aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--etc/dconf-editor.profile47
-rw-r--r--etc/disable-programs.inc4
-rw-r--r--etc/exfalso.profile52
-rw-r--r--etc/font-manager.profile54
-rw-r--r--etc/gconf-editor.profile49
-rw-r--r--etc/subdownloader.profile46
-rw-r--r--src/firecfg/firecfg.config5
7 files changed, 257 insertions, 0 deletions
diff --git a/etc/dconf-editor.profile b/etc/dconf-editor.profile
new file mode 100644
index 000000000..72b4f7a77
--- /dev/null
+++ b/etc/dconf-editor.profile
@@ -0,0 +1,47 @@
1# Firejail profile for dconf-editor
2# Description: dconf configuration editor
3# This file is overwritten after every install/update
4# Persistent local customizations
5include dconf-editor.local
6# Persistent global definitions
7include globals.local
8
9include disable-common.inc
10include disable-devel.inc
11include disable-interpreters.inc
12include disable-passwdmgr.inc
13include disable-programs.inc
14include disable-xdg.inc
15
16include whitelist-common.inc
17
18apparmor
19caps.drop all
20machine-id
21net none
22no3d
23# nodbus - DBUS is needed to commit changes to dconf
24nodvd
25nogroups
26nonewprivs
27noroot
28nosound
29notv
30nou2f
31novideo
32protocol unix
33seccomp
34shell none
35tracelog
36
37disable-mnt
38private-bin dconf-editor
39private-cache
40private-dev
41private-etc alternatives,fonts
42private-lib
43private-tmp
44
45memory-deny-write-execute
46noexec ${HOME}
47noexec /tmp
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index aa1acbb88..0c7a8b020 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -93,6 +93,7 @@ blacklist ${HOME}/.config/Rocket.Chat
93blacklist ${HOME}/.config/Signal 93blacklist ${HOME}/.config/Signal
94blacklist ${HOME}/.config/Slack 94blacklist ${HOME}/.config/Slack
95blacklist ${HOME}/.config/Standard Notes 95blacklist ${HOME}/.config/Standard Notes
96blacklist ${HOME}/.config/SubDownloader
96blacklist ${HOME}/.config/Thunar 97blacklist ${HOME}/.config/Thunar
97blacklist ${HOME}/.config/VirtualBox 98blacklist ${HOME}/.config/VirtualBox
98blacklist ${HOME}/.config/Wire 99blacklist ${HOME}/.config/Wire
@@ -144,8 +145,10 @@ blacklist ${HOME}/.config/evolution
144blacklist ${HOME}/.config/falkon 145blacklist ${HOME}/.config/falkon
145blacklist ${HOME}/.config/filezilla 146blacklist ${HOME}/.config/filezilla
146blacklist ${HOME}/.config/flowblade 147blacklist ${HOME}/.config/flowblade
148blacklist ${HOME}/.config/font-manager
147blacklist ${HOME}/.config/gajim 149blacklist ${HOME}/.config/gajim
148blacklist ${HOME}/.config/galculator 150blacklist ${HOME}/.config/galculator
151blacklist ${HOME}/.config/gconf
149blacklist ${HOME}/.config/geany 152blacklist ${HOME}/.config/geany
150blacklist ${HOME}/.config/gedit 153blacklist ${HOME}/.config/gedit
151blacklist ${HOME}/.config/geeqie 154blacklist ${HOME}/.config/geeqie
@@ -512,6 +515,7 @@ blacklist ${HOME}/.pingus
512blacklist ${HOME}/.purple 515blacklist ${HOME}/.purple
513blacklist ${HOME}/.qemu-launcher 516blacklist ${HOME}/.qemu-launcher
514blacklist ${HOME}/.qmmp 517blacklist ${HOME}/.qmmp
518blacklist ${HOME}/.quodlibet
515blacklist ${HOME}/.redeclipse 519blacklist ${HOME}/.redeclipse
516blacklist ${HOME}/.remmina 520blacklist ${HOME}/.remmina
517blacklist ${HOME}/.repo_.gitconfig.json 521blacklist ${HOME}/.repo_.gitconfig.json
diff --git a/etc/exfalso.profile b/etc/exfalso.profile
new file mode 100644
index 000000000..58fd1b3b2
--- /dev/null
+++ b/etc/exfalso.profile
@@ -0,0 +1,52 @@
1# Firejail profile for exfalso
2# Description: GTK audio tag editor
3# This file is overwritten after every install/update
4# Persistent local customizations
5include exfalso.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.quodlibet
10noblacklist ${MUSIC}
11
12# Allow python (blacklisted by disable-interpreters.inc)
13noblacklist ${PATH}/python2*
14noblacklist ${PATH}/python3*
15noblacklist /usr/lib/python2*
16noblacklist /usr/lib/python3*
17
18include disable-common.inc
19include disable-devel.inc
20include disable-interpreters.inc
21include disable-passwdmgr.inc
22include disable-programs.inc
23include disable-xdg.inc
24
25caps.drop all
26# machine-id breaks audio; it should work fine in setups where sound is not required
27machine-id
28netfilter
29no3d
30nodbus
31nodvd
32nogroups
33nonewprivs
34noroot
35nosound
36notv
37nou2f
38novideo
39protocol unix,inet,inet6
40seccomp
41shell none
42
43private-bin exfalso,python*
44private-cache
45private-dev
46private-etc alternatives,fonts,group,passwd
47private-lib libatk-1.0.so.*,libgdk-3.so.*,libgdk_pixbuf-2.0.so.*,libgirepository-1.0.so.*,libgstreamer-1.0.so.*,libgtk-3.so.*,libgtksourceview-3.0.so.*,libpango-1.0.so.*,libpython*,libreadline.so.*,libsoup-2.4.so.*,libssl.so.1.*,python2*,python3*
48private-tmp
49
50# memory-deny-write-execute - Breaks on Arch
51noexec ${HOME}
52noexec /tmp
diff --git a/etc/font-manager.profile b/etc/font-manager.profile
new file mode 100644
index 000000000..fa5ee6105
--- /dev/null
+++ b/etc/font-manager.profile
@@ -0,0 +1,54 @@
1# Firejail profile for font-manager
2# Description: A simple font management application for GTK desktop environments
3# This file is overwritten after every install/update
4# Persistent local customizations
5include font-manager.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.config/font-manager
10whitelist ${HOME}/.config/font-manager
11
12# Allow python (blacklisted by disable-interpreters.inc)
13noblacklist ${PATH}/python2*
14noblacklist ${PATH}/python3*
15noblacklist /usr/lib/python2*
16noblacklist /usr/lib/python3*
17
18include disable-common.inc
19include disable-devel.inc
20include disable-interpreters.inc
21include disable-passwdmgr.inc
22include disable-programs.inc
23include disable-xdg.inc
24
25mkdir ${HOME}/.cache/font-manager
26whitelist ${HOME}/.cache/font-manager
27include whitelist-common.inc
28
29apparmor
30caps.drop all
31machine-id
32net none
33no3d
34nodvd
35nogroups
36nonewprivs
37noroot
38nosound
39notv
40nou2f
41novideo
42protocol unix
43seccomp
44shell none
45tracelog
46
47disable-mnt
48private-bin font-manager,python*,yelp
49private-dev
50private-tmp
51
52#memory-deny-write-execute - Breaks on Arch
53noexec ${HOME}
54noexec /tmp
diff --git a/etc/gconf-editor.profile b/etc/gconf-editor.profile
new file mode 100644
index 000000000..a5132e937
--- /dev/null
+++ b/etc/gconf-editor.profile
@@ -0,0 +1,49 @@
1# Firejail profile for gconf-editor
2# Description: Graphical gconf registry editor
3# This file is overwritten after every install/update
4# Persistent local customizations
5include gconf-editor.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.config/gconf
10
11include disable-common.inc
12include disable-devel.inc
13include disable-interpreters.inc
14include disable-passwdmgr.inc
15include disable-programs.inc
16include disable-xdg.inc
17
18include whitelist-common.inc
19
20apparmor
21caps.drop all
22machine-id
23net none
24no3d
25# nodbus - DBUS is needed to commit changes to gconf
26nodvd
27nogroups
28nonewprivs
29noroot
30nosound
31notv
32nou2f
33novideo
34protocol unix
35seccomp
36shell none
37tracelog
38
39disable-mnt
40private-bin gconf-editor
41private-cache
42private-dev
43private-etc alternatives,fonts
44private-lib
45private-tmp
46
47memory-deny-write-execute
48noexec ${HOME}
49noexec /tmp
diff --git a/etc/subdownloader.profile b/etc/subdownloader.profile
new file mode 100644
index 000000000..009cf65df
--- /dev/null
+++ b/etc/subdownloader.profile
@@ -0,0 +1,46 @@
1# Firejail profile for subdownloader
2# Description: Automatic download/upload of subtitles using fast hashing
3# This file is overwritten after every install/update
4# Persistent local customizations
5include subdownloader.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.config/SubDownloader
10noblacklist ${VIDEOS}
11
12# Allow python (blacklisted by disable-interpreters.inc)
13noblacklist ${PATH}/python2*
14noblacklist ${PATH}/python3*
15noblacklist /usr/lib/python2*
16noblacklist /usr/lib/python3*
17
18include disable-common.inc
19include disable-devel.inc
20include disable-interpreters.inc
21include disable-passwdmgr.inc
22include disable-programs.inc
23include disable-xdg.inc
24
25apparmor
26caps.drop all
27netfilter
28nodbus
29nodvd
30nogroups
31nonewprivs
32noroot
33notv
34nou2f
35protocol unix,inet,inet6
36seccomp
37shell none
38
39private-cache
40private-dev
41private-etc alternatives,fonts
42private-tmp
43
44# memory-deny-write-execute - Breaks on Arch
45noexec ${HOME}
46noexec /tmp
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 8713aeaa4..be42684d3 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -99,6 +99,7 @@ crow
99cvlc 99cvlc
100cyberfox 100cyberfox
101darktable 101darktable
102dconf-editor
102deadbeef 103deadbeef
103deluge 104deluge
104dex2jar 105dex2jar
@@ -139,6 +140,7 @@ evince
139evince-previewer 140evince-previewer
140evince-thumbnailer 141evince-thumbnailer
141evolution 142evolution
143exfalso
142exiftool 144exiftool
143falkon 145falkon
144fbreader 146fbreader
@@ -155,6 +157,7 @@ firefox-wayland
155flameshot 157flameshot
156flashpeak-slimjet 158flashpeak-slimjet
157flowblade 159flowblade
160font-manager
158fontforge 161fontforge
159franz 162franz
160freecad 163freecad
@@ -164,6 +167,7 @@ frozen-bubble
164gajim 167gajim
165galculator 168galculator
166gcloud 169gcloud
170gconf-editor
167geany 171geany
168geary 172geary
169gedit 173gedit
@@ -412,6 +416,7 @@ steam
412steam-native 416steam-native
413stellarium 417stellarium
414strings 418strings
419subdownloader
415supertux2 420supertux2
416supertuxkart 421supertuxkart
417surf 422surf
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-09 05:01:22 +0000