aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--etc/authenticator.profile10
-rw-r--r--etc/chromium-common.profile2
-rw-r--r--etc/disable-common.inc3
-rw-r--r--etc/disable-programs.inc4
-rw-r--r--etc/electrum.profile2
-rw-r--r--etc/evince.profile2
-rw-r--r--etc/firefox-common.profile2
-rw-r--r--etc/firejail.config9
-rw-r--r--etc/flacsplt.profile6
-rw-r--r--etc/freeoffice-planmaker.profile38
-rw-r--r--etc/freeoffice-presentations.profile38
-rw-r--r--etc/freeoffice-textmaker.profile38
-rw-r--r--etc/gajim.profile2
-rw-r--r--etc/gramps.profile53
-rw-r--r--etc/midori.profile2
-rw-r--r--etc/min.profile2
-rw-r--r--etc/mp3splt.profile48
-rw-r--r--etc/mp3wrap.profile6
-rw-r--r--etc/mpv.profile2
-rw-r--r--etc/newsboat.profile47
-rw-r--r--etc/oggsplt.profile6
-rw-r--r--src/firecfg/firecfg.config9
-rw-r--r--src/firejail/checkcfg.c1
-rw-r--r--src/firejail/firejail.h1
-rw-r--r--src/firejail/profile.c5
-rw-r--r--src/man/firejail-profile.txt2
26 files changed, 323 insertions, 17 deletions
diff --git a/etc/authenticator.profile b/etc/authenticator.profile
index f989ab1ba..5f1c64682 100644
--- a/etc/authenticator.profile
+++ b/etc/authenticator.profile
@@ -6,6 +6,7 @@ include authenticator.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9noblacklist ${HOME}/.cache/Authenticator
9noblacklist ${HOME}/.config/Authenticator 10noblacklist ${HOME}/.config/Authenticator
10 11
11# Allow python (blacklisted by disable-interpreters.inc) 12# Allow python (blacklisted by disable-interpreters.inc)
@@ -25,7 +26,7 @@ include disable-programs.inc
25 26
26# apparmor 27# apparmor
27caps.drop all 28caps.drop all
28net none 29netfilter
29no3d 30no3d
30# nodbus - makes settings immutable 31# nodbus - makes settings immutable
31nodvd 32nodvd
@@ -36,15 +37,14 @@ nosound
36notv 37notv
37nou2f 38nou2f
38# novideo 39# novideo
39protocol unix 40protocol unix,inet,inet6
40seccomp 41seccomp
41shell none 42shell none
42 43
43disable-mnt 44disable-mnt
44# private-bin authenticator 45# private-bin authenticator,python*
45private-cache
46private-dev 46private-dev
47private-etc alternatives,fonts,ld.so.cache 47private-etc alternatives,ca-certificates,fonts,ld.so.cache,ssl
48private-tmp 48private-tmp
49 49
50# memory-deny-write-execute - breaks on Arch 50# memory-deny-write-execute - breaks on Arch
diff --git a/etc/chromium-common.profile b/etc/chromium-common.profile
index 3c7423316..63983d93b 100644
--- a/etc/chromium-common.profile
+++ b/etc/chromium-common.profile
@@ -7,7 +7,7 @@ include chromium-common.local
7#include globals.local 7#include globals.local
8 8
9# noexec ${HOME} breaks DRM binaries. 9# noexec ${HOME} breaks DRM binaries.
10ignore noexec ${HOME} 10?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
11 11
12noblacklist ${HOME}/.pki 12noblacklist ${HOME}/.pki
13noblacklist ${HOME}/.local/share/pki 13noblacklist ${HOME}/.local/share/pki
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index f37626a63..9d7a34bc5 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -247,12 +247,14 @@ read-only ${HOME}/.emacs
247read-only ${HOME}/.emacs.d 247read-only ${HOME}/.emacs.d
248read-only ${HOME}/.exrc 248read-only ${HOME}/.exrc
249read-only ${HOME}/.gvimrc 249read-only ${HOME}/.gvimrc
250read-only ${HOME}/.homesick
250read-only ${HOME}/.iscreenrc 251read-only ${HOME}/.iscreenrc
251read-only ${HOME}/.mailcap 252read-only ${HOME}/.mailcap
252read-only ${HOME}/.msmtprc 253read-only ${HOME}/.msmtprc
253read-only ${HOME}/.mutt/muttrc 254read-only ${HOME}/.mutt/muttrc
254read-only ${HOME}/.muttrc 255read-only ${HOME}/.muttrc
255read-only ${HOME}/.nano 256read-only ${HOME}/.nano
257read-only ${HOME}/.pythonrc.py
256read-only ${HOME}/.reportbugrc 258read-only ${HOME}/.reportbugrc
257read-only ${HOME}/.tmux.conf 259read-only ${HOME}/.tmux.conf
258read-only ${HOME}/.vim 260read-only ${HOME}/.vim
@@ -264,7 +266,6 @@ read-only ${HOME}/_exrc
264read-only ${HOME}/_gvimrc 266read-only ${HOME}/_gvimrc
265read-only ${HOME}/_vimrc 267read-only ${HOME}/_vimrc
266read-only ${HOME}/dotfiles 268read-only ${HOME}/dotfiles
267read-only ${HOME}/.homesick
268 269
269# Make directories commonly found in $PATH read-only 270# Make directories commonly found in $PATH read-only
270read-only ${HOME}/.gem 271read-only ${HOME}/.gem
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 96fd80daf..7e12b97b2 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -5,6 +5,7 @@ include disable-programs.local
5blacklist ${HOME}/Arduino 5blacklist ${HOME}/Arduino
6blacklist ${HOME}/Monero/wallets 6blacklist ${HOME}/Monero/wallets
7blacklist ${HOME}/Nextcloud/Notes 7blacklist ${HOME}/Nextcloud/Notes
8blacklist ${HOME}/SoftMaker
8blacklist ${HOME}/Standard Notes Backups 9blacklist ${HOME}/Standard Notes Backups
9blacklist ${HOME}/wallet.dat 10blacklist ${HOME}/wallet.dat
10blacklist ${HOME}/.*coin 11blacklist ${HOME}/.*coin
@@ -339,6 +340,7 @@ blacklist ${HOME}/.googleearth/Temp/
339blacklist ${HOME}/.googleearth/myplaces.backup.kml 340blacklist ${HOME}/.googleearth/myplaces.backup.kml
340blacklist ${HOME}/.googleearth/myplaces.kml 341blacklist ${HOME}/.googleearth/myplaces.kml
341blacklist ${HOME}/.gradle 342blacklist ${HOME}/.gradle
343blacklist ${HOME}/.gramps
342blacklist ${HOME}/.guayadeque 344blacklist ${HOME}/.guayadeque
343blacklist ${HOME}/.hashcat 345blacklist ${HOME}/.hashcat
344blacklist ${HOME}/.hedgewars 346blacklist ${HOME}/.hedgewars
@@ -549,6 +551,7 @@ blacklist ${HOME}/.multimc5
549blacklist ${HOME}/.nanorc 551blacklist ${HOME}/.nanorc
550blacklist ${HOME}/.netactview 552blacklist ${HOME}/.netactview
551blacklist ${HOME}/.neverball 553blacklist ${HOME}/.neverball
554blacklist ${HOME}/.newsboat
552blacklist ${HOME}/.nv 555blacklist ${HOME}/.nv
553blacklist ${HOME}/.nylas-mail 556blacklist ${HOME}/.nylas-mail
554blacklist ${HOME}/.opencity 557blacklist ${HOME}/.opencity
@@ -625,6 +628,7 @@ blacklist /tmp/ssh-*
625# ${HOME}/.cache directory 628# ${HOME}/.cache directory
626blacklist ${HOME}/.cache/0ad 629blacklist ${HOME}/.cache/0ad
627blacklist ${HOME}/.cache/8pecxstudios 630blacklist ${HOME}/.cache/8pecxstudios
631blacklist ${HOME}/.cache/Authenticator
628blacklist ${HOME}/.cache/Clementine 632blacklist ${HOME}/.cache/Clementine
629blacklist ${HOME}/.cache/Enox 633blacklist ${HOME}/.cache/Enox
630blacklist ${HOME}/.cache/Franz 634blacklist ${HOME}/.cache/Franz
diff --git a/etc/electrum.profile b/etc/electrum.profile
index 88d27e47e..ffa0fb5f6 100644
--- a/etc/electrum.profile
+++ b/etc/electrum.profile
@@ -50,6 +50,6 @@ disable-mnt
50private-bin electrum,python* 50private-bin electrum,python*
51private-cache 51private-cache
52private-dev 52private-dev
53private-etc alternatives,fonts,dconf,ca-certificates,ssl,pki,crypto-policies,machine-id 53private-etc alternatives,fonts,dconf,ca-certificates,ssl,pki,crypto-policies,machine-id,resolv.conf
54private-tmp 54private-tmp
55 55
diff --git a/etc/evince.profile b/etc/evince.profile
index b1f984784..1a429d673 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -43,7 +43,7 @@ private-bin evince,evince-previewer,evince-thumbnailer
43private-cache 43private-cache
44private-dev 44private-dev
45private-etc alternatives,fonts,group,machine-id,passwd 45private-etc alternatives,fonts,group,machine-id,passwd
46private-lib evince,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,gconv 46private-lib evince,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.*,gconv
47private-tmp 47private-tmp
48 48
49# memory-deny-write-execute - might break application (https://github.com/netblue30/firejail/issues/1803) 49# memory-deny-write-execute - might break application (https://github.com/netblue30/firejail/issues/1803)
diff --git a/etc/firefox-common.profile b/etc/firefox-common.profile
index a2a34f33f..080d9e81a 100644
--- a/etc/firefox-common.profile
+++ b/etc/firefox-common.profile
@@ -7,7 +7,7 @@ include firefox-common.local
7#include globals.local 7#include globals.local
8 8
9# noexec ${HOME} breaks DRM binaries. 9# noexec ${HOME} breaks DRM binaries.
10ignore noexec ${HOME} 10?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
11 11
12# Uncomment the following line to allow access to common programs/addons/plugins. 12# Uncomment the following line to allow access to common programs/addons/plugins.
13#include firefox-common-addons.inc 13#include firefox-common-addons.inc
diff --git a/etc/firejail.config b/etc/firejail.config
index b37edf7a5..497d9633e 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -5,9 +5,6 @@
5# Enable AppArmor functionality, default enabled. 5# Enable AppArmor functionality, default enabled.
6# apparmor yes 6# apparmor yes
7 7
8# Disable U2F in browsers, default enabled.
9# browser-disable-u2f yes
10
11# Number of ARP probes sent when assigning an IP address for --net option, 8# Number of ARP probes sent when assigning an IP address for --net option,
12# default 2. This is a partial implementation of RFC 5227. A 0.5 seconds 9# default 2. This is a partial implementation of RFC 5227. A 0.5 seconds
13# timeout is implemented for each probe. Increase this number to 4 if your 10# timeout is implemented for each probe. Increase this number to 4 if your
@@ -18,6 +15,12 @@
18# Enable or disable bind support, default enabled. 15# Enable or disable bind support, default enabled.
19# bind yes 16# bind yes
20 17
18# Allow (DRM) execution in browsers, default disabled.
19# browser-allow-drm no
20
21# Disable U2F in browsers, default enabled.
22# browser-disable-u2f yes
23
21# Enable or disable cgroup support, default enabled. 24# Enable or disable cgroup support, default enabled.
22# cgroup yes 25# cgroup yes
23 26
diff --git a/etc/flacsplt.profile b/etc/flacsplt.profile
new file mode 100644
index 000000000..2efef0f22
--- /dev/null
+++ b/etc/flacsplt.profile
@@ -0,0 +1,6 @@
1# Firejail profile for flacsplt
2# This file is overwritten after every install/update
3include flacsplt.local
4
5# Redirect
6include mp3splt.profile
diff --git a/etc/freeoffice-planmaker.profile b/etc/freeoffice-planmaker.profile
new file mode 100644
index 000000000..8a53c63e3
--- /dev/null
+++ b/etc/freeoffice-planmaker.profile
@@ -0,0 +1,38 @@
1# Firejail profile for freeoffice-planmaker
2# This file is overwritten after every install/update
3# Persistent local customizations
4include freeoffice-planmaker.local
5# Persistent global definitions
6include globals.local
7
8noblacklist ${HOME}/SoftMaker
9
10include disable-common.inc
11include disable-devel.inc
12include disable-exec.inc
13include disable-interpreters.inc
14include disable-passwdmgr.inc
15include disable-programs.inc
16# include disable-xdg.inc
17
18apparmor
19caps.drop all
20ipc-namespace
21netfilter
22no3d
23nodbus
24nodvd
25nogroups
26nonewprivs
27noroot
28notv
29nou2f
30novideo
31protocol unix,inet,inet6
32seccomp
33shell none
34tracelog
35
36private-cache
37private-dev
38private-tmp
diff --git a/etc/freeoffice-presentations.profile b/etc/freeoffice-presentations.profile
new file mode 100644
index 000000000..63be4da7f
--- /dev/null
+++ b/etc/freeoffice-presentations.profile
@@ -0,0 +1,38 @@
1# Firejail profile for freeoffice-presentations
2# This file is overwritten after every install/update
3# Persistent local customizations
4include freeoffice-presentations.local
5# Persistent global definitions
6include globals.local
7
8noblacklist ${HOME}/SoftMaker
9
10include disable-common.inc
11include disable-devel.inc
12include disable-exec.inc
13include disable-interpreters.inc
14include disable-passwdmgr.inc
15include disable-programs.inc
16# include disable-xdg.inc
17
18apparmor
19caps.drop all
20ipc-namespace
21netfilter
22no3d
23nodbus
24nodvd
25nogroups
26nonewprivs
27noroot
28notv
29nou2f
30novideo
31protocol unix,inet,inet6
32seccomp
33shell none
34tracelog
35
36private-cache
37private-dev
38private-tmp
diff --git a/etc/freeoffice-textmaker.profile b/etc/freeoffice-textmaker.profile
new file mode 100644
index 000000000..4bca5a98c
--- /dev/null
+++ b/etc/freeoffice-textmaker.profile
@@ -0,0 +1,38 @@
1# Firejail profile for freeoffice-textmaker
2# This file is overwritten after every install/update
3# Persistent local customizations
4include freeoffice-textmaker.local
5# Persistent global definitions
6include globals.local
7
8noblacklist ${HOME}/SoftMaker
9
10include disable-common.inc
11include disable-devel.inc
12include disable-exec.inc
13include disable-interpreters.inc
14include disable-passwdmgr.inc
15include disable-programs.inc
16# include disable-xdg.inc
17
18apparmor
19caps.drop all
20ipc-namespace
21netfilter
22no3d
23nodbus
24nodvd
25nogroups
26nonewprivs
27noroot
28notv
29nou2f
30novideo
31protocol unix,inet,inet6
32seccomp
33shell none
34tracelog
35
36private-cache
37private-dev
38private-tmp
diff --git a/etc/gajim.profile b/etc/gajim.profile
index 36121c4b9..ee84a0994 100644
--- a/etc/gajim.profile
+++ b/etc/gajim.profile
@@ -42,7 +42,7 @@ nonewprivs
42noroot 42noroot
43notv 43notv
44nou2f 44nou2f
45protocol unix,inet,inet6 45protocol unix,inet,inet6,netlink
46seccomp 46seccomp
47shell none 47shell none
48tracelog 48tracelog
diff --git a/etc/gramps.profile b/etc/gramps.profile
new file mode 100644
index 000000000..764c14b60
--- /dev/null
+++ b/etc/gramps.profile
@@ -0,0 +1,53 @@
1# Firejail profile for gramps
2# Description: genealogy program
3# This file is overwritten after every install/update
4# Persistent local customizations
5include gramps.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.gramps
10
11# Allow python (blacklisted by disable-interpreters.inc)
12#noblacklist ${PATH}/python2*
13noblacklist ${PATH}/python3*
14#noblacklist /usr/lib/python2*
15noblacklist /usr/lib/python3*
16#noblacklist /usr/local/lib/python2*
17noblacklist /usr/local/lib/python3*
18
19include disable-common.inc
20include disable-devel.inc
21include disable-exec.inc
22include disable-interpreters.inc
23include disable-passwdmgr.inc
24include disable-programs.inc
25include disable-xdg.inc
26
27mkdir ${HOME}/.gramps
28whitelist ${HOME}/.gramps
29include whitelist-common.inc
30include whitelist-var-common.inc
31
32apparmor
33caps.drop all
34ipc-namespace
35netfilter
36no3d
37nodbus
38nodvd
39nogroups
40nonewprivs
41noroot
42nosound
43notv
44nou2f
45novideo
46protocol unix,inet,inet6
47seccomp
48shell none
49
50disable-mnt
51private-cache
52private-dev
53private-tmp
diff --git a/etc/midori.profile b/etc/midori.profile
index d59a6a16b..e4d39cd70 100644
--- a/etc/midori.profile
+++ b/etc/midori.profile
@@ -14,7 +14,7 @@ noblacklist ${HOME}/.pki
14noblacklist ${HOME}/.local/share/pki 14noblacklist ${HOME}/.local/share/pki
15 15
16# noexec ${HOME} breaks DRM binaries. 16# noexec ${HOME} breaks DRM binaries.
17ignore noexec ${HOME} 17?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
18 18
19include disable-common.inc 19include disable-common.inc
20include disable-devel.inc 20include disable-devel.inc
diff --git a/etc/min.profile b/etc/min.profile
index eec81677d..c89df0a95 100644
--- a/etc/min.profile
+++ b/etc/min.profile
@@ -12,7 +12,7 @@ noblacklist ${HOME}/.pki
12noblacklist ${HOME}/.local/share/pki 12noblacklist ${HOME}/.local/share/pki
13 13
14# noexec ${HOME} breaks DRM binaries. 14# noexec ${HOME} breaks DRM binaries.
15ignore noexec ${HOME} 15?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
16 16
17include disable-common.inc 17include disable-common.inc
18include disable-devel.inc 18include disable-devel.inc
diff --git a/etc/mp3splt.profile b/etc/mp3splt.profile
new file mode 100644
index 000000000..6cf6f0409
--- /dev/null
+++ b/etc/mp3splt.profile
@@ -0,0 +1,48 @@
1# Firejail profile for mp3splt
2# Description: utility for mp3 splitting without decoding
3# This file is overwritten after every install/update
4# Persistent local customizations
5include mp3splt.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${MUSIC}
10
11include disable-common.inc
12include disable-devel.inc
13include disable-exec.inc
14include disable-interpreters.inc
15include disable-passwdmgr.inc
16include disable-programs.inc
17include disable-xdg.inc
18
19include whitelist-var-common.inc
20
21apparmor
22caps.drop all
23ipc-namespace
24machine-id
25net none
26no3d
27nodbus
28nodvd
29nogroups
30nonewprivs
31noroot
32nosound
33notv
34nou2f
35novideo
36protocol unix
37seccomp
38shell none
39tracelog
40
41disable-mnt
42private-bin flacsplt,mp3splt,mp3wrap,oggsplt
43private-cache
44private-dev
45private-etc alternatives
46private-tmp
47
48memory-deny-write-execute
diff --git a/etc/mp3wrap.profile b/etc/mp3wrap.profile
new file mode 100644
index 000000000..2e7d97f72
--- /dev/null
+++ b/etc/mp3wrap.profile
@@ -0,0 +1,6 @@
1# Firejail profile for mp3wrap
2# This file is overwritten after every install/update
3include mp3wrap.local
4
5# Redirect
6include mp3splt.profile
diff --git a/etc/mpv.profile b/etc/mpv.profile
index c2ae9c6f9..34542b11b 100644
--- a/etc/mpv.profile
+++ b/etc/mpv.profile
@@ -1,6 +1,7 @@
1# Firejail profile for mpv 1# Firejail profile for mpv
2# Description: Video player based on MPlayer/mplayer2 2# Description: Video player based on MPlayer/mplayer2
3# This file is overwritten after every install/update 3# This file is overwritten after every install/update
4quiet
4# Persistent local customizations 5# Persistent local customizations
5include mpv.local 6include mpv.local
6# Persistent global definitions 7# Persistent global definitions
@@ -44,4 +45,5 @@ shell none
44tracelog 45tracelog
45 46
46private-bin mpv,youtube-dl,python*,env 47private-bin mpv,youtube-dl,python*,env
48private-cache
47private-dev 49private-dev
diff --git a/etc/newsboat.profile b/etc/newsboat.profile
new file mode 100644
index 000000000..e063abe53
--- /dev/null
+++ b/etc/newsboat.profile
@@ -0,0 +1,47 @@
1# Firejail profile for Newsboat
2# Description: RSS program
3# This file is overwritten after every install/update
4# Persistent local customizations
5include newsboat.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.newsboat
10
11include disable-common.inc
12include disable-devel.inc
13include disable-exec.inc
14include disable-interpreters.inc
15include disable-passwdmgr.inc
16include disable-programs.inc
17include disable-xdg.inc
18
19mkdir ${HOME}/.newsboat
20whitelist ${HOME}/.newsboat
21include whitelist-common.inc
22include whitelist-var-common.inc
23
24caps.drop all
25ipc-namespace
26netfilter
27no3d
28nodbus
29nodvd
30nogroups
31nonewprivs
32noroot
33notv
34nou2f
35novideo
36protocol inet,inet6
37seccomp
38shell none
39
40disable-mnt
41private-bin newsboat
42private-cache
43private-dev
44private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl,terminfo
45private-tmp
46
47memory-deny-write-execute
diff --git a/etc/oggsplt.profile b/etc/oggsplt.profile
new file mode 100644
index 000000000..456412c30
--- /dev/null
+++ b/etc/oggsplt.profile
@@ -0,0 +1,6 @@
1# Firejail profile for oggsplt
2# This file is overwritten after every install/update
3include oggsplt.local
4
5# Redirect
6include mp3splt.profile
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 097d03235..9f5f7a7a8 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -186,6 +186,7 @@ firefox-esr
186firefox-nightly 186firefox-nightly
187firefox-wayland 187firefox-wayland
188flameshot 188flameshot
189flacsplt
189flashpeak-slimjet 190flashpeak-slimjet
190flowblade 191flowblade
191font-manager 192font-manager
@@ -199,6 +200,9 @@ freeciv-gtk3
199freeciv-mp-gtk3 200freeciv-mp-gtk3
200freecol 201freecol
201freemind 202freemind
203freeoffice-planmaker
204freeoffice-presentations
205freeoffice-textmaker
202freshclam 206freshclam
203frozen-bubble 207frozen-bubble
204gajim 208gajim
@@ -255,6 +259,7 @@ gpa
255gpicview 259gpicview
256gpredict 260gpredict
257gradio 261gradio
262gramps
258gthumb 263gthumb
259guayadeque 264guayadeque
260gucharmap 265gucharmap
@@ -358,6 +363,8 @@ midori
358min 363min
359minetest 364minetest
360mousepad 365mousepad
366mp3splt
367mp3wrap
361mpDris2 368mpDris2
362mplayer 369mplayer
363mpsyt 370mpsyt
@@ -384,6 +391,7 @@ netactview
384nethack 391nethack
385netsurf 392netsurf
386neverball 393neverball
394newsboat
387nheko 395nheko
388nitroshare 396nitroshare
389nitroshare-cli 397nitroshare-cli
@@ -396,6 +404,7 @@ nyx
396obs 404obs
397ocenaudio 405ocenaudio
398odt2txt 406odt2txt
407oggsplt
399okular 408okular
400onionshare-gui 409onionshare-gui
401open-invaders 410open-invaders
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 54f6ea023..7ca72bf30 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -111,6 +111,7 @@ int checkcfg(int val) {
111 PARSE_YESNO(CFG_DISABLE_MNT, "disable-mnt") 111 PARSE_YESNO(CFG_DISABLE_MNT, "disable-mnt")
112 PARSE_YESNO(CFG_XPRA_ATTACH, "xpra-attach") 112 PARSE_YESNO(CFG_XPRA_ATTACH, "xpra-attach")
113 PARSE_YESNO(CFG_BROWSER_DISABLE_U2F, "browser-disable-u2f") 113 PARSE_YESNO(CFG_BROWSER_DISABLE_U2F, "browser-disable-u2f")
114 PARSE_YESNO(CFG_BROWSER_ALLOW_DRM, "browser-allow-drm")
114#undef PARSE_YESNO 115#undef PARSE_YESNO
115 116
116 // netfilter 117 // netfilter
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index b2c18d79f..2e04084e3 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -702,6 +702,7 @@ enum {
702 CFG_ARP_PROBES, 702 CFG_ARP_PROBES,
703 CFG_XPRA_ATTACH, 703 CFG_XPRA_ATTACH,
704 CFG_BROWSER_DISABLE_U2F, 704 CFG_BROWSER_DISABLE_U2F,
705 CFG_BROWSER_ALLOW_DRM,
705 CFG_PRIVATE_LIB, 706 CFG_PRIVATE_LIB,
706 CFG_APPARMOR, 707 CFG_APPARMOR,
707 CFG_DBUS, 708 CFG_DBUS,
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 667b03652..c8619f7e2 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -151,10 +151,15 @@ static int check_disable_u2f(void) {
151 return checkcfg(CFG_BROWSER_DISABLE_U2F) != 0; 151 return checkcfg(CFG_BROWSER_DISABLE_U2F) != 0;
152} 152}
153 153
154static int check_allow_drm(void) {
155 return checkcfg(CFG_BROWSER_ALLOW_DRM) != 0;
156}
157
154Cond conditionals[] = { 158Cond conditionals[] = {
155 {"HAS_APPIMAGE", check_appimage}, 159 {"HAS_APPIMAGE", check_appimage},
156 {"HAS_NODBUS", check_nodbus}, 160 {"HAS_NODBUS", check_nodbus},
157 {"BROWSER_DISABLE_U2F", check_disable_u2f}, 161 {"BROWSER_DISABLE_U2F", check_disable_u2f},
162 {"BROWSER_ALLOW_DRM", check_allow_drm},
158 { NULL, NULL } 163 { NULL, NULL }
159}; 164};
160 165
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index dde815d05..20b547355 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -94,7 +94,7 @@ Example: "?HAS_APPIMAGE: whitelist ${HOME}/special/appimage/dir"
94 94
95This example will load the whitelist profile line only if the \-\-appimage option has been specified on the command line. 95This example will load the whitelist profile line only if the \-\-appimage option has been specified on the command line.
96 96
97Currently the only conditionals supported are HAS_APPIMAGE, HAS_NODBUS and BROWSER_DISABLE_U2F. 97Currently the only conditionals supported are HAS_APPIMAGE, HAS_NODBUS, BROWSER_DISABLE_U2F, and BROWSER_ALLOW_DRM.
98 98
99The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines. 99The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines.
100 100
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-08-28 11:27:10 +0000