22 files changed, 220 insertions, 32 deletions

diff --git a/README b/README
index f27a80a34..13c324a02 100644
--- a/README
+++ b/README
@@ -43,6 +43,9 @@ hamzadis (https://github.com/hamzadis)
         - added --overlay-named=name and --overlay-path=path    
 Gaman Gabriel (https://github.com/stelariusinfinitek)
         - inox profile
+greigdp (https://github.com/greigdp)
+        - fixed spotify profile
+        - added Slack profile
 Laurent Declercq (https://github.com/nuxwin)
         - fixed test for shell interpreter in chroots
 Franco (nextime) Lanza (https://github.com/nextime)
diff --git a/README.md b/README.md
index 04965a97a..13aeb51b0 100644
--- a/README.md
+++ b/README.md
@@ -57,19 +57,7 @@ TESTING: file
 TESTING: tar
 netblue@debian:~/work/github/firejail/test/sysutils$ TESTING ERROR 3.1
 [...]
-cd test/apps-x11; ./apps-x11.sh | grep TESTING
-TESTING: xterm x11
-netblue@debian:~/work/github/firejail/test/apps-x11$ TESTING ERROR 5.1
-TESTING: firefox x11
-netblue@debian:~/work/github/firejail/test/apps-x11$ TESTING ERROR 5.1
-TESTING: chromium x11
-TESTING: transmission-gtk x11
-netblue@debian:~/work/github/firejail/test/apps-x11$ TESTING ERROR 5.1
-TESTING: icedove x11
-netblue@debian:~/work/github/firejail/test/apps-x11$ TESTING ERROR 5.1
-[...]
 `````
-"firemon --seccomp" and "firemon --caps" are misbehaving at the moment.
 
 ## Deprecated --user
 
@@ -230,5 +218,5 @@ Browsers: Palemoon
 ## New security profiles
 
 Gitter, gThumb, mpv, Franz messenger, LibreOffice, pix, audacity, xz, xzdec, gzip, cpio, less, Atom Beta, Atom, jitsi, eom, uudeview
-tar (gtar), unzip, unrar, file, skypeforlinux, gnome-chess, inox
+tar (gtar), unzip, unrar, file, skypeforlinux, gnome-chess, inox, Slack
 
diff --git a/RELNOTES b/RELNOTES
index 4e2ad9b6c..eec3117ed 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -25,7 +25,8 @@ firejail (0.9.42~rc2) baseline; urgency=low
   * new profiles: Gitter, gThumb, mpv, Franz messenger, LibreOffice
   * new profiles: pix, audacity, xz, xzdec, gzip, cpio, less
   * new profiles: Atom Beta, Atom, jitsi, eom, uudeview
-  * new profiles: tar (gtar), unzip, unrar, file, skypeforlinux, inox
+  * new profiles: tar (gtar), unzip, unrar, file, skypeforlinux,
+  * new profiles: inox, Slack, gnome-chess
  -- netblue30 <netblue30@yahoo.com>  Thu, 21 Jul 2016 08:00:00 -0500
 
 firejail (0.9.40) baseline; urgency=low
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index d18ee0287..ed6ee315b 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -14,6 +14,7 @@ blacklist /etc/xdg/autostart
 blacklist ${HOME}/.kde4/Autostart
 blacklist ${HOME}/.kde4/share/autostart
 blacklist ${HOME}/.kde/Autostart
+blacklist ${HOME}/.kde/share/autostart
 blacklist ${HOME}/.config/plasma-workspace/shutdown
 blacklist ${HOME}/.config/plasma-workspace/env
 blacklist ${HOME}/.config/lxsession/LXDE/autostart
@@ -168,3 +169,5 @@ blacklist ${PATH}/roxterm-config
 blacklist ${PATH}/terminix
 blacklist ${PATH}/urxvtc
 blacklist ${PATH}/urxvtcd
+blacklist ${PATH}/konsole
+blacklist ${PATH}/yakuake
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 140417b01..26d9cf22b 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -78,6 +78,10 @@ blacklist ${HOME}/.TelegramDesktop
 blacklist ${HOME}/.config/Gitter
 blacklist ${HOME}/.config/Franz
 blacklist ${HOME}/.jitsi
+blacklist ${HOME}/.config/Slack
+blacklist ${HOME}/.cache/gajim
+blacklist ${HOME}/.local/share/gajim
+blacklist ${HOME}/.config/gajim
 
 # Games
 blacklist ${HOME}/.hedgewars
diff --git a/etc/gajim.profile b/etc/gajim.profile
new file mode 100644
index 000000000..04902a734
--- /dev/null
+++ b/etc/gajim.profile
@@ -0,0 +1,33 @@
+# Firejail profile for Gajim
+
+mkdir ${HOME}/.cache/gajim
+mkdir ${HOME}/.local/share/gajim
+mkdir ${HOME}/.config/gajim
+mkdir ${HOME}/Downloads
+
+# Allow the local python 2.7 site packages, in case any plugins are using these
+mkdir ${HOME}/.local/lib/python2.7/site-packages/
+whitelist ${HOME}/.local/lib/python2.7/site-packages/
+read-only ${HOME}/.local/lib/python2.7/site-packages/
+
+whitelist ${HOME}/.cache/gajim
+whitelist ${HOME}/.local/share/gajim
+whitelist ${HOME}/.config/gajim
+whitelist ${HOME}/Downloads
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
+
+caps.drop all
+netfilter
+nonewprivs
+nogroups
+noroot
+protocol unix,inet,inet6
+seccomp
+shell none
+
+#private-bin python2.7 gajim
+private-dev
diff --git a/etc/gnome-mplayer.profile b/etc/gnome-mplayer.profile
index 1caea177d..1b0fc9807 100644
--- a/etc/gnome-mplayer.profile
+++ b/etc/gnome-mplayer.profile
@@ -5,10 +5,13 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+nogroups
 nonewprivs
 noroot
 protocol unix,inet,inet6
 seccomp
-
 shell none
+
 private-bin gnome-mplayer
+private-dev
+private-tmp
diff --git a/etc/gpredict.profile b/etc/gpredict.profile
index a8378a66e..353ecceae 100644
--- a/etc/gpredict.profile
+++ b/etc/gpredict.profile
@@ -15,10 +15,11 @@ nonewprivs
 nogroups
 noroot
 nosound
-protocol unix,inet,inet6,netlink
+protocol unix,inet,inet6
 seccomp
 shell none
 tracelog
 
 private-bin gpredict
 private-dev
+private-tmp
diff --git a/etc/gthumb.profile b/etc/gthumb.profile
index 3c02576aa..e043c7229 100644
--- a/etc/gthumb.profile
+++ b/etc/gthumb.profile
@@ -7,8 +7,8 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-nonewprivs
 nogroups
+nonewprivs
 noroot
 nosound
 protocol unix
@@ -19,3 +19,4 @@ tracelog
 private-bin gthumb
 whitelist /tmp/.X11-unix
 private-dev
+private-tmp
diff --git a/etc/hedgewars.profile b/etc/hedgewars.profile
index c5d863bd5..7910b7eb0 100644
--- a/etc/hedgewars.profile
+++ b/etc/hedgewars.profile
@@ -7,12 +7,16 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
+netfilter
+nogroups
 nonewprivs
 noroot
-private-dev
 seccomp
 tracelog
 
+private-dev
+private-tmp
+
 mkdir     ~/.hedgewars
 whitelist ~/.hedgewars
 include /etc/firejail/whitelist-common.inc
diff --git a/etc/hexchat.profile b/etc/hexchat.profile
index 0d7ee6594..0ff64aef5 100644
--- a/etc/hexchat.profile
+++ b/etc/hexchat.profile
@@ -7,9 +7,11 @@ include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 
 caps.drop all
+netfilter
+nogroups
 nonewprivs
 noroot
-netfilter
+nosound
 protocol unix,inet,inet6
 seccomp
 
@@ -18,3 +20,5 @@ whitelist ~/.config/hexchat
 include /etc/firejail/whitelist-common.inc
 
 # private-bin requires perl, python, etc.
+private-dev
+private-tmp
diff --git a/etc/icecat.profile b/etc/icecat.profile
index 25d426ad2..2f8e2df7f 100644
--- a/etc/icecat.profile
+++ b/etc/icecat.profile
@@ -1,2 +1,51 @@
 # Firejail profile for GNU Icecat
-include /etc/firejail/firefox.profile
+
+noblacklist ~/.mozilla
+noblacklist ~/.cache/mozilla
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
+
+caps.drop all
+netfilter
+nonewprivs
+noroot
+protocol unix,inet,inet6,netlink
+seccomp
+tracelog
+
+whitelist ${DOWNLOADS}
+mkdir ~/.mozilla
+whitelist ~/.mozilla
+mkdir ~/.cache/mozilla/icecat
+whitelist ~/.cache/mozilla/icecat
+whitelist ~/dwhelper
+whitelist ~/.zotero
+whitelist ~/.vimperatorrc
+whitelist ~/.vimperator
+whitelist ~/.pentadactylrc
+whitelist ~/.pentadactyl
+whitelist ~/.keysnail.js
+whitelist ~/.config/gnome-mplayer
+whitelist ~/.cache/gnome-mplayer/plugin
+whitelist ~/.pki
+
+# lastpass, keepassx
+whitelist ~/.keepassx
+whitelist ~/.config/keepassx
+whitelist ~/keepassx.kdbx
+whitelist ~/.lastpass
+whitelist ~/.config/lastpass
+
+
+#silverlight
+whitelist ~/.wine-pipelight
+whitelist ~/.wine-pipelight64
+whitelist ~/.config/pipelight-widevine
+whitelist ~/.config/pipelight-silverlight5.1
+
+include /etc/firejail/whitelist-common.inc
+
+# experimental features
+#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse
+
diff --git a/etc/jitsi.profile b/etc/jitsi.profile
index 8baf1ad94..c61158f8b 100644
--- a/etc/jitsi.profile
+++ b/etc/jitsi.profile
@@ -14,3 +14,4 @@ seccomp
 shell none
 tracelog
 
+private-tmp
diff --git a/etc/kmail.profile b/etc/kmail.profile
index 44a53e258..8c8fd18c4 100644
--- a/etc/kmail.profile
+++ b/etc/kmail.profile
@@ -9,7 +9,11 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 netfilter
 nonewprivs
+nogroups
 noroot
 protocol unix,inet,inet6,netlink
 seccomp
 tracelog
+
+private-dev
+private-tmp
diff --git a/etc/konversation.profile b/etc/konversation.profile
index 190061618..e9546fd1b 100644
--- a/etc/konversation.profile
+++ b/etc/konversation.profile
@@ -7,6 +7,9 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+nogroups
 noroot
 seccomp
 protocol unix,inet,inet6
+
+private-tmp
diff --git a/etc/slack.profile b/etc/slack.profile
new file mode 100644
index 000000000..ea7b715f9
--- /dev/null
+++ b/etc/slack.profile
@@ -0,0 +1,27 @@
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+
+mkdir ${HOME}/.config
+mkdir ${HOME}/.config/Slack
+whitelist ${HOME}/.config/Slack
+whitelist ~/Downloads
+
+protocol unix,inet,inet6,netlink
+private-dev
+private-tmp
+private-etc fonts,resolv.conf,ld.so.conf,ld.so.cache,localtime
+name slack
+blacklist /var
+
+include /etc/firejail/whitelist-common.inc
+
+caps.drop all
+seccomp
+netfilter
+nonewprivs
+nogroups
+noroot
+shell none
+private-bin slack
diff --git a/etc/spotify.profile b/etc/spotify.profile
index 6bcb99e0f..73d427db3 100644
--- a/etc/spotify.profile
+++ b/etc/spotify.profile
@@ -27,5 +27,5 @@ protocol unix,inet,inet6,netlink
 seccomp
 shell none
 
-private-bin spotify
+#private-bin spotify
 private-dev
diff --git a/etc/whitelist-common.inc b/etc/whitelist-common.inc
index 2317133c5..abbb4a9fc 100644
--- a/etc/whitelist-common.inc
+++ b/etc/whitelist-common.inc
@@ -20,8 +20,11 @@ whitelist ~/.cache/fontconfig
 # gtk
 whitelist ~/.gtkrc
 whitelist ~/.gtkrc-2.0
+whitelist ~/.config/gtk-2.0
 whitelist ~/.config/gtk-3.0
 whitelist ~/.themes
+whitelist ~/.kde/share/config/gtkrc
+whitelist ~/.kde/share/config/gtkrc-2.0
 
 # dconf
 mkdir ~/.config/dconf
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index 59f0b35e7..fb19a135f 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -106,6 +106,7 @@
 /etc/firejail/server.profile
 /etc/firejail/skype.profile
 /etc/firejail/skypeforlinux.profile
+/etc/firejail/slack.profile
 /etc/firejail/snap.profile
 /etc/firejail/soffice.profile
 /etc/firejail/spotify.profile
diff --git a/src/include/common.h b/src/include/common.h
index cd4b9c874..762a0262a 100644
--- a/src/include/common.h
+++ b/src/include/common.h
@@ -113,4 +113,5 @@ int join_namespace(pid_t pid, char *type);
 int name2pid(const char *name, pid_t *pid);
 char *pid_proc_comm(const pid_t pid);
 char *pid_proc_cmdline(const pid_t pid);
+int pid_proc_cmdline_x11(const pid_t pid);
 #endif
diff --git a/src/lib/common.c b/src/lib/common.c
index 8ea926df1..fe5c62536 100644
--- a/src/lib/common.c
+++ b/src/lib/common.c
@@ -199,3 +199,63 @@ char *pid_proc_cmdline(const pid_t pid) {
         }
         return rv;
 }
+
+// return 1 if firejail --x11 on command line
+int pid_proc_cmdline_x11(const pid_t pid) {
+        // if comm is not firejail return 0
+        char *comm = pid_proc_comm(pid);
+        if (strcmp(comm, "firejail") != 0) {
+                free(comm);
+                return 0;
+        }
+        free(comm);
+
+        // open /proc/pid/cmdline file
+        char *fname;
+        int fd;
+        if (asprintf(&fname, "/proc/%d/cmdline", pid) == -1)
+                return 0;
+        if ((fd = open(fname, O_RDONLY)) < 0) {
+                free(fname);
+                return 0;
+        }
+        free(fname);
+
+        // read file
+        unsigned char buffer[BUFLEN];
+        ssize_t len;
+        if ((len = read(fd, buffer, sizeof(buffer) - 1)) <= 0) {
+                close(fd);
+                return 0;
+        }
+        buffer[len] = '\0';
+        close(fd);
+
+        // skip the first argument
+        int i;
+        for (i = 0; buffer[i] != '\0'; i++);
+
+        // parse remaining command line options
+        while (1) {
+                // extract argument
+                i++;
+                if (i >= len)
+                        break;
+                char *arg = buffer + i;
+
+                // detect the last command line option
+                if (strcmp(arg, "--") == 0)
+                        break;
+                if (strncmp(arg, "--", 2) != 0)
+                        break;
+                        
+                // check x11
+                if (strncmp(arg, "--x11", 5) == 0)
+                        return 1;
+                i += strlen(arg);
+        }
+        return 0;
+}
+
+
+
diff --git a/src/lib/pid.c b/src/lib/pid.c
index d1ade389e..bbb123b81 100644
--- a/src/lib/pid.c
+++ b/src/lib/pid.c
@@ -340,18 +340,12 @@ void pid_read(pid_t mon_pid) {
                                         exit(1);
                                 }
 
-                                if (mon_pid == 0 && strncmp(ptr, "firejail", 8) == 0) {
-                                        pids[pid].level = 1;
+                                if ((strncmp(ptr, "firejail", 8) == 0) && (mon_pid == 0 || mon_pid == pid)) {
+                                        if (pid_proc_cmdline_x11(pid))
+                                                pids[pid].level = -1;
+                                        else
+                                                pids[pid].level = 1;
                                 }
-                                else if (mon_pid == pid && strncmp(ptr, "firejail", 8) == 0) {
-                                        pids[pid].level = 1;
-                                }
-//                              else if (mon_pid == 0 && strncmp(ptr, "lxc-execute", 11) == 0) {
-//                                      pids[pid].level = 1;
-//                              }
-//                              else if (mon_pid == pid && strncmp(ptr, "lxc-execute", 11) == 0) {
-//                                      pids[pid].level = 1;
-//                              }
                                 else
                                         pids[pid].level = -1;
                         }