
314 | } | 318 | } |
315 | 319 | ||
316 | // Filter env variables for a sbox app | 320 | // Filter env variables for a sbox app |
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index c84965074..2a7d88575 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -5,7 +5,7 @@ | |||
5 | * | 5 | * |
6 | * This program is free software; you can redistribute it and/or modify | 6 | * This program is free software; you can redistribute it and/or modify |
7 | * it under the terms of the GNU General Public License as published by | 7 | * it under the terms of the GNU General Public License as published by |
8 | * the Free Software Foundation; eithe r version 2 of the License, or | 8 | * the Free Software Foundation; either version 2 of the License, or |
9 | * (at your option) any later version. | 9 | * (at your option) any later version. |
10 | * | 10 | * |
11 | * This program is distributed in the hope that it will be useful, | 11 | * This program is distributed in the hope that it will be useful, |
@@ -156,6 +156,8 @@ typedef struct config_t { | |||
156 | 156 | ||
157 | // filesystem | 157 | // filesystem |
158 | ProfileEntry *profile; | 158 | ProfileEntry *profile; |
159 | ProfileEntry *profile_rebuild_etc; // blacklist files in /etc directory used by fs_rebuild_etc() | ||
160 | |||
159 | #define MAX_PROFILE_IGNORE 32 | 161 | #define MAX_PROFILE_IGNORE 32 |
160 | char *profile_ignore[MAX_PROFILE_IGNORE]; | 162 | char *profile_ignore[MAX_PROFILE_IGNORE]; |
161 | char *chrootdir; // chroot directory | 163 | char *chrootdir; // chroot directory |
@@ -508,7 +510,7 @@ void logargs(int argc, char **argv) ; | |||
508 | void logerr(const char *msg); | 510 | void logerr(const char *msg); |
509 | void set_nice(int inc); | 511 | void set_nice(int inc); |
510 | int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode); | 512 | int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode); |
511 | void copy_file_as_user(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode); | 513 | void copy_file_as_user(const char *srcname, const char *destname, mode_t mode); |
512 | void copy_file_from_user_to_root(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode); | 514 | void copy_file_from_user_to_root(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode); |
513 | void touch_file_as_user(const char *fname, mode_t mode); | 515 | void touch_file_as_user(const char *fname, mode_t mode); |
514 | int is_dir(const char *fname); | 516 | int is_dir(const char *fname); |
@@ -625,7 +627,6 @@ void fs_trace(void); | |||
625 | 627 | ||
626 | // fs_hostname.c | 628 | // fs_hostname.c |
627 | void fs_hostname(const char *hostname); | 629 | void fs_hostname(const char *hostname); |
628 | void fs_resolvconf(void); | ||
629 | char *fs_check_hosts_file(const char *fname); | 630 | char *fs_check_hosts_file(const char *fname); |
630 | void fs_store_hosts_file(void); | 631 | void fs_store_hosts_file(void); |
631 | void fs_mount_hosts_file(void); | 632 | void fs_mount_hosts_file(void); |
@@ -668,6 +669,7 @@ void fs_machineid(void); | |||
668 | void fs_private_dir_copy(const char *private_dir, const char *private_run_dir, const char *private_list); | 669 | void fs_private_dir_copy(const char *private_dir, const char *private_run_dir, const char *private_list); |
669 | void fs_private_dir_mount(const char *private_dir, const char *private_run_dir); | 670 | void fs_private_dir_mount(const char *private_dir, const char *private_run_dir); |
670 | void fs_private_dir_list(const char *private_dir, const char *private_run_dir, const char *private_list); | 671 | void fs_private_dir_list(const char *private_dir, const char *private_run_dir, const char *private_list); |
672 | void fs_rebuild_etc(void); | ||
671 | 673 | ||
672 | // no_sandbox.c | 674 | // no_sandbox.c |
673 | int check_namespace_virt(void); | 675 | int check_namespace_virt(void); |
@@ -776,7 +778,6 @@ enum { | |||
776 | CFG_NETWORK, | 778 | CFG_NETWORK, |
777 | CFG_RESTRICTED_NETWORK, | 779 | CFG_RESTRICTED_NETWORK, |
778 | CFG_FORCE_NONEWPRIVS, | 780 | CFG_FORCE_NONEWPRIVS, |
779 | CFG_WHITELIST, | ||
780 | CFG_XEPHYR_WINDOW_TITLE, | 781 | CFG_XEPHYR_WINDOW_TITLE, |
781 | CFG_OVERLAYFS, | 782 | CFG_OVERLAYFS, |
782 | CFG_PRIVATE_BIN, | 783 | CFG_PRIVATE_BIN, |
@@ -810,6 +811,7 @@ extern char *xvfb_extra_params; | |||
810 | extern char *netfilter_default; | 811 | extern char *netfilter_default; |
811 | extern unsigned long join_timeout; | 812 | extern unsigned long join_timeout; |
812 | extern char *config_seccomp_error_action_str; | 813 | extern char *config_seccomp_error_action_str; |
814 | extern char *config_seccomp_filter_add; | ||
813 | extern char **whitelist_reject_topdirs; | 815 | extern char **whitelist_reject_topdirs; |
814 | 816 | ||
815 | int checkcfg(int val); | 817 | int checkcfg(int val); |
@@ -833,7 +835,6 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc, | |||
833 | #define PATH_FNET_MAIN (LIBDIR "/firejail/fnet") // when called from main thread | 835 | #define PATH_FNET_MAIN (LIBDIR "/firejail/fnet") // when called from main thread |
834 | #define PATH_FNET (RUN_FIREJAIL_LIB_DIR "/fnet") // when called from sandbox thread | 836 | #define PATH_FNET (RUN_FIREJAIL_LIB_DIR "/fnet") // when called from sandbox thread |
835 | 837 | ||
836 | //#define PATH_FNETFILTER (LIBDIR "/firejail/fnetfilter") | ||
837 | #define PATH_FNETFILTER (RUN_FIREJAIL_LIB_DIR "/fnetfilter") | 838 | #define PATH_FNETFILTER (RUN_FIREJAIL_LIB_DIR "/fnetfilter") |
838 | 839 | ||
839 | #define PATH_FIREMON (PREFIX "/bin/firemon") | 840 | #define PATH_FIREMON (PREFIX "/bin/firemon") |
@@ -846,17 +847,16 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc, | |||
846 | // it is also run from inside the sandbox by --debug; in this case we do an access(filename, X_OK) test first | 847 | // it is also run from inside the sandbox by --debug; in this case we do an access(filename, X_OK) test first |
847 | #define PATH_FSEC_PRINT (LIBDIR "/firejail/fsec-print") | 848 | #define PATH_FSEC_PRINT (LIBDIR "/firejail/fsec-print") |
848 | 849 | ||
849 | //#define PATH_FSEC_OPTIMIZE (LIBDIR "/firejail/fsec-optimize") | ||
850 | #define PATH_FSEC_OPTIMIZE (RUN_FIREJAIL_LIB_DIR "/fsec-optimize") | 850 | #define PATH_FSEC_OPTIMIZE (RUN_FIREJAIL_LIB_DIR "/fsec-optimize") |
851 | 851 | ||
852 | //#define PATH_FCOPY (LIBDIR "/firejail/fcopy") | ||
853 | #define PATH_FCOPY (RUN_FIREJAIL_LIB_DIR "/fcopy") | 852 | #define PATH_FCOPY (RUN_FIREJAIL_LIB_DIR "/fcopy") |
854 | 853 | ||
855 | #define SBOX_STDIN_FILE "/run/firejail/mnt/sbox_stdin" | 854 | #define SBOX_STDIN_FILE "/run/firejail/mnt/sbox_stdin" |
856 | 855 | ||
857 | //#define PATH_FLDD (LIBDIR "/firejail/fldd") | ||
858 | #define PATH_FLDD (RUN_FIREJAIL_LIB_DIR "/fldd") | 856 | #define PATH_FLDD (RUN_FIREJAIL_LIB_DIR "/fldd") |
859 | 857 | ||
858 | #define PATH_FIDS (LIBDIR "/firejail/fids") | ||
859 | |||
860 | // bitmapped filters for sbox_run | 860 | // bitmapped filters for sbox_run |
861 | #define SBOX_ROOT (1 << 0) // run the sandbox as root | 861 | #define SBOX_ROOT (1 << 0) // run the sandbox as root |
862 | #define SBOX_USER (1 << 1) // run the sandbox as a regular user | 862 | #define SBOX_USER (1 << 1) // run the sandbox as a regular user |
@@ -901,4 +901,7 @@ void dhcp_start(void); | |||
901 | // selinux.c | 901 | // selinux.c |
902 | void selinux_relabel_path(const char *path, const char *inside_path); | 902 | void selinux_relabel_path(const char *path, const char *inside_path); |
903 | 903 | ||
904 | // ids.c | ||
905 | void run_ids(int argc, char **argv); | ||
906 | |||
904 | #endif | 907 | #endif |
diff --git a/src/firejail/fs.c b/src/firejail/fs.c index 4ae7dbfa4..6d01b5e5d 100644 --- a/src/firejail/fs.c +++ b/src/firejail/fs.c | |||
@@ -18,6 +18,7 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include "../include/gcov_wrapper.h" | ||
21 | #include <sys/mount.h> | 22 | #include <sys/mount.h> |
22 | #include <sys/stat.h> | 23 | #include <sys/stat.h> |
23 | #include <sys/statvfs.h> | 24 | #include <sys/statvfs.h> |
@@ -33,10 +34,6 @@ | |||
33 | #define O_PATH 010000000 | 34 | #define O_PATH 010000000 |
34 | #endif | 35 | #endif |
35 | 36 | ||
36 | #ifdef HAVE_GCOV | ||
37 | #include <gcov.h> | ||
38 | #endif | ||
39 | |||
40 | #define MAX_BUF 4096 | 37 | #define MAX_BUF 4096 |
41 | #define EMPTY_STRING ("") | 38 | #define EMPTY_STRING ("") |
42 | // check noblacklist statements not matched by a proper blacklist in disable-*.inc files | 39 | // check noblacklist statements not matched by a proper blacklist in disable-*.inc files |
@@ -111,7 +108,7 @@ static void disable_file(OPERATION op, const char *filename) { | |||
111 | } | 108 | } |
112 | 109 | ||
113 | // check for firejail executable | 110 | // check for firejail executable |
114 | // we migth have a file found in ${PATH} pointing to /usr/bin/firejail | 111 | // we might have a file found in ${PATH} pointing to /usr/bin/firejail |
115 | // blacklisting it here will end up breaking situations like user clicks on a link in Thunderbird | 112 | // blacklisting it here will end up breaking situations like user clicks on a link in Thunderbird |
116 | // and expects Firefox to open in the same sandbox | 113 | // and expects Firefox to open in the same sandbox |
117 | if (strcmp(BINDIR "/firejail", fname) == 0) { | 114 | if (strcmp(BINDIR "/firejail", fname) == 0) { |
@@ -165,6 +162,19 @@ static void disable_file(OPERATION op, const char *filename) { | |||
165 | fs_logger2("blacklist", fname); | 162 | fs_logger2("blacklist", fname); |
166 | else | 163 | else |
167 | fs_logger2("blacklist-nolog", fname); | 164 | fs_logger2("blacklist-nolog", fname); |
165 | |||
166 | // files in /etc will be reprocessed during /etc rebuild | ||
167 | if (strncmp(fname, "/etc/", 5) == 0) { | ||
168 | ProfileEntry *prf = malloc(sizeof(ProfileEntry)); | ||
169 | if (!prf) | ||
170 | errExit("malloc"); | ||
171 | memset(prf, 0, sizeof(ProfileEntry)); | ||
172 | prf->data = strdup(fname); | ||
173 | if (!prf->data) | ||
174 | errExit("strdup"); | ||
175 | prf->next = cfg.profile_rebuild_etc; | ||
176 | cfg.profile_rebuild_etc = prf; | ||
177 | } | ||
168 | } | 178 | } |
169 | } | 179 | } |
170 | else if (op == MOUNT_READONLY || op == MOUNT_RDWR || op == MOUNT_NOEXEC) { | 180 | else if (op == MOUNT_READONLY || op == MOUNT_RDWR || op == MOUNT_NOEXEC) { |
@@ -190,8 +200,6 @@ static void disable_file(OPERATION op, const char *filename) { | |||
190 | } | 200 | } |
191 | 201 | ||
192 | fs_tmpfs(fname, uid); | 202 | fs_tmpfs(fname, uid); |
193 | EUID_USER(); // fs_tmpfs returns with EUID 0 | ||
194 | |||
195 | selinux_relabel_path(fname, fname); | 203 | selinux_relabel_path(fname, fname); |
196 | } | 204 | } |
197 | else | 205 | else |
@@ -272,6 +280,8 @@ static void globbing(OPERATION op, const char *pattern, const char *noblacklist[ | |||
272 | 280 | ||
273 | // blacklist files or directories by mounting empty files on top of them | 281 | // blacklist files or directories by mounting empty files on top of them |
274 | void fs_blacklist(void) { | 282 | void fs_blacklist(void) { |
283 | EUID_ASSERT(); | ||
284 | |||
275 | ProfileEntry *entry = cfg.profile; | 285 | ProfileEntry *entry = cfg.profile; |
276 | if (!entry) | 286 | if (!entry) |
277 | return; | 287 | return; |
@@ -283,7 +293,6 @@ void fs_blacklist(void) { | |||
283 | if (noblacklist == NULL) | 293 | if (noblacklist == NULL) |
284 | errExit("failed allocating memory for noblacklist entries"); | 294 | errExit("failed allocating memory for noblacklist entries"); |
285 | 295 | ||
286 | EUID_USER(); | ||
287 | while (entry) { | 296 | while (entry) { |
288 | OPERATION op = OPERATION_MAX; | 297 | OPERATION op = OPERATION_MAX; |
289 | char *ptr; | 298 | char *ptr; |
@@ -459,8 +468,6 @@ void fs_blacklist(void) { | |||
459 | for (i = 0; i < noblacklist_c; i++) | 468 | for (i = 0; i < noblacklist_c; i++) |
460 | free(noblacklist[i]); | 469 | free(noblacklist[i]); |
461 | free(noblacklist); | 470 | free(noblacklist); |
462 | |||
463 | EUID_ROOT(); | ||
464 | } | 471 | } |
465 | 472 | ||
466 | //*********************************************** | 473 | //*********************************************** |
@@ -469,7 +476,7 @@ void fs_blacklist(void) { | |||
469 | 476 | ||
470 | // mount a writable tmpfs on directory; requires a resolved path | 477 | // mount a writable tmpfs on directory; requires a resolved path |
471 | void fs_tmpfs(const char *dir, unsigned check_owner) { | 478 | void fs_tmpfs(const char *dir, unsigned check_owner) { |
472 | EUID_USER(); | 479 | EUID_ASSERT(); |
473 | assert(dir); | 480 | assert(dir); |
474 | if (arg_debug) | 481 | if (arg_debug) |
475 | printf("Mounting tmpfs on %s, check owner: %s\n", dir, (check_owner)? "yes": "no"); | 482 | printf("Mounting tmpfs on %s, check owner: %s\n", dir, (check_owner)? "yes": "no"); |
@@ -492,14 +499,15 @@ void fs_tmpfs(const char *dir, unsigned check_owner) { | |||
492 | struct statvfs buf; | 499 | struct statvfs buf; |
493 | if (fstatvfs(fd, &buf) == -1) | 500 | if (fstatvfs(fd, &buf) == -1) |
494 | errExit("fstatvfs"); | 501 | errExit("fstatvfs"); |
495 | unsigned long flags = buf.f_flag & ~(MS_RDONLY|MS_BIND); | 502 | unsigned long flags = buf.f_flag & ~(MS_RDONLY|MS_BIND|MS_REMOUNT); |
496 | // mount via the symbolic link in /proc/self/fd | 503 | // mount via the symbolic link in /proc/self/fd |
497 | EUID_ROOT(); | ||
498 | char *proc; | 504 | char *proc; |
499 | if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1) | 505 | if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1) |
500 | errExit("asprintf"); | 506 | errExit("asprintf"); |
507 | EUID_ROOT(); | ||
501 | if (mount("tmpfs", proc, "tmpfs", flags|MS_NOSUID|MS_NODEV, options) < 0) | 508 | if (mount("tmpfs", proc, "tmpfs", flags|MS_NOSUID|MS_NODEV, options) < 0) |
502 | errExit("mounting tmpfs"); | 509 | errExit("mounting tmpfs"); |
510 | EUID_USER(); | ||
503 | // check the last mount operation | 511 | // check the last mount operation |
504 | MountData *mdata = get_last_mount(); | 512 | MountData *mdata = get_last_mount(); |
505 | if (strcmp(mdata->fstype, "tmpfs") != 0 || strcmp(mdata->dir, dir) != 0) | 513 | if (strcmp(mdata->fstype, "tmpfs") != 0 || strcmp(mdata->dir, dir) != 0) |
@@ -1213,9 +1221,8 @@ void fs_overlayfs(void) { | |||
1213 | fs_logger("whitelist /tmp"); | 1221 | fs_logger("whitelist /tmp"); |
1214 | 1222 | ||
1215 | // chroot in the new filesystem | 1223 | // chroot in the new filesystem |
1216 | #ifdef HAVE_GCOV | ||
1217 | __gcov_flush(); | 1224 | __gcov_flush(); |
1218 | #endif | 1225 | |
1219 | if (chroot(oroot) == -1) | 1226 | if (chroot(oroot) == -1) |
1220 | errExit("chroot"); | 1227 | errExit("chroot"); |
1221 | 1228 | ||
@@ -1281,6 +1288,9 @@ void fs_private_tmp(void) { | |||
1281 | // read-only x11 directory | 1288 | // read-only x11 directory |
1282 | profile_add("read-only /tmp/.X11-unix"); | 1289 | profile_add("read-only /tmp/.X11-unix"); |
1283 | 1290 | ||
1291 | // whitelist sndio directory | ||
1292 | profile_add("whitelist /tmp/sndio"); | ||
1293 | |||
1284 | // whitelist any pulse* file in /tmp directory | 1294 | // whitelist any pulse* file in /tmp directory |
1285 | // some distros use PulseAudio sockets under /tmp instead of the socket in /urn/user | 1295 | // some distros use PulseAudio sockets under /tmp instead of the socket in /urn/user |
1286 | DIR *dir; | 1296 | DIR *dir; |
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c index 8cc3ecc62..a43b18344 100644 --- a/src/firejail/fs_dev.c +++ b/src/firejail/fs_dev.c | |||
@@ -330,8 +330,10 @@ void fs_dev_disable_sound(void) { | |||
330 | } | 330 | } |
331 | 331 | ||
332 | // disable all jack sockets in /dev/shm | 332 | // disable all jack sockets in /dev/shm |
333 | EUID_USER(); | ||
333 | glob_t globbuf; | 334 | glob_t globbuf; |
334 | int globerr = glob("/dev/shm/jack*", GLOB_NOSORT, NULL, &globbuf); | 335 | int globerr = glob("/dev/shm/jack*", GLOB_NOSORT, NULL, &globbuf); |
336 | EUID_ROOT(); | ||
335 | if (globerr) | 337 | if (globerr) |
336 | return; | 338 | return; |
337 | 339 | ||
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c index b0e1e1bf1..76054b485 100644 --- a/src/firejail/fs_etc.c +++ b/src/firejail/fs_etc.c | |||
@@ -24,6 +24,7 @@ | |||
24 | #include <sys/types.h> | 24 | #include <sys/types.h> |
25 | #include <time.h> | 25 | #include <time.h> |
26 | #include <unistd.h> | 26 | #include <unistd.h> |
27 | #include <dirent.h> | ||
27 | 28 | ||
28 | // spoof /etc/machine_id | 29 | // spoof /etc/machine_id |
29 | void fs_machineid(void) { | 30 | void fs_machineid(void) { |
@@ -250,3 +251,128 @@ void fs_private_dir_list(const char *private_dir, const char *private_run_dir, c | |||
250 | fs_private_dir_mount(private_dir, private_run_dir); | 251 | fs_private_dir_mount(private_dir, private_run_dir); |
251 | fmessage("Private %s installed in %0.2f ms\n", private_dir, timetrace_end()); | 252 | fmessage("Private %s installed in %0.2f ms\n", private_dir, timetrace_end()); |
252 | } | 253 | } |
254 | |||
255 | void fs_rebuild_etc(void) { | ||
256 | int have_dhcp = 1; | ||
257 | if (cfg.dns1 == NULL && !any_dhcp()) | ||
258 | have_dhcp = 0; | ||
259 | |||
260 | if (arg_debug) | ||
261 | printf("rebuilding /etc directory\n"); | ||
262 | if (mkdir(RUN_DNS_ETC, 0755)) | ||
263 | errExit("mkdir"); | ||
264 | selinux_relabel_path(RUN_DNS_ETC, "/etc"); | ||
265 | fs_logger("tmpfs /etc"); | ||
266 | |||
267 | DIR *dir = opendir("/etc"); | ||
268 | if (!dir) | ||
269 | errExit("opendir"); | ||
270 | |||
271 | struct stat s; | ||
272 | struct dirent *entry; | ||
273 | while ((entry = readdir(dir))) { | ||
274 | if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) | ||
275 | continue; | ||
276 | |||
277 | // skip files in cfg.profile_rebuild_etc list | ||
278 | // these files are already blacklisted | ||
279 | { | ||
280 | ProfileEntry *prf = cfg.profile_rebuild_etc; | ||
281 | int found = 0; | ||
282 | while (prf) { | ||
283 | if (strcmp(entry->d_name, prf->data + 5) == 0) { // 5 is strlen("/etc/") | ||
284 | found = 1; | ||
285 | break; | ||
286 | } | ||
287 | prf = prf->next; | ||
288 | } | ||
289 | if (found) | ||
290 | continue; | ||
291 | } | ||
292 | |||
293 | // for resolv.conf we might have to create a brand new file later | ||
294 | if (have_dhcp && | ||
295 | (strcmp(entry->d_name, "resolv.conf") == 0 || | ||
296 | strcmp(entry->d_name, "resolv.conf.dhclient-new") == 0)) | ||
297 | continue; | ||
298 | // printf("linking %s\n", entry->d_name); | ||
299 | |||
300 | char *src; | ||
301 | if (asprintf(&src, "/etc/%s", entry->d_name) == -1) | ||
302 | errExit("asprintf"); | ||
303 | if (stat(src, &s) != 0) { | ||
304 | free(src); | ||
305 | continue; | ||
306 | } | ||
307 | |||
308 | char *dest; | ||
309 | if (asprintf(&dest, "%s/%s", RUN_DNS_ETC, entry->d_name) == -1) | ||
310 | errExit("asprintf"); | ||
311 | |||
312 | int symlink_done = 0; | ||
313 | if (is_link(src)) { | ||
314 | char *rp =realpath(src, NULL); | ||
315 | if (rp == NULL) { | ||
316 | free(src); | ||
317 | free(dest); | ||
318 | continue; | ||
319 | } | ||
320 | if (symlink(rp, dest)) | ||
321 | errExit("symlink"); | ||
322 | else | ||
323 | symlink_done = 1; | ||
324 | } | ||
325 | else if (S_ISDIR(s.st_mode)) | ||
326 | create_empty_dir_as_root(dest, s.st_mode); | ||
327 | else | ||
328 | create_empty_file_as_root(dest, s.st_mode); | ||
329 | |||
330 | // bind-mount src on top of dest | ||
331 | if (!symlink_done) { | ||
332 | if (mount(src, dest, NULL, MS_BIND|MS_REC, NULL) < 0) | ||
333 | errExit("mount bind mirroring /etc"); | ||
334 | } | ||
335 | fs_logger2("clone", src); | ||
336 | |||
337 | free(src); | ||
338 | free(dest); | ||
339 | } | ||
340 | closedir(dir); | ||
341 | |||
342 | // mount bind our private etc directory on top of /etc | ||
343 | if (arg_debug) | ||
344 | printf("Mount-bind %s on top of /etc\n", RUN_DNS_ETC); | ||
345 | if (mount(RUN_DNS_ETC, "/etc", NULL, MS_BIND|MS_REC, NULL) < 0) | ||
346 | errExit("mount bind mirroring /etc"); | ||
347 | fs_logger("mount /etc"); | ||
348 | |||
349 | if (have_dhcp == 0) | ||
350 | return; | ||
351 | |||
352 | if (arg_debug) | ||
353 | printf("Creating a new /etc/resolv.conf file\n"); | ||
354 | FILE *fp = fopen("/etc/resolv.conf", "wxe"); | ||
355 | if (!fp) { | ||
356 | fprintf(stderr, "Error: cannot create /etc/resolv.conf file\n"); | ||
357 | exit(1); | ||
358 | } | ||
359 | |||
360 | if (cfg.dns1) { | ||
361 | if (any_dhcp()) | ||
362 | fwarning("network setup uses DHCP, nameservers will likely be overwritten\n"); | ||
363 | fprintf(fp, "nameserver %s\n", cfg.dns1); | ||
364 | } | ||
365 | if (cfg.dns2) | ||
366 | fprintf(fp, "nameserver %s\n", cfg.dns2); | ||
367 | if (cfg.dns3) | ||
368 | fprintf(fp, "nameserver %s\n", cfg.dns3); | ||
369 | if (cfg.dns4) | ||
370 | fprintf(fp, "nameserver %s\n", cfg.dns4); | ||
371 | |||
372 | // mode and owner | ||
373 | SET_PERMS_STREAM(fp, 0, 0, 0644); | ||
374 | |||
375 | fclose(fp); | ||
376 | |||
377 | fs_logger("create /etc/resolv.conf"); | ||
378 | } | ||
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c index eab952eb8..590337da1 100644 --- a/src/firejail/fs_home.c +++ b/src/firejail/fs_home.c | |||
@@ -34,12 +34,13 @@ | |||
34 | #define O_PATH 010000000 | 34 | #define O_PATH 010000000 |
35 | #endif | 35 | #endif |
36 | 36 | ||
37 | static void skel(const char *homedir, uid_t u, gid_t g) { | 37 | static void skel(const char *homedir) { |
38 | char *fname; | 38 | EUID_ASSERT(); |
39 | 39 | ||
40 | // zsh | 40 | // zsh |
41 | if (!arg_shell_none && (strcmp(cfg.shell,"/usr/bin/zsh") == 0 || strcmp(cfg.shell,"/bin/zsh") == 0)) { | 41 | if (!arg_shell_none && (strcmp(cfg.shell,"/usr/bin/zsh") == 0 || strcmp(cfg.shell,"/bin/zsh") == 0)) { |
42 | // copy skel files | 42 | // copy skel files |
43 | char *fname; | ||
43 | if (asprintf(&fname, "%s/.zshrc", homedir) == -1) | 44 | if (asprintf(&fname, "%s/.zshrc", homedir) == -1) |
44 | errExit("asprintf"); | 45 | errExit("asprintf"); |
45 | // don't copy it if we already have the file | 46 | // don't copy it if we already have the file |
@@ -50,7 +51,7 @@ static void skel(const char *homedir, uid_t u, gid_t g) { | |||
50 | exit(1); | 51 | exit(1); |
51 | } | 52 | } |
52 | if (access("/etc/skel/.zshrc", R_OK) == 0) { | 53 | if (access("/etc/skel/.zshrc", R_OK) == 0) { |
53 | copy_file_as_user("/etc/skel/.zshrc", fname, u, g, 0644); // regular user | 54 | copy_file_as_user("/etc/skel/.zshrc", fname, 0644); // regular user |
54 | fs_logger("clone /etc/skel/.zshrc"); | 55 | fs_logger("clone /etc/skel/.zshrc"); |
55 | fs_logger2("clone", fname); | 56 | fs_logger2("clone", fname); |
56 | } | 57 | } |
@@ -64,6 +65,7 @@ static void skel(const char *homedir, uid_t u, gid_t g) { | |||
64 | // csh | 65 | // csh |
65 | else if (!arg_shell_none && strcmp(cfg.shell,"/bin/csh") == 0) { | 66 | else if (!arg_shell_none && strcmp(cfg.shell,"/bin/csh") == 0) { |
66 | // copy skel files | 67 | // copy skel files |
68 | char *fname; | ||
67 | if (asprintf(&fname, "%s/.cshrc", homedir) == -1) | 69 | if (asprintf(&fname, "%s/.cshrc", homedir) == -1) |
68 | errExit("asprintf"); | 70 | errExit("asprintf"); |
69 | // don't copy it if we already have the file | 71 | // don't copy it if we already have the file |
@@ -74,7 +76,7 @@ static void skel(const char *homedir, uid_t u, gid_t g) { | |||
74 | exit(1); | 76 | exit(1); |
75 | } | 77 | } |
76 | if (access("/etc/skel/.cshrc", R_OK) == 0) { | 78 | if (access("/etc/skel/.cshrc", R_OK) == 0) { |
77 | copy_file_as_user("/etc/skel/.cshrc", fname, u, g, 0644); // regular user | 79 | copy_file_as_user("/etc/skel/.cshrc", fname, 0644); // regular user |
78 | fs_logger("clone /etc/skel/.cshrc"); | 80 | fs_logger("clone /etc/skel/.cshrc"); |
79 | fs_logger2("clone", fname); | 81 | fs_logger2("clone", fname); |
80 | } | 82 | } |
@@ -88,6 +90,7 @@ static void skel(const char *homedir, uid_t u, gid_t g) { | |||
88 | // bash etc. | 90 | // bash etc. |
89 | else { | 91 | else { |
90 | // copy skel files | 92 | // copy skel files |
93 | char *fname; | ||
91 | if (asprintf(&fname, "%s/.bashrc", homedir) == -1) | 94 | if (asprintf(&fname, "%s/.bashrc", homedir) == -1) |
92 | errExit("asprintf"); | 95 | errExit("asprintf"); |
93 | // don't copy it if we already have the file | 96 | // don't copy it if we already have the file |
@@ -98,7 +101,7 @@ static void skel(const char *homedir, uid_t u, gid_t g) { | |||
98 | exit(1); | 101 | exit(1); |
99 | } | 102 | } |
100 | if (access("/etc/skel/.bashrc", R_OK) == 0) { | 103 | if (access("/etc/skel/.bashrc", R_OK) == 0) { |
101 | copy_file_as_user("/etc/skel/.bashrc", fname, u, g, 0644); // regular user | 104 | copy_file_as_user("/etc/skel/.bashrc", fname, 0644); // regular user |
102 | fs_logger("clone /etc/skel/.bashrc"); | 105 | fs_logger("clone /etc/skel/.bashrc"); |
103 | fs_logger2("clone", fname); | 106 | fs_logger2("clone", fname); |
104 | } | 107 | } |
@@ -108,6 +111,7 @@ static void skel(const char *homedir, uid_t u, gid_t g) { | |||
108 | } | 111 | } |
109 | 112 | ||
110 | static int store_xauthority(void) { | 113 | static int store_xauthority(void) { |
114 | EUID_ASSERT(); | ||
111 | if (arg_x11_block) | 115 | if (arg_x11_block) |
112 | return 0; | 116 | return 0; |
113 | 117 | ||
@@ -118,7 +122,7 @@ static int store_xauthority(void) { | |||
118 | errExit("asprintf"); | 122 | errExit("asprintf"); |
119 | 123 | ||
120 | struct stat s; | 124 | struct stat s; |
121 | if (lstat_as_user(src, &s) == 0) { | 125 | if (lstat(src, &s) == 0) { |
122 | if (S_ISLNK(s.st_mode)) { | 126 | if (S_ISLNK(s.st_mode)) { |
123 | fwarning("invalid .Xauthority file\n"); | 127 | fwarning("invalid .Xauthority file\n"); |
124 | free(src); | 128 | free(src); |
@@ -126,6 +130,7 @@ static int store_xauthority(void) { | |||
126 | } | 130 | } |
127 | 131 | ||
128 | // create an empty file as root, and change ownership to user | 132 | // create an empty file as root, and change ownership to user |
133 | EUID_ROOT(); | ||
129 | FILE *fp = fopen(dest, "we"); | 134 | FILE *fp = fopen(dest, "we"); |
130 | if (fp) { | 135 | if (fp) { |
131 | fprintf(fp, "\n"); | 136 | fprintf(fp, "\n"); |
@@ -134,10 +139,11 @@ static int store_xauthority(void) { | |||
134 | } | 139 | } |
135 | else | 140 | else |
136 | errExit("fopen"); | 141 | errExit("fopen"); |
142 | EUID_USER(); | ||
137 | 143 | ||
138 | copy_file_as_user(src, dest, getuid(), getgid(), 0600); // regular user | 144 | copy_file_as_user(src, dest, 0600); // regular user |
139 | fs_logger2("clone", dest); | ||
140 | selinux_relabel_path(dest, src); | 145 | selinux_relabel_path(dest, src); |
146 | fs_logger2("clone", dest); | ||
141 | free(src); | 147 | free(src); |
142 | return 1; // file copied | 148 | return 1; // file copied |
143 | } | 149 | } |
@@ -147,6 +153,7 @@ static int store_xauthority(void) { | |||
147 | } | 153 | } |
148 | 154 | ||
149 | static int store_asoundrc(void) { | 155 | static int store_asoundrc(void) { |
156 | EUID_ASSERT(); | ||
150 | if (arg_nosound) | 157 | if (arg_nosound) |
151 | return 0; | 158 | return 0; |
152 | 159 | ||
@@ -157,11 +164,11 @@ static int store_asoundrc(void) { | |||
157 | errExit("asprintf"); | 164 | errExit("asprintf"); |
158 | 165 | ||
159 | struct stat s; | 166 | struct stat s; |
160 | if (lstat_as_user(src, &s) == 0) { | 167 | if (lstat(src, &s) == 0) { |
161 | if (S_ISLNK(s.st_mode)) { | 168 | if (S_ISLNK(s.st_mode)) { |
162 | // make sure the real path of the file is inside the home directory | 169 | // make sure the real path of the file is inside the home directory |
163 | /* coverity[toctou] */ | 170 | /* coverity[toctou] */ |
164 | char *rp = realpath_as_user(src); | 171 | char *rp = realpath(src, NULL); |
165 | if (!rp) { | 172 | if (!rp) { |
166 | fprintf(stderr, "Error: Cannot access %s\n", src); | 173 | fprintf(stderr, "Error: Cannot access %s\n", src); |
167 | exit(1); | 174 | exit(1); |
@@ -174,6 +181,7 @@ static int store_asoundrc(void) { | |||
174 | } | 181 | } |
175 | 182 | ||
176 | // create an empty file as root, and change ownership to user | 183 | // create an empty file as root, and change ownership to user |
184 | EUID_ROOT(); | ||
177 | FILE *fp = fopen(dest, "we"); | 185 | FILE *fp = fopen(dest, "we"); |
178 | if (fp) { | 186 | if (fp) { |
179 | fprintf(fp, "\n"); | 187 | fprintf(fp, "\n"); |
@@ -182,10 +190,11 @@ static int store_asoundrc(void) { | |||
182 | } | 190 | } |
183 | else | 191 | else |
184 | errExit("fopen"); | 192 | errExit("fopen"); |
193 | EUID_USER(); | ||
185 | 194 | ||
186 | copy_file_as_user(src, dest, getuid(), getgid(), 0644); // regular user | 195 | copy_file_as_user(src, dest, 0644); // regular user |
187 | selinux_relabel_path(dest, src); | ||
188 | fs_logger2("clone", dest); | 196 | fs_logger2("clone", dest); |
197 | selinux_relabel_path(dest, src); | ||
189 | free(src); | 198 | free(src); |
190 | return 1; // file copied | 199 | return 1; // file copied |
191 | } | 200 | } |
@@ -195,6 +204,7 @@ static int store_asoundrc(void) { | |||
195 | } | 204 | } |
196 | 205 | ||
197 | static void copy_xauthority(void) { | 206 | static void copy_xauthority(void) { |
207 | EUID_ASSERT(); | ||
198 | // copy XAUTHORITY_FILE in the new home directory | 208 | // copy XAUTHORITY_FILE in the new home directory |
199 | char *src = RUN_XAUTHORITY_FILE ; | 209 | char *src = RUN_XAUTHORITY_FILE ; |
200 | char *dest; | 210 | char *dest; |
@@ -207,16 +217,18 @@ static void copy_xauthority(void) { | |||
207 | exit(1); | 217 | exit(1); |
208 | } | 218 | } |
209 | 219 | ||
210 | copy_file_as_user(src, dest, getuid(), getgid(), S_IRUSR | S_IWUSR); // regular user | 220 | copy_file_as_user(src, dest, S_IRUSR | S_IWUSR); // regular user |
211 | selinux_relabel_path(dest, src); | ||
212 | fs_logger2("clone", dest); | 221 | fs_logger2("clone", dest); |
222 | selinux_relabel_path(dest, dest); | ||
213 | free(dest); | 223 | free(dest); |
214 | 224 | ||
215 | // delete the temporary file | 225 | EUID_ROOT(); |
216 | unlink(src); | 226 | unlink(src); // delete the temporary file |
227 | EUID_USER(); | ||
217 | } | 228 | } |
218 | 229 | ||
219 | static void copy_asoundrc(void) { | 230 | static void copy_asoundrc(void) { |
231 | EUID_ASSERT(); | ||
220 | // copy ASOUNDRC_FILE in the new home directory | 232 | // copy ASOUNDRC_FILE in the new home directory |
221 | char *src = RUN_ASOUNDRC_FILE ; | 233 | char *src = RUN_ASOUNDRC_FILE ; |
222 | char *dest; | 234 | char *dest; |
@@ -229,13 +241,14 @@ static void copy_asoundrc(void) { | |||
229 | exit(1); | 241 | exit(1); |
230 | } | 242 | } |
231 | 243 | ||
232 | copy_file_as_user(src, dest, getuid(), getgid(), S_IRUSR | S_IWUSR); // regular user | 244 | copy_file_as_user(src, dest, S_IRUSR | S_IWUSR); // regular user |
233 | selinux_relabel_path(dest, src); | ||
234 | fs_logger2("clone", dest); | 245 | fs_logger2("clone", dest); |
246 | selinux_relabel_path(dest, dest); | ||
235 | free(dest); | 247 | free(dest); |
236 | 248 | ||
237 | // delete the temporary file | 249 | EUID_ROOT(); |
238 | unlink(src); | 250 | unlink(src); // delete the temporary file |
251 | EUID_USER(); | ||
239 | } | 252 | } |
240 | 253 | ||
241 | // private mode (--private=homedir): | 254 | // private mode (--private=homedir): |
@@ -248,18 +261,18 @@ void fs_private_homedir(void) { | |||
248 | char *private_homedir = cfg.home_private; | 261 | char *private_homedir = cfg.home_private; |
249 | assert(homedir); | 262 | assert(homedir); |
250 | assert(private_homedir); | 263 | assert(private_homedir); |
264 | EUID_ASSERT(); | ||
265 | |||
266 | uid_t u = getuid(); | ||
267 | // gid_t g = getgid(); | ||
251 | 268 | ||
252 | int xflag = store_xauthority(); | 269 | int xflag = store_xauthority(); |
253 | int aflag = store_asoundrc(); | 270 | int aflag = store_asoundrc(); |
254 | 271 | ||
255 | uid_t u = getuid(); | ||
256 | gid_t g = getgid(); | ||
257 | |||
258 | // mount bind private_homedir on top of homedir | 272 | // mount bind private_homedir on top of homedir |
259 | if (arg_debug) | 273 | if (arg_debug) |
260 | printf("Mount-bind %s on top of %s\n", private_homedir, homedir); | 274 | printf("Mount-bind %s on top of %s\n", private_homedir, homedir); |
261 | // get file descriptors for homedir and private_homedir, fails if there is any symlink | 275 | // get file descriptors for homedir and private_homedir, fails if there is any symlink |
262 | EUID_USER(); | ||
263 | int src = safer_openat(-1, private_homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); | 276 | int src = safer_openat(-1, private_homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); |
264 | if (src == -1) | 277 | if (src == -1) |
265 | errExit("opening private directory"); | 278 | errExit("opening private directory"); |
@@ -287,6 +300,7 @@ void fs_private_homedir(void) { | |||
287 | EUID_ROOT(); | 300 | EUID_ROOT(); |
288 | if (bind_mount_by_fd(src, dst)) | 301 | if (bind_mount_by_fd(src, dst)) |
289 | errExit("mount bind"); | 302 | errExit("mount bind"); |
303 | EUID_USER(); | ||
290 | 304 | ||
291 | // check /proc/self/mountinfo to confirm the mount is ok | 305 | // check /proc/self/mountinfo to confirm the mount is ok |
292 | MountData *mptr = get_last_mount(); | 306 | MountData *mptr = get_last_mount(); |
@@ -305,6 +319,7 @@ void fs_private_homedir(void) { | |||
305 | // if (chmod(homedir, s.st_mode) == -1) | 319 | // if (chmod(homedir, s.st_mode) == -1) |
306 | // errExit("mount-bind chmod"); | 320 | // errExit("mount-bind chmod"); |
307 | 321 | ||
322 | EUID_ROOT(); | ||
308 | if (u != 0) { | 323 | if (u != 0) { |
309 | // mask /root | 324 | // mask /root |
310 | if (arg_debug) | 325 | if (arg_debug) |
@@ -323,8 +338,9 @@ void fs_private_homedir(void) { | |||
323 | selinux_relabel_path("/home", "/home"); | 338 | selinux_relabel_path("/home", "/home"); |
324 | fs_logger("tmpfs /home"); | 339 | fs_logger("tmpfs /home"); |
325 | } | 340 | } |
341 | EUID_USER(); | ||
326 | 342 | ||
327 | skel(homedir, u, g); | 343 | skel(homedir); |
328 | if (xflag) | 344 | if (xflag) |
329 | copy_xauthority(); | 345 | copy_xauthority(); |
330 | if (aflag) | 346 | if (aflag) |
@@ -339,12 +355,15 @@ void fs_private_homedir(void) { | |||
339 | void fs_private(void) { | 355 | void fs_private(void) { |
340 | char *homedir = cfg.homedir; | 356 | char *homedir = cfg.homedir; |
341 | assert(homedir); | 357 | assert(homedir); |
358 | EUID_ASSERT(); | ||
359 | |||
342 | uid_t u = getuid(); | 360 | uid_t u = getuid(); |
343 | gid_t g = getgid(); | 361 | gid_t g = getgid(); |
344 | 362 | ||
345 | int xflag = store_xauthority(); | 363 | int xflag = store_xauthority(); |
346 | int aflag = store_asoundrc(); | 364 | int aflag = store_asoundrc(); |
347 | 365 | ||
366 | EUID_ROOT(); | ||
348 | // mask /root | 367 | // mask /root |
349 | if (arg_debug) | 368 | if (arg_debug) |
350 | printf("Mounting a new /root directory\n"); | 369 | printf("Mounting a new /root directory\n"); |
@@ -376,19 +395,22 @@ void fs_private(void) { | |||
376 | } | 395 | } |
377 | if (chown(homedir, u, g) < 0) | 396 | if (chown(homedir, u, g) < 0) |
378 | errExit("chown"); | 397 | errExit("chown"); |
379 | |||
380 | fs_logger2("mkdir", homedir); | 398 | fs_logger2("mkdir", homedir); |
381 | fs_logger2("tmpfs", homedir); | 399 | fs_logger2("tmpfs", homedir); |
382 | } | 400 | } |
383 | else | 401 | else { |
384 | // mask user home directory | 402 | // mask user home directory |
385 | // the directory should be owned by the current user | 403 | // the directory should be owned by the current user |
404 | EUID_USER(); | ||
386 | fs_tmpfs(homedir, 1); | 405 | fs_tmpfs(homedir, 1); |
406 | EUID_ROOT(); | ||
407 | } | ||
387 | 408 | ||
388 | selinux_relabel_path(homedir, homedir); | 409 | selinux_relabel_path(homedir, homedir); |
389 | } | 410 | } |
411 | EUID_USER(); | ||
390 | 412 | ||
391 | skel(homedir, u, g); | 413 | skel(homedir); |
392 | if (xflag) | 414 | if (xflag) |
393 | copy_xauthority(); | 415 | copy_xauthority(); |
394 | if (aflag) | 416 | if (aflag) |
@@ -530,26 +552,30 @@ static void duplicate(char *name) { | |||
530 | // set skel files, | 552 | // set skel files, |
531 | // restore .Xauthority | 553 | // restore .Xauthority |
532 | void fs_private_home_list(void) { | 554 | void fs_private_home_list(void) { |
533 | timetrace_start(); | ||
534 | |||
535 | char *homedir = cfg.homedir; | 555 | char *homedir = cfg.homedir; |
536 | char *private_list = cfg.home_private_keep; | 556 | char *private_list = cfg.home_private_keep; |
537 | assert(homedir); | 557 | assert(homedir); |
538 | assert(private_list); | 558 | assert(private_list); |
559 | EUID_ASSERT(); | ||
539 | 560 | ||
540 | int xflag = store_xauthority(); | 561 | timetrace_start(); |
541 | int aflag = store_asoundrc(); | ||
542 | 562 | ||
543 | uid_t uid = getuid(); | 563 | uid_t uid = getuid(); |
544 | gid_t gid = getgid(); | 564 | gid_t gid = getgid(); |
545 | 565 | ||
566 | int xflag = store_xauthority(); | ||
567 | int aflag = store_asoundrc(); | ||
568 | |||
569 | EUID_ROOT(); | ||
546 | // create /run/firejail/mnt/home directory | 570 | // create /run/firejail/mnt/home directory |
547 | mkdir_attr(RUN_HOME_DIR, 0755, uid, gid); | 571 | mkdir_attr(RUN_HOME_DIR, 0755, uid, gid); |
548 | selinux_relabel_path(RUN_HOME_DIR, homedir); | 572 | selinux_relabel_path(RUN_HOME_DIR, homedir); |
549 | fs_logger_print(); // save the current log | ||
550 | 573 | ||
551 | // copy the list of files in the new home directory | 574 | // save the current log |
575 | fs_logger_print(); | ||
552 | EUID_USER(); | 576 | EUID_USER(); |
577 | |||
578 | // copy the list of files in the new home directory | ||
553 | if (arg_debug) | 579 | if (arg_debug) |
554 | printf("Copying files in the new home:\n"); | 580 | printf("Copying files in the new home:\n"); |
555 | char *dlist = strdup(cfg.home_private_keep); | 581 | char *dlist = strdup(cfg.home_private_keep); |
@@ -587,6 +613,7 @@ void fs_private_home_list(void) { | |||
587 | EUID_ROOT(); | 613 | EUID_ROOT(); |
588 | if (bind_mount_path_to_fd(RUN_HOME_DIR, fd)) | 614 | if (bind_mount_path_to_fd(RUN_HOME_DIR, fd)) |
589 | errExit("mount bind"); | 615 | errExit("mount bind"); |
616 | EUID_USER(); | ||
590 | close(fd); | 617 | close(fd); |
591 | 618 | ||
592 | // check /proc/self/mountinfo to confirm the mount is ok | 619 | // check /proc/self/mountinfo to confirm the mount is ok |
@@ -595,11 +622,7 @@ void fs_private_home_list(void) { | |||
595 | errLogExit("invalid private-home mount"); | 622 | errLogExit("invalid private-home mount"); |
596 | fs_logger2("tmpfs", homedir); | 623 | fs_logger2("tmpfs", homedir); |
597 | 624 | ||
598 | // mask RUN_HOME_DIR, it is writable and not noexec | 625 | EUID_ROOT(); |
599 | if (mount("tmpfs", RUN_HOME_DIR, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME, "mode=755,gid=0") < 0) | ||
600 | errExit("mounting tmpfs"); | ||
601 | fs_logger2("tmpfs", RUN_HOME_DIR); | ||
602 | |||
603 | if (uid != 0) { | 626 | if (uid != 0) { |
604 | // mask /root | 627 | // mask /root |
605 | if (arg_debug) | 628 | if (arg_debug) |
@@ -619,7 +642,12 @@ void fs_private_home_list(void) { | |||
619 | fs_logger("tmpfs /home"); | 642 | fs_logger("tmpfs /home"); |
620 | } | 643 | } |
621 | 644 | ||
622 | skel(homedir, uid, gid); | 645 | // mask RUN_HOME_DIR, it is writable and not noexec |
646 | if (mount("tmpfs", RUN_HOME_DIR, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME, "mode=755,gid=0") < 0) | ||
647 | errExit("mounting tmpfs"); | ||
648 | EUID_USER(); | ||
649 | |||
650 | skel(homedir); | ||
623 | if (xflag) | 651 | if (xflag) |
624 | copy_xauthority(); | 652 | copy_xauthority(); |
625 | if (aflag) | 653 | if (aflag) |
diff --git a/src/firejail/fs_hostname.c b/src/firejail/fs_hostname.c index 80046f7ae..7d320e90b 100644 --- a/src/firejail/fs_hostname.c +++ b/src/firejail/fs_hostname.c | |||
@@ -88,118 +88,11 @@ errexit: | |||
88 | exit(1); | 88 | exit(1); |
89 | } | 89 | } |
90 | 90 | ||
91 | void fs_resolvconf(void) { | ||
92 | if (cfg.dns1 == NULL && !any_dhcp()) | ||
93 | return; | ||
94 | |||
95 | if (arg_debug) | ||
96 | printf("mirroring /etc directory\n"); | ||
97 | if (mkdir(RUN_DNS_ETC, 0755)) | ||
98 | errExit("mkdir"); | ||
99 | selinux_relabel_path(RUN_DNS_ETC, "/etc"); | ||
100 | fs_logger("tmpfs /etc"); | ||
101 | |||
102 | DIR *dir = opendir("/etc"); | ||
103 | if (!dir) | ||
104 | errExit("opendir"); | ||
105 | |||
106 | struct stat s; | ||
107 | struct dirent *entry; | ||
108 | while ((entry = readdir(dir))) { | ||
109 | if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) | ||
110 | continue; | ||
111 | // for resolv.conf we create a brand new file | ||
112 | if (strcmp(entry->d_name, "resolv.conf") == 0 || | ||
113 | strcmp(entry->d_name, "resolv.conf.dhclient-new") == 0) | ||
114 | continue; | ||
115 | // printf("linking %s\n", entry->d_name); | ||
116 | |||
117 | char *src; | ||
118 | if (asprintf(&src, "/etc/%s", entry->d_name) == -1) | ||
119 | errExit("asprintf"); | ||
120 | if (stat(src, &s) != 0) { | ||
121 | free(src); | ||
122 | continue; | ||
123 | } | ||
124 | |||
125 | char *dest; | ||
126 | if (asprintf(&dest, "%s/%s", RUN_DNS_ETC, entry->d_name) == -1) | ||
127 | errExit("asprintf"); | ||
128 | |||
129 | int symlink_done = 0; | ||
130 | if (is_link(src)) { | ||
131 | char *rp =realpath(src, NULL); | ||
132 | if (rp == NULL) { | ||
133 | free(src); | ||
134 | free(dest); | ||
135 | continue; | ||
136 | } | ||
137 | if (symlink(rp, dest)) | ||
138 | errExit("symlink"); | ||
139 | else | ||
140 | symlink_done = 1; | ||
141 | } | ||
142 | else if (S_ISDIR(s.st_mode)) | ||
143 | create_empty_dir_as_root(dest, s.st_mode); | ||
144 | else | ||
145 | create_empty_file_as_root(dest, s.st_mode); | ||
146 | |||
147 | // bind-mount src on top of dest | ||
148 | if (!symlink_done) { | ||
149 | if (mount(src, dest, NULL, MS_BIND|MS_REC, NULL) < 0) | ||
150 | errExit("mount bind mirroring /etc"); | ||
151 | } | ||
152 | fs_logger2("clone", src); | ||
153 | |||
154 | free(src); | ||
155 | free(dest); | ||
156 | } | ||
157 | closedir(dir); | ||
158 | |||
159 | // mount bind our private etc directory on top of /etc | ||
160 | if (arg_debug) | ||
161 | printf("Mount-bind %s on top of /etc\n", RUN_DNS_ETC); | ||
162 | if (mount(RUN_DNS_ETC, "/etc", NULL, MS_BIND|MS_REC, NULL) < 0) | ||
163 | errExit("mount bind mirroring /etc"); | ||
164 | fs_logger("mount /etc"); | ||
165 | |||
166 | if (arg_debug) | ||
167 | printf("Creating a new /etc/resolv.conf file\n"); | ||
168 | FILE *fp = fopen("/etc/resolv.conf", "wxe"); | ||
169 | if (!fp) { | ||
170 | fprintf(stderr, "Error: cannot create /etc/resolv.conf file\n"); | ||
171 | exit(1); | ||
172 | } | ||
173 | |||
174 | if (cfg.dns1) { | ||
175 | if (any_dhcp()) | ||
176 | fwarning("network setup uses DHCP, nameservers will likely be overwritten\n"); | ||
177 | fprintf(fp, "nameserver %s\n", cfg.dns1); | ||
178 | } | ||
179 | if (cfg.dns2) | ||
180 | fprintf(fp, "nameserver %s\n", cfg.dns2); | ||
181 | if (cfg.dns3) | ||
182 | fprintf(fp, "nameserver %s\n", cfg.dns3); | ||
183 | if (cfg.dns4) | ||
184 | fprintf(fp, "nameserver %s\n", cfg.dns4); | ||
185 | |||
186 | // mode and owner | ||
187 | SET_PERMS_STREAM(fp, 0, 0, 0644); | ||
188 | |||
189 | fclose(fp); | ||
190 | |||
191 | fs_logger("create /etc/resolv.conf"); | ||
192 | } | ||
193 | |||
194 | char *fs_check_hosts_file(const char *fname) { | 91 | char *fs_check_hosts_file(const char *fname) { |
195 | assert(fname); | 92 | assert(fname); |
196 | invalid_filename(fname, 0); // no globbing | 93 | invalid_filename(fname, 0); // no globbing |
197 | char *rv = expand_macros(fname); | 94 | char *rv = expand_macros(fname); |
198 | 95 | ||
199 | // no a link | ||
200 | if (is_link(rv)) | ||
201 | goto errexit; | ||
202 | |||
203 | // the user has read access to the file | 96 | // the user has read access to the file |
204 | if (access(rv, R_OK)) | 97 | if (access(rv, R_OK)) |
205 | goto errexit; | 98 | goto errexit; |
@@ -222,9 +115,6 @@ void fs_mount_hosts_file(void) { | |||
222 | struct stat s; | 115 | struct stat s; |
223 | if (stat("/etc/hosts", &s) == -1) | 116 | if (stat("/etc/hosts", &s) == -1) |
224 | goto errexit; | 117 | goto errexit; |
225 | // not a link | ||
226 | if (is_link("/etc/hosts")) | ||
227 | goto errexit; | ||
228 | // owned by root | 118 | // owned by root |
229 | if (s.st_uid != 0) | 119 | if (s.st_uid != 0) |
230 | goto errexit; | 120 | goto errexit; |
diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c index 9d7a17cf3..848c186fa 100644 --- a/src/firejail/fs_lib.c +++ b/src/firejail/fs_lib.c | |||
@@ -195,6 +195,11 @@ void fslib_mount_libs(const char *full_path, unsigned user) { | |||
195 | assert(full_path); | 195 | assert(full_path); |
196 | // if library/executable does not exist or the user does not have read access to it | 196 | // if library/executable does not exist or the user does not have read access to it |
197 | // print a warning and exit the function. | 197 | // print a warning and exit the function. |
198 | if (access(full_path, F_OK)) { | ||
199 | if (arg_debug || arg_debug_private_lib) | ||
200 | printf("Cannot find %s, skipping...\n", full_path); | ||
201 | return; | ||
202 | } | ||
198 | if (user && access(full_path, R_OK)) { | 203 | if (user && access(full_path, R_OK)) { |
199 | if (arg_debug || arg_debug_private_lib) | 204 | if (arg_debug || arg_debug_private_lib) |
200 | printf("Cannot read %s, skipping...\n", full_path); | 205 | printf("Cannot read %s, skipping...\n", full_path); |
diff --git a/src/firejail/fs_lib2.c b/src/firejail/fs_lib2.c index c69bf7c98..a347b380c 100644 --- a/src/firejail/fs_lib2.c +++ b/src/firejail/fs_lib2.c | |||
@@ -143,7 +143,7 @@ static void fdir(void) { | |||
143 | NULL, | 143 | NULL, |
144 | }; | 144 | }; |
145 | 145 | ||
146 | // need to parse as root user, unprivileged users have no read permission on executables | 146 | // need to parse as root user, unprivileged users have no read permission on some of these binaries |
147 | int i; | 147 | int i; |
148 | for (i = 0; fbin[i]; i++) | 148 | for (i = 0; fbin[i]; i++) |
149 | fslib_mount_libs(fbin[i], 0); | 149 | fslib_mount_libs(fbin[i], 0); |
@@ -153,7 +153,9 @@ void fslib_install_firejail(void) { | |||
153 | timetrace_start(); | 153 | timetrace_start(); |
154 | // bring in firejail executable libraries, in case we are redirected here | 154 | // bring in firejail executable libraries, in case we are redirected here |
155 | // by a firejail symlink from /usr/local/bin/firejail | 155 | // by a firejail symlink from /usr/local/bin/firejail |
156 | fslib_mount_libs(PATH_FIREJAIL, 1); // parse as user | 156 | // fldd might have no read permission on the firejail executable |
157 | // parse as root in order to support these setups | ||
158 | fslib_mount_libs(PATH_FIREJAIL, 0); | ||
157 | 159 | ||
158 | // bring in firejail directory | 160 | // bring in firejail directory |
159 | fdir(); | 161 | fdir(); |
diff --git a/src/firejail/fs_mkdir.c b/src/firejail/fs_mkdir.c index bbc2aa938..4983db0a0 100644 --- a/src/firejail/fs_mkdir.c +++ b/src/firejail/fs_mkdir.c | |||
@@ -18,6 +18,7 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include "../include/gcov_wrapper.h" | ||
21 | #include <sys/types.h> | 22 | #include <sys/types.h> |
22 | #include <sys/stat.h> | 23 | #include <sys/stat.h> |
23 | #include <unistd.h> | 24 | #include <unistd.h> |
@@ -25,10 +26,6 @@ | |||
25 | #include <sys/wait.h> | 26 | #include <sys/wait.h> |
26 | #include <string.h> | 27 | #include <string.h> |
27 | 28 | ||
28 | #ifdef HAVE_GCOV | ||
29 | #include <gcov.h> | ||
30 | #endif | ||
31 | |||
32 | static void check(const char *fname) { | 29 | static void check(const char *fname) { |
33 | // manufacture /run/user directory | 30 | // manufacture /run/user directory |
34 | char *runuser; | 31 | char *runuser; |
@@ -98,9 +95,9 @@ void fs_mkdir(const char *name) { | |||
98 | 95 | ||
99 | // create directory | 96 | // create directory |
100 | mkdir_recursive(expanded); | 97 | mkdir_recursive(expanded); |
101 | #ifdef HAVE_GCOV | 98 | |
102 | __gcov_flush(); | 99 | __gcov_flush(); |
103 | #endif | 100 | |
104 | _exit(0); | 101 | _exit(0); |
105 | } | 102 | } |
106 | // wait for the child to finish | 103 | // wait for the child to finish |
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c index 370035a4d..7afebed1f 100644 --- a/src/firejail/fs_whitelist.c +++ b/src/firejail/fs_whitelist.c | |||
@@ -105,6 +105,7 @@ static int whitelist_mkpath(const char* path, mode_t mode) { | |||
105 | } | 105 | } |
106 | 106 | ||
107 | static void whitelist_file(int dirfd, const char *relpath, const char *path) { | 107 | static void whitelist_file(int dirfd, const char *relpath, const char *path) { |
108 | EUID_ASSERT(); | ||
108 | assert(relpath && path); | 109 | assert(relpath && path); |
109 | 110 | ||
110 | // open mount source, using a file descriptor that refers to the | 111 | // open mount source, using a file descriptor that refers to the |
@@ -130,12 +131,9 @@ static void whitelist_file(int dirfd, const char *relpath, const char *path) { | |||
130 | } | 131 | } |
131 | 132 | ||
132 | // create mount target as root, except if inside home or run/user/$UID directory | 133 | // create mount target as root, except if inside home or run/user/$UID directory |
133 | int userprivs = 0; | 134 | if ((strncmp(path, cfg.homedir, homedir_len) != 0 || path[homedir_len] != '/') && |
134 | if ((strncmp(path, cfg.homedir, homedir_len) == 0 && path[homedir_len] == '/') || | 135 | (strncmp(path, runuser, runuser_len) != 0 || path[runuser_len] != '/')) |
135 | (strncmp(path, runuser, runuser_len) == 0 && path[runuser_len] == '/')) { | 136 | EUID_ROOT(); |
136 | EUID_USER(); | ||
137 | userprivs = 1; | ||
138 | } | ||
139 | 137 | ||
140 | // create path of the mount target | 138 | // create path of the mount target |
141 | int fd2 = whitelist_mkpath(path, 0755); | 139 | int fd2 = whitelist_mkpath(path, 0755); |
@@ -146,8 +144,7 @@ static void whitelist_file(int dirfd, const char *relpath, const char *path) { | |||
146 | if (arg_debug || arg_debug_whitelists) | 144 | if (arg_debug || arg_debug_whitelists) |
147 | printf("Debug %d: skip whitelist %s\n", __LINE__, path); | 145 | printf("Debug %d: skip whitelist %s\n", __LINE__, path); |
148 | close(fd); | 146 | close(fd); |
149 | if (userprivs) | 147 | EUID_USER(); |
150 | EUID_ROOT(); | ||
151 | return; | 148 | return; |
152 | } | 149 | } |
153 | 150 | ||
@@ -166,8 +163,7 @@ static void whitelist_file(int dirfd, const char *relpath, const char *path) { | |||
166 | } | 163 | } |
167 | close(fd); | 164 | close(fd); |
168 | close(fd2); | 165 | close(fd2); |
169 | if (userprivs) | 166 | EUID_USER(); |
170 | EUID_ROOT(); | ||
171 | return; | 167 | return; |
172 | } | 168 | } |
173 | fd3 = openat(fd2, file, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); | 169 | fd3 = openat(fd2, file, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); |
@@ -184,19 +180,17 @@ static void whitelist_file(int dirfd, const char *relpath, const char *path) { | |||
184 | } | 180 | } |
185 | close(fd); | 181 | close(fd); |
186 | close(fd2); | 182 | close(fd2); |
187 | if (userprivs) | 183 | EUID_USER(); |
188 | EUID_ROOT(); | ||
189 | return; | 184 | return; |
190 | } | 185 | } |
191 | |||
192 | close(fd2); | 186 | close(fd2); |
193 | if (userprivs) | ||
194 | EUID_ROOT(); | ||
195 | 187 | ||
196 | if (arg_debug || arg_debug_whitelists) | 188 | if (arg_debug || arg_debug_whitelists) |
197 | printf("Whitelisting %s\n", path); | 189 | printf("Whitelisting %s\n", path); |
190 | EUID_ROOT(); | ||
198 | if (bind_mount_by_fd(fd, fd3)) | 191 | if (bind_mount_by_fd(fd, fd3)) |
199 | errExit("mount bind"); | 192 | errExit("mount bind"); |
193 | EUID_USER(); | ||
200 | // check the last mount operation | 194 | // check the last mount operation |
201 | MountData *mptr = get_last_mount(); // will do exit(1) if the mount cannot be found | 195 | MountData *mptr = get_last_mount(); // will do exit(1) if the mount cannot be found |
202 | #ifdef TEST_MOUNTINFO | 196 | #ifdef TEST_MOUNTINFO |
@@ -219,22 +213,19 @@ static void whitelist_file(int dirfd, const char *relpath, const char *path) { | |||
219 | } | 213 | } |
220 | 214 | ||
221 | static void whitelist_symlink(const char *link, const char *target) { | 215 | static void whitelist_symlink(const char *link, const char *target) { |
216 | EUID_ASSERT(); | ||
222 | assert(link && target); | 217 | assert(link && target); |
223 | 218 | ||
224 | // create files as root, except if inside home or run/user/$UID directory | 219 | // create files as root, except if inside home or run/user/$UID directory |
225 | int userprivs = 0; | 220 | if ((strncmp(link, cfg.homedir, homedir_len) != 0 || link[homedir_len] != '/') && |
226 | if ((strncmp(link, cfg.homedir, homedir_len) == 0 && link[homedir_len] == '/') || | 221 | (strncmp(link, runuser, runuser_len) != 0 || link[runuser_len] != '/')) |
227 | (strncmp(link, runuser, runuser_len) == 0 && link[runuser_len] == '/')) { | 222 | EUID_ROOT(); |
228 | EUID_USER(); | ||
229 | userprivs = 1; | ||
230 | } | ||
231 | 223 | ||
232 | int fd = whitelist_mkpath(link, 0755); | 224 | int fd = whitelist_mkpath(link, 0755); |
233 | if (fd == -1) { | 225 | if (fd == -1) { |
234 | if (arg_debug || arg_debug_whitelists) | 226 | if (arg_debug || arg_debug_whitelists) |
235 | printf("Debug %d: cannot create symbolic link %s\n", __LINE__, link); | 227 | printf("Debug %d: cannot create symbolic link %s\n", __LINE__, link); |
236 | if (userprivs) | 228 | EUID_USER(); |
237 | EUID_ROOT(); | ||
238 | return; | 229 | return; |
239 | } | 230 | } |
240 | 231 | ||
@@ -252,8 +243,7 @@ static void whitelist_symlink(const char *link, const char *target) { | |||
252 | printf("Created symbolic link %s -> %s\n", link, target); | 243 | printf("Created symbolic link %s -> %s\n", link, target); |
253 | 244 | ||
254 | close(fd); | 245 | close(fd); |
255 | if (userprivs) | 246 | EUID_USER(); |
256 | EUID_ROOT(); | ||
257 | } | 247 | } |
258 | 248 | ||
259 | static void globbing(const char *pattern) { | 249 | static void globbing(const char *pattern) { |
@@ -330,10 +320,11 @@ static void tmpfs_topdirs(const TopDir *topdirs) { | |||
330 | // init tmpfs | 320 | // init tmpfs |
331 | if (strcmp(topdirs[i].path, "/run") == 0) { | 321 | if (strcmp(topdirs[i].path, "/run") == 0) { |
332 | // restore /run/firejail directory | 322 | // restore /run/firejail directory |
333 | if (mkdir(RUN_FIREJAIL_DIR, 0755) == -1) | 323 | EUID_ROOT(); |
334 | errExit("mkdir"); | 324 | mkdir_attr(RUN_FIREJAIL_DIR, 0755, 0, 0); |
335 | if (bind_mount_fd_to_path(fd, RUN_FIREJAIL_DIR)) | 325 | if (bind_mount_fd_to_path(fd, RUN_FIREJAIL_DIR)) |
336 | errExit("mount bind"); | 326 | errExit("mount bind"); |
327 | EUID_USER(); | ||
337 | close(fd); | 328 | close(fd); |
338 | fs_logger2("whitelist", RUN_FIREJAIL_DIR); | 329 | fs_logger2("whitelist", RUN_FIREJAIL_DIR); |
339 | 330 | ||
@@ -351,12 +342,14 @@ static void tmpfs_topdirs(const TopDir *topdirs) { | |||
351 | errExit("asprintf"); | 342 | errExit("asprintf"); |
352 | if (strcmp(env, pamtmpdir) == 0) { | 343 | if (strcmp(env, pamtmpdir) == 0) { |
353 | // create empty user-owned /tmp/user/$UID directory | 344 | // create empty user-owned /tmp/user/$UID directory |
345 | EUID_ROOT(); | ||
354 | mkdir_attr("/tmp/user", 0711, 0, 0); | 346 | mkdir_attr("/tmp/user", 0711, 0, 0); |
355 | selinux_relabel_path("/tmp/user", "/tmp/user"); | 347 | selinux_relabel_path("/tmp/user", "/tmp/user"); |
356 | fs_logger("mkdir /tmp/user"); | 348 | fs_logger("mkdir /tmp/user"); |
357 | mkdir_attr(pamtmpdir, 0700, getuid(), 0); | 349 | mkdir_attr(pamtmpdir, 0700, getuid(), 0); |
358 | selinux_relabel_path(pamtmpdir, pamtmpdir); | 350 | selinux_relabel_path(pamtmpdir, pamtmpdir); |
359 | fs_logger2("mkdir", pamtmpdir); | 351 | fs_logger2("mkdir", pamtmpdir); |
352 | EUID_USER(); | ||
360 | } | 353 | } |
361 | free(pamtmpdir); | 354 | free(pamtmpdir); |
362 | } | 355 | } |
@@ -375,8 +368,7 @@ static void tmpfs_topdirs(const TopDir *topdirs) { | |||
375 | 368 | ||
376 | // user home directory | 369 | // user home directory |
377 | if (tmpfs_home) | 370 | if (tmpfs_home) |
378 | // checks owner if outside /home | 371 | fs_private(); // checks owner if outside /home |
379 | fs_private(); | ||
380 | 372 | ||
381 | // /run/user/$UID directory | 373 | // /run/user/$UID directory |
382 | if (tmpfs_runuser) { | 374 | if (tmpfs_runuser) { |
@@ -400,6 +392,7 @@ static int reject_topdir(const char *dir) { | |||
400 | // keep track of whitelist top level directories by adding them to an array | 392 | // keep track of whitelist top level directories by adding them to an array |
401 | // open each directory | 393 | // open each directory |
402 | static TopDir *add_topdir(const char *dir, TopDir *topdirs, const char *path) { | 394 | static TopDir *add_topdir(const char *dir, TopDir *topdirs, const char *path) { |
395 | EUID_ASSERT(); | ||
403 | assert(dir && path); | 396 | assert(dir && path); |
404 | 397 | ||
405 | // /proc and /sys are not allowed | 398 | // /proc and /sys are not allowed |
@@ -514,6 +507,8 @@ static char *extract_topdir(const char *path) { | |||
514 | } | 507 | } |
515 | 508 | ||
516 | void fs_whitelist(void) { | 509 | void fs_whitelist(void) { |
510 | EUID_ASSERT(); | ||
511 | |||
517 | ProfileEntry *entry = cfg.profile; | 512 | ProfileEntry *entry = cfg.profile; |
518 | if (!entry) | 513 | if (!entry) |
519 | return; | 514 | return; |
@@ -534,7 +529,6 @@ void fs_whitelist(void) { | |||
534 | errExit("calloc"); | 529 | errExit("calloc"); |
535 | 530 | ||
536 | // verify whitelist files, extract symbolic links, etc. | 531 | // verify whitelist files, extract symbolic links, etc. |
537 | EUID_USER(); | ||
538 | while (entry) { | 532 | while (entry) { |
539 | int nowhitelist_flag = 0; | 533 | int nowhitelist_flag = 0; |
540 | 534 | ||
@@ -628,7 +622,7 @@ void fs_whitelist(void) { | |||
628 | if (!fname) { | 622 | if (!fname) { |
629 | if (arg_debug || arg_debug_whitelists) { | 623 | if (arg_debug || arg_debug_whitelists) { |
630 | printf("Removed path: %s\n", entry->data); | 624 | printf("Removed path: %s\n", entry->data); |
631 | printf("\texpanded: %s\n", new_name); | 625 | printf("\tnew_name: %s\n", new_name); |
632 | printf("\trealpath: (null)\n"); | 626 | printf("\trealpath: (null)\n"); |
633 | printf("\t%s\n", strerror(errno)); | 627 | printf("\t%s\n", strerror(errno)); |
634 | } | 628 | } |
@@ -710,7 +704,6 @@ void fs_whitelist(void) { | |||
710 | free(nowhitelist); | 704 | free(nowhitelist); |
711 | 705 | ||
712 | // mount tmpfs on all top level directories | 706 | // mount tmpfs on all top level directories |
713 | EUID_ROOT(); | ||
714 | tmpfs_topdirs(topdirs); | 707 | tmpfs_topdirs(topdirs); |
715 | 708 | ||
716 | // go through profile rules again, and interpret whitelist commands | 709 | // go through profile rules again, and interpret whitelist commands |
diff --git a/src/firejail/ids.c b/src/firejail/ids.c new file mode 100644 index 000000000..a9ff59be4 --- /dev/null +++ b/src/firejail/ids.c | |||
@@ -0,0 +1,89 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014-2021 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #include "firejail.h" | ||
21 | #include <sys/types.h> | ||
22 | #include <sys/stat.h> | ||
23 | #include <fcntl.h> | ||
24 | |||
25 | |||
26 | static void ids_init(void) { | ||
27 | // store checksums as root in /var/lib/firejail/${USERNAME}.ids | ||
28 | char *fname; | ||
29 | if (asprintf(&fname, VARDIR"/%s.ids", cfg.username) == -1) | ||
30 | errExit("asprintf"); | ||
31 | |||
32 | int rv = unlink(fname); | ||
33 | (void) rv; | ||
34 | int fd = open(fname, O_CREAT | O_TRUNC | O_WRONLY, 0600); | ||
35 | if (fd < 0) { | ||
36 | fprintf(stderr, "Error: cannot create %s\n", fname); | ||
37 | exit(1); | ||
38 | } | ||
39 | |||
40 | // redirect output | ||
41 | close(STDOUT_FILENO); | ||
42 | if (dup(fd) != STDOUT_FILENO) | ||
43 | errExit("dup"); | ||
44 | close(fd); | ||
45 | |||
46 | sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3, PATH_FIDS, "--init", cfg.homedir); | ||
47 | } | ||
48 | |||
49 | static void ids_check(void) { | ||
50 | // store checksums as root in /var/lib/firejail/${USERNAME}.ids | ||
51 | char *fname; | ||
52 | if (asprintf(&fname, VARDIR"/%s.ids", cfg.username) == -1) | ||
53 | errExit("asprintf"); | ||
54 | |||
55 | int fd = open(fname, O_RDONLY); | ||
56 | if (fd < 0) { | ||
57 | fprintf(stderr, "Error: cannot open %s\n", fname); | ||
58 | exit(1); | ||
59 | } | ||
60 | |||
61 | // redirect input | ||
62 | close(STDIN_FILENO); | ||
63 | if (dup(fd) != STDIN_FILENO) | ||
64 | errExit("dup"); | ||
65 | close(fd); | ||
66 | |||
67 | sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP| SBOX_ALLOW_STDIN, 3, PATH_FIDS, "--check", cfg.homedir); | ||
68 | } | ||
69 | |||
70 | void run_ids(int argc, char **argv) { | ||
71 | if (argc != 2) { | ||
72 | fprintf(stderr, "Error: only one IDS command expected\n"); | ||
73 | exit(1); | ||
74 | } | ||
75 | |||
76 | EUID_ROOT(); | ||
77 | struct stat s; | ||
78 | if (stat(VARDIR, &s)) // /var/lib/firejail | ||
79 | create_empty_dir_as_root(VARDIR, 0700); | ||
80 | |||
81 | if (strcmp(argv[1], "--ids-init") == 0) | ||
82 | ids_init(); | ||
83 | else if (strcmp(argv[1], "--ids-check") == 0) | ||
84 | ids_check(); | ||
85 | else | ||
86 | fprintf(stderr, "Error: unrecognized IDS command\n"); | ||
87 | |||
88 | exit(0); | ||
89 | } | ||
diff --git a/src/firejail/join.c b/src/firejail/join.c index 394bbb528..a869f6b64 100644 --- a/src/firejail/join.c +++ b/src/firejail/join.c | |||
@@ -45,7 +45,7 @@ static unsigned display = 0; | |||
45 | static void signal_handler(int sig){ | 45 | static void signal_handler(int sig){ |
46 | flush_stdin(); | 46 | flush_stdin(); |
47 | 47 | ||
48 | exit(sig); | 48 | exit(128 + sig); |
49 | } | 49 | } |
50 | 50 | ||
51 | static void install_handler(void) { | 51 | static void install_handler(void) { |
@@ -536,7 +536,6 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
536 | prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); | 536 | prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); |
537 | 537 | ||
538 | #ifdef HAVE_APPARMOR | 538 | #ifdef HAVE_APPARMOR |
539 | // add apparmor confinement after the execve | ||
540 | set_apparmor(); | 539 | set_apparmor(); |
541 | #endif | 540 | #endif |
542 | 541 | ||
@@ -552,10 +551,6 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
552 | if (cfg.cpus) // not available for uid 0 | 551 | if (cfg.cpus) // not available for uid 0 |
553 | set_cpu_affinity(); | 552 | set_cpu_affinity(); |
554 | 553 | ||
555 | // set nice value | ||
556 | if (arg_nice) | ||
557 | set_nice(cfg.nice); | ||
558 | |||
559 | // add x11 display | 554 | // add x11 display |
560 | if (display) { | 555 | if (display) { |
561 | char *display_str; | 556 | char *display_str; |
@@ -574,6 +569,11 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
574 | dbus_set_system_bus_env(); | 569 | dbus_set_system_bus_env(); |
575 | #endif | 570 | #endif |
576 | 571 | ||
572 | // set nice and rlimits | ||
573 | if (arg_nice) | ||
574 | set_nice(cfg.nice); | ||
575 | set_rlimits(); | ||
576 | |||
577 | start_application(0, shfd, NULL); | 577 | start_application(0, shfd, NULL); |
578 | 578 | ||
579 | __builtin_unreachable(); | 579 | __builtin_unreachable(); |
@@ -596,15 +596,17 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
596 | 596 | ||
597 | // end of signal-safe code | 597 | // end of signal-safe code |
598 | //***************************** | 598 | //***************************** |
599 | flush_stdin(); | ||
600 | 599 | ||
601 | if (WIFEXITED(status)) { | 600 | if (WIFEXITED(status)) { |
601 | // if we had a proper exit, return that exit status | ||
602 | status = WEXITSTATUS(status); | 602 | status = WEXITSTATUS(status); |
603 | } else if (WIFSIGNALED(status)) { | 603 | } else if (WIFSIGNALED(status)) { |
604 | status = WTERMSIG(status); | 604 | // distinguish fatal signals by adding 128 |
605 | status = 128 + WTERMSIG(status); | ||
605 | } else { | 606 | } else { |
606 | status = 0; | 607 | status = -1; |
607 | } | 608 | } |
608 | 609 | ||
610 | flush_stdin(); | ||
609 | exit(status); | 611 | exit(status); |
610 | } | 612 | } |
diff --git a/src/firejail/ls.c b/src/firejail/ls.c index 6ee557648..70985ba9e 100644 --- a/src/firejail/ls.c +++ b/src/firejail/ls.c | |||
@@ -19,6 +19,7 @@ | |||
19 | */ | 19 | */ |
20 | 20 | ||
21 | #include "firejail.h" | 21 | #include "firejail.h" |
22 | #include "../include/gcov_wrapper.h" | ||
22 | #include <sys/types.h> | 23 | #include <sys/types.h> |
23 | #include <sys/stat.h> | 24 | #include <sys/stat.h> |
24 | #include <sys/wait.h> | 25 | #include <sys/wait.h> |
@@ -31,10 +32,6 @@ | |||
31 | //#include <stdio.h> | 32 | //#include <stdio.h> |
32 | //#include <stdlib.h> | 33 | //#include <stdlib.h> |
33 | 34 | ||
34 | #ifdef HAVE_GCOV | ||
35 | #include <gcov.h> | ||
36 | #endif | ||
37 | |||
38 | // uid/gid cache | 35 | // uid/gid cache |
39 | static uid_t c_uid = 0; | 36 | static uid_t c_uid = 0; |
40 | static char *c_uid_name = NULL; | 37 | static char *c_uid_name = NULL; |
@@ -353,9 +350,8 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) { | |||
353 | ls(fname1); | 350 | ls(fname1); |
354 | else | 351 | else |
355 | cat(fname1); | 352 | cat(fname1); |
356 | #ifdef HAVE_GCOV | 353 | |
357 | __gcov_flush(); | 354 | __gcov_flush(); |
358 | #endif | ||
359 | } | 355 | } |
360 | // get file from host and store it in the sandbox | 356 | // get file from host and store it in the sandbox |
361 | else if (op == SANDBOX_FS_PUT && path2) { | 357 | else if (op == SANDBOX_FS_PUT && path2) { |
@@ -387,9 +383,9 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) { | |||
387 | // copy the file | 383 | // copy the file |
388 | if (copy_file(src_fname, tmp_fname, getuid(), getgid(), 0600)) // already a regular user | 384 | if (copy_file(src_fname, tmp_fname, getuid(), getgid(), 0600)) // already a regular user |
389 | _exit(1); | 385 | _exit(1); |
390 | #ifdef HAVE_GCOV | 386 | |
391 | __gcov_flush(); | 387 | __gcov_flush(); |
392 | #endif | 388 | |
393 | _exit(0); | 389 | _exit(0); |
394 | } | 390 | } |
395 | 391 | ||
@@ -419,9 +415,9 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) { | |||
419 | // copy the file | 415 | // copy the file |
420 | if (copy_file(tmp_fname, dest_fname, getuid(), getgid(), 0600)) // already a regular user | 416 | if (copy_file(tmp_fname, dest_fname, getuid(), getgid(), 0600)) // already a regular user |
421 | _exit(1); | 417 | _exit(1); |
422 | #ifdef HAVE_GCOV | 418 | |
423 | __gcov_flush(); | 419 | __gcov_flush(); |
424 | #endif | 420 | |
425 | _exit(0); | 421 | _exit(0); |
426 | } | 422 | } |
427 | 423 | ||
diff --git a/src/firejail/main.c b/src/firejail/main.c index b376095f1..81d148257 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -20,6 +20,7 @@ | |||
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include "../include/pid.h" | 21 | #include "../include/pid.h" |
22 | #include "../include/firejail_user.h" | 22 | #include "../include/firejail_user.h" |
23 | #include "../include/gcov_wrapper.h" | ||
23 | #include "../include/syscall.h" | 24 | #include "../include/syscall.h" |
24 | #include "../include/seccomp.h" | 25 | #include "../include/seccomp.h" |
25 | #define _GNU_SOURCE | 26 | #define _GNU_SOURCE |
@@ -44,10 +45,6 @@ | |||
44 | #define O_PATH 010000000 | 45 | #define O_PATH 010000000 |
45 | #endif | 46 | #endif |
46 | 47 | ||
47 | #ifdef HAVE_GCOV | ||
48 | #include <gcov.h> | ||
49 | #endif | ||
50 | |||
51 | #ifdef __ia64__ | 48 | #ifdef __ia64__ |
52 | /* clone(2) has a different interface on ia64, as it needs to know | 49 | /* clone(2) has a different interface on ia64, as it needs to know |
53 | the size of the stack */ | 50 | the size of the stack */ |
@@ -192,13 +189,15 @@ static void my_handler(int s) { | |||
192 | logsignal(s); | 189 | logsignal(s); |
193 | 190 | ||
194 | if (waitpid(child, NULL, WNOHANG) == 0) { | 191 | if (waitpid(child, NULL, WNOHANG) == 0) { |
195 | if (has_handler(child, s)) // signals are not delivered if there is no handler yet | 192 | // child is pid 1 of a pid namespace: |
193 | // signals are not delivered if there is no handler yet | ||
194 | if (has_handler(child, s)) | ||
196 | kill(child, s); | 195 | kill(child, s); |
197 | else | 196 | else |
198 | kill(child, SIGKILL); | 197 | kill(child, SIGKILL); |
199 | waitpid(child, NULL, 0); | 198 | waitpid(child, NULL, 0); |
200 | } | 199 | } |
201 | myexit(s); | 200 | myexit(128 + s); |
202 | } | 201 | } |
203 | 202 | ||
204 | static void install_handler(void) { | 203 | static void install_handler(void) { |
@@ -939,8 +938,8 @@ static void run_builder(int argc, char **argv) { | |||
939 | assert(getenv("LD_PRELOAD") == NULL); | 938 | assert(getenv("LD_PRELOAD") == NULL); |
940 | umask(orig_umask); | 939 | umask(orig_umask); |
941 | 940 | ||
942 | // restore some environment variables | 941 | // restore original environment variables |
943 | env_apply_whitelist_sbox(); | 942 | env_apply_all(); |
944 | 943 | ||
945 | argv[0] = LIBDIR "/firejail/fbuilder"; | 944 | argv[0] = LIBDIR "/firejail/fbuilder"; |
946 | execvp(argv[0], argv); | 945 | execvp(argv[0], argv); |
@@ -967,7 +966,7 @@ void filter_add_blacklist_override(int fd, int syscall, int arg, void *ptrarg, b | |||
967 | static int check_postexec(const char *list) { | 966 | static int check_postexec(const char *list) { |
968 | char *prelist, *postlist; | 967 | char *prelist, *postlist; |
969 | 968 | ||
970 | if (list) { | 969 | if (list && list[0]) { |
971 | syscalls_in_list(list, "@default-keep", -1, &prelist, &postlist, true); | 970 | syscalls_in_list(list, "@default-keep", -1, &prelist, &postlist, true); |
972 | if (postlist) | 971 | if (postlist) |
973 | return 1; | 972 | return 1; |
@@ -988,24 +987,16 @@ int main(int argc, char **argv, char **envp) { | |||
988 | int arg_caps_cmdline = 0; // caps requested on command line (used to break out of --chroot) | 987 | int arg_caps_cmdline = 0; // caps requested on command line (used to break out of --chroot) |
989 | char **ptr; | 988 | char **ptr; |
990 | 989 | ||
991 | #ifndef HAVE_SUID | ||
992 | if (geteuid() != 0) { | ||
993 | fprintf(stderr, "Error: Firejail needs to be SUID.\n"); | ||
994 | fprintf(stderr, "Assuming firejail is installed in /usr/bin, execute the following command as root:\n"); | ||
995 | fprintf(stderr, " chmod u+s /usr/bin/firejail\n"); | ||
996 | } | ||
997 | #endif | ||
998 | |||
999 | // sanitize the umask | 990 | // sanitize the umask |
1000 | orig_umask = umask(022); | 991 | orig_umask = umask(022); |
1001 | 992 | ||
1002 | // check standard streams before printing anything | ||
1003 | fix_std_streams(); | ||
1004 | |||
1005 | // drop permissions by default and rise them when required | 993 | // drop permissions by default and rise them when required |
1006 | EUID_INIT(); | 994 | EUID_INIT(); |
1007 | EUID_USER(); | 995 | EUID_USER(); |
1008 | 996 | ||
997 | // check standard streams before opening any file | ||
998 | fix_std_streams(); | ||
999 | |||
1009 | // argument count should be larger than 0 | 1000 | // argument count should be larger than 0 |
1010 | if (argc == 0 || !argv || strlen(argv[0]) == 0) { | 1001 | if (argc == 0 || !argv || strlen(argv[0]) == 0) { |
1011 | fprintf(stderr, "Error: argv is invalid\n"); | 1002 | fprintf(stderr, "Error: argv is invalid\n"); |
@@ -1015,16 +1006,6 @@ int main(int argc, char **argv, char **envp) { | |||
1015 | exit(1); | 1006 | exit(1); |
1016 | } | 1007 | } |
1017 | 1008 | ||
1018 | // Stash environment variables | ||
1019 | for (i = 0, ptr = envp; ptr && *ptr && i < MAX_ENVS; i++, ptr++) | ||
1020 | env_store(*ptr, SETENV); | ||
1021 | |||
1022 | // sanity check for environment variables | ||
1023 | if (i >= MAX_ENVS) { | ||
1024 | fprintf(stderr, "Error: too many environment variables\n"); | ||
1025 | exit(1); | ||
1026 | } | ||
1027 | |||
1028 | // sanity check for arguments | 1009 | // sanity check for arguments |
1029 | for (i = 0; i < argc; i++) { | 1010 | for (i = 0; i < argc; i++) { |
1030 | if (*argv[i] == 0) { | 1011 | if (*argv[i] == 0) { |
@@ -1037,82 +1018,29 @@ int main(int argc, char **argv, char **envp) { | |||
1037 | } | 1018 | } |
1038 | } | 1019 | } |
1039 | 1020 | ||
1021 | // Stash environment variables | ||
1022 | for (i = 0, ptr = envp; ptr && *ptr && i < MAX_ENVS; i++, ptr++) | ||
1023 | env_store(*ptr, SETENV); | ||
1024 | |||
1025 | // sanity check for environment variables | ||
1026 | if (i >= MAX_ENVS) { | ||
1027 | fprintf(stderr, "Error: too many environment variables\n"); | ||
1028 | exit(1); | ||
1029 | } | ||
1030 | |||
1040 | // Reapply a minimal set of environment variables | 1031 | // Reapply a minimal set of environment variables |
1041 | env_apply_whitelist(); | 1032 | env_apply_whitelist(); |
1042 | 1033 | ||
1043 | // check if the user is allowed to use firejail | 1034 | // process --quiet |
1044 | init_cfg(argc, argv); | ||
1045 | |||
1046 | // get starting timestamp, process --quiet | ||
1047 | timetrace_start(); | ||
1048 | const char *env_quiet = env_get("FIREJAIL_QUIET"); | 1035 | const char *env_quiet = env_get("FIREJAIL_QUIET"); |
1049 | if (check_arg(argc, argv, "--quiet", 1) || (env_quiet && strcmp(env_quiet, "yes") == 0)) | 1036 | if (check_arg(argc, argv, "--quiet", 1) || (env_quiet && strcmp(env_quiet, "yes") == 0)) |
1050 | arg_quiet = 1; | 1037 | arg_quiet = 1; |
1051 | 1038 | ||
1052 | // cleanup at exit | 1039 | // check if the user is allowed to use firejail |
1053 | EUID_ROOT(); | 1040 | init_cfg(argc, argv); |
1054 | atexit(clear_atexit); | ||
1055 | |||
1056 | // build /run/firejail directory structure | ||
1057 | preproc_build_firejail_dir(); | ||
1058 | const char *container_name = env_get("container"); | ||
1059 | if (!container_name || strcmp(container_name, "firejail")) { | ||
1060 | lockfd_directory = open(RUN_DIRECTORY_LOCK_FILE, O_WRONLY | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR); | ||
1061 | if (lockfd_directory != -1) { | ||
1062 | int rv = fchown(lockfd_directory, 0, 0); | ||
1063 | (void) rv; | ||
1064 | flock(lockfd_directory, LOCK_EX); | ||
1065 | } | ||
1066 | preproc_clean_run(); | ||
1067 | flock(lockfd_directory, LOCK_UN); | ||
1068 | close(lockfd_directory); | ||
1069 | } | ||
1070 | EUID_USER(); | ||
1071 | |||
1072 | // --ip=dhcp - we need access to /sbin and /usr/sbin directories in order to run ISC DHCP client (dhclient) | ||
1073 | // these paths are disabled in disable-common.inc | ||
1074 | if ((i = check_arg(argc, argv, "--ip", 0)) != 0) { | ||
1075 | if (strncmp(argv[i] + 4, "=dhcp", 5) == 0) { | ||
1076 | profile_add("noblacklist /sbin"); | ||
1077 | profile_add("noblacklist /usr/sbin"); | ||
1078 | } | ||
1079 | } | ||
1080 | |||
1081 | // for appimages we need to remove "include disable-shell.inc from the profile | ||
1082 | // a --profile command can show up before --appimage | ||
1083 | if (check_arg(argc, argv, "--appimage", 1)) | ||
1084 | arg_appimage = 1; | ||
1085 | |||
1086 | // process allow-debuggers | ||
1087 | if (check_arg(argc, argv, "--allow-debuggers", 1)) { | ||
1088 | // check kernel version | ||
1089 | struct utsname u; | ||
1090 | int rv = uname(&u); | ||
1091 | if (rv != 0) | ||
1092 | errExit("uname"); | ||
1093 | int major; | ||
1094 | int minor; | ||
1095 | if (2 != sscanf(u.release, "%d.%d", &major, &minor)) { | ||
1096 | fprintf(stderr, "Error: cannot extract Linux kernel version: %s\n", u.version); | ||
1097 | exit(1); | ||
1098 | } | ||
1099 | if (major < 4 || (major == 4 && minor < 8)) { | ||
1100 | fprintf(stderr, "Error: --allow-debuggers is disabled on Linux kernels prior to 4.8. " | ||
1101 | "A bug in ptrace call allows a full bypass of the seccomp filter. " | ||
1102 | "Your current kernel version is %d.%d.\n", major, minor); | ||
1103 | exit(1); | ||
1104 | } | ||
1105 | |||
1106 | arg_allow_debuggers = 1; | ||
1107 | char *cmd = strdup("noblacklist ${PATH}/strace"); | ||
1108 | if (!cmd) | ||
1109 | errExit("strdup"); | ||
1110 | profile_add(cmd); | ||
1111 | } | ||
1112 | 1041 | ||
1113 | // profile builder | 1042 | // get starting timestamp |
1114 | if (check_arg(argc, argv, "--build", 0)) // supports both --build and --build=filename | 1043 | timetrace_start(); |
1115 | run_builder(argc, argv); // this function will not return | ||
1116 | 1044 | ||
1117 | // check argv[0] symlink wrapper if this is not a login shell | 1045 | // check argv[0] symlink wrapper if this is not a login shell |
1118 | if (*argv[0] != '-') | 1046 | if (*argv[0] != '-') |
@@ -1137,15 +1065,44 @@ int main(int argc, char **argv, char **envp) { | |||
1137 | __builtin_unreachable(); | 1065 | __builtin_unreachable(); |
1138 | } | 1066 | } |
1139 | } | 1067 | } |
1140 | EUID_ASSERT(); | ||
1141 | 1068 | ||
1069 | // profile builder | ||
1070 | if (check_arg(argc, argv, "--build", 0)) // supports both --build and --build=filename | ||
1071 | run_builder(argc, argv); // this function will not return | ||
1072 | |||
1073 | // intrusion detection system | ||
1074 | if (check_arg(argc, argv, "--ids-", 0)) // supports both --ids-init and --ids-check | ||
1075 | run_ids(argc, argv); // this function will not return | ||
1142 | 1076 | ||
1143 | // check firejail directories | ||
1144 | EUID_ROOT(); | 1077 | EUID_ROOT(); |
1145 | delete_run_files(sandbox_pid); | 1078 | #ifndef HAVE_SUID |
1079 | if (geteuid() != 0) { | ||
1080 | fprintf(stderr, "Error: Firejail needs to be SUID.\n"); | ||
1081 | fprintf(stderr, "Assuming firejail is installed in /usr/bin, execute the following command as root:\n"); | ||
1082 | fprintf(stderr, " chmod u+s /usr/bin/firejail\n"); | ||
1083 | } | ||
1084 | #endif | ||
1085 | |||
1086 | // build /run/firejail directory structure | ||
1087 | preproc_build_firejail_dir(); | ||
1088 | const char *container_name = env_get("container"); | ||
1089 | if (!container_name || strcmp(container_name, "firejail")) { | ||
1090 | lockfd_directory = open(RUN_DIRECTORY_LOCK_FILE, O_WRONLY | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR); | ||
1091 | if (lockfd_directory != -1) { | ||
1092 | int rv = fchown(lockfd_directory, 0, 0); | ||
1093 | (void) rv; | ||
1094 | flock(lockfd_directory, LOCK_EX); | ||
1095 | } | ||
1096 | preproc_clean_run(); | ||
1097 | flock(lockfd_directory, LOCK_UN); | ||
1098 | close(lockfd_directory); | ||
1099 | } | ||
1100 | |||
1101 | delete_run_files(getpid()); | ||
1102 | atexit(clear_atexit); | ||
1146 | EUID_USER(); | 1103 | EUID_USER(); |
1147 | 1104 | ||
1148 | //check if the parent is sshd daemon | 1105 | // check if the parent is sshd daemon |
1149 | int parent_sshd = 0; | 1106 | int parent_sshd = 0; |
1150 | { | 1107 | { |
1151 | pid_t ppid = getppid(); | 1108 | pid_t ppid = getppid(); |
@@ -1202,7 +1159,8 @@ int main(int argc, char **argv, char **envp) { | |||
1202 | } | 1159 | } |
1203 | EUID_ASSERT(); | 1160 | EUID_ASSERT(); |
1204 | 1161 | ||
1205 | // is this a login shell, or a command passed by sshd, insert command line options from /etc/firejail/login.users | 1162 | // is this a login shell, or a command passed by sshd, |
1163 | // insert command line options from /etc/firejail/login.users | ||
1206 | if (*argv[0] == '-' || parent_sshd) { | 1164 | if (*argv[0] == '-' || parent_sshd) { |
1207 | if (argc == 1) | 1165 | if (argc == 1) |
1208 | login_shell = 1; | 1166 | login_shell = 1; |
@@ -1254,6 +1212,47 @@ int main(int argc, char **argv, char **envp) { | |||
1254 | #endif | 1212 | #endif |
1255 | EUID_ASSERT(); | 1213 | EUID_ASSERT(); |
1256 | 1214 | ||
1215 | // --ip=dhcp - we need access to /sbin and /usr/sbin directories in order to run ISC DHCP client (dhclient) | ||
1216 | // these paths are disabled in disable-common.inc | ||
1217 | if ((i = check_arg(argc, argv, "--ip", 0)) != 0) { | ||
1218 | if (strncmp(argv[i] + 4, "=dhcp", 5) == 0) { | ||
1219 | profile_add("noblacklist /sbin"); | ||
1220 | profile_add("noblacklist /usr/sbin"); | ||
1221 | } | ||
1222 | } | ||
1223 | |||
1224 | // process allow-debuggers | ||
1225 | if (check_arg(argc, argv, "--allow-debuggers", 1)) { | ||
1226 | // check kernel version | ||
1227 | struct utsname u; | ||
1228 | int rv = uname(&u); | ||
1229 | if (rv != 0) | ||
1230 | errExit("uname"); | ||
1231 | int major; | ||
1232 | int minor; | ||
1233 | if (2 != sscanf(u.release, "%d.%d", &major, &minor)) { | ||
1234 | fprintf(stderr, "Error: cannot extract Linux kernel version: %s\n", u.version); | ||
1235 | exit(1); | ||
1236 | } | ||
1237 | if (major < 4 || (major == 4 && minor < 8)) { | ||
1238 | fprintf(stderr, "Error: --allow-debuggers is disabled on Linux kernels prior to 4.8. " | ||
1239 | "A bug in ptrace call allows a full bypass of the seccomp filter. " | ||
1240 | "Your current kernel version is %d.%d.\n", major, minor); | ||
1241 | exit(1); | ||
1242 | } | ||
1243 | |||
1244 | arg_allow_debuggers = 1; | ||
1245 | char *cmd = strdup("noblacklist ${PATH}/strace"); | ||
1246 | if (!cmd) | ||
1247 | errExit("strdup"); | ||
1248 | profile_add(cmd); | ||
1249 | } | ||
1250 | |||
1251 | // for appimages we need to remove "include disable-shell.inc from the profile | ||
1252 | // a --profile command can show up before --appimage | ||
1253 | if (check_arg(argc, argv, "--appimage", 1)) | ||
1254 | arg_appimage = 1; | ||
1255 | |||
1257 | // check for force-nonewprivs in /etc/firejail/firejail.config file | 1256 | // check for force-nonewprivs in /etc/firejail/firejail.config file |
1258 | if (checkcfg(CFG_FORCE_NONEWPRIVS)) | 1257 | if (checkcfg(CFG_FORCE_NONEWPRIVS)) |
1259 | arg_nonewprivs = 1; | 1258 | arg_nonewprivs = 1; |
@@ -1568,6 +1567,8 @@ int main(int argc, char **argv, char **envp) { | |||
1568 | profile_check_line(line, 0, NULL); // will exit if something wrong | 1567 | profile_check_line(line, 0, NULL); // will exit if something wrong |
1569 | profile_add(line); | 1568 | profile_add(line); |
1570 | } | 1569 | } |
1570 | |||
1571 | // blacklist/deny | ||
1571 | else if (strncmp(argv[i], "--blacklist=", 12) == 0) { | 1572 | else if (strncmp(argv[i], "--blacklist=", 12) == 0) { |
1572 | char *line; | 1573 | char *line; |
1573 | if (asprintf(&line, "blacklist %s", argv[i] + 12) == -1) | 1574 | if (asprintf(&line, "blacklist %s", argv[i] + 12) == -1) |
@@ -1576,6 +1577,14 @@ int main(int argc, char **argv, char **envp) { | |||
1576 | profile_check_line(line, 0, NULL); // will exit if something wrong | 1577 | profile_check_line(line, 0, NULL); // will exit if something wrong |
1577 | profile_add(line); | 1578 | profile_add(line); |
1578 | } | 1579 | } |
1580 | else if (strncmp(argv[i], "--deny=", 7) == 0) { | ||
1581 | char *line; | ||
1582 | if (asprintf(&line, "blacklist %s", argv[i] + 7) == -1) | ||
1583 | errExit("asprintf"); | ||
1584 | |||
1585 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
1586 | profile_add(line); | ||
1587 | } | ||
1579 | else if (strncmp(argv[i], "--noblacklist=", 14) == 0) { | 1588 | else if (strncmp(argv[i], "--noblacklist=", 14) == 0) { |
1580 | char *line; | 1589 | char *line; |
1581 | if (asprintf(&line, "noblacklist %s", argv[i] + 14) == -1) | 1590 | if (asprintf(&line, "noblacklist %s", argv[i] + 14) == -1) |
@@ -1584,19 +1593,31 @@ int main(int argc, char **argv, char **envp) { | |||
1584 | profile_check_line(line, 0, NULL); // will exit if something wrong | 1593 | profile_check_line(line, 0, NULL); // will exit if something wrong |
1585 | profile_add(line); | 1594 | profile_add(line); |
1586 | } | 1595 | } |
1596 | else if (strncmp(argv[i], "--nodeny=", 9) == 0) { | ||
1597 | char *line; | ||
1598 | if (asprintf(&line, "noblacklist %s", argv[i] + 9) == -1) | ||
1599 | errExit("asprintf"); | ||
1600 | |||
1601 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
1602 | profile_add(line); | ||
1603 | } | ||
1587 | 1604 | ||
1588 | #ifdef HAVE_WHITELIST | 1605 | // whitelist |
1589 | else if (strncmp(argv[i], "--whitelist=", 12) == 0) { | 1606 | else if (strncmp(argv[i], "--whitelist=", 12) == 0) { |
1590 | if (checkcfg(CFG_WHITELIST)) { | 1607 | char *line; |
1591 | char *line; | 1608 | if (asprintf(&line, "whitelist %s", argv[i] + 12) == -1) |
1592 | if (asprintf(&line, "whitelist %s", argv[i] + 12) == -1) | 1609 | errExit("asprintf"); |
1593 | errExit("asprintf"); | ||
1594 | 1610 | ||
1595 | profile_check_line(line, 0, NULL); // will exit if something wrong | 1611 | profile_check_line(line, 0, NULL); // will exit if something wrong |
1596 | profile_add(line); | 1612 | profile_add(line); |
1597 | } | 1613 | } |
1598 | else | 1614 | else if (strncmp(argv[i], "--allow=", 8) == 0) { |
1599 | exit_err_feature("whitelist"); | 1615 | char *line; |
1616 | if (asprintf(&line, "whitelist %s", argv[i] + 8) == -1) | ||
1617 | errExit("asprintf"); | ||
1618 | |||
1619 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
1620 | profile_add(line); | ||
1600 | } | 1621 | } |
1601 | else if (strncmp(argv[i], "--nowhitelist=", 14) == 0) { | 1622 | else if (strncmp(argv[i], "--nowhitelist=", 14) == 0) { |
1602 | char *line; | 1623 | char *line; |
@@ -1606,7 +1627,16 @@ int main(int argc, char **argv, char **envp) { | |||
1606 | profile_check_line(line, 0, NULL); // will exit if something wrong | 1627 | profile_check_line(line, 0, NULL); // will exit if something wrong |
1607 | profile_add(line); | 1628 | profile_add(line); |
1608 | } | 1629 | } |
1609 | #endif | 1630 | else if (strncmp(argv[i], "--noallow=", 10) == 0) { |
1631 | char *line; | ||
1632 | if (asprintf(&line, "nowhitelist %s", argv[i] + 10) == -1) | ||
1633 | errExit("asprintf"); | ||
1634 | |||
1635 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
1636 | profile_add(line); | ||
1637 | } | ||
1638 | |||
1639 | |||
1610 | else if (strncmp(argv[i], "--mkdir=", 8) == 0) { | 1640 | else if (strncmp(argv[i], "--mkdir=", 8) == 0) { |
1611 | char *line; | 1641 | char *line; |
1612 | if (asprintf(&line, "mkdir %s", argv[i] + 8) == -1) | 1642 | if (asprintf(&line, "mkdir %s", argv[i] + 8) == -1) |
@@ -2652,8 +2682,9 @@ int main(int argc, char **argv, char **envp) { | |||
2652 | //************************************* | 2682 | //************************************* |
2653 | else if (strncmp(argv[i], "--timeout=", 10) == 0) | 2683 | else if (strncmp(argv[i], "--timeout=", 10) == 0) |
2654 | cfg.timeout = extract_timeout(argv[i] + 10); | 2684 | cfg.timeout = extract_timeout(argv[i] + 10); |
2655 | else if (strcmp(argv[i], "--appimage") == 0) | 2685 | else if (strcmp(argv[i], "--appimage") == 0) { |
2656 | arg_appimage = 1; | 2686 | // already handled |
2687 | } | ||
2657 | else if (strcmp(argv[i], "--shell=none") == 0) { | 2688 | else if (strcmp(argv[i], "--shell=none") == 0) { |
2658 | arg_shell_none = 1; | 2689 | arg_shell_none = 1; |
2659 | if (cfg.shell) { | 2690 | if (cfg.shell) { |
@@ -2895,6 +2926,15 @@ int main(int argc, char **argv, char **envp) { | |||
2895 | // check network configuration options - it will exit if anything went wrong | 2926 | // check network configuration options - it will exit if anything went wrong |
2896 | net_check_cfg(); | 2927 | net_check_cfg(); |
2897 | 2928 | ||
2929 | // customization of default seccomp filter | ||
2930 | if (config_seccomp_filter_add) { | ||
2931 | if (arg_seccomp && !cfg.seccomp_list_keep && !cfg.seccomp_list_drop) | ||
2932 | profile_list_augment(&cfg.seccomp_list, config_seccomp_filter_add); | ||
2933 | |||
2934 | if (arg_seccomp32 && !cfg.seccomp_list_keep32 && !cfg.seccomp_list_drop32) | ||
2935 | profile_list_augment(&cfg.seccomp_list32, config_seccomp_filter_add); | ||
2936 | } | ||
2937 | |||
2898 | if (arg_seccomp) | 2938 | if (arg_seccomp) |
2899 | arg_seccomp_postexec = check_postexec(cfg.seccomp_list) || check_postexec(cfg.seccomp_list_drop); | 2939 | arg_seccomp_postexec = check_postexec(cfg.seccomp_list) || check_postexec(cfg.seccomp_list_drop); |
2900 | 2940 | ||
@@ -3030,9 +3070,9 @@ int main(int argc, char **argv, char **envp) { | |||
3030 | network_main(child); | 3070 | network_main(child); |
3031 | if (arg_debug) | 3071 | if (arg_debug) |
3032 | printf("Host network configured\n"); | 3072 | printf("Host network configured\n"); |
3033 | #ifdef HAVE_GCOV | 3073 | |
3034 | __gcov_flush(); | 3074 | __gcov_flush(); |
3035 | #endif | 3075 | |
3036 | _exit(0); | 3076 | _exit(0); |
3037 | } | 3077 | } |
3038 | 3078 | ||
@@ -3178,10 +3218,11 @@ printf("link #%s#\n", prf->link); | |||
3178 | if (WIFEXITED(status)){ | 3218 | if (WIFEXITED(status)){ |
3179 | myexit(WEXITSTATUS(status)); | 3219 | myexit(WEXITSTATUS(status)); |
3180 | } else if (WIFSIGNALED(status)) { | 3220 | } else if (WIFSIGNALED(status)) { |
3181 | myexit(WTERMSIG(status)); | 3221 | // distinguish fatal signals by adding 128 |
3222 | myexit(128 + WTERMSIG(status)); | ||
3182 | } else { | 3223 | } else { |
3183 | myexit(0); | 3224 | myexit(1); |
3184 | } | 3225 | } |
3185 | 3226 | ||
3186 | return 0; | 3227 | return 1; |
3187 | } | 3228 | } |
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c index 665bef73d..0e5562d90 100644 --- a/src/firejail/no_sandbox.c +++ b/src/firejail/no_sandbox.c | |||
@@ -49,6 +49,7 @@ int check_namespace_virt(void) { | |||
49 | // check PID 1 container environment variable | 49 | // check PID 1 container environment variable |
50 | EUID_ROOT(); | 50 | EUID_ROOT(); |
51 | FILE *fp = fopen("/proc/1/environ", "re"); | 51 | FILE *fp = fopen("/proc/1/environ", "re"); |
52 | EUID_USER(); | ||
52 | if (fp) { | 53 | if (fp) { |
53 | int c = 0; | 54 | int c = 0; |
54 | while (c != EOF) { | 55 | while (c != EOF) { |
@@ -69,7 +70,6 @@ int check_namespace_virt(void) { | |||
69 | // found it | 70 | // found it |
70 | if (is_container(buf + 10)) { | 71 | if (is_container(buf + 10)) { |
71 | fclose(fp); | 72 | fclose(fp); |
72 | EUID_USER(); | ||
73 | return 1; | 73 | return 1; |
74 | } | 74 | } |
75 | } | 75 | } |
@@ -79,7 +79,6 @@ int check_namespace_virt(void) { | |||
79 | fclose(fp); | 79 | fclose(fp); |
80 | } | 80 | } |
81 | 81 | ||
82 | EUID_USER(); | ||
83 | return 0; | 82 | return 0; |
84 | } | 83 | } |
85 | 84 | ||
diff --git a/src/firejail/output.c b/src/firejail/output.c index 835dff2db..ce10ab157 100644 --- a/src/firejail/output.c +++ b/src/firejail/output.c | |||
@@ -50,13 +50,21 @@ void check_output(int argc, char **argv) { | |||
50 | if (!outindex) | 50 | if (!outindex) |
51 | return; | 51 | return; |
52 | 52 | ||
53 | |||
54 | // check filename | ||
55 | drop_privs(0); | 53 | drop_privs(0); |
56 | char *outfile = argv[outindex]; | 54 | char *outfile = argv[outindex]; |
57 | outfile += (enable_stderr)? 16:9; | 55 | outfile += (enable_stderr)? 16:9; |
56 | |||
57 | // check filename | ||
58 | invalid_filename(outfile, 0); // no globbing | 58 | invalid_filename(outfile, 0); // no globbing |
59 | 59 | ||
60 | // expand user home directory | ||
61 | if (outfile[0] == '~') { | ||
62 | char *full; | ||
63 | if (asprintf(&full, "%s%s", cfg.homedir, outfile + 1) == -1) | ||
64 | errExit("asprintf"); | ||
65 | outfile = full; | ||
66 | } | ||
67 | |||
60 | // do not accept directories, links, and files with ".." | 68 | // do not accept directories, links, and files with ".." |
61 | if (strstr(outfile, "..") || is_link(outfile) || is_dir(outfile)) { | 69 | if (strstr(outfile, "..") || is_link(outfile) || is_dir(outfile)) { |
62 | fprintf(stderr, "Error: invalid output file. Links, directories and files with \"..\" are not allowed.\n"); | 70 | fprintf(stderr, "Error: invalid output file. Links, directories and files with \"..\" are not allowed.\n"); |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index 5b1478918..059100fcb 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -18,15 +18,12 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include "../include/gcov_wrapper.h" | ||
21 | #include "../include/seccomp.h" | 22 | #include "../include/seccomp.h" |
22 | #include "../include/syscall.h" | 23 | #include "../include/syscall.h" |
23 | #include <dirent.h> | 24 | #include <dirent.h> |
24 | #include <sys/stat.h> | 25 | #include <sys/stat.h> |
25 | 26 | ||
26 | #ifdef HAVE_GCOV | ||
27 | #include <gcov.h> | ||
28 | #endif | ||
29 | |||
30 | extern char *xephyr_screen; | 27 | extern char *xephyr_screen; |
31 | 28 | ||
32 | #define MAX_READ 8192 // line buffer for profile files | 29 | #define MAX_READ 8192 // line buffer for profile files |
@@ -1592,22 +1589,8 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
1592 | else if (strncmp(ptr, "noblacklist ", 12) == 0) | 1589 | else if (strncmp(ptr, "noblacklist ", 12) == 0) |
1593 | ptr += 12; | 1590 | ptr += 12; |
1594 | else if (strncmp(ptr, "whitelist ", 10) == 0) { | 1591 | else if (strncmp(ptr, "whitelist ", 10) == 0) { |
1595 | #ifdef HAVE_WHITELIST | 1592 | arg_whitelist = 1; |
1596 | if (checkcfg(CFG_WHITELIST)) { | 1593 | ptr += 10; |
1597 | arg_whitelist = 1; | ||
1598 | ptr += 10; | ||
1599 | } | ||
1600 | else { | ||
1601 | static int whitelist_warning_printed = 0; | ||
1602 | if (!whitelist_warning_printed) { | ||
1603 | warning_feature_disabled("whitelist"); | ||
1604 | whitelist_warning_printed = 1; | ||
1605 | } | ||
1606 | return 0; | ||
1607 | } | ||
1608 | #else | ||
1609 | return 0; | ||
1610 | #endif | ||
1611 | } | 1594 | } |
1612 | else if (strncmp(ptr, "nowhitelist ", 12) == 0) | 1595 | else if (strncmp(ptr, "nowhitelist ", 12) == 0) |
1613 | ptr += 12; | 1596 | ptr += 12; |
@@ -1753,6 +1736,44 @@ void profile_read(const char *fname) { | |||
1753 | continue; | 1736 | continue; |
1754 | } | 1737 | } |
1755 | 1738 | ||
1739 | // translate allow/deny to whitelist/blacklist | ||
1740 | if (strncmp(ptr, "allow ", 6) == 0) { | ||
1741 | char *tmp; | ||
1742 | if (asprintf(&tmp, "whitelist %s", ptr + 6) == -1) | ||
1743 | errExit("asprintf"); | ||
1744 | free(ptr); | ||
1745 | ptr = tmp; | ||
1746 | } | ||
1747 | else if (strncmp(ptr, "deny ", 5) == 0) { | ||
1748 | char *tmp; | ||
1749 | if (asprintf(&tmp, "blacklist %s", ptr + 5) == -1) | ||
1750 | errExit("asprintf"); | ||
1751 | free(ptr); | ||
1752 | ptr = tmp; | ||
1753 | } | ||
1754 | else if (strncmp(ptr, "deny-nolog ", 11) == 0) { | ||
1755 | char *tmp; | ||
1756 | if (asprintf(&tmp, "blacklist-nolog %s", ptr + 11) == -1) | ||
1757 | errExit("asprintf"); | ||
1758 | free(ptr); | ||
1759 | ptr = tmp; | ||
1760 | } | ||
1761 | // translate noallow/nodeny to nowhitelist/noblacklist | ||
1762 | else if (strncmp(ptr, "noallow ", 8) == 0) { | ||
1763 | char *tmp; | ||
1764 | if (asprintf(&tmp, "nowhitelist %s", ptr + 8) == -1) | ||
1765 | errExit("asprintf"); | ||
1766 | free(ptr); | ||
1767 | ptr = tmp; | ||
1768 | } | ||
1769 | else if (strncmp(ptr, "nodeny ", 7) == 0) { | ||
1770 | char *tmp; | ||
1771 | if (asprintf(&tmp, "noblacklist %s", ptr + 7) == -1) | ||
1772 | errExit("asprintf"); | ||
1773 | free(ptr); | ||
1774 | ptr = tmp; | ||
1775 | } | ||
1776 | |||
1756 | // process quiet | 1777 | // process quiet |
1757 | // todo: a quiet in the profile file cannot be disabled by --ignore on command line | 1778 | // todo: a quiet in the profile file cannot be disabled by --ignore on command line |
1758 | if (strcmp(ptr, "quiet") == 0) { | 1779 | if (strcmp(ptr, "quiet") == 0) { |
@@ -1805,9 +1826,8 @@ void profile_read(const char *fname) { | |||
1805 | // else { | 1826 | // else { |
1806 | // free(ptr); | 1827 | // free(ptr); |
1807 | // } | 1828 | // } |
1808 | #ifdef HAVE_GCOV | 1829 | |
1809 | __gcov_flush(); | 1830 | __gcov_flush(); |
1810 | #endif | ||
1811 | } | 1831 | } |
1812 | fclose(fp); | 1832 | fclose(fp); |
1813 | } | 1833 | } |
@@ -1918,7 +1938,7 @@ char *profile_list_compress(char *list) | |||
1918 | /* Include non-empty item */ | 1938 | /* Include non-empty item */ |
1919 | if (!*item) | 1939 | if (!*item) |
1920 | in[i] = 0; | 1940 | in[i] = 0; |
1921 | /* Remove all allready included items */ | 1941 | /* Remove all already included items */ |
1922 | for (k = 0; k < i; ++k) | 1942 | for (k = 0; k < i; ++k) |
1923 | in[k] = 0; | 1943 | in[k] = 0; |
1924 | break; | 1944 | break; |
diff --git a/src/firejail/rlimit.c b/src/firejail/rlimit.c index dd6fec972..f177f4b89 100644 --- a/src/firejail/rlimit.c +++ b/src/firejail/rlimit.c | |||
@@ -18,13 +18,10 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include "../include/gcov_wrapper.h" | ||
21 | #include <sys/time.h> | 22 | #include <sys/time.h> |
22 | #include <sys/resource.h> | 23 | #include <sys/resource.h> |
23 | 24 | ||
24 | #ifdef HAVE_GCOV | ||
25 | #include <gcov.h> | ||
26 | #endif | ||
27 | |||
28 | void set_rlimits(void) { | 25 | void set_rlimits(void) { |
29 | EUID_ASSERT(); | 26 | EUID_ASSERT(); |
30 | // resource limits | 27 | // resource limits |
@@ -37,9 +34,9 @@ void set_rlimits(void) { | |||
37 | // set the new limit | 34 | // set the new limit |
38 | rl.rlim_cur = (rlim_t) cfg.rlimit_cpu; | 35 | rl.rlim_cur = (rlim_t) cfg.rlimit_cpu; |
39 | rl.rlim_max = (rlim_t) cfg.rlimit_cpu; | 36 | rl.rlim_max = (rlim_t) cfg.rlimit_cpu; |
40 | #ifdef HAVE_GCOV | 37 | |
41 | __gcov_dump(); | 38 | __gcov_dump(); |
42 | #endif | 39 | |
43 | if (setrlimit(RLIMIT_CPU, &rl) == -1) | 40 | if (setrlimit(RLIMIT_CPU, &rl) == -1) |
44 | errExit("setrlimit"); | 41 | errExit("setrlimit"); |
45 | if (arg_debug) | 42 | if (arg_debug) |
@@ -54,9 +51,10 @@ void set_rlimits(void) { | |||
54 | // set the new limit | 51 | // set the new limit |
55 | rl.rlim_cur = (rlim_t) cfg.rlimit_nofile; | 52 | rl.rlim_cur = (rlim_t) cfg.rlimit_nofile; |
56 | rl.rlim_max = (rlim_t) cfg.rlimit_nofile; | 53 | rl.rlim_max = (rlim_t) cfg.rlimit_nofile; |
57 | #ifdef HAVE_GCOV // gcov-instrumented programs might crash at this point | 54 | |
55 | // gcov-instrumented programs might crash at this point | ||
58 | __gcov_dump(); | 56 | __gcov_dump(); |
59 | #endif | 57 | |
60 | if (setrlimit(RLIMIT_NOFILE, &rl) == -1) | 58 | if (setrlimit(RLIMIT_NOFILE, &rl) == -1) |
61 | errExit("setrlimit"); | 59 | errExit("setrlimit"); |
62 | if (arg_debug) | 60 | if (arg_debug) |
@@ -71,9 +69,9 @@ void set_rlimits(void) { | |||
71 | // set the new limit | 69 | // set the new limit |
72 | rl.rlim_cur = (rlim_t) cfg.rlimit_nproc; | 70 | rl.rlim_cur = (rlim_t) cfg.rlimit_nproc; |
73 | rl.rlim_max = (rlim_t) cfg.rlimit_nproc; | 71 | rl.rlim_max = (rlim_t) cfg.rlimit_nproc; |
74 | #ifdef HAVE_GCOV | 72 | |
75 | __gcov_dump(); | 73 | __gcov_dump(); |
76 | #endif | 74 | |
77 | if (setrlimit(RLIMIT_NPROC, &rl) == -1) | 75 | if (setrlimit(RLIMIT_NPROC, &rl) == -1) |
78 | errExit("setrlimit"); | 76 | errExit("setrlimit"); |
79 | if (arg_debug) | 77 | if (arg_debug) |
@@ -88,9 +86,9 @@ void set_rlimits(void) { | |||
88 | // set the new limit | 86 | // set the new limit |
89 | rl.rlim_cur = (rlim_t) cfg.rlimit_fsize; | 87 | rl.rlim_cur = (rlim_t) cfg.rlimit_fsize; |
90 | rl.rlim_max = (rlim_t) cfg.rlimit_fsize; | 88 | rl.rlim_max = (rlim_t) cfg.rlimit_fsize; |
91 | #ifdef HAVE_GCOV | 89 | |
92 | __gcov_dump(); | 90 | __gcov_dump(); |
93 | #endif | 91 | |
94 | if (setrlimit(RLIMIT_FSIZE, &rl) == -1) | 92 | if (setrlimit(RLIMIT_FSIZE, &rl) == -1) |
95 | errExit("setrlimit"); | 93 | errExit("setrlimit"); |
96 | if (arg_debug) | 94 | if (arg_debug) |
@@ -105,9 +103,9 @@ void set_rlimits(void) { | |||
105 | // set the new limit | 103 | // set the new limit |
106 | rl.rlim_cur = (rlim_t) cfg.rlimit_sigpending; | 104 | rl.rlim_cur = (rlim_t) cfg.rlimit_sigpending; |
107 | rl.rlim_max = (rlim_t) cfg.rlimit_sigpending; | 105 | rl.rlim_max = (rlim_t) cfg.rlimit_sigpending; |
108 | #ifdef HAVE_GCOV | 106 | |
109 | __gcov_dump(); | 107 | __gcov_dump(); |
110 | #endif | 108 | |
111 | if (setrlimit(RLIMIT_SIGPENDING, &rl) == -1) | 109 | if (setrlimit(RLIMIT_SIGPENDING, &rl) == -1) |
112 | errExit("setrlimit"); | 110 | errExit("setrlimit"); |
113 | if (arg_debug) | 111 | if (arg_debug) |
@@ -122,9 +120,9 @@ void set_rlimits(void) { | |||
122 | // set the new limit | 120 | // set the new limit |
123 | rl.rlim_cur = (rlim_t) cfg.rlimit_as; | 121 | rl.rlim_cur = (rlim_t) cfg.rlimit_as; |
124 | rl.rlim_max = (rlim_t) cfg.rlimit_as; | 122 | rl.rlim_max = (rlim_t) cfg.rlimit_as; |
125 | #ifdef HAVE_GCOV | 123 | |
126 | __gcov_dump(); | 124 | __gcov_dump(); |
127 | #endif | 125 | |
128 | if (setrlimit(RLIMIT_AS, &rl) == -1) | 126 | if (setrlimit(RLIMIT_AS, &rl) == -1) |
129 | errExit("setrlimit"); | 127 | errExit("setrlimit"); |
130 | if (arg_debug) | 128 | if (arg_debug) |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index e06ba3617..83e50aee2 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -19,6 +19,7 @@ | |||
19 | */ | 19 | */ |
20 | 20 | ||
21 | #include "firejail.h" | 21 | #include "firejail.h" |
22 | #include "../include/gcov_wrapper.h" | ||
22 | #include "../include/seccomp.h" | 23 | #include "../include/seccomp.h" |
23 | #include <sys/mman.h> | 24 | #include <sys/mman.h> |
24 | #include <sys/mount.h> | 25 | #include <sys/mount.h> |
@@ -49,10 +50,6 @@ | |||
49 | #include <sys/apparmor.h> | 50 | #include <sys/apparmor.h> |
50 | #endif | 51 | #endif |
51 | 52 | ||
52 | #ifdef HAVE_GCOV | ||
53 | #include <gcov.h> | ||
54 | #endif | ||
55 | |||
56 | static int force_nonewprivs = 0; | 53 | static int force_nonewprivs = 0; |
57 | 54 | ||
58 | static int monitored_pid = 0; | 55 | static int monitored_pid = 0; |
@@ -90,9 +87,9 @@ static void sandbox_handler(int sig){ | |||
90 | 87 | ||
91 | // broadcast a SIGKILL | 88 | // broadcast a SIGKILL |
92 | kill(-1, SIGKILL); | 89 | kill(-1, SIGKILL); |
93 | flush_stdin(); | ||
94 | 90 | ||
95 | exit(sig); | 91 | flush_stdin(); |
92 | exit(128 + sig); | ||
96 | } | 93 | } |
97 | 94 | ||
98 | static void install_handler(void) { | 95 | static void install_handler(void) { |
@@ -507,9 +504,8 @@ void start_application(int no_sandbox, int fd, char *set_sandbox_status) { | |||
507 | exit(1); | 504 | exit(1); |
508 | } | 505 | } |
509 | 506 | ||
510 | #ifdef HAVE_GCOV | ||
511 | __gcov_dump(); | 507 | __gcov_dump(); |
512 | #endif | 508 | |
513 | seccomp_install_filters(); | 509 | seccomp_install_filters(); |
514 | 510 | ||
515 | if (set_sandbox_status) | 511 | if (set_sandbox_status) |
@@ -563,9 +559,8 @@ void start_application(int no_sandbox, int fd, char *set_sandbox_status) { | |||
563 | if (!arg_command && !arg_quiet) | 559 | if (!arg_command && !arg_quiet) |
564 | print_time(); | 560 | print_time(); |
565 | 561 | ||
566 | #ifdef HAVE_GCOV | ||
567 | __gcov_dump(); | 562 | __gcov_dump(); |
568 | #endif | 563 | |
569 | seccomp_install_filters(); | 564 | seccomp_install_filters(); |
570 | 565 | ||
571 | if (set_sandbox_status) | 566 | if (set_sandbox_status) |
@@ -840,6 +835,7 @@ int sandbox(void* sandbox_arg) { | |||
840 | // private mode | 835 | // private mode |
841 | //**************************** | 836 | //**************************** |
842 | if (arg_private) { | 837 | if (arg_private) { |
838 | EUID_USER(); | ||
843 | if (cfg.home_private) { // --private= | 839 | if (cfg.home_private) { // --private= |
844 | if (cfg.chrootdir) | 840 | if (cfg.chrootdir) |
845 | fwarning("private=directory feature is disabled in chroot\n"); | 841 | fwarning("private=directory feature is disabled in chroot\n"); |
@@ -858,6 +854,7 @@ int sandbox(void* sandbox_arg) { | |||
858 | } | 854 | } |
859 | else // --private | 855 | else // --private |
860 | fs_private(); | 856 | fs_private(); |
857 | EUID_ROOT(); | ||
861 | } | 858 | } |
862 | 859 | ||
863 | if (arg_private_dev) | 860 | if (arg_private_dev) |
@@ -1007,10 +1004,12 @@ int sandbox(void* sandbox_arg) { | |||
1007 | // apply the profile file | 1004 | // apply the profile file |
1008 | //**************************** | 1005 | //**************************** |
1009 | // apply all whitelist commands ... | 1006 | // apply all whitelist commands ... |
1007 | EUID_USER(); | ||
1010 | fs_whitelist(); | 1008 | fs_whitelist(); |
1011 | 1009 | ||
1012 | // ... followed by blacklist commands | 1010 | // ... followed by blacklist commands |
1013 | fs_blacklist(); // mkdir and mkfile are processed all over again | 1011 | fs_blacklist(); // mkdir and mkfile are processed all over again |
1012 | EUID_ROOT(); | ||
1014 | 1013 | ||
1015 | //**************************** | 1014 | //**************************** |
1016 | // nosound/no3d/notv/novideo and fix for pulseaudio 7.0 | 1015 | // nosound/no3d/notv/novideo and fix for pulseaudio 7.0 |
@@ -1046,7 +1045,7 @@ int sandbox(void* sandbox_arg) { | |||
1046 | //**************************** | 1045 | //**************************** |
1047 | // set dns | 1046 | // set dns |
1048 | //**************************** | 1047 | //**************************** |
1049 | fs_resolvconf(); | 1048 | fs_rebuild_etc(); |
1050 | 1049 | ||
1051 | //**************************** | 1050 | //**************************** |
1052 | // start dhcp client | 1051 | // start dhcp client |
@@ -1246,7 +1245,6 @@ int sandbox(void* sandbox_arg) { | |||
1246 | 1245 | ||
1247 | if (app_pid == 0) { | 1246 | if (app_pid == 0) { |
1248 | #ifdef HAVE_APPARMOR | 1247 | #ifdef HAVE_APPARMOR |
1249 | // add apparmor confinement after the execve | ||
1250 | set_apparmor(); | 1248 | set_apparmor(); |
1251 | #endif | 1249 | #endif |
1252 | 1250 | ||
@@ -1261,13 +1259,17 @@ int sandbox(void* sandbox_arg) { | |||
1261 | munmap(set_sandbox_status, 1); | 1259 | munmap(set_sandbox_status, 1); |
1262 | 1260 | ||
1263 | int status = monitor_application(app_pid); // monitor application | 1261 | int status = monitor_application(app_pid); // monitor application |
1264 | flush_stdin(); | ||
1265 | 1262 | ||
1266 | if (WIFEXITED(status)) { | 1263 | if (WIFEXITED(status)) { |
1267 | // if we had a proper exit, return that exit status | 1264 | // if we had a proper exit, return that exit status |
1268 | return WEXITSTATUS(status); | 1265 | status = WEXITSTATUS(status); |
1266 | } else if (WIFSIGNALED(status)) { | ||
1267 | // distinguish fatal signals by adding 128 | ||
1268 | status = 128 + WTERMSIG(status); | ||
1269 | } else { | 1269 | } else { |
1270 | // something else went wrong! | 1270 | status = -1; |
1271 | return -1; | ||
1272 | } | 1271 | } |
1272 | |||
1273 | flush_stdin(); | ||
1274 | return status; | ||
1273 | } | 1275 | } |
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c index 9670fe816..3d9bf9082 100644 --- a/src/firejail/seccomp.c +++ b/src/firejail/seccomp.c | |||
@@ -208,7 +208,8 @@ int seccomp_filter_drop(bool native) { | |||
208 | // - seccomp | 208 | // - seccomp |
209 | if (cfg.seccomp_list_drop == NULL) { | 209 | if (cfg.seccomp_list_drop == NULL) { |
210 | // default seccomp if error action is not changed | 210 | // default seccomp if error action is not changed |
211 | if (cfg.seccomp_list == NULL && arg_seccomp_error_action == DEFAULT_SECCOMP_ERROR_ACTION) { | 211 | if ((cfg.seccomp_list == NULL || cfg.seccomp_list[0] == '\0') |
212 | && arg_seccomp_error_action == DEFAULT_SECCOMP_ERROR_ACTION) { | ||
212 | if (arg_seccomp_block_secondary) | 213 | if (arg_seccomp_block_secondary) |
213 | seccomp_filter_block_secondary(); | 214 | seccomp_filter_block_secondary(); |
214 | else { | 215 | else { |
@@ -261,7 +262,7 @@ int seccomp_filter_drop(bool native) { | |||
261 | } | 262 | } |
262 | 263 | ||
263 | // build the seccomp filter as a regular user | 264 | // build the seccomp filter as a regular user |
264 | if (list) | 265 | if (list && list[0]) |
265 | if (arg_allow_debuggers) | 266 | if (arg_allow_debuggers) |
266 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 7, | 267 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 7, |
267 | PATH_FSECCOMP, command, "drop", filter, postexec_filter, list, "allow-debuggers"); | 268 | PATH_FSECCOMP, command, "drop", filter, postexec_filter, list, "allow-debuggers"); |
diff --git a/src/firejail/selinux.c b/src/firejail/selinux.c index 6969e7a3d..fa59882ed 100644 --- a/src/firejail/selinux.c +++ b/src/firejail/selinux.c | |||
@@ -21,6 +21,7 @@ | |||
21 | #include "firejail.h" | 21 | #include "firejail.h" |
22 | #include <sys/types.h> | 22 | #include <sys/types.h> |
23 | #include <sys/stat.h> | 23 | #include <sys/stat.h> |
24 | #include <errno.h> | ||
24 | 25 | ||
25 | #include <fcntl.h> | 26 | #include <fcntl.h> |
26 | #ifndef O_PATH | 27 | #ifndef O_PATH |
@@ -57,7 +58,17 @@ void selinux_relabel_path(const char *path, const char *inside_path) | |||
57 | 58 | ||
58 | /* Open the file as O_PATH, to pin it while we determine and adjust the label | 59 | /* Open the file as O_PATH, to pin it while we determine and adjust the label |
59 | * Defeat symlink races by not allowing symbolic links */ | 60 | * Defeat symlink races by not allowing symbolic links */ |
61 | int called_as_root = 0; | ||
62 | if (geteuid() == 0) | ||
63 | called_as_root = 1; | ||
64 | if (called_as_root) | ||
65 | EUID_USER(); | ||
66 | |||
60 | fd = safer_openat(-1, path, O_NOFOLLOW|O_CLOEXEC|O_PATH); | 67 | fd = safer_openat(-1, path, O_NOFOLLOW|O_CLOEXEC|O_PATH); |
68 | |||
69 | if (called_as_root) | ||
70 | EUID_ROOT(); | ||
71 | |||
61 | if (fd < 0) | 72 | if (fd < 0) |
62 | return; | 73 | return; |
63 | if (fstat(fd, &st) < 0) | 74 | if (fstat(fd, &st) < 0) |
@@ -68,8 +79,16 @@ void selinux_relabel_path(const char *path, const char *inside_path) | |||
68 | if (arg_debug) | 79 | if (arg_debug) |
69 | printf("Relabeling %s as %s (%s)\n", path, inside_path, fcon); | 80 | printf("Relabeling %s as %s (%s)\n", path, inside_path, fcon); |
70 | 81 | ||
71 | setfilecon_raw(procfs_path, fcon); | 82 | if (!called_as_root) |
83 | EUID_ROOT(); | ||
84 | |||
85 | if (setfilecon_raw(procfs_path, fcon) != 0 && arg_debug) | ||
86 | printf("Cannot relabel %s: %s\n", path, strerror(errno)); | ||
87 | |||
88 | if (!called_as_root) | ||
89 | EUID_USER(); | ||
72 | } | 90 | } |
91 | |||
73 | freecon(fcon); | 92 | freecon(fcon); |
74 | close: | 93 | close: |
75 | close(fd); | 94 | close(fd); |
diff --git a/src/firejail/usage.c b/src/firejail/usage.c index 888a6ffed..43f862b9d 100644 --- a/src/firejail/usage.c +++ b/src/firejail/usage.c | |||
@@ -58,16 +58,18 @@ static char *usage_str = | |||
58 | #ifdef HAVE_DBUSPROXY | 58 | #ifdef HAVE_DBUSPROXY |
59 | " --dbus-log=file - set DBus log file location.\n" | 59 | " --dbus-log=file - set DBus log file location.\n" |
60 | " --dbus-system=filter|none - set system DBus access policy.\n" | 60 | " --dbus-system=filter|none - set system DBus access policy.\n" |
61 | " --dbus-system.broadcast=rule - allow signals on the system DBus according to rule.\n" | 61 | " --dbus-system.broadcast=rule - allow signals on the system DBus according\n" |
62 | "\tto rule.\n" | ||
62 | " --dbus-system.call=rule - allow calls on the system DBus according to rule.\n" | 63 | " --dbus-system.call=rule - allow calls on the system DBus according to rule.\n" |
63 | " --dbus-system.log - turn on logging for the system DBus." | 64 | " --dbus-system.log - turn on logging for the system DBus.\n" |
64 | " --dbus-system.own=name - allow ownership of name on the system DBus.\n" | 65 | " --dbus-system.own=name - allow ownership of name on the system DBus.\n" |
65 | " --dbus-system.see=name - allow seeing name on the system DBus.\n" | 66 | " --dbus-system.see=name - allow seeing name on the system DBus.\n" |
66 | " --dbus-system.talk=name - allow talking to name on the system DBus.\n" | 67 | " --dbus-system.talk=name - allow talking to name on the system DBus.\n" |
67 | " --dbus-user=filter|none - set session DBus access policy.\n" | 68 | " --dbus-user=filter|none - set session DBus access policy.\n" |
68 | " --dbus-user.broadcast=rule - allow signals on the session DBus according to rule.\n" | 69 | " --dbus-user.broadcast=rule - allow signals on the session DBus according\n" |
70 | "\tto rule.\n" | ||
69 | " --dbus-user.call=rule - allow calls on the session DBus according to rule.\n" | 71 | " --dbus-user.call=rule - allow calls on the session DBus according to rule.\n" |
70 | " --dbus-user.log - turn on logging for the user DBus." | 72 | " --dbus-user.log - turn on logging for the user DBus.\n" |
71 | " --dbus-user.own=name - allow ownership of name on the session DBus.\n" | 73 | " --dbus-user.own=name - allow ownership of name on the session DBus.\n" |
72 | " --dbus-user.see=name - allow seeing name on the session DBus.\n" | 74 | " --dbus-user.see=name - allow seeing name on the session DBus.\n" |
73 | " --dbus-user.talk=name - allow talking to name on the session DBus.\n" | 75 | " --dbus-user.talk=name - allow talking to name on the session DBus.\n" |
@@ -80,9 +82,7 @@ static char *usage_str = | |||
80 | " --debug-protocols - print all recognized protocols.\n" | 82 | " --debug-protocols - print all recognized protocols.\n" |
81 | " --debug-syscalls - print all recognized system calls.\n" | 83 | " --debug-syscalls - print all recognized system calls.\n" |
82 | " --debug-syscalls32 - print all recognized 32 bit system calls.\n" | 84 | " --debug-syscalls32 - print all recognized 32 bit system calls.\n" |
83 | #ifdef HAVE_WHITELIST | ||
84 | " --debug-whitelists - debug whitelisting.\n" | 85 | " --debug-whitelists - debug whitelisting.\n" |
85 | #endif | ||
86 | #ifdef HAVE_NETWORK | 86 | #ifdef HAVE_NETWORK |
87 | " --defaultgw=address - configure default gateway.\n" | 87 | " --defaultgw=address - configure default gateway.\n" |
88 | #endif | 88 | #endif |
@@ -97,6 +97,8 @@ static char *usage_str = | |||
97 | " --help, -? - this help screen.\n" | 97 | " --help, -? - this help screen.\n" |
98 | " --hostname=name - set sandbox hostname.\n" | 98 | " --hostname=name - set sandbox hostname.\n" |
99 | " --hosts-file=file - use file as /etc/hosts.\n" | 99 | " --hosts-file=file - use file as /etc/hosts.\n" |
100 | " --ids-check - verify file system.\n" | ||
101 | " --ids-init - initialize IDS database.\n" | ||
100 | " --ignore=command - ignore command in profile files.\n" | 102 | " --ignore=command - ignore command in profile files.\n" |
101 | #ifdef HAVE_NETWORK | 103 | #ifdef HAVE_NETWORK |
102 | " --interface=name - move interface in sandbox.\n" | 104 | " --interface=name - move interface in sandbox.\n" |
@@ -143,8 +145,8 @@ static char *usage_str = | |||
143 | " --netfilter.print=name|pid - print the firewall.\n" | 145 | " --netfilter.print=name|pid - print the firewall.\n" |
144 | " --netfilter6=filename - enable IPv6 firewall.\n" | 146 | " --netfilter6=filename - enable IPv6 firewall.\n" |
145 | " --netfilter6.print=name|pid - print the IPv6 firewall.\n" | 147 | " --netfilter6.print=name|pid - print the IPv6 firewall.\n" |
146 | " --netmask=address - define a network mask when dealing with unconfigured" | 148 | " --netmask=address - define a network mask when dealing with unconfigured\n" |
147 | "\tparrent interfaces.\n" | 149 | "\tparent interfaces.\n" |
148 | " --netns=name - Run the program in a named, persistent network namespace.\n" | 150 | " --netns=name - Run the program in a named, persistent network namespace.\n" |
149 | " --netstats - monitor network statistics.\n" | 151 | " --netstats - monitor network statistics.\n" |
150 | #endif | 152 | #endif |
@@ -252,9 +254,7 @@ static char *usage_str = | |||
252 | #ifdef HAVE_NETWORK | 254 | #ifdef HAVE_NETWORK |
253 | " --veth-name=name - use this name for the interface connected to the bridge.\n" | 255 | " --veth-name=name - use this name for the interface connected to the bridge.\n" |
254 | #endif | 256 | #endif |
255 | #ifdef HAVE_WHITELIST | ||
256 | " --whitelist=filename - whitelist directory or file.\n" | 257 | " --whitelist=filename - whitelist directory or file.\n" |
257 | #endif | ||
258 | " --writable-etc - /etc directory is mounted read-write.\n" | 258 | " --writable-etc - /etc directory is mounted read-write.\n" |
259 | " --writable-run-user - allow access to /run/user/$UID/systemd and\n" | 259 | " --writable-run-user - allow access to /run/user/$UID/systemd and\n" |
260 | "\t/run/user/$UID/gnupg.\n" | 260 | "\t/run/user/$UID/gnupg.\n" |
diff --git a/src/firejail/util.c b/src/firejail/util.c index 68b76b8e8..f0df45eb2 100644 --- a/src/firejail/util.c +++ b/src/firejail/util.c | |||
@@ -19,6 +19,7 @@ | |||
19 | */ | 19 | */ |
20 | #define _XOPEN_SOURCE 500 | 20 | #define _XOPEN_SOURCE 500 |
21 | #include "firejail.h" | 21 | #include "firejail.h" |
22 | #include "../include/gcov_wrapper.h" | ||
22 | #include <ftw.h> | 23 | #include <ftw.h> |
23 | #include <sys/stat.h> | 24 | #include <sys/stat.h> |
24 | #include <sys/mount.h> | 25 | #include <sys/mount.h> |
@@ -44,10 +45,6 @@ | |||
44 | #include <linux/openat2.h> | 45 | #include <linux/openat2.h> |
45 | #endif | 46 | #endif |
46 | 47 | ||
47 | #ifdef HAVE_GCOV | ||
48 | #include <gcov.h> | ||
49 | #endif | ||
50 | |||
51 | #define MAX_GROUPS 1024 | 48 | #define MAX_GROUPS 1024 |
52 | #define MAXBUF 4098 | 49 | #define MAXBUF 4098 |
53 | #define EMPTY_STRING ("") | 50 | #define EMPTY_STRING ("") |
@@ -370,7 +367,7 @@ int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, m | |||
370 | } | 367 | } |
371 | 368 | ||
372 | // return -1 if error, 0 if no error | 369 | // return -1 if error, 0 if no error |
373 | void copy_file_as_user(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode) { | 370 | void copy_file_as_user(const char *srcname, const char *destname, mode_t mode) { |
374 | pid_t child = fork(); | 371 | pid_t child = fork(); |
375 | if (child < 0) | 372 | if (child < 0) |
376 | errExit("fork"); | 373 | errExit("fork"); |
@@ -378,13 +375,13 @@ void copy_file_as_user(const char *srcname, const char *destname, uid_t uid, gid | |||
378 | // drop privileges | 375 | // drop privileges |
379 | drop_privs(0); | 376 | drop_privs(0); |
380 | 377 | ||
381 | // copy, set permissions and ownership | 378 | // copy, set permissions |
382 | int rv = copy_file(srcname, destname, uid, gid, mode); // already a regular user | 379 | int rv = copy_file(srcname, destname, -1, -1, mode); // already a regular user |
383 | if (rv) | 380 | if (rv) |
384 | fwarning("cannot copy %s\n", srcname); | 381 | fwarning("cannot copy %s\n", srcname); |
385 | #ifdef HAVE_GCOV | 382 | |
386 | __gcov_flush(); | 383 | __gcov_flush(); |
387 | #endif | 384 | |
388 | _exit(0); | 385 | _exit(0); |
389 | } | 386 | } |
390 | // wait for the child to finish | 387 | // wait for the child to finish |
@@ -416,9 +413,9 @@ void copy_file_from_user_to_root(const char *srcname, const char *destname, uid_ | |||
416 | close(src); | 413 | close(src); |
417 | } | 414 | } |
418 | close(dst); | 415 | close(dst); |
419 | #ifdef HAVE_GCOV | 416 | |
420 | __gcov_flush(); | 417 | __gcov_flush(); |
421 | #endif | 418 | |
422 | _exit(0); | 419 | _exit(0); |
423 | } | 420 | } |
424 | // wait for the child to finish | 421 | // wait for the child to finish |
@@ -447,9 +444,9 @@ void touch_file_as_user(const char *fname, mode_t mode) { | |||
447 | } | 444 | } |
448 | else | 445 | else |
449 | fwarning("cannot create %s\n", fname); | 446 | fwarning("cannot create %s\n", fname); |
450 | #ifdef HAVE_GCOV | 447 | |
451 | __gcov_flush(); | 448 | __gcov_flush(); |
452 | #endif | 449 | |
453 | _exit(0); | 450 | _exit(0); |
454 | } | 451 | } |
455 | // wait for the child to finish | 452 | // wait for the child to finish |
@@ -462,31 +459,21 @@ int is_dir(const char *fname) { | |||
462 | if (*fname == '\0') | 459 | if (*fname == '\0') |
463 | return 0; | 460 | return 0; |
464 | 461 | ||
465 | int called_as_root = 0; | ||
466 | if (geteuid() == 0) | ||
467 | called_as_root = 1; | ||
468 | |||
469 | if (called_as_root) | ||
470 | EUID_USER(); | ||
471 | |||
472 | // if fname doesn't end in '/', add one | 462 | // if fname doesn't end in '/', add one |
473 | int rv; | 463 | int rv; |
474 | struct stat s; | 464 | struct stat s; |
475 | if (fname[strlen(fname) - 1] == '/') | 465 | if (fname[strlen(fname) - 1] == '/') |
476 | rv = stat(fname, &s); | 466 | rv = stat_as_user(fname, &s); |
477 | else { | 467 | else { |
478 | char *tmp; | 468 | char *tmp; |
479 | if (asprintf(&tmp, "%s/", fname) == -1) { | 469 | if (asprintf(&tmp, "%s/", fname) == -1) { |
480 | fprintf(stderr, "Error: cannot allocate memory, %s:%d\n", __FILE__, __LINE__); | 470 | fprintf(stderr, "Error: cannot allocate memory, %s:%d\n", __FILE__, __LINE__); |
481 | errExit("asprintf"); | 471 | errExit("asprintf"); |
482 | } | 472 | } |
483 | rv = stat(tmp, &s); | 473 | rv = stat_as_user(tmp, &s); |
484 | free(tmp); | 474 | free(tmp); |
485 | } | 475 | } |
486 | 476 | ||
487 | if (called_as_root) | ||
488 | EUID_ROOT(); | ||
489 | |||
490 | if (rv == -1) | 477 | if (rv == -1) |
491 | return 0; | 478 | return 0; |
492 | 479 | ||
@@ -1056,9 +1043,9 @@ int remove_overlay_directory(void) { | |||
1056 | // remove ~/.firejail | 1043 | // remove ~/.firejail |
1057 | if (rmdir(path) == -1) | 1044 | if (rmdir(path) == -1) |
1058 | errExit("rmdir"); | 1045 | errExit("rmdir"); |
1059 | #ifdef HAVE_GCOV | 1046 | |
1060 | __gcov_flush(); | 1047 | __gcov_flush(); |
1061 | #endif | 1048 | |
1062 | _exit(0); | 1049 | _exit(0); |
1063 | } | 1050 | } |
1064 | // wait for the child to finish | 1051 | // wait for the child to finish |
@@ -1114,9 +1101,9 @@ int create_empty_dir_as_user(const char *dir, mode_t mode) { | |||
1114 | } | 1101 | } |
1115 | else if (arg_debug) | 1102 | else if (arg_debug) |
1116 | printf("Directory %s not created: %s\n", dir, strerror(errno)); | 1103 | printf("Directory %s not created: %s\n", dir, strerror(errno)); |
1117 | #ifdef HAVE_GCOV | 1104 | |
1118 | __gcov_flush(); | 1105 | __gcov_flush(); |
1119 | #endif | 1106 | |
1120 | _exit(0); | 1107 | _exit(0); |
1121 | } | 1108 | } |
1122 | waitpid(child, NULL, 0); | 1109 | waitpid(child, NULL, 0); |
@@ -1231,6 +1218,7 @@ unsigned extract_timeout(const char *str) { | |||
1231 | } | 1218 | } |
1232 | 1219 | ||
1233 | void disable_file_or_dir(const char *fname) { | 1220 | void disable_file_or_dir(const char *fname) { |
1221 | assert(geteuid() == 0); | ||
1234 | assert(fname); | 1222 | assert(fname); |
1235 | 1223 | ||
1236 | EUID_USER(); | 1224 | EUID_USER(); |
@@ -1515,8 +1503,7 @@ void check_homedir(const char *dir) { | |||
1515 | exit(1); | 1503 | exit(1); |
1516 | } | 1504 | } |
1517 | // symlinks are rejected in many places | 1505 | // symlinks are rejected in many places |
1518 | if (has_link(dir)) { | 1506 | if (has_link(dir)) |
1519 | fprintf(stderr, "No full support for symbolic links in path of user directory.\n" | 1507 | fmessage("No full support for symbolic links in path of user directory.\n" |
1520 | "Please provide resolved path in password database (/etc/passwd).\n\n"); | 1508 | "Please provide resolved path in password database (/etc/passwd).\n\n"); |
1521 | } | ||
1522 | } | 1509 | } |
diff --git a/src/firejail/x11.c b/src/firejail/x11.c index 0619ff380..896aa2fd3 100644 --- a/src/firejail/x11.c +++ b/src/firejail/x11.c | |||
@@ -1290,9 +1290,11 @@ void x11_xorg(void) { | |||
1290 | if (envar) { | 1290 | if (envar) { |
1291 | char *rp = realpath(envar, NULL); | 1291 | char *rp = realpath(envar, NULL); |
1292 | if (rp) { | 1292 | if (rp) { |
1293 | if (strcmp(rp, dest) != 0) | 1293 | if (strcmp(rp, dest) != 0) { |
1294 | // disable_file_or_dir returns with EUID 0 | 1294 | EUID_ROOT(); |
1295 | disable_file_or_dir(rp); | 1295 | disable_file_or_dir(rp); |
1296 | EUID_USER(); | ||
1297 | } | ||
1296 | free(rp); | 1298 | free(rp); |
1297 | } | 1299 | } |
1298 | } | 1300 | } |
diff --git a/src/firemon/interface.c b/src/firemon/interface.c index b93d4a5a2..780e3d706 100644 --- a/src/firemon/interface.c +++ b/src/firemon/interface.c | |||
@@ -18,6 +18,7 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firemon.h" | 20 | #include "firemon.h" |
21 | #include "../include/gcov_wrapper.h" | ||
21 | #include <sys/types.h> | 22 | #include <sys/types.h> |
22 | #include <sys/wait.h> | 23 | #include <sys/wait.h> |
23 | #include <netdb.h> | 24 | #include <netdb.h> |
@@ -33,10 +34,6 @@ | |||
33 | //#include <net/route.h> | 34 | //#include <net/route.h> |
34 | //#include <linux/if_bridge.h> | 35 | //#include <linux/if_bridge.h> |
35 | 36 | ||
36 | #ifdef HAVE_GCOV | ||
37 | #include <gcov.h> | ||
38 | #endif | ||
39 | |||
40 | // print IP addresses for all interfaces | 37 | // print IP addresses for all interfaces |
41 | static void net_ifprint(void) { | 38 | static void net_ifprint(void) { |
42 | uint32_t ip; | 39 | uint32_t ip; |
@@ -149,9 +146,9 @@ static void print_sandbox(pid_t pid) { | |||
149 | if (rv) | 146 | if (rv) |
150 | return; | 147 | return; |
151 | net_ifprint(); | 148 | net_ifprint(); |
152 | #ifdef HAVE_GCOV | 149 | |
153 | __gcov_flush(); | 150 | __gcov_flush(); |
154 | #endif | 151 | |
155 | _exit(0); | 152 | _exit(0); |
156 | } | 153 | } |
157 | 154 | ||
diff --git a/src/firemon/netstats.c b/src/firemon/netstats.c index 23d228e26..9d8e5d7f5 100644 --- a/src/firemon/netstats.c +++ b/src/firemon/netstats.c | |||
@@ -18,16 +18,13 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firemon.h" | 20 | #include "firemon.h" |
21 | #include "../include/gcov_wrapper.h" | ||
21 | #include <termios.h> | 22 | #include <termios.h> |
22 | #include <sys/ioctl.h> | 23 | #include <sys/ioctl.h> |
23 | #include <sys/types.h> | 24 | #include <sys/types.h> |
24 | #include <sys/stat.h> | 25 | #include <sys/stat.h> |
25 | #include <unistd.h> | 26 | #include <unistd.h> |
26 | 27 | ||
27 | #ifdef HAVE_GCOV | ||
28 | #include <gcov.h> | ||
29 | #endif | ||
30 | |||
31 | #define MAXBUF 4096 | 28 | #define MAXBUF 4096 |
32 | 29 | ||
33 | // ip -s link: device stats | 30 | // ip -s link: device stats |
@@ -246,8 +243,7 @@ void netstats(void) { | |||
246 | print_proc(i, itv, col); | 243 | print_proc(i, itv, col); |
247 | } | 244 | } |
248 | } | 245 | } |
249 | #ifdef HAVE_GCOV | 246 | |
250 | __gcov_flush(); | 247 | __gcov_flush(); |
251 | #endif | ||
252 | } | 248 | } |
253 | } | 249 | } |
diff --git a/src/firemon/procevent.c b/src/firemon/procevent.c index 4e809681e..716a9cba4 100644 --- a/src/firemon/procevent.c +++ b/src/firemon/procevent.c | |||
@@ -18,6 +18,7 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firemon.h" | 20 | #include "firemon.h" |
21 | #include "../include/gcov_wrapper.h" | ||
21 | #include <sys/socket.h> | 22 | #include <sys/socket.h> |
22 | #include <linux/connector.h> | 23 | #include <linux/connector.h> |
23 | #include <linux/netlink.h> | 24 | #include <linux/netlink.h> |
@@ -30,10 +31,6 @@ | |||
30 | #include <fcntl.h> | 31 | #include <fcntl.h> |
31 | #include <sys/uio.h> | 32 | #include <sys/uio.h> |
32 | 33 | ||
33 | #ifdef HAVE_GCOV | ||
34 | #include <gcov.h> | ||
35 | #endif | ||
36 | |||
37 | #define PIDS_BUFLEN 4096 | 34 | #define PIDS_BUFLEN 4096 |
38 | #define SERVER_PORT 889 // 889-899 is left unassigned by IANA | 35 | #define SERVER_PORT 889 // 889-899 is left unassigned by IANA |
39 | 36 | ||
@@ -234,9 +231,7 @@ static void __attribute__((noreturn)) procevent_monitor(const int sock, pid_t my | |||
234 | tv.tv_usec = 0; | 231 | tv.tv_usec = 0; |
235 | 232 | ||
236 | while (1) { | 233 | while (1) { |
237 | #ifdef HAVE_GCOV | ||
238 | __gcov_flush(); | 234 | __gcov_flush(); |
239 | #endif | ||
240 | 235 | ||
241 | #define BUFFSIZE 4096 | 236 | #define BUFFSIZE 4096 |
242 | char __attribute__ ((aligned(NLMSG_ALIGNTO)))buf[BUFFSIZE]; | 237 | char __attribute__ ((aligned(NLMSG_ALIGNTO)))buf[BUFFSIZE]; |
diff --git a/src/firemon/top.c b/src/firemon/top.c index 9d6f34991..2217cc7de 100644 --- a/src/firemon/top.c +++ b/src/firemon/top.c | |||
@@ -18,16 +18,13 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firemon.h" | 20 | #include "firemon.h" |
21 | #include "../include/gcov_wrapper.h" | ||
21 | #include <termios.h> | 22 | #include <termios.h> |
22 | #include <sys/ioctl.h> | 23 | #include <sys/ioctl.h> |
23 | #include <sys/types.h> | 24 | #include <sys/types.h> |
24 | #include <sys/stat.h> | 25 | #include <sys/stat.h> |
25 | #include <unistd.h> | 26 | #include <unistd.h> |
26 | 27 | ||
27 | #ifdef HAVE_GCOV | ||
28 | #include <gcov.h> | ||
29 | #endif | ||
30 | |||
31 | static unsigned pgs_rss = 0; | 28 | static unsigned pgs_rss = 0; |
32 | static unsigned pgs_shared = 0; | 29 | static unsigned pgs_shared = 0; |
33 | static unsigned clocktick = 0; | 30 | static unsigned clocktick = 0; |
@@ -330,8 +327,7 @@ void top(void) { | |||
330 | } | 327 | } |
331 | } | 328 | } |
332 | head_print(col, row); | 329 | head_print(col, row); |
333 | #ifdef HAVE_GCOV | 330 | |
334 | __gcov_flush(); | 331 | __gcov_flush(); |
335 | #endif | ||
336 | } | 332 | } |
337 | } | 333 | } |
diff --git a/src/fldd/main.c b/src/fldd/main.c index 9d91557c1..b71145793 100644 --- a/src/fldd/main.c +++ b/src/fldd/main.c | |||
@@ -261,12 +261,21 @@ static void walk_directory(const char *dirname) { | |||
261 | 261 | ||
262 | // check directory | 262 | // check directory |
263 | // entry->d_type field is supported in glibc since version 2.19 (Feb 2014) | 263 | // entry->d_type field is supported in glibc since version 2.19 (Feb 2014) |
264 | // we'll use stat to check for directories | 264 | // we'll use stat to check for directories using the real path |
265 | // (sometimes the path is a double symlink to a real file and stat would fail) | ||
266 | char *rpath = realpath(path, NULL); | ||
267 | if (!rpath) { | ||
268 | free(path); | ||
269 | continue; | ||
270 | } | ||
271 | free(path); | ||
272 | |||
265 | struct stat s; | 273 | struct stat s; |
266 | if (stat(path, &s) == -1) | 274 | if (stat(rpath, &s) == -1) |
267 | errExit("stat"); | 275 | errExit("stat"); |
268 | if (S_ISDIR(s.st_mode)) | 276 | if (S_ISDIR(s.st_mode)) |
269 | walk_directory(path); | 277 | walk_directory(rpath); |
278 | free(rpath); | ||
270 | } | 279 | } |
271 | closedir(dir); | 280 | closedir(dir); |
272 | } | 281 | } |
diff --git a/src/include/gcov_wrapper.h b/src/include/gcov_wrapper.h new file mode 100644 index 000000000..4aafb8e18 --- /dev/null +++ b/src/include/gcov_wrapper.h | |||
@@ -0,0 +1,46 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2021 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | |||
21 | #ifndef GCOV_WRAPPER_H | ||
22 | #define GCOV_WRAPPER_H | ||
23 | |||
24 | #ifdef HAS_GCOV | ||
25 | #include <gcov.h> | ||
26 | |||
27 | /* | ||
28 | * __gcov_flush was removed on gcc 11.1.0 (as it's no longer needed), but it | ||
29 | * appears to be the safe/"correct" way to do things on previous versions (as | ||
30 | * it ensured proper locking, which is now done elsewhere). Thus, keep using | ||
31 | * it in the code and ensure that it exists, in order to support gcc <11.1.0 | ||
32 | * and gcc >=11.1.0, respectively. | ||
33 | */ | ||
34 | #if __GNUC__ > 11 || (__GNUC__ == 11 && __GNUC_MINOR__ >= 1) | ||
35 | static void __gcov_flush(void) { | ||
36 | __gcov_dump(); | ||
37 | __gcov_reset(); | ||
38 | } | ||
39 | #endif | ||
40 | #else | ||
41 | #define __gcov_dump() ((void)0) | ||
42 | #define __gcov_reset() ((void)0) | ||
43 | #define __gcov_flush() ((void)0) | ||
44 | #endif /* HAS_GCOV */ | ||
45 | |||
46 | #endif /* GCOV_WRAPPER_H */ | ||
diff --git a/src/jailcheck/jailcheck.h b/src/jailcheck/jailcheck.h index be3104da3..3f8c89bfb 100644 --- a/src/jailcheck/jailcheck.h +++ b/src/jailcheck/jailcheck.h | |||
@@ -61,4 +61,4 @@ char *get_homedir(const char *user, uid_t *uid, gid_t *gid); | |||
61 | int find_child(pid_t pid); | 61 | int find_child(pid_t pid); |
62 | pid_t switch_to_child(pid_t pid); | 62 | pid_t switch_to_child(pid_t pid); |
63 | 63 | ||
64 | #endif \ No newline at end of file | 64 | #endif |
diff --git a/src/jailcheck/noexec.c b/src/jailcheck/noexec.c index 7f994d6a1..be18ac109 100644 --- a/src/jailcheck/noexec.c +++ b/src/jailcheck/noexec.c | |||
@@ -110,4 +110,4 @@ void noexec_test(const char *path) { | |||
110 | wait(&status); | 110 | wait(&status); |
111 | int rv = unlink(fname); | 111 | int rv = unlink(fname); |
112 | (void) rv; | 112 | (void) rv; |
113 | } \ No newline at end of file | 113 | } |
diff --git a/src/lib/syscall.c b/src/lib/syscall.c index b3131ac17..d0d9ff5aa 100644 --- a/src/lib/syscall.c +++ b/src/lib/syscall.c | |||
@@ -253,9 +253,6 @@ static const SyscallGroupList sysgroups[] = { | |||
253 | #ifdef SYS_fanotify_init | 253 | #ifdef SYS_fanotify_init |
254 | "fanotify_init," | 254 | "fanotify_init," |
255 | #endif | 255 | #endif |
256 | #ifdef SYS_kcmp | ||
257 | "kcmp," | ||
258 | #endif | ||
259 | #ifdef SYS_add_key | 256 | #ifdef SYS_add_key |
260 | "add_key," | 257 | "add_key," |
261 | #endif | 258 | #endif |
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt index db58e0910..a76fd3765 100644 --- a/src/man/firejail-profile.txt +++ b/src/man/firejail-profile.txt | |||
@@ -78,7 +78,7 @@ in your desktop environment copy the profile file in ~/.config/firejail director | |||
78 | Several command line options can be passed to the program using | 78 | Several command line options can be passed to the program using |
79 | profile files. Firejail chooses the profile file as follows: | 79 | profile files. Firejail chooses the profile file as follows: |
80 | 80 | ||
81 | \fB1.\fR If a profile file is provided by the user with \-\-profile option, the profile file is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. | 81 | \fB1.\fR If a profile file is provided by the user with \-\-profile option, the profile file is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. |
82 | Example: | 82 | Example: |
83 | .PP | 83 | .PP |
84 | .RS | 84 | .RS |
@@ -324,16 +324,16 @@ Remount the file or the directory noexec, nodev and nosuid. | |||
324 | #ifdef HAVE_OVERLAYFS | 324 | #ifdef HAVE_OVERLAYFS |
325 | .TP | 325 | .TP |
326 | \fBoverlay | 326 | \fBoverlay |
327 | Mount a filesystem overlay on top of the current filesystem. | 327 | Mount a filesystem overlay on top of the current filesystem. |
328 | The overlay is stored in $HOME/.firejail/<PID> directory. | 328 | The overlay is stored in $HOME/.firejail/<PID> directory. |
329 | .TP | 329 | .TP |
330 | \fBoverlay-named name | 330 | \fBoverlay-named name |
331 | Mount a filesystem overlay on top of the current filesystem. | 331 | Mount a filesystem overlay on top of the current filesystem. |
332 | The overlay is stored in $HOME/.firejail/name directory. | 332 | The overlay is stored in $HOME/.firejail/name directory. |
333 | .TP | 333 | .TP |
334 | \fBoverlay-tmpfs | 334 | \fBoverlay-tmpfs |
335 | Mount a filesystem overlay on top of the current filesystem. | 335 | Mount a filesystem overlay on top of the current filesystem. |
336 | All filesystem modifications are discarded when the sandbox is closed. | 336 | All filesystem modifications are discarded when the sandbox is closed. |
337 | #endif | 337 | #endif |
338 | .TP | 338 | .TP |
339 | \fBprivate | 339 | \fBprivate |
@@ -487,12 +487,12 @@ does not result in an increase of privilege. | |||
487 | #ifdef HAVE_USERNS | 487 | #ifdef HAVE_USERNS |
488 | .TP | 488 | .TP |
489 | \fBnoroot | 489 | \fBnoroot |
490 | Use this command to enable an user namespace. The namespace has only one user, the current user. | 490 | Use this command to enable an user namespace. The namespace has only one user, the current user. |
491 | There is no root account (uid 0) defined in the namespace. | 491 | There is no root account (uid 0) defined in the namespace. |
492 | #endif | 492 | #endif |
493 | .TP | 493 | .TP |
494 | \fBprotocol protocol1,protocol2,protocol3 | 494 | \fBprotocol protocol1,protocol2,protocol3 |
495 | Enable protocol filter. The filter is based on seccomp and checks the | 495 | Enable protocol filter. The filter is based on seccomp and checks the |
496 | first argument to socket system call. Recognized values: \fBunix\fR, | 496 | first argument to socket system call. Recognized values: \fBunix\fR, |
497 | \fBinet\fR, \fBinet6\fR, \fBnetlink\fR, \fBpacket\fR and \fBbluetooth\fR. | 497 | \fBinet\fR, \fBinet6\fR, \fBnetlink\fR, \fBpacket\fR and \fBbluetooth\fR. |
498 | .TP | 498 | .TP |
@@ -606,7 +606,7 @@ Allow the application to see but not talk to the name org.freedesktop.Notificati | |||
606 | Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. | 606 | Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. |
607 | .TP | 607 | .TP |
608 | \fBdbus-system.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | 608 | \fBdbus-system.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications |
609 | Allow the application to receive broadcast signals from the the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. | 609 | Allow the application to receive broadcast signals from the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. |
610 | .TP | 610 | .TP |
611 | \fBdbus-user filter | 611 | \fBdbus-user filter |
612 | Enable filtered access to the session DBus. Filters can be specified with the dbus-user.talk and dbus-user.own commands. | 612 | Enable filtered access to the session DBus. Filters can be specified with the dbus-user.talk and dbus-user.own commands. |
@@ -752,6 +752,9 @@ Disable U2F devices. | |||
752 | \fBnovideo | 752 | \fBnovideo |
753 | Disable video capture devices. | 753 | Disable video capture devices. |
754 | .TP | 754 | .TP |
755 | \fBmachine-id | ||
756 | Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox. | ||
757 | .TP | ||
755 | \fBshell none | 758 | \fBshell none |
756 | Run the program directly, without a shell. | 759 | Run the program directly, without a shell. |
757 | 760 | ||
@@ -870,8 +873,8 @@ a DHCP client and releasing the lease manually. | |||
870 | 873 | ||
871 | .TP | 874 | .TP |
872 | \fBiprange address,address | 875 | \fBiprange address,address |
873 | Assign an IP address in the provided range to the last network | 876 | Assign an IP address in the provided range to the last network |
874 | interface defined by a net command. A default gateway is assigned by default. | 877 | interface defined by a net command. A default gateway is assigned by default. |
875 | .br | 878 | .br |
876 | 879 | ||
877 | .br | 880 | .br |
@@ -889,10 +892,6 @@ iprange 192.168.1.150,192.168.1.160 | |||
889 | Assign MAC addresses to the last network interface defined by a net command. | 892 | Assign MAC addresses to the last network interface defined by a net command. |
890 | 893 | ||
891 | .TP | 894 | .TP |
892 | \fBmachine-id | ||
893 | Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox. | ||
894 | |||
895 | .TP | ||
896 | \fBmtu number | 895 | \fBmtu number |
897 | Assign a MTU value to the last network interface defined by a net command. | 896 | Assign a MTU value to the last network interface defined by a net command. |
898 | 897 | ||
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index d18811316..2883ab257 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -45,7 +45,7 @@ firejail {\-? | \-\-debug-caps | \-\-debug-errnos | \-\-debug-syscalls | \-\-deb | |||
45 | #ifdef HAVE_LTS | 45 | #ifdef HAVE_LTS |
46 | This is Firejail long-term support (LTS), an enterprise focused version of the software, | 46 | This is Firejail long-term support (LTS), an enterprise focused version of the software, |
47 | LTS is usually supported for two or three years. | 47 | LTS is usually supported for two or three years. |
48 | During this time only bugs and the occasional documentation problems are fixed. | 48 | During this time only bugs and the occasional documentation problems are fixed. |
49 | The attack surface of the SUID executable was greatly reduced by removing some of the features. | 49 | The attack surface of the SUID executable was greatly reduced by removing some of the features. |
50 | .br | 50 | .br |
51 | 51 | ||
@@ -109,7 +109,7 @@ ptrace system call allows a full bypass of the seccomp filter. | |||
109 | .br | 109 | .br |
110 | Example: | 110 | Example: |
111 | .br | 111 | .br |
112 | $ firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox | 112 | $ firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox |
113 | .TP | 113 | .TP |
114 | \fB\-\-allusers | 114 | \fB\-\-allusers |
115 | All directories under /home are visible inside the sandbox. By default, only current user home directory is visible. | 115 | All directories under /home are visible inside the sandbox. By default, only current user home directory is visible. |
@@ -947,7 +947,7 @@ $ firejail \-\-net=eth0 \-\-\iprange=192.168.1.100,192.168.1.150 | |||
947 | 947 | ||
948 | .TP | 948 | .TP |
949 | \fB\-\-ipc-namespace | 949 | \fB\-\-ipc-namespace |
950 | Enable a new IPC namespace if the sandbox was started as a regular user. IPC namespace is enabled by default | 950 | Enable a new IPC namespace if the sandbox was started as a regular user. IPC namespace is enabled by default |
951 | for sandboxes started as root. | 951 | for sandboxes started as root. |
952 | .br | 952 | .br |
953 | 953 | ||
@@ -1014,7 +1014,7 @@ $ sudo firejail --join-network=browser /sbin/iptables -vL | |||
1014 | .br | 1014 | .br |
1015 | 1015 | ||
1016 | .br | 1016 | .br |
1017 | # verify IP addresses | 1017 | # verify IP addresses |
1018 | .br | 1018 | .br |
1019 | $ sudo firejail --join-network=browser ip addr | 1019 | $ sudo firejail --join-network=browser ip addr |
1020 | .br | 1020 | .br |
@@ -2134,7 +2134,7 @@ Use k(ilobyte), m(egabyte) or g(igabyte) for size suffix (base 1024). | |||
2134 | .TP | 2134 | .TP |
2135 | \fB\-\-rlimit-cpu=number | 2135 | \fB\-\-rlimit-cpu=number |
2136 | Set the maximum limit, in seconds, for the amount of CPU time each | 2136 | Set the maximum limit, in seconds, for the amount of CPU time each |
2137 | sandboxed process can consume. When the limit is reached, the processes are killed. | 2137 | sandboxed process can consume. When the limit is reached, the processes are killed. |
2138 | 2138 | ||
2139 | The CPU limit is a limit on CPU seconds rather than elapsed time. CPU seconds is basically how many seconds | 2139 | The CPU limit is a limit on CPU seconds rather than elapsed time. CPU seconds is basically how many seconds |
2140 | the CPU has been in use and does not necessarily directly relate to the elapsed time. Linux kernel keeps | 2140 | the CPU has been in use and does not necessarily directly relate to the elapsed time. Linux kernel keeps |
@@ -2178,7 +2178,7 @@ $ firejail \-\-net=eth0 \-\-scan | |||
2178 | .TP | 2178 | .TP |
2179 | \fB\-\-seccomp | 2179 | \fB\-\-seccomp |
2180 | Enable seccomp filter and blacklist the syscalls in the default list, | 2180 | Enable seccomp filter and blacklist the syscalls in the default list, |
2181 | which is @default-nodebuggers unless allow-debuggers is specified, | 2181 | which is @default-nodebuggers unless \-\-allow-debuggers is specified, |
2182 | then it is @default. | 2182 | then it is @default. |
2183 | 2183 | ||
2184 | .br | 2184 | .br |
@@ -2189,18 +2189,13 @@ system call groups are defined: @aio, @basic-io, @chown, @clock, | |||
2189 | @network-io, @obsolete, @privileged, @process, @raw-io, @reboot, | 2189 | @network-io, @obsolete, @privileged, @process, @raw-io, @reboot, |
2190 | @resources, @setuid, @swap, @sync, @system-service and @timer. | 2190 | @resources, @setuid, @swap, @sync, @system-service and @timer. |
2191 | More information about groups can be found in /usr/share/doc/firejail/syscalls.txt | 2191 | More information about groups can be found in /usr/share/doc/firejail/syscalls.txt |
2192 | 2192 | .br | |
2193 | In addition, a system call can be specified by its number instead of | ||
2194 | name with prefix $, so for example $165 would be equal to mount on i386. | ||
2195 | Exceptions can be allowed with prefix !. | ||
2196 | 2193 | ||
2197 | .br | 2194 | .br |
2198 | System architecture is strictly imposed only if flag | 2195 | System architecture is strictly imposed only if flag |
2199 | \-\-seccomp.block-secondary is used. The filter is applied at run time | 2196 | \-\-seccomp.block-secondary is used. The filter is applied at run time |
2200 | only if the correct architecture was detected. For the case of I386 | 2197 | only if the correct architecture was detected. For the case of I386 |
2201 | and AMD64 both 32-bit and 64-bit filters are installed. On a 64 bit | 2198 | and AMD64 both 32-bit and 64-bit filters are installed. |
2202 | architecture, an additional filter for 32 bit system calls can be | ||
2203 | installed with \-\-seccomp.32. | ||
2204 | .br | 2199 | .br |
2205 | 2200 | ||
2206 | .br | 2201 | .br |
@@ -2211,11 +2206,18 @@ Firejail will print seccomp violations to the audit log if the kernel was compil | |||
2211 | Example: | 2206 | Example: |
2212 | .br | 2207 | .br |
2213 | $ firejail \-\-seccomp | 2208 | $ firejail \-\-seccomp |
2209 | .br | ||
2210 | |||
2211 | .br | ||
2212 | The default list can be customized, see \-\-seccomp= for a description. It can be customized | ||
2213 | also globally in /etc/firejail/firejail.config file. | ||
2214 | |||
2214 | .TP | 2215 | .TP |
2215 | \fB\-\-seccomp=syscall,@group,!syscall2 | 2216 | \fB\-\-seccomp=syscall,@group,!syscall2 |
2216 | Enable seccomp filter, whitelist "syscall2", but blacklist the default | 2217 | Enable seccomp filter, blacklist the default list and the syscalls or syscall groups |
2217 | list and the syscalls or syscall groups specified by the | 2218 | specified by the command, but don't blacklist "syscall2". On a 64 bit |
2218 | command. | 2219 | architecture, an additional filter for 32 bit system calls can be |
2220 | installed with \-\-seccomp.32. | ||
2219 | .br | 2221 | .br |
2220 | 2222 | ||
2221 | .br | 2223 | .br |
@@ -2225,6 +2227,13 @@ $ firejail \-\-seccomp=utime,utimensat,utimes firefox | |||
2225 | .br | 2227 | .br |
2226 | $ firejail \-\-seccomp=@clock,mkdir,unlinkat transmission-gtk | 2228 | $ firejail \-\-seccomp=@clock,mkdir,unlinkat transmission-gtk |
2227 | .br | 2229 | .br |
2230 | $ firejail '\-\-seccomp=@ipc,!pipe,!pipe2' audacious | ||
2231 | .br | ||
2232 | |||
2233 | .br | ||
2234 | Syscalls can be specified by their number if prefix $ is added, | ||
2235 | so for example $165 would be equal to mount on i386. | ||
2236 | .br | ||
2228 | 2237 | ||
2229 | .br | 2238 | .br |
2230 | Instead of dropping the syscall by returning EPERM, another error | 2239 | Instead of dropping the syscall by returning EPERM, another error |
@@ -2237,6 +2246,7 @@ by using \fBsyscall:kill\fR syntax, or the attempt may be logged with | |||
2237 | 2246 | ||
2238 | .br | 2247 | .br |
2239 | Example: | 2248 | Example: |
2249 | .br | ||
2240 | $ firejail \-\-seccomp=unlinkat:ENOENT,utimensat,utimes | 2250 | $ firejail \-\-seccomp=unlinkat:ENOENT,utimensat,utimes |
2241 | .br | 2251 | .br |
2242 | Parent pid 10662, child pid 10663 | 2252 | Parent pid 10662, child pid 10663 |
@@ -2245,9 +2255,13 @@ Child process initialized | |||
2245 | .br | 2255 | .br |
2246 | $ touch testfile | 2256 | $ touch testfile |
2247 | .br | 2257 | .br |
2258 | $ ls testfile | ||
2259 | .br | ||
2260 | testfile | ||
2261 | .br | ||
2248 | $ rm testfile | 2262 | $ rm testfile |
2249 | .br | 2263 | .br |
2250 | rm: cannot remove `testfile': Operation not permitted | 2264 | rm: cannot remove `testfile': No such file or directory |
2251 | .br | 2265 | .br |
2252 | 2266 | ||
2253 | .br | 2267 | .br |
@@ -2260,7 +2274,7 @@ filters. | |||
2260 | .br | 2274 | .br |
2261 | Example: | 2275 | Example: |
2262 | .br | 2276 | .br |
2263 | $ firejail \-\-noprofile \-\-shell=none \-\-seccomp=execve bash | 2277 | $ firejail \-\-noprofile \-\-shell=none \-\-seccomp=execve sh |
2264 | .br | 2278 | .br |
2265 | Parent pid 32751, child pid 32752 | 2279 | Parent pid 32751, child pid 32752 |
2266 | .br | 2280 | .br |
@@ -2272,8 +2286,7 @@ Child process initialized in 46.44 ms | |||
2272 | .br | 2286 | .br |
2273 | $ ls | 2287 | $ ls |
2274 | .br | 2288 | .br |
2275 | Bad system call | 2289 | Operation not permitted |
2276 | .br | ||
2277 | 2290 | ||
2278 | .TP | 2291 | .TP |
2279 | \fB\-\-seccomp.block-secondary | 2292 | \fB\-\-seccomp.block-secondary |
@@ -2317,15 +2330,15 @@ Child process initialized | |||
2317 | .br | 2330 | .br |
2318 | $ touch testfile | 2331 | $ touch testfile |
2319 | .br | 2332 | .br |
2333 | $ ls testfile | ||
2334 | .br | ||
2335 | testfile | ||
2336 | .br | ||
2320 | $ rm testfile | 2337 | $ rm testfile |
2321 | .br | 2338 | .br |
2322 | rm: cannot remove `testfile': Operation not permitted | 2339 | rm: cannot remove `testfile': No such file or directory |
2323 | .br | 2340 | .br |
2324 | 2341 | ||
2325 | |||
2326 | |||
2327 | |||
2328 | |||
2329 | .TP | 2342 | .TP |
2330 | \fB\-\-seccomp.keep=syscall,@group,!syscall2 | 2343 | \fB\-\-seccomp.keep=syscall,@group,!syscall2 |
2331 | Enable seccomp filter, blacklist all syscall not listed and "syscall2". | 2344 | Enable seccomp filter, blacklist all syscall not listed and "syscall2". |
@@ -2852,7 +2865,7 @@ and it is installed by default on most Linux distributions. It provides support | |||
2852 | connection model. Untrusted clients are restricted in certain ways to prevent them from reading window | 2865 | connection model. Untrusted clients are restricted in certain ways to prevent them from reading window |
2853 | contents of other clients, stealing input events, etc. | 2866 | contents of other clients, stealing input events, etc. |
2854 | 2867 | ||
2855 | The untrusted mode has several limitations. A lot of regular programs assume they are a trusted X11 clients | 2868 | The untrusted mode has several limitations. A lot of regular programs assume they are a trusted X11 clients |
2856 | and will crash or lock up when run in untrusted mode. Chromium browser and xterm are two examples. | 2869 | and will crash or lock up when run in untrusted mode. Chromium browser and xterm are two examples. |
2857 | Firefox and transmission-gtk seem to be working fine. | 2870 | Firefox and transmission-gtk seem to be working fine. |
2858 | A network namespace is not required for this option. | 2871 | A network namespace is not required for this option. |
@@ -3243,7 +3256,7 @@ The owner of the sandbox. | |||
3243 | .SH RESTRICTED SHELL | 3256 | .SH RESTRICTED SHELL |
3244 | To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in | 3257 | To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in |
3245 | /etc/passwd file for each user that needs to be restricted. Alternatively, | 3258 | /etc/passwd file for each user that needs to be restricted. Alternatively, |
3246 | you can specify /usr/bin/firejail in adduser command: | 3259 | you can specify /usr/bin/firejail in adduser command: |
3247 | 3260 | ||
3248 | adduser \-\-shell /usr/bin/firejail username | 3261 | adduser \-\-shell /usr/bin/firejail username |
3249 | 3262 | ||
@@ -3253,7 +3266,7 @@ Additional arguments passed to firejail executable upon login are declared in /e | |||
3253 | Several command line options can be passed to the program using | 3266 | Several command line options can be passed to the program using |
3254 | profile files. Firejail chooses the profile file as follows: | 3267 | profile files. Firejail chooses the profile file as follows: |
3255 | 3268 | ||
3256 | 1. If a profile file is provided by the user with --profile=FILE option, the profile FILE is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. If there is a file with the same name as the given profile name, it will be used instead of doing the profile search. To force a profile search, prefix the profile name with a colon (:), eg. --profile=:PROFILE_NAME. | 3269 | 1. If a profile file is provided by the user with --profile=FILE option, the profile FILE is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. If there is a file with the same name as the given profile name, it will be used instead of doing the profile search. To force a profile search, prefix the profile name with a colon (:), eg. --profile=:PROFILE_NAME. |
3257 | Example: | 3270 | Example: |
3258 | .PP | 3271 | .PP |
3259 | .RS | 3272 | .RS |
diff --git a/src/man/firemon.txt b/src/man/firemon.txt index 76b2f7be2..c4e6e15b3 100644 --- a/src/man/firemon.txt +++ b/src/man/firemon.txt | |||
@@ -56,7 +56,7 @@ Print route table for each sandbox. | |||
56 | Print seccomp configuration for each sandbox. | 56 | Print seccomp configuration for each sandbox. |
57 | .TP | 57 | .TP |
58 | \fB\-\-top | 58 | \fB\-\-top |
59 | Monitor the most CPU-intensive sandboxes. This command is similar to | 59 | Monitor the most CPU-intensive sandboxes. This command is similar to |
60 | the regular UNIX top command, however it applies only to sandboxes. | 60 | the regular UNIX top command, however it applies only to sandboxes. |
61 | .TP | 61 | .TP |
62 | \fB\-\-tree | 62 | \fB\-\-tree |
diff --git a/src/tools/profcleaner.c b/src/tools/profcleaner.c new file mode 100644 index 000000000..beff93199 --- /dev/null +++ b/src/tools/profcleaner.c | |||
@@ -0,0 +1,75 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014-2021 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | |||
21 | //************************************************************* | ||
22 | // Small utility program to convert profiles from blacklist/whitelist to deny/allow | ||
23 | // Compile: | ||
24 | // gcc -o profcleaner profcleaner.c | ||
25 | // Usage: | ||
26 | // profcleaner *.profile | ||
27 | //************************************************************* | ||
28 | |||
29 | #include <stdio.h> | ||
30 | #include <stdlib.h> | ||
31 | #include <string.h> | ||
32 | #include <unistd.h> | ||
33 | #define MAXBUF 4096 | ||
34 | |||
35 | int main(int argc, char **argv) { | ||
36 | printf("Usage: profcleaner files\n"); | ||
37 | int i; | ||
38 | |||
39 | for (i = 1; i < argc; i++) { | ||
40 | FILE *fp = fopen(argv[i], "r"); | ||
41 | if (!fp) { | ||
42 | fprintf(stderr, "Error: cannot open %s\n", argv[i]); | ||
43 | return 1; | ||
44 | } | ||
45 | |||
46 | FILE *fpout = fopen("profcleaner-tmp", "w"); | ||
47 | if (!fpout) { | ||
48 | fprintf(stderr, "Error: cannot open output file\n"); | ||
49 | return 1; | ||
50 | } | ||
51 | |||
52 | char buf[MAXBUF]; | ||
53 | while (fgets(buf, MAXBUF, fp)) { | ||
54 | if (strncmp(buf, "blacklist-nolog", 15) == 0) | ||
55 | fprintf(fpout, "deny-nolog %s", buf + 15); | ||
56 | else if (strncmp(buf, "blacklist", 9) == 0) | ||
57 | fprintf(fpout, "deny %s", buf + 9); | ||
58 | else if (strncmp(buf, "noblacklist", 11) == 0) | ||
59 | fprintf(fpout, "nodeny %s", buf + 11); | ||
60 | else if (strncmp(buf, "whitelist", 9) == 0) | ||
61 | fprintf(fpout, "allow %s", buf + 9); | ||
62 | else if (strncmp(buf, "nowhitelist", 11) == 0) | ||
63 | fprintf(fpout, "noallow %s", buf + 11); | ||
64 | else | ||
65 | fprintf(fpout, "%s", buf); | ||
66 | } | ||
67 | |||
68 | fclose(fp); | ||
69 | fclose(fpout); | ||
70 | unlink(argv[i]); | ||
71 | rename("profcleaner-tmp", argv[i]); | ||
72 | } | ||
73 | |||
74 | return 0; | ||
75 | } | ||
diff --git a/src/tools/profcleaner.sh b/src/tools/profcleaner.sh new file mode 100755 index 000000000..96402aed6 --- /dev/null +++ b/src/tools/profcleaner.sh | |||
@@ -0,0 +1,45 @@ | |||
1 | #!/bin/bash | ||
2 | |||
3 | # Copyright (C) 2021 Firejail Authors | ||
4 | # | ||
5 | # This file is part of firejail project | ||
6 | # | ||
7 | # This program is free software; you can redistribute it and/or modify | ||
8 | # it under the terms of the GNU General Public License as published by | ||
9 | # the Free Software Foundation; either version 2 of the License, or | ||
10 | # (at your option) any later version. | ||
11 | # | ||
12 | # This program is distributed in the hope that it will be useful, | ||
13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
15 | # GNU General Public License for more details. | ||
16 | # | ||
17 | # You should have received a copy of the GNU General Public License along | ||
18 | # with this program; if not, write to the Free Software Foundation, Inc., | ||
19 | # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
20 | |||
21 | if [[ $1 == --help ]]; then | ||
22 | cat <<-EOM | ||
23 | USAGE: | ||
24 | profcleaner.sh --help Show this help message and exit | ||
25 | profcleaner.sh --system Clean all profiles in /etc/firejail | ||
26 | profcleaner.sh --user Clean all profiles in ~/.config/firejail | ||
27 | profcleaner.sh /path/to/profile1 /path/to/profile2 ... | ||
28 | EOM | ||
29 | exit 0 | ||
30 | fi | ||
31 | |||
32 | if [[ $1 == --system ]]; then | ||
33 | profiles=(/etc/firejail/*.{inc,local,profile}) | ||
34 | elif [[ $1 == --user ]]; then | ||
35 | profiles=("$HOME"/.config/firejail/*.{inc,local,profile}) | ||
36 | else | ||
37 | profiles=("$@") | ||
38 | fi | ||
39 | |||
40 | sed -i -E \ | ||
41 | -e "s/^(# |#)?(ignore )?blacklist/\1\2deny/" \ | ||
42 | -e "s/^(# |#)?(ignore )?noblacklist/\1\2nodeny/" \ | ||
43 | -e "s/^(# |#)?(ignore )?whitelist/\1\2allow/" \ | ||
44 | -e "s/^(# |#)?(ignore )?nowhitelist/\1\2noallow/" \ | ||
45 | "${profiles[@]}" | ||
diff --git a/src/zsh_completion/_firejail.in b/src/zsh_completion/_firejail.in index f1a19b86d..c7f6ee3f1 100644 --- a/src/zsh_completion/_firejail.in +++ b/src/zsh_completion/_firejail.in | |||
@@ -48,8 +48,8 @@ _firejail_args=( | |||
48 | '*::arguments:_normal' | 48 | '*::arguments:_normal' |
49 | 49 | ||
50 | '--appimage[sandbox an AppImage application]' | 50 | '--appimage[sandbox an AppImage application]' |
51 | '--build[build a whitelisted profile for the application and print it on stdout]' | 51 | '--build[build a profile for the application and print it on stdout]' |
52 | '--build=-[build a whitelisted profile for the application and save it]: :_files' | 52 | '--build=-[build a profile for the application and save it]: :_files' |
53 | # Ignore that you can do -? too as it's the only short option | 53 | # Ignore that you can do -? too as it's the only short option |
54 | '--help[this help screen]' | 54 | '--help[this help screen]' |
55 | '--join=-[join the sandbox name|pid]: :_all_firejails' | 55 | '--join=-[join the sandbox name|pid]: :_all_firejails' |
@@ -62,15 +62,18 @@ _firejail_args=( | |||
62 | '--tree[print a tree of all sandboxed processes]' | 62 | '--tree[print a tree of all sandboxed processes]' |
63 | '--version[print program version and exit]' | 63 | '--version[print program version and exit]' |
64 | 64 | ||
65 | '--ids-check[verify file system]' | ||
66 | '--ids-init[initialize IDS database]' | ||
67 | |||
65 | '--debug[print sandbox debug messages]' | 68 | '--debug[print sandbox debug messages]' |
66 | '--debug-blacklists[debug blacklisting]' | 69 | '--debug-allow[debug file system access]' |
67 | '--debug-caps[print all recognized capabilities]' | 70 | '--debug-caps[print all recognized capabilities]' |
71 | '--debug-deny[debug file system access]' | ||
68 | '--debug-errnos[print all recognized error numbers]' | 72 | '--debug-errnos[print all recognized error numbers]' |
69 | '--debug-private-lib[debug for --private-lib option]' | 73 | '--debug-private-lib[debug for --private-lib option]' |
70 | '--debug-protocols[print all recognized protocols]' | 74 | '--debug-protocols[print all recognized protocols]' |
71 | '--debug-syscalls[print all recognized system calls]' | 75 | '--debug-syscalls[print all recognized system calls]' |
72 | '--debug-syscalls32[print all recognized 32 bit system calls]' | 76 | '--debug-syscalls32[print all recognized 32 bit system calls]' |
73 | '--debug-whitelists[debug whitelisting]' | ||
74 | 77 | ||
75 | '--caps.print=-[print the caps filter name|pid]:firejail:_all_firejails' | 78 | '--caps.print=-[print the caps filter name|pid]:firejail:_all_firejails' |
76 | '--cpu.print=-[print the cpus in use name|pid]: :_all_firejails' | 79 | '--cpu.print=-[print the cpus in use name|pid]: :_all_firejails' |
@@ -83,13 +86,13 @@ _firejail_args=( | |||
83 | '--allusers[all user home directories are visible inside the sandbox]' | 86 | '--allusers[all user home directories are visible inside the sandbox]' |
84 | # Should be _files, a comma and files or files -/ | 87 | # Should be _files, a comma and files or files -/ |
85 | '*--bind=-[mount-bind dirname1/filename1 on top of dirname2/filename2]: :(file1,file2 dir1,dir2)' | 88 | '*--bind=-[mount-bind dirname1/filename1 on top of dirname2/filename2]: :(file1,file2 dir1,dir2)' |
86 | '*--blacklist=-[blacklist directory or file]: :_files' | ||
87 | '--caps[enable default Linux capabilities filter]' | 89 | '--caps[enable default Linux capabilities filter]' |
88 | '--caps.drop=all[drop all capabilities]' | 90 | '--caps.drop=all[drop all capabilities]' |
89 | '*--caps.drop=-[drop capabilities: all|cap1,cap2,...]: :_caps' | 91 | '*--caps.drop=-[drop capabilities: all|cap1,cap2,...]: :_caps' |
90 | '*--caps.keep=-[keep capabilities: cap1,cap2,...]: :_caps' | 92 | '*--caps.keep=-[keep capabilities: cap1,cap2,...]: :_caps' |
91 | '--cgroup=-[place the sandbox in the specified control group]: :' | 93 | '--cgroup=-[place the sandbox in the specified control group]: :' |
92 | '--cpu=-[set cpu affinity]: :->cpus' | 94 | '--cpu=-[set cpu affinity]: :->cpus' |
95 | '*--deny=-[deny access to directory or file]: :_files' | ||
93 | "--deterministic-exit-code[always exit with first child's status code]" | 96 | "--deterministic-exit-code[always exit with first child's status code]" |
94 | '*--dns=-[set DNS server]: :' | 97 | '*--dns=-[set DNS server]: :' |
95 | '*--env=-[set environment variable]: :' | 98 | '*--env=-[set environment variable]: :' |
@@ -112,7 +115,7 @@ _firejail_args=( | |||
112 | '--nice=-[set nice value]: :(1 10 15 20)' | 115 | '--nice=-[set nice value]: :(1 10 15 20)' |
113 | '--no3d[disable 3D hardware acceleration]' | 116 | '--no3d[disable 3D hardware acceleration]' |
114 | '--noautopulse[disable automatic ~/.config/pulse init]' | 117 | '--noautopulse[disable automatic ~/.config/pulse init]' |
115 | '--noblacklist=-[disable blacklist for file or directory]: :_files' | 118 | '--nodeny=-[disable deny command for file or directory]: :_files' |
116 | '--nodbus[disable D-Bus access]' | 119 | '--nodbus[disable D-Bus access]' |
117 | '--nodvd[disable DVD and audio CD devices]' | 120 | '--nodvd[disable DVD and audio CD devices]' |
118 | '*--noexec=-[remount the file or directory noexec nosuid and nodev]: :_files' | 121 | '*--noexec=-[remount the file or directory noexec nosuid and nodev]: :_files' |
@@ -143,13 +146,13 @@ _firejail_args=( | |||
143 | '--rlimit-nproc=-[set the maximum number of processes that can be created for the real user ID of the calling process]: :' | 146 | '--rlimit-nproc=-[set the maximum number of processes that can be created for the real user ID of the calling process]: :' |
144 | '--rlimit-sigpending=-[set the maximum number of pending signals for a process]: :' | 147 | '--rlimit-sigpending=-[set the maximum number of pending signals for a process]: :' |
145 | '*--rmenv=-[remove environment variable in the new sandbox]: :_values environment-variables $(env | cut -d= -f1)' | 148 | '*--rmenv=-[remove environment variable in the new sandbox]: :_values environment-variables $(env | cut -d= -f1)' |
146 | '--seccomp[enable seccomp filter and apply the default blacklist]: :' | 149 | '--seccomp[enable seccomp filter and drop the default syscalls]: :' |
147 | '--seccomp=-[enable seccomp filter, blacklist the default syscall list and the syscalls specified by the command]: :->seccomp' | 150 | '--seccomp=-[enable seccomp filter, drop the default syscall list and the syscalls specified by the command]: :->seccomp' |
148 | '--seccomp.block-secondary[build only the native architecture filters]' | 151 | '--seccomp.block-secondary[build only the native architecture filters]' |
149 | '*--seccomp.drop=-[enable seccomp filter, and blacklist the syscalls specified by the command]: :->seccomp' | 152 | '*--seccomp.drop=-[enable seccomp filter, and drop the syscalls specified by the command]: :->seccomp' |
150 | '*--seccomp.keep=-[enable seccomp filter, and whitelist the syscalls specified by the command]: :->seccomp' | 153 | '*--seccomp.keep=-[enable seccomp filter, and allow the syscalls specified by the command]: :->seccomp' |
151 | '*--seccomp.32.drop=-[enable seccomp filter, and blacklist the 32 bit syscalls specified by the command]: :' | 154 | '*--seccomp.32.drop=-[enable seccomp filter, and drop the 32 bit syscalls specified by the command]: :' |
152 | '*--seccomp.32.keep=-[enable seccomp filter, and whitelist the 32 bit syscalls specified by the command]: :' | 155 | '*--seccomp.32.keep=-[enable seccomp filter, and drop the 32 bit syscalls specified by the command]: :' |
153 | # FIXME: Add errnos | 156 | # FIXME: Add errnos |
154 | '--seccomp-error-action=-[change error code, kill process or log the attempt]: :(kill log)' | 157 | '--seccomp-error-action=-[change error code, kill process or log the attempt]: :(kill log)' |
155 | '--shell=none[run the program directly without a user shell]' | 158 | '--shell=none[run the program directly without a user shell]' |
@@ -157,7 +160,7 @@ _firejail_args=( | |||
157 | '--timeout=-[kill the sandbox automatically after the time has elapsed]: :' | 160 | '--timeout=-[kill the sandbox automatically after the time has elapsed]: :' |
158 | #'(--tracelog)--trace[trace open, access and connect system calls]' | 161 | #'(--tracelog)--trace[trace open, access and connect system calls]' |
159 | '(--tracelog)--trace=-[trace open, access and connect system calls]: :_files' | 162 | '(--tracelog)--trace=-[trace open, access and connect system calls]: :_files' |
160 | '(--trace)--tracelog[add a syslog message for every access to files or directories blacklisted by the security profile]' | 163 | '(--trace)--tracelog[add a syslog message for every access to files or directories dropped by the security profile]' |
161 | '(--private-etc)--writable-etc[/etc directory is mounted read-write]' | 164 | '(--private-etc)--writable-etc[/etc directory is mounted read-write]' |
162 | '--writable-run-user[allow access to /run/user/$UID/systemd and /run/user/$UID/gnupg]' | 165 | '--writable-run-user[allow access to /run/user/$UID/systemd and /run/user/$UID/gnupg]' |
163 | '--writable-var[/var directory is mounted read-write]' | 166 | '--writable-var[/var directory is mounted read-write]' |
@@ -215,7 +218,7 @@ _firejail_args=( | |||
215 | '--netfilter.print=-[print the firewall name|pid]: :_all_firejails' | 218 | '--netfilter.print=-[print the firewall name|pid]: :_all_firejails' |
216 | '--netfilter6=-[enable IPv6 firewall]: :' | 219 | '--netfilter6=-[enable IPv6 firewall]: :' |
217 | '--netfilter6.print=-[print the IPv6 firewall name|pid]: :_all_firejails' | 220 | '--netfilter6.print=-[print the IPv6 firewall name|pid]: :_all_firejails' |
218 | '--netmask=-[define a network mask when dealing with unconfigured parrent interfaces]: :' | 221 | '--netmask=-[define a network mask when dealing with unconfigured parent interfaces]: :' |
219 | '--netns=-[Run the program in a named, persistent network namespace]: :' | 222 | '--netns=-[Run the program in a named, persistent network namespace]: :' |
220 | '--netstats[monitor network statistics]' | 223 | '--netstats[monitor network statistics]' |
221 | '--interface=-[move interface in sandbox]: :' | 224 | '--interface=-[move interface in sandbox]: :' |
@@ -251,10 +254,8 @@ _firejail_args=( | |||
251 | '*--tmpfs=-[mount a tmpfs filesystem on directory dirname]: :_files -/' | 254 | '*--tmpfs=-[mount a tmpfs filesystem on directory dirname]: :_files -/' |
252 | #endif | 255 | #endif |
253 | 256 | ||
254 | #ifdef HAVE_WHITELIST | 257 | '*--noallow=-[disable allow command for file or directory]: :_files' |
255 | '*--nowhitelist=-[disable whitelist for file or directory]: :_files' | 258 | '*--allow=-[allow file system access]: :_files' |
256 | '*--whitelist=-[whitelist directory or file]: :_files' | ||
257 | #endif | ||
258 | 259 | ||
259 | #ifdef HAVE_X11 | 260 | #ifdef HAVE_X11 |
260 | '--x11[enable X11 sandboxing. The software checks first if Xpra is installed, then it checks if Xephyr is installed. If all fails, it will attempt to use X11 security extension]' | 261 | '--x11[enable X11 sandboxing. The software checks first if Xpra is installed, then it checks if Xephyr is installed. If all fails, it will attempt to use X11 security extension]' |
diff --git a/test/environment/environment.sh b/test/environment/environment.sh index 152975c9d..1e1dd549b 100755 --- a/test/environment/environment.sh +++ b/test/environment/environment.sh | |||
@@ -112,14 +112,17 @@ echo "TESTING: rlimit (test/environment/rlimit.exp)" | |||
112 | echo "TESTING: rlimit profile (test/environment/rlimit-profile.exp)" | 112 | echo "TESTING: rlimit profile (test/environment/rlimit-profile.exp)" |
113 | ./rlimit-profile.exp | 113 | ./rlimit-profile.exp |
114 | 114 | ||
115 | echo "TESTING: rlimit join (test/environment/rlimit-join.exp)" | ||
116 | ./rlimit-join.exp | ||
117 | |||
115 | echo "TESTING: rlimit errors (test/environment/rlimit-bad.exp)" | 118 | echo "TESTING: rlimit errors (test/environment/rlimit-bad.exp)" |
116 | ./rlimit-bad.exp | 119 | ./rlimit-bad.exp |
117 | 120 | ||
118 | echo "TESTING: rlimit errors profile (test/environment/rlimit-bad-profile.exp)" | 121 | echo "TESTING: rlimit errors profile (test/environment/rlimit-bad-profile.exp)" |
119 | ./rlimit-bad-profile.exp | 122 | ./rlimit-bad-profile.exp |
120 | 123 | ||
121 | echo "TESTING: deterministic exit code (test/environment/deterministic-exit-code.exp" | 124 | echo "TESTING: deterministic exit code (test/environment/deterministic-exit-code.exp)" |
122 | ./deterministic-exit-code.exp | 125 | ./deterministic-exit-code.exp |
123 | 126 | ||
124 | echo "TESTING: retain umask (test/environment/umask.exp" | 127 | echo "TESTING: retain umask (test/environment/umask.exp)" |
125 | (umask 123 && ./umask.exp) | 128 | (umask 123 && ./umask.exp) |
diff --git a/test/environment/rlimit-join.exp b/test/environment/rlimit-join.exp new file mode 100755 index 000000000..aa8a203c0 --- /dev/null +++ b/test/environment/rlimit-join.exp | |||
@@ -0,0 +1,36 @@ | |||
1 | #!/usr/bin/expect -f | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2021 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | set timeout 10 | ||
7 | cd /home | ||
8 | spawn $env(SHELL) | ||
9 | match_max 100000 | ||
10 | |||
11 | send -- "firejail --noprofile --name=\"rlimit testing\"\r" | ||
12 | expect { | ||
13 | timeout {puts "TESTING ERROR 0\n";exit} | ||
14 | "Child process initialized" | ||
15 | } | ||
16 | sleep 1 | ||
17 | |||
18 | spawn $env(SHELL) | ||
19 | send -- "firejail --rlimit-nofile=1234 --join=\"rlimit testing\"\r" | ||
20 | expect { | ||
21 | timeout {puts "TESTING ERROR 1\n";exit} | ||
22 | "Switching to pid" | ||
23 | } | ||
24 | sleep 1 | ||
25 | |||
26 | send -- "cat /proc/self/limits\r" | ||
27 | expect { | ||
28 | timeout {puts "TESTING ERROR 2\n";exit} | ||
29 | "Max open files 1234 1234" | ||
30 | } | ||
31 | after 100 | ||
32 | |||
33 | send -- "exit\r" | ||
34 | after 100 | ||
35 | |||
36 | puts "\nall done\n" | ||
diff --git a/test/fs/fs.sh b/test/fs/fs.sh index 591fc1a06..9c3310b31 100755 --- a/test/fs/fs.sh +++ b/test/fs/fs.sh | |||
@@ -15,15 +15,18 @@ echo "TESTING: mkdir/mkfile (test/fs/mkdir_mkfile.exp)" | |||
15 | ./mkdir_mkfile.exp | 15 | ./mkdir_mkfile.exp |
16 | rm -fr ~/_firejail_test_* | 16 | rm -fr ~/_firejail_test_* |
17 | 17 | ||
18 | mkdir ~/_firejail_test_dir | 18 | echo "TESTING: recursive mkdir (test/fs/mkdir.exp)" |
19 | touch ~/_firejail_test_dir/a | 19 | ./mkdir.exp |
20 | mkdir ~/_firejail_test_dir/test1 | 20 | rm -fr ~/_firejail_test_* |
21 | touch ~/_firejail_test_dir/test1/b | 21 | rm -fr /tmp/_firejail_test_* |
22 | |||
22 | echo "TESTING: read/write (test/fs/read-write.exp)" | 23 | echo "TESTING: read/write (test/fs/read-write.exp)" |
23 | ./read-write.exp | 24 | ./read-write.exp |
25 | rm -fr ~/_firejail_test_dir | ||
26 | |||
24 | echo "TESTING: whitelist readonly (test/fs/whitelist-readonly.exp)" | 27 | echo "TESTING: whitelist readonly (test/fs/whitelist-readonly.exp)" |
25 | ./whitelist-readonly.exp | 28 | ./whitelist-readonly.exp |
26 | rm -fr ~/_firejail_test_* | 29 | rm -f ~/_firejail_test_dir |
27 | 30 | ||
28 | echo "TESTING: /sys/fs access (test/fs/sys_fs.exp)" | 31 | echo "TESTING: /sys/fs access (test/fs/sys_fs.exp)" |
29 | ./sys_fs.exp | 32 | ./sys_fs.exp |
@@ -37,16 +40,19 @@ fi | |||
37 | 40 | ||
38 | echo "TESTING: read/write /var/tmp (test/fs/fs_var_tmp.exp)" | 41 | echo "TESTING: read/write /var/tmp (test/fs/fs_var_tmp.exp)" |
39 | ./fs_var_tmp.exp | 42 | ./fs_var_tmp.exp |
43 | rm -f /var/tmp/_firejail_test_file | ||
40 | 44 | ||
41 | echo "TESTING: private-lib (test/fs/private-lib.exp)" | 45 | echo "TESTING: private-lib (test/fs/private-lib.exp)" |
42 | ./private-lib.exp | 46 | ./private-lib.exp |
43 | 47 | ||
44 | echo "TESTING: read/write /var/lock (test/fs/fs_var_lock.exp)" | 48 | echo "TESTING: read/write /var/lock (test/fs/fs_var_lock.exp)" |
45 | ./fs_var_lock.exp | 49 | ./fs_var_lock.exp |
50 | rm -f /var/lock/_firejail_test_file | ||
46 | 51 | ||
47 | if [ -w /dev/shm ]; then | 52 | if [ -w /dev/shm ]; then |
48 | echo "TESTING: read/write /dev/shm (test/fs/fs_dev_shm.exp)" | 53 | echo "TESTING: read/write /dev/shm (test/fs/fs_dev_shm.exp)" |
49 | ./fs_dev_shm.exp | 54 | ./fs_dev_shm.exp |
55 | rm -f /dev/shm/_firejail_test_file | ||
50 | else | 56 | else |
51 | echo "TESTING SKIP: /dev/shm not writable" | 57 | echo "TESTING SKIP: /dev/shm not writable" |
52 | fi | 58 | fi |
@@ -56,12 +62,23 @@ echo "TESTING: private (test/fs/private.exp)" | |||
56 | 62 | ||
57 | echo "TESTING: private home (test/fs/private-home.exp)" | 63 | echo "TESTING: private home (test/fs/private-home.exp)" |
58 | ./private-home.exp | 64 | ./private-home.exp |
65 | rm -f ~/_firejail_test_file1 | ||
66 | rm -f ~/_firejail_test_file2 | ||
67 | rm -fr ~/_firejail_test_dir1 | ||
68 | rm -f ~/_firejail_test_link1 | ||
69 | rm -f ~/_firejail_test_link2 | ||
59 | 70 | ||
60 | echo "TESTING: private home dir (test/fs/private-home-dir.exp)" | 71 | echo "TESTING: private home dir (test/fs/private-home-dir.exp)" |
61 | ./private-home-dir.exp | 72 | ./private-home-dir.exp |
73 | rm -fr ~/_firejail_test_dir1 | ||
62 | 74 | ||
63 | echo "TESTING: private home dir same as user home (test/fs/private-homedir.exp)" | 75 | echo "TESTING: private home dir same as user home (test/fs/private-homedir.exp)" |
64 | ./private-homedir.exp | 76 | ./private-homedir.exp |
77 | rm -f ~/_firejail_test_file1 | ||
78 | rm -f ~/_firejail_test_file2 | ||
79 | rm -fr ~/_firejail_test_dir1 | ||
80 | rm -f ~/_firejail_test_link1 | ||
81 | rm -f ~/_firejail_test_link2 | ||
65 | 82 | ||
66 | echo "TESTING: private-etc (test/fs/private-etc.exp)" | 83 | echo "TESTING: private-etc (test/fs/private-etc.exp)" |
67 | ./private-etc.exp | 84 | ./private-etc.exp |
@@ -74,6 +91,7 @@ echo "TESTING: private-bin (test/fs/private-bin.exp)" | |||
74 | 91 | ||
75 | echo "TESTING: private-cache (test/fs/private-cache.exp)" | 92 | echo "TESTING: private-cache (test/fs/private-cache.exp)" |
76 | ./private-cache.exp | 93 | ./private-cache.exp |
94 | rm -f ~/.cache/abcdefg | ||
77 | 95 | ||
78 | echo "TESTING: private-cwd (test/fs/private-cwd.exp)" | 96 | echo "TESTING: private-cwd (test/fs/private-cwd.exp)" |
79 | ./private-cwd.exp | 97 | ./private-cwd.exp |
@@ -83,6 +101,12 @@ echo "TESTING: macros (test/fs/macro.exp)" | |||
83 | 101 | ||
84 | echo "TESTING: whitelist empty (test/fs/whitelist-empty.exp)" | 102 | echo "TESTING: whitelist empty (test/fs/whitelist-empty.exp)" |
85 | ./whitelist-empty.exp | 103 | ./whitelist-empty.exp |
104 | rm -f ~/Videos/_firejail_test_fil | ||
105 | rm -f ~/Pictures/_firejail_test_file | ||
106 | rm -f ~/Music/_firejail_test_file | ||
107 | rm -f ~/Downloads/_firejail_test_file | ||
108 | rm -f ~/Documents/_firejail_test_file | ||
109 | rm -f ~/Desktop/_firejail_test_file | ||
86 | 110 | ||
87 | echo "TESTING: private whitelist (test/fs/private-whitelist.exp)" | 111 | echo "TESTING: private whitelist (test/fs/private-whitelist.exp)" |
88 | ./private-whitelist.exp | 112 | ./private-whitelist.exp |
@@ -95,9 +119,11 @@ echo "TESTING: blacklist directory (test/fs/option_blacklist.exp)" | |||
95 | 119 | ||
96 | echo "TESTING: blacklist file (test/fs/option_blacklist_file.exp)" | 120 | echo "TESTING: blacklist file (test/fs/option_blacklist_file.exp)" |
97 | ./option_blacklist_file.exp | 121 | ./option_blacklist_file.exp |
122 | rm -fr ~/_firejail_test_dir | ||
98 | 123 | ||
99 | echo "TESTING: blacklist glob (test/fs/option_blacklist_glob.exp)" | 124 | echo "TESTING: blacklist glob (test/fs/option_blacklist_glob.exp)" |
100 | ./option_blacklist_glob.exp | 125 | ./option_blacklist_glob.exp |
126 | rm -fr ~/_firejail_test_dir | ||
101 | 127 | ||
102 | echo "TESTING: noblacklist blacklist noexec (test/fs/noblacklist-blacklist-noexec.exp)" | 128 | echo "TESTING: noblacklist blacklist noexec (test/fs/noblacklist-blacklist-noexec.exp)" |
103 | ./noblacklist-blacklist-noexec.exp | 129 | ./noblacklist-blacklist-noexec.exp |
@@ -108,14 +134,13 @@ echo "TESTING: noblacklist blacklist readonly (test/fs/noblacklist-blacklist-rea | |||
108 | echo "TESTING: bind as user (test/fs/option_bind_user.exp)" | 134 | echo "TESTING: bind as user (test/fs/option_bind_user.exp)" |
109 | ./option_bind_user.exp | 135 | ./option_bind_user.exp |
110 | 136 | ||
111 | echo "TESTING: recursive mkdir (test/fs/mkdir.exp)" | ||
112 | ./mkdir.exp | ||
113 | |||
114 | echo "TESTING: double whitelist (test/fs/whitelist-double.exp)" | 137 | echo "TESTING: double whitelist (test/fs/whitelist-double.exp)" |
115 | ./whitelist-double.exp | 138 | ./whitelist-double.exp |
139 | rm -f /tmp/_firejail_test_file | ||
116 | 140 | ||
117 | echo "TESTING: whitelist (test/fs/whitelist.exp)" | 141 | echo "TESTING: whitelist (test/fs/whitelist.exp)" |
118 | ./whitelist.exp | 142 | ./whitelist.exp |
143 | rm -fr ~/_firejail_test_* | ||
119 | 144 | ||
120 | echo "TESTING: whitelist dev, var(test/fs/whitelist-dev.exp)" | 145 | echo "TESTING: whitelist dev, var(test/fs/whitelist-dev.exp)" |
121 | ./whitelist-dev.exp | 146 | ./whitelist-dev.exp |
@@ -131,6 +156,8 @@ echo "TESTING: fscheck --bind non root (test/fs/fscheck-bindnoroot.exp)" | |||
131 | 156 | ||
132 | echo "TESTING: fscheck --tmpfs non root (test/fs/fscheck-tmpfs.exp)" | 157 | echo "TESTING: fscheck --tmpfs non root (test/fs/fscheck-tmpfs.exp)" |
133 | ./fscheck-tmpfs.exp | 158 | ./fscheck-tmpfs.exp |
159 | rm -fr ~/_firejail_test_dir | ||
160 | rm -fr /tmp/_firejail_test_dir | ||
134 | 161 | ||
135 | echo "TESTING: fscheck --private= (test/fs/fscheck-private.exp)" | 162 | echo "TESTING: fscheck --private= (test/fs/fscheck-private.exp)" |
136 | ./fscheck-private.exp | 163 | ./fscheck-private.exp |
@@ -139,10 +166,4 @@ echo "TESTING: fscheck --read-only= (test/fs/fscheck-readonly.exp)" | |||
139 | ./fscheck-readonly.exp | 166 | ./fscheck-readonly.exp |
140 | 167 | ||
141 | #cleanup | 168 | #cleanup |
142 | rm -fr ~/fjtest-dir | 169 | rm -fr ~/_firejail_test* |
143 | rm -fr ~/fjtest-dir-lnk | ||
144 | rm -f ~/fjtest-file | ||
145 | rm -f ~/fjtest-file-lnk | ||
146 | rm -f /tmp/fjtest-file | ||
147 | rm -fr /tmp/fjtest-dir | ||
148 | rm -fr ~/_firejail_test_* | ||
diff --git a/test/fs/fs_dev_shm.exp b/test/fs/fs_dev_shm.exp index 04e6e2383..5f0503494 100755 --- a/test/fs/fs_dev_shm.exp +++ b/test/fs/fs_dev_shm.exp | |||
@@ -16,13 +16,13 @@ expect { | |||
16 | after 100 | 16 | after 100 |
17 | send -- "stty -echo\r" | 17 | send -- "stty -echo\r" |
18 | 18 | ||
19 | send -- "echo mytest > /dev/shm/ttt;echo done\r" | 19 | send -- "echo mytest > /dev/shm/_firejail_test_file;echo done\r" |
20 | expect { | 20 | expect { |
21 | timeout {puts "TESTING ERROR 1\n";exit} | 21 | timeout {puts "TESTING ERROR 1\n";exit} |
22 | "done" | 22 | "done" |
23 | } | 23 | } |
24 | 24 | ||
25 | send -- "cat /dev/shm/ttt;echo done\r" | 25 | send -- "cat /dev/shm/_firejail_test_file;echo done\r" |
26 | expect { | 26 | expect { |
27 | timeout {puts "TESTING ERROR 2\n";exit} | 27 | timeout {puts "TESTING ERROR 2\n";exit} |
28 | "mytest" | 28 | "mytest" |
@@ -32,13 +32,13 @@ expect { | |||
32 | "done" | 32 | "done" |
33 | } | 33 | } |
34 | 34 | ||
35 | send -- "rm /dev/shm/ttt;echo done\r" | 35 | send -- "rm /dev/shm/_firejail_test_file;echo done\r" |
36 | expect { | 36 | expect { |
37 | timeout {puts "TESTING ERROR 4\n";exit} | 37 | timeout {puts "TESTING ERROR 4\n";exit} |
38 | "done" | 38 | "done" |
39 | } | 39 | } |
40 | 40 | ||
41 | send -- "cat /dev/shm/ttt;echo done\r" | 41 | send -- "cat /dev/shm/_firejail_test_file;echo done\r" |
42 | expect { | 42 | expect { |
43 | timeout {puts "TESTING ERROR 5\n";exit} | 43 | timeout {puts "TESTING ERROR 5\n";exit} |
44 | "mytest" {puts "TESTING ERROR 6\n";exit} | 44 | "mytest" {puts "TESTING ERROR 6\n";exit} |
@@ -57,13 +57,13 @@ expect { | |||
57 | after 100 | 57 | after 100 |
58 | send -- "stty -echo\r" | 58 | send -- "stty -echo\r" |
59 | 59 | ||
60 | send -- "echo mytest > /dev/shm/ttt;echo done\r" | 60 | send -- "echo mytest > /dev/shm/_firejail_test_file;echo done\r" |
61 | expect { | 61 | expect { |
62 | timeout {puts "TESTING ERROR 8\n";exit} | 62 | timeout {puts "TESTING ERROR 8\n";exit} |
63 | "done" | 63 | "done" |
64 | } | 64 | } |
65 | 65 | ||
66 | send -- "cat /dev/shm/ttt;echo done\r" | 66 | send -- "cat /dev/shm/_firejail_test_file;echo done\r" |
67 | expect { | 67 | expect { |
68 | timeout {puts "TESTING ERROR 9\n";exit} | 68 | timeout {puts "TESTING ERROR 9\n";exit} |
69 | "mytest" | 69 | "mytest" |
@@ -73,13 +73,13 @@ expect { | |||
73 | "done" | 73 | "done" |
74 | } | 74 | } |
75 | 75 | ||
76 | send -- "rm /dev/shm/ttt;echo done\r" | 76 | send -- "rm /dev/shm/_firejail_test_file;echo done\r" |
77 | expect { | 77 | expect { |
78 | timeout {puts "TESTING ERROR 11\n";exit} | 78 | timeout {puts "TESTING ERROR 11\n";exit} |
79 | "done" | 79 | "done" |
80 | } | 80 | } |
81 | 81 | ||
82 | send -- "cat /dev/shm/ttt;echo done\r" | 82 | send -- "cat /dev/shm/_firejail_test_file;echo done\r" |
83 | expect { | 83 | expect { |
84 | timeout {puts "TESTING ERROR 12\n";exit} | 84 | timeout {puts "TESTING ERROR 12\n";exit} |
85 | "mytest" {puts "TESTING ERROR 13\n";exit} | 85 | "mytest" {puts "TESTING ERROR 13\n";exit} |
diff --git a/test/fs/fs_var_tmp.exp b/test/fs/fs_var_tmp.exp index 004425719..c7d4b0c20 100755 --- a/test/fs/fs_var_tmp.exp +++ b/test/fs/fs_var_tmp.exp | |||
@@ -16,13 +16,13 @@ expect { | |||
16 | after 100 | 16 | after 100 |
17 | send -- "stty -echo\r" | 17 | send -- "stty -echo\r" |
18 | 18 | ||
19 | send -- "echo mytest > /var/tmp/ttt;echo done\r" | 19 | send -- "echo mytest > /var/tmp/_firejail_test_file;echo done\r" |
20 | expect { | 20 | expect { |
21 | timeout {puts "TESTING ERROR 1\n";exit} | 21 | timeout {puts "TESTING ERROR 1\n";exit} |
22 | "done" | 22 | "done" |
23 | } | 23 | } |
24 | 24 | ||
25 | send -- "cat /var/tmp/ttt;echo done\r" | 25 | send -- "cat /var/tmp/_firejail_test_file;echo done\r" |
26 | expect { | 26 | expect { |
27 | timeout {puts "TESTING ERROR 2\n";exit} | 27 | timeout {puts "TESTING ERROR 2\n";exit} |
28 | "mytest" | 28 | "mytest" |
@@ -32,13 +32,13 @@ expect { | |||
32 | "done" | 32 | "done" |
33 | } | 33 | } |
34 | 34 | ||
35 | send -- "rm /var/tmp/ttt;echo done\r" | 35 | send -- "rm /var/tmp/_firejail_test_file;echo done\r" |
36 | expect { | 36 | expect { |
37 | timeout {puts "TESTING ERROR 4\n";exit} | 37 | timeout {puts "TESTING ERROR 4\n";exit} |
38 | "done" | 38 | "done" |
39 | } | 39 | } |
40 | 40 | ||
41 | send -- "cat /var/tmp/ttt;echo done\r" | 41 | send -- "cat /var/tmp/_firejail_test_file;echo done\r" |
42 | expect { | 42 | expect { |
43 | timeout {puts "TESTING ERROR 5\n";exit} | 43 | timeout {puts "TESTING ERROR 5\n";exit} |
44 | "mytest" {puts "TESTING ERROR 6\n";exit} | 44 | "mytest" {puts "TESTING ERROR 6\n";exit} |
@@ -58,13 +58,13 @@ expect { | |||
58 | after 100 | 58 | after 100 |
59 | send -- "stty -echo\r" | 59 | send -- "stty -echo\r" |
60 | 60 | ||
61 | send -- "echo mytest > /var/tmp/ttt;echo done\r" | 61 | send -- "echo mytest > /var/tmp/_firejail_test_file;echo done\r" |
62 | expect { | 62 | expect { |
63 | timeout {puts "TESTING ERROR 8\n";exit} | 63 | timeout {puts "TESTING ERROR 8\n";exit} |
64 | "done" | 64 | "done" |
65 | } | 65 | } |
66 | 66 | ||
67 | send -- "cat /var/tmp/ttt;echo done\r" | 67 | send -- "cat /var/tmp/_firejail_test_file;echo done\r" |
68 | expect { | 68 | expect { |
69 | timeout {puts "TESTING ERROR 9\n";exit} | 69 | timeout {puts "TESTING ERROR 9\n";exit} |
70 | "mytest" | 70 | "mytest" |
@@ -74,13 +74,13 @@ expect { | |||
74 | "done" | 74 | "done" |
75 | } | 75 | } |
76 | 76 | ||
77 | send -- "rm /var/tmp/ttt;echo done\r" | 77 | send -- "rm /var/tmp/_firejail_test_file;echo done\r" |
78 | expect { | 78 | expect { |
79 | timeout {puts "TESTING ERROR 11\n";exit} | 79 | timeout {puts "TESTING ERROR 11\n";exit} |
80 | "done" | 80 | "done" |
81 | } | 81 | } |
82 | 82 | ||
83 | send -- "cat /var/tmp/ttt;echo done\r" | 83 | send -- "cat /var/tmp/_firejail_test_file;echo done\r" |
84 | expect { | 84 | expect { |
85 | timeout {puts "TESTING ERROR 12\n";exit} | 85 | timeout {puts "TESTING ERROR 12\n";exit} |
86 | "mytest" {puts "TESTING ERROR 13\n";exit} | 86 | "mytest" {puts "TESTING ERROR 13\n";exit} |
diff --git a/test/fs/mkdir.exp b/test/fs/mkdir.exp index 8b787f114..da04a431c 100755 --- a/test/fs/mkdir.exp +++ b/test/fs/mkdir.exp | |||
@@ -7,34 +7,34 @@ set timeout 3 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "rm -fr ~/.firejail_test\r" | 10 | send -- "rm -fr ~/_firejail_test_dir\r" |
11 | after 100 | 11 | after 100 |
12 | 12 | ||
13 | send -- "firejail --profile=mkdir.profile find ~/.firejail_test\r" | 13 | send -- "firejail --profile=mkdir.profile find ~/_firejail_test_dir\r" |
14 | expect { | 14 | expect { |
15 | timeout {puts "TESTING ERROR 1.1\n";exit} | 15 | timeout {puts "TESTING ERROR 1.1\n";exit} |
16 | ".firejail_test/a/b/c/d.txt" | 16 | "_firejail_test_dir/_firejail_test_file" |
17 | } | 17 | } |
18 | send -- "rm -rf ~/.firejail_test\r" | 18 | send -- "rm -rf ~/_firejail_test_dir\r" |
19 | after 100 | 19 | after 100 |
20 | 20 | ||
21 | send -- "firejail --profile=mkdir.profile find /tmp/.firejail_test\r" | 21 | send -- "firejail --profile=mkdir.profile find /tmp/_firejail_test_dir\r" |
22 | expect { | 22 | expect { |
23 | timeout {puts "TESTING ERROR 2.1\n";exit} | 23 | timeout {puts "TESTING ERROR 2.1\n";exit} |
24 | "/tmp/.firejail_test/a/b/c/d.txt" | 24 | "_firejail_test_dir/_firejail_test_file" |
25 | } | 25 | } |
26 | send -- "rm -rf /tmp/.firejail_test\r" | 26 | send -- "rm -rf /tmp/_firejail_test_dir\r" |
27 | after 100 | 27 | after 100 |
28 | 28 | ||
29 | set UID [exec id -u] | 29 | set UID [exec id -u] |
30 | set fexist [file exist /run/user/$UID] | 30 | set fexist [file exist /run/user/$UID] |
31 | if { $fexist } { | 31 | if { $fexist } { |
32 | send -- "firejail --profile=mkdir.profile find /run/user/$UID/.firejail_test\r" | 32 | send -- "firejail --profile=mkdir.profile find /run/user/$UID/_firejail_test_dir\r" |
33 | expect { | 33 | expect { |
34 | timeout {puts "TESTING ERROR 3.1\n";exit} | 34 | timeout {puts "TESTING ERROR 3.1\n";exit} |
35 | "/run/user/$UID/.firejail_test/a/b/c/d.txt" | 35 | "_firejail_test_dir/_firejail_test_file" |
36 | } | 36 | } |
37 | send -- "rm -rf /run/user/$UID/.firejail_test\r" | 37 | send -- "rm -rf /run/user/$UID/_firejail_test_dir\r" |
38 | after 100 | 38 | after 100 |
39 | 39 | ||
40 | 40 | ||
diff --git a/test/fs/mkdir.profile b/test/fs/mkdir.profile index 35c27c872..fba93f466 100644 --- a/test/fs/mkdir.profile +++ b/test/fs/mkdir.profile | |||
@@ -1,6 +1,6 @@ | |||
1 | mkdir ~/.firejail_test/a/b/c | 1 | mkdir ~/_firejail_test_dir |
2 | mkfile ~/.firejail_test/a/b/c/d.txt | 2 | mkfile ~/_firejail_test_dir/_firejail_test_file |
3 | mkdir /tmp/.firejail_test/a/b/c | 3 | mkdir /tmp/_firejail_test_dir |
4 | mkfile /tmp/.firejail_test/a/b/c/d.txt | 4 | mkfile /tmp/_firejail_test_dir/_firejail_test_file |
5 | mkdir ${RUNUSER}/.firejail_test/a/b/c | 5 | mkdir ${RUNUSER}/_firejail_test_dir |
6 | mkfile ${RUNUSER}/.firejail_test/a/b/c/d.txt | 6 | mkfile ${RUNUSER}/_firejail_test_dir/_firejail_test_file |
diff --git a/test/fs/option_blacklist.exp b/test/fs/option_blacklist.exp index 6ee2b07ca..48dfcc069 100755 --- a/test/fs/option_blacklist.exp +++ b/test/fs/option_blacklist.exp | |||
@@ -35,4 +35,4 @@ expect { | |||
35 | } | 35 | } |
36 | after 100 | 36 | after 100 |
37 | 37 | ||
38 | puts "\n" | 38 | puts "\nall done\n" |
diff --git a/test/fs/option_blacklist_file.exp b/test/fs/option_blacklist_file.exp index b0bcc741b..247e69121 100755 --- a/test/fs/option_blacklist_file.exp +++ b/test/fs/option_blacklist_file.exp | |||
@@ -7,7 +7,12 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "firejail --blacklist=/etc/passwd\r" | 10 | send -- "mkdir ~/_firejail_test_dir\r" |
11 | after 100 | ||
12 | send -- "touch ~/_firejail_test_dir/a\r" | ||
13 | after 100 | ||
14 | |||
15 | send -- "firejail --blacklist=/etc/passwd --blacklist=~/_firejail_test_dir\r" | ||
11 | expect { | 16 | expect { |
12 | timeout {puts "TESTING ERROR 0\n";exit} | 17 | timeout {puts "TESTING ERROR 0\n";exit} |
13 | "Child process initialized" | 18 | "Child process initialized" |
@@ -17,6 +22,16 @@ sleep 1 | |||
17 | send -- "cat /etc/passwd;echo done\r" | 22 | send -- "cat /etc/passwd;echo done\r" |
18 | expect { | 23 | expect { |
19 | timeout {puts "TESTING ERROR 1\n";exit} | 24 | timeout {puts "TESTING ERROR 1\n";exit} |
25 | "No such file or directory" | ||
26 | } | ||
27 | expect { | ||
28 | timeout {puts "TESTING ERROR 2\n";exit} | ||
29 | "done" | ||
30 | } | ||
31 | after 100 | ||
32 | send -- "cat ~/_firejail_test_dir/a;echo done\r" | ||
33 | expect { | ||
34 | timeout {puts "TESTING ERROR 1\n";exit} | ||
20 | "Permission denied" | 35 | "Permission denied" |
21 | } | 36 | } |
22 | expect { | 37 | expect { |
@@ -25,4 +40,10 @@ expect { | |||
25 | } | 40 | } |
26 | after 100 | 41 | after 100 |
27 | 42 | ||
28 | puts "\n" | 43 | send -- "exit\r" |
44 | sleep 1 | ||
45 | |||
46 | send -- "rm -fr ~/_firejail_test_dir\r" | ||
47 | after 100 | ||
48 | |||
49 | puts "\nall done\n" | ||
diff --git a/test/fs/option_blacklist_glob.exp b/test/fs/option_blacklist_glob.exp index ee79eabf4..a4be4a97d 100755 --- a/test/fs/option_blacklist_glob.exp +++ b/test/fs/option_blacklist_glob.exp | |||
@@ -7,26 +7,41 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "firejail --blacklist=testdir1/*\r" | 10 | send -- "mkdir ~/_firejail_test_dir\r" |
11 | after 100 | ||
12 | send -- "touch ~/_firejail_test_dir/a\r" | ||
13 | after 100 | ||
14 | send -- "mkdir ~/_firejail_test_dir/test1\r" | ||
15 | after 100 | ||
16 | send -- "touch ~/_firejail_test_dir/test1/b\r" | ||
17 | after 100 | ||
18 | |||
19 | send -- "firejail --blacklist=~/_firejail_test_dir/*\r" | ||
11 | expect { | 20 | expect { |
12 | timeout {puts "TESTING ERROR 0\n";exit} | 21 | timeout {puts "TESTING ERROR 0\n";exit} |
13 | "Child process initialized" | 22 | "Child process initialized" |
14 | } | 23 | } |
15 | sleep 1 | 24 | sleep 1 |
16 | send -- "cd testdir1\r" | 25 | send -- "cd ~/_firejail_test_dir\r" |
17 | sleep 1 | 26 | sleep 1 |
18 | 27 | ||
19 | send -- "cat .file\r" | 28 | send -- "cat a\r" |
20 | expect { | 29 | expect { |
21 | timeout {puts "TESTING ERROR 1\n";exit} | 30 | timeout {puts "TESTING ERROR 1\n";exit} |
22 | "Permission denied" | 31 | "Permission denied" |
23 | } | 32 | } |
24 | 33 | ||
25 | send -- "ls .directory\r" | 34 | send -- "ls test1\r" |
26 | expect { | 35 | expect { |
27 | timeout {puts "TESTING ERROR 2\n";exit} | 36 | timeout {puts "TESTING ERROR 2\n";exit} |
28 | "Permission denied" | 37 | "Permission denied" |
29 | } | 38 | } |
30 | after 100 | 39 | after 100 |
31 | 40 | ||
32 | puts "\n" | 41 | send -- "exit\r" |
42 | sleep 1 | ||
43 | |||
44 | send -- "rm -fr ~/_firejail_test_dir\r" | ||
45 | after 100 | ||
46 | |||
47 | puts "\nall done\n" | ||
diff --git a/test/fs/private-etc.exp b/test/fs/private-etc.exp index c9a74f96e..7d0e9f619 100755 --- a/test/fs/private-etc.exp +++ b/test/fs/private-etc.exp | |||
@@ -64,9 +64,6 @@ expect { | |||
64 | } | 64 | } |
65 | after 100 | 65 | after 100 |
66 | 66 | ||
67 | 67 | send -- "exit\r" | |
68 | |||
69 | |||
70 | |||
71 | after 100 | 68 | after 100 |
72 | puts "\nall done\n" | 69 | puts "\nall done\n" |
diff --git a/test/fs/private-home-dir.exp b/test/fs/private-home-dir.exp index 75ac5aea5..bd8cab16f 100755 --- a/test/fs/private-home-dir.exp +++ b/test/fs/private-home-dir.exp | |||
@@ -21,13 +21,13 @@ if {[file exists ~/.Xauthority]} { | |||
21 | send -- "touch ~/.Xauthority\r" | 21 | send -- "touch ~/.Xauthority\r" |
22 | } | 22 | } |
23 | after 100 | 23 | after 100 |
24 | send -- "rm -fr ~/_firejail_test_dir_\r" | 24 | send -- "rm -fr ~/_firejail_test_dir1_\r" |
25 | after 100 | 25 | after 100 |
26 | send -- "mkdir ~/_firejail_test_dir_\r" | 26 | send -- "mkdir ~/_firejail_test_dir1_\r" |
27 | sleep 1 | 27 | sleep 1 |
28 | 28 | ||
29 | # testing profile and private | 29 | # testing profile and private |
30 | send -- "firejail --private=~/_firejail_test_dir_\r" | 30 | send -- "firejail --private=~/_firejail_test_dir1_\r" |
31 | expect { | 31 | expect { |
32 | timeout {puts "TESTING ERROR 0\n";exit} | 32 | timeout {puts "TESTING ERROR 0\n";exit} |
33 | "Child process initialized" | 33 | "Child process initialized" |
@@ -67,12 +67,12 @@ expect { | |||
67 | "private directory is not owned by the current user" | 67 | "private directory is not owned by the current user" |
68 | } | 68 | } |
69 | sleep 1 | 69 | sleep 1 |
70 | send -- "mkdir ~/_firejail_test_dir_/test_dir_2\r" | 70 | send -- "mkdir ~/_firejail_test_dir1_/test_dir_2\r" |
71 | after 100 | 71 | after 100 |
72 | send -- "touch ~/_firejail_test_dir_/test_dir_2/testfile\r" | 72 | send -- "touch ~/_firejail_test_dir1_/test_dir_2/testfile\r" |
73 | sleep 1 | 73 | sleep 1 |
74 | 74 | ||
75 | send -- "firejail --debug --noprofile --blacklist=~/test_dir_2 --private=~/_firejail_test_dir_\r" | 75 | send -- "firejail --debug --noprofile --blacklist=~/test_dir_2 --private=~/_firejail_test_dir1_\r" |
76 | expect { | 76 | expect { |
77 | timeout {puts "TESTING ERROR 10\n";exit} | 77 | timeout {puts "TESTING ERROR 10\n";exit} |
78 | "Disable" | 78 | "Disable" |
@@ -98,7 +98,8 @@ after 100 | |||
98 | send "exit\r" | 98 | send "exit\r" |
99 | sleep 1 | 99 | sleep 1 |
100 | 100 | ||
101 | send -- "rm -fr ~/_firejail_test_dir_\r" | 101 | send -- "rm -fr ~/_firejail_test_dir1\r" |
102 | after 100 | 102 | after 100 |
103 | 103 | ||
104 | |||
104 | puts "\nall done\n" | 105 | puts "\nall done\n" |
diff --git a/test/fs/private-home.exp b/test/fs/private-home.exp index 2f297e93f..6fbe8b0f6 100755 --- a/test/fs/private-home.exp +++ b/test/fs/private-home.exp | |||
@@ -95,8 +95,19 @@ expect { | |||
95 | "broken symbolic link" | 95 | "broken symbolic link" |
96 | } | 96 | } |
97 | send -- "exit\r" | 97 | send -- "exit\r" |
98 | sleep 1 | ||
98 | 99 | ||
99 | send -- "rm -f ~/_firejail_test*\r" | 100 | send -- "echo cleanup\r" |
101 | after 100 | ||
102 | send -- "rm -f ~/_firejail_test_file1\r" | ||
103 | after 100 | ||
104 | send -- "rm -f ~/_firejail_test_file2\r" | ||
105 | after 100 | ||
106 | send -- "rm -fr ~/_firejail_test_dir1\r" | ||
107 | after 100 | ||
108 | send -- "rm -f ~/_firejail_test_link1\r" | ||
109 | after 100 | ||
110 | send -- "rm -f ~/_firejail_test_link2\r" | ||
100 | after 100 | 111 | after 100 |
101 | 112 | ||
102 | puts "\nall done\n" | 113 | puts "\nall done\n" |
diff --git a/test/fs/read-write.exp b/test/fs/read-write.exp index ad51c2db1..6c0f755da 100755 --- a/test/fs/read-write.exp +++ b/test/fs/read-write.exp | |||
@@ -7,6 +7,14 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "mkdir ~/_firejail_test_dir\r" | ||
11 | after 100 | ||
12 | send -- "touch ~/_firejail_test_dir/a\r" | ||
13 | after 100 | ||
14 | send -- "mkdir ~/_firejail_test_dir/test1\r" | ||
15 | after 100 | ||
16 | send -- "touch ~/_firejail_test_dir/test1/b\r" | ||
17 | after 100 | ||
10 | 18 | ||
11 | send -- "firejail --read-only=~/_firejail_test_dir --read-write=~/_firejail_test_dir/test1\r" | 19 | send -- "firejail --read-only=~/_firejail_test_dir --read-write=~/_firejail_test_dir/test1\r" |
12 | expect { | 20 | expect { |
@@ -32,4 +40,9 @@ expect { | |||
32 | } | 40 | } |
33 | 41 | ||
34 | after 100 | 42 | after 100 |
43 | send -- "exit\r" | ||
44 | sleep 1 | ||
45 | |||
46 | send -- "rm -fr ~/_firejail_test_dir\r" | ||
47 | after 100 | ||
35 | puts "\nall done\n" | 48 | puts "\nall done\n" |
diff --git a/test/fs/testdir1/.directory/file b/test/fs/testdir1/.directory/file deleted file mode 100644 index e69de29bb..000000000 --- a/test/fs/testdir1/.directory/file +++ /dev/null | |||
diff --git a/test/fs/testdir1/.file b/test/fs/testdir1/.file deleted file mode 100644 index e69de29bb..000000000 --- a/test/fs/testdir1/.file +++ /dev/null | |||
diff --git a/test/fs/testfile1 b/test/fs/testfile1 deleted file mode 100644 index e69de29bb..000000000 --- a/test/fs/testfile1 +++ /dev/null | |||
diff --git a/test/fs/whitelist-dev.exp b/test/fs/whitelist-dev.exp index ad5c54a9c..d0466bbeb 100755 --- a/test/fs/whitelist-dev.exp +++ b/test/fs/whitelist-dev.exp | |||
@@ -61,6 +61,9 @@ expect { | |||
61 | "19" {puts "OK\n"} | 61 | "19" {puts "OK\n"} |
62 | "20" {puts "OK\n"} | 62 | "20" {puts "OK\n"} |
63 | "21" {puts "OK\n"} | 63 | "21" {puts "OK\n"} |
64 | "22" {puts "OK\n"} | ||
65 | "23" {puts "OK\n"} | ||
66 | "24" {puts "OK\n"} | ||
64 | } | 67 | } |
65 | after 100 | 68 | after 100 |
66 | 69 | ||
diff --git a/test/fs/whitelist-double.exp b/test/fs/whitelist-double.exp index 5ce9d8ad7..e653517a6 100755 --- a/test/fs/whitelist-double.exp +++ b/test/fs/whitelist-double.exp | |||
@@ -7,17 +7,17 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "echo 123 > /tmp/firejal-deleteme\r" | 10 | send -- "echo 123 > /tmp/_firejail_test_file\r" |
11 | sleep 1 | 11 | sleep 1 |
12 | 12 | ||
13 | send -- "firejail --whitelist=/tmp/firejal-deleteme --whitelist=/tmp/firejal-deleteme\r" | 13 | send -- "firejail --whitelist=/tmp/_firejail_test_file --whitelist=/tmp/_firejail_test_file\r" |
14 | expect { | 14 | expect { |
15 | timeout {puts "TESTING ERROR 0\n";exit} | 15 | timeout {puts "TESTING ERROR 0\n";exit} |
16 | "Child process initialized" | 16 | "Child process initialized" |
17 | } | 17 | } |
18 | sleep 1 | 18 | sleep 1 |
19 | 19 | ||
20 | send -- "cat /tmp/firejal-deleteme\r" | 20 | send -- "cat /tmp/_firejail_test_file\r" |
21 | expect { | 21 | expect { |
22 | timeout {puts "TESTING ERROR 1\n";exit} | 22 | timeout {puts "TESTING ERROR 1\n";exit} |
23 | "123" | 23 | "123" |
@@ -26,13 +26,13 @@ expect { | |||
26 | send -- "exit\r" | 26 | send -- "exit\r" |
27 | sleep 1 | 27 | sleep 1 |
28 | 28 | ||
29 | send -- "cat /tmp/firejal-deleteme\r" | 29 | send -- "cat /tmp/_firejail_test_file\r" |
30 | expect { | 30 | expect { |
31 | timeout {puts "TESTING ERROR 2\n";exit} | 31 | timeout {puts "TESTING ERROR 2\n";exit} |
32 | "123" | 32 | "123" |
33 | } | 33 | } |
34 | 34 | ||
35 | send -- "rm -v /tmp/firejal-deleteme\r" | 35 | send -- "rm -v /tmp/_firejail_test_file\r" |
36 | expect { | 36 | expect { |
37 | timeout {puts "TESTING ERROR 3\n";exit} | 37 | timeout {puts "TESTING ERROR 3\n";exit} |
38 | "removed" | 38 | "removed" |
diff --git a/test/fs/whitelist-readonly.exp b/test/fs/whitelist-readonly.exp index e5c9cc400..f9d78b7c0 100755 --- a/test/fs/whitelist-readonly.exp +++ b/test/fs/whitelist-readonly.exp | |||
@@ -7,6 +7,14 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "mkdir ~/_firejail_test_dir\r" | ||
11 | after 100 | ||
12 | send -- "touch ~/_firejail_test_dir/a\r" | ||
13 | after 100 | ||
14 | send -- "mkdir ~/_firejail_test_dir/test1\r" | ||
15 | after 100 | ||
16 | send -- "touch ~/_firejail_test_dir/test1/b\r" | ||
17 | after 100 | ||
10 | 18 | ||
11 | send -- "firejail --noprofile --whitelist=~/_firejail_test_dir --read-only=~\r" | 19 | send -- "firejail --noprofile --whitelist=~/_firejail_test_dir --read-only=~\r" |
12 | expect { | 20 | expect { |
@@ -25,4 +33,6 @@ after 100 | |||
25 | send -- "exit\r" | 33 | send -- "exit\r" |
26 | sleep 1 | 34 | sleep 1 |
27 | 35 | ||
36 | send -- "rm -fr ~/_firejail_test_dir\r" | ||
37 | after 100 | ||
28 | puts "\nall done\n" | 38 | puts "\nall done\n" |
diff --git a/test/profiles/profile_syntax.exp b/test/profiles/profile_syntax.exp index 258089a39..a2cccb0d4 100755 --- a/test/profiles/profile_syntax.exp +++ b/test/profiles/profile_syntax.exp | |||
@@ -22,7 +22,7 @@ expect { | |||
22 | } | 22 | } |
23 | 23 | ||
24 | sleep 1 | 24 | sleep 1 |
25 | send -- "ls -l /etc/shadow\r" | 25 | send -- "ls -l /dev/console\r" |
26 | expect { | 26 | expect { |
27 | timeout {puts "TESTING ERROR 3\n";exit} | 27 | timeout {puts "TESTING ERROR 3\n";exit} |
28 | "root root" | 28 | "root root" |
diff --git a/test/profiles/test.profile b/test/profiles/test.profile index 26d6de849..27cb99606 100644 --- a/test/profiles/test.profile +++ b/test/profiles/test.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | blacklist /sbin/iptables | 1 | blacklist /sbin/iptables |
2 | blacklist /etc/shadow | 2 | blacklist /dev/console |
3 | blacklist /bin/rmdir | 3 | blacklist /bin/rmdir |
4 | blacklist ${PATH}/umount | 4 | blacklist ${PATH}/umount |
5 | blacklist ${PATH}/mount | 5 | blacklist ${PATH}/mount |
diff --git a/test/utils/build.exp b/test/utils/build.exp index 7fbe969a4..104ac037c 100755 --- a/test/utils/build.exp +++ b/test/utils/build.exp | |||
@@ -7,13 +7,13 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "echo testing > ~/firejail-test-file-7699\r" | 10 | send -- "echo testing > ~/_firejail-test-file\r" |
11 | after 100 | 11 | after 100 |
12 | 12 | ||
13 | send -- "firejail --build cat ~/firejail-test-file-7699\r" | 13 | send -- "firejail --build cat ~/_firejail-test-file\r" |
14 | expect { | 14 | expect { |
15 | timeout {puts "TESTING ERROR 0\n";exit} | 15 | timeout {puts "TESTING ERROR 0\n";exit} |
16 | "whitelist $\{HOME\}/firejail-test-file-7699" | 16 | "allow $\{HOME\}/_firejail-test-file" |
17 | } | 17 | } |
18 | expect { | 18 | expect { |
19 | timeout {puts "TESTING ERROR 1\n";exit} | 19 | timeout {puts "TESTING ERROR 1\n";exit} |
@@ -77,7 +77,8 @@ expect { | |||
77 | } | 77 | } |
78 | after 100 | 78 | after 100 |
79 | 79 | ||
80 | 80 | send -- "rm -f ~/_firejail-test-file\r" | |
81 | after 100 | ||
81 | 82 | ||
82 | send -- "firejail --build cat /etc/passwd\r" | 83 | send -- "firejail --build cat /etc/passwd\r" |
83 | expect { | 84 | expect { |
diff --git a/test/utils/utils.sh b/test/utils/utils.sh index c021d6287..e3e24bd9a 100755 --- a/test/utils/utils.sh +++ b/test/utils/utils.sh | |||
@@ -15,8 +15,8 @@ export PATH="$PATH:/usr/lib/firejail:/usr/lib64/firejail" | |||
15 | 15 | ||
16 | echo "TESTING: build (test/utils/build.exp)" | 16 | echo "TESTING: build (test/utils/build.exp)" |
17 | ./build.exp | 17 | ./build.exp |
18 | rm -f ~/firejail-test-file-7699 | 18 | rm -f ~/_firejail-test-file |
19 | rm -f firejail-test-file-4388 | 19 | rm -f _firejail-test-file |
20 | 20 | ||
21 | echo "TESTING: name (test/utils/name.exp)" | 21 | echo "TESTING: name (test/utils/name.exp)" |
22 | ./name.exp | 22 | ./name.exp |