diff options
78 files changed, 527 insertions, 494 deletions
@@ -195,4 +195,4 @@ Stats: | |||
195 | 195 | ||
196 | ### New profiles: | 196 | ### New profiles: |
197 | 197 | ||
198 | spectacle, chromium-browser-privacy, gtk-straw-viewer, gtk-youtube-viewer, gtk2-youtube-viewer, gtk3-youtube-viewer, straw-viewer, lutris, dolphin-emu, authenticator-rs | 198 | spectacle, chromium-browser-privacy, gtk-straw-viewer, gtk-youtube-viewer, gtk2-youtube-viewer, gtk3-youtube-viewer, straw-viewer, lutris, dolphin-emu, authenticator-rs, servo |
@@ -5,7 +5,7 @@ firejail (0.9.65) baseline; urgency=low | |||
5 | * Setup guide for new users: contrib/firejail-welcome.sh | 5 | * Setup guide for new users: contrib/firejail-welcome.sh |
6 | * new profiles: spectacle, chromium-browser-privacy, gtk-straw-viewer | 6 | * new profiles: spectacle, chromium-browser-privacy, gtk-straw-viewer |
7 | * new profiles: gtk-youtube-viewer, gtk2-youtube-viewer, gtk3-youtube-viewer | 7 | * new profiles: gtk-youtube-viewer, gtk2-youtube-viewer, gtk3-youtube-viewer |
8 | * new profiles: straw-viewer, lutris, dolphin-emu, authenticator-rs | 8 | * new profiles: straw-viewer, lutris, dolphin-emu, authenticator-rs, servo |
9 | 9 | ||
10 | -- netblue30 <netblue30@yahoo.com> Wed, 21 Oct 2020 09:00:00 -0500 | 10 | -- netblue30 <netblue30@yahoo.com> Wed, 21 Oct 2020 09:00:00 -0500 |
11 | 11 | ||
diff --git a/etc/inc/archiver-common.inc b/etc/inc/archiver-common.inc index 2c5e4d8bf..9812e3ebb 100644 --- a/etc/inc/archiver-common.inc +++ b/etc/inc/archiver-common.inc | |||
@@ -6,12 +6,21 @@ include archiver-common.local | |||
6 | 6 | ||
7 | blacklist ${RUNUSER} | 7 | blacklist ${RUNUSER} |
8 | 8 | ||
9 | include disable-common.inc | 9 | # WARNING: |
10 | # Users can (un)restrict file access for **all** archivers by commenting/uncommenting the needed | ||
11 | # include file(s) here or by putting those into archiver-common.local. | ||
12 | # Another option is to do this **per archiver** in the relevant <archiver>.local. | ||
13 | # Just beware that things tend to break when overtightening profiles. For example, because you only | ||
14 | # need to (un)compress files in ${DOWNLOADS}, other applications may need access to ${HOME}/.local/share. | ||
15 | |||
16 | # Uncomment the next line (or put it into your archiver-common.local) if you don't need to compress files in disable-common.inc. | ||
17 | #include disable-common.inc | ||
10 | include disable-devel.inc | 18 | include disable-devel.inc |
11 | include disable-exec.inc | 19 | include disable-exec.inc |
12 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 21 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 22 | # Uncomment the next line (or put it into your archiver-common.local) if you don't need to compress files in disable-programs.inc. |
23 | #include disable-programs.inc | ||
15 | include disable-shell.inc | 24 | include disable-shell.inc |
16 | 25 | ||
17 | apparmor | 26 | apparmor |
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc index 2b56bb5be..d88506d90 100644 --- a/etc/inc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -517,16 +517,19 @@ blacklist /proc/config.gz | |||
517 | blacklist ${PATH}/dig | 517 | blacklist ${PATH}/dig |
518 | blacklist ${PATH}/dlint | 518 | blacklist ${PATH}/dlint |
519 | blacklist ${PATH}/dns2tcp | 519 | blacklist ${PATH}/dns2tcp |
520 | blacklist ${PATH}/dnssec-* | ||
520 | blacklist ${PATH}/dnswalk | 521 | blacklist ${PATH}/dnswalk |
521 | blacklist ${PATH}/drill | 522 | blacklist ${PATH}/drill |
522 | blacklist ${PATH}/host | 523 | blacklist ${PATH}/host |
523 | blacklist ${PATH}/iodine | 524 | blacklist ${PATH}/iodine |
524 | blacklist ${PATH}/kdig | 525 | blacklist ${PATH}/kdig |
526 | blacklist ${PATH}/khost | ||
525 | blacklist ${PATH}/knsupdate | 527 | blacklist ${PATH}/knsupdate |
526 | blacklist ${PATH}/ldns-* | 528 | blacklist ${PATH}/ldns-* |
527 | blacklist ${PATH}/ldnsd | 529 | blacklist ${PATH}/ldnsd |
528 | blacklist ${PATH}/nslookup | 530 | blacklist ${PATH}/nslookup |
529 | blacklist ${PATH}/resolvectl | 531 | blacklist ${PATH}/resolvectl |
532 | blacklist ${PATH}/unbound-host | ||
530 | 533 | ||
531 | # rest of ${RUNUSER} | 534 | # rest of ${RUNUSER} |
532 | blacklist ${RUNUSER}/*.lock | 535 | blacklist ${RUNUSER}/*.lock |
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 59bd28f95..7ab11e620 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -303,11 +303,13 @@ blacklist ${HOME}/.config/mana | |||
303 | blacklist ${HOME}/.config/mate-calc | 303 | blacklist ${HOME}/.config/mate-calc |
304 | blacklist ${HOME}/.config/mate/eom | 304 | blacklist ${HOME}/.config/mate/eom |
305 | blacklist ${HOME}/.config/mate/mate-dictionary | 305 | blacklist ${HOME}/.config/mate/mate-dictionary |
306 | blacklist ${HOME}/.config/matrix-mirage | ||
306 | blacklist ${HOME}/.config/meld | 307 | blacklist ${HOME}/.config/meld |
307 | blacklist ${HOME}/.config/meteo-qt | 308 | blacklist ${HOME}/.config/meteo-qt |
308 | blacklist ${HOME}/.config/menulibre.cfg | 309 | blacklist ${HOME}/.config/menulibre.cfg |
309 | blacklist ${HOME}/.config/mfusion | 310 | blacklist ${HOME}/.config/mfusion |
310 | blacklist ${HOME}/.config/Microsoft | 311 | blacklist ${HOME}/.config/Microsoft |
312 | blacklist ${HOME}/.config/microsoft-edge-dev | ||
311 | blacklist ${HOME}/.config/midori | 313 | blacklist ${HOME}/.config/midori |
312 | blacklist ${HOME}/.config/mirage | 314 | blacklist ${HOME}/.config/mirage |
313 | blacklist ${HOME}/.config/mono | 315 | blacklist ${HOME}/.config/mono |
@@ -554,6 +556,7 @@ blacklist ${HOME}/.kino-history | |||
554 | blacklist ${HOME}/.kinorc | 556 | blacklist ${HOME}/.kinorc |
555 | blacklist ${HOME}/.klatexformula | 557 | blacklist ${HOME}/.klatexformula |
556 | blacklist ${HOME}/.kodi | 558 | blacklist ${HOME}/.kodi |
559 | blacklist ${HOME}/.librewolf | ||
557 | blacklist ${HOME}/.lincity-ng | 560 | blacklist ${HOME}/.lincity-ng |
558 | blacklist ${HOME}/.links | 561 | blacklist ${HOME}/.links |
559 | blacklist ${HOME}/.linphone-history.db | 562 | blacklist ${HOME}/.linphone-history.db |
@@ -589,7 +592,7 @@ blacklist ${HOME}/.local/share/agenda | |||
589 | blacklist ${HOME}/.local/share/apps/korganizer | 592 | blacklist ${HOME}/.local/share/apps/korganizer |
590 | blacklist ${HOME}/.local/share/aspyr-media | 593 | blacklist ${HOME}/.local/share/aspyr-media |
591 | blacklist ${HOME}/.local/share/autokey | 594 | blacklist ${HOME}/.local/share/autokey |
592 | blacklist ${HOME}/.local/share/authenticator-rs | 595 | blacklist ${HOME}/.local/share/authenticator-rs |
593 | blacklist ${HOME}/.local/share/backintime | 596 | blacklist ${HOME}/.local/share/backintime |
594 | blacklist ${HOME}/.local/share/baloo | 597 | blacklist ${HOME}/.local/share/baloo |
595 | blacklist ${HOME}/.local/share/barrier | 598 | blacklist ${HOME}/.local/share/barrier |
@@ -671,6 +674,7 @@ blacklist ${HOME}/.local/share/lugaru | |||
671 | blacklist ${HOME}/.local/share/lutris | 674 | blacklist ${HOME}/.local/share/lutris |
672 | blacklist ${HOME}/.local/share/mana | 675 | blacklist ${HOME}/.local/share/mana |
673 | blacklist ${HOME}/.local/share/maps-places.json | 676 | blacklist ${HOME}/.local/share/maps-places.json |
677 | blacklist ${HOME}/.local/share/matrix-mirage | ||
674 | blacklist ${HOME}/.local/share/meld | 678 | blacklist ${HOME}/.local/share/meld |
675 | blacklist ${HOME}/.local/share/midori | 679 | blacklist ${HOME}/.local/share/midori |
676 | blacklist ${HOME}/.local/share/mirage | 680 | blacklist ${HOME}/.local/share/mirage |
@@ -940,9 +944,12 @@ blacklist ${HOME}/.cache/ksplashqml | |||
940 | blacklist ${HOME}/.cache/kube | 944 | blacklist ${HOME}/.cache/kube |
941 | blacklist ${HOME}/.cache/kwin | 945 | blacklist ${HOME}/.cache/kwin |
942 | blacklist ${HOME}/.cache/libgweather | 946 | blacklist ${HOME}/.cache/libgweather |
947 | blacklist ${HOME}/.cache/librewolf | ||
943 | blacklist ${HOME}/.cache/liferea | 948 | blacklist ${HOME}/.cache/liferea |
944 | blacklist ${HOME}/.cache/lutris | 949 | blacklist ${HOME}/.cache/lutris |
945 | blacklist ${HOME}/.cache/Mendeley Ltd. | 950 | blacklist ${HOME}/.cache/Mendeley Ltd. |
951 | blacklist ${HOME}/.cache/matrix-mirage | ||
952 | blacklist ${HOME}/.cache/microsoft-edge-dev | ||
946 | blacklist ${HOME}/.cache/midori | 953 | blacklist ${HOME}/.cache/midori |
947 | blacklist ${HOME}/.cache/minetest | 954 | blacklist ${HOME}/.cache/minetest |
948 | blacklist ${HOME}/.cache/mirage | 955 | blacklist ${HOME}/.cache/mirage |
@@ -958,7 +965,7 @@ blacklist ${HOME}/.cache/ms-skype-online | |||
958 | blacklist ${HOME}/.cache/ms-word-online | 965 | blacklist ${HOME}/.cache/ms-word-online |
959 | blacklist ${HOME}/.cache/mutt | 966 | blacklist ${HOME}/.cache/mutt |
960 | blacklist ${HOME}/.cache/mypaint | 967 | blacklist ${HOME}/.cache/mypaint |
961 | blacklist ${HOME}/.cache/nheko/nheko | 968 | blacklist ${HOME}/.cache/nheko |
962 | blacklist ${HOME}/.cache/netsurf | 969 | blacklist ${HOME}/.cache/netsurf |
963 | blacklist ${HOME}/.cache/okular | 970 | blacklist ${HOME}/.cache/okular |
964 | blacklist ${HOME}/.cache/opera | 971 | blacklist ${HOME}/.cache/opera |
diff --git a/etc/inc/disable-shell.inc b/etc/inc/disable-shell.inc index e66d23c9f..8274b0215 100644 --- a/etc/inc/disable-shell.inc +++ b/etc/inc/disable-shell.inc | |||
@@ -8,6 +8,7 @@ blacklist ${PATH}/dash | |||
8 | blacklist ${PATH}/fish | 8 | blacklist ${PATH}/fish |
9 | blacklist ${PATH}/ksh | 9 | blacklist ${PATH}/ksh |
10 | blacklist ${PATH}/mksh | 10 | blacklist ${PATH}/mksh |
11 | blacklist ${PATH}/oksh | ||
11 | blacklist ${PATH}/sh | 12 | blacklist ${PATH}/sh |
12 | blacklist ${PATH}/tclsh | 13 | blacklist ${PATH}/tclsh |
13 | blacklist ${PATH}/tcsh | 14 | blacklist ${PATH}/tcsh |
diff --git a/etc/profile-a-l/7z.profile b/etc/profile-a-l/7z.profile index 4f9e72a79..5e1c17b28 100644 --- a/etc/profile-a-l/7z.profile +++ b/etc/profile-a-l/7z.profile | |||
@@ -10,5 +10,3 @@ include globals.local | |||
10 | noblacklist ${PATH}/bash | 10 | noblacklist ${PATH}/bash |
11 | noblacklist ${PATH}/sh | 11 | noblacklist ${PATH}/sh |
12 | include archiver-common.inc | 12 | include archiver-common.inc |
13 | |||
14 | private-bin 7z,7z*,bash,p7zip,sh | ||
diff --git a/etc/profile-a-l/alacarte.profile b/etc/profile-a-l/alacarte.profile index 5fabf8283..98188d2a7 100644 --- a/etc/profile-a-l/alacarte.profile +++ b/etc/profile-a-l/alacarte.profile | |||
@@ -11,7 +11,7 @@ include allow-python3.inc | |||
11 | 11 | ||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
@@ -25,7 +25,7 @@ whitelist /usr/share/icons | |||
25 | whitelist /var/lib/app-info/icons | 25 | whitelist /var/lib/app-info/icons |
26 | whitelist /var/lib/flatpak/exports/share/applications | 26 | whitelist /var/lib/flatpak/exports/share/applications |
27 | whitelist /var/lib/flatpak/exports/share/icons | 27 | whitelist /var/lib/flatpak/exports/share/icons |
28 | include whitelist-runuser-common.inc | 28 | include whitelist-runuser-common.inc |
29 | include whitelist-usr-share-common.inc | 29 | include whitelist-usr-share-common.inc |
30 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
31 | 31 | ||
@@ -49,7 +49,7 @@ shell none | |||
49 | tracelog | 49 | tracelog |
50 | 50 | ||
51 | disable-mnt | 51 | disable-mnt |
52 | private-bin alacarte,bash,python*,sh | 52 | # private-bin alacarte,bash,python*,sh |
53 | private-cache | 53 | private-cache |
54 | private-dev | 54 | private-dev |
55 | private-etc alternatives,dconf,fonts,gtk-3.0,locale.alias,locale.conf,login.defs,mime.types,nsswitch.conf,passwd,pki,X11,xdg | 55 | private-etc alternatives,dconf,fonts,gtk-3.0,locale.alias,locale.conf,login.defs,mime.types,nsswitch.conf,passwd,pki,X11,xdg |
diff --git a/etc/profile-a-l/ar.profile b/etc/profile-a-l/ar.profile index a600eddef..c2b215807 100644 --- a/etc/profile-a-l/ar.profile +++ b/etc/profile-a-l/ar.profile | |||
@@ -8,5 +8,3 @@ include ar.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | include archiver-common.inc | 10 | include archiver-common.inc |
11 | |||
12 | private-bin ar | ||
diff --git a/etc/profile-a-l/atom.profile b/etc/profile-a-l/atom.profile index cf0a5a42b..f21a5febf 100644 --- a/etc/profile-a-l/atom.profile +++ b/etc/profile-a-l/atom.profile | |||
@@ -6,31 +6,27 @@ include atom.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Disabled until someone reported positive feedback | ||
10 | ignore include disable-devel.inc | ||
11 | ignore include disable-interpreters.inc | ||
12 | ignore include disable-xdg.inc | ||
13 | ignore whitelist ${DOWNLOADS} | ||
14 | ignore include whitelist-common.inc | ||
15 | ignore include whitelist-runuser-common.inc | ||
16 | ignore include whitelist-usr-share-common.inc | ||
17 | ignore include whitelist-var-common.inc | ||
18 | ignore apparmor | ||
19 | ignore disable-mnt | ||
20 | |||
9 | noblacklist ${HOME}/.atom | 21 | noblacklist ${HOME}/.atom |
10 | noblacklist ${HOME}/.config/Atom | 22 | noblacklist ${HOME}/.config/Atom |
11 | 23 | ||
12 | # Allows files commonly used by IDEs | 24 | # Allows files commonly used by IDEs |
13 | include allow-common-devel.inc | 25 | include allow-common-devel.inc |
14 | 26 | ||
15 | include disable-common.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | |||
20 | caps.keep sys_admin,sys_chroot | ||
21 | # net none | 27 | # net none |
22 | netfilter | 28 | netfilter |
23 | nodvd | ||
24 | nogroups | ||
25 | nosound | 29 | nosound |
26 | notv | ||
27 | nou2f | ||
28 | novideo | ||
29 | shell none | ||
30 | |||
31 | private-cache | ||
32 | private-dev | ||
33 | private-tmp | ||
34 | 30 | ||
35 | dbus-user none | 31 | # Redirect |
36 | dbus-system none | 32 | include electron.profile |
diff --git a/etc/profile-a-l/authenticator-rs.profile b/etc/profile-a-l/authenticator-rs.profile index 1eb802d9b..fb12018f5 100644 --- a/etc/profile-a-l/authenticator-rs.profile +++ b/etc/profile-a-l/authenticator-rs.profile | |||
@@ -6,7 +6,7 @@ include authenticator-rs.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.local/share/authenticator-rs | 9 | noblacklist ${HOME}/.local/share/authenticator-rs |
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
@@ -18,12 +18,12 @@ include disable-shell.inc | |||
18 | include disable-xdg.inc | 18 | include disable-xdg.inc |
19 | 19 | ||
20 | mkdir ${HOME}/.local/share/authenticator-rs | 20 | mkdir ${HOME}/.local/share/authenticator-rs |
21 | whitelist ${HOME}/.local/share/authenticator-rs | 21 | whitelist ${HOME}/.local/share/authenticator-rs |
22 | whitelist ${DOWNLOADS} | 22 | whitelist ${DOWNLOADS} |
23 | whitelist /usr/share/uk.co.grumlimited.authenticator-rs | 23 | whitelist /usr/share/uk.co.grumlimited.authenticator-rs |
24 | include whitelist-common.inc | 24 | include whitelist-common.inc |
25 | include whitelist-runuser-common.inc | 25 | include whitelist-runuser-common.inc |
26 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
28 | 28 | ||
29 | apparmor | 29 | apparmor |
diff --git a/etc/profile-a-l/balsa.profile b/etc/profile-a-l/balsa.profile index a401ac592..cda6b1aa0 100644 --- a/etc/profile-a-l/balsa.profile +++ b/etc/profile-a-l/balsa.profile | |||
@@ -58,7 +58,7 @@ shell none | |||
58 | tracelog | 58 | tracelog |
59 | 59 | ||
60 | # disable-mnt | 60 | # disable-mnt |
61 | # Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg | 61 | # Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg |
62 | # Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile. | 62 | # Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile. |
63 | private-bin balsa,balsa-ab | 63 | private-bin balsa,balsa-ab |
64 | private-cache | 64 | private-cache |
diff --git a/etc/profile-a-l/beaker.profile b/etc/profile-a-l/beaker.profile index cc1886a49..f3a9568bd 100644 --- a/etc/profile-a-l/beaker.profile +++ b/etc/profile-a-l/beaker.profile | |||
@@ -3,17 +3,26 @@ | |||
3 | # Persistent local customizations | 3 | # Persistent local customizations |
4 | include beaker.local | 4 | include beaker.local |
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | # added by included profile | 6 | include globals.local |
7 | #include globals.local | ||
8 | 7 | ||
9 | noblacklist ${HOME}/.config/Beaker Browser | 8 | # Disabled until someone reported positive feedback |
9 | ignore include disable-exec.inc | ||
10 | ignore include disable-xdg.inc | ||
11 | ignore include whitelist-runuser-common.inc | ||
12 | ignore include whitelist-usr-share-common.inc | ||
13 | ignore include whitelist-var-common.inc | ||
14 | ignore nou2f | ||
15 | ignore novideo | ||
16 | ignore shell none | ||
17 | ignore disable-mnt | ||
18 | ignore private-cache | ||
19 | ignore private-dev | ||
20 | ignore private-tmp | ||
10 | 21 | ||
11 | include disable-devel.inc | 22 | noblacklist ${HOME}/.config/Beaker Browser |
12 | include disable-interpreters.inc | ||
13 | 23 | ||
14 | mkdir ${HOME}/.config/Beaker Browser | 24 | mkdir ${HOME}/.config/Beaker Browser |
15 | whitelist ${HOME}/.config/Beaker Browser | 25 | whitelist ${HOME}/.config/Beaker Browser |
16 | include whitelist-common.inc | ||
17 | 26 | ||
18 | # Redirect | 27 | # Redirect |
19 | include electron.profile | 28 | include electron.profile |
diff --git a/etc/profile-a-l/brave.profile b/etc/profile-a-l/brave.profile index 904d3e94f..5a5e9eacd 100644 --- a/etc/profile-a-l/brave.profile +++ b/etc/profile-a-l/brave.profile | |||
@@ -10,10 +10,6 @@ include globals.local | |||
10 | ignore noexec /tmp | 10 | ignore noexec /tmp |
11 | # TOR is installed in ${HOME} | 11 | # TOR is installed in ${HOME} |
12 | ignore noexec ${HOME} | 12 | ignore noexec ${HOME} |
13 | # Disable for now, see https://github.com/netblue30/firejail/pull/3688#issuecomment-718711565 | ||
14 | ignore whitelist /usr/share/chromium | ||
15 | ignore include whitelist-runuser-common.inc | ||
16 | ignore include whitelist-usr-share-common.inc | ||
17 | 13 | ||
18 | noblacklist ${HOME}/.cache/BraveSoftware | 14 | noblacklist ${HOME}/.cache/BraveSoftware |
19 | noblacklist ${HOME}/.config/BraveSoftware | 15 | noblacklist ${HOME}/.config/BraveSoftware |
diff --git a/etc/profile-a-l/bsdtar.profile b/etc/profile-a-l/bsdtar.profile index f2116f4ab..c37f4071e 100644 --- a/etc/profile-a-l/bsdtar.profile +++ b/etc/profile-a-l/bsdtar.profile | |||
@@ -8,6 +8,4 @@ include globals.local | |||
8 | 8 | ||
9 | include archiver-common.inc | 9 | include archiver-common.inc |
10 | 10 | ||
11 | # support compressed archives | ||
12 | private-bin bash,bsdcat,bsdcpio,bsdtar,bzip2,compress,gtar,gzip,lbzip2,libarchive,lz4,lzip,lzma,lzop,sh,xz | ||
13 | private-etc alternatives,group,localtime,passwd | 11 | private-etc alternatives,group,localtime,passwd |
diff --git a/etc/profile-a-l/chromium-common.profile b/etc/profile-a-l/chromium-common.profile index 6a9cf99b0..ce9c652c6 100644 --- a/etc/profile-a-l/chromium-common.profile +++ b/etc/profile-a-l/chromium-common.profile | |||
@@ -25,7 +25,6 @@ mkdir ${HOME}/.local/share/pki | |||
25 | whitelist ${DOWNLOADS} | 25 | whitelist ${DOWNLOADS} |
26 | whitelist ${HOME}/.pki | 26 | whitelist ${HOME}/.pki |
27 | whitelist ${HOME}/.local/share/pki | 27 | whitelist ${HOME}/.local/share/pki |
28 | whitelist /usr/share/chromium | ||
29 | include whitelist-common.inc | 28 | include whitelist-common.inc |
30 | include whitelist-runuser-common.inc | 29 | include whitelist-runuser-common.inc |
31 | include whitelist-usr-share-common.inc | 30 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-a-l/chromium.profile b/etc/profile-a-l/chromium.profile index dab9ce449..14f1bbe64 100644 --- a/etc/profile-a-l/chromium.profile +++ b/etc/profile-a-l/chromium.profile | |||
@@ -15,6 +15,7 @@ mkdir ${HOME}/.config/chromium | |||
15 | whitelist ${HOME}/.cache/chromium | 15 | whitelist ${HOME}/.cache/chromium |
16 | whitelist ${HOME}/.config/chromium | 16 | whitelist ${HOME}/.config/chromium |
17 | whitelist ${HOME}/.config/chromium-flags.conf | 17 | whitelist ${HOME}/.config/chromium-flags.conf |
18 | whitelist /usr/share/chromium | ||
18 | 19 | ||
19 | # private-bin chromium,chromium-browser,chromedriver | 20 | # private-bin chromium,chromium-browser,chromedriver |
20 | 21 | ||
diff --git a/etc/profile-a-l/discord-common.profile b/etc/profile-a-l/discord-common.profile index 35bea4aaa..e6edbd7eb 100644 --- a/etc/profile-a-l/discord-common.profile +++ b/etc/profile-a-l/discord-common.profile | |||
@@ -6,33 +6,24 @@ include discord-common.local | |||
6 | # added by caller profile | 6 | # added by caller profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | ignore noexec ${HOME} | 9 | # Disabled until someone reported positive feedback |
10 | ignore include disable-interpreters.inc | ||
11 | ignore include disable-xdg.inc | ||
12 | ignore include whitelist-runuser-common.inc | ||
13 | ignore include whitelist-usr-share-common.inc | ||
14 | ignore apparmor | ||
15 | ignore disable-mnt | ||
16 | ignore private-cache | ||
17 | ignore dbus-user none | ||
18 | ignore dbus-system none | ||
10 | 19 | ||
11 | include disable-common.inc | 20 | ignore noexec ${HOME} |
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | ||
16 | 21 | ||
17 | whitelist ${DOWNLOADS} | ||
18 | whitelist ${HOME}/.config/BetterDiscord | 22 | whitelist ${HOME}/.config/BetterDiscord |
19 | whitelist ${HOME}/.local/share/betterdiscordctl | 23 | whitelist ${HOME}/.local/share/betterdiscordctl |
20 | include whitelist-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | caps.drop all | ||
24 | netfilter | ||
25 | nodvd | ||
26 | nogroups | ||
27 | nonewprivs | ||
28 | noroot | ||
29 | notv | ||
30 | nou2f | ||
31 | novideo | ||
32 | protocol unix,inet,inet6,netlink | ||
33 | seccomp !chroot | ||
34 | 24 | ||
35 | private-bin bash,cut,echo,egrep,fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh | 25 | private-bin bash,cut,echo,egrep,fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh |
36 | private-dev | ||
37 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,resolv.conf,ssl | 26 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,resolv.conf,ssl |
38 | private-tmp | 27 | |
28 | # Redirect | ||
29 | include electron.profile | ||
diff --git a/etc/profile-a-l/electron.profile b/etc/profile-a-l/electron.profile index 9b99c7ffb..d3be07c9d 100644 --- a/etc/profile-a-l/electron.profile +++ b/etc/profile-a-l/electron.profile | |||
@@ -3,25 +3,39 @@ | |||
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include electron.local | 5 | include electron.local |
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | 6 | ||
9 | include disable-common.inc | 7 | include disable-common.inc |
8 | include disable-devel.inc | ||
9 | include disable-exec.inc | ||
10 | include disable-interpreters.inc | ||
10 | include disable-passwdmgr.inc | 11 | include disable-passwdmgr.inc |
11 | include disable-programs.inc | 12 | include disable-programs.inc |
13 | include disable-xdg.inc | ||
12 | 14 | ||
13 | whitelist ${DOWNLOADS} | 15 | whitelist ${DOWNLOADS} |
16 | include whitelist-common.inc | ||
17 | include whitelist-runuser-common.inc | ||
18 | include whitelist-usr-share-common.inc | ||
19 | include whitelist-var-common.inc | ||
20 | |||
21 | # Uncomment the next line (or add it to your chromium-common.local) | ||
22 | # if your kernel allows unprivileged userns clone. | ||
23 | #include chromium-common-hardened.inc | ||
14 | 24 | ||
15 | apparmor | 25 | apparmor |
16 | caps.drop all | 26 | caps.keep sys_admin,sys_chroot |
17 | netfilter | 27 | netfilter |
18 | nodvd | 28 | nodvd |
19 | nogroups | 29 | nogroups |
20 | nonewprivs | ||
21 | noroot | ||
22 | notv | 30 | notv |
23 | protocol unix,inet,inet6,netlink | 31 | nou2f |
24 | seccomp | 32 | novideo |
33 | shell none | ||
34 | |||
35 | disable-mnt | ||
36 | private-cache | ||
37 | private-dev | ||
38 | private-tmp | ||
25 | 39 | ||
26 | dbus-user none | 40 | dbus-user none |
27 | dbus-system none | 41 | dbus-system none |
diff --git a/etc/profile-a-l/element-desktop.profile b/etc/profile-a-l/element-desktop.profile index 2d56369cd..48a826f2e 100644 --- a/etc/profile-a-l/element-desktop.profile +++ b/etc/profile-a-l/element-desktop.profile | |||
@@ -7,6 +7,8 @@ include element-desktop.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | ignore dbus-user none | ||
11 | |||
10 | noblacklist ${HOME}/.config/Element | 12 | noblacklist ${HOME}/.config/Element |
11 | 13 | ||
12 | mkdir ${HOME}/.config/Element | 14 | mkdir ${HOME}/.config/Element |
@@ -15,5 +17,8 @@ whitelist /opt/Element | |||
15 | 17 | ||
16 | private-opt Element | 18 | private-opt Element |
17 | 19 | ||
20 | dbus-user filter | ||
21 | dbus-user.talk org.freedesktop.secrets | ||
22 | |||
18 | # Redirect | 23 | # Redirect |
19 | include riot-desktop.profile | 24 | include riot-desktop.profile |
diff --git a/etc/profile-a-l/feh.profile b/etc/profile-a-l/feh.profile index 3ee07e559..8ac7755de 100644 --- a/etc/profile-a-l/feh.profile +++ b/etc/profile-a-l/feh.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for feh | 1 | # Firejail profile for feh |
2 | # Description: imlib2 based image viewer | 2 | # Description: imlib2 based image viewer |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include feh.local | 6 | include feh.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
diff --git a/etc/profile-a-l/fractal.profile b/etc/profile-a-l/fractal.profile index ab907eb0d..c3af29e15 100644 --- a/etc/profile-a-l/fractal.profile +++ b/etc/profile-a-l/fractal.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for fractal | 1 | # Firejail profile for fractal |
2 | # Description: Desktop client for Matrix | 2 | # Description: Desktop client for Matrix |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include fractal.local | 5 | include fractal.local |
@@ -21,7 +21,7 @@ mkdir ${HOME}/.cache/fractal | |||
21 | whitelist ${HOME}/.cache/fractal | 21 | whitelist ${HOME}/.cache/fractal |
22 | whitelist ${DOWNLOADS} | 22 | whitelist ${DOWNLOADS} |
23 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | 24 | include whitelist-runuser-common.inc |
25 | include whitelist-usr-share-common.inc | 25 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
27 | 27 | ||
diff --git a/etc/profile-a-l/freetube.profile b/etc/profile-a-l/freetube.profile index 91f0caf87..e6aff533d 100644 --- a/etc/profile-a-l/freetube.profile +++ b/etc/profile-a-l/freetube.profile | |||
@@ -8,24 +8,13 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.config/FreeTube | 9 | noblacklist ${HOME}/.config/FreeTube |
10 | 10 | ||
11 | include disable-devel.inc | 11 | include disable-shell.inc |
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-shell.inc | ||
15 | include disable-xdg.inc | ||
16 | 12 | ||
17 | mkdir ${HOME}/.config/FreeTube | 13 | mkdir ${HOME}/.config/FreeTube |
18 | whitelist ${HOME}/.config/FreeTube | 14 | whitelist ${HOME}/.config/FreeTube |
19 | 15 | ||
20 | seccomp !chroot | ||
21 | shell none | ||
22 | |||
23 | disable-mnt | ||
24 | private-bin freetube | 16 | private-bin freetube |
25 | private-cache | ||
26 | private-dev | ||
27 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg | 17 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg |
28 | private-tmp | ||
29 | 18 | ||
30 | # Redirect | 19 | # Redirect |
31 | include electron.profile | 20 | include electron.profile |
diff --git a/etc/profile-a-l/github-desktop.profile b/etc/profile-a-l/github-desktop.profile index 152396553..325c54ced 100644 --- a/etc/profile-a-l/github-desktop.profile +++ b/etc/profile-a-l/github-desktop.profile | |||
@@ -6,43 +6,35 @@ include github-desktop.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Note: On debian-based distributions the binary might be located in | ||
10 | # /opt/GitHub Desktop/github-desktop, and therefore not be in PATH. | ||
11 | # If that's the case you can start GitHub Desktop with firejail via | ||
12 | # `firejail "/opt/GitHub Desktop/github-desktop"`. | ||
13 | |||
14 | # Disabled until someone reported positive feedback | ||
15 | ignore include disable-xdg.inc | ||
16 | ignore whitelist ${DOWNLOADS} | ||
17 | ignore include whitelist-common.inc | ||
18 | ignore include whitelist-runuser-common.inc | ||
19 | ignore include whitelist-usr-share-common.inc | ||
20 | ignore include whitelist-var-common.inc | ||
21 | ignore apparmor | ||
22 | ignore dbus-user none | ||
23 | ignore dbus-system none | ||
24 | |||
9 | noblacklist ${HOME}/.config/GitHub Desktop | 25 | noblacklist ${HOME}/.config/GitHub Desktop |
10 | noblacklist ${HOME}/.config/git | 26 | noblacklist ${HOME}/.config/git |
11 | noblacklist ${HOME}/.gitconfig | 27 | noblacklist ${HOME}/.gitconfig |
12 | noblacklist ${HOME}/.git-credentials | 28 | noblacklist ${HOME}/.git-credentials |
13 | 29 | ||
14 | include disable-common.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-devel.inc | ||
18 | include disable-exec.inc | ||
19 | include disable-interpreters.inc | ||
20 | |||
21 | caps.drop all | ||
22 | netfilter | ||
23 | # no3d | 30 | # no3d |
24 | nodvd | ||
25 | nogroups | ||
26 | nonewprivs | ||
27 | noroot | ||
28 | nosound | 31 | nosound |
29 | notv | ||
30 | nou2f | ||
31 | novideo | ||
32 | protocol unix,inet,inet6,netlink | ||
33 | seccomp !chroot | ||
34 | 32 | ||
35 | # Note: On debian-based distributions the binary might be located in | ||
36 | # /opt/GitHub Desktop/github-desktop, and therefore not be in PATH. | ||
37 | # If that's the case you can start GitHub Desktop with firejail via | ||
38 | # `firejail "/opt/GitHub Desktop/github-desktop"`. | ||
39 | |||
40 | disable-mnt | ||
41 | # private-bin github-desktop | 33 | # private-bin github-desktop |
42 | private-cache | ||
43 | ?HAS_APPIMAGE: ignore private-dev | 34 | ?HAS_APPIMAGE: ignore private-dev |
44 | private-dev | ||
45 | # private-lib | 35 | # private-lib |
46 | private-tmp | ||
47 | 36 | ||
48 | # memory-deny-write-execute | 37 | # memory-deny-write-execute |
38 | |||
39 | # Redirect | ||
40 | include electron.profile | ||
diff --git a/etc/profile-a-l/homebank.profile b/etc/profile-a-l/homebank.profile index 8e600a2d7..da32de640 100644 --- a/etc/profile-a-l/homebank.profile +++ b/etc/profile-a-l/homebank.profile | |||
@@ -10,7 +10,7 @@ noblacklist ${HOME}/.config/homebank | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
diff --git a/etc/profile-a-l/jitsi-meet-desktop.profile b/etc/profile-a-l/jitsi-meet-desktop.profile index c4121d835..e5beb741a 100644 --- a/etc/profile-a-l/jitsi-meet-desktop.profile +++ b/etc/profile-a-l/jitsi-meet-desktop.profile | |||
@@ -6,34 +6,22 @@ include jitsi-meet-desktop.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Disabled until someone reported positive feedback | ||
10 | ignore nou2f | ||
11 | ignore novideo | ||
12 | ignore shell none | ||
13 | |||
9 | ignore noexec /tmp | 14 | ignore noexec /tmp |
10 | 15 | ||
11 | noblacklist ${HOME}/.config/Jitsi Meet | 16 | noblacklist ${HOME}/.config/Jitsi Meet |
12 | 17 | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | nowhitelist ${DOWNLOADS} | 18 | nowhitelist ${DOWNLOADS} |
19 | 19 | ||
20 | mkdir ${HOME}/.config/Jitsi Meet | 20 | mkdir ${HOME}/.config/Jitsi Meet |
21 | |||
22 | whitelist ${HOME}/.config/Jitsi Meet | 21 | whitelist ${HOME}/.config/Jitsi Meet |
23 | 22 | ||
24 | include whitelist-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | seccomp !chroot | ||
30 | |||
31 | disable-mnt | ||
32 | private-bin bash,jitsi-meet-desktop | 23 | private-bin bash,jitsi-meet-desktop |
33 | private-cache | ||
34 | private-dev | ||
35 | private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,drirc,fonts,glvnd,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,nvidia,pango,passwd,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg | 24 | private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,drirc,fonts,glvnd,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,nvidia,pango,passwd,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg |
36 | private-tmp | ||
37 | 25 | ||
38 | # Redirect | 26 | # Redirect |
39 | include electron.profile | 27 | include electron.profile |
diff --git a/etc/profile-a-l/kazam.profile b/etc/profile-a-l/kazam.profile index 9899ff195..9c095e106 100644 --- a/etc/profile-a-l/kazam.profile +++ b/etc/profile-a-l/kazam.profile | |||
@@ -12,12 +12,12 @@ noblacklist ${PICTURES} | |||
12 | noblacklist ${VIDEOS} | 12 | noblacklist ${VIDEOS} |
13 | noblacklist ${HOME}/.config/kazam | 13 | noblacklist ${HOME}/.config/kazam |
14 | 14 | ||
15 | include allow-python2.inc | 15 | include allow-python2.inc |
16 | include allow-python3.inc | 16 | include allow-python3.inc |
17 | 17 | ||
18 | include disable-common.inc | 18 | include disable-common.inc |
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-passwdmgr.inc | 23 | include disable-passwdmgr.inc |
@@ -25,7 +25,7 @@ include disable-shell.inc | |||
25 | include disable-xdg.inc | 25 | include disable-xdg.inc |
26 | 26 | ||
27 | whitelist /usr/share/kazam | 27 | whitelist /usr/share/kazam |
28 | include whitelist-runuser-common.inc | 28 | include whitelist-runuser-common.inc |
29 | include whitelist-usr-share-common.inc | 29 | include whitelist-usr-share-common.inc |
30 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
31 | 31 | ||
diff --git a/etc/profile-a-l/keepassxc.profile b/etc/profile-a-l/keepassxc.profile index 58db056b2..456f1820d 100644 --- a/etc/profile-a-l/keepassxc.profile +++ b/etc/profile-a-l/keepassxc.profile | |||
@@ -73,12 +73,11 @@ dbus-user.talk org.freedesktop.login1.Session | |||
73 | dbus-user.talk org.gnome.ScreenSaver | 73 | dbus-user.talk org.gnome.ScreenSaver |
74 | dbus-user.talk org.gnome.SessionManager | 74 | dbus-user.talk org.gnome.SessionManager |
75 | dbus-user.talk org.gnome.SessionManager.Presence | 75 | dbus-user.talk org.gnome.SessionManager.Presence |
76 | # Uncomment or add to your keepassxc.local to allow Notifications/Tray. | 76 | # Uncomment or add to your keepassxc.local to allow Notifications. |
77 | #dbus-user.talk org.freedesktop.Notifications | 77 | #dbus-user.talk org.freedesktop.Notifications |
78 | # Uncomment or add to your keepassxc.local to allow Tray. | ||
78 | #dbus-user.talk org.kde.StatusNotifierWatcher | 79 | #dbus-user.talk org.kde.StatusNotifierWatcher |
79 | # These numbers seems to be not stable, see #3713. Play around with them. | 80 | #dbus-user.own org.kde.* |
80 | #dbus-user.own org.kde.StatusNotifierItem-2-2 | ||
81 | #dbus-user.own org.kde.StatusNotifierItem-10-2 | ||
82 | dbus-system none | 81 | dbus-system none |
83 | 82 | ||
84 | # Mutex is stored in /tmp by default, which is broken by private-tmp | 83 | # Mutex is stored in /tmp by default, which is broken by private-tmp |
diff --git a/etc/profile-a-l/kube.profile b/etc/profile-a-l/kube.profile index cf3a69fd7..e0cfb9f24 100644 --- a/etc/profile-a-l/kube.profile +++ b/etc/profile-a-l/kube.profile | |||
@@ -63,7 +63,7 @@ shell none | |||
63 | tracelog | 63 | tracelog |
64 | 64 | ||
65 | # disable-mnt | 65 | # disable-mnt |
66 | # Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg | 66 | # Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg |
67 | # Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile. | 67 | # Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile. |
68 | private-bin kube,sink_synchronizer | 68 | private-bin kube,sink_synchronizer |
69 | private-cache | 69 | private-cache |
diff --git a/etc/profile-a-l/librewolf.profile b/etc/profile-a-l/librewolf.profile new file mode 100644 index 000000000..5208cb979 --- /dev/null +++ b/etc/profile-a-l/librewolf.profile | |||
@@ -0,0 +1,28 @@ | |||
1 | # Firejail profile for Librewolf | ||
2 | # Description: Firefox fork based on privacy | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include librewolf.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/librewolf | ||
10 | noblacklist ${HOME}/.librewolf | ||
11 | |||
12 | mkdir ${HOME}/.cache/librewolf | ||
13 | mkdir ${HOME}/.librewolf | ||
14 | whitelist ${HOME}/.cache/librewolf | ||
15 | whitelist ${HOME}/.librewolf | ||
16 | |||
17 | # Uncomment (or add to librewolf.local) the following lines if you want to | ||
18 | # use the migration wizard. | ||
19 | #noblacklist ${HOME}/.mozilla | ||
20 | #whitelist ${HOME}/.mozilla | ||
21 | |||
22 | # librewolf requires a shell to launch on Arch. We can possibly remove sh though. | ||
23 | #private-bin bash,dbus-launch,dbus-send,env,librewolf,python*,sh,which | ||
24 | # private-etc must first be enabled in firefox-common.profile | ||
25 | #private-etc librewolf | ||
26 | |||
27 | # Redirect | ||
28 | include firefox-common.profile | ||
diff --git a/etc/profile-a-l/links.profile b/etc/profile-a-l/links.profile index b2f94d3cf..ccc77f274 100644 --- a/etc/profile-a-l/links.profile +++ b/etc/profile-a-l/links.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for links | 1 | # Firejail profile for links |
2 | # Description: Text WWW browser | 2 | # Description: Text WWW browser |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include links.local | 6 | include links.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
diff --git a/etc/profile-a-l/lynx.profile b/etc/profile-a-l/lynx.profile index dbd0a61e5..76a0e7ed0 100644 --- a/etc/profile-a-l/lynx.profile +++ b/etc/profile-a-l/lynx.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for lynx | 1 | # Firejail profile for lynx |
2 | # Description: Classic non-graphical (text-mode) web browser | 2 | # Description: Classic non-graphical (text-mode) web browser |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include lynx.local | 6 | include lynx.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
diff --git a/etc/profile-m-z/matrix-mirage.profile b/etc/profile-m-z/matrix-mirage.profile new file mode 100644 index 000000000..b3080df88 --- /dev/null +++ b/etc/profile-m-z/matrix-mirage.profile | |||
@@ -0,0 +1,24 @@ | |||
1 | # Firejail profile for matrix-mirage | ||
2 | # Description: Debian name for mirage binary/package | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include matrix-mirage.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.cache/matrix-mirage | ||
11 | noblacklist ${HOME}/.config/matrix-mirage | ||
12 | noblacklist ${HOME}/.local/share/matrix-mirage | ||
13 | |||
14 | mkdir ${HOME}/.cache/matrix-mirage | ||
15 | mkdir ${HOME}/.config/matrix-mirage | ||
16 | mkdir ${HOME}/.local/share/matrix-mirage | ||
17 | whitelist ${HOME}/.cache/matrix-mirage | ||
18 | whitelist ${HOME}/.config/matrix-mirage | ||
19 | whitelist ${HOME}/.local/share/matrix-mirage | ||
20 | |||
21 | private-bin matrix-mirage | ||
22 | |||
23 | # Redirect | ||
24 | include mirage.profile | ||
diff --git a/etc/profile-m-z/menulibre.profile b/etc/profile-m-z/menulibre.profile index c70090a25..8a98209a2 100644 --- a/etc/profile-m-z/menulibre.profile +++ b/etc/profile-m-z/menulibre.profile | |||
@@ -11,7 +11,7 @@ include allow-python3.inc | |||
11 | 11 | ||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
@@ -25,7 +25,7 @@ whitelist /usr/share/menulibre | |||
25 | whitelist /var/lib/app-info/icons | 25 | whitelist /var/lib/app-info/icons |
26 | whitelist /var/lib/flatpak/exports/share/applications | 26 | whitelist /var/lib/flatpak/exports/share/applications |
27 | whitelist /var/lib/flatpak/exports/share/icons | 27 | whitelist /var/lib/flatpak/exports/share/icons |
28 | include whitelist-runuser-common.inc | 28 | include whitelist-runuser-common.inc |
29 | include whitelist-usr-share-common.inc | 29 | include whitelist-usr-share-common.inc |
30 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
31 | 31 | ||
diff --git a/etc/profile-m-z/microsoft-edge-dev.profile b/etc/profile-m-z/microsoft-edge-dev.profile new file mode 100644 index 000000000..039cd36a8 --- /dev/null +++ b/etc/profile-m-z/microsoft-edge-dev.profile | |||
@@ -0,0 +1,20 @@ | |||
1 | # Firejail profile for Microsoft Edge Dev | ||
2 | # Description: Web browser from Microsoft,dev channel | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include microsoft-edge-dev.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/microsoft-edge-dev | ||
10 | noblacklist ${HOME}/.config/microsoft-edge-dev | ||
11 | |||
12 | mkdir ${HOME}/.cache/microsoft-edge-dev | ||
13 | mkdir ${HOME}/.config/microsoft-edge-dev | ||
14 | whitelist ${HOME}/.cache/microsoft-edge-dev | ||
15 | whitelist ${HOME}/.config/microsoft-edge-dev | ||
16 | |||
17 | private-opt microsoft | ||
18 | |||
19 | # Redirect | ||
20 | include chromium-common.profile | ||
diff --git a/etc/profile-m-z/microsoft-edge.profile b/etc/profile-m-z/microsoft-edge.profile new file mode 100644 index 000000000..f427507d1 --- /dev/null +++ b/etc/profile-m-z/microsoft-edge.profile | |||
@@ -0,0 +1,11 @@ | |||
1 | # Firejail profile for Microsoft Edge | ||
2 | # Description: Web browser from Microsoft | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include microsoft-edge.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | # Redirect | ||
11 | include microsoft-edge-dev.profile | ||
diff --git a/etc/profile-m-z/min.profile b/etc/profile-m-z/min.profile index be85fdbc4..7f3aeab44 100644 --- a/etc/profile-m-z/min.profile +++ b/etc/profile-m-z/min.profile | |||
@@ -6,8 +6,6 @@ include min.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | nowhitelist /usr/share/chromium | ||
10 | |||
11 | noblacklist ${HOME}/.config/Min | 9 | noblacklist ${HOME}/.config/Min |
12 | 10 | ||
13 | mkdir ${HOME}/.config/Min | 11 | mkdir ${HOME}/.config/Min |
diff --git a/etc/profile-m-z/minitube.profile b/etc/profile-m-z/minitube.profile index 39ecc7127..78ef5e398 100644 --- a/etc/profile-m-z/minitube.profile +++ b/etc/profile-m-z/minitube.profile | |||
@@ -19,7 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | 22 | include disable-shell.inc |
23 | include disable-xdg.inc | 23 | include disable-xdg.inc |
24 | 24 | ||
25 | mkdir ${HOME}/.cache/Flavio Tordini | 25 | mkdir ${HOME}/.cache/Flavio Tordini |
@@ -30,8 +30,8 @@ whitelist ${HOME}/.cache/Flavio Tordini | |||
30 | whitelist ${HOME}/.config/Flavio Tordini | 30 | whitelist ${HOME}/.config/Flavio Tordini |
31 | whitelist ${HOME}/.local/share/Flavio Tordini | 31 | whitelist ${HOME}/.local/share/Flavio Tordini |
32 | whitelist /usr/share/minitube | 32 | whitelist /usr/share/minitube |
33 | include whitelist-common.inc | 33 | include whitelist-common.inc |
34 | include whitelist-runuser-common.inc | 34 | include whitelist-runuser-common.inc |
35 | include whitelist-usr-share-common.inc | 35 | include whitelist-usr-share-common.inc |
36 | include whitelist-var-common.inc | 36 | include whitelist-var-common.inc |
37 | 37 | ||
diff --git a/etc/profile-m-z/mirage.profile b/etc/profile-m-z/mirage.profile index 4a5f12aec..7130267e8 100644 --- a/etc/profile-m-z/mirage.profile +++ b/etc/profile-m-z/mirage.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for mirage | 1 | # Firejail profile for mirage |
2 | # Description: Desktop client for Matrix | 2 | # Description: Desktop client for Matrix |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include mirage.local | 5 | include mirage.local |
@@ -9,6 +9,7 @@ include globals.local | |||
9 | noblacklist ${HOME}/.cache/mirage | 9 | noblacklist ${HOME}/.cache/mirage |
10 | noblacklist ${HOME}/.config/mirage | 10 | noblacklist ${HOME}/.config/mirage |
11 | noblacklist ${HOME}/.local/share/mirage | 11 | noblacklist ${HOME}/.local/share/mirage |
12 | noblacklist /sbin | ||
12 | 13 | ||
13 | include allow-python2.inc | 14 | include allow-python2.inc |
14 | include allow-python3.inc | 15 | include allow-python3.inc |
@@ -30,7 +31,7 @@ whitelist ${HOME}/.config/mirage | |||
30 | whitelist ${HOME}/.local/share/mirage | 31 | whitelist ${HOME}/.local/share/mirage |
31 | whitelist ${DOWNLOADS} | 32 | whitelist ${DOWNLOADS} |
32 | include whitelist-common.inc | 33 | include whitelist-common.inc |
33 | include whitelist-runuser-common.inc | 34 | include whitelist-runuser-common.inc |
34 | include whitelist-usr-share-common.inc | 35 | include whitelist-usr-share-common.inc |
35 | include whitelist-var-common.inc | 36 | include whitelist-var-common.inc |
36 | 37 | ||
@@ -49,7 +50,7 @@ shell none | |||
49 | tracelog | 50 | tracelog |
50 | 51 | ||
51 | disable-mnt | 52 | disable-mnt |
52 | private-bin mirage | 53 | private-bin ldconfig,mirage |
53 | private-cache | 54 | private-cache |
54 | private-dev | 55 | private-dev |
55 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 56 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
diff --git a/etc/profile-m-z/mtpaint.profile b/etc/profile-m-z/mtpaint.profile index cfd00e8ae..9f1f0f53d 100644 --- a/etc/profile-m-z/mtpaint.profile +++ b/etc/profile-m-z/mtpaint.profile | |||
@@ -10,14 +10,14 @@ noblacklist ${PICTURES} | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | 17 | include disable-shell.inc |
18 | include disable-xdg.inc | 18 | include disable-xdg.inc |
19 | 19 | ||
20 | include whitelist-runuser-common.inc | 20 | include whitelist-runuser-common.inc |
21 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
diff --git a/etc/profile-m-z/musictube.profile b/etc/profile-m-z/musictube.profile index 955df698d..dbfd12619 100644 --- a/etc/profile-m-z/musictube.profile +++ b/etc/profile-m-z/musictube.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for musictube | 1 | # Firejail profile for musictube |
2 | # Description: Stream music | 2 | # Description: Stream music |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include musictube.local | 5 | include musictube.local |
@@ -16,7 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | 19 | include disable-shell.inc |
20 | include disable-xdg.inc | 20 | include disable-xdg.inc |
21 | 21 | ||
22 | mkdir ${HOME}/.cache/Flavio Tordini | 22 | mkdir ${HOME}/.cache/Flavio Tordini |
@@ -26,8 +26,8 @@ whitelist ${HOME}/.cache/Flavio Tordini | |||
26 | whitelist ${HOME}/.config/Flavio Tordini | 26 | whitelist ${HOME}/.config/Flavio Tordini |
27 | whitelist ${HOME}/.local/share/Flavio Tordini | 27 | whitelist ${HOME}/.local/share/Flavio Tordini |
28 | whitelist /usr/share/musictube | 28 | whitelist /usr/share/musictube |
29 | include whitelist-common.inc | 29 | include whitelist-common.inc |
30 | include whitelist-runuser-common.inc | 30 | include whitelist-runuser-common.inc |
31 | include whitelist-usr-share-common.inc | 31 | include whitelist-usr-share-common.inc |
32 | include whitelist-var-common.inc | 32 | include whitelist-var-common.inc |
33 | 33 | ||
diff --git a/etc/profile-m-z/nheko.profile b/etc/profile-m-z/nheko.profile index 701098f4b..42e7e92fc 100644 --- a/etc/profile-m-z/nheko.profile +++ b/etc/profile-m-z/nheko.profile | |||
@@ -7,7 +7,7 @@ include nheko.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.config/nheko | 9 | noblacklist ${HOME}/.config/nheko |
10 | noblacklist ${HOME}/.cache/nheko/nheko | 10 | noblacklist ${HOME}/.cache/nheko |
11 | 11 | ||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
@@ -16,14 +16,19 @@ include disable-interpreters.inc | |||
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | 18 | include disable-shell.inc |
19 | include disable-xdg.inc | ||
19 | 20 | ||
20 | mkdir ${HOME}/.config/nheko | 21 | mkdir ${HOME}/.config/nheko |
21 | mkdir ${HOME}/.cache/nheko/nheko | 22 | mkdir ${HOME}/.cache/nheko/nheko |
22 | whitelist ${HOME}/.config/nheko | 23 | whitelist ${HOME}/.config/nheko |
23 | whitelist ${HOME}/.cache/nheko/nheko | 24 | whitelist ${HOME}/.cache/nheko |
24 | whitelist ${DOWNLOADS} | 25 | whitelist ${DOWNLOADS} |
25 | include whitelist-common.inc | 26 | include whitelist-common.inc |
27 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
29 | include whitelist-var-common.inc | ||
26 | 30 | ||
31 | apparmor | ||
27 | caps.drop all | 32 | caps.drop all |
28 | netfilter | 33 | netfilter |
29 | nodvd | 34 | nodvd |
@@ -38,5 +43,14 @@ tracelog | |||
38 | 43 | ||
39 | disable-mnt | 44 | disable-mnt |
40 | private-bin nheko | 45 | private-bin nheko |
46 | private-cache | ||
47 | private-dev | ||
48 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
41 | private-tmp | 49 | private-tmp |
42 | 50 | ||
51 | dbus-user none | ||
52 | # Comment the above line and uncomment below lines for notification popups | ||
53 | # dbus-user filter | ||
54 | # dbus-user.talk org.freedesktop.Notifications | ||
55 | # dbus-user.talk org.kde.StatusNotifierWatcher | ||
56 | dbus-system none | ||
diff --git a/etc/profile-m-z/nuclear.profile b/etc/profile-m-z/nuclear.profile index 1b97eda9b..886403b9e 100644 --- a/etc/profile-m-z/nuclear.profile +++ b/etc/profile-m-z/nuclear.profile | |||
@@ -10,31 +10,16 @@ ignore dbus-user | |||
10 | 10 | ||
11 | noblacklist ${HOME}/.config/nuclear | 11 | noblacklist ${HOME}/.config/nuclear |
12 | 12 | ||
13 | include disable-devel.inc | 13 | include disable-shell.inc |
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-shell.inc | ||
17 | include disable-xdg.inc | ||
18 | 14 | ||
19 | mkdir ${HOME}/.config/nuclear | 15 | mkdir ${HOME}/.config/nuclear |
20 | whitelist ${HOME}/.config/nuclear | 16 | whitelist ${HOME}/.config/nuclear |
21 | include whitelist-common.inc | ||
22 | include whitelist-runuser-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | 17 | ||
26 | no3d | 18 | no3d |
27 | nou2f | ||
28 | novideo | ||
29 | shell none | ||
30 | 19 | ||
31 | disable-mnt | ||
32 | # private-bin nuclear | 20 | # private-bin nuclear |
33 | private-cache | ||
34 | private-dev | ||
35 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 21 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
36 | private-opt nuclear | 22 | private-opt nuclear |
37 | private-tmp | ||
38 | 23 | ||
39 | # Redirect | 24 | # Redirect |
40 | include electron.profile | 25 | include electron.profile |
diff --git a/etc/profile-m-z/onboard.profile b/etc/profile-m-z/onboard.profile index 3a235a677..f7cb8790b 100644 --- a/etc/profile-m-z/onboard.profile +++ b/etc/profile-m-z/onboard.profile | |||
@@ -13,7 +13,7 @@ include allow-python3.inc | |||
13 | 13 | ||
14 | include disable-common.inc | 14 | include disable-common.inc |
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
@@ -23,9 +23,9 @@ include disable-xdg.inc | |||
23 | mkdir ${HOME}/.config/onboard | 23 | mkdir ${HOME}/.config/onboard |
24 | whitelist ${HOME}/.config/onboard | 24 | whitelist ${HOME}/.config/onboard |
25 | whitelist /usr/share/onboard | 25 | whitelist /usr/share/onboard |
26 | include whitelist-common.inc | 26 | include whitelist-common.inc |
27 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
28 | include whitelist-runuser-common.inc | 28 | include whitelist-runuser-common.inc |
29 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
30 | 30 | ||
31 | apparmor | 31 | apparmor |
diff --git a/etc/profile-m-z/otter-browser.profile b/etc/profile-m-z/otter-browser.profile index 652b6b7cb..aa26ddd4e 100644 --- a/etc/profile-m-z/otter-browser.profile +++ b/etc/profile-m-z/otter-browser.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for otter-browser | 1 | # Firejail profile for otter-browser |
2 | # Description: Lightweight web browser based on Qt5 | 2 | # Description: Lightweight web browser based on Qt5 |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include otter-browser.local | 5 | include otter-browser.local |
@@ -32,7 +32,7 @@ whitelist ${HOME}/.pki | |||
32 | whitelist ${HOME}/.local/share/pki | 32 | whitelist ${HOME}/.local/share/pki |
33 | whitelist /usr/share/otter-browser | 33 | whitelist /usr/share/otter-browser |
34 | include whitelist-common.inc | 34 | include whitelist-common.inc |
35 | include whitelist-runuser-common.inc | 35 | include whitelist-runuser-common.inc |
36 | include whitelist-usr-share-common.inc | 36 | include whitelist-usr-share-common.inc |
37 | include whitelist-var-common.inc | 37 | include whitelist-var-common.inc |
38 | 38 | ||
@@ -54,6 +54,6 @@ private-bin bash,otter-browser,sh,which | |||
54 | private-cache | 54 | private-cache |
55 | ?BROWSER_DISABLE_U2F: private-dev | 55 | ?BROWSER_DISABLE_U2F: private-dev |
56 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 56 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
57 | private-tmp | 57 | private-tmp |
58 | 58 | ||
59 | dbus-system none | 59 | dbus-system none |
diff --git a/etc/profile-m-z/photoflare.profile b/etc/profile-m-z/photoflare.profile index d9df3e3b3..9e6b4a87d 100644 --- a/etc/profile-m-z/photoflare.profile +++ b/etc/profile-m-z/photoflare.profile | |||
@@ -10,14 +10,14 @@ noblacklist ${PICTURES} | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | 17 | include disable-shell.inc |
18 | include disable-xdg.inc | 18 | include disable-xdg.inc |
19 | 19 | ||
20 | include whitelist-runuser-common.inc | 20 | include whitelist-runuser-common.inc |
21 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
diff --git a/etc/profile-m-z/quaternion.profile b/etc/profile-m-z/quaternion.profile index 2133c74d3..3041860b3 100644 --- a/etc/profile-m-z/quaternion.profile +++ b/etc/profile-m-z/quaternion.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for quaternion | 1 | # Firejail profile for quaternion |
2 | # Description: Desktop client for Matrix | 2 | # Description: Desktop client for Matrix |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include quaternion.local | 5 | include quaternion.local |
@@ -25,7 +25,7 @@ whitelist ${HOME}/.config/Quotient | |||
25 | whitelist ${DOWNLOADS} | 25 | whitelist ${DOWNLOADS} |
26 | whitelist /usr/share/Quotient/quaternion | 26 | whitelist /usr/share/Quotient/quaternion |
27 | include whitelist-common.inc | 27 | include whitelist-common.inc |
28 | include whitelist-runuser-common.inc | 28 | include whitelist-runuser-common.inc |
29 | include whitelist-usr-share-common.inc | 29 | include whitelist-usr-share-common.inc |
30 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
31 | 31 | ||
diff --git a/etc/profile-m-z/riot-desktop.profile b/etc/profile-m-z/riot-desktop.profile index 4372fabe1..e91d25196 100644 --- a/etc/profile-m-z/riot-desktop.profile +++ b/etc/profile-m-z/riot-desktop.profile | |||
@@ -7,7 +7,5 @@ include riot-desktop.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | seccomp !chroot | ||
11 | |||
12 | # Redirect | 10 | # Redirect |
13 | include riot-web.profile | 11 | include riot-web.profile |
diff --git a/etc/profile-m-z/riot-web.profile b/etc/profile-m-z/riot-web.profile index b930adf2b..687c943b0 100644 --- a/etc/profile-m-z/riot-web.profile +++ b/etc/profile-m-z/riot-web.profile | |||
@@ -4,14 +4,15 @@ | |||
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include riot-web.local | 5 | include riot-web.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | # added by included profile | 7 | include globals.local |
8 | #include globals.local | 8 | |
9 | ignore noexec /tmp | ||
9 | 10 | ||
10 | noblacklist ${HOME}/.config/Riot | 11 | noblacklist ${HOME}/.config/Riot |
11 | 12 | ||
12 | mkdir ${HOME}/.config/Riot | 13 | mkdir ${HOME}/.config/Riot |
13 | whitelist ${HOME}/.config/Riot | 14 | whitelist ${HOME}/.config/Riot |
14 | include whitelist-common.inc | 15 | whitelist /usr/share/webapps/element |
15 | 16 | ||
16 | # Redirect | 17 | # Redirect |
17 | include electron.profile | 18 | include electron.profile |
diff --git a/etc/profile-m-z/rocketchat.profile b/etc/profile-m-z/rocketchat.profile index a574e4e8b..8d3607c75 100644 --- a/etc/profile-m-z/rocketchat.profile +++ b/etc/profile-m-z/rocketchat.profile | |||
@@ -3,14 +3,28 @@ | |||
3 | # Persistent local customizations | 3 | # Persistent local customizations |
4 | include rocketchat.local | 4 | include rocketchat.local |
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | # added by included profile | 6 | include globals.local |
7 | #include globals.local | 7 | |
8 | # Disabled until someone reported positive feedback | ||
9 | ignore include disable-devel.inc | ||
10 | ignore include disable-exec.inc | ||
11 | ignore include disable-interpreters.inc | ||
12 | ignore include disable-xdg.inc | ||
13 | ignore include whitelist-runuser-common.inc | ||
14 | ignore include whitelist-usr-share-common.inc | ||
15 | ignore include whitelist-var-common.inc | ||
16 | ignore nou2f | ||
17 | ignore novideo | ||
18 | ignore shell none | ||
19 | ignore disable-mnt | ||
20 | ignore private-cache | ||
21 | ignore private-dev | ||
22 | ignore private-tmp | ||
8 | 23 | ||
9 | noblacklist ${HOME}/.config/Rocket.Chat | 24 | noblacklist ${HOME}/.config/Rocket.Chat |
10 | 25 | ||
11 | mkdir ${HOME}/.config/Rocket.Chat | 26 | mkdir ${HOME}/.config/Rocket.Chat |
12 | whitelist ${HOME}/.config/Rocket.Chat | 27 | whitelist ${HOME}/.config/Rocket.Chat |
13 | include whitelist-common.inc | ||
14 | 28 | ||
15 | # Redirect | 29 | # Redirect |
16 | include electron.profile | 30 | include electron.profile |
diff --git a/etc/profile-m-z/servo.profile b/etc/profile-m-z/servo.profile new file mode 100644 index 000000000..65da5d0de --- /dev/null +++ b/etc/profile-m-z/servo.profile | |||
@@ -0,0 +1,48 @@ | |||
1 | # Firejail profile for servo | ||
2 | # Description: The Servo Browser Engine | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include servo.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Servo is usually installed inside $HOME | ||
10 | ignore noexec ${HOME} | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | # Add a whitelist for the directory where servo is installed and uncomment the lines below. | ||
21 | #whitelist ${DOWNLOADS} | ||
22 | #include whitelist-common.inc | ||
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | caps.drop all | ||
28 | netfilter | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix,inet,inet6 | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | disable-mnt | ||
42 | private-bin servo,sh | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-tmp | ||
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/profile-m-z/signal-desktop.profile b/etc/profile-m-z/signal-desktop.profile index c28571270..08e1c1f03 100644 --- a/etc/profile-m-z/signal-desktop.profile +++ b/etc/profile-m-z/signal-desktop.profile | |||
@@ -5,6 +5,13 @@ include signal-desktop.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Disabled until someone reported positive feedback | ||
9 | ignore include-xdg.inc | ||
10 | ignore include whitelist-runuser-common.inc | ||
11 | ignore include whitelist-usr-share-common.inc | ||
12 | ignore private-cache | ||
13 | ignore novideo | ||
14 | |||
8 | ignore noexec /tmp | 15 | ignore noexec /tmp |
9 | 16 | ||
10 | noblacklist ${HOME}/.config/Signal | 17 | noblacklist ${HOME}/.config/Signal |
@@ -14,32 +21,12 @@ noblacklist ${HOME}/.mozilla | |||
14 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | 21 | whitelist ${HOME}/.mozilla/firefox/profiles.ini |
15 | read-only ${HOME}/.mozilla/firefox/profiles.ini | 22 | read-only ${HOME}/.mozilla/firefox/profiles.ini |
16 | 23 | ||
17 | include disable-common.inc | ||
18 | include disable-devel.inc | ||
19 | include disable-exec.inc | 24 | include disable-exec.inc |
20 | include disable-interpreters.inc | ||
21 | include disable-programs.inc | ||
22 | include disable-passwdmgr.inc | ||
23 | 25 | ||
24 | mkdir ${HOME}/.config/Signal | 26 | mkdir ${HOME}/.config/Signal |
25 | whitelist ${DOWNLOADS} | ||
26 | whitelist ${HOME}/.config/Signal | 27 | whitelist ${HOME}/.config/Signal |
27 | include whitelist-common.inc | 28 | |
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.keep sys_admin,sys_chroot | ||
32 | netfilter | ||
33 | nodvd | ||
34 | nogroups | ||
35 | notv | ||
36 | nou2f | ||
37 | shell none | ||
38 | |||
39 | disable-mnt | ||
40 | private-dev | ||
41 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl | 29 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl |
42 | private-tmp | ||
43 | 30 | ||
44 | dbus-user none | 31 | # Redirect |
45 | dbus-system none | 32 | include electron.profile |
diff --git a/etc/profile-m-z/skypeforlinux.profile b/etc/profile-m-z/skypeforlinux.profile index 341c25a95..b39763981 100644 --- a/etc/profile-m-z/skypeforlinux.profile +++ b/etc/profile-m-z/skypeforlinux.profile | |||
@@ -5,27 +5,24 @@ include skypeforlinux.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Disabled until someone reported positive feedback | ||
9 | ignore whitelist ${DOWNLOADS} | ||
10 | ignore include whitelist-common.inc | ||
11 | ignore include whitelist-runuser-common.inc | ||
12 | ignore include whitelist-usr-share-common.inc | ||
13 | ignore include whitelist-var-common.inc | ||
14 | ignore nou2f | ||
15 | ignore novideo | ||
16 | ignore private-dev | ||
17 | ignore dbus-user none | ||
18 | ignore dbus-system none | ||
19 | |||
8 | # breaks Skype | 20 | # breaks Skype |
9 | ignore noexec /tmp | 21 | ignore noexec /tmp |
10 | 22 | ||
11 | noblacklist ${HOME}/.config/skypeforlinux | 23 | noblacklist ${HOME}/.config/skypeforlinux |
12 | 24 | ||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | caps.keep sys_admin,sys_chroot | ||
22 | netfilter | ||
23 | nodvd | ||
24 | nogroups | ||
25 | notv | ||
26 | shell none | ||
27 | |||
28 | disable-mnt | ||
29 | private-cache | ||
30 | # private-dev - needs /dev/disk | 25 | # private-dev - needs /dev/disk |
31 | private-tmp | 26 | |
27 | # Redirect | ||
28 | include electron.profile | ||
diff --git a/etc/profile-m-z/slack.profile b/etc/profile-m-z/slack.profile index 8ab3edd63..9ad772cd5 100644 --- a/etc/profile-m-z/slack.profile +++ b/etc/profile-m-z/slack.profile | |||
@@ -5,31 +5,26 @@ include slack.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Disabled until someone reported positive feedback | ||
9 | ignore include disable-exec.inc | ||
10 | ignore include disable-xdg.inc | ||
11 | ignore include whitelist-runuser-common.inc | ||
12 | ignore include whitelist-usr-share-common.inc | ||
13 | ignore apparmor | ||
14 | ignore novideo | ||
15 | ignore private-tmp | ||
16 | ignore dbus-user none | ||
17 | ignore dbus-system none | ||
18 | |||
8 | noblacklist ${HOME}/.config/Slack | 19 | noblacklist ${HOME}/.config/Slack |
9 | 20 | ||
10 | include disable-common.inc | ||
11 | include disable-devel.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | 21 | include disable-shell.inc |
16 | 22 | ||
17 | mkdir ${HOME}/.config/Slack | 23 | mkdir ${HOME}/.config/Slack |
18 | whitelist ${HOME}/.config/Slack | 24 | whitelist ${HOME}/.config/Slack |
19 | whitelist ${DOWNLOADS} | ||
20 | include whitelist-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | caps.keep sys_admin,sys_chroot | ||
24 | netfilter | ||
25 | nodvd | ||
26 | nogroups | ||
27 | notv | ||
28 | nou2f | ||
29 | shell none | ||
30 | 25 | ||
31 | disable-mnt | ||
32 | private-bin locale,slack | 26 | private-bin locale,slack |
33 | private-cache | ||
34 | private-dev | ||
35 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fedora-release,fonts,group,ld.so.cache,ld.so.conf,localtime,machine-id,os-release,passwd,pki,pulse,redhat-release,resolv.conf,ssl,system-release,system-release-cpe | 27 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fedora-release,fonts,group,ld.so.cache,ld.so.conf,localtime,machine-id,os-release,passwd,pki,pulse,redhat-release,resolv.conf,ssl,system-release,system-release-cpe |
28 | |||
29 | # Redirect | ||
30 | include electron.profile | ||
diff --git a/etc/profile-m-z/spectral.profile b/etc/profile-m-z/spectral.profile index d7f94e144..093661d8c 100644 --- a/etc/profile-m-z/spectral.profile +++ b/etc/profile-m-z/spectral.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for spectral | 1 | # Firejail profile for spectral |
2 | # Description: Desktop client for Matrix | 2 | # Description: Desktop client for Matrix |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include spectral.local | 5 | include spectral.local |
@@ -24,7 +24,7 @@ whitelist ${HOME}/.cache/ENCOM/Spectral | |||
24 | whitelist ${HOME}/.config/ENCOM | 24 | whitelist ${HOME}/.config/ENCOM |
25 | whitelist ${DOWNLOADS} | 25 | whitelist ${DOWNLOADS} |
26 | include whitelist-common.inc | 26 | include whitelist-common.inc |
27 | include whitelist-runuser-common.inc | 27 | include whitelist-runuser-common.inc |
28 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
29 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
30 | 30 | ||
@@ -50,4 +50,8 @@ private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts, | |||
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | dbus-user none | 52 | dbus-user none |
53 | # Comment the above line and uncomment below lines for notification popups | ||
54 | # dbus-user filter | ||
55 | # dbus-user.talk org.freedesktop.Notifications | ||
56 | # dbus-user.talk org.kde.StatusNotifierWatcher | ||
53 | dbus-system none | 57 | dbus-system none |
diff --git a/etc/profile-m-z/ssh.profile b/etc/profile-m-z/ssh.profile index 78b12c2cb..d873a5672 100644 --- a/etc/profile-m-z/ssh.profile +++ b/etc/profile-m-z/ssh.profile | |||
@@ -34,7 +34,7 @@ nonewprivs | |||
34 | # noroot - see issue #1543 | 34 | # noroot - see issue #1543 |
35 | nosound | 35 | nosound |
36 | notv | 36 | notv |
37 | # nou2f - OpenSSH >= 8.2 supports U2F | 37 | # nou2f - OpenSSH >= 8.2 supports U2F |
38 | novideo | 38 | novideo |
39 | protocol unix,inet,inet6 | 39 | protocol unix,inet,inet6 |
40 | seccomp | 40 | seccomp |
diff --git a/etc/profile-m-z/strawberry.profile b/etc/profile-m-z/strawberry.profile index cd36c0d41..0801add28 100644 --- a/etc/profile-m-z/strawberry.profile +++ b/etc/profile-m-z/strawberry.profile | |||
@@ -21,7 +21,7 @@ include disable-xdg.inc | |||
21 | 21 | ||
22 | include whitelist-runuser-common.inc | 22 | include whitelist-runuser-common.inc |
23 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
25 | 25 | ||
26 | apparmor | 26 | apparmor |
27 | caps.drop all | 27 | caps.drop all |
diff --git a/etc/profile-m-z/tar.profile b/etc/profile-m-z/tar.profile index 5233f5e4e..f6efb0feb 100644 --- a/etc/profile-m-z/tar.profile +++ b/etc/profile-m-z/tar.profile | |||
@@ -13,9 +13,7 @@ noblacklist /var/lib/pacman | |||
13 | ignore include disable-shell.inc | 13 | ignore include disable-shell.inc |
14 | include archiver-common.inc | 14 | include archiver-common.inc |
15 | 15 | ||
16 | # support compressed archives | ||
17 | private-bin awk,bash,bzip2,compress,firejail,grep,gtar,gzip,lbzip2,lzip,lzma,lzop,sh,tar,xz | ||
18 | private-etc alternatives,group,localtime,login.defs,passwd | 16 | private-etc alternatives,group,localtime,login.defs,passwd |
19 | private-lib libfakeroot,liblzma.so.*,libreadline.so.* | 17 | #private-lib libfakeroot,liblzma.so.*,libreadline.so.* |
20 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) | 18 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) |
21 | writable-var | 19 | writable-var |
diff --git a/etc/profile-m-z/teams-for-linux.profile b/etc/profile-m-z/teams-for-linux.profile index a13c92bc3..eee083332 100644 --- a/etc/profile-m-z/teams-for-linux.profile +++ b/etc/profile-m-z/teams-for-linux.profile | |||
@@ -4,33 +4,23 @@ | |||
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include teams-for-linux.local | 5 | include teams-for-linux.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | # added by included profile | 7 | include globals.local |
8 | #include globals.local | 8 | |
9 | # Disabled until someone reported positive feedback | ||
10 | ignore include disable-xdg.inc | ||
11 | ignore include whitelist-runuser-common.inc | ||
12 | ignore include whitelist-usr-share-common.inc | ||
9 | 13 | ||
10 | ignore dbus-user none | 14 | ignore dbus-user none |
11 | ignore dbus-system none | 15 | ignore dbus-system none |
12 | 16 | ||
13 | noblacklist ${HOME}/.config/teams-for-linux | 17 | noblacklist ${HOME}/.config/teams-for-linux |
14 | 18 | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | |||
19 | mkdir ${HOME}/.config/teams-for-linux | 19 | mkdir ${HOME}/.config/teams-for-linux |
20 | whitelist ${HOME}/.config/teams-for-linux | 20 | whitelist ${HOME}/.config/teams-for-linux |
21 | include whitelist-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | nou2f | ||
25 | novideo | ||
26 | shell none | ||
27 | 21 | ||
28 | disable-mnt | ||
29 | private-bin bash,cut,echo,egrep,grep,head,sed,sh,teams-for-linux,tr,xdg-mime,xdg-open,zsh | 22 | private-bin bash,cut,echo,egrep,grep,head,sed,sh,teams-for-linux,tr,xdg-mime,xdg-open,zsh |
30 | private-cache | ||
31 | private-dev | ||
32 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,resolv.conf,ssl | 23 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,resolv.conf,ssl |
33 | private-tmp | ||
34 | 24 | ||
35 | # Redirect | 25 | # Redirect |
36 | include electron.profile | 26 | include electron.profile |
diff --git a/etc/profile-m-z/teams.profile b/etc/profile-m-z/teams.profile index af1365571..c8d98cbaa 100644 --- a/etc/profile-m-z/teams.profile +++ b/etc/profile-m-z/teams.profile | |||
@@ -4,8 +4,14 @@ | |||
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include teams.local | 5 | include teams.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | # added by included profile | 7 | include globals.local |
8 | #include globals.local | 8 | |
9 | # Disabled until someone reported positive feedback | ||
10 | ignore include disable-xdg.inc | ||
11 | ignore include whitelist-runuser-common.inc | ||
12 | ignore include whitelist-usr-share-common.inc | ||
13 | ignore novideo | ||
14 | ignore private-tmp | ||
9 | 15 | ||
10 | # see #3404 | 16 | # see #3404 |
11 | ignore apparmor | 17 | ignore apparmor |
@@ -15,24 +21,10 @@ ignore dbus-system none | |||
15 | noblacklist ${HOME}/.config/teams | 21 | noblacklist ${HOME}/.config/teams |
16 | noblacklist ${HOME}/.config/Microsoft | 22 | noblacklist ${HOME}/.config/Microsoft |
17 | 23 | ||
18 | include disable-devel.inc | ||
19 | include disable-exec.inc | ||
20 | include disable-interpreters.inc | ||
21 | |||
22 | mkdir ${HOME}/.config/teams | 24 | mkdir ${HOME}/.config/teams |
23 | mkdir ${HOME}/.config/Microsoft | 25 | mkdir ${HOME}/.config/Microsoft |
24 | whitelist ${HOME}/.config/teams | 26 | whitelist ${HOME}/.config/teams |
25 | whitelist ${HOME}/.config/Microsoft | 27 | whitelist ${HOME}/.config/Microsoft |
26 | include whitelist-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | nou2f | ||
30 | seccomp !chroot | ||
31 | shell none | ||
32 | |||
33 | disable-mnt | ||
34 | private-cache | ||
35 | private-dev | ||
36 | 28 | ||
37 | # Redirect | 29 | # Redirect |
38 | include electron.profile | 30 | include electron.profile |
diff --git a/etc/profile-m-z/twitch.profile b/etc/profile-m-z/twitch.profile index 3c50344f1..2f573c872 100644 --- a/etc/profile-m-z/twitch.profile +++ b/etc/profile-m-z/twitch.profile | |||
@@ -6,31 +6,20 @@ include twitch.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Disabled until someone reported positive feedback | ||
10 | ignore nou2f | ||
11 | ignore novideo | ||
12 | |||
9 | noblacklist ${HOME}/.config/Twitch | 13 | noblacklist ${HOME}/.config/Twitch |
10 | 14 | ||
11 | include disable-devel.inc | 15 | include disable-shell.inc |
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-shell.inc | ||
15 | include disable-xdg.inc | ||
16 | 16 | ||
17 | mkdir ${HOME}/.config/Twitch | 17 | mkdir ${HOME}/.config/Twitch |
18 | whitelist ${HOME}/.config/Twitch | 18 | whitelist ${HOME}/.config/Twitch |
19 | include whitelist-common.inc | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | seccomp !chroot | ||
25 | shell none | ||
26 | 19 | ||
27 | disable-mnt | ||
28 | private-bin twitch | 20 | private-bin twitch |
29 | private-cache | ||
30 | private-dev | ||
31 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 21 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
32 | private-opt Twitch | 22 | private-opt Twitch |
33 | private-tmp | ||
34 | 23 | ||
35 | # Redirect | 24 | # Redirect |
36 | include electron.profile | 25 | include electron.profile |
diff --git a/etc/profile-m-z/unzip.profile b/etc/profile-m-z/unzip.profile index be480923e..8da9ea820 100644 --- a/etc/profile-m-z/unzip.profile +++ b/etc/profile-m-z/unzip.profile | |||
@@ -10,8 +10,6 @@ include globals.local | |||
10 | # GNOME Shell integration (chrome-gnome-shell) | 10 | # GNOME Shell integration (chrome-gnome-shell) |
11 | noblacklist ${HOME}/.local/share/gnome-shell | 11 | noblacklist ${HOME}/.local/share/gnome-shell |
12 | 12 | ||
13 | noroot | ||
14 | include archiver-common.inc | 13 | include archiver-common.inc |
15 | 14 | ||
16 | private-bin unzip | ||
17 | private-etc alternatives,group,localtime,passwd | 15 | private-etc alternatives,group,localtime,passwd |
diff --git a/etc/profile-m-z/whalebird.profile b/etc/profile-m-z/whalebird.profile index 187c49ed8..22a84274d 100644 --- a/etc/profile-m-z/whalebird.profile +++ b/etc/profile-m-z/whalebird.profile | |||
@@ -4,36 +4,24 @@ | |||
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include whalebird.local | 5 | include whalebird.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | # added by included profile | 7 | include globals.local |
8 | #include globals.local | 8 | |
9 | # Disabled until someone reported positive feedback | ||
10 | ignore include whitelist-runuser-common.inc | ||
11 | ignore include whitelist-usr-share-common.inc | ||
9 | 12 | ||
10 | ignore dbus-user none | 13 | ignore dbus-user none |
11 | ignore dbus-system none | 14 | ignore dbus-system none |
12 | 15 | ||
13 | noblacklist ${HOME}/.config/Whalebird | 16 | noblacklist ${HOME}/.config/Whalebird |
14 | 17 | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.config/Whalebird | 18 | mkdir ${HOME}/.config/Whalebird |
21 | whitelist ${HOME}/.config/Whalebird | 19 | whitelist ${HOME}/.config/Whalebird |
22 | include whitelist-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | 20 | ||
25 | no3d | 21 | no3d |
26 | nou2f | ||
27 | novideo | ||
28 | protocol unix,inet,inet6 | ||
29 | shell none | ||
30 | 22 | ||
31 | disable-mnt | ||
32 | private-bin whalebird | 23 | private-bin whalebird |
33 | private-cache | ||
34 | private-dev | ||
35 | private-etc fonts,machine-id | 24 | private-etc fonts,machine-id |
36 | private-tmp | ||
37 | 25 | ||
38 | # Redirect | 26 | # Redirect |
39 | include electron.profile | 27 | include electron.profile |
diff --git a/etc/profile-m-z/wire-desktop.profile b/etc/profile-m-z/wire-desktop.profile index d265c6bae..151cd2adb 100644 --- a/etc/profile-m-z/wire-desktop.profile +++ b/etc/profile-m-z/wire-desktop.profile | |||
@@ -4,33 +4,29 @@ | |||
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include wire-desktop.local | 5 | include wire-desktop.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | # added by included profile | 7 | include globals.local |
8 | #include globals.local | ||
9 | 8 | ||
10 | # Debian/Ubuntu use /opt/Wire. As that is not in PATH by default, run `firejail /opt/Wire/wire-desktop` to start it. | 9 | # Debian/Ubuntu use /opt/Wire. As that is not in PATH by default, run `firejail /opt/Wire/wire-desktop` to start it. |
11 | 10 | ||
11 | # Disabled until someone reported positive feedback | ||
12 | ignore include disable-exec.inc | ||
13 | ignore include disable-xdg.inc | ||
14 | ignore include whitelist-runuser-common.inc | ||
15 | ignore include whitelist-usr-share-common.inc | ||
16 | ignore include whitelist-var-common.inc | ||
17 | ignore novideo | ||
18 | ignore private-cache | ||
19 | |||
12 | ignore dbus-user none | 20 | ignore dbus-user none |
13 | ignore dbus-system none | 21 | ignore dbus-system none |
14 | 22 | ||
15 | noblacklist ${HOME}/.config/Wire | 23 | noblacklist ${HOME}/.config/Wire |
16 | 24 | ||
17 | include disable-devel.inc | ||
18 | include disable-interpreters.inc | ||
19 | |||
20 | mkdir ${HOME}/.config/Wire | 25 | mkdir ${HOME}/.config/Wire |
21 | whitelist ${HOME}/.config/Wire | 26 | whitelist ${HOME}/.config/Wire |
22 | include whitelist-common.inc | ||
23 | |||
24 | nou2f | ||
25 | ignore seccomp | ||
26 | seccomp !chroot | ||
27 | shell none | ||
28 | 27 | ||
29 | disable-mnt | ||
30 | private-bin bash,electron,electron[0-9],electron[0-9][0-9],env,sh,wire-desktop | 28 | private-bin bash,electron,electron[0-9],electron[0-9][0-9],env,sh,wire-desktop |
31 | private-dev | ||
32 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl | 29 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl |
33 | private-tmp | ||
34 | 30 | ||
35 | # Redirect | 31 | # Redirect |
36 | include electron.profile | 32 | include electron.profile |
diff --git a/etc/profile-m-z/youtube.profile b/etc/profile-m-z/youtube.profile index a6c7750a9..ad7ceaee4 100644 --- a/etc/profile-m-z/youtube.profile +++ b/etc/profile-m-z/youtube.profile | |||
@@ -6,32 +6,19 @@ include youtube.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Disabled until someone reported positive feedback | ||
10 | ignore nou2f | ||
11 | |||
9 | noblacklist ${HOME}/.config/Youtube | 12 | noblacklist ${HOME}/.config/Youtube |
10 | 13 | ||
11 | include disable-devel.inc | 14 | include disable-shell.inc |
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-shell.inc | ||
15 | include disable-xdg.inc | ||
16 | 15 | ||
17 | mkdir ${HOME}/.config/Youtube | 16 | mkdir ${HOME}/.config/Youtube |
18 | whitelist ${HOME}/.config/Youtube | 17 | whitelist ${HOME}/.config/Youtube |
19 | include whitelist-common.inc | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | novideo | ||
25 | seccomp !chroot | ||
26 | shell none | ||
27 | 18 | ||
28 | disable-mnt | ||
29 | private-bin youtube | 19 | private-bin youtube |
30 | private-cache | ||
31 | private-dev | ||
32 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 20 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
33 | private-opt Youtube | 21 | private-opt Youtube |
34 | private-tmp | ||
35 | 22 | ||
36 | # Redirect | 23 | # Redirect |
37 | include electron.profile | 24 | include electron.profile |
diff --git a/etc/profile-m-z/youtubemusic-nativefier.profile b/etc/profile-m-z/youtubemusic-nativefier.profile index 3a94a5707..74b0e38b9 100644 --- a/etc/profile-m-z/youtubemusic-nativefier.profile +++ b/etc/profile-m-z/youtubemusic-nativefier.profile | |||
@@ -8,31 +8,14 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.config/youtubemusic-nativefier-040164 | 9 | noblacklist ${HOME}/.config/youtubemusic-nativefier-040164 |
10 | 10 | ||
11 | include disable-devel.inc | 11 | include disable-shell.inc |
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-shell.inc | ||
15 | include disable-xdg.inc | ||
16 | 12 | ||
17 | mkdir ${HOME}/.config/youtubemusic-nativefier-040164 | 13 | mkdir ${HOME}/.config/youtubemusic-nativefier-040164 |
18 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 | 14 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 |
19 | include whitelist-common.inc | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | 15 | ||
24 | nou2f | ||
25 | novideo | ||
26 | seccomp !chroot | ||
27 | shell none | ||
28 | |||
29 | disable-mnt | ||
30 | private-bin youtubemusic-nativefier | 16 | private-bin youtubemusic-nativefier |
31 | private-cache | ||
32 | private-dev | ||
33 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
34 | private-opt youtubemusic-nativefier | 18 | private-opt youtubemusic-nativefier |
35 | private-tmp | ||
36 | 19 | ||
37 | # Redirect | 20 | # Redirect |
38 | include electron.profile | 21 | include electron.profile |
diff --git a/etc/profile-m-z/ytmdesktop.profile b/etc/profile-m-z/ytmdesktop.profile index 5c37b838b..ab46fccc2 100644 --- a/etc/profile-m-z/ytmdesktop.profile +++ b/etc/profile-m-z/ytmdesktop.profile | |||
@@ -10,30 +10,12 @@ ignore dbus-user none | |||
10 | 10 | ||
11 | noblacklist ${HOME}/.config/youtube-music-desktop-app | 11 | noblacklist ${HOME}/.config/youtube-music-desktop-app |
12 | 12 | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | mkdir ${HOME}/.config/youtube-music-desktop-app | 13 | mkdir ${HOME}/.config/youtube-music-desktop-app |
19 | whitelist ${HOME}/.config/youtube-music-desktop-app | 14 | whitelist ${HOME}/.config/youtube-music-desktop-app |
20 | include whitelist-common.inc | ||
21 | include whitelist-runuser-common.inc | ||
22 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | |||
25 | nou2f | ||
26 | novideo | ||
27 | seccomp !chroot | ||
28 | shell none | ||
29 | 15 | ||
30 | disable-mnt | ||
31 | # private-bin env,ytmdesktop | 16 | # private-bin env,ytmdesktop |
32 | private-cache | ||
33 | private-dev | ||
34 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
35 | # private-opt | 18 | # private-opt |
36 | private-tmp | ||
37 | 19 | ||
38 | # Redirect | 20 | # Redirect |
39 | include electron.profile | 21 | include electron.profile |
diff --git a/etc/profile-m-z/zoom.profile b/etc/profile-m-z/zoom.profile index 889e8c02e..e8cd64c93 100644 --- a/etc/profile-m-z/zoom.profile +++ b/etc/profile-m-z/zoom.profile | |||
@@ -6,16 +6,20 @@ include zoom.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Disabled until someone reported positive feedback | ||
10 | ignore apparmor | ||
11 | ignore novideo | ||
12 | ignore dbus-user none | ||
13 | ignore dbus-system none | ||
14 | |||
15 | # nogroups breaks webcam access on non-systemd systems (see #3711). | ||
16 | # If you use such a system uncomment the line below or put 'ignore nogroups' in your zoom.local | ||
17 | #ignore nogroups | ||
18 | |||
9 | noblacklist ${HOME}/.config/zoomus.conf | 19 | noblacklist ${HOME}/.config/zoomus.conf |
10 | noblacklist ${HOME}/.zoom | 20 | noblacklist ${HOME}/.zoom |
11 | 21 | ||
12 | include disable-common.inc | 22 | nowhitelist ${DOWNLOADS} |
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | 23 | ||
20 | mkdir ${HOME}/.cache/zoom | 24 | mkdir ${HOME}/.cache/zoom |
21 | mkfile ${HOME}/.config/zoomus.conf | 25 | mkfile ${HOME}/.config/zoomus.conf |
@@ -23,29 +27,9 @@ mkdir ${HOME}/.zoom | |||
23 | whitelist ${HOME}/.cache/zoom | 27 | whitelist ${HOME}/.cache/zoom |
24 | whitelist ${HOME}/.config/zoomus.conf | 28 | whitelist ${HOME}/.config/zoomus.conf |
25 | whitelist ${HOME}/.zoom | 29 | whitelist ${HOME}/.zoom |
26 | include whitelist-common.inc | ||
27 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
29 | include whitelist-var-common.inc | ||
30 | 30 | ||
31 | caps.drop all | ||
32 | netfilter | ||
33 | nodvd | ||
34 | # nogroups breaks webcam access on non-systemd systems (see #3711). | ||
35 | # If you use such a system comment the line below or put 'ignore nogroups' in your zoom.local | ||
36 | nogroups | ||
37 | nonewprivs | ||
38 | noroot | ||
39 | notv | ||
40 | nou2f | ||
41 | protocol unix,inet,inet6,netlink | ||
42 | seccomp !chroot | ||
43 | shell none | ||
44 | tracelog | ||
45 | |||
46 | disable-mnt | ||
47 | private-cache | ||
48 | private-dev | ||
49 | # Disable for now, see https://github.com/netblue30/firejail/issues/3726 | 31 | # Disable for now, see https://github.com/netblue30/firejail/issues/3726 |
50 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl | 32 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl |
51 | private-tmp | 33 | |
34 | # Redirect | ||
35 | include electron.profile | ||
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 3f1591cbd..23b1e364a 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -423,6 +423,7 @@ kwrite | |||
423 | leafpad | 423 | leafpad |
424 | # less - breaks man | 424 | # less - breaks man |
425 | libreoffice | 425 | libreoffice |
426 | librewolf | ||
426 | liferea | 427 | liferea |
427 | lightsoff | 428 | lightsoff |
428 | lincity-ng | 429 | lincity-ng |
@@ -462,6 +463,7 @@ mate-calculator | |||
462 | mate-color-select | 463 | mate-color-select |
463 | mate-dictionary | 464 | mate-dictionary |
464 | mathematica | 465 | mathematica |
466 | matrix-mirage | ||
465 | mattermost-desktop | 467 | mattermost-desktop |
466 | mcabber | 468 | mcabber |
467 | mediainfo | 469 | mediainfo |
@@ -473,6 +475,8 @@ mencoder | |||
473 | mendeleydesktop | 475 | mendeleydesktop |
474 | menulibre | 476 | menulibre |
475 | meteo-qt | 477 | meteo-qt |
478 | microsoft-edge | ||
479 | microsoft-edge-dev | ||
476 | midori | 480 | midori |
477 | min | 481 | min |
478 | mindless | 482 | mindless |
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c index af891d61f..8c7c19203 100644 --- a/src/firejail/fs_home.c +++ b/src/firejail/fs_home.c | |||
@@ -360,43 +360,38 @@ void fs_private(void) { | |||
360 | selinux_relabel_path("/root", "/root"); | 360 | selinux_relabel_path("/root", "/root"); |
361 | fs_logger("tmpfs /root"); | 361 | fs_logger("tmpfs /root"); |
362 | 362 | ||
363 | if (arg_allusers) { | 363 | // mask /home |
364 | if (u != 0) | 364 | if (!arg_allusers) { |
365 | // mask user home directory | ||
366 | // the directory should be owned by the current user | ||
367 | fs_tmpfs(homedir, 1); | ||
368 | } | ||
369 | else { // mask /home | ||
370 | if (arg_debug) | 365 | if (arg_debug) |
371 | printf("Mounting a new /home directory\n"); | 366 | printf("Mounting a new /home directory\n"); |
372 | if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME, "mode=755,gid=0") < 0) | 367 | if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME, "mode=755,gid=0") < 0) |
373 | errExit("mounting /home directory"); | 368 | errExit("mounting /home directory"); |
374 | selinux_relabel_path("/home", "/home"); | 369 | selinux_relabel_path("/home", "/home"); |
375 | fs_logger("tmpfs /home"); | 370 | fs_logger("tmpfs /home"); |
371 | } | ||
376 | 372 | ||
377 | if (u != 0) { | 373 | if (u != 0) { |
378 | if (strncmp(homedir, "/home/", 6) == 0) { | 374 | if (!arg_allusers && strncmp(homedir, "/home/", 6) == 0) { |
379 | // create /home/user | 375 | // create new empty /home/user directory |
380 | if (arg_debug) | 376 | if (arg_debug) |
381 | printf("Create a new user directory\n"); | 377 | printf("Create a new user directory\n"); |
382 | if (mkdir(homedir, S_IRWXU) == -1) { | 378 | if (mkdir(homedir, S_IRWXU) == -1) { |
383 | if (mkpath_as_root(homedir) == -1) | 379 | if (mkpath_as_root(homedir) == -1) |
384 | errExit("mkpath"); | 380 | errExit("mkpath"); |
385 | if (mkdir(homedir, S_IRWXU) == -1 && errno != EEXIST) | 381 | if (mkdir(homedir, S_IRWXU) == -1) |
386 | errExit("mkdir"); | 382 | errExit("mkdir"); |
387 | } | ||
388 | if (chown(homedir, u, g) < 0) | ||
389 | errExit("chown"); | ||
390 | |||
391 | selinux_relabel_path(homedir, homedir); | ||
392 | fs_logger2("mkdir", homedir); | ||
393 | fs_logger2("tmpfs", homedir); | ||
394 | } | 383 | } |
395 | else | 384 | if (chown(homedir, u, g) < 0) |
396 | // mask user home directory | 385 | errExit("chown"); |
397 | // the directory should be owned by the current user | 386 | |
398 | fs_tmpfs(homedir, 1); | 387 | selinux_relabel_path(homedir, homedir); |
388 | fs_logger2("mkdir", homedir); | ||
389 | fs_logger2("tmpfs", homedir); | ||
399 | } | 390 | } |
391 | else | ||
392 | // mask user home directory | ||
393 | // the directory should be owned by the current user | ||
394 | fs_tmpfs(homedir, 1); | ||
400 | } | 395 | } |
401 | 396 | ||
402 | skel(homedir, u, g); | 397 | skel(homedir, u, g); |
diff --git a/src/firejail/main.c b/src/firejail/main.c index 213d5c014..e5d8a4720 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -867,7 +867,8 @@ char *guess_shell(void) { | |||
867 | shell = getenv("SHELL"); | 867 | shell = getenv("SHELL"); |
868 | if (shell) { | 868 | if (shell) { |
869 | invalid_filename(shell, 0); // no globbing | 869 | invalid_filename(shell, 0); // no globbing |
870 | if (!is_dir(shell) && strstr(shell, "..") == NULL && stat(shell, &s) == 0 && access(shell, X_OK) == 0) | 870 | if (!is_dir(shell) && strstr(shell, "..") == NULL && stat(shell, &s) == 0 && access(shell, X_OK) == 0 && |
871 | strcmp(shell, PATH_FIREJAIL) != 0) | ||
871 | return shell; | 872 | return shell; |
872 | } | 873 | } |
873 | 874 | ||
@@ -3029,8 +3030,15 @@ int main(int argc, char **argv, char **envp) { | |||
3029 | ptr += strlen(ptr); | 3030 | ptr += strlen(ptr); |
3030 | 3031 | ||
3031 | if (!arg_nogroups) { | 3032 | if (!arg_nogroups) { |
3033 | // add firejail group | ||
3034 | gid_t g = get_group_id("firejail"); | ||
3035 | if (g) { | ||
3036 | sprintf(ptr, "%d %d 1\n", g, g); | ||
3037 | ptr += strlen(ptr); | ||
3038 | } | ||
3039 | |||
3032 | // add tty group | 3040 | // add tty group |
3033 | gid_t g = get_group_id("tty"); | 3041 | g = get_group_id("tty"); |
3034 | if (g) { | 3042 | if (g) { |
3035 | sprintf(ptr, "%d %d 1\n", g, g); | 3043 | sprintf(ptr, "%d %d 1\n", g, g); |
3036 | ptr += strlen(ptr); | 3044 | ptr += strlen(ptr); |
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c index 22f36ef07..6c7803602 100644 --- a/src/firejail/no_sandbox.c +++ b/src/firejail/no_sandbox.c | |||
@@ -204,11 +204,12 @@ void run_no_sandbox(int argc, char **argv) { | |||
204 | break; | 204 | break; |
205 | } | 205 | } |
206 | } | 206 | } |
207 | // if shell is /usr/bin/firejail, replace it with /bin/bash | 207 | |
208 | if (strcmp(cfg.shell, PATH_FIREJAIL) == 0) { | 208 | // if shell is /usr/bin/firejail, replace it with /bin/bash |
209 | cfg.shell = "/bin/bash"; | 209 | // if (strcmp(cfg.shell, PATH_FIREJAIL) == 0) { |
210 | prog_index = 0; | 210 | // cfg.shell = "/bin/bash"; |
211 | } | 211 | // prog_index = 0; |
212 | // } | ||
212 | 213 | ||
213 | if (prog_index == 0) { | 214 | if (prog_index == 0) { |
214 | assert(cfg.command_line == NULL); // runs cfg.shell | 215 | assert(cfg.command_line == NULL); // runs cfg.shell |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index ff8b47102..1ee8cdfcb 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -619,6 +619,17 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
619 | #endif | 619 | #endif |
620 | return 0; | 620 | return 0; |
621 | } | 621 | } |
622 | else if (strncmp(ptr, "netns ", 6) == 0) { | ||
623 | #ifdef HAVE_NETWORK | ||
624 | if (checkcfg(CFG_NETWORK)) { | ||
625 | arg_netns = ptr + 6; | ||
626 | check_netns(arg_netns); | ||
627 | } | ||
628 | else | ||
629 | warning_feature_disabled("networking"); | ||
630 | #endif | ||
631 | return 0; | ||
632 | } | ||
622 | else if (strcmp(ptr, "net none") == 0) { | 633 | else if (strcmp(ptr, "net none") == 0) { |
623 | arg_nonetwork = 1; | 634 | arg_nonetwork = 1; |
624 | cfg.bridge0.configured = 0; | 635 | cfg.bridge0.configured = 0; |
@@ -745,6 +756,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
745 | fprintf(stderr, "Error: invalid MAC address\n"); | 756 | fprintf(stderr, "Error: invalid MAC address\n"); |
746 | exit(1); | 757 | exit(1); |
747 | } | 758 | } |
759 | |||
760 | // check multicast address | ||
761 | if (br->macsandbox[0] & 1) { | ||
762 | fprintf(stderr, "Error: invalid MAC address (multicast)\n"); | ||
763 | exit(1); | ||
764 | } | ||
748 | } | 765 | } |
749 | else | 766 | else |
750 | warning_feature_disabled("networking"); | 767 | warning_feature_disabled("networking"); |
diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c index 84cbb1977..a5c924a70 100644 --- a/src/firejail/pulseaudio.c +++ b/src/firejail/pulseaudio.c | |||
@@ -31,6 +31,8 @@ | |||
31 | #define O_PATH 010000000 | 31 | #define O_PATH 010000000 |
32 | #endif | 32 | #endif |
33 | 33 | ||
34 | #define PULSE_CLIENT_SYSCONF "/etc/pulse/client.conf" | ||
35 | |||
34 | // disable pulseaudio socket | 36 | // disable pulseaudio socket |
35 | void pulseaudio_disable(void) { | 37 | void pulseaudio_disable(void) { |
36 | if (arg_debug) | 38 | if (arg_debug) |
@@ -73,8 +75,8 @@ void pulseaudio_disable(void) { | |||
73 | closedir(dir); | 75 | closedir(dir); |
74 | } | 76 | } |
75 | 77 | ||
76 | static void pulseaudio_set_environment(const char *path) { | 78 | static void pulseaudio_fallback(const char *path) { |
77 | assert(path); | 79 | fmessage("Cannot mount tmpfs on %s/.config/pulse\n", cfg.homedir); |
78 | if (setenv("PULSE_CLIENTCONFIG", path, 1) < 0) | 80 | if (setenv("PULSE_CLIENTCONFIG", path, 1) < 0) |
79 | errExit("setenv"); | 81 | errExit("setenv"); |
80 | } | 82 | } |
@@ -84,9 +86,9 @@ void pulseaudio_init(void) { | |||
84 | struct stat s; | 86 | struct stat s; |
85 | 87 | ||
86 | // do we have pulseaudio in the system? | 88 | // do we have pulseaudio in the system? |
87 | if (stat("/etc/pulse/client.conf", &s) == -1) { | 89 | if (stat(PULSE_CLIENT_SYSCONF, &s) == -1) { |
88 | if (arg_debug) | 90 | if (arg_debug) |
89 | printf("/etc/pulse/client.conf not found\n"); | 91 | printf("%s not found\n", PULSE_CLIENT_SYSCONF); |
90 | return; | 92 | return; |
91 | } | 93 | } |
92 | 94 | ||
@@ -101,7 +103,7 @@ void pulseaudio_init(void) { | |||
101 | char *pulsecfg = NULL; | 103 | char *pulsecfg = NULL; |
102 | if (asprintf(&pulsecfg, "%s/client.conf", RUN_PULSE_DIR) == -1) | 104 | if (asprintf(&pulsecfg, "%s/client.conf", RUN_PULSE_DIR) == -1) |
103 | errExit("asprintf"); | 105 | errExit("asprintf"); |
104 | if (copy_file("/etc/pulse/client.conf", pulsecfg, -1, -1, 0644)) // root needed | 106 | if (copy_file(PULSE_CLIENT_SYSCONF, pulsecfg, -1, -1, 0644)) // root needed |
105 | errExit("copy_file"); | 107 | errExit("copy_file"); |
106 | FILE *fp = fopen(pulsecfg, "a"); | 108 | FILE *fp = fopen(pulsecfg, "a"); |
107 | if (!fp) | 109 | if (!fp) |
@@ -126,11 +128,11 @@ void pulseaudio_init(void) { | |||
126 | if (create_empty_dir_as_user(homeusercfg, 0700)) | 128 | if (create_empty_dir_as_user(homeusercfg, 0700)) |
127 | fs_logger2("create", homeusercfg); | 129 | fs_logger2("create", homeusercfg); |
128 | 130 | ||
129 | // if ~/.config/pulse now exists and there are no symbolic links, mount the new directory | 131 | // if ~/.config/pulse exists and there are no symbolic links, mount the new directory |
130 | // else set environment variable | 132 | // else set environment variable |
131 | int fd = safe_fd(homeusercfg, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); | 133 | int fd = safe_fd(homeusercfg, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); |
132 | if (fd == -1) { | 134 | if (fd == -1) { |
133 | pulseaudio_set_environment(pulsecfg); | 135 | pulseaudio_fallback(pulsecfg); |
134 | goto out; | 136 | goto out; |
135 | } | 137 | } |
136 | // confirm the actual mount destination is owned by the user | 138 | // confirm the actual mount destination is owned by the user |
@@ -138,12 +140,12 @@ void pulseaudio_init(void) { | |||
138 | if (errno != EACCES) | 140 | if (errno != EACCES) |
139 | errExit("fstat"); | 141 | errExit("fstat"); |
140 | close(fd); | 142 | close(fd); |
141 | pulseaudio_set_environment(pulsecfg); | 143 | pulseaudio_fallback(pulsecfg); |
142 | goto out; | 144 | goto out; |
143 | } | 145 | } |
144 | if (s.st_uid != getuid()) { | 146 | if (s.st_uid != getuid()) { |
145 | close(fd); | 147 | close(fd); |
146 | pulseaudio_set_environment(pulsecfg); | 148 | pulseaudio_fallback(pulsecfg); |
147 | goto out; | 149 | goto out; |
148 | } | 150 | } |
149 | // preserve a read-only mount | 151 | // preserve a read-only mount |
@@ -171,8 +173,9 @@ void pulseaudio_init(void) { | |||
171 | char *p; | 173 | char *p; |
172 | if (asprintf(&p, "%s/client.conf", homeusercfg) == -1) | 174 | if (asprintf(&p, "%s/client.conf", homeusercfg) == -1) |
173 | errExit("asprintf"); | 175 | errExit("asprintf"); |
176 | if (setenv("PULSE_CLIENTCONFIG", p, 1) < 0) | ||
177 | errExit("setenv"); | ||
174 | fs_logger2("create", p); | 178 | fs_logger2("create", p); |
175 | pulseaudio_set_environment(p); | ||
176 | free(p); | 179 | free(p); |
177 | 180 | ||
178 | // RUN_PULSE_DIR not needed anymore, mask it | 181 | // RUN_PULSE_DIR not needed anymore, mask it |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index 991e5b2f2..d811fe45a 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -141,7 +141,7 @@ void set_apparmor(void) { | |||
141 | } | 141 | } |
142 | #endif | 142 | #endif |
143 | 143 | ||
144 | void seccomp_debug(void) { | 144 | static void seccomp_debug(void) { |
145 | if (arg_debug == 0) | 145 | if (arg_debug == 0) |
146 | return; | 146 | return; |
147 | 147 | ||
diff --git a/src/firejail/util.c b/src/firejail/util.c index e8b35a64b..a3927cc88 100644 --- a/src/firejail/util.c +++ b/src/firejail/util.c | |||
@@ -29,7 +29,6 @@ | |||
29 | #include <sys/ioctl.h> | 29 | #include <sys/ioctl.h> |
30 | #include <termios.h> | 30 | #include <termios.h> |
31 | #include <sys/wait.h> | 31 | #include <sys/wait.h> |
32 | #include <sys/syscall.h> | ||
33 | #include <limits.h> | 32 | #include <limits.h> |
34 | 33 | ||
35 | #include <fcntl.h> | 34 | #include <fcntl.h> |
@@ -37,6 +36,7 @@ | |||
37 | #define O_PATH 010000000 | 36 | #define O_PATH 010000000 |
38 | #endif | 37 | #endif |
39 | 38 | ||
39 | #include <sys/syscall.h> | ||
40 | #ifdef __NR_openat2 | 40 | #ifdef __NR_openat2 |
41 | #include <linux/openat2.h> | 41 | #include <linux/openat2.h> |
42 | #endif | 42 | #endif |
@@ -75,10 +75,11 @@ static void clean_supplementary_groups(gid_t gid) { | |||
75 | goto clean_all; | 75 | goto clean_all; |
76 | 76 | ||
77 | // clean supplementary group list | 77 | // clean supplementary group list |
78 | // allow only tty, audio, video, games | 78 | // allow only firejail, tty, audio, video, games |
79 | gid_t new_groups[MAX_GROUPS]; | 79 | gid_t new_groups[MAX_GROUPS]; |
80 | int new_ngroups = 0; | 80 | int new_ngroups = 0; |
81 | char *allowed[] = { | 81 | char *allowed[] = { |
82 | "firejail", | ||
82 | "tty", | 83 | "tty", |
83 | "audio", | 84 | "audio", |
84 | "video", | 85 | "video", |
@@ -1012,12 +1013,8 @@ int create_empty_dir_as_user(const char *dir, mode_t mode) { | |||
1012 | if (chmod(dir, mode) == -1) | 1013 | if (chmod(dir, mode) == -1) |
1013 | {;} // do nothing | 1014 | {;} // do nothing |
1014 | } | 1015 | } |
1015 | else if (arg_debug) { | 1016 | else if (arg_debug) |
1016 | char *str; | 1017 | printf("Directory %s not created: %s\n", dir, strerror(errno)); |
1017 | if (asprintf(&str, "Directory %s not created", dir) == -1) | ||
1018 | errExit("asprintf"); | ||
1019 | perror(str); | ||
1020 | } | ||
1021 | #ifdef HAVE_GCOV | 1018 | #ifdef HAVE_GCOV |
1022 | __gcov_flush(); | 1019 | __gcov_flush(); |
1023 | #endif | 1020 | #endif |
@@ -1164,12 +1161,12 @@ void disable_file_path(const char *path, const char *file) { | |||
1164 | 1161 | ||
1165 | // open an existing file without following any symbolic link | 1162 | // open an existing file without following any symbolic link |
1166 | int safe_fd(const char *path, int flags) { | 1163 | int safe_fd(const char *path, int flags) { |
1164 | flags |= O_NOFOLLOW; | ||
1167 | assert(path); | 1165 | assert(path); |
1168 | if (*path != '/' || strstr(path, "..")) { | 1166 | if (*path != '/' || strstr(path, "..")) { |
1169 | fprintf(stderr, "Error: invalid path %s\n", path); | 1167 | fprintf(stderr, "Error: invalid path %s\n", path); |
1170 | exit(1); | 1168 | exit(1); |
1171 | } | 1169 | } |
1172 | flags |= O_NOFOLLOW; | ||
1173 | int fd = -1; | 1170 | int fd = -1; |
1174 | 1171 | ||
1175 | #ifdef __NR_openat2 // kernel 5.6 or better | 1172 | #ifdef __NR_openat2 // kernel 5.6 or better |
diff --git a/src/firejail/x11.c b/src/firejail/x11.c index e10abad4e..4872a5207 100644 --- a/src/firejail/x11.c +++ b/src/firejail/x11.c | |||
@@ -1368,7 +1368,7 @@ void fs_x11(void) { | |||
1368 | void x11_block(void) { | 1368 | void x11_block(void) { |
1369 | #ifdef HAVE_X11 | 1369 | #ifdef HAVE_X11 |
1370 | // check abstract socket presence and network namespace options | 1370 | // check abstract socket presence and network namespace options |
1371 | if ((!arg_nonetwork && !cfg.bridge0.configured && !cfg.interface0.configured) | 1371 | if ((!arg_nonetwork && !arg_netns && !cfg.bridge0.configured && !cfg.interface0.configured) |
1372 | && x11_abstract_sockets_present()) { | 1372 | && x11_abstract_sockets_present()) { |
1373 | fprintf(stderr, "ERROR: --x11=none specified, but abstract X11 socket still accessible.\n" | 1373 | fprintf(stderr, "ERROR: --x11=none specified, but abstract X11 socket still accessible.\n" |
1374 | "Additional setup required. To block abstract X11 socket you can either:\n" | 1374 | "Additional setup required. To block abstract X11 socket you can either:\n" |
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index 562b3eda3..347e2b31b 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -76,10 +76,10 @@ If an appropriate profile is not found, Firejail will use a default profile. | |||
76 | The default profile is quite restrictive. In case the application doesn't work, use --noprofile option | 76 | The default profile is quite restrictive. In case the application doesn't work, use --noprofile option |
77 | to disable it. For more information, please see \fBSECURITY PROFILES\fR section below. | 77 | to disable it. For more information, please see \fBSECURITY PROFILES\fR section below. |
78 | .PP | 78 | .PP |
79 | If a program argument is not specified, Firejail starts /bin/bash shell. | 79 | If a program argument is not specified, Firejail starts the user's preferred shell. |
80 | Examples: | 80 | Examples: |
81 | .PP | 81 | .PP |
82 | $ firejail [OPTIONS] # starting a /bin/bash shell | 82 | $ firejail [OPTIONS] # starting the program specified in $SHELL, usually /bin/bash |
83 | .PP | 83 | .PP |
84 | $ firejail [OPTIONS] firefox # starting Mozilla Firefox | 84 | $ firejail [OPTIONS] firefox # starting Mozilla Firefox |
85 | .PP | 85 | .PP |
@@ -2476,7 +2476,7 @@ $ firejail \-\-shell=none script.sh | |||
2476 | \fB\-\-shell=program | 2476 | \fB\-\-shell=program |
2477 | Set default user shell. Use this shell to run the application using \-c shell option. | 2477 | Set default user shell. Use this shell to run the application using \-c shell option. |
2478 | For example "firejail \-\-shell=/bin/dash firefox" will start Mozilla Firefox as "/bin/dash \-c firefox". | 2478 | For example "firejail \-\-shell=/bin/dash firefox" will start Mozilla Firefox as "/bin/dash \-c firefox". |
2479 | By default Bash shell (/bin/bash) is used. | 2479 | By default the user's preferred shell is used. |
2480 | .br | 2480 | .br |
2481 | 2481 | ||
2482 | .br | 2482 | .br |
@@ -3023,7 +3023,7 @@ We provide a tool that automates all this integration, please see \&\flfirecfg\f | |||
3023 | .SH EXAMPLES | 3023 | .SH EXAMPLES |
3024 | .TP | 3024 | .TP |
3025 | \f\firejail | 3025 | \f\firejail |
3026 | Sandbox a regular /bin/bash session. | 3026 | Sandbox a regular shell session. |
3027 | .TP | 3027 | .TP |
3028 | \f\firejail firefox | 3028 | \f\firejail firefox |
3029 | Start Mozilla Firefox. | 3029 | Start Mozilla Firefox. |
@@ -3043,7 +3043,7 @@ Start Firefox in a new network namespace. An IP address is | |||
3043 | assigned automatically. | 3043 | assigned automatically. |
3044 | .TP | 3044 | .TP |
3045 | \f\firejail \-\-net=br0 \-\-ip=10.10.20.5 \-\-net=br1 \-\-net=br2 | 3045 | \f\firejail \-\-net=br0 \-\-ip=10.10.20.5 \-\-net=br1 \-\-net=br2 |
3046 | Start a /bin/bash session in a new network namespace and connect it | 3046 | Start a shell session in a new network namespace and connect it |
3047 | to br0, br1, and br2 host bridge devices. IP addresses are assigned | 3047 | to br0, br1, and br2 host bridge devices. IP addresses are assigned |
3048 | automatically for the interfaces connected to br1 and b2 | 3048 | automatically for the interfaces connected to br1 and b2 |
3049 | #endif | 3049 | #endif |