aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--etc/authenticator.profile10
-rw-r--r--etc/disable-common.inc3
-rw-r--r--etc/disable-programs.inc4
-rw-r--r--etc/electrum.profile2
-rw-r--r--etc/evince.profile2
-rw-r--r--etc/flacsplt.profile6
-rw-r--r--etc/freeoffice-planmaker.profile38
-rw-r--r--etc/freeoffice-presentations.profile38
-rw-r--r--etc/freeoffice-textmaker.profile38
-rw-r--r--etc/gajim.profile2
-rw-r--r--etc/gramps.profile53
-rw-r--r--etc/mp3splt.profile48
-rw-r--r--etc/mp3wrap.profile6
-rw-r--r--etc/mpv.profile2
-rw-r--r--etc/newsboat.profile47
-rw-r--r--etc/oggsplt.profile6
-rw-r--r--src/firecfg/firecfg.config9
17 files changed, 305 insertions, 9 deletions
diff --git a/etc/authenticator.profile b/etc/authenticator.profile
index f989ab1ba..5f1c64682 100644
--- a/etc/authenticator.profile
+++ b/etc/authenticator.profile
@@ -6,6 +6,7 @@ include authenticator.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9noblacklist ${HOME}/.cache/Authenticator
9noblacklist ${HOME}/.config/Authenticator 10noblacklist ${HOME}/.config/Authenticator
10 11
11# Allow python (blacklisted by disable-interpreters.inc) 12# Allow python (blacklisted by disable-interpreters.inc)
@@ -25,7 +26,7 @@ include disable-programs.inc
25 26
26# apparmor 27# apparmor
27caps.drop all 28caps.drop all
28net none 29netfilter
29no3d 30no3d
30# nodbus - makes settings immutable 31# nodbus - makes settings immutable
31nodvd 32nodvd
@@ -36,15 +37,14 @@ nosound
36notv 37notv
37nou2f 38nou2f
38# novideo 39# novideo
39protocol unix 40protocol unix,inet,inet6
40seccomp 41seccomp
41shell none 42shell none
42 43
43disable-mnt 44disable-mnt
44# private-bin authenticator 45# private-bin authenticator,python*
45private-cache
46private-dev 46private-dev
47private-etc alternatives,fonts,ld.so.cache 47private-etc alternatives,ca-certificates,fonts,ld.so.cache,ssl
48private-tmp 48private-tmp
49 49
50# memory-deny-write-execute - breaks on Arch 50# memory-deny-write-execute - breaks on Arch
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index f37626a63..9d7a34bc5 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -247,12 +247,14 @@ read-only ${HOME}/.emacs
247read-only ${HOME}/.emacs.d 247read-only ${HOME}/.emacs.d
248read-only ${HOME}/.exrc 248read-only ${HOME}/.exrc
249read-only ${HOME}/.gvimrc 249read-only ${HOME}/.gvimrc
250read-only ${HOME}/.homesick
250read-only ${HOME}/.iscreenrc 251read-only ${HOME}/.iscreenrc
251read-only ${HOME}/.mailcap 252read-only ${HOME}/.mailcap
252read-only ${HOME}/.msmtprc 253read-only ${HOME}/.msmtprc
253read-only ${HOME}/.mutt/muttrc 254read-only ${HOME}/.mutt/muttrc
254read-only ${HOME}/.muttrc 255read-only ${HOME}/.muttrc
255read-only ${HOME}/.nano 256read-only ${HOME}/.nano
257read-only ${HOME}/.pythonrc.py
256read-only ${HOME}/.reportbugrc 258read-only ${HOME}/.reportbugrc
257read-only ${HOME}/.tmux.conf 259read-only ${HOME}/.tmux.conf
258read-only ${HOME}/.vim 260read-only ${HOME}/.vim
@@ -264,7 +266,6 @@ read-only ${HOME}/_exrc
264read-only ${HOME}/_gvimrc 266read-only ${HOME}/_gvimrc
265read-only ${HOME}/_vimrc 267read-only ${HOME}/_vimrc
266read-only ${HOME}/dotfiles 268read-only ${HOME}/dotfiles
267read-only ${HOME}/.homesick
268 269
269# Make directories commonly found in $PATH read-only 270# Make directories commonly found in $PATH read-only
270read-only ${HOME}/.gem 271read-only ${HOME}/.gem
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 96fd80daf..7e12b97b2 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -5,6 +5,7 @@ include disable-programs.local
5blacklist ${HOME}/Arduino 5blacklist ${HOME}/Arduino
6blacklist ${HOME}/Monero/wallets 6blacklist ${HOME}/Monero/wallets
7blacklist ${HOME}/Nextcloud/Notes 7blacklist ${HOME}/Nextcloud/Notes
8blacklist ${HOME}/SoftMaker
8blacklist ${HOME}/Standard Notes Backups 9blacklist ${HOME}/Standard Notes Backups
9blacklist ${HOME}/wallet.dat 10blacklist ${HOME}/wallet.dat
10blacklist ${HOME}/.*coin 11blacklist ${HOME}/.*coin
@@ -339,6 +340,7 @@ blacklist ${HOME}/.googleearth/Temp/
339blacklist ${HOME}/.googleearth/myplaces.backup.kml 340blacklist ${HOME}/.googleearth/myplaces.backup.kml
340blacklist ${HOME}/.googleearth/myplaces.kml 341blacklist ${HOME}/.googleearth/myplaces.kml
341blacklist ${HOME}/.gradle 342blacklist ${HOME}/.gradle
343blacklist ${HOME}/.gramps
342blacklist ${HOME}/.guayadeque 344blacklist ${HOME}/.guayadeque
343blacklist ${HOME}/.hashcat 345blacklist ${HOME}/.hashcat
344blacklist ${HOME}/.hedgewars 346blacklist ${HOME}/.hedgewars
@@ -549,6 +551,7 @@ blacklist ${HOME}/.multimc5
549blacklist ${HOME}/.nanorc 551blacklist ${HOME}/.nanorc
550blacklist ${HOME}/.netactview 552blacklist ${HOME}/.netactview
551blacklist ${HOME}/.neverball 553blacklist ${HOME}/.neverball
554blacklist ${HOME}/.newsboat
552blacklist ${HOME}/.nv 555blacklist ${HOME}/.nv
553blacklist ${HOME}/.nylas-mail 556blacklist ${HOME}/.nylas-mail
554blacklist ${HOME}/.opencity 557blacklist ${HOME}/.opencity
@@ -625,6 +628,7 @@ blacklist /tmp/ssh-*
625# ${HOME}/.cache directory 628# ${HOME}/.cache directory
626blacklist ${HOME}/.cache/0ad 629blacklist ${HOME}/.cache/0ad
627blacklist ${HOME}/.cache/8pecxstudios 630blacklist ${HOME}/.cache/8pecxstudios
631blacklist ${HOME}/.cache/Authenticator
628blacklist ${HOME}/.cache/Clementine 632blacklist ${HOME}/.cache/Clementine
629blacklist ${HOME}/.cache/Enox 633blacklist ${HOME}/.cache/Enox
630blacklist ${HOME}/.cache/Franz 634blacklist ${HOME}/.cache/Franz
diff --git a/etc/electrum.profile b/etc/electrum.profile
index 88d27e47e..ffa0fb5f6 100644
--- a/etc/electrum.profile
+++ b/etc/electrum.profile
@@ -50,6 +50,6 @@ disable-mnt
50private-bin electrum,python* 50private-bin electrum,python*
51private-cache 51private-cache
52private-dev 52private-dev
53private-etc alternatives,fonts,dconf,ca-certificates,ssl,pki,crypto-policies,machine-id 53private-etc alternatives,fonts,dconf,ca-certificates,ssl,pki,crypto-policies,machine-id,resolv.conf
54private-tmp 54private-tmp
55 55
diff --git a/etc/evince.profile b/etc/evince.profile
index b1f984784..1a429d673 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -43,7 +43,7 @@ private-bin evince,evince-previewer,evince-thumbnailer
43private-cache 43private-cache
44private-dev 44private-dev
45private-etc alternatives,fonts,group,machine-id,passwd 45private-etc alternatives,fonts,group,machine-id,passwd
46private-lib evince,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,gconv 46private-lib evince,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.*,gconv
47private-tmp 47private-tmp
48 48
49# memory-deny-write-execute - might break application (https://github.com/netblue30/firejail/issues/1803) 49# memory-deny-write-execute - might break application (https://github.com/netblue30/firejail/issues/1803)
diff --git a/etc/flacsplt.profile b/etc/flacsplt.profile
new file mode 100644
index 000000000..2efef0f22
--- /dev/null
+++ b/etc/flacsplt.profile
@@ -0,0 +1,6 @@
1# Firejail profile for flacsplt
2# This file is overwritten after every install/update
3include flacsplt.local
4
5# Redirect
6include mp3splt.profile
diff --git a/etc/freeoffice-planmaker.profile b/etc/freeoffice-planmaker.profile
new file mode 100644
index 000000000..8a53c63e3
--- /dev/null
+++ b/etc/freeoffice-planmaker.profile
@@ -0,0 +1,38 @@
1# Firejail profile for freeoffice-planmaker
2# This file is overwritten after every install/update
3# Persistent local customizations
4include freeoffice-planmaker.local
5# Persistent global definitions
6include globals.local
7
8noblacklist ${HOME}/SoftMaker
9
10include disable-common.inc
11include disable-devel.inc
12include disable-exec.inc
13include disable-interpreters.inc
14include disable-passwdmgr.inc
15include disable-programs.inc
16# include disable-xdg.inc
17
18apparmor
19caps.drop all
20ipc-namespace
21netfilter
22no3d
23nodbus
24nodvd
25nogroups
26nonewprivs
27noroot
28notv
29nou2f
30novideo
31protocol unix,inet,inet6
32seccomp
33shell none
34tracelog
35
36private-cache
37private-dev
38private-tmp
diff --git a/etc/freeoffice-presentations.profile b/etc/freeoffice-presentations.profile
new file mode 100644
index 000000000..63be4da7f
--- /dev/null
+++ b/etc/freeoffice-presentations.profile
@@ -0,0 +1,38 @@
1# Firejail profile for freeoffice-presentations
2# This file is overwritten after every install/update
3# Persistent local customizations
4include freeoffice-presentations.local
5# Persistent global definitions
6include globals.local
7
8noblacklist ${HOME}/SoftMaker
9
10include disable-common.inc
11include disable-devel.inc
12include disable-exec.inc
13include disable-interpreters.inc
14include disable-passwdmgr.inc
15include disable-programs.inc
16# include disable-xdg.inc
17
18apparmor
19caps.drop all
20ipc-namespace
21netfilter
22no3d
23nodbus
24nodvd
25nogroups
26nonewprivs
27noroot
28notv
29nou2f
30novideo
31protocol unix,inet,inet6
32seccomp
33shell none
34tracelog
35
36private-cache
37private-dev
38private-tmp
diff --git a/etc/freeoffice-textmaker.profile b/etc/freeoffice-textmaker.profile
new file mode 100644
index 000000000..4bca5a98c
--- /dev/null
+++ b/etc/freeoffice-textmaker.profile
@@ -0,0 +1,38 @@
1# Firejail profile for freeoffice-textmaker
2# This file is overwritten after every install/update
3# Persistent local customizations
4include freeoffice-textmaker.local
5# Persistent global definitions
6include globals.local
7
8noblacklist ${HOME}/SoftMaker
9
10include disable-common.inc
11include disable-devel.inc
12include disable-exec.inc
13include disable-interpreters.inc
14include disable-passwdmgr.inc
15include disable-programs.inc
16# include disable-xdg.inc
17
18apparmor
19caps.drop all
20ipc-namespace
21netfilter
22no3d
23nodbus
24nodvd
25nogroups
26nonewprivs
27noroot
28notv
29nou2f
30novideo
31protocol unix,inet,inet6
32seccomp
33shell none
34tracelog
35
36private-cache
37private-dev
38private-tmp
diff --git a/etc/gajim.profile b/etc/gajim.profile
index 36121c4b9..ee84a0994 100644
--- a/etc/gajim.profile
+++ b/etc/gajim.profile
@@ -42,7 +42,7 @@ nonewprivs
42noroot 42noroot
43notv 43notv
44nou2f 44nou2f
45protocol unix,inet,inet6 45protocol unix,inet,inet6,netlink
46seccomp 46seccomp
47shell none 47shell none
48tracelog 48tracelog
diff --git a/etc/gramps.profile b/etc/gramps.profile
new file mode 100644
index 000000000..764c14b60
--- /dev/null
+++ b/etc/gramps.profile
@@ -0,0 +1,53 @@
1# Firejail profile for gramps
2# Description: genealogy program
3# This file is overwritten after every install/update
4# Persistent local customizations
5include gramps.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.gramps
10
11# Allow python (blacklisted by disable-interpreters.inc)
12#noblacklist ${PATH}/python2*
13noblacklist ${PATH}/python3*
14#noblacklist /usr/lib/python2*
15noblacklist /usr/lib/python3*
16#noblacklist /usr/local/lib/python2*
17noblacklist /usr/local/lib/python3*
18
19include disable-common.inc
20include disable-devel.inc
21include disable-exec.inc
22include disable-interpreters.inc
23include disable-passwdmgr.inc
24include disable-programs.inc
25include disable-xdg.inc
26
27mkdir ${HOME}/.gramps
28whitelist ${HOME}/.gramps
29include whitelist-common.inc
30include whitelist-var-common.inc
31
32apparmor
33caps.drop all
34ipc-namespace
35netfilter
36no3d
37nodbus
38nodvd
39nogroups
40nonewprivs
41noroot
42nosound
43notv
44nou2f
45novideo
46protocol unix,inet,inet6
47seccomp
48shell none
49
50disable-mnt
51private-cache
52private-dev
53private-tmp
diff --git a/etc/mp3splt.profile b/etc/mp3splt.profile
new file mode 100644
index 000000000..6cf6f0409
--- /dev/null
+++ b/etc/mp3splt.profile
@@ -0,0 +1,48 @@
1# Firejail profile for mp3splt
2# Description: utility for mp3 splitting without decoding
3# This file is overwritten after every install/update
4# Persistent local customizations
5include mp3splt.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${MUSIC}
10
11include disable-common.inc
12include disable-devel.inc
13include disable-exec.inc
14include disable-interpreters.inc
15include disable-passwdmgr.inc
16include disable-programs.inc
17include disable-xdg.inc
18
19include whitelist-var-common.inc
20
21apparmor
22caps.drop all
23ipc-namespace
24machine-id
25net none
26no3d
27nodbus
28nodvd
29nogroups
30nonewprivs
31noroot
32nosound
33notv
34nou2f
35novideo
36protocol unix
37seccomp
38shell none
39tracelog
40
41disable-mnt
42private-bin flacsplt,mp3splt,mp3wrap,oggsplt
43private-cache
44private-dev
45private-etc alternatives
46private-tmp
47
48memory-deny-write-execute
diff --git a/etc/mp3wrap.profile b/etc/mp3wrap.profile
new file mode 100644
index 000000000..2e7d97f72
--- /dev/null
+++ b/etc/mp3wrap.profile
@@ -0,0 +1,6 @@
1# Firejail profile for mp3wrap
2# This file is overwritten after every install/update
3include mp3wrap.local
4
5# Redirect
6include mp3splt.profile
diff --git a/etc/mpv.profile b/etc/mpv.profile
index c2ae9c6f9..34542b11b 100644
--- a/etc/mpv.profile
+++ b/etc/mpv.profile
@@ -1,6 +1,7 @@
1# Firejail profile for mpv 1# Firejail profile for mpv
2# Description: Video player based on MPlayer/mplayer2 2# Description: Video player based on MPlayer/mplayer2
3# This file is overwritten after every install/update 3# This file is overwritten after every install/update
4quiet
4# Persistent local customizations 5# Persistent local customizations
5include mpv.local 6include mpv.local
6# Persistent global definitions 7# Persistent global definitions
@@ -44,4 +45,5 @@ shell none
44tracelog 45tracelog
45 46
46private-bin mpv,youtube-dl,python*,env 47private-bin mpv,youtube-dl,python*,env
48private-cache
47private-dev 49private-dev
diff --git a/etc/newsboat.profile b/etc/newsboat.profile
new file mode 100644
index 000000000..e063abe53
--- /dev/null
+++ b/etc/newsboat.profile
@@ -0,0 +1,47 @@
1# Firejail profile for Newsboat
2# Description: RSS program
3# This file is overwritten after every install/update
4# Persistent local customizations
5include newsboat.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.newsboat
10
11include disable-common.inc
12include disable-devel.inc
13include disable-exec.inc
14include disable-interpreters.inc
15include disable-passwdmgr.inc
16include disable-programs.inc
17include disable-xdg.inc
18
19mkdir ${HOME}/.newsboat
20whitelist ${HOME}/.newsboat
21include whitelist-common.inc
22include whitelist-var-common.inc
23
24caps.drop all
25ipc-namespace
26netfilter
27no3d
28nodbus
29nodvd
30nogroups
31nonewprivs
32noroot
33notv
34nou2f
35novideo
36protocol inet,inet6
37seccomp
38shell none
39
40disable-mnt
41private-bin newsboat
42private-cache
43private-dev
44private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl,terminfo
45private-tmp
46
47memory-deny-write-execute
diff --git a/etc/oggsplt.profile b/etc/oggsplt.profile
new file mode 100644
index 000000000..456412c30
--- /dev/null
+++ b/etc/oggsplt.profile
@@ -0,0 +1,6 @@
1# Firejail profile for oggsplt
2# This file is overwritten after every install/update
3include oggsplt.local
4
5# Redirect
6include mp3splt.profile
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 7aec0f82a..44e8dc571 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -184,6 +184,7 @@ firefox-esr
184firefox-nightly 184firefox-nightly
185firefox-wayland 185firefox-wayland
186flameshot 186flameshot
187flacsplt
187flashpeak-slimjet 188flashpeak-slimjet
188flowblade 189flowblade
189font-manager 190font-manager
@@ -197,6 +198,9 @@ freeciv-gtk3
197freeciv-mp-gtk3 198freeciv-mp-gtk3
198freecol 199freecol
199freemind 200freemind
201freeoffice-planmaker
202freeoffice-presentations
203freeoffice-textmaker
200freshclam 204freshclam
201frozen-bubble 205frozen-bubble
202gajim 206gajim
@@ -253,6 +257,7 @@ gpa
253gpicview 257gpicview
254gpredict 258gpredict
255gradio 259gradio
260gramps
256gthumb 261gthumb
257guayadeque 262guayadeque
258gucharmap 263gucharmap
@@ -356,6 +361,8 @@ midori
356min 361min
357minetest 362minetest
358mousepad 363mousepad
364mp3splt
365mp3wrap
359mpDris2 366mpDris2
360mplayer 367mplayer
361mpsyt 368mpsyt
@@ -382,6 +389,7 @@ netactview
382nethack 389nethack
383netsurf 390netsurf
384neverball 391neverball
392newsboat
385nheko 393nheko
386nitroshare 394nitroshare
387nitroshare-cli 395nitroshare-cli
@@ -394,6 +402,7 @@ nyx
394obs 402obs
395ocenaudio 403ocenaudio
396odt2txt 404odt2txt
405oggsplt
397okular 406okular
398onionshare-gui 407onionshare-gui
399open-invaders 408open-invaders
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-08-28 19:29:23 +0000