190 files changed, 1081 insertions, 705 deletions
diff --git a/.gitignore b/.gitignore
index eeaa0bb03..1285dea92 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,5 @@ seccomp.32
 seccomp.64
 seccomp.block_secondary
 seccomp.mdwx
+src/common.mk
diff --git a/Makefile.in b/Makefile.in
index 27187f53a..134e7bd66 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -75,7 +75,7 @@ distclean: clean
        for dir in $(APPS) $(MYLIBS); do \
                $(MAKE) -C $$dir distclean; \
        done
-        rm -fr Makefile autom4te.cache config.log config.status config.h uids.h
+        rm -fr Makefile autom4te.cache config.log config.status config.h uids.h dummy.o src/common.mk
 realinstall:
        # firejail executable
@@ -107,6 +107,7 @@ endif
        install -c -m 0755 src/fbuilder/fbuilder $(DESTDIR)/$(libdir)/firejail/.
 ifeq ($(HAVE_SECCOMP),-DHAVE_SECCOMP)
        install -c -m 0755 src/fsec-print/fsec-print $(DESTDIR)/$(libdir)/firejail/.
+        install -c -m 0755 src/fsec-optimize/fsec-optimize $(DESTDIR)/$(libdir)/firejail/.
        install -c -m 0755 src/fseccomp/fseccomp $(DESTDIR)/$(libdir)/firejail/.
        install -c -m 0644 seccomp $(DESTDIR)/$(libdir)/firejail/.
        install -c -m 0644 seccomp.debug $(DESTDIR)/$(libdir)/firejail/.
@@ -176,6 +177,7 @@ install-strip: all
        strip src/fnetfilter/fnetfilter
        strip src/fseccomp/fseccomp
        strip src/fsec-print/fsec-print
+        strip src/fsec-optimize/fsec-optimize
        strip src/fcopy/fcopy
        strip src/fldd/fldd
        strip src/fbuilder/fbuilder
@@ -195,7 +197,7 @@ uninstall:
        rm -f $(DESTDIR)/$(datarootdir)/bash-completion/completions/firemon
        rm -f $(DESTDIR)/$(datarootdir)/bash-completion/completions/firecfg
-DISTFILES = "src etc platform contrib configure configure.ac Makefile.in install.sh mkman.sh mketc.sh mkdeb.sh mkuid.sh COPYING README RELNOTES"
+DISTFILES = "src etc platform contrib configure configure.ac dummy.c Makefile.in install.sh mkman.sh mketc.sh mkdeb.sh mkuid.sh COPYING README RELNOTES"
 DISTFILES_TEST = "test/apps test/apps-x11 test/apps-x11-xorg test/root test/fcopy test/environment test/profiles test/utils test/compile test/filters test/network test/arguments test/fs test/sysutils test/chroot"
 dist:
diff --git a/README b/README
index 6aacf8131..d20e956cd 100644
--- a/README
+++ b/README
@@ -244,6 +244,10 @@ Gaman Gabriel (https://github.com/stelariusinfinitek)
        - inox profile
 geg2048 (https://github.com/geg2048)
        - kwallet profile fixes
+glitsj16 (https://github.com/glitsj16)
+        - evince-previewer, evince-thumbnailer profiles
+        - gnome-recipes, gnome-logs profiles
+        - fixed private-lib for gnome-calculator
 graywolf (https://github.com/graywolf)
        - spelling fix
 greigdp (https://github.com/greigdp)
@@ -284,6 +288,8 @@ Jaykishan Mutkawoa (https://github.com/jmutkawoa)
 James Elford (https://github.com/jelford)
        - pass password manager support
        - removed shell none from ssh-agent configuration, fixing the infinit loop
+        - added gcloud profile
+        - blacklist sensitive cloud provider files in disable-common
 Jericho (https://github.com/attritionorg)
        - spelling
 Jesse Smith (https://github.com/slicer69)
diff --git a/README.md b/README.md
index 90e3f7fcc..4d9727797 100644
--- a/README.md
+++ b/README.md
@@ -98,6 +98,65 @@ Use this issue to request new profiles: [#1139](https://github.com/netblue30/fir
 `````
 # Current development version: 0.9.53
+## Spectre mitigation
+If your gcc compiler version supports it, -mindirect-branch=thunk is inserted into EXTRA_CFLAGS during software configuration.
+The patch was introduced in gcc version 8, and it was backported to gcc 7. You'll also find it
+on older versions, for example on Debian stable running on gcc 6.3.0.  This is how you check it:
+`````
+$ ./configure --prefix=/usr
+checking for gcc... gcc
+checking whether the C compiler works... yes
+checking for C compiler default output file name... a.out
+checking for suffix of executables...
+checking whether we are cross compiling... no
+checking for suffix of object files... o
+checking whether we are using the GNU C compiler... yes
+checking whether gcc accepts -g... yes
+checking for gcc option to accept ISO C89... none needed
+checking for a BSD-compatible install... /usr/bin/install -c
+checking for ranlib... ranlib
+checking for Spectre mitigation support in gcc compiler... yes
+[...]
+Configuration options:
+   prefix: /usr
+   sysconfdir: /etc
+   seccomp: -DHAVE_SECCOMP
+   <linux/seccomp.h>: -DHAVE_SECCOMP_H
+   apparmor:
+   global config: -DHAVE_GLOBALCFG
+   chroot: -DHAVE_CHROOT
+   bind: -DHAVE_BIND
+   network: -DHAVE_NETWORK
+   user namespace: -DHAVE_USERNS
+   X11 sandboxing support: -DHAVE_X11
+   whitelisting: -DHAVE_WHITELIST
+   private home support: -DHAVE_PRIVATE_HOME
+   file transfer support: -DHAVE_FILE_TRANSFER
+   overlayfs support: -DHAVE_OVERLAYFS
+   git install support:
+   busybox workaround: no
+   Spectre compiler patch: yes
+   EXTRA_LDFLAGS:
+   EXTRA_CFLAGS:  -mindirect-branch=thunk
+   fatal warnings:
+   Gcov instrumentation:
+   Install contrib scripts: yes
+`````
+This feature is also supported for LLVM/clang compiler
+## New command line options
+`````
+       --nodbus
+              Disable D-Bus access. Only the regular UNIX socket is handled by
+              this command. To disable the abstract socket you would  need  to
+              request  a  new  network  namespace using --net command. Another
+              option is to remove unix from --protocol set.
+              Example:
+              $ firejail --nodbus --net=none
+`````
 ## AppImage development
 Support for private-bin, private-lib and shell none has been disabled while running AppImage archives.
@@ -213,9 +272,10 @@ enable/disable apparmor functionality globally. By default the flag is enabled.
 AppArmor deployment: we are starting apparmor by default for the following programs:
 - web browsers: firefox (firefox-common.profile), chromium (chromium-common.profile)
 - torrent clients: transmission-qt, transmission-gtk, qbittorrent
- media players: vlc, mpv, audacious, totem, rhythmbox
+- media players: vlc, mpv, audacious, kodi, smplayer
- media editing: kdenlive, audacity, handbrake, gimp, inkscape, krita, openshot
+- media editing: kdenlive, audacity, handbrake, inkscape, gimp, krita, openshot
- etc.: atril, gnome-calculator, galculator, eom, eog
+- archive managers: ark, engrampa, file-roller
+- etc.: digikam, libreoffice, okular, gwenview, galculator, kcalc
 Checking apparmor status:
 `````
@@ -246,4 +306,6 @@ firefox-common-addons.inc in firefox-common.profile.
 Basilisk browser, Tor Browser language packs, PlayOnLinux, sylpheed, discord-canary,
 pycharm-community, pycharm-professional, Pitivi, OnionShare, Fritzing, Kaffeine, pdfchain,
-tilp, vivaldi-snapshot, bitcoin-qt, VS Code, falkon, gnome-builder, lobase, asunder
+tilp, vivaldi-snapshot, bitcoin-qt, VS Code, falkon, gnome-builder, lobase, asunder,
+gnome-recipes, akonadi_control, evince-previewer, evince-thumbnailer, blender-2.8,
+thunderbird-beta, ncdu, gnome-logs, gcloud
diff --git a/RELNOTES b/RELNOTES
index e7852663e..e76800f2c 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -9,10 +9,11 @@ firejail (0.9.53) baseline; urgency=low
     All users of Firefox-based browsers who use addons and plugins
     that read/write from ${HOME} will need to uncomment the includes for
     firefox-common-addons.inc in firefox-common.profile.
+  * Spectre mitigation patch for gcc and clang compiler
+  * D-Bus handling (--nodbus)
  * AppArmor support for overlayfs and chroot sandboxes
  * AppArmor support for AppImages
-  * Enable AppArmor by default for Firefox, Chromium, Transmission
+  * Enable AppArmor by default for a large number of programs
-     VLC and mpv
  * firejail --apparmor.print option
  * firemon --apparmor option
  * apparmor yes/no flag in /etc/firejail/firejail.config
@@ -26,8 +27,10 @@ firejail (0.9.53) baseline; urgency=low
  * added sandbox name support in firemon
  * new profiles: basilisk, Tor Browser language packs, PlayOnLinux, sylpheed,
  * new profiles: discord-canary, pycharm-community, pycharm-professional,
-  * new profiles: pdfchain, tilp, vivaldi-snapshot, bitcoin-qt, kaffeine, VS Code,
+  * new profiles: pdfchain, tilp, vivaldi-snapshot, bitcoin-qt, kaffeine,
-  * new profiles: falkon, gnome-builder, asunder
+  * new profiles: falkon, gnome-builder, asunder, VS Code, gnome-recipes
+  * new profiles: akonadi_controle, evince-previewer, evince-thumbnailer,
+  * new profiles: blender-2.8, thunderbird-beta, ncdu, gnome-logs, gcloud
 -- netblue30 <netblue30@yahoo.com>  Thu, 1 Mar 2018 08:00:00 -0500
 firejail (0.9.52) baseline; urgency=low
diff --git a/configure b/configure
index 761cebc1e..5addefc72 100755
--- a/configure
+++ b/configure
@@ -646,6 +646,7 @@ EGREP
 GREP
 CPP
 HAVE_APPARMOR
+EXTRA_CFLAGS
 RANLIB
 INSTALL_DATA
 INSTALL_SCRIPT
@@ -2099,7 +2100,6 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 #AC_CONFIG_HEADERS([config.h])
 ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
 ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
@@ -3105,6 +3105,47 @@ else
 fi
+HAVE_SPECTRE="no"
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Spectre mitigation support in gcc or clang compiler" >&5
+$as_echo_n "checking for Spectre mitigation support in gcc or clang compiler... " >&6; }
+if test "$CC" = "gcc"; then :
+        HAVE_SPECTRE="yes"
+        $CC -mindirect-branch=thunk -c dummy.c || HAVE_SPECTRE="no"
+        rm -f dummy.o
+        if test "$HAVE_SPECTRE" = "yes"; then :
+                EXTRA_CFLAGS+=" -mindirect-branch=thunk "
+fi
+fi
+if test "$CC" = "clang"; then :
+        HAVE_SPECTRE="yes"
+        $CC -mretpoline -c dummy.c || HAVE_SPECTRE="no"
+        rm -f dummy.o
+        if test "$HAVE_SPECTRE" = "yes"; then :
+                EXTRA_CFLAGS+=" -mretpoline "
+fi
+fi
+if test "$HAVE_SPECTRE" = "yes"; then :
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+fi
+if test "$HAVE_SPECTRE" = "no"; then :
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: ... not available" >&5
+$as_echo "... not available" >&6; }
+fi
 HAVE_APPARMOR=""
 # Check whether --enable-apparmor was given.
 if test "${enable_apparmor+set}" = set; then :
@@ -3119,7 +3160,6 @@ if test "x$enable_apparmor" = "xyes"; then :
 fi
 ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
 ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
@@ -3531,7 +3571,7 @@ fi
 fi
 if test "x$enable_apparmor" = "xyes"; then :
-        EXTRA_LDFLAGS+="-lapparmor "
+        EXTRA_LDFLAGS+=" -lapparmor "
 fi
@@ -3725,7 +3765,7 @@ fi
 if test "x$enable_gcov" = "xyes"; then :
        HAVE_GCOV="--coverage -DHAVE_GCOV "
-        EXTRA_LDFLAGS+="-lgcov --coverage "
+        EXTRA_LDFLAGS+=" -lgcov --coverage "
 fi
@@ -3823,7 +3863,7 @@ if test "$prefix" = /usr; then
        sysconfdir="/etc"
 fi
-ac_config_files="$ac_config_files Makefile src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile"
+ac_config_files="$ac_config_files Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile"
 cat >confcache <<\_ACEOF
 # This file is a shell script that caches the results of configure
@@ -4533,6 +4573,7 @@ for ac_config_target in $ac_config_targets
 do
  case $ac_config_target in
    "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;;
+    "src/common.mk") CONFIG_FILES="$CONFIG_FILES src/common.mk" ;;
    "src/lib/Makefile") CONFIG_FILES="$CONFIG_FILES src/lib/Makefile" ;;
    "src/fcopy/Makefile") CONFIG_FILES="$CONFIG_FILES src/fcopy/Makefile" ;;
    "src/fnet/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnet/Makefile" ;;
@@ -5024,7 +5065,9 @@ echo "   file transfer support: $HAVE_FILE_TRANSFER"
 echo "   overlayfs support: $HAVE_OVERLAYFS"
 echo "   git install support: $HAVE_GIT_INSTALL"
 echo "   busybox workaround: $BUSYBOX_WORKAROUND"
+echo "   Spectre compiler patch: $HAVE_SPECTRE"
 echo "   EXTRA_LDFLAGS: $EXTRA_LDFLAGS"
+echo "   EXTRA_CFLAGS: $EXTRA_CFLAGS"
 echo "   fatal warnings: $HAVE_FATAL_WARNINGS"
 echo "   Gcov instrumentation: $HAVE_GCOV"
 echo "   Install contrib scripts: $HAVE_CONTRIB_INSTALL"
diff --git a/configure.ac b/configure.ac
index 952dec3b8..460c93d50 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3,12 +3,37 @@ AC_INIT(firejail, 0.9.53, netblue30@yahoo.com, , http://firejail.wordpress.com)
 AC_CONFIG_SRCDIR([src/firejail/main.c])
 #AC_CONFIG_HEADERS([config.h])
 AC_PROG_CC
 #AC_PROG_CXX
 AC_PROG_INSTALL
 AC_PROG_RANLIB
+HAVE_SPECTRE="no"
+AC_MSG_CHECKING(for Spectre mitigation support in gcc or clang compiler)
+AS_IF([test "$CC" = "gcc"], [
+        HAVE_SPECTRE="yes"
+        $CC -mindirect-branch=thunk -c dummy.c || HAVE_SPECTRE="no"
+        rm -f dummy.o
+        AS_IF([test "$HAVE_SPECTRE" = "yes"], [
+                EXTRA_CFLAGS+=" -mindirect-branch=thunk "
+        ])
+])
+AS_IF([test "$CC" = "clang"], [
+        HAVE_SPECTRE="yes"
+        $CC -mretpoline -c dummy.c || HAVE_SPECTRE="no"
+        rm -f dummy.o
+        AS_IF([test "$HAVE_SPECTRE" = "yes"], [
+                EXTRA_CFLAGS+=" -mretpoline "
+        ])
+])
+AS_IF([test "$HAVE_SPECTRE" = "yes"], [
+        AC_MSG_RESULT(yes)
+])
+AS_IF([test "$HAVE_SPECTRE" = "no"], [
+        AC_MSG_RESULT(... not available)
+])
+AC_SUBST([EXTRA_CFLAGS])
 HAVE_APPARMOR=""
 AC_ARG_ENABLE([apparmor],
    AS_HELP_STRING([--enable-apparmor], [enable apparmor]))
@@ -17,13 +42,12 @@ AS_IF([test "x$enable_apparmor" = "xyes"], [
        AC_SUBST(HAVE_APPARMOR)
 ])
 AS_IF([test "x$enable_apparmor" = "xyes"], [
        AC_CHECK_HEADER(sys/apparmor.h, , [AC_MSG_ERROR(
        [Couldn't find sys/apparmor.h... please install apparmor user space library and development files] )])
 ])
 AS_IF([test "x$enable_apparmor" = "xyes"], [
-        EXTRA_LDFLAGS+="-lapparmor "
+        EXTRA_LDFLAGS+=" -lapparmor "
 ])
 AC_SUBST([EXTRA_LDFLAGS])
@@ -142,7 +166,7 @@ AC_ARG_ENABLE([gcov],
    AS_HELP_STRING([--enable-gcov], [Gcov instrumentation]))
 AS_IF([test "x$enable_gcov" = "xyes"], [
        HAVE_GCOV="--coverage -DHAVE_GCOV "
-        EXTRA_LDFLAGS+="-lgcov --coverage "
+        EXTRA_LDFLAGS+=" -lgcov --coverage "
        AC_SUBST(HAVE_GCOV)
 ])
@@ -175,7 +199,7 @@ if test "$prefix" = /usr; then
        sysconfdir="/etc"
 fi
-AC_OUTPUT(Makefile src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile \
+AC_OUTPUT(Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile \
 src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile \
 src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile)
@@ -198,7 +222,9 @@ echo "   file transfer support: $HAVE_FILE_TRANSFER"
 echo "   overlayfs support: $HAVE_OVERLAYFS"
 echo "   git install support: $HAVE_GIT_INSTALL"
 echo "   busybox workaround: $BUSYBOX_WORKAROUND"
+echo "   Spectre compiler patch: $HAVE_SPECTRE"
 echo "   EXTRA_LDFLAGS: $EXTRA_LDFLAGS"
+echo "   EXTRA_CFLAGS: $EXTRA_CFLAGS"
 echo "   fatal warnings: $HAVE_FATAL_WARNINGS"
 echo "   Gcov instrumentation: $HAVE_GCOV"
 echo "   Install contrib scripts: $HAVE_CONTRIB_INSTALL"
diff --git a/dummy.c b/dummy.c
new file mode 100644
index 000000000..061ed7eef
--- /dev/null
+++ b/dummy.c
@@ -0,0 +1,3 @@
+int main(void) {
+        return 0;
+}
diff --git a/etc/0ad.profile b/etc/0ad.profile
index 057dcf49e..766783997 100644
--- a/etc/0ad.profile
+++ b/etc/0ad.profile
@@ -24,6 +24,7 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/7z.profile b/etc/7z.profile
index ededacbbe..0330e4dbf 100644
--- a/etc/7z.profile
+++ b/etc/7z.profile
@@ -6,12 +6,12 @@ include /etc/firejail/7z.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 ignore noroot
 net none
 no3d
+nodbus
 nodvd
 nosound
 notv
diff --git a/etc/akonadi_control.profile b/etc/akonadi_control.profile
new file mode 100644
index 000000000..3a4404b28
--- /dev/null
+++ b/etc/akonadi_control.profile
@@ -0,0 +1,49 @@
+# Firejail profile for akonadi_control
+# Persistent local customizations
+include /etc/firejail/akonadi_control.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+noblacklist ${HOME}/.cache/akonadi*
+noblacklist ${HOME}/.config/akonadi*
+noblacklist ${HOME}/.config/baloorc
+noblacklist ${HOME}/.config/emailidentities
+noblacklist ${HOME}/.config/kmail2rc
+noblacklist ${HOME}/.local/share/akonadi*
+noblacklist ${HOME}/.local/share/contacts
+noblacklist ${HOME}/.local/share/local-mail
+noblacklist ${HOME}/.local/share/notes
+noblacklist /tmp/akonadi-*
+noblacklist /usr/sbin
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/whitelist-var-common.inc
+# disabled options below are not compatible with the apparmor profile for mysqld-akonadi.
+# this affects ubuntu and debian currently
+# apparmor
+caps.drop all
+ipc-namespace
+no3d
+netfilter
+nodvd
+nogroups
+# nonewprivs
+noroot
+nosound
+notv
+novideo
+# protocol unix,inet,inet6
+# seccomp.drop @cpu-emulation,@debug,@obsolete,@privileged,@resources,add_key,fanotify_init,io_cancel,io_destroy,kcmp,keyctl,name_to_handle_at,ni_syscall,open_by_handle_at,personality,process_vm_readv,ptrace,remap_file_pages,request_key,syslog,umount,userfaultfd,vmsplice
+tracelog
+private-dev
+# private-tmp - breaks programs that depend on akonadi
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/apktool.profile b/etc/apktool.profile
index bbf91c264..d5063d79b 100644
--- a/etc/apktool.profile
+++ b/etc/apktool.profile
@@ -6,8 +6,6 @@ include /etc/firejail/apktool.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
@@ -15,6 +13,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/ardour5.profile b/etc/ardour5.profile
index 1f2228544..cf72561da 100644
--- a/etc/ardour5.profile
+++ b/etc/ardour5.profile
@@ -5,8 +5,6 @@ include /etc/firejail/ardour5.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/ardour4
 noblacklist ${HOME}/.config/ardour5
 noblacklist ${HOME}/.lv2
@@ -20,6 +18,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 ipc-namespace
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/ark.profile b/etc/ark.profile
index beeb652cf..8e156df0f 100644
--- a/etc/ark.profile
+++ b/etc/ark.profile
@@ -5,8 +5,6 @@ include /etc/firejail/ark.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/arkrc
 include /etc/firejail/disable-common.inc
@@ -20,6 +18,7 @@ apparmor
 caps.drop all
 # net none
 netfilter
+# nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/asunder.profile b/etc/asunder.profile
index 0fbc3a158..7d643877f 100644
--- a/etc/asunder.profile
+++ b/etc/asunder.profile
@@ -20,6 +20,7 @@ include /etc/firejail/whitelist-var-common.inc
 apparmor
 caps.drop all
 netfilter
+nodbus
 # nogroups
 nonewprivs
 noroot
diff --git a/etc/atom.profile b/etc/atom.profile
index de09275cc..c513c7531 100644
--- a/etc/atom.profile
+++ b/etc/atom.profile
@@ -5,8 +5,6 @@ include /etc/firejail/atom.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus
 noblacklist ${HOME}/.atom
 noblacklist ${HOME}/.config/Atom
@@ -17,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 # net none
 netfilter
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/atril-previewer.profile b/etc/atril-previewer.profile
new file mode 100644
index 000000000..5d841bc0e
--- /dev/null
+++ b/etc/atril-previewer.profile
@@ -0,0 +1,10 @@
+# Firejail profile for atril-previewer
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/atril-previewer.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+# Redirect
+include /etc/firejail/atril.profile
diff --git a/etc/atril-thumbnailer.profile b/etc/atril-thumbnailer.profile
new file mode 100644
index 000000000..88c74735d
--- /dev/null
+++ b/etc/atril-thumbnailer.profile
@@ -0,0 +1,10 @@
+# Firejail profile for atril-thumbnailer
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/atril-thumbnailer.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+# Redirect
+include /etc/firejail/atril.profile
diff --git a/etc/atril.profile b/etc/atril.profile
index a05f11076..e08b70ac6 100644
--- a/etc/atril.profile
+++ b/etc/atril.profile
@@ -5,6 +5,7 @@ include /etc/firejail/atril.local
 # Persistent global definitions
 include /etc/firejail/globals.local
+noblacklist ${HOME}/.cache/atril
 noblacklist ${HOME}/.config/atril
 #noblacklist ${HOME}/.local/share
@@ -17,7 +18,7 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
-apparmor
+# apparmor
 caps.drop all
 machine-id
 no3d
diff --git a/etc/audacious.profile b/etc/audacious.profile
index 93ba5a45d..71003f156 100644
--- a/etc/audacious.profile
+++ b/etc/audacious.profile
@@ -18,6 +18,7 @@ include /etc/firejail/whitelist-var-common.inc
 apparmor
 caps.drop all
 netfilter
+nodbus
 nogroups
 nonewprivs
 noroot
diff --git a/etc/audacity.profile b/etc/audacity.profile
index 8c85dd6be..907dbeb55 100644
--- a/etc/audacity.profile
+++ b/etc/audacity.profile
@@ -5,8 +5,6 @@ include /etc/firejail/audacity.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.audacity-data
 include /etc/firejail/disable-common.inc
@@ -18,8 +16,9 @@ include /etc/firejail/whitelist-var-common.inc
 apparmor
 caps.drop all
-#net none
+net none
 no3d
+# nodbus - problems on Fedora 27
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/baobab.profile b/etc/baobab.profile
index e47e31bb1..5c1675611 100644
--- a/etc/baobab.profile
+++ b/etc/baobab.profile
@@ -5,8 +5,6 @@ include /etc/firejail/baobab.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -15,6 +13,7 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/bibletime.profile b/etc/bibletime.profile
index 018569603..f23a29052 100644
--- a/etc/bibletime.profile
+++ b/etc/bibletime.profile
@@ -21,6 +21,7 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/bleachbit.profile b/etc/bleachbit.profile
index dce7892a4..ae40c3ec7 100644
--- a/etc/bleachbit.profile
+++ b/etc/bleachbit.profile
@@ -5,8 +5,6 @@ include /etc/firejail/bleachbit.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -15,6 +13,7 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
@@ -29,6 +28,7 @@ shell none
 private-dev
 # private-tmp
-memory-deny-write-execute
+# memory-deny-write-execute breaks some systems, see issue #1850
+# memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/blender-2.8.profile b/etc/blender-2.8.profile
new file mode 100644
index 000000000..4b907018e
--- /dev/null
+++ b/etc/blender-2.8.profile
@@ -0,0 +1,6 @@
+# Firejail profile alias for blender
+# This file is overwritten after every install/update
+# Redirect
+include /etc/firejail/blender.profile
diff --git a/etc/bless.profile b/etc/bless.profile
index 37d1e856f..10b471582 100644
--- a/etc/bless.profile
+++ b/etc/bless.profile
@@ -5,8 +5,6 @@ include /etc/firejail/bless.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/bless
 include /etc/firejail/disable-common.inc
@@ -17,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/bluefish.profile b/etc/bluefish.profile
index 66ba0168b..6eb1d753f 100644
--- a/etc/bluefish.profile
+++ b/etc/bluefish.profile
@@ -5,8 +5,6 @@ include /etc/firejail/bluefish.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -17,6 +15,7 @@ include /etc/firejail/whitelist-var-common.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/calligra.profile b/etc/calligra.profile
index f09716bc3..f7df8ce85 100644
--- a/etc/calligra.profile
+++ b/etc/calligra.profile
@@ -5,8 +5,6 @@ include /etc/firejail/calligra.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -15,6 +13,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 ipc-namespace
 # net none
+# nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/catfish.profile b/etc/catfish.profile
index 6d5ec1c52..6a608c673 100644
--- a/etc/catfish.profile
+++ b/etc/catfish.profile
@@ -8,8 +8,6 @@ include /etc/firejail/globals.local
 # We can't blacklist much since catfish
 # is for finding files/content
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/catfish
 include /etc/firejail/disable-common.inc
@@ -23,6 +21,7 @@ include /etc/firejail/whitelist-var-common.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/chromium-common.profile b/etc/chromium-common.profile
index a11947334..7f07c5b26 100644
--- a/etc/chromium-common.profile
+++ b/etc/chromium-common.profile
@@ -20,6 +20,7 @@ include /etc/firejail/whitelist-var-common.inc
 apparmor
 caps.keep sys_chroot,sys_admin
 netfilter
+nodbus
 nodvd
 nogroups
 notv
@@ -31,3 +32,6 @@ private-dev
 noexec ${HOME}
 noexec /tmp
+# the file dialog needs to work without d-bus
+env NO_CHROME_KDE_FILE_DIALOG=1
diff --git a/etc/cin.profile b/etc/cin.profile
index d114e50b1..e86a4d9b4 100644
--- a/etc/cin.profile
+++ b/etc/cin.profile
@@ -5,8 +5,6 @@ include /etc/firejail/cin.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.bcast5
 include /etc/firejail/disable-common.inc
@@ -17,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 ipc-namespace
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/clamav.profile b/etc/clamav.profile
index c3a0132d0..41bd3b679 100644
--- a/etc/clamav.profile
+++ b/etc/clamav.profile
@@ -6,12 +6,11 @@ include /etc/firejail/clamav.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 caps.drop all
 ipc-namespace
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/cpio.profile b/etc/cpio.profile
index caee6570e..445e1cec7 100644
--- a/etc/cpio.profile
+++ b/etc/cpio.profile
@@ -6,7 +6,6 @@ include /etc/firejail/cpio.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 noblacklist /sbin
@@ -19,6 +18,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nonewprivs
 nosound
diff --git a/etc/default.profile b/etc/default.profile
index 82eded802..1af7ceba4 100644
--- a/etc/default.profile
+++ b/etc/default.profile
@@ -17,6 +17,7 @@ caps.drop all
 # ipc-namespace
 netfilter
 # no3d
+# nodbus
 # nodvd
 # nogroups
 nonewprivs
diff --git a/etc/dex2jar.profile b/etc/dex2jar.profile
index f89e17239..ed73b8b8c 100644
--- a/etc/dex2jar.profile
+++ b/etc/dex2jar.profile
@@ -6,8 +6,6 @@ include /etc/firejail/dex2jar.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -16,6 +14,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/dia.profile b/etc/dia.profile
index b1a723da0..fb3506955 100644
--- a/etc/dia.profile
+++ b/etc/dia.profile
@@ -5,8 +5,6 @@ include /etc/firejail/dia.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.dia
 include /etc/firejail/disable-common.inc
@@ -17,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/digikam.profile b/etc/digikam.profile
index 516876c6b..4df344cbc 100644
--- a/etc/digikam.profile
+++ b/etc/digikam.profile
@@ -20,6 +20,7 @@ include /etc/firejail/whitelist-var-common.inc
 apparmor
 caps.drop all
 netfilter
+# nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index 19be56f86..0f605b933 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -75,6 +75,7 @@ blacklist ${HOME}/.kde4/share/config/plasma-desktop-appletsrc
 blacklist ${HOME}/.local/share/kglobalaccel
 blacklist ${HOME}/.local/share/kwin
 blacklist ${HOME}/.local/share/plasma
+blacklist ${HOME}/.local/share/plasmashell
 blacklist ${HOME}/.local/share/solid
 read-only ${HOME}/.cache/ksycoca5_*
 read-only ${HOME}/.config/*notifyrc
@@ -296,6 +297,13 @@ blacklist /etc/ssh
 blacklist /home/.ecryptfs
 blacklist /var/backup
+# cloud provider configuration
+blacklist ${HOME}/.aws
+blacklist ${HOME}/.boto
+blacklist /etc/boto.cfg
+blacklist ${HOME}/.config/gcloud
+blacklist ${HOME}/.kube
 # system directories
 blacklist /sbin
 blacklist /usr/local/sbin
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 0d542c6d8..a6f12f3db 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -73,6 +73,7 @@ blacklist ${HOME}/.config/Slack
 blacklist ${HOME}/.config/Thunar
 blacklist ${HOME}/.config/VirtualBox
 blacklist ${HOME}/.config/Wire
+blacklist ${HOME}/.config/akonadi*
 blacklist ${HOME}/.config/akregatorrc
 blacklist ${HOME}/.config/ardour4
 blacklist ${HOME}/.config/ardour5
@@ -106,6 +107,7 @@ blacklist ${HOME}/.config/digikam
 blacklist ${HOME}/.config/digikamrc
 blacklist ${HOME}/.config/dolphinrc
 blacklist ${HOME}/.config/dragonplayerrc
+blacklist ${HOME}/.config/emailidentities
 blacklist ${HOME}/.config/enchant
 blacklist ${HOME}/.config/eog
 blacklist ${HOME}/.config/epiphany
@@ -136,6 +138,7 @@ blacklist ${HOME}/.config/itch
 blacklist ${HOME}/.config/jd-gui.cfg
 blacklist ${HOME}/.config/k3brc
 blacklist ${HOME}/.config/kaffeinerc
+blacklist ${HOME}/.config/katemetainfos
 blacklist ${HOME}/.config/katepartrc
 blacklist ${HOME}/.config/katerc
 blacklist ${HOME}/.config/kateschemarc
@@ -144,6 +147,7 @@ blacklist ${HOME}/.config/katevirc
 blacklist ${HOME}/.config/kdenliverc
 blacklist ${HOME}/.config/kgetrc
 blacklist ${HOME}/.config/klipperrc
+blacklist ${HOME}/.config/kmail2rc
 blacklist ${HOME}/.config/kritarc
 blacklist ${HOME}/.config/kwriterc
 blacklist ${HOME}/.config/kdeconnect
@@ -346,18 +350,21 @@ blacklist ${HOME}/.local/share/SuperHexagon
 blacklist ${HOME}/.local/share/TelegramDesktop
 blacklist ${HOME}/.local/share/Terraria
 blacklist ${HOME}/.local/share/TpLogger
+blacklist ${HOME}/.local/share/akonadi*
 blacklist ${HOME}/.local/share/akregator
 blacklist ${HOME}/.local/share/aspyr-media
 blacklist ${HOME}/.local/share/baloo
 blacklist ${HOME}/.local/share/caja-python
 blacklist ${HOME}/.local/share/cdprojektred
 blacklist ${HOME}/.local/share/clipit
+blacklist ${HOME}/.local/share/contacts
 blacklist ${HOME}/.local/share/data/Mumble
 blacklist ${HOME}/.local/share/data/MusE
 blacklist ${HOME}/.local/share/data/MuseScore
 blacklist ${HOME}/.local/share/data/qBittorrent
 blacklist ${HOME}/.local/share/dino
 blacklist ${HOME}/.local/share/dolphin
+blacklist ${HOME}/.local/share/emailidentities
 blacklist ${HOME}/.local/share/epiphany
 blacklist ${HOME}/.local/share/evolution
 blacklist ${HOME}/.local/share/feral-interactive
@@ -369,6 +376,7 @@ blacklist ${HOME}/.local/share/gnome-2048
 blacklist ${HOME}/.local/share/gnome-chess
 blacklist ${HOME}/.local/share/gnome-music
 blacklist ${HOME}/.local/share/gnome-photos
+blacklist ${HOME}/.local/share/gnome-recipes
 blacklist ${HOME}/.local/share/gnome-ring
 blacklist ${HOME}/.local/share/gnome-twitch
 blacklist ${HOME}/.local/share/gwenview
@@ -376,11 +384,14 @@ blacklist ${HOME}/.local/share/kaffeine
 blacklist ${HOME}/.local/share/kate
 blacklist ${HOME}/.local/share/kdenlive
 blacklist ${HOME}/.local/share/kget
+blacklist ${HOME}/.local/share/kmail2
+blacklist ${HOME}/.local/share/knotes
 blacklist ${HOME}/.local/share/krita
 blacklist ${HOME}/.local/share/ktorrentrc
 blacklist ${HOME}/.local/share/ktorrent
 blacklist ${HOME}/.local/share/kwrite
 blacklist ${HOME}/.local/share/liferea
+blacklist ${HOME}/.local/share/local-mail
 blacklist ${HOME}/.local/share/lollypop
 blacklist ${HOME}/.local/share/maps-places.json
 blacklist ${HOME}/.local/share/meld
@@ -397,6 +408,7 @@ blacklist ${HOME}/.local/share/okular
 blacklist ${HOME}/.local/share/orage
 blacklist ${HOME}/.local/share/org.kde.gwenview
 blacklist ${HOME}/.local/share/pix
+blacklist ${HOME}/.local/share/plasma_notes
 blacklist ${HOME}/.local/share/psi+
 blacklist ${HOME}/.local/share/qpdfview
 blacklist ${HOME}/.local/share/qutebrowser
@@ -485,6 +497,7 @@ blacklist ${HOME}/.xpdfrc
 blacklist ${HOME}/.zoom
 blacklist ${HOME}/Arduino
 blacklist ${HOME}/wallet.dat
+blacklist /tmp/akonadi-*
 blacklist /tmp/ssh-*
 # ~/.cache directory
@@ -495,6 +508,8 @@ blacklist ${HOME}/.cache/Franz
 blacklist ${HOME}/.cache/INRIA
 blacklist ${HOME}/.cache/MusicBrainz
 blacklist ${HOME}/.cache/QuiteRss
+blacklist ${HOME}/.cache/akonadi*
+blacklist ${HOME}/.cache/atril
 blacklist ${HOME}/.cache/attic
 blacklist ${HOME}/.cache/borg
 blacklist ${HOME}/.cache/calibre
@@ -517,11 +532,14 @@ blacklist ${HOME}/.cache/google-chrome-unstable
 blacklist ${HOME}/.cache/gnome-twitch
 blacklist ${HOME}/.cache/icedove
 blacklist ${HOME}/.cache/INRIA/Natron
+blacklist ${HOME}/.cache/inkscape
 blacklist ${HOME}/.cache/inox
 blacklist ${HOME}/.cache/iridium
 blacklist ${HOME}/.cache/kdenlive
 blacklist ${HOME}/.cache/kinfocenter
+blacklist ${HOME}/.cache/kmail2
 blacklist ${HOME}/.cache/krunner
+blacklist ${HOME}/.cache/krunnerbookmarkrunnerfirefoxdbfile.sqlite
 blacklist ${HOME}/.cache/kscreenlocker_greet
 blacklist ${HOME}/.cache/ksmserver-logout-greeter
 blacklist ${HOME}/.cache/ksplashqml
@@ -554,6 +572,7 @@ blacklist ${HOME}/.cache/torbrowser
 blacklist ${HOME}/.cache/transmission
 blacklist ${HOME}/.cache/vivaldi
 blacklist ${HOME}/.cache/vivaldi-snapshot
+blacklist ${HOME}/.cache/vlc
 blacklist ${HOME}/.cache/waterfox
 blacklist ${HOME}/.cache/wesnoth
 blacklist ${HOME}/.cache/xmms2
diff --git a/etc/display.profile b/etc/display.profile
index 41512a0cb..69183f4ca 100644
--- a/etc/display.profile
+++ b/etc/display.profile
@@ -5,8 +5,6 @@ include /etc/firejail/display.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -16,6 +14,7 @@ include /etc/firejail/whitelist-var-common.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/ebook-viewer.profile b/etc/ebook-viewer.profile
index 9f7e1382b..1e28b854a 100644
--- a/etc/ebook-viewer.profile
+++ b/etc/ebook-viewer.profile
@@ -1,9 +1,8 @@
 # Firejail profile alias for calibre
 # This file is overwritten after every install/update
-blacklist /run/user/*/bus
 net none
+nodbus
 # Redirect
 include /etc/firejail/calibre.profile
diff --git a/etc/electron.profile b/etc/electron.profile
index 222beada0..52d45b3f8 100644
--- a/etc/electron.profile
+++ b/etc/electron.profile
@@ -14,6 +14,7 @@ whitelist ${DOWNLOADS}
 apparmor
 caps.drop all
 netfilter
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/engrampa.profile b/etc/engrampa.profile
index ae61f1d93..cf32d579e 100644
--- a/etc/engrampa.profile
+++ b/etc/engrampa.profile
@@ -5,8 +5,6 @@ include /etc/firejail/engrampa.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus - makes settings immutable
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -14,9 +12,11 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
+apparmor
 caps.drop all
-# net none - makes settings immutable
+net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/eog.profile b/etc/eog.profile
index 545a6e432..66434ae05 100644
--- a/etc/eog.profile
+++ b/etc/eog.profile
@@ -5,8 +5,6 @@ include /etc/firejail/eog.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus - makes settings immutable
 noblacklist ${HOME}/.Steam
 noblacklist ${HOME}/.config/eog
 noblacklist ${HOME}/.local/share/Trash
@@ -19,10 +17,11 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
-apparmor
+# apparmor - makes settings immutable
 caps.drop all
 # net none - makes settings immutable
 no3d
+# nodbus - makes settings immutable
 nodvd
 nogroups
 nonewprivs
@@ -37,7 +36,7 @@ shell none
 private-bin eog
 private-dev
 private-etc fonts
-private-lib
+private-lib gdk-pixbuf-2.0,gio,girepository-1.0,gvfs,libgconf-2.so.4
 private-tmp
 #memory-deny-write-execute  - breaks on Arch
diff --git a/etc/eom.profile b/etc/eom.profile
index c7c92db0e..48965bcb9 100644
--- a/etc/eom.profile
+++ b/etc/eom.profile
@@ -5,8 +5,6 @@ include /etc/firejail/eom.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus - makes settings immutable
 noblacklist ${HOME}/.Steam
 noblacklist ${HOME}/.config/mate/eom
 noblacklist ${HOME}/.local/share/Trash
@@ -19,10 +17,11 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
-apparmor
+# apparmor - makes settings immutable
 caps.drop all
 # net none - makes settings immutable
 no3d
+# nodbus - makes settings immutable
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/etr.profile b/etc/etr.profile
index ad2e5be5d..5c01636cc 100644
--- a/etc/etr.profile
+++ b/etc/etr.profile
@@ -5,8 +5,6 @@ include /etc/firejail/etr.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.etr
 include /etc/firejail/disable-common.inc
@@ -20,6 +18,7 @@ include /etc/firejail/whitelist-var-common.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/evince-previewer.profile b/etc/evince-previewer.profile
new file mode 100644
index 000000000..d5bc6db33
--- /dev/null
+++ b/etc/evince-previewer.profile
@@ -0,0 +1,10 @@
+# Firejail profile for evince-previewer
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/evince-previewer.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+# Redirect
+include /etc/firejail/evince.profile
diff --git a/etc/evince-thumbnailer.profile b/etc/evince-thumbnailer.profile
new file mode 100644
index 000000000..abc21632d
--- /dev/null
+++ b/etc/evince-thumbnailer.profile
@@ -0,0 +1,10 @@
+# Firejail profile for evince-thumbnailer
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/evince-thumbnailer.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+# Redirect
+include /etc/firejail/evince.profile
diff --git a/etc/evince.profile b/etc/evince.profile
index 72c1ffc97..38c9ee9a9 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -5,8 +5,6 @@ include /etc/firejail/evince.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/evince
 include /etc/firejail/disable-common.inc
@@ -21,6 +19,7 @@ machine-id
 # net none breaks AppArmor on Ubuntu systems
 netfilter
 no3d
+# nodbus
 nodvd
 nogroups
 nonewprivs
@@ -38,7 +37,7 @@ private-dev
 private-etc fonts
 #private-lib - seems to be breaking on Gnome Shell 3.26.2, Mutter WM, issue 1711
-#private-lib evince,libpoppler-glib.so.8
+private-lib evince,gdk-pixbuf-2.0,gio,gvfs/libgvfscommon.so,libgconf-2.so.4,libpoppler-glib.so.8,librsvg-2.so.2
 private-tmp
diff --git a/etc/exiftool.profile b/etc/exiftool.profile
index 18d1e3c81..8ab6012f5 100644
--- a/etc/exiftool.profile
+++ b/etc/exiftool.profile
@@ -6,7 +6,6 @@ include /etc/firejail/exiftool.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 noblacklist /usr/bin/perl
@@ -21,6 +20,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/feh.profile b/etc/feh.profile
index 1320434f1..ba7a76c49 100644
--- a/etc/feh.profile
+++ b/etc/feh.profile
@@ -5,8 +5,6 @@ include /etc/firejail/feh.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -15,6 +13,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/ffmpeg.profile b/etc/ffmpeg.profile
index acea1e834..538179107 100644
--- a/etc/ffmpeg.profile
+++ b/etc/ffmpeg.profile
@@ -6,8 +6,6 @@ include /etc/firejail/ffmpeg.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -18,6 +16,7 @@ include /etc/firejail/whitelist-var-common.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nosound
 notv
diff --git a/etc/file-roller.profile b/etc/file-roller.profile
index bc4e70da4..eb76d1dbb 100644
--- a/etc/file-roller.profile
+++ b/etc/file-roller.profile
@@ -5,8 +5,6 @@ include /etc/firejail/file-roller.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus - makes settings immutable
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -14,9 +12,11 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
+apparmor
 caps.drop all
-# net none - makes settings immutable
+net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/file.profile b/etc/file.profile
index 041bf5ae5..2bdbaaaa8 100644
--- a/etc/file.profile
+++ b/etc/file.profile
@@ -6,7 +6,6 @@ include /etc/firejail/file.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 include /etc/firejail/disable-common.inc
@@ -17,6 +16,7 @@ caps.drop all
 hostname file
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/firefox-common.profile b/etc/firefox-common.profile
index 12d160155..1f531c1b7 100644
--- a/etc/firefox-common.profile
+++ b/etc/firefox-common.profile
@@ -25,6 +25,7 @@ caps.drop all
 # machine-id breaks pulse audio; it should work fine in setups where sound is not required
 #machine-id
 netfilter
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/firejail.config b/etc/firejail.config
index ade3e3c84..0cd4dca3a 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -23,6 +23,9 @@
 # and it will harden the rest of the chroot tree.
 # chroot-desktop yes
+# Enable or disable dbus handling by --nodbus flag, default enabled.
+# dbus yes
 # Disable /mnt, /media, /run/mount and /run/media access. By default access
 # to these directories is enabled.
 # disable-mnt no
diff --git a/etc/freecad.profile b/etc/freecad.profile
index bac502a5f..c51d88f7a 100644
--- a/etc/freecad.profile
+++ b/etc/freecad.profile
@@ -5,8 +5,6 @@ include /etc/firejail/freecad.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/FreeCAD
 include /etc/firejail/disable-common.inc
@@ -17,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 ipc-namespace
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/frozen-bubble.profile b/etc/frozen-bubble.profile
index ca38ed1b8..8acd32bdd 100644
--- a/etc/frozen-bubble.profile
+++ b/etc/frozen-bubble.profile
@@ -5,8 +5,6 @@ include /etc/firejail/frozen-bubble.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.frozen-bubble
 include /etc/firejail/disable-common.inc
@@ -21,6 +19,7 @@ include /etc/firejail/whitelist-var-common.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/galculator.profile b/etc/galculator.profile
index b28c7943f..8229f8250 100644
--- a/etc/galculator.profile
+++ b/etc/galculator.profile
@@ -5,8 +5,6 @@ include /etc/firejail/galculator.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/galculator
 include /etc/firejail/disable-common.inc
@@ -22,6 +20,7 @@ include /etc/firejail/whitelist-var-common.inc
 apparmor
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/gcloud.profile b/etc/gcloud.profile
new file mode 100644
index 000000000..195dc9302
--- /dev/null
+++ b/etc/gcloud.profile
@@ -0,0 +1,40 @@
+# Firejail profile for gcloud
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/gcloud.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+noblacklist ${HOME}/.boto
+noblacklist ${HOME}/.config/gcloud
+noblacklist /var/run/docker.sock
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-programs.inc
+apparmor
+caps.drop all
+machine-id
+netfilter
+nodbus
+nodvd
+# required for sudo-free docker
+#nogroups
+nonewprivs
+noroot
+notv
+protocol unix,inet,inet6
+seccomp
+shell none
+tracelog
+disable-mnt
+private-dev
+private-etc ca-certificates,ssl,hosts,localtime,nsswitch.conf,resolv.conf,pki,crypto-policies,ld.so.cache
+private-tmp
+noexec /tmp
+# will break user-local installs of gcloud tooling
+# noexec ${HOME}
diff --git a/etc/gedit.profile b/etc/gedit.profile
index 97eb692de..e78b8a708 100644
--- a/etc/gedit.profile
+++ b/etc/gedit.profile
@@ -5,8 +5,6 @@ include /etc/firejail/gedit.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus - makes settings immutable
 noblacklist ${HOME}/.config/enchant
 noblacklist ${HOME}/.config/gedit
 noblacklist ${HOME}/.gitconfig
@@ -18,10 +16,12 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
+# apparmor - makes settings immutable
 caps.drop all
-# net none - makes settings immutable
 machine-id
+# net none - makes settings immutable
 no3d
+# nodbus - makes settings immutable
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/gimp.profile b/etc/gimp.profile
index 3cc012a88..49df54d1f 100644
--- a/etc/gimp.profile
+++ b/etc/gimp.profile
@@ -5,8 +5,6 @@ include /etc/firejail/gimp.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.gimp*
 include /etc/firejail/disable-common.inc
@@ -18,6 +16,7 @@ include /etc/firejail/whitelist-var-common.inc
 apparmor
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/gnome-calculator.profile b/etc/gnome-calculator.profile
index d13208a1e..dfb93c3b0 100644
--- a/etc/gnome-calculator.profile
+++ b/etc/gnome-calculator.profile
@@ -6,7 +6,6 @@ include /etc/firejail/gnome-calculator.local
 # Persistent global definitions
 include /etc/firejail/globals.local
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -14,10 +13,12 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-common.inc
 include /etc/firejail/whitelist-var-common.inc
-apparmor
+# apparmor - makes settings immutable
 caps.drop all
+# net none
 netfilter
 no3d
+# nodbus - makes settings immutable
 nodvd
 nogroups
 nonewprivs
@@ -32,7 +33,7 @@ shell none
 disable-mnt
 private-bin gnome-calculator
 private-dev
-private-lib
+private-lib gdk-pixbuf-2.0,gio,girepository-1.0,gvfs,libgconf-2.so.4,libgnutls.so.30,libproxy.so.1,librsvg-2.so.2,libxml2.so.2
 private-tmp
 #memory-deny-write-execute  - breaks on Arch
diff --git a/etc/gnome-logs.profile b/etc/gnome-logs.profile
new file mode 100644
index 000000000..7e7902dff
--- /dev/null
+++ b/etc/gnome-logs.profile
@@ -0,0 +1,40 @@
+# Firejail profile for gnome-logs
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/gnome-logs.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+whitelist /var/log/journal
+include /etc/firejail/whitelist-var-common.inc
+caps.drop all
+net none
+no3d
+nodbus
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix
+seccomp
+shell none
+disable-mnt
+private-bin gnome-logs
+private-dev
+#private-etc fonts
+#private-lib gdk-pixbuf-2.0,gio,gvfs/libgvfscommon.so,libgconf-2.so.4,librsvg-2.so.2
+private-tmp
+writable-var-log
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/gnome-recipes.profile b/etc/gnome-recipes.profile
new file mode 100644
index 000000000..2f7657c0c
--- /dev/null
+++ b/etc/gnome-recipes.profile
@@ -0,0 +1,45 @@
+# Firejail profile for gnome-recipes
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/gnome-recipes.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+noblacklist ${HOME}/.local/share/gnome-recipes
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+mkdir ${HOME}/.cache/gnome-recipes
+whitelist ${HOME}/.cache/gnome-recipes
+include /etc/firejail/whitelist-common.inc
+include /etc/firejail/whitelist-var-common.inc
+caps.drop all
+ipc-namespace
+netfilter
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+disable-mnt
+private-bin gnome-recipes,tar
+private-dev
+private-etc ca-certificates,fonts,ssl,crypto-policies,pki
+# private-lib works for me with Gnome Shell 3.26.2, Mutter WM (Arch Linux)
+# not widely tested though, leaving it to devs discretion to enable it later
+#private-lib gdk-pixbuf-2.0,gio,gvfs/libgvfscommon.so,libgconf-2.so.4,libgnutls.so.30,libjpeg.so.8,libp11-kit.so.0,libproxy.so.1,librsvg-2.so.2
+private-tmp
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/gpicview.profile b/etc/gpicview.profile
index 8d47d9c31..c6453e972 100644
--- a/etc/gpicview.profile
+++ b/etc/gpicview.profile
@@ -5,8 +5,6 @@ include /etc/firejail/gpicview.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/gpicview
 include /etc/firejail/disable-common.inc
@@ -18,6 +16,7 @@ include /etc/firejail/whitelist-var-common.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/gwenview.profile b/etc/gwenview.profile
index d79b72152..d17be41cc 100644
--- a/etc/gwenview.profile
+++ b/etc/gwenview.profile
@@ -5,8 +5,6 @@ include /etc/firejail/gwenview.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/gwenviewrc
 noblacklist ${HOME}/.config/org.kde.gwenviewrc
 noblacklist ${HOME}/.gimp*
@@ -24,8 +22,10 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
+apparmor
 caps.drop all
 # net none
+# nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/gzip.profile b/etc/gzip.profile
index 5187bb9f0..779067770 100644
--- a/etc/gzip.profile
+++ b/etc/gzip.profile
@@ -6,12 +6,12 @@ include /etc/firejail/gzip.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 ignore noroot
 net none
 no3d
+nodbus
 nodvd
 nosound
 notv
diff --git a/etc/handbrake.profile b/etc/handbrake.profile
index b99842d60..ff9dd248f 100644
--- a/etc/handbrake.profile
+++ b/etc/handbrake.profile
@@ -17,6 +17,7 @@ include /etc/firejail/whitelist-var-common.inc
 apparmor
 caps.drop all
 netfilter
+nodbus
 nogroups
 nonewprivs
 noroot
diff --git a/etc/hashcat.profile b/etc/hashcat.profile
index ad1aae523..c8ab268c8 100644
--- a/etc/hashcat.profile
+++ b/etc/hashcat.profile
@@ -6,8 +6,6 @@ include /etc/firejail/hashcat.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.hashcat
 noblacklist /usr/include
@@ -18,6 +16,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/highlight.profile b/etc/highlight.profile
index a7c667ce1..781866f3b 100644
--- a/etc/highlight.profile
+++ b/etc/highlight.profile
@@ -5,7 +5,6 @@ include /etc/firejail/highlight.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 include /etc/firejail/disable-common.inc
@@ -16,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/hugin.profile b/etc/hugin.profile
index bff074b74..3847a7daf 100644
--- a/etc/hugin.profile
+++ b/etc/hugin.profile
@@ -5,8 +5,6 @@ include /etc/firejail/hugin.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.hugin
 include /etc/firejail/disable-common.inc
@@ -16,6 +14,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/imagej.profile b/etc/imagej.profile
index 058da2805..7396160af 100644
--- a/etc/imagej.profile
+++ b/etc/imagej.profile
@@ -5,8 +5,6 @@ include /etc/firejail/imagej.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.imagej
 include /etc/firejail/disable-common.inc
@@ -17,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 ipc-namespace
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/img2txt.profile b/etc/img2txt.profile
index 5a19a75f1..8c157bf2a 100644
--- a/etc/img2txt.profile
+++ b/etc/img2txt.profile
@@ -5,8 +5,6 @@ include /etc/firejail/img2txt.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -14,6 +12,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/inkscape.profile b/etc/inkscape.profile
index 6e669ea2c..af24bc3e9 100644
--- a/etc/inkscape.profile
+++ b/etc/inkscape.profile
@@ -5,9 +5,9 @@ include /etc/firejail/inkscape.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-noblacklist ${HOME}/.inkscape
+noblacklist ${HOME}/.cache/inkscape
 noblacklist ${HOME}/.config/inkscape
+noblacklist ${HOME}/.inkscape
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
@@ -18,7 +18,8 @@ include /etc/firejail/whitelist-var-common.inc
 apparmor
 caps.drop all
-netfilter
+net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/jd-gui.profile b/etc/jd-gui.profile
index bf461b93d..f70eff3e4 100644
--- a/etc/jd-gui.profile
+++ b/etc/jd-gui.profile
@@ -5,8 +5,6 @@ include /etc/firejail/jd-gui.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/jd-gui.cfg
 noblacklist ${HOME}/.java
@@ -18,6 +16,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/kate.profile b/etc/kate.profile
index a3d2be6b2..b3c1e81d8 100644
--- a/etc/kate.profile
+++ b/etc/kate.profile
@@ -5,8 +5,7 @@ include /etc/firejail/kate.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus
+noblacklist ${HOME}/.config/katemetainfos
 noblacklist ${HOME}/.config/katepartrc
 noblacklist ${HOME}/.config/katerc
 noblacklist ${HOME}/.config/kateschemarc
@@ -21,9 +20,10 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
-apparmor
+# apparmor
 caps.drop all
 # net none
+# nodbus
 netfilter
 nodvd
 nogroups
@@ -42,4 +42,7 @@ private-dev
 # private-etc fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg
 private-tmp
+# noexec ${HOME}
+noexec /tmp
 join-or-start kate
diff --git a/etc/kcalc.profile b/etc/kcalc.profile
index 3f024f3fa..86a3b1462 100644
--- a/etc/kcalc.profile
+++ b/etc/kcalc.profile
@@ -20,9 +20,11 @@ whitelist ${HOME}/.kde4/share/config/kcalcrc
 include /etc/firejail/whitelist-common.inc
 include /etc/firejail/whitelist-var-common.inc
+apparmor
 caps.drop all
-netfilter
+net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/kdenlive.profile b/etc/kdenlive.profile
index 5c770856a..819279b10 100644
--- a/etc/kdenlive.profile
+++ b/etc/kdenlive.profile
@@ -5,7 +5,6 @@ include /etc/firejail/kdenlive.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus
 noblacklist ${HOME}/.cache/kdenlive
 noblacklist ${HOME}/.config/kdenliverc
 noblacklist ${HOME}/.local/share/kdenlive
@@ -18,6 +17,7 @@ include /etc/firejail/disable-programs.inc
 apparmor
 caps.drop all
 # net none
+# nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/keepassx.profile b/etc/keepassx.profile
index f7b0bd5d1..14af2682c 100644
--- a/etc/keepassx.profile
+++ b/etc/keepassx.profile
@@ -5,8 +5,6 @@ include /etc/firejail/keepassx.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/*.kdb
 noblacklist ${HOME}/*.kdbx
 noblacklist ${HOME}/.config/keepassx
@@ -23,6 +21,7 @@ caps.drop all
 machine-id
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/keepassxc.profile b/etc/keepassxc.profile
index 66b524d29..0e464cbe4 100644
--- a/etc/keepassxc.profile
+++ b/etc/keepassxc.profile
@@ -5,8 +5,6 @@ include /etc/firejail/keepassxc.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/*.kdb
 noblacklist ${HOME}/*.kdbx
 noblacklist ${HOME}/.config/keepassxc
@@ -22,9 +20,11 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
 caps.drop all
+machine-id
 net none
 no3d
 nodvd
+nodbus
 nogroups
 nonewprivs
 noroot
diff --git a/etc/kmail.profile b/etc/kmail.profile
index ca774f4ec..3e425b62e 100644
--- a/etc/kmail.profile
+++ b/etc/kmail.profile
@@ -5,13 +5,32 @@ include /etc/firejail/kmail.local
 # Persistent global definitions
 include /etc/firejail/globals.local
+# kmail has problems launching akonadi in debian and ubuntu.
+# one solution is to have akonadi already running when kmail is started
+noblacklist ${HOME}/.cache/akonadi*
+noblacklist ${HOME}/.cache/kmail2
+noblacklist ${HOME}/.config/akonadi*
+noblacklist ${HOME}/.config/baloorc
+noblacklist ${HOME}/.config/emailidentities
+noblacklist ${HOME}/.config/kmail2rc
 noblacklist ${HOME}/.gnupg
+noblacklist ${HOME}/.local/share/akonadi*
+noblacklist ${HOME}/.local/share/contacts
+noblacklist ${HOME}/.local/share/emailidentities
+noblacklist ${HOME}/.local/share/kmail2
+noblacklist ${HOME}/.local/share/local-mail
+noblacklist ${HOME}/.local/share/notes
+noblacklist /tmp/akonadi-*
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
+include /etc/firejail/whitelist-var-common.inc
+# apparmor
 caps.drop all
 netfilter
 nodvd
@@ -22,11 +41,14 @@ nosound
 notv
 novideo
 protocol unix,inet,inet6,netlink
-# blacklisting of chroot system calls breaks kmail
+# we need to allow chroot, io_getevents, ioprio_set, io_setup, io_submit system calls
-seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
+seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
 # tracelog
 # writable-run-user is needed for signing and encrypting emails
 writable-run-user
 private-dev
-# private-tmp - breaks akonadi and opening of email attachments
+# private-tmp - interrupts connection to akonadi, breaks opening of email attachments
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/knotes.profile b/etc/knotes.profile
index 94ada7855..4bbbd332d 100644
--- a/etc/knotes.profile
+++ b/etc/knotes.profile
@@ -5,27 +5,12 @@ include /etc/firejail/knotes.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-noblacklist ${HOME}/.config/knotesrc
+# knotes has problems launching akonadi in debian and ubuntu.
+# one solution is to have akonadi already running when knotes is started
-include /etc/firejail/disable-common.inc
-# include /etc/firejail/disable-devel.inc
-include /etc/firejail/disable-passwdmgr.inc
-include /etc/firejail/disable-programs.inc
-include /etc/firejail/whitelist-var-common.inc
+noblacklist ${HOME}/.config/knotesrc
+noblacklist ${HOME}/.local/share/knotes
-caps.drop all
-netfilter
-nodvd
-nogroups
-nonewprivs
-noroot
-nosound
-notv
-protocol unix
-seccomp
-shell none
-tracelog
-private-dev
+# Redirect
-#private-tmp - problems on kubuntu 17.04
+include /etc/firejail/kmail.profile
diff --git a/etc/krita.profile b/etc/krita.profile
index 0f4c5210b..24948c584 100644
--- a/etc/krita.profile
+++ b/etc/krita.profile
@@ -5,7 +5,6 @@ include /etc/firejail/krita.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/kritarc
 noblacklist ${HOME}/.local/share/krita
@@ -18,6 +17,7 @@ apparmor
 caps.drop all
 ipc-namespace
 # net none
+# nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/krunner.profile b/etc/krunner.profile
index 1e97f4290..17526c4ea 100644
--- a/etc/krunner.profile
+++ b/etc/krunner.profile
@@ -10,10 +10,13 @@ include /etc/firejail/globals.local
 #   with its own profile, if it is sandboxed automatically.
 # noblacklist ${HOME}/.cache/krunner
+# noblacklist ${HOME}/.cache/krunnerbookmarkrunnerfirefoxdbfile.sqlite
+# noblacklist ${HOME}/.config/chromium
 noblacklist ${HOME}/.config/krunnerrc
 noblacklist ${HOME}/.kde/share/config/krunnerrc
 noblacklist ${HOME}/.kde4/share/config/krunnerrc
 # noblacklist ${HOME}/.local/share/baloo
+# noblacklist ${HOME}/.mozilla
 include /etc/firejail/disable-common.inc
 # include /etc/firejail/disable-devel.inc
diff --git a/etc/kwrite.profile b/etc/kwrite.profile
index a785f3541..ac51259c0 100644
--- a/etc/kwrite.profile
+++ b/etc/kwrite.profile
@@ -5,8 +5,6 @@ include /etc/firejail/kwrite.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/katepartrc
 noblacklist ${HOME}/.config/katerc
 noblacklist ${HOME}/.config/kateschemarc
@@ -26,6 +24,7 @@ apparmor
 caps.drop all
 # net none
 netfilter
+# nodbus
 nodvd
 nogroups
 nonewprivs
@@ -43,4 +42,7 @@ private-dev
 private-etc fonts,kde4rc,kde5rc,ld.so.cache,machine-id,pulse,xdg
 private-tmp
+noexec ${HOME}
+noexec /tmp
 join-or-start kwrite
diff --git a/etc/less.profile b/etc/less.profile
index 3b1c5d6bf..e2616ba4f 100644
--- a/etc/less.profile
+++ b/etc/less.profile
@@ -6,12 +6,12 @@ include /etc/firejail/less.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 ignore noroot
 net none
 no3d
+nodbus
 nodvd
 nosound
 notv
diff --git a/etc/libreoffice.profile b/etc/libreoffice.profile
index ceb680951..15961321e 100644
--- a/etc/libreoffice.profile
+++ b/etc/libreoffice.profile
@@ -21,6 +21,7 @@ apparmor
 caps.drop all
 machine-id
 netfilter
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/lmms.profile b/etc/lmms.profile
index b2bacb246..a9fecf5be 100644
--- a/etc/lmms.profile
+++ b/etc/lmms.profile
@@ -5,8 +5,6 @@ include /etc/firejail/lmms.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.lmmsrc.xml
 include /etc/firejail/disable-common.inc
@@ -18,6 +16,7 @@ caps.drop all
 ipc-namespace
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/macrofusion.profile b/etc/macrofusion.profile
index f8c5c34ca..948c7226d 100644
--- a/etc/macrofusion.profile
+++ b/etc/macrofusion.profile
@@ -5,8 +5,6 @@ include /etc/firejail/macrofusion.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/mfusion
 include /etc/firejail/disable-common.inc
@@ -17,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 ipc-namespace
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/mate-calc.profile b/etc/mate-calc.profile
index be5dac206..f452b751a 100644
--- a/etc/mate-calc.profile
+++ b/etc/mate-calc.profile
@@ -5,8 +5,6 @@ include /etc/firejail/mate-calc.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/mate-calc
 include /etc/firejail/disable-common.inc
@@ -24,6 +22,7 @@ whitelist ${HOME}/.themes
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/mediainfo.profile b/etc/mediainfo.profile
index de9297174..c3c84ed39 100644
--- a/etc/mediainfo.profile
+++ b/etc/mediainfo.profile
@@ -5,7 +5,6 @@ include /etc/firejail/mediainfo.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 include /etc/firejail/disable-common.inc
@@ -16,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/meld.profile b/etc/meld.profile
index 1a451ff57..78d9e0c76 100644
--- a/etc/meld.profile
+++ b/etc/meld.profile
@@ -5,8 +5,6 @@ include /etc/firejail/meld.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.local/share/meld
 include /etc/firejail/disable-common.inc
@@ -17,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/mpv.profile b/etc/mpv.profile
index a4dc679f4..dcd8b05e1 100644
--- a/etc/mpv.profile
+++ b/etc/mpv.profile
@@ -18,6 +18,7 @@ include /etc/firejail/whitelist-var-common.inc
 apparmor
 caps.drop all
 netfilter
+nodbus
 nogroups
 nonewprivs
 noroot
diff --git a/etc/mupdf.profile b/etc/mupdf.profile
index 9e04c3a81..af5859dbc 100644
--- a/etc/mupdf.profile
+++ b/etc/mupdf.profile
@@ -5,8 +5,6 @@ include /etc/firejail/mupdf.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -17,6 +15,7 @@ include /etc/firejail/whitelist-var-common.inc
 caps.drop all
 machine-id
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/mupen64plus.profile b/etc/mupen64plus.profile
index e05babc91..2e3d7cfb8 100644
--- a/etc/mupen64plus.profile
+++ b/etc/mupen64plus.profile
@@ -5,8 +5,6 @@ include /etc/firejail/mupen64plus.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/mupen64plus
 noblacklist ${HOME}/.local/share/mupen64plus
@@ -24,6 +22,7 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nonewprivs
 noroot
diff --git a/etc/natron.profile b/etc/natron.profile
index 413ea53f9..cf01c862c 100644
--- a/etc/natron.profile
+++ b/etc/natron.profile
@@ -5,8 +5,6 @@ include /etc/firejail/natron.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.Natron
 noblacklist ${HOME}/.cache/INRIA/Natron
 noblacklist ${HOME}/.config/INRIA
@@ -19,6 +17,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/ncdu.profile b/etc/ncdu.profile
new file mode 100644
index 000000000..ab79a325e
--- /dev/null
+++ b/etc/ncdu.profile
@@ -0,0 +1,29 @@
+# Firejail profile for ncdu
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/ncdu.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+caps.drop all
+ipc-namespace
+nodbus
+net none
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix
+seccomp
+shell none
+private-dev
+# private-tmp
+memory-deny-write-execute
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/odt2txt.profile b/etc/odt2txt.profile
index b6d4a63b5..c807a5399 100644
--- a/etc/odt2txt.profile
+++ b/etc/odt2txt.profile
@@ -5,7 +5,6 @@ include /etc/firejail/odt2txt.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 include /etc/firejail/disable-common.inc
@@ -16,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/okular.profile b/etc/okular.profile
index ffe0d2bfb..f1f0b2c7e 100644
--- a/etc/okular.profile
+++ b/etc/okular.profile
@@ -5,8 +5,6 @@ include /etc/firejail/okular.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus
 noblacklist ${HOME}/.cache/okular
 noblacklist ${HOME}/.config/okularpartrc
 noblacklist ${HOME}/.config/okularrc
@@ -30,6 +28,7 @@ caps.drop all
 machine-id
 # net none
 netfilter
+# nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/open-invaders.profile b/etc/open-invaders.profile
index 191f8d87b..3c3609dae 100644
--- a/etc/open-invaders.profile
+++ b/etc/open-invaders.profile
@@ -5,8 +5,6 @@ include /etc/firejail/open-invaders.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.openinvaders
 include /etc/firejail/disable-common.inc
@@ -20,6 +18,7 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/openbox.profile b/etc/openbox.profile
index 5bab7ce7d..ec4b47c29 100644
--- a/etc/openbox.profile
+++ b/etc/openbox.profile
@@ -14,3 +14,6 @@ netfilter
 noroot
 protocol unix,inet,inet6
 seccomp
+read-only ${HOME}/.config/openbox/autostart
+read-only ${HOME}/.config/openbox/environment
diff --git a/etc/openshot.profile b/etc/openshot.profile
index ca9110be6..b9eb29590 100644
--- a/etc/openshot.profile
+++ b/etc/openshot.profile
@@ -18,6 +18,7 @@ include /etc/firejail/whitelist-var-common.inc
 apparmor
 caps.drop all
 netfilter
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/pcmanfm.profile b/etc/pcmanfm.profile
index 08c607020..0dcd21549 100644
--- a/etc/pcmanfm.profile
+++ b/etc/pcmanfm.profile
@@ -5,8 +5,6 @@ include /etc/firejail/pcmanfm.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus
 noblacklist ${HOME}/.local/share/Trash
 # noblacklist ${HOME}/.config/libfm - disable-programs.inc is disabled, see below
 # noblacklist ${HOME}/.config/pcmanfm
@@ -19,6 +17,7 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 # net none - see issue #1467, computer:/// location broken
 no3d
+# nodbus
 nodvd
 nonewprivs
 noroot
diff --git a/etc/pdfchain.profile b/etc/pdfchain.profile
index d43c0911e..b4ccb6003 100755
--- a/etc/pdfchain.profile
+++ b/etc/pdfchain.profile
@@ -5,9 +5,6 @@ include /etc/firejail/pdfchain.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
@@ -19,6 +16,7 @@ caps.drop all
 ipc-namespace
 net none
 no3d
+nodbus
 nogroups
 nonewprivs
 noroot
diff --git a/etc/pdfmod.profile b/etc/pdfmod.profile
index 8ac09dcdc..9b08dfd84 100644
--- a/etc/pdfmod.profile
+++ b/etc/pdfmod.profile
@@ -5,8 +5,6 @@ include /etc/firejail/pdfmod.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.cache/pdfmod
 noblacklist ${HOME}/.config/pdfmod
@@ -22,6 +20,7 @@ ipc-namespace
 machine-id
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/pdfsam.profile b/etc/pdfsam.profile
index c1515ab73..465f68fd6 100644
--- a/etc/pdfsam.profile
+++ b/etc/pdfsam.profile
@@ -5,8 +5,6 @@ include /etc/firejail/pdfsam.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.java
 include /etc/firejail/disable-common.inc
@@ -18,6 +16,7 @@ caps.drop all
 machine-id
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/pdftotext.profile b/etc/pdftotext.profile
index 736faa5ea..a97063754 100644
--- a/etc/pdftotext.profile
+++ b/etc/pdftotext.profile
@@ -5,7 +5,6 @@ include /etc/firejail/pdftotext.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 include /etc/firejail/disable-common.inc
@@ -19,6 +18,7 @@ caps.drop all
 machine-id
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/peek.profile b/etc/peek.profile
index 01db4fa08..7b7ab9470 100644
--- a/etc/peek.profile
+++ b/etc/peek.profile
@@ -5,8 +5,6 @@ include /etc/firejail/peek.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.cache/peek
 include /etc/firejail/disable-common.inc
@@ -17,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/pingus.profile b/etc/pingus.profile
index ec7eff632..b287e7ee8 100644
--- a/etc/pingus.profile
+++ b/etc/pingus.profile
@@ -5,8 +5,6 @@ include /etc/firejail/pingus.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.pingus
 include /etc/firejail/disable-common.inc
@@ -20,6 +18,7 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/pinta.profile b/etc/pinta.profile
index 4a8815a73..b51521ef7 100644
--- a/etc/pinta.profile
+++ b/etc/pinta.profile
@@ -5,8 +5,6 @@ include /etc/firejail/pinta.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/Pinta
 include /etc/firejail/disable-common.inc
@@ -17,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 ipc-namespace
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/pluma.profile b/etc/pluma.profile
index b50e3cbaf..d0acfeb1a 100644
--- a/etc/pluma.profile
+++ b/etc/pluma.profile
@@ -5,8 +5,6 @@ include /etc/firejail/pluma.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus - makes settings immutable
 noblacklist ${HOME}/.config/pluma
 include /etc/firejail/disable-common.inc
@@ -16,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
+# apparmor - makes settings immutable
 caps.drop all
-# net none - makes settings immutable
 machine-id
+# net none - makes settings immutable
 no3d
+# nodbus - makes settings immutable
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/qbittorrent.profile b/etc/qbittorrent.profile
index 8df8177eb..14a9e8adc 100644
--- a/etc/qbittorrent.profile
+++ b/etc/qbittorrent.profile
@@ -30,6 +30,7 @@ apparmor
 caps.drop all
 machine-id
 netfilter
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/ranger.profile b/etc/ranger.profile
index 211a1b2d5..fd5bbf89c 100644
--- a/etc/ranger.profile
+++ b/etc/ranger.profile
@@ -5,8 +5,6 @@ include /etc/firejail/ranger.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 # noblacklist /usr/bin/cpan*
 noblacklist /usr/bin/perl
 noblacklist /usr/lib/perl*
@@ -20,6 +18,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/rhythmbox.profile b/etc/rhythmbox.profile
index a20bdb883..6322f8217 100644
--- a/etc/rhythmbox.profile
+++ b/etc/rhythmbox.profile
@@ -13,10 +13,11 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
-apparmor
+# apparmor - makes settings immutable
 caps.drop all
 netfilter
 # no3d
+# nodbus - makes settings immutable
 nogroups
 nonewprivs
 noroot
diff --git a/etc/scribus.profile b/etc/scribus.profile
index 8ce63fbf0..f9f585a20 100644
--- a/etc/scribus.profile
+++ b/etc/scribus.profile
@@ -5,8 +5,6 @@ include /etc/firejail/scribus.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 # Support for PDF readers comes with Scribus 1.5 and higher
 noblacklist ${HOME}/.cache/okular
 noblacklist ${HOME}/.config/okularpartrc
@@ -33,6 +31,7 @@ include /etc/firejail/whitelist-var-common.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
@@ -48,3 +47,6 @@ tracelog
 # private-bin scribus,gs,gimp*
 private-dev
 private-tmp
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/sdat2img.profile b/etc/sdat2img.profile
index bc94ae2a0..2f3d94f01 100644
--- a/etc/sdat2img.profile
+++ b/etc/sdat2img.profile
@@ -6,8 +6,6 @@ include /etc/firejail/sdat2img.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -16,6 +14,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/shotcut.profile b/etc/shotcut.profile
index 3f2cc3d33..293a89ba3 100644
--- a/etc/shotcut.profile
+++ b/etc/shotcut.profile
@@ -5,8 +5,6 @@ include /etc/firejail/shotcut.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/Meltytech
 include /etc/firejail/disable-common.inc
@@ -16,6 +14,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/simutrans.profile b/etc/simutrans.profile
index 8b4113d2f..adde3f8ce 100644
--- a/etc/simutrans.profile
+++ b/etc/simutrans.profile
@@ -5,8 +5,6 @@ include /etc/firejail/simutrans.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.simutrans
 include /etc/firejail/disable-common.inc
@@ -20,6 +18,7 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/skanlite.profile b/etc/skanlite.profile
index 316cf5821..4fa649654 100644
--- a/etc/skanlite.profile
+++ b/etc/skanlite.profile
@@ -5,8 +5,6 @@ include /etc/firejail/skanlite.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -15,6 +13,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 # net none
 netfilter
+# nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/smplayer.profile b/etc/smplayer.profile
index 64eff5670..187b0674a 100644
--- a/etc/smplayer.profile
+++ b/etc/smplayer.profile
@@ -18,6 +18,7 @@ include /etc/firejail/whitelist-var-common.inc
 apparmor
 caps.drop all
 netfilter
+# nodbus - problems with KDE
 # nogroups
 nonewprivs
 noroot
diff --git a/etc/spotify.profile b/etc/spotify.profile
index c973783a9..dfd3bae7f 100644
--- a/etc/spotify.profile
+++ b/etc/spotify.profile
@@ -31,6 +31,7 @@ include /etc/firejail/whitelist-var-common.inc
 caps.drop all
 netfilter
+nodbus
 nodvd
 nogroups
 nonewprivs
@@ -44,7 +45,7 @@ tracelog
 disable-mnt
 private-bin spotify,bash,sh,zenity
 private-dev
-private-etc fonts,group,ld.so.cache,machine-id,pulse,resolv.conf
+private-etc fonts,ld.so.cache,machine-id,pulse,resolv.conf
 private-opt spotify
 private-tmp
diff --git a/etc/sqlitebrowser.profile b/etc/sqlitebrowser.profile
index 933d55b79..22c37645d 100644
--- a/etc/sqlitebrowser.profile
+++ b/etc/sqlitebrowser.profile
@@ -5,8 +5,6 @@ include /etc/firejail/sqlitebrowser.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/sqlitebrowser
 include /etc/firejail/disable-common.inc
@@ -17,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/steam.profile b/etc/steam.profile
index 4965d3a54..bcdea9bc7 100644
--- a/etc/steam.profile
+++ b/etc/steam.profile
@@ -32,7 +32,10 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
 caps.drop all
+#ipc-namespace
 netfilter
+# nodbus disabled as it breaks appindicator support
+#nodbus
 nodvd
 nogroups
 nonewprivs
@@ -44,10 +47,17 @@ protocol unix,inet,inet6,netlink
 seccomp
 shell none
 # tracelog disabled as it breaks integrated browser
-# tracelog
+#tracelog
+# private-bin is disabled while in testing, but has been tested working with multiple games
+#private-bin awk,basename,bash,bsdtar,bzip2,cat,chmod,cksum,cmp,comm,compress,cp,curl,cut,date,dbus-launch,dbus-send,desktop-file-edit,desktop-file-install,desktop-file-validate,dirname,echo,env,expr,file,find,getopt,grep,gtar,gzip,head,hostname,id,lbzip2,ldconfig,ldd,ln,ls,lsb_release,lspci,lsof,lz4,lzip,lzma,lzop,md5sum,mkdir,mktemp,mv,netstat,ps,pulseaudio,readlink,realpath,rm,sed,sh,sha1sum,sha256sum,sha512sum,sleep,sort,steam,steamdeps,steam-native,steam-runtime,sum,tail,tar,test,touch,tr,umask,uname,update-desktop-database,wc,wget,which,whoami,xterm,xz,zenity
+# extra programs are available which might be needed for select games
+#private-bin java,java-config,mono,python*
+# picture viewers are are needed for viewing screenshots
+#private-bin eog,eom,gthumb,pix,viewnior,xviewer
 # private-dev should be commented for controllers
 private-dev
-# private-etc breaks some games
+# private-etc breaks a small selection of games on some systems, comment to support those
-#private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,ld.so.conf,ld.so.conf.d,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl,pki,services,crypto-policies
+private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,ld.so.conf,ld.so.conf.d,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl,pki,services,crypto-policies,alternatives
 private-tmp
diff --git a/etc/strings.profile b/etc/strings.profile
index 09273f35d..8995ad2a6 100644
--- a/etc/strings.profile
+++ b/etc/strings.profile
@@ -6,12 +6,12 @@ include /etc/firejail/strings.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 ignore noroot
 net none
 no3d
+nodbus
 nodvd
 nosound
 notv
diff --git a/etc/supertux2.profile b/etc/supertux2.profile
index d60d7fa5f..24f42c276 100644
--- a/etc/supertux2.profile
+++ b/etc/supertux2.profile
@@ -5,8 +5,6 @@ include /etc/firejail/supertux2.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.local/share/supertux2
 include /etc/firejail/disable-common.inc
@@ -21,6 +19,7 @@ include /etc/firejail/whitelist-var-common.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/synfigstudio.profile b/etc/synfigstudio.profile
index 415a42cf5..be9c2aa64 100644
--- a/etc/synfigstudio.profile
+++ b/etc/synfigstudio.profile
@@ -5,8 +5,6 @@ include /etc/firejail/synfigstudio.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/synfig
 noblacklist ${HOME}/.synfig
@@ -17,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/tar.profile b/etc/tar.profile
index bd7973abf..5f54bf02d 100644
--- a/etc/tar.profile
+++ b/etc/tar.profile
@@ -6,13 +6,13 @@ include /etc/firejail/tar.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 hostname tar
 ignore noroot
 net none
 no3d
+nodbus
 nodvd
 nosound
 notv
diff --git a/etc/terasology.profile b/etc/terasology.profile
index ea25938d3..e671c4dc3 100644
--- a/etc/terasology.profile
+++ b/etc/terasology.profile
@@ -5,8 +5,6 @@ include /etc/firejail/terasology.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.java
 noblacklist ${HOME}/.local/share/terasology
@@ -25,6 +23,7 @@ caps.drop all
 ipc-namespace
 net none
 netfilter
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/thunderbird-beta.profile b/etc/thunderbird-beta.profile
new file mode 100644
index 000000000..73d2419da
--- /dev/null
+++ b/etc/thunderbird-beta.profile
@@ -0,0 +1,8 @@
+# Firejail profile alias for thunderbird-beta
+# This file is overwritten after every install/update
+whitelist /opt/thunderbird-beta
+# Redirect
+include /etc/firejail/thunderbird.profile
diff --git a/etc/totem.profile b/etc/totem.profile
index 6dbc5f0c2..ad3845d90 100644
--- a/etc/totem.profile
+++ b/etc/totem.profile
@@ -15,9 +15,10 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
-apparmor
+# apparmor - makes settings immutable
 caps.drop all
 netfilter
+# nodbus - makes settings immutable
 nogroups
 nonewprivs
 noroot
diff --git a/etc/transmission-gtk.profile b/etc/transmission-gtk.profile
index 3d249748d..ee044aa0d 100644
--- a/etc/transmission-gtk.profile
+++ b/etc/transmission-gtk.profile
@@ -25,6 +25,7 @@ apparmor
 caps.drop all
 machine-id
 netfilter
+nodbus
 nodvd
 nonewprivs
 noroot
diff --git a/etc/transmission-qt.profile b/etc/transmission-qt.profile
index 4f4d9bac1..a8fb80fd8 100644
--- a/etc/transmission-qt.profile
+++ b/etc/transmission-qt.profile
@@ -25,6 +25,7 @@ apparmor
 caps.drop all
 machine-id
 netfilter
+nodbus
 nodvd
 nonewprivs
 noroot
diff --git a/etc/transmission-show.profile b/etc/transmission-show.profile
index 135371747..575bf77dc 100644
--- a/etc/transmission-show.profile
+++ b/etc/transmission-show.profile
@@ -5,8 +5,6 @@ include /etc/firejail/transmission-show.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.cache/transmission
 noblacklist ${HOME}/.config/transmission
@@ -18,6 +16,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 machine-id
 net none
+nodbus
 nodvd
 nonewprivs
 noroot
diff --git a/etc/uefitool.profile b/etc/uefitool.profile
index 6cff5249c..a10b44fb1 100644
--- a/etc/uefitool.profile
+++ b/etc/uefitool.profile
@@ -5,8 +5,6 @@ include /etc/firejail/uefitool.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -16,6 +14,7 @@ caps.drop all
 ipc-namespace
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/unrar.profile b/etc/unrar.profile
index f7e25d5d7..ba2a86f4c 100644
--- a/etc/unrar.profile
+++ b/etc/unrar.profile
@@ -6,13 +6,13 @@ include /etc/firejail/unrar.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 hostname unrar
 ignore noroot
 net none
 no3d
+nodbus
 nodvd
 nosound
 notv
diff --git a/etc/unzip.profile b/etc/unzip.profile
index fe16c670d..fddc79260 100644
--- a/etc/unzip.profile
+++ b/etc/unzip.profile
@@ -6,13 +6,13 @@ include /etc/firejail/unzip.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 hostname unzip
 ignore noroot
 net none
 no3d
+nodbus
 nodvd
 nosound
 notv
diff --git a/etc/uudeview.profile b/etc/uudeview.profile
index f7699552d..b64ecaa3e 100644
--- a/etc/uudeview.profile
+++ b/etc/uudeview.profile
@@ -6,11 +6,10 @@ include /etc/firejail/uudeview.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 hostname uudeview
 ignore noroot
 net none
+nodbus
 nodvd
 nosound
 notv
diff --git a/etc/viewnior.profile b/etc/viewnior.profile
index 39bf3f7ce..135147266 100644
--- a/etc/viewnior.profile
+++ b/etc/viewnior.profile
@@ -5,7 +5,6 @@ include /etc/firejail/viewnior.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist ${HOME}/.bashrc
 noblacklist ${HOME}/.Steam
@@ -20,6 +19,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/vlc.profile b/etc/vlc.profile
index dad9a9ae1..c8c84b992 100644
--- a/etc/vlc.profile
+++ b/etc/vlc.profile
@@ -5,6 +5,7 @@ include /etc/firejail/vlc.local
 # Persistent global definitions
 include /etc/firejail/globals.local
+noblacklist ${HOME}/.cache/vlc
 noblacklist ${HOME}/.config/vlc
 noblacklist ${HOME}/.local/share/vlc
@@ -18,6 +19,7 @@ include /etc/firejail/whitelist-var-common.inc
 apparmor
 caps.drop all
 netfilter
+# nodbus - problems with KDE
 # nogroups
 nonewprivs
 noroot
diff --git a/etc/x-terminal-emulator.profile b/etc/x-terminal-emulator.profile
index 67707ffb8..ac8f0fe2a 100644
--- a/etc/x-terminal-emulator.profile
+++ b/etc/x-terminal-emulator.profile
@@ -5,12 +5,11 @@ include /etc/firejail/x-terminal-emulator.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 caps.drop all
 ipc-namespace
 net none
 netfilter
+nodbus
 nogroups
 noroot
 protocol unix
diff --git a/etc/xcalc.profile b/etc/xcalc.profile
index 467f96003..8493fe658 100644
--- a/etc/xcalc.profile
+++ b/etc/xcalc.profile
@@ -5,8 +5,6 @@ include /etc/firejail/xcalc.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -18,6 +16,7 @@ caps.drop all
 net none
 netfilter
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/xed.profile b/etc/xed.profile
index e4ab673e8..5d46560b7 100644
--- a/etc/xed.profile
+++ b/etc/xed.profile
@@ -5,8 +5,6 @@ include /etc/firejail/xed.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus - makes settings immutable
 noblacklist ${HOME}/.config/xed
 include /etc/firejail/disable-common.inc
@@ -16,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
+# apparmor - makes settings immutable
 caps.drop all
-# net none - makes settings immutable
 machine-id
+# net none - makes settings immutable
 no3d
+# nodbus - makes settings immutable
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/xpdf.profile b/etc/xpdf.profile
index 7b8042e5c..9eeda4d29 100644
--- a/etc/xpdf.profile
+++ b/etc/xpdf.profile
@@ -5,8 +5,6 @@ include /etc/firejail/xpdf.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 noblacklist ${HOME}/.xpdfrc
 include /etc/firejail/disable-common.inc
@@ -20,6 +18,7 @@ caps.drop all
 machine-id
 net none
 no3d
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/xplayer-audio-preview.profile b/etc/xplayer-audio-preview.profile
new file mode 100644
index 000000000..a422b9989
--- /dev/null
+++ b/etc/xplayer-audio-preview.profile
@@ -0,0 +1,10 @@
+# Firejail profile for xplayer-audio-preview
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/xplayer-audio-preview.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+# Redirect
+include /etc/firejail/xplayer.profile
diff --git a/etc/xplayer-video-thumbnailer b/etc/xplayer-video-thumbnailer
new file mode 100644
index 000000000..1ec5250bf
--- /dev/null
+++ b/etc/xplayer-video-thumbnailer
@@ -0,0 +1,10 @@
+# Firejail profile for xplayer-video-thumbnailer
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/xplayer-video-thumbnailer.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+# Redirect
+include /etc/firejail/xplayer.profile
diff --git a/etc/xplayer.profile b/etc/xplayer.profile
index 8ea361d79..7e475bd58 100644
--- a/etc/xplayer.profile
+++ b/etc/xplayer.profile
@@ -15,8 +15,10 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
+# apparmor - makes settings immutable
 caps.drop all
 netfilter
+# nodbus - makes settings immutable
 nogroups
 nonewprivs
 noroot
diff --git a/etc/xreader-previewer.profile b/etc/xreader-previewer.profile
new file mode 100644
index 000000000..4c42c147c
--- /dev/null
+++ b/etc/xreader-previewer.profile
@@ -0,0 +1,10 @@
+# Firejail profile for xreader-previewer
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/xreader-previewer.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+# Redirect
+include /etc/firejail/xreader.profile
diff --git a/etc/xreader-thumbnailer.profile b/etc/xreader-thumbnailer.profile
new file mode 100644
index 000000000..bc0bcbb67
--- /dev/null
+++ b/etc/xreader-thumbnailer.profile
@@ -0,0 +1,10 @@
+# Firejail profile for xreader-thumbnailer
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/xreader-thumbnailer.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+# Redirect
+include /etc/firejail/xreader.profile
diff --git a/etc/xreader.profile b/etc/xreader.profile
index 00bd1ee2f..1ddfad26f 100644
--- a/etc/xreader.profile
+++ b/etc/xreader.profile
@@ -16,6 +16,7 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
+# apparmor
 caps.drop all
 no3d
 nodvd
diff --git a/etc/xviewer.profile b/etc/xviewer.profile
index 7c4ede111..26f9f0238 100644
--- a/etc/xviewer.profile
+++ b/etc/xviewer.profile
@@ -5,8 +5,6 @@ include /etc/firejail/xviewer.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus - makes settings immutable
 noblacklist ${HOME}/.Steam
 noblacklist ${HOME}/.config/xviewer
 noblacklist ${HOME}/.local/share/Trash
@@ -19,9 +17,11 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/whitelist-var-common.inc
+# apparmor - makes settings immutable
 caps.drop all
 # net none - makes settings immutable
 no3d
+# nodbus - makes settings immutable
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/xzdec.profile b/etc/xzdec.profile
index 1136a6535..5913fd07a 100644
--- a/etc/xzdec.profile
+++ b/etc/xzdec.profile
@@ -6,12 +6,12 @@ include /etc/firejail/xzdec.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 blacklist /tmp/.X11-unix
 ignore noroot
 net none
 no3d
+nodbus
 nodvd
 nosound
 notv
diff --git a/etc/zart.profile b/etc/zart.profile
index e9fd9b3bd..60eb09c71 100644
--- a/etc/zart.profile
+++ b/etc/zart.profile
@@ -5,8 +5,6 @@ include /etc/firejail/zart.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-blacklist /run/user/*/bus
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
@@ -15,6 +13,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 ipc-namespace
 net none
+nodbus
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/zathura.profile b/etc/zathura.profile
index 288abb8ec..3edece779 100644
--- a/etc/zathura.profile
+++ b/etc/zathura.profile
@@ -5,8 +5,6 @@ include /etc/firejail/zathura.local
 # Persistent global definitions
 include /etc/firejail/globals.local
-# blacklist /run/user/*/bus
 noblacklist ${HOME}/.config/zathura
 noblacklist ${HOME}/.local/share/zathura
@@ -17,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 # net none
+# nodbus
 nodvd
 nogroups
 nonewprivs
@@ -31,5 +30,6 @@ private-bin zathura
 private-dev
 private-etc fonts
 private-tmp
 read-only ${HOME}/
 read-write ${HOME}/.local/share/zathura/
diff --git a/gcov.sh b/gcov.sh
index df1fcb51b..ff910cbe0 100755
--- a/gcov.sh
+++ b/gcov.sh
@@ -10,11 +10,18 @@ gcov_init() {
        /usr/lib/firejail/fcopy --help > /dev/null
        /usr/lib/firejail/fldd --help > /dev/null
        firecfg --help > /dev/null
+        /usr/lib/firejail/fnetfilter --help > /dev/null
+        /usr/lib/firejail/fsec-print --help > /dev/null
+        /usr/lib/firejail/fsec-optimize --help > /dev/null
+        /usr/lib/firejail/faudit --help > /dev/null
+        /usr/lib/firejail/fbuilder --help > /dev/null
        sudo chown $USER:$USER `find .`
 }
 generate() {
-        lcov -q --capture -d src/firejail -d src/firemon -d  src/fcopy -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file-new
+        lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder -d  src/fcopy -d  src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file-new
        lcov --add-tracefile gcov-file-old --add-tracefile gcov-file-new  --output-file gcov-file
        rm -fr gcov-dir
        genhtml -q gcov-file --output-directory gcov-dir
@@ -25,7 +32,7 @@ generate() {
 gcov_init
-lcov -q --capture -d src/firejail -d src/firemon -d  src/fcopy -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd  --output-file gcov-file-old
+lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder -d  src/fcopy -d  src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd  --output-file gcov-file-old
 #make test-environment
 #generate
diff --git a/src/common.mk.in b/src/common.mk.in
new file mode 100644
index 000000000..1d4dbe304
--- /dev/null
+++ b/src/common.mk.in
@@ -0,0 +1,37 @@
+# common definitions for all makefiles
+CC=@CC@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+sysconfdir=@sysconfdir@
+VERSION=@PACKAGE_VERSION@
+NAME=@PACKAGE_NAME@
+HAVE_SECCOMP_H=@HAVE_SECCOMP_H@
+HAVE_SECCOMP=@HAVE_SECCOMP@
+HAVE_CHROOT=@HAVE_CHROOT@
+HAVE_BIND=@HAVE_BIND@
+HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
+HAVE_NETWORK=@HAVE_NETWORK@
+HAVE_USERNS=@HAVE_USERNS@
+HAVE_X11=@HAVE_X11@
+HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
+HAVE_WHITELIST=@HAVE_WHITELIST@
+HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
+HAVE_APPARMOR=@HAVE_APPARMOR@
+HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
+HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
+HAVE_GCOV=@HAVE_GCOV@
+HAVE_GIT_INSTALL=@HAVE_GIT_INSTALL@
+H_FILE_LIST       = $(sort $(wildcard *.[h]))
+C_FILE_LIST       = $(sort $(wildcard *.c))
+OBJS = $(C_FILE_LIST:.c=.o)
+BINOBJS =  $(foreach file, $(OBJS), $file)
+CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"'  $(HAVE_GCOV) $(HAVE_GIT_INSTALL) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
+LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
+EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
+EXTRA_CFLAGS +=@EXTRA_CFLAGS@
diff --git a/src/faudit/Makefile.in b/src/faudit/Makefile.in
index a3b505c39..26df0fe51 100644
--- a/src/faudit/Makefile.in
+++ b/src/faudit/Makefile.in
@@ -1,25 +1,14 @@
 all: faudit
-CC=@CC@
+include ../common.mk
-PREFIX=@prefix@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -DPREFIX='"$(PREFIX)"' -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
-LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST)
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 faudit: $(OBJS)
-        $(CC)  $(LDFLAGS) -o $@ $(OBJS)
+        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
-clean:; rm -f *.o faudit
+clean:; rm -f *.o faudit *.gcov *.gcda *.gcno
 distclean: clean
        rm -fr Makefile
diff --git a/src/fbuilder/Makefile.in b/src/fbuilder/Makefile.in
index dd8e2ce6e..7a606c872 100644
--- a/src/fbuilder/Makefile.in
+++ b/src/fbuilder/Makefile.in
@@ -1,40 +1,9 @@
 all: fbuilder
-CC=@CC@
+include ../common.mk
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@libdir@
-sysconfdir=@sysconfdir@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_SECCOMP_H=@HAVE_SECCOMP_H@
-HAVE_SECCOMP=@HAVE_SECCOMP@
-HAVE_CHROOT=@HAVE_CHROOT@
-HAVE_BIND=@HAVE_BIND@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_NETWORK=@HAVE_NETWORK@
-HAVE_USERNS=@HAVE_USERNS@
-HAVE_X11=@HAVE_X11@
-HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
-HAVE_WHITELIST=@HAVE_WHITELIST@
-HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
-HAVE_APPARMOR=@HAVE_APPARMOR@
-HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
-HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-HAVE_GCOV=@HAVE_GCOV@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
-LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 fbuilder: $(OBJS)
        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
diff --git a/src/fcopy/Makefile.in b/src/fcopy/Makefile.in
index ad08f543e..c9e7d87ab 100644
--- a/src/fcopy/Makefile.in
+++ b/src/fcopy/Makefile.in
@@ -1,40 +1,9 @@
 all: fcopy
-CC=@CC@
+include ../common.mk
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@libdir@
-sysconfdir=@sysconfdir@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_SECCOMP_H=@HAVE_SECCOMP_H@
-HAVE_SECCOMP=@HAVE_SECCOMP@
-HAVE_CHROOT=@HAVE_CHROOT@
-HAVE_BIND=@HAVE_BIND@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_NETWORK=@HAVE_NETWORK@
-HAVE_USERNS=@HAVE_USERNS@
-HAVE_X11=@HAVE_X11@
-HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
-HAVE_WHITELIST=@HAVE_WHITELIST@
-HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
-HAVE_APPARMOR=@HAVE_APPARMOR@
-HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
-HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-HAVE_GCOV=@HAVE_GCOV@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
-LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 fcopy: $(OBJS)
        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
diff --git a/src/firecfg/Makefile.in b/src/firecfg/Makefile.in
index 0b2b03275..b6dbb039d 100644
--- a/src/firecfg/Makefile.in
+++ b/src/firecfg/Makefile.in
@@ -1,40 +1,14 @@
 all: firecfg
-CC=@CC@
+include ../common.mk
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@libdir@
-sysconfdir=@sysconfdir@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_SECCOMP_H=@HAVE_SECCOMP_H@
-HAVE_SECCOMP=@HAVE_SECCOMP@
-HAVE_CHROOT=@HAVE_CHROOT@
-HAVE_BIND=@HAVE_BIND@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_NETWORK=@HAVE_NETWORK@
-HAVE_USERNS=@HAVE_USERNS@
-HAVE_X11=@HAVE_X11@
-HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
-HAVE_GCOV=@HAVE_GCOV@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)  -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_SECCOMP) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
-LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/euid_common.h ../include/libnetlink.h ../include/pid.h
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 firecfg: $(OBJS) ../lib/common.o
        $(CC)  $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o $(LIBS) $(EXTRA_LDFLAGS)
-clean:; rm -f *.o firecfg firecfg.1 firecfg.1.gz *.gcov *.gcda *.gcno
+clean:; rm -f *.o firecfg *.gcov *.gcda *.gcno
 distclean: clean
        rm -fr Makefile
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index e29f95886..1f56e2532 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -16,6 +16,7 @@ VirtualBox
 Wire
 Xephyr
 abrowser
+akonadi_control
 akregator
 amarok
 amule
@@ -43,6 +44,7 @@ bibletime
 bitlbee
 bleachbit
 blender
+blender-2.8
 bless
 bluefish
 bnox
@@ -108,6 +110,8 @@ eom
 epiphany
 etr
 evince
+evince-previewer
+evince-thumbnailer
 evolution
 exiftool
 falkon
@@ -130,6 +134,7 @@ freshclam
 frozen-bubble
 gajim
 galculator
+gcloud
 geany
 geary
 gedit
@@ -150,10 +155,12 @@ gnome-clocks
 gnome-contacts
 gnome-documents
 gnome-font-viewer
+gnome-logs
 gnome-maps
 gnome-mplayer
 gnome-music
 gnome-photos
+gnome-recipes
 gnome-twitch
 gnome-weather
 goobox
@@ -258,6 +265,7 @@ musescore
 mutt
 natron
 nautilus
+ncdu
 netsurf
 neverball
 nheko
@@ -348,6 +356,7 @@ telegram
 telegram-desktop
 terasology
 thunderbird
+thunderbird-beta
 tilp
 tor-browser-ar
 tor-browser-en
diff --git a/src/firejail/Makefile.in b/src/firejail/Makefile.in
index 01cb929e2..9bd2f9c22 100644
--- a/src/firejail/Makefile.in
+++ b/src/firejail/Makefile.in
@@ -1,45 +1,14 @@
 all: firejail
-CC=@CC@
+include ../common.mk
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@libdir@
-sysconfdir=@sysconfdir@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_SECCOMP_H=@HAVE_SECCOMP_H@
-HAVE_SECCOMP=@HAVE_SECCOMP@
-HAVE_CHROOT=@HAVE_CHROOT@
-HAVE_BIND=@HAVE_BIND@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_NETWORK=@HAVE_NETWORK@
-HAVE_USERNS=@HAVE_USERNS@
-HAVE_X11=@HAVE_X11@
-HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
-HAVE_WHITELIST=@HAVE_WHITELIST@
-HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
-HAVE_APPARMOR=@HAVE_APPARMOR@
-HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
-HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
-HAVE_GCOV=@HAVE_GCOV@
-HAVE_GIT_INSTALL=@HAVE_GIT_INSTALL@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"'  $(HAVE_GCOV) $(HAVE_GIT_INSTALL) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
-LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/euid_common.h ../include/pid.h ../include/seccomp.h ../include/syscall.h
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 firejail: $(OBJS) ../lib/libnetlink.o ../lib/common.o ../lib/ldd_utils.o
        $(CC)  $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/ldd_utils.o $(LIBS) $(EXTRA_LDFLAGS)
-clean:; rm -f *.o firejail firejail.1 firejail.1.gz *.gcov *.gcda *.gcno
+clean:; rm -f *.o firejail *.gcov *.gcda *.gcno
 distclean: clean
        rm -fr Makefile
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 0d77c199b..20845270e 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -85,6 +85,15 @@ int checkcfg(int val) {
                                else
                                        goto errout;
                        }
+                        // dbus
+                        else if (strncmp(ptr, "dbus ", 5) == 0) {
+                                if (strcmp(ptr + 5, "yes") == 0)
+                                        cfg_val[CFG_DBUS] = 1;
+                                else if (strcmp(ptr + 5, "no") == 0)
+                                        cfg_val[CFG_DBUS] = 0;
+                                else
+                                        goto errout;
+                        }
                        // join
                        else if (strncmp(ptr, "join ", 5) == 0) {
                                if (strcmp(ptr + 5, "yes") == 0)
diff --git a/src/firejail/dbus.c b/src/firejail/dbus.c
new file mode 100644
index 000000000..6c122c6d0
--- /dev/null
+++ b/src/firejail/dbus.c
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2014-2018 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include "firejail.h"
+void dbus_session_disable(void) {
+        if (!checkcfg(CFG_DBUS)) {
+                fwarning("D-Bus handling is disabled in Firejail configuration file\n");
+                return;
+        }
+        char *path;
+        if (asprintf(&path, "/run/user/%d/bus", getuid()) == -1)
+                errExit("asprintf");
+        char *env_var;
+        if (asprintf(&env_var, "DBUS_SESSION_BUS_ADDRESS=unix:path=%s", path) == -1)
+                errExit("asprintf");
+        // set a new environment variable: DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/<UID>/bus
+        if (setenv("DBUS_SESSION_BUS_ADDRESS", env_var, 1) == -1) {
+                fprintf(stderr, "Error: cannot modify DBUS_SESSION_BUS_ADDRESS required by --nodbus\n");
+                exit(1);
+        }
+        // blacklist the path
+        disable_file_or_dir(path);
+        free(path);
+        free(env_var);
+        // look for a possible abstract unix socket
+        // --net=none
+        if (arg_nonetwork)
+                return;
+        // --net=eth0
+        if (any_bridge_configured())
+                return;
+        // --protocol=unix
+#ifdef HAVE_SECCOMP
+        if (cfg.protocol && !strstr(cfg.protocol, "unix"))
+                return;
+#endif
+        fwarning("An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.\n");
+}
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 5af141289..fdb5745cb 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -382,6 +382,7 @@ extern int arg_noprofile;	// use default.profile if none other found/specified
 extern int arg_memory_deny_write_execute;       // block writable and executable memory
 extern int arg_notv;    // --notv
 extern int arg_nodvd;   // --nodvd
+extern int arg_nodbus; // -nodbus
 extern int login_shell;
 extern int parent_to_child_fds[2];
@@ -520,6 +521,8 @@ void create_empty_file_as_root(const char *dir, mode_t mode);
 int set_perms(const char *fname, uid_t uid, gid_t gid, mode_t mode);
 void mkdir_attr(const char *fname, mode_t mode, uid_t uid, gid_t gid);
 unsigned extract_timeout(const char *str);
+void disable_file_or_dir(const char *fname);
+void disable_file_path(const char *path, const char *file);
 // fs_var.c
 void fs_var_log(void);  // mounting /var/log
@@ -741,6 +744,7 @@ enum {
        CFG_XPRA_ATTACH,
        CFG_PRIVATE_LIB,
        CFG_APPARMOR,
+        CFG_DBUS,
        CFG_MAX // this should always be the last entry
 };
 extern char *xephyr_screen;
@@ -800,4 +804,7 @@ void set_name_run_file(pid_t pid);
 void set_x11_run_file(pid_t pid, int display);
 void set_profile_run_file(pid_t pid, const char *fname);
+// dbus.c
+void dbus_session_disable(void);
 #endif
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
index 6eac78d96..152ddf5f7 100644
--- a/src/firejail/fs_dev.c
+++ b/src/firejail/fs_dev.c
@@ -297,26 +297,6 @@ void fs_private_dev(void){
        }
 }
-static void disable_file_or_dir(const char *fname) {
-        if (arg_debug)
-                printf("disable %s\n", fname);
-        struct stat s;
-        if (stat(fname, &s) != -1) {
-                if (is_dir(fname)) {
-                        if (mount(RUN_RO_DIR, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
-                                errExit("disable directory");
-                }
-                else {
-                        if (mount(RUN_RO_FILE, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
-                                errExit("disable file");
-                }
-        }
-        fs_logger2("blacklist", fname);
-}
 void fs_dev_disable_sound(void) {
        unsigned i = 0;
        while (dev[i].dev_fname != NULL) {
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 38db165e8..6dc19abdd 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -120,6 +120,7 @@ int arg_noprofile = 0; // use default.profile if none other found/specified
 int arg_memory_deny_write_execute = 0;          // block writable and executable memory
 int arg_notv = 0;       // --notv
 int arg_nodvd = 0; // --nodvd
+int arg_nodbus = 0; // -nodbus
 int login_shell = 0;
@@ -1111,7 +1112,7 @@ int main(int argc, char **argv) {
                else if (strncmp(argv[i], "--protocol=", 11) == 0) {
                        if (checkcfg(CFG_SECCOMP)) {
                                if (cfg.protocol) {
-                                        fwarning("a protocol list is present, the new list \"%s\" will not be installed\n", argv[i] + 11);
+                                        fwarning("two protocol lists are present, \"%s\" will be installed\n", cfg.protocol);
                                }
                                else {
                                        // store list
@@ -1734,6 +1735,8 @@ int main(int argc, char **argv) {
                        arg_notv = 1;
                else if (strcmp(argv[i], "--nodvd") == 0)
                        arg_nodvd = 1;
+                else if (strcmp(argv[i], "--nodbus") == 0)
+                        arg_nodbus = 1;
                //*************************************
                // network
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 5566b9860..2cb91964a 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -249,6 +249,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                arg_no3d = 1;
                return 0;
        }
+        else if (strcmp(ptr, "nodbus") == 0) {
+                arg_nodbus = 1;
+                return 0;
+        }
        else if (strcmp(ptr, "allow-private-blacklist") == 0) {
                fmessage("--allow-private-blacklist was deprecated\n");
                return 0;
@@ -549,7 +553,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 #ifdef HAVE_SECCOMP
                if (checkcfg(CFG_SECCOMP)) {
                        if (cfg.protocol) {
-                                fwarning("a protocol list is present, the new list \"%s\" will not be installed\n", ptr + 9);
+                                fwarning("two protocol lists are present, \"%s\" will be installed\n", cfg.protocol);
                                return 0;
                        }
diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index ef674fb4a..9109a6865 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -24,52 +24,24 @@
 #include <dirent.h>
 #include <sys/wait.h>
-static void disable_file(const char *path, const char *file) {
-        assert(file);
-        assert(path);
-        struct stat s;
-        char *fname;
-        if (asprintf(&fname, "%s/%s", path, file) == -1)
-                errExit("asprintf");
-        if (stat(fname, &s) == -1)
-                goto doexit;
-        if (arg_debug)
-                printf("Disable%s\n", fname);
-        if (S_ISDIR(s.st_mode)) {
-                if (mount(RUN_RO_DIR, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
-                        errExit("disable file");
-        }
-        else {
-                if (mount(RUN_RO_FILE, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
-                        errExit("disable file");
-        }
-        fs_logger2("blacklist", fname);
-doexit:
-        free(fname);
-}
 // disable pulseaudio socket
 void pulseaudio_disable(void) {
        if (arg_debug)
                printf("disable pulseaudio\n");
        // blacklist user config directory
-        disable_file(cfg.homedir, ".config/pulse");
+        disable_file_path(cfg.homedir, ".config/pulse");
        // blacklist pulseaudio socket in XDG_RUNTIME_DIR
        char *name = getenv("XDG_RUNTIME_DIR");
        if (name)
-                disable_file(name, "pulse/native");
+                disable_file_path(name, "pulse/native");
        // try the default location anyway
        char *path;
        if (asprintf(&path, "/run/user/%d", getuid()) == -1)
                errExit("asprintf");
-        disable_file(path, "pulse/native");
+        disable_file_path(path, "pulse/native");
        free(path);
@@ -87,12 +59,11 @@ void pulseaudio_disable(void) {
        struct dirent *entry;
        while ((entry = readdir(dir))) {
                if (strncmp(entry->d_name, "pulse-", 6) == 0) {
-                        disable_file("/tmp", entry->d_name);
+                        disable_file_path("/tmp", entry->d_name);
                }
        }
        closedir(dir);
 }
diff --git a/src/firejail/run_files.c b/src/firejail/run_files.c
index 57a0e19df..361ad1414 100644
--- a/src/firejail/run_files.c
+++ b/src/firejail/run_files.c
@@ -20,6 +20,7 @@
 #include "firejail.h"
 #include "../include/pid.h"
+#define BUFLEN 4096
 static void delete_x11_run_file(pid_t pid) {
        char *fname;
@@ -74,7 +75,36 @@ void delete_run_files(pid_t pid) {
        delete_profile_run_file(pid);
 }
+static char *newname(char *name) {
+        char *rv;
+        pid_t pid;
+        // try the name
+        if (name2pid(name, &pid))
+                return name;
+        // try name-1 to 9
+        int i;
+        for (i = 1; i < 10; i++) {
+                if (asprintf(&rv, "%s-%d", name, i) == -1)
+                        errExit("asprintf");
+                if (name2pid(rv, &pid)) {
+                        fwarning("Sandbox name changed to %s\n", rv);
+                        return rv;
+                }
+                free(rv);
+        }
+        // return name-pid
+        if (asprintf(&rv, "%s-%d", name, getpid()) == -1)
+                errExit("asprintf");
+        return rv;
+}
 void set_name_run_file(pid_t pid) {
+        cfg.name = newname(cfg.name);
        char *fname;
        if (asprintf(&fname, "%s/%d", RUN_FIREJAIL_NAME_DIR, pid) == -1)
                errExit("asprintf");
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 96b7b267b..75dbc976d 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -838,6 +838,13 @@ int sandbox(void* sandbox_arg) {
        }
        //****************************
+        // Session D-BUS
+        //****************************
+        if (arg_nodbus)
+                dbus_session_disable();
+        //****************************
        // hosts and hostname
        //****************************
        if (cfg.hostname)
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 15b548d20..d0292f524 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -132,7 +132,9 @@ void usage(void) {
 #endif
        printf("    --nice=value - set nice value.\n");
        printf("    --no3d - disable 3D hardware acceleration.\n");
-        printf("    --noblacklist=filename - disable blacklist for file or directory .\n");
+        printf("    --noblacklist=filename - disable blacklist for file or directory.\n");
+        printf("    --nodbus - disable D-Bus access.\n");
+        printf("    --nodvd - disable DVD and audio CD devices.\n");
        printf("    --noexec=filename - remount the file or directory noexec nosuid and nodev.\n");
        printf("    --nogroups - disable supplementary groups.\n");
        printf("    --nonewprivs - sets the NO_NEW_PRIVS prctl.\n");
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 0adca5e33..c644f83a8 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -21,6 +21,7 @@
 #include "firejail.h"
 #include <ftw.h>
 #include <sys/stat.h>
+#include <sys/mount.h>
 #include <fcntl.h>
 #include <syslog.h>
 #include <errno.h>
@@ -964,3 +965,33 @@ unsigned extract_timeout(const char *str) {
        return h * 3600 + m * 60 + s;
 }
+void disable_file_or_dir(const char *fname) {
+        if (arg_debug)
+                printf("blacklist %s\n", fname);
+        struct stat s;
+        if (stat(fname, &s) != -1) {
+                if (is_dir(fname)) {
+                        if (mount(RUN_RO_DIR, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
+                                errExit("disable directory");
+                }
+                else {
+                        if (mount(RUN_RO_FILE, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
+                                errExit("disable file");
+                }
+        }
+        fs_logger2("blacklist", fname);
+}
+void disable_file_path(const char *path, const char *file) {
+        assert(file);
+        assert(path);
+        char *fname;
+        if (asprintf(&fname, "%s/%s", path, file) == -1)
+                errExit("asprintf");
+        disable_file_or_dir(fname);
+        free(fname);
+}
diff --git a/src/firemon/Makefile.in b/src/firemon/Makefile.in
index 326c305d9..d3ffe5d3f 100644
--- a/src/firemon/Makefile.in
+++ b/src/firemon/Makefile.in
@@ -1,26 +1,9 @@
 all: firemon
-CC=@CC@
+include ../common.mk
-prefix=@prefix@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_GCOV=@HAVE_GCOV@
-HAVE_APPARMOR=@HAVE_APPARMOR@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -DPREFIX='"$(prefix)"' $(HAVE_APPARMOR) $(HAVE_GCOV) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
-LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now
-HAVE_GCOV=@HAVE_GCOV@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
 %.o : %.c $(H_FILE_LIST)
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 firemon: $(OBJS) ../lib/common.o ../lib/pid.o
        $(CC)  $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/pid.o $(LIBS) $(EXTRA_LDFLAGS)
diff --git a/src/fldd/Makefile.in b/src/fldd/Makefile.in
index e2bf4b787..5af37cfbd 100644
--- a/src/fldd/Makefile.in
+++ b/src/fldd/Makefile.in
@@ -1,40 +1,9 @@
 all: fldd
-CC=@CC@
+include ../common.mk
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@libdir@
-sysconfdir=@sysconfdir@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_SECCOMP_H=@HAVE_SECCOMP_H@
-HAVE_SECCOMP=@HAVE_SECCOMP@
-HAVE_CHROOT=@HAVE_CHROOT@
-HAVE_BIND=@HAVE_BIND@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_NETWORK=@HAVE_NETWORK@
-HAVE_USERNS=@HAVE_USERNS@
-HAVE_X11=@HAVE_X11@
-HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
-HAVE_WHITELIST=@HAVE_WHITELIST@
-HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
-HAVE_APPARMOR=@HAVE_APPARMOR@
-HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
-HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-HAVE_GCOV=@HAVE_GCOV@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
-LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h ../include/ldd_utils.h
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 fldd: $(OBJS) ../lib/ldd_utils.o
        $(CC)  $(LDFLAGS) -o $@ $(OBJS) ../lib/ldd_utils.o $(LIBS) $(EXTRA_LDFLAGS)
diff --git a/src/fnet/Makefile.in b/src/fnet/Makefile.in
index 3288e6354..06b3981a9 100644
--- a/src/fnet/Makefile.in
+++ b/src/fnet/Makefile.in
@@ -1,40 +1,9 @@
 all: fnet
-CC=@CC@
+include ../common.mk
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@libdir@
-sysconfdir=@sysconfdir@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_SECCOMP_H=@HAVE_SECCOMP_H@
-HAVE_SECCOMP=@HAVE_SECCOMP@
-HAVE_CHROOT=@HAVE_CHROOT@
-HAVE_BIND=@HAVE_BIND@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_NETWORK=@HAVE_NETWORK@
-HAVE_USERNS=@HAVE_USERNS@
-HAVE_X11=@HAVE_X11@
-HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
-HAVE_WHITELIST=@HAVE_WHITELIST@
-HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
-HAVE_APPARMOR=@HAVE_APPARMOR@
-HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
-HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-HAVE_GCOV=@HAVE_GCOV@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
-LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/libnetlink.h
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 fnet: $(OBJS) ../lib/libnetlink.o
        $(CC)  $(LDFLAGS) -o $@ $(OBJS) ../lib/libnetlink.o $(LIBS) $(EXTRA_LDFLAGS)
diff --git a/src/fnetfilter/Makefile.in b/src/fnetfilter/Makefile.in
index 1063737e1..2e263cc2b 100644
--- a/src/fnetfilter/Makefile.in
+++ b/src/fnetfilter/Makefile.in
@@ -1,40 +1,9 @@
 all: fnetfilter
-CC=@CC@
+include ../common.mk
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@libdir@
-sysconfdir=@sysconfdir@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_SECCOMP_H=@HAVE_SECCOMP_H@
-HAVE_SECCOMP=@HAVE_SECCOMP@
-HAVE_CHROOT=@HAVE_CHROOT@
-HAVE_BIND=@HAVE_BIND@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_NETWORK=@HAVE_NETWORK@
-HAVE_USERNS=@HAVE_USERNS@
-HAVE_X11=@HAVE_X11@
-HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
-HAVE_WHITELIST=@HAVE_WHITELIST@
-HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
-HAVE_APPARMOR=@HAVE_APPARMOR@
-HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
-HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-HAVE_GCOV=@HAVE_GCOV@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
-LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 fnetfilter: $(OBJS)
        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
diff --git a/src/fsec-optimize/Makefile.in b/src/fsec-optimize/Makefile.in
index 6ddbfc075..e5e14a6a6 100644
--- a/src/fsec-optimize/Makefile.in
+++ b/src/fsec-optimize/Makefile.in
@@ -1,40 +1,9 @@
 all: fsec-optimize
-CC=@CC@
+include ../common.mk
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@libdir@
-sysconfdir=@sysconfdir@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_SECCOMP_H=@HAVE_SECCOMP_H@
-HAVE_SECCOMP=@HAVE_SECCOMP@
-HAVE_CHROOT=@HAVE_CHROOT@
-HAVE_BIND=@HAVE_BIND@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_NETWORK=@HAVE_NETWORK@
-HAVE_USERNS=@HAVE_USERNS@
-HAVE_X11=@HAVE_X11@
-HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
-HAVE_WHITELIST=@HAVE_WHITELIST@
-HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
-HAVE_APPARMOR=@HAVE_APPARMOR@
-HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
-HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-HAVE_GCOV=@HAVE_GCOV@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
-LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/seccomp.h ../include/syscall.h
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 fsec-optimize: $(OBJS) ../lib/libnetlink.o
        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
diff --git a/src/fsec-print/Makefile.in b/src/fsec-print/Makefile.in
index 5d23382f7..3db4406f4 100644
--- a/src/fsec-print/Makefile.in
+++ b/src/fsec-print/Makefile.in
@@ -1,40 +1,9 @@
 all: fsec-print
-CC=@CC@
+include ../common.mk
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@libdir@
-sysconfdir=@sysconfdir@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_SECCOMP_H=@HAVE_SECCOMP_H@
-HAVE_SECCOMP=@HAVE_SECCOMP@
-HAVE_CHROOT=@HAVE_CHROOT@
-HAVE_BIND=@HAVE_BIND@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_NETWORK=@HAVE_NETWORK@
-HAVE_USERNS=@HAVE_USERNS@
-HAVE_X11=@HAVE_X11@
-HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
-HAVE_WHITELIST=@HAVE_WHITELIST@
-HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
-HAVE_APPARMOR=@HAVE_APPARMOR@
-HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
-HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-HAVE_GCOV=@HAVE_GCOV@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
-LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/seccomp.h ../include/syscall.h
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 fsec-print: $(OBJS) ../lib/libnetlink.o
        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
diff --git a/src/fsec-print/print.c b/src/fsec-print/print.c
index e3b53c44c..faf59aa35 100644
--- a/src/fsec-print/print.c
+++ b/src/fsec-print/print.c
@@ -269,7 +269,7 @@ static void bpf_decode_args(const struct sock_filter *bpf, unsigned int line) {
                                 native_arch = (ARCH_NR == ARCH_64)? 1: 0;
                        }
                        else if (bpf->k == X32_SYSCALL_BIT)
-                                printf("X32_ABI true:%.4x (false %.4x)",
+                                printf("X32_ABI %.4x (false %.4x)",
                                       (line + 1) + bpf->jt,
                                       (line + 1) + bpf->jf);
                        else if (name)
diff --git a/src/fseccomp/Makefile.in b/src/fseccomp/Makefile.in
index df4343d36..2c99096bb 100644
--- a/src/fseccomp/Makefile.in
+++ b/src/fseccomp/Makefile.in
@@ -1,40 +1,9 @@
 all: fseccomp
-CC=@CC@
+include ../common.mk
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@libdir@
-sysconfdir=@sysconfdir@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_SECCOMP_H=@HAVE_SECCOMP_H@
-HAVE_SECCOMP=@HAVE_SECCOMP@
-HAVE_CHROOT=@HAVE_CHROOT@
-HAVE_BIND=@HAVE_BIND@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_NETWORK=@HAVE_NETWORK@
-HAVE_USERNS=@HAVE_USERNS@
-HAVE_X11=@HAVE_X11@
-HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
-HAVE_WHITELIST=@HAVE_WHITELIST@
-HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
-HAVE_APPARMOR=@HAVE_APPARMOR@
-HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
-HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-HAVE_GCOV=@HAVE_GCOV@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
-LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 fseccomp: $(OBJS)
        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
diff --git a/src/ftee/Makefile.in b/src/ftee/Makefile.in
index fd39f0cb7..d3b92362c 100644
--- a/src/ftee/Makefile.in
+++ b/src/ftee/Makefile.in
@@ -1,25 +1,12 @@
 all: ftee
-CC=@CC@
+include ../common.mk
-PREFIX=@prefix@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_GCOV=@HAVE_GCOV@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) -DPREFIX='"$(PREFIX)"' -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
-LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST)
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 ftee: $(OBJS)
-        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(EXTRA_LDFLAGS)
+        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
 clean:; rm -f *.o ftee *.gcov *.gcda *.gcno
diff --git a/src/lib/Makefile.in b/src/lib/Makefile.in
index a49e56ad2..a744b8d80 100644
--- a/src/lib/Makefile.in
+++ b/src/lib/Makefile.in
@@ -1,22 +1,9 @@
-CC=@CC@
+include ../common.mk
-PREFIX=@prefix@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_GCOV=@HAVE_GCOV@
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-H_FILE_LIST       = $(sort $(wildcard *.[h]))
-C_FILE_LIST       = $(sort $(wildcard *.c))
-OBJS = $(C_FILE_LIST:.c=.o)
-BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -DLIBDIR='"$(libdir)"' $(HAVE_GCOV) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIC -Wformat -Wformat-security
-LDFLAGS:=-pic -Wl,-z,relro -Wl,-z,now
 all: $(OBJS)
 %.o : %.c $(H_FILE_LIST)
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 clean:; rm -f $(OBJS) *.gcov *.gcda *.gcno
diff --git a/src/lib/pid.c b/src/lib/pid.c
index f138efc8c..3c804716d 100644
--- a/src/lib/pid.c
+++ b/src/lib/pid.c
@@ -188,10 +188,11 @@ static void print_elem(unsigned index, int nowrap) {
        uid_t uid = pids[index].uid;
        char *cmd = pid_proc_cmdline(index);
        char *user = pid_get_user_name(uid);
-        char *allocated = user;
+        char *user_allocated = user;
        // extract sandbox name - pid == index
        char *sandbox_name = "";
+        char *sandbox_name_allocated = NULL;
        char *fname;
        if (asprintf(&fname, "%s/%d", RUN_FIREJAIL_NAME_DIR, index) == -1)
                errExit("asprintf");
@@ -202,6 +203,7 @@ static void print_elem(unsigned index, int nowrap) {
                        sandbox_name = malloc(s.st_size + 1);
                        if (!sandbox_name)
                                errExit("malloc");
+                        sandbox_name_allocated = sandbox_name;
                        char *rv = fgets(sandbox_name, s.st_size + 1, fp);
                        if (!rv)
                                *sandbox_name = '\0';
@@ -241,8 +243,10 @@ static void print_elem(unsigned index, int nowrap) {
                else
                        printf("%s%u:\n", indent, index);
        }
-        if (allocated)
+        if (user_allocated)
-                free(allocated);
+                free(user_allocated);
+        if (sandbox_name_allocated)
+                free(sandbox_name_allocated);
 }
 // recursivity!!!
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 34e4102f6..f080c8c7b 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1064,6 +1064,17 @@ $ nc dict.org 2628
 220 pan.alephnull.com dictd 1.12.1/rf on Linux 3.14-1-amd64
 .br
 .TP
+\fB\-\-nodbus
+Disable D-Bus access. Only the regular UNIX socket is handled by this command. To
+disable the abstract socket you would need to request a new network namespace using
+\-\-net command. Another option is to remove unix from \-\-protocol set.
+.br
+.br
+Example:
+.br
+$ firejail \-\-nodbus \-\-net=none
+.TP
 \fB\-\-nodvd
 Disable DVD and audio CD devices.
 .br
diff --git a/test/root/firecfg.exp b/test/root/firecfg.exp
index 02f2323a0..656b8e215 100755
--- a/test/root/firecfg.exp
+++ b/test/root/firecfg.exp
@@ -13,7 +13,7 @@ sleep 1
 send --  "firecfg --clean\r"
 expect {
        timeout {puts "TESTING ERROR 0\n";exit}
-        "/usr/local/bin/firefox removed"
+        "less removed"
 }
 sleep 1
@@ -30,11 +30,11 @@ sleep 1
 send --  "firecfg\r"
 expect {
        timeout {puts "TESTING ERROR 3\n";exit}
-        "firefox created"
+        "less created"
 }
 sleep 1
-send -- "file /usr/local/bin/firefox\r"
+send -- "file /usr/local/bin/less\r"
 expect {
        timeout {puts "TESTING ERROR 4\n";exit}
        "symbolic link to /usr/bin/firejail"
@@ -44,7 +44,7 @@ sleep 1
 send -- "firecfg --list\r"
 expect {
        timeout {puts "TESTING ERROR 5\n";exit}
-        "/usr/local/bin/firefox"
+        "/usr/local/bin/less"
 }
 sleep 1
diff --git a/test/root/root.sh b/test/root/root.sh
index 912ae23f0..22b12cf86 100755
--- a/test/root/root.sh
+++ b/test/root/root.sh
@@ -110,13 +110,13 @@ echo "TESTING: firemon events (test/root/firemon-events.exp)"
 #********************************
 # firecfg
 #********************************
-which firefox
+which less
 if [ "$?" -eq 0 ];
 then
        echo "TESTING: firecfg (test/root/firecfg.exp)"
        ./firecfg.exp
 else
-        echo "TESTING SKIP: firecfg, firefox not found"
+        echo "TESTING SKIP: firecfg, less not found"
 fi
 # restore the default config file
diff --git a/test/utils/audit.exp b/test/utils/audit.exp
index c68ee387c..684886af7 100755
--- a/test/utils/audit.exp
+++ b/test/utils/audit.exp
@@ -76,4 +76,24 @@ expect {
 }
 after 100
+# run audit executable without a sandbox
+send -- "faudit\r"
+expect {
+        timeout {puts "TESTING ERROR 13\n";exit}
+        "is not running in a PID namespace"
+}
+expect {
+        timeout {puts "TESTING ERROR 14\n";exit}
+        "BAD: seccomp disabled"
+}
+expect {
+        timeout {puts "TESTING ERROR 15\n";exit}
+        "BAD: the capability map is"
+}
+expect {
+        timeout {puts "TESTING ERROR 16\n";exit}
+        "MAYBE: /dev directory seems to be fully populated"
+}
+after 100
 puts "\nall done\n"
diff --git a/test/utils/build.exp b/test/utils/build.exp
new file mode 100755
index 000000000..de2a9b6ae
--- /dev/null
+++ b/test/utils/build.exp
@@ -0,0 +1,58 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2018 Firejail Authors
+# License GPL v2
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+send -- "firejail --build cat ~/firejail-test-file-7699\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "whitelist ~/firejail-test-file-7699"
+}
+expect {
+        timeout {puts "TESTING ERROR 0.1\n";exit}
+        "include /etc/firejail/whitelist-common.inc"
+}
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "private-tmp"
+}
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "private-dev"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "blacklist /var"
+}
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "private-bin cat,"
+}
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "caps.drop all"
+}
+expect {
+        timeout {puts "TESTING ERROR 6\n";exit}
+        "nonewprivs"
+}
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        "seccomp"
+}
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        "net none"
+}
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "shell none"
+}
+after 100
+puts "all done\n"
diff --git a/test/utils/utils.sh b/test/utils/utils.sh
index 9dd3b67a3..d72cc2269 100755
--- a/test/utils/utils.sh
+++ b/test/utils/utils.sh
@@ -6,6 +6,17 @@
 export MALLOC_CHECK_=3
 export MALLOC_PERTURB_=$(($RANDOM % 255 + 1))
+if [ -f /etc/debian_version ]; then
+        libdir=$(dirname "$(dpkg -L firejail | grep faudit)")
+        export PATH="$PATH:$libdir"
+fi
+export PATH="$PATH:/usr/lib/firejail"
+echo "testing" > ~/firejail-test-file-7699
+echo "TESTING: build (test/utils/build.exp)"
+./build.exp
+rm -f ~/firejail-test-file-7699
 echo "TESTING: audit (test/utils/audit.exp)"
 ./audit.exp