3 files changed, 11 insertions, 6 deletions

diff --git a/.github/workflows/check-c.yml b/.github/workflows/check-c.yml
index 349f92525..307b0c37c 100644
--- a/.github/workflows/check-c.yml
+++ b/.github/workflows/check-c.yml
@@ -161,7 +161,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@1b1aada464948af03b950897e5eb522f92603cc2
+      uses: github/codeql-action/init@4355270be187e1b672a7a1c7c7bae5afdc1ab94a
       with:
         languages: cpp
 
@@ -172,4 +172,4 @@ jobs:
       run: make -j "$(nproc)"
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@1b1aada464948af03b950897e5eb522f92603cc2
+      uses: github/codeql-action/analyze@4355270be187e1b672a7a1c7c7bae5afdc1ab94a
diff --git a/.github/workflows/check-python.yml b/.github/workflows/check-python.yml
index 507b975af..43d139c9f 100644
--- a/.github/workflows/check-python.yml
+++ b/.github/workflows/check-python.yml
@@ -51,9 +51,9 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@1b1aada464948af03b950897e5eb522f92603cc2
+      uses: github/codeql-action/init@4355270be187e1b672a7a1c7c7bae5afdc1ab94a
       with:
         languages: python
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@1b1aada464948af03b950897e5eb522f92603cc2
+      uses: github/codeql-action/analyze@4355270be187e1b672a7a1c7c7bae5afdc1ab94a
diff --git a/etc/profile-m-z/mov-cli.profile b/etc/profile-m-z/mov-cli.profile
index 1efd1e8f9..85f72f478 100644
--- a/etc/profile-m-z/mov-cli.profile
+++ b/etc/profile-m-z/mov-cli.profile
@@ -10,11 +10,16 @@ include mov-cli.local
 
 noblacklist ${HOME}/.config/mov-cli
 
+# Allow /bin/sh (blacklisted by disable-shell.inc)
+include allow-bin-sh.inc
+
 include disable-proc.inc
 include disable-xdg.inc
 
 mkdir ${HOME}/.config/mov-cli
 whitelist ${HOME}/.config/mov-cli
+whitelist ${DOWNLOADS}
+whitelist /usr/share/nano
 include whitelist-run-common.inc
 include whitelist-runuser-common.inc
 
@@ -24,9 +29,9 @@ noprinters
 notv
 
 disable-mnt
-private-bin ffmpeg,fzf,mov-cli
+private-bin fzf,mov-cli,nano,sh,uname
 #private-cache
-private-etc X11,alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,magic,magic.mgc,mime.types,nsswitch.conf,pango,passwd,pki,protocols,pulse,resolv.conf,rpc,services,ssl,xdg
+private-etc X11,alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,magic,magic.mgc,mime.types,nanorc,nsswitch.conf,pango,passwd,pki,protocols,pulse,resolv.conf,rpc,services,ssl,xdg
 private-tmp
 
 # Redirect