23 files changed, 89 insertions, 7 deletions

diff --git a/RELNOTES b/RELNOTES
index 87497e538..483b4cfa6 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,11 +1,12 @@
-ffirejail (0.9.31) baseline; urgency=low
-  * disable X11 autostart folders in default profiles
-  * disable subversion and git config files in home directory
+firejail (0.9.31) baseline; urgency=low
+  * lots of security profile changes
   * added FBReader default profile
+  * added --interface option
+  * bugfixes
  -- netblue30 <netblue30@yahoo.com>  current development
 
 
-irejail (0.9.30) baseline; urgency=low
+firejail (0.9.30) baseline; urgency=low
   * added a disable-history.inc profile as a result of Firefox PDF.js exploit;
     disable-history.inc included in all default profiles
   * Firefox PDF.js exploit (CVE-2015-4495) fixes
diff --git a/etc/audacious.profile b/etc/audacious.profile
index 923b70184..a55398648 100644
--- a/etc/audacious.profile
+++ b/etc/audacious.profile
@@ -3,6 +3,11 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 noroot
diff --git a/etc/clementine.profile b/etc/clementine.profile
index 47c40506a..779eb902b 100644
--- a/etc/clementine.profile
+++ b/etc/clementine.profile
@@ -3,6 +3,11 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 noroot
diff --git a/etc/deadbeef.profile b/etc/deadbeef.profile
index 68027bd7c..a64968a7e 100644
--- a/etc/deadbeef.profile
+++ b/etc/deadbeef.profile
@@ -3,6 +3,11 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 noroot
diff --git a/etc/deluge.profile b/etc/deluge.profile
index 24a082099..3e499bbf4 100644
--- a/etc/deluge.profile
+++ b/etc/deluge.profile
@@ -3,6 +3,11 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 netfilter
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index fc069dd2a..cc9ba0032 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -38,6 +38,10 @@ blacklist ${HOME}/.fluxbox/startup
 blacklist ${HOME}/.config/openbox/autostart
 blacklist ${HOME}/.config/openbox/environment
 
+# VirtualBox
+blacklist ${HOME}/.VirtualBox
+blacklist ${HOME}/VirtualBox VMs
+
 # git, subversion
 blacklist ${HOME}/.subversion
 blacklist ${HOME}/.gitconfig
diff --git a/etc/disable-secret.inc b/etc/disable-secret.inc
index 8ac1b3792..1042582a0 100644
--- a/etc/disable-secret.inc
+++ b/etc/disable-secret.inc
@@ -4,6 +4,5 @@ tmpfs ${HOME}/.gnome2_private
 blacklist ${HOME}/.gnome2/keyrings
 blacklist ${HOME}/kde4/share/apps/kwallet
 blacklist ${HOME}/kde/share/apps/kwallet
-blacklist ${HOME}/.pki/nssdb
 blacklist ${HOME}/.gnupg
 blacklist ${HOME}/.local/share/recently-used.xbel
diff --git a/etc/dropbox.profile b/etc/dropbox.profile
index 008660f77..76367e13a 100644
--- a/etc/dropbox.profile
+++ b/etc/dropbox.profile
@@ -3,6 +3,11 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
 caps
 seccomp
 noroot
diff --git a/etc/empathy.profile b/etc/empathy.profile
index 7a9e53b86..24ba457d9 100644
--- a/etc/empathy.profile
+++ b/etc/empathy.profile
@@ -3,5 +3,6 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
diff --git a/etc/evince.profile b/etc/evince.profile
index 023fd2444..1dc4f2b7a 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -3,6 +3,11 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 noroot
diff --git a/etc/fbreader.profile b/etc/fbreader.profile
index 97baa2a3e..e42dc6084 100644
--- a/etc/fbreader.profile
+++ b/etc/fbreader.profile
@@ -4,6 +4,11 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 netfilter
diff --git a/etc/filezilla.profile b/etc/filezilla.profile
index 437fa6d43..df89574f1 100644
--- a/etc/filezilla.profile
+++ b/etc/filezilla.profile
@@ -5,6 +5,7 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 noroot
diff --git a/etc/generic.profile b/etc/generic.profile
index f1c6af30d..18fb4ebc6 100644
--- a/etc/generic.profile
+++ b/etc/generic.profile
@@ -5,7 +5,10 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
-
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
 caps.drop all
 seccomp
 netfilter
diff --git a/etc/gnome-mplayer.profile b/etc/gnome-mplayer.profile
index 4be1c1093..b3578c38c 100644
--- a/etc/gnome-mplayer.profile
+++ b/etc/gnome-mplayer.profile
@@ -3,6 +3,11 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 noroot
diff --git a/etc/pidgin.profile b/etc/pidgin.profile
index 3574e4d66..ba45487e6 100644
--- a/etc/pidgin.profile
+++ b/etc/pidgin.profile
@@ -3,6 +3,7 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 noroot
diff --git a/etc/qbittorrent.profile b/etc/qbittorrent.profile
index dd7be997c..d6ed092f2 100644
--- a/etc/qbittorrent.profile
+++ b/etc/qbittorrent.profile
@@ -3,6 +3,11 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 netfilter
diff --git a/etc/quassel.profile b/etc/quassel.profile
index 931debc95..08d90df34 100644
--- a/etc/quassel.profile
+++ b/etc/quassel.profile
@@ -3,6 +3,7 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 noroot
diff --git a/etc/rhythmbox.profile b/etc/rhythmbox.profile
index f2870d543..adfa94dbd 100644
--- a/etc/rhythmbox.profile
+++ b/etc/rhythmbox.profile
@@ -3,6 +3,11 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 noroot
diff --git a/etc/totem.profile b/etc/totem.profile
index 6b26a4e0e..f6730ce5a 100644
--- a/etc/totem.profile
+++ b/etc/totem.profile
@@ -3,6 +3,11 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 noroot
diff --git a/etc/transmission-gtk.profile b/etc/transmission-gtk.profile
index dc1d9d524..4d9d491bd 100644
--- a/etc/transmission-gtk.profile
+++ b/etc/transmission-gtk.profile
@@ -3,6 +3,11 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 netfilter
diff --git a/etc/transmission-qt.profile b/etc/transmission-qt.profile
index 64c2ba8ad..4369f3992 100644
--- a/etc/transmission-qt.profile
+++ b/etc/transmission-qt.profile
@@ -3,7 +3,12 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
-caps.drop all
+cblacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
+aps.drop all
 seccomp
 netfilter
 noroot
diff --git a/etc/vlc.profile b/etc/vlc.profile
index 365ea838a..ef64873b8 100644
--- a/etc/vlc.profile
+++ b/etc/vlc.profile
@@ -3,6 +3,11 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 noroot
diff --git a/etc/xchat.profile b/etc/xchat.profile
index 45f0f15ba..dc7e84e12 100644
--- a/etc/xchat.profile
+++ b/etc/xchat.profile
@@ -3,6 +3,7 @@ include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-history.inc
+blacklist ${HOME}/.wine
 caps.drop all
 seccomp
 noroot