diff options
369 files changed, 1463 insertions, 373 deletions
diff --git a/Makefile.in b/Makefile.in index 6d8bf5f72..d9d7bcd37 100644 --- a/Makefile.in +++ b/Makefile.in | |||
@@ -1,6 +1,6 @@ | |||
1 | all: apps man filters | 1 | all: apps man filters |
2 | MYLIBS = src/lib | 2 | MYLIBS = src/lib |
3 | APPS = src/firejail src/firemon src/firecfg src/libtrace src/libtracelog src/ftee src/faudit src/fnet src/fseccomp src/fcopy src/fldd | 3 | APPS = src/firejail src/firemon src/firecfg src/libtrace src/libtracelog src/ftee src/faudit src/fnet src/fseccomp src/fcopy src/fldd src/libpostexecseccomp |
4 | MANPAGES = firejail.1 firemon.1 firecfg.1 firejail-profile.5 firejail-login.5 | 4 | MANPAGES = firejail.1 firemon.1 firecfg.1 firejail-profile.5 firejail-login.5 |
5 | SECCOMP_FILTERS = seccomp seccomp.i386 seccomp.amd64 | 5 | SECCOMP_FILTERS = seccomp seccomp.i386 seccomp.amd64 |
6 | 6 | ||
@@ -85,6 +85,7 @@ realinstall: | |||
85 | install -m 0755 -d $(DESTDIR)/$(libdir)/firejail | 85 | install -m 0755 -d $(DESTDIR)/$(libdir)/firejail |
86 | install -c -m 0644 src/libtrace/libtrace.so $(DESTDIR)/$(libdir)/firejail/. | 86 | install -c -m 0644 src/libtrace/libtrace.so $(DESTDIR)/$(libdir)/firejail/. |
87 | install -c -m 0644 src/libtracelog/libtracelog.so $(DESTDIR)/$(libdir)/firejail/. | 87 | install -c -m 0644 src/libtracelog/libtracelog.so $(DESTDIR)/$(libdir)/firejail/. |
88 | install -c -m 0644 src/libpostexecseccomp/libpostexecseccomp.so $(DESTDIR)/$(libdir)/firejail/. | ||
88 | install -c -m 0755 src/ftee/ftee $(DESTDIR)/$(libdir)/firejail/. | 89 | install -c -m 0755 src/ftee/ftee $(DESTDIR)/$(libdir)/firejail/. |
89 | install -c -m 0755 src/fshaper/fshaper.sh $(DESTDIR)/$(libdir)/firejail/. | 90 | install -c -m 0755 src/fshaper/fshaper.sh $(DESTDIR)/$(libdir)/firejail/. |
90 | ifeq ($(HAVE_GIT_INSTALL),-DHAVE_GIT_INSTALL) | 91 | ifeq ($(HAVE_GIT_INSTALL),-DHAVE_GIT_INSTALL) |
@@ -159,11 +160,13 @@ install-strip: all | |||
159 | strip src/firecfg/firecfg | 160 | strip src/firecfg/firecfg |
160 | strip src/libtrace/libtrace.so | 161 | strip src/libtrace/libtrace.so |
161 | strip src/libtracelog/libtracelog.so | 162 | strip src/libtracelog/libtracelog.so |
163 | strip src/libpostexecseccomp/libpostexecseccomp.so | ||
162 | strip src/ftee/ftee | 164 | strip src/ftee/ftee |
163 | strip src/faudit/faudit | 165 | strip src/faudit/faudit |
164 | strip src/fnet/fnet | 166 | strip src/fnet/fnet |
165 | strip src/fseccomp/fseccomp | 167 | strip src/fseccomp/fseccomp |
166 | strip src/fcopy/fcopy | 168 | strip src/fcopy/fcopy |
169 | strip src/fldd/fldd | ||
167 | $(MAKE) realinstall | 170 | $(MAKE) realinstall |
168 | 171 | ||
169 | uninstall: | 172 | uninstall: |
@@ -336,6 +336,8 @@ pirate486743186 (https://github.com/pirate486743186) | |||
336 | - KMail profile | 336 | - KMail profile |
337 | Pixel Fairy (https://github.com/xahare) | 337 | Pixel Fairy (https://github.com/xahare) |
338 | - added fjclip.py, fjdisplay.py and fjresize.py in contrib section | 338 | - added fjclip.py, fjdisplay.py and fjresize.py in contrib section |
339 | PizzaDude (https://github.com/pizzadude) | ||
340 | - add mpv support to smplayer | ||
339 | pshpsh (https://github.com/pshpsh) | 341 | pshpsh (https://github.com/pshpsh) |
340 | - added FossaMail profile | 342 | - added FossaMail profile |
341 | pstn (https://github.com/pstn) | 343 | pstn (https://github.com/pstn) |
@@ -112,6 +112,10 @@ Use this issue to request new profiles: [#1139](https://github.com/netblue30/fir | |||
112 | Example: | 112 | Example: |
113 | $ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 fire‐ | 113 | $ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 fire‐ |
114 | fox | 114 | fox |
115 | |||
116 | --output-stderr=logfile | ||
117 | Similar to --output, but stderr is also stored. | ||
118 | |||
115 | ````` | 119 | ````` |
116 | 120 | ||
117 | ## /etc/firejail/firejail.config | 121 | ## /etc/firejail/firejail.config |
@@ -1,5 +1,6 @@ | |||
1 | firejail (0.9.49) baseline; urgency=low | 1 | firejail (0.9.49) baseline; urgency=low |
2 | * work in progress! | 2 | * work in progress! |
3 | * modif: --output split in two commands, --output and --output-stderr | ||
3 | * feature: per-profile disable-mnt (--disable-mnt) | 4 | * feature: per-profile disable-mnt (--disable-mnt) |
4 | * feature: per-profile support to set X11 Xephyr screen size (--xephyr-screen) | 5 | * feature: per-profile support to set X11 Xephyr screen size (--xephyr-screen) |
5 | * enhancement: /proc/sys mounting | 6 | * enhancement: /proc/sys mounting |
@@ -3823,7 +3823,7 @@ if test "$prefix" = /usr; then | |||
3823 | sysconfdir="/etc" | 3823 | sysconfdir="/etc" |
3824 | fi | 3824 | fi |
3825 | 3825 | ||
3826 | ac_config_files="$ac_config_files Makefile src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile" | 3826 | ac_config_files="$ac_config_files Makefile src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile" |
3827 | 3827 | ||
3828 | cat >confcache <<\_ACEOF | 3828 | cat >confcache <<\_ACEOF |
3829 | # This file is a shell script that caches the results of configure | 3829 | # This file is a shell script that caches the results of configure |
@@ -4545,6 +4545,7 @@ do | |||
4545 | "src/faudit/Makefile") CONFIG_FILES="$CONFIG_FILES src/faudit/Makefile" ;; | 4545 | "src/faudit/Makefile") CONFIG_FILES="$CONFIG_FILES src/faudit/Makefile" ;; |
4546 | "src/fseccomp/Makefile") CONFIG_FILES="$CONFIG_FILES src/fseccomp/Makefile" ;; | 4546 | "src/fseccomp/Makefile") CONFIG_FILES="$CONFIG_FILES src/fseccomp/Makefile" ;; |
4547 | "src/fldd/Makefile") CONFIG_FILES="$CONFIG_FILES src/fldd/Makefile" ;; | 4547 | "src/fldd/Makefile") CONFIG_FILES="$CONFIG_FILES src/fldd/Makefile" ;; |
4548 | "src/libpostexecseccomp/Makefile") CONFIG_FILES="$CONFIG_FILES src/libpostexecseccomp/Makefile" ;; | ||
4548 | 4549 | ||
4549 | *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;; | 4550 | *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;; |
4550 | esac | 4551 | esac |
diff --git a/configure.ac b/configure.ac index 09fc3f587..8552c48eb 100644 --- a/configure.ac +++ b/configure.ac | |||
@@ -177,7 +177,7 @@ fi | |||
177 | 177 | ||
178 | AC_OUTPUT(Makefile src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile \ | 178 | AC_OUTPUT(Makefile src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile \ |
179 | src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile \ | 179 | src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile \ |
180 | src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile) | 180 | src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile) |
181 | 181 | ||
182 | echo | 182 | echo |
183 | echo "Configuration options:" | 183 | echo "Configuration options:" |
diff --git a/etc/0ad.profile b/etc/0ad.profile index af6e32947..9ca9834a8 100644 --- a/etc/0ad.profile +++ b/etc/0ad.profile | |||
@@ -24,9 +24,11 @@ include /etc/firejail/whitelist-common.inc | |||
24 | 24 | ||
25 | caps.drop all | 25 | caps.drop all |
26 | netfilter | 26 | netfilter |
27 | nodvd | ||
27 | nogroups | 28 | nogroups |
28 | nonewprivs | 29 | nonewprivs |
29 | noroot | 30 | noroot |
31 | notv | ||
30 | novideo | 32 | novideo |
31 | protocol unix,inet,inet6 | 33 | protocol unix,inet,inet6 |
32 | seccomp | 34 | seccomp |
diff --git a/etc/2048-qt.profile b/etc/2048-qt.profile index d8c402d34..06cc69503 100644 --- a/etc/2048-qt.profile +++ b/etc/2048-qt.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | 15 | ||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
diff --git a/etc/7z.profile b/etc/7z.profile index 5e2b76f18..ea67bbe19 100644 --- a/etc/7z.profile +++ b/etc/7z.profile | |||
@@ -11,8 +11,9 @@ blacklist /tmp/.X11-unix | |||
11 | ignore noroot | 11 | ignore noroot |
12 | net none | 12 | net none |
13 | no3d | 13 | no3d |
14 | nodvd | ||
14 | nosound | 15 | nosound |
15 | nosound | 16 | notv |
16 | novideo | 17 | novideo |
17 | shell none | 18 | shell none |
18 | tracelog | 19 | tracelog |
diff --git a/etc/Cryptocat.profile b/etc/Cryptocat.profile index dc45a32b7..add122a5e 100644 --- a/etc/Cryptocat.profile +++ b/etc/Cryptocat.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | protocol unix,inet,inet6,netlink | 23 | protocol unix,inet,inet6,netlink |
22 | seccomp | 24 | seccomp |
23 | shell none | 25 | shell none |
diff --git a/etc/Cyberfox.profile b/etc/Cyberfox.profile index 4d0f7cac8..202bc26f4 100644 --- a/etc/Cyberfox.profile +++ b/etc/Cyberfox.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/cyberfox.profile | 6 | include /etc/firejail/cyberfox.profile |
diff --git a/etc/FossaMail.profile b/etc/FossaMail.profile index 3b8c093ef..01e338ef2 100644 --- a/etc/FossaMail.profile +++ b/etc/FossaMail.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/fossamail.profile | 6 | include /etc/firejail/fossamail.profile |
diff --git a/etc/Mathematica.profile b/etc/Mathematica.profile index 8f6e33f7b..924f74389 100644 --- a/etc/Mathematica.profile +++ b/etc/Mathematica.profile | |||
@@ -21,6 +21,8 @@ whitelist ~/Documents/Wolfram Mathematica | |||
21 | include /etc/firejail/whitelist-common.inc | 21 | include /etc/firejail/whitelist-common.inc |
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | nodvd | ||
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
27 | notv | ||
26 | seccomp | 28 | seccomp |
diff --git a/etc/Telegram.profile b/etc/Telegram.profile index 844595b3f..df6557a90 100644 --- a/etc/Telegram.profile +++ b/etc/Telegram.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/telegram.profile | 6 | include /etc/firejail/telegram.profile |
diff --git a/etc/Thunar.profile b/etc/Thunar.profile index 7bb66240e..f4a5c9f54 100644 --- a/etc/Thunar.profile +++ b/etc/Thunar.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix | 27 | protocol unix |
26 | seccomp | 28 | seccomp |
diff --git a/etc/VirtualBox.profile b/etc/VirtualBox.profile index 706a3611b..dedf448ae 100644 --- a/etc/VirtualBox.profile +++ b/etc/VirtualBox.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/virtualbox.profile | 6 | include /etc/firejail/virtualbox.profile |
diff --git a/etc/Wire.profile b/etc/Wire.profile index a2c0f0099..26b683f84 100644 --- a/etc/Wire.profile +++ b/etc/Wire.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/wire.profile | 6 | include /etc/firejail/wire.profile |
diff --git a/etc/Xephyr.profile b/etc/Xephyr.profile index db3b3858c..c0c322b67 100644 --- a/etc/Xephyr.profile +++ b/etc/Xephyr.profile | |||
@@ -22,11 +22,13 @@ include /etc/firejail/whitelist-common.inc | |||
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | # Xephyr needs to be allowed access to the abstract Unix socket namespace. | 24 | # Xephyr needs to be allowed access to the abstract Unix socket namespace. |
25 | nodvd | ||
25 | nogroups | 26 | nogroups |
26 | nonewprivs | 27 | nonewprivs |
27 | # In noroot mode, Xephyr cannot create a socket in the real /tmp/.X11-unix. | 28 | # In noroot mode, Xephyr cannot create a socket in the real /tmp/.X11-unix. |
28 | # noroot | 29 | # noroot |
29 | nosound | 30 | nosound |
31 | notv | ||
30 | protocol unix | 32 | protocol unix |
31 | seccomp | 33 | seccomp |
32 | shell none | 34 | shell none |
diff --git a/etc/Xvfb.profile b/etc/Xvfb.profile index ce17a9732..7921e0d06 100644 --- a/etc/Xvfb.profile +++ b/etc/Xvfb.profile | |||
@@ -23,11 +23,13 @@ include /etc/firejail/whitelist-common.inc | |||
23 | 23 | ||
24 | caps.drop all | 24 | caps.drop all |
25 | # Xvfb needs to be allowed access to the abstract Unix socket namespace. | 25 | # Xvfb needs to be allowed access to the abstract Unix socket namespace. |
26 | nodvd | ||
26 | nogroups | 27 | nogroups |
27 | nonewprivs | 28 | nonewprivs |
28 | # In noroot mode, Xvfb cannot create a socket in the real /tmp/.X11-unix. | 29 | # In noroot mode, Xvfb cannot create a socket in the real /tmp/.X11-unix. |
29 | #noroot | 30 | #noroot |
30 | nosound | 31 | nosound |
32 | notv | ||
31 | protocol unix | 33 | protocol unix |
32 | seccomp | 34 | seccomp |
33 | shell none | 35 | shell none |
diff --git a/etc/abrowser.profile b/etc/abrowser.profile index a7fbb63d9..3251ef8aa 100644 --- a/etc/abrowser.profile +++ b/etc/abrowser.profile | |||
@@ -37,8 +37,10 @@ include /etc/firejail/whitelist-common.inc | |||
37 | 37 | ||
38 | caps.drop all | 38 | caps.drop all |
39 | netfilter | 39 | netfilter |
40 | nodvd | ||
40 | nonewprivs | 41 | nonewprivs |
41 | noroot | 42 | noroot |
43 | notv | ||
42 | protocol unix,inet,inet6,netlink | 44 | protocol unix,inet,inet6,netlink |
43 | seccomp | 45 | seccomp |
44 | tracelog | 46 | tracelog |
diff --git a/etc/akregator.profile b/etc/akregator.profile index 36886b961..12bb06fb5 100644 --- a/etc/akregator.profile +++ b/etc/akregator.profile | |||
@@ -16,9 +16,11 @@ include /etc/firejail/disable-programs.inc | |||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | no3d | 18 | no3d |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix,inet,inet6 | 25 | protocol unix,inet,inet6 |
24 | seccomp | 26 | seccomp |
diff --git a/etc/amarok.profile b/etc/amarok.profile index 28398e2c1..e10cfbefe 100644 --- a/etc/amarok.profile +++ b/etc/amarok.profile | |||
@@ -16,6 +16,7 @@ netfilter | |||
16 | nogroups | 16 | nogroups |
17 | nonewprivs | 17 | nonewprivs |
18 | noroot | 18 | noroot |
19 | notv | ||
19 | protocol unix,inet,inet6 | 20 | protocol unix,inet,inet6 |
20 | # seccomp | 21 | # seccomp |
21 | shell none | 22 | shell none |
diff --git a/etc/android-studio.profile b/etc/android-studio.profile index 3f4795195..1e1953780 100644 --- a/etc/android-studio.profile +++ b/etc/android-studio.profile | |||
@@ -20,9 +20,11 @@ include /etc/firejail/disable-programs.inc | |||
20 | 20 | ||
21 | caps.drop all | 21 | caps.drop all |
22 | netfilter | 22 | netfilter |
23 | nodvd | ||
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
27 | notv | ||
26 | novideo | 28 | novideo |
27 | protocol unix,inet,inet6 | 29 | protocol unix,inet,inet6 |
28 | seccomp | 30 | seccomp |
diff --git a/etc/apktool.profile b/etc/apktool.profile index e057e4c0f..bdd711964 100644 --- a/etc/apktool.profile +++ b/etc/apktool.profile | |||
@@ -14,15 +14,18 @@ include /etc/firejail/disable-programs.inc | |||
14 | caps.drop all | 14 | caps.drop all |
15 | net none | 15 | net none |
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
25 | 27 | ||
28 | private-bin apktool,bash,java,dirname,basename,expr | ||
26 | private-dev | 29 | private-dev |
27 | 30 | ||
28 | noexec ${HOME} | 31 | noexec ${HOME} |
diff --git a/etc/arduino.profile b/etc/arduino.profile index 2734e59a4..b529ec266 100644 --- a/etc/arduino.profile +++ b/etc/arduino.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix,inet,inet6 | 27 | protocol unix,inet,inet6 |
26 | seccomp | 28 | seccomp |
diff --git a/etc/ark.profile b/etc/ark.profile index 7c8574973..2ed25a4e6 100644 --- a/etc/ark.profile +++ b/etc/ark.profile | |||
@@ -14,10 +14,13 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
23 | novideo | ||
21 | protocol unix | 24 | protocol unix |
22 | seccomp | 25 | seccomp |
23 | shell none | 26 | shell none |
diff --git a/etc/arm.profile b/etc/arm.profile index 5686c3301..53d290b49 100644 --- a/etc/arm.profile +++ b/etc/arm.profile | |||
@@ -20,10 +20,12 @@ caps.drop all | |||
20 | ipc-namespace | 20 | ipc-namespace |
21 | netfilter | 21 | netfilter |
22 | no3d | 22 | no3d |
23 | nodvd | ||
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
26 | nosound | 27 | nosound |
28 | notv | ||
27 | novideo | 29 | novideo |
28 | protocol unix,inet,inet6 | 30 | protocol unix,inet,inet6 |
29 | seccomp | 31 | seccomp |
@@ -31,7 +33,7 @@ shell none | |||
31 | tracelog | 33 | tracelog |
32 | 34 | ||
33 | disable-mnt | 35 | disable-mnt |
34 | # private-bin arm,tor,sh,python2,python2.7,ps,lsof,ldconfig | 36 | # private-bin arm,tor,sh,bash,python2,python2.7,ps,lsof,ldconfig |
35 | private-dev | 37 | private-dev |
36 | private-etc tor,passwd | 38 | private-etc tor,passwd |
37 | private-tmp | 39 | private-tmp |
diff --git a/etc/atom-beta.profile b/etc/atom-beta.profile index acce287c7..4869ef4ea 100644 --- a/etc/atom-beta.profile +++ b/etc/atom-beta.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix,inet,inet6,netlink | 24 | protocol unix,inet,inet6,netlink |
23 | seccomp | 25 | seccomp |
diff --git a/etc/atom.profile b/etc/atom.profile index 0b763997e..8629c3dd8 100644 --- a/etc/atom.profile +++ b/etc/atom.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix,inet,inet6,netlink | 24 | protocol unix,inet,inet6,netlink |
23 | seccomp | 25 | seccomp |
diff --git a/etc/atool.profile b/etc/atool.profile index a1da26076..c2e772f9d 100644 --- a/etc/atool.profile +++ b/etc/atool.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
diff --git a/etc/atril.profile b/etc/atril.profile index 5cac339ca..7109d343e 100644 --- a/etc/atril.profile +++ b/etc/atril.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
14 | include /etc/firejail/disable-programs.inc | 14 | include /etc/firejail/disable-programs.inc |
15 | 15 | ||
16 | caps.drop all | 16 | caps.drop all |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/audacious.profile b/etc/audacious.profile index 15bf6c013..3baa0ddba 100644 --- a/etc/audacious.profile +++ b/etc/audacious.profile | |||
@@ -17,6 +17,8 @@ caps.drop all | |||
17 | netfilter | 17 | netfilter |
18 | nonewprivs | 18 | nonewprivs |
19 | noroot | 19 | noroot |
20 | notv | ||
21 | novideo | ||
20 | protocol unix,inet,inet6 | 22 | protocol unix,inet,inet6 |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/audacity.profile b/etc/audacity.profile index 0f88886e7..b5a15b04c 100644 --- a/etc/audacity.profile +++ b/etc/audacity.profile | |||
@@ -15,9 +15,11 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/aweather.profile b/etc/aweather.profile index 9068c39c7..ef811b330 100644 --- a/etc/aweather.profile +++ b/etc/aweather.profile | |||
@@ -18,10 +18,12 @@ include /etc/firejail/whitelist-common.inc | |||
18 | 18 | ||
19 | caps.drop all | 19 | caps.drop all |
20 | netfilter | 20 | netfilter |
21 | nodvd | ||
21 | nogroups | 22 | nogroups |
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
24 | nosound | 25 | nosound |
26 | notv | ||
25 | novideo | 27 | novideo |
26 | protocol unix,inet,inet6 | 28 | protocol unix,inet,inet6 |
27 | seccomp | 29 | seccomp |
diff --git a/etc/baloo_file.profile b/etc/baloo_file.profile index 9c2909b0f..2809089e6 100644 --- a/etc/baloo_file.profile +++ b/etc/baloo_file.profile | |||
@@ -18,10 +18,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
18 | include /etc/firejail/disable-programs.inc | 18 | include /etc/firejail/disable-programs.inc |
19 | 19 | ||
20 | caps.drop all | 20 | caps.drop all |
21 | nodvd | ||
21 | nogroups | 22 | nogroups |
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
24 | nosound | 25 | nosound |
26 | notv | ||
25 | novideo | 27 | novideo |
26 | protocol unix | 28 | protocol unix |
27 | # Baloo makes ioprio_set system calls, which are blacklisted by default. | 29 | # Baloo makes ioprio_set system calls, which are blacklisted by default. |
@@ -36,6 +38,6 @@ noexec /tmp | |||
36 | 38 | ||
37 | # Make home directory read-only and allow writing only to ~/.local/share | 39 | # Make home directory read-only and allow writing only to ~/.local/share |
38 | # Note: Baloo will not be able to update the "first run" key in its configuration files. | 40 | # Note: Baloo will not be able to update the "first run" key in its configuration files. |
39 | # noexec ${HOME}/.local/share | ||
40 | # read-only ${HOME} | 41 | # read-only ${HOME} |
41 | # read-write ${HOME}/.local/share | 42 | # read-write ${HOME}/.local/share |
43 | # noexec ${HOME}/.local/share | ||
diff --git a/etc/baobab.profile b/etc/baobab.profile index 1336a220c..ef733632d 100644 --- a/etc/baobab.profile +++ b/etc/baobab.profile | |||
@@ -14,15 +14,18 @@ include /etc/firejail/disable-passwdmgr.inc | |||
14 | caps.drop all | 14 | caps.drop all |
15 | net none | 15 | net none |
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
25 | 27 | ||
28 | private-bin baobab | ||
26 | private-dev | 29 | private-dev |
27 | private-tmp | 30 | private-tmp |
28 | 31 | ||
diff --git a/etc/bibletime.profile b/etc/bibletime.profile index d59c8e05c..73d31c205 100644 --- a/etc/bibletime.profile +++ b/etc/bibletime.profile | |||
@@ -24,10 +24,12 @@ include /etc/firejail/whitelist-common.inc | |||
24 | 24 | ||
25 | caps.drop all | 25 | caps.drop all |
26 | netfilter | 26 | netfilter |
27 | nodvd | ||
27 | nogroups | 28 | nogroups |
28 | nonewprivs | 29 | nonewprivs |
29 | noroot | 30 | noroot |
30 | nosound | 31 | nosound |
32 | notv | ||
31 | novideo | 33 | novideo |
32 | protocol unix,inet,inet6,netlink | 34 | protocol unix,inet,inet6,netlink |
33 | seccomp | 35 | seccomp |
diff --git a/etc/bitlbee.profile b/etc/bitlbee.profile index 9c32cca44..0b61e7b9f 100644 --- a/etc/bitlbee.profile +++ b/etc/bitlbee.profile | |||
@@ -15,8 +15,10 @@ include /etc/firejail/disable-programs.inc | |||
15 | 15 | ||
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nonewprivs | 19 | nonewprivs |
19 | nosound | 20 | nosound |
21 | notv | ||
20 | novideo | 22 | novideo |
21 | protocol unix,inet,inet6 | 23 | protocol unix,inet,inet6 |
22 | seccomp | 24 | seccomp |
diff --git a/etc/bleachbit.profile b/etc/bleachbit.profile index dab328163..f3498e9b9 100644 --- a/etc/bleachbit.profile +++ b/etc/bleachbit.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
14 | caps.drop all | 14 | caps.drop all |
15 | net none | 15 | net none |
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/blender.profile b/etc/blender.profile index f4c566c0d..f7ecbce55 100644 --- a/etc/blender.profile +++ b/etc/blender.profile | |||
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
21 | notv | ||
20 | protocol unix,inet,inet6,netlink | 22 | protocol unix,inet,inet6,netlink |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/bless.profile b/etc/bless.profile index 6c6558b1c..e4d2f0730 100644 --- a/etc/bless.profile +++ b/etc/bless.profile | |||
@@ -15,15 +15,18 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
26 | 28 | ||
29 | # private-bin bless,sh,bash,mono | ||
27 | private-dev | 30 | private-dev |
28 | private-etc fonts,mono | 31 | private-etc fonts,mono |
29 | private-tmp | 32 | private-tmp |
diff --git a/etc/brasero.profile b/etc/brasero.profile index ee7fe8efa..eff4cba43 100644 --- a/etc/brasero.profile +++ b/etc/brasero.profile | |||
@@ -17,6 +17,7 @@ nogroups | |||
17 | nonewprivs | 17 | nonewprivs |
18 | noroot | 18 | noroot |
19 | nosound | 19 | nosound |
20 | notv | ||
20 | novideo | 21 | novideo |
21 | protocol unix | 22 | protocol unix |
22 | seccomp | 23 | seccomp |
diff --git a/etc/brave.profile b/etc/brave.profile index 20dbf6c52..4a908c884 100644 --- a/etc/brave.profile +++ b/etc/brave.profile | |||
@@ -30,6 +30,8 @@ include /etc/firejail/whitelist-common.inc | |||
30 | netfilter | 30 | netfilter |
31 | # nonewprivs | 31 | # nonewprivs |
32 | # noroot | 32 | # noroot |
33 | nodvd | ||
34 | notv | ||
33 | # protocol unix,inet,inet6,netlink | 35 | # protocol unix,inet,inet6,netlink |
34 | # seccomp | 36 | # seccomp |
35 | 37 | ||
diff --git a/etc/caja.profile b/etc/caja.profile index 1350b63dd..d234e6c9b 100644 --- a/etc/caja.profile +++ b/etc/caja.profile | |||
@@ -19,9 +19,11 @@ include /etc/firejail/disable-passwdmgr.inc | |||
19 | 19 | ||
20 | caps.drop all | 20 | caps.drop all |
21 | netfilter | 21 | netfilter |
22 | nodvd | ||
22 | nogroups | 23 | nogroups |
23 | nonewprivs | 24 | nonewprivs |
24 | noroot | 25 | noroot |
26 | notv | ||
25 | protocol unix | 27 | protocol unix |
26 | seccomp | 28 | seccomp |
27 | shell none | 29 | shell none |
diff --git a/etc/calibre.profile b/etc/calibre.profile index 726a33db8..aa0de473c 100644 --- a/etc/calibre.profile +++ b/etc/calibre.profile | |||
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc | |||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | no3d | 18 | no3d |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
22 | nosound | 23 | nosound |
24 | notv | ||
23 | novideo | 25 | novideo |
24 | protocol unix,inet,inet6 | 26 | protocol unix,inet,inet6 |
25 | seccomp | 27 | seccomp |
diff --git a/etc/catfish.profile b/etc/catfish.profile index 759b5e384..498f3b6ee 100644 --- a/etc/catfish.profile +++ b/etc/catfish.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-devel.inc | |||
14 | caps.drop all | 14 | caps.drop all |
15 | net none | 15 | net none |
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/cherrytree.profile b/etc/cherrytree.profile index fe0153959..88be562c8 100644 --- a/etc/cherrytree.profile +++ b/etc/cherrytree.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix,inet,inet6,netlink | 27 | protocol unix,inet,inet6,netlink |
26 | seccomp | 28 | seccomp |
diff --git a/etc/chromium-browser.profile b/etc/chromium-browser.profile index dcafbaaa9..472841e92 100644 --- a/etc/chromium-browser.profile +++ b/etc/chromium-browser.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile alias for chromium | 1 | # Firejail profile alias for chromium |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | # Redirect | |
5 | include /etc/firejail/chromium.profile | 5 | include /etc/firejail/chromium.profile |
diff --git a/etc/chromium.profile b/etc/chromium.profile index cec5366d9..9be99e68a 100644 --- a/etc/chromium.profile +++ b/etc/chromium.profile | |||
@@ -11,8 +11,7 @@ noblacklist ~/.config/chromium-flags.conf | |||
11 | noblacklist ~/.pki | 11 | noblacklist ~/.pki |
12 | 12 | ||
13 | include /etc/firejail/disable-common.inc | 13 | include /etc/firejail/disable-common.inc |
14 | # chromium is distributed with a perl script on Arch | 14 | include /etc/firejail/disable-devel.inc |
15 | # include /etc/firejail/disable-devel.inc | ||
16 | include /etc/firejail/disable-programs.inc | 15 | include /etc/firejail/disable-programs.inc |
17 | 16 | ||
18 | mkdir ~/.cache/chromium | 17 | mkdir ~/.cache/chromium |
@@ -27,9 +26,12 @@ include /etc/firejail/whitelist-common.inc | |||
27 | 26 | ||
28 | caps.keep sys_chroot,sys_admin | 27 | caps.keep sys_chroot,sys_admin |
29 | netfilter | 28 | netfilter |
29 | nodvd | ||
30 | nogroups | 30 | nogroups |
31 | notv | ||
31 | shell none | 32 | shell none |
32 | 33 | ||
34 | # private-bin chromium,chromium-browser,chromedriver | ||
33 | private-dev | 35 | private-dev |
34 | # private-tmp - problems with multiple browser sessions | 36 | # private-tmp - problems with multiple browser sessions |
35 | 37 | ||
diff --git a/etc/claws-mail.profile b/etc/claws-mail.profile index 730e27e33..bc045fb77 100644 --- a/etc/claws-mail.profile +++ b/etc/claws-mail.profile | |||
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc | |||
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
22 | nosound | 23 | nosound |
24 | notv | ||
23 | protocol unix,inet,inet6 | 25 | protocol unix,inet,inet6 |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
diff --git a/etc/clementine.profile b/etc/clementine.profile index 13a14af3b..14437db3e 100644 --- a/etc/clementine.profile +++ b/etc/clementine.profile | |||
@@ -5,6 +5,7 @@ include /etc/firejail/clementine.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include /etc/firejail/globals.local | 6 | include /etc/firejail/globals.local |
7 | 7 | ||
8 | noblacklist ~/.config/Clementine | ||
8 | 9 | ||
9 | include /etc/firejail/disable-common.inc | 10 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-devel.inc | 11 | include /etc/firejail/disable-devel.inc |
@@ -14,6 +15,7 @@ include /etc/firejail/disable-programs.inc | |||
14 | caps.drop all | 15 | caps.drop all |
15 | nonewprivs | 16 | nonewprivs |
16 | noroot | 17 | noroot |
18 | notv | ||
17 | novideo | 19 | novideo |
18 | protocol unix,inet,inet6 | 20 | protocol unix,inet,inet6 |
19 | # Clementine makes ioprio_set system calls, which are blacklisted by default. | 21 | # Clementine makes ioprio_set system calls, which are blacklisted by default. |
diff --git a/etc/clipit.profile b/etc/clipit.profile index 444943061..e6ee7b636 100644 --- a/etc/clipit.profile +++ b/etc/clipit.profile | |||
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc | |||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | no3d | 18 | no3d |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
22 | nosound | 23 | nosound |
24 | notv | ||
23 | novideo | 25 | novideo |
24 | protocol unix | 26 | protocol unix |
25 | seccomp | 27 | seccomp |
diff --git a/etc/cmus.profile b/etc/cmus.profile index fc6476267..cf0830475 100644 --- a/etc/cmus.profile +++ b/etc/cmus.profile | |||
@@ -16,6 +16,7 @@ caps.drop all | |||
16 | netfilter | 16 | netfilter |
17 | nonewprivs | 17 | nonewprivs |
18 | noroot | 18 | noroot |
19 | notv | ||
19 | protocol unix,inet,inet6 | 20 | protocol unix,inet,inet6 |
20 | seccomp | 21 | seccomp |
21 | shell none | 22 | shell none |
diff --git a/etc/conkeror.profile b/etc/conkeror.profile index b4cd3369a..f6a9eefb6 100644 --- a/etc/conkeror.profile +++ b/etc/conkeror.profile | |||
@@ -25,7 +25,9 @@ include /etc/firejail/whitelist-common.inc | |||
25 | 25 | ||
26 | caps.drop all | 26 | caps.drop all |
27 | netfilter | 27 | netfilter |
28 | nodvd | ||
28 | nonewprivs | 29 | nonewprivs |
29 | noroot | 30 | noroot |
31 | notv | ||
30 | protocol unix,inet,inet6 | 32 | protocol unix,inet,inet6 |
31 | seccomp | 33 | seccomp |
diff --git a/etc/corebird.profile b/etc/corebird.profile index 62941164f..87f7a970b 100644 --- a/etc/corebird.profile +++ b/etc/corebird.profile | |||
@@ -13,6 +13,8 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | nodvd | ||
16 | noroot | 17 | noroot |
18 | notv | ||
17 | protocol unix,inet,inet6 | 19 | protocol unix,inet,inet6 |
18 | seccomp | 20 | seccomp |
diff --git a/etc/cpio.profile b/etc/cpio.profile index c5d7680a3..f082d2e40 100644 --- a/etc/cpio.profile +++ b/etc/cpio.profile | |||
@@ -19,7 +19,9 @@ caps.drop all | |||
19 | net none | 19 | net none |
20 | net none | 20 | net none |
21 | no3d | 21 | no3d |
22 | nodvd | ||
22 | nosound | 23 | nosound |
24 | notv | ||
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
25 | tracelog | 27 | tracelog |
diff --git a/etc/cryptocat.profile b/etc/cryptocat.profile index 021ce32d4..04301ffbd 100644 --- a/etc/cryptocat.profile +++ b/etc/cryptocat.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/Cryptocat.profile | 6 | include /etc/Cryptocat.profile |
diff --git a/etc/curl.profile b/etc/curl.profile index 34874d270..af7eabf59 100644 --- a/etc/curl.profile +++ b/etc/curl.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | protocol unix,inet,inet6 | 26 | protocol unix,inet,inet6 |
25 | seccomp | 27 | seccomp |
26 | shell none | 28 | shell none |
diff --git a/etc/cvlc.profile b/etc/cvlc.profile index 460966321..ee1346617 100644 --- a/etc/cvlc.profile +++ b/etc/cvlc.profile | |||
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
21 | notv | ||
20 | protocol unix,inet,inet6,netlink | 22 | protocol unix,inet,inet6,netlink |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/cyberfox.profile b/etc/cyberfox.profile index 3c18ef002..63f6ea845 100644 --- a/etc/cyberfox.profile +++ b/etc/cyberfox.profile | |||
@@ -52,9 +52,11 @@ include /etc/firejail/whitelist-common.inc | |||
52 | 52 | ||
53 | caps.drop all | 53 | caps.drop all |
54 | netfilter | 54 | netfilter |
55 | nodvd | ||
55 | nogroups | 56 | nogroups |
56 | nonewprivs | 57 | nonewprivs |
57 | noroot | 58 | noroot |
59 | notv | ||
58 | protocol unix,inet,inet6,netlink | 60 | protocol unix,inet,inet6,netlink |
59 | seccomp | 61 | seccomp |
60 | shell none | 62 | shell none |
diff --git a/etc/darktable.profile b/etc/darktable.profile index 47d4710ad..e04163486 100644 --- a/etc/darktable.profile +++ b/etc/darktable.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | 15 | ||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix,inet,inet6 | 25 | protocol unix,inet,inet6 |
24 | seccomp | 26 | seccomp |
diff --git a/etc/deadbeef.profile b/etc/deadbeef.profile index 905920d42..3367aa8f4 100644 --- a/etc/deadbeef.profile +++ b/etc/deadbeef.profile | |||
@@ -18,6 +18,7 @@ no3d | |||
18 | nogroups | 18 | nogroups |
19 | nonewprivs | 19 | nonewprivs |
20 | noroot | 20 | noroot |
21 | notv | ||
21 | novideo | 22 | novideo |
22 | protocol unix,inet,inet6 | 23 | protocol unix,inet,inet6 |
23 | seccomp | 24 | seccomp |
diff --git a/etc/default.profile b/etc/default.profile index 693f89ad3..82eded802 100644 --- a/etc/default.profile +++ b/etc/default.profile | |||
@@ -16,10 +16,13 @@ include /etc/firejail/disable-programs.inc | |||
16 | caps.drop all | 16 | caps.drop all |
17 | # ipc-namespace | 17 | # ipc-namespace |
18 | netfilter | 18 | netfilter |
19 | # no3d | ||
20 | # nodvd | ||
19 | # nogroups | 21 | # nogroups |
20 | nonewprivs | 22 | nonewprivs |
21 | noroot | 23 | noroot |
22 | # nosound | 24 | # nosound |
25 | # notv | ||
23 | # novideo | 26 | # novideo |
24 | protocol unix,inet,inet6 | 27 | protocol unix,inet,inet6 |
25 | seccomp | 28 | seccomp |
diff --git a/etc/deluge.profile b/etc/deluge.profile index bb45c4371..c311d2fa7 100644 --- a/etc/deluge.profile +++ b/etc/deluge.profile | |||
@@ -19,9 +19,11 @@ include /etc/firejail/whitelist-common.inc | |||
19 | 19 | ||
20 | caps.drop all | 20 | caps.drop all |
21 | netfilter | 21 | netfilter |
22 | nodvd | ||
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
24 | nosound | 25 | nosound |
26 | notv | ||
25 | novideo | 27 | novideo |
26 | protocol unix,inet,inet6 | 28 | protocol unix,inet,inet6 |
27 | seccomp | 29 | seccomp |
diff --git a/etc/dex2jar.profile b/etc/dex2jar.profile index 5e971a5d4..5261bb865 100644 --- a/etc/dex2jar.profile +++ b/etc/dex2jar.profile | |||
@@ -15,15 +15,18 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
26 | 28 | ||
29 | private-bin dex2jar,java,sh,bash,expr,dirname,ls,uname,grep | ||
27 | private-dev | 30 | private-dev |
28 | 31 | ||
29 | noexec ${HOME} | 32 | noexec ${HOME} |
diff --git a/etc/dia.profile b/etc/dia.profile index 2072314cb..a625ab36d 100644 --- a/etc/dia.profile +++ b/etc/dia.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
diff --git a/etc/digikam.profile b/etc/digikam.profile index 35365984e..43191ec06 100644 --- a/etc/digikam.profile +++ b/etc/digikam.profile | |||
@@ -16,9 +16,11 @@ include /etc/firejail/disable-programs.inc | |||
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
23 | notv | ||
22 | protocol unix,inet,inet6,netlink | 24 | protocol unix,inet,inet6,netlink |
23 | seccomp | 25 | seccomp |
24 | # seccomp.keep fallocate,getrusage,openat,access,arch_prctl,bind,brk,chdir,chmod,clock_getres,clone,close,connect,dup2,dup3,eventfd2,execve,fadvise64,fcntl,fdatasync,flock,fstat,fstatfs,ftruncate,futex,getcwd,getdents,getegid,geteuid,getgid,getpeername,getpgrp,getpid,getppid,getrandom,getresgid,getresuid,getrlimit,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,ioctl,lseek,lstat,madvise,mbind,memfd_create,mkdir,mmap,mprotect,msync,munmap,nanosleep,open,pipe,pipe2,poll,ppoll,prctl,pread64,pwrite64,read,readlink,readlinkat,recvfrom,recvmsg,rename,rt_sigaction,rt_sigprocmask,rt_sigreturn,sched_getaffinity,sched_getparam,sched_get_priority_max,sched_get_priority_min,sched_getscheduler,sched_setscheduler,sched_yield,sendmsg,sendto,setgid,setresgid,setresuid,set_robust_list,setsid,setsockopt,set_tid_address,setuid,shmat,shmctl,shmdt,shmget,shutdown,socket,stat,statfs,sysinfo,timerfd_create,umask,uname,unlink,wait4,waitid,write,writev,fchmod,fchown,unshare,exit,exit_group | 26 | # seccomp.keep fallocate,getrusage,openat,access,arch_prctl,bind,brk,chdir,chmod,clock_getres,clone,close,connect,dup2,dup3,eventfd2,execve,fadvise64,fcntl,fdatasync,flock,fstat,fstatfs,ftruncate,futex,getcwd,getdents,getegid,geteuid,getgid,getpeername,getpgrp,getpid,getppid,getrandom,getresgid,getresuid,getrlimit,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,ioctl,lseek,lstat,madvise,mbind,memfd_create,mkdir,mmap,mprotect,msync,munmap,nanosleep,open,pipe,pipe2,poll,ppoll,prctl,pread64,pwrite64,read,readlink,readlinkat,recvfrom,recvmsg,rename,rt_sigaction,rt_sigprocmask,rt_sigreturn,sched_getaffinity,sched_getparam,sched_get_priority_max,sched_get_priority_min,sched_getscheduler,sched_setscheduler,sched_yield,sendmsg,sendto,setgid,setresgid,setresuid,set_robust_list,setsid,setsockopt,set_tid_address,setuid,shmat,shmctl,shmdt,shmget,shutdown,socket,stat,statfs,sysinfo,timerfd_create,umask,uname,unlink,wait4,waitid,write,writev,fchmod,fchown,unshare,exit,exit_group |
diff --git a/etc/dillo.profile b/etc/dillo.profile index 4601be8dc..aa8a395e1 100644 --- a/etc/dillo.profile +++ b/etc/dillo.profile | |||
@@ -21,8 +21,10 @@ include /etc/firejail/whitelist-common.inc | |||
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | netfilter | 23 | netfilter |
24 | nodvd | ||
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
27 | notv | ||
26 | protocol unix,inet,inet6 | 28 | protocol unix,inet,inet6 |
27 | seccomp | 29 | seccomp |
28 | tracelog | 30 | tracelog |
diff --git a/etc/dino.profile b/etc/dino.profile index 0501cd408..72f4f40b2 100644 --- a/etc/dino.profile +++ b/etc/dino.profile | |||
@@ -20,10 +20,12 @@ include /etc/firejail/whitelist-common.inc | |||
20 | caps.drop all | 20 | caps.drop all |
21 | netfilter | 21 | netfilter |
22 | no3d | 22 | no3d |
23 | nodvd | ||
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
26 | nosound | 27 | nosound |
28 | notv | ||
27 | novideo | 29 | novideo |
28 | protocol unix,inet,inet6 | 30 | protocol unix,inet,inet6 |
29 | seccomp | 31 | seccomp |
diff --git a/etc/disable-common.inc b/etc/disable-common.inc index f23a03876..3606d6308 100644 --- a/etc/disable-common.inc +++ b/etc/disable-common.inc | |||
@@ -3,102 +3,102 @@ | |||
3 | include /etc/firejail/disable-common.local | 3 | include /etc/firejail/disable-common.local |
4 | 4 | ||
5 | # History files in $HOME | 5 | # History files in $HOME |
6 | blacklist-nolog ${HOME}/.history | ||
7 | blacklist-nolog ${HOME}/.*_history | 6 | blacklist-nolog ${HOME}/.*_history |
7 | blacklist-nolog ${HOME}/.adobe | ||
8 | blacklist-nolog ${HOME}/.bash_history | 8 | blacklist-nolog ${HOME}/.bash_history |
9 | blacklist-nolog ${HOME}/.history | ||
9 | blacklist-nolog ${HOME}/.local/share/fish/fish_history | 10 | blacklist-nolog ${HOME}/.local/share/fish/fish_history |
10 | blacklist-nolog ${HOME}/.adobe | ||
11 | blacklist-nolog ${HOME}/.macromedia | 11 | blacklist-nolog ${HOME}/.macromedia |
12 | 12 | ||
13 | # X11 session autostart | 13 | # X11 session autostart |
14 | blacklist ${HOME}/.xinitrc | 14 | # blacklist ${HOME}/.xpra - this will kill --x11=xpra cmdline option for all programs |
15 | blacklist ${HOME}/.xserverrc | ||
16 | blacklist /etc/X11/Xsession.d | ||
17 | blacklist ${HOME}/.Xsession | 15 | blacklist ${HOME}/.Xsession |
18 | blacklist ${HOME}/.xsession | ||
19 | blacklist ${HOME}/.xsessionrc | ||
20 | blacklist ${HOME}/.xprofile | ||
21 | blacklist ${HOME}/.gnomerc | ||
22 | blacklist /etc/xdg/autostart | ||
23 | blacklist ${HOME}/.config/autostart | 16 | blacklist ${HOME}/.config/autostart |
24 | blacklist ${HOME}/.local/share/autostart | ||
25 | blacklist ${HOME}/.kde4/share/config/startupconfig | ||
26 | blacklist ${HOME}/.kde4/env | ||
27 | blacklist ${HOME}/.kde4/Autostart | ||
28 | blacklist ${HOME}/.kde4/share/autostart | ||
29 | blacklist ${HOME}/.kde4/shutdown | ||
30 | blacklist ${HOME}/.kde/share/config/startupconfig | ||
31 | blacklist ${HOME}/.kde/env | ||
32 | blacklist ${HOME}/.kde/Autostart | ||
33 | blacklist ${HOME}/.kde/share/autostart | ||
34 | blacklist ${HOME}/.kde/shutdown | ||
35 | blacklist ${HOME}/.config/startupconfig | ||
36 | blacklist ${HOME}/.config/autostart-scripts | 17 | blacklist ${HOME}/.config/autostart-scripts |
37 | blacklist ${HOME}/.config/plasma-workspace/env | ||
38 | blacklist ${HOME}/.config/plasma-workspace/shutdown | ||
39 | blacklist ${HOME}/.config/lxsession/LXDE/autostart | 18 | blacklist ${HOME}/.config/lxsession/LXDE/autostart |
40 | blacklist ${HOME}/.config/openbox/autostart | 19 | blacklist ${HOME}/.config/openbox/autostart |
41 | blacklist ${HOME}/.config/openbox/environment | 20 | blacklist ${HOME}/.config/openbox/environment |
21 | blacklist ${HOME}/.config/plasma-workspace/env | ||
22 | blacklist ${HOME}/.config/plasma-workspace/shutdown | ||
23 | blacklist ${HOME}/.config/startupconfig | ||
42 | blacklist ${HOME}/.fluxbox/startup | 24 | blacklist ${HOME}/.fluxbox/startup |
43 | # blacklist ${HOME}/.xpra - this will kill --x11=xpra cmdline option for all programs | 25 | blacklist ${HOME}/.gnomerc |
26 | blacklist ${HOME}/.kde/Autostart | ||
27 | blacklist ${HOME}/.kde/env | ||
28 | blacklist ${HOME}/.kde/share/autostart | ||
29 | blacklist ${HOME}/.kde/share/config/startupconfig | ||
30 | blacklist ${HOME}/.kde/shutdown | ||
31 | blacklist ${HOME}/.kde4/env | ||
32 | blacklist ${HOME}/.kde4/Autostart | ||
33 | blacklist ${HOME}/.kde4/share/autostart | ||
34 | blacklist ${HOME}/.kde4/shutdown | ||
35 | blacklist ${HOME}/.kde4/share/config/startupconfig | ||
36 | blacklist ${HOME}/.local/share/autostart | ||
37 | blacklist ${HOME}/.xinitrc | ||
38 | blacklist ${HOME}/.xprofile | ||
39 | blacklist ${HOME}/.xserverrc | ||
40 | blacklist ${HOME}/.xsession | ||
41 | blacklist ${HOME}/.xsessionrc | ||
42 | blacklist /etc/X11/Xsession.d | ||
43 | blacklist /etc/xdg/autostart | ||
44 | 44 | ||
45 | # KDE config | 45 | # KDE config |
46 | blacklist ${HOME}/.kde4/share/apps/konsole | 46 | blacklist ${HOME}/.config/*.notifyrc |
47 | blacklist ${HOME}/.kde4/share/apps/kwin | 47 | blacklist ${HOME}/.config/khotkeysrc |
48 | blacklist ${HOME}/.kde4/share/apps/plasma | 48 | blacklist ${HOME}/.config/krunnerrc |
49 | blacklist ${HOME}/.kde4/share/apps/solid | 49 | blacklist ${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc |
50 | blacklist ${HOME}/.kde4/share/config/*.notifyrc | ||
51 | read-only ${HOME}/.kde4/share/config/kdeglobals | ||
52 | blacklist ${HOME}/.kde4/share/config/khotkeysrc | ||
53 | blacklist ${HOME}/.kde4/share/config/krunnerrc | ||
54 | blacklist ${HOME}/.kde4/share/config/plasma-desktop-appletsrc | ||
55 | read-only ${HOME}/.kde4/share/kde4/services | ||
56 | blacklist ${HOME}/.kde/share/apps/konsole | 50 | blacklist ${HOME}/.kde/share/apps/konsole |
57 | blacklist ${HOME}/.kde/share/apps/kwin | 51 | blacklist ${HOME}/.kde/share/apps/kwin |
58 | blacklist ${HOME}/.kde/share/apps/plasma | 52 | blacklist ${HOME}/.kde/share/apps/plasma |
59 | blacklist ${HOME}/.kde/share/apps/solid | 53 | blacklist ${HOME}/.kde/share/apps/solid |
60 | blacklist ${HOME}/.kde/share/config/*.notifyrc | 54 | blacklist ${HOME}/.kde/share/config/*.notifyrc |
61 | read-only ${HOME}/.kde/share/config/kdeglobals | ||
62 | blacklist ${HOME}/.kde/share/config/khotkeysrc | 55 | blacklist ${HOME}/.kde/share/config/khotkeysrc |
63 | blacklist ${HOME}/.kde/share/config/krunnerrc | 56 | blacklist ${HOME}/.kde/share/config/krunnerrc |
64 | blacklist ${HOME}/.kde/share/config/plasma-desktop-appletsrc | 57 | blacklist ${HOME}/.kde/share/config/plasma-desktop-appletsrc |
65 | read-only ${HOME}/.kde/share/kde4/services | 58 | blacklist ${HOME}/.kde4/share/apps/plasma |
66 | blacklist ${HOME}/.config/*.notifyrc | 59 | blacklist ${HOME}/.kde4/share/apps/konsole |
67 | read-only ${HOME}/.config/kdeglobals | 60 | blacklist ${HOME}/.kde4/share/apps/kwin |
68 | blacklist ${HOME}/.config/khotkeysrc | 61 | blacklist ${HOME}/.kde4/share/config/krunnerrc |
69 | blacklist ${HOME}/.config/krunnerrc | 62 | blacklist ${HOME}/.kde4/share/config/plasma-desktop-appletsrc |
70 | blacklist ${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc | 63 | blacklist ${HOME}/.kde4/share/config/khotkeysrc |
64 | blacklist ${HOME}/.kde4/share/apps/solid | ||
65 | blacklist ${HOME}/.kde4/share/config/*.notifyrc | ||
71 | blacklist ${HOME}/.local/share/kglobalaccel | 66 | blacklist ${HOME}/.local/share/kglobalaccel |
72 | blacklist ${HOME}/.local/share/konsole | 67 | blacklist ${HOME}/.local/share/konsole |
73 | read-only ${HOME}/.local/share/kservices5 | ||
74 | blacklist ${HOME}/.local/share/kwin | 68 | blacklist ${HOME}/.local/share/kwin |
75 | blacklist ${HOME}/.local/share/plasma | 69 | blacklist ${HOME}/.local/share/plasma |
76 | blacklist ${HOME}/.local/share/solid | 70 | blacklist ${HOME}/.local/share/solid |
71 | read-only ${HOME}/.config/kdeglobals | ||
72 | read-only ${HOME}/.kde/share/config/kdeglobals | ||
73 | read-only ${HOME}/.kde/share/kde4/services | ||
74 | read-only ${HOME}/.kde4/share/kde4/services | ||
75 | read-only ${HOME}/.kde4/share/config/kdeglobals | ||
76 | read-only ${HOME}/.local/share/kservices5 | ||
77 | 77 | ||
78 | # systemd | 78 | # systemd |
79 | blacklist ${HOME}/.local/share/systemd | ||
80 | blacklist ${HOME}/.config/systemd | 79 | blacklist ${HOME}/.config/systemd |
80 | blacklist ${HOME}/.local/share/systemd | ||
81 | 81 | ||
82 | # VirtualBox | 82 | # VirtualBox |
83 | blacklist ${HOME}/.VirtualBox | 83 | blacklist ${HOME}/.VirtualBox |
84 | blacklist ${HOME}/VirtualBox VMs | ||
85 | blacklist ${HOME}/.config/VirtualBox | 84 | blacklist ${HOME}/.config/VirtualBox |
85 | blacklist ${HOME}/VirtualBox VMs | ||
86 | 86 | ||
87 | # VeraCrypt | 87 | # VeraCrypt |
88 | blacklist ${HOME}/.VeraCrypt | ||
88 | blacklist ${PATH}/veracrypt | 89 | blacklist ${PATH}/veracrypt |
89 | blacklist ${PATH}/veracrypt-uninstall.sh | 90 | blacklist ${PATH}/veracrypt-uninstall.sh |
90 | blacklist /usr/share/veracrypt | ||
91 | blacklist /usr/share/applications/veracrypt.* | 91 | blacklist /usr/share/applications/veracrypt.* |
92 | blacklist /usr/share/pixmaps/veracrypt.* | 92 | blacklist /usr/share/pixmaps/veracrypt.* |
93 | blacklist ${HOME}/.VeraCrypt | 93 | blacklist /usr/share/veracrypt |
94 | 94 | ||
95 | # TrueCrypt | 95 | # TrueCrypt |
96 | blacklist ${HOME}/.TrueCrypt | ||
96 | blacklist ${PATH}/truecrypt | 97 | blacklist ${PATH}/truecrypt |
97 | blacklist ${PATH}/truecrypt-uninstall.sh | 98 | blacklist ${PATH}/truecrypt-uninstall.sh |
98 | blacklist /usr/share/truecrypt | ||
99 | blacklist /usr/share/applications/truecrypt.* | 99 | blacklist /usr/share/applications/truecrypt.* |
100 | blacklist /usr/share/pixmaps/truecrypt.* | 100 | blacklist /usr/share/pixmaps/truecrypt.* |
101 | blacklist ${HOME}/.TrueCrypt | 101 | blacklist /usr/share/truecrypt |
102 | 102 | ||
103 | # zuluCrypt | 103 | # zuluCrypt |
104 | blacklist ${HOME}/.zuluCrypt | 104 | blacklist ${HOME}/.zuluCrypt |
@@ -107,82 +107,82 @@ blacklist ${PATH}/zuluCrypt-cli | |||
107 | blacklist ${PATH}/zuluMount-cli | 107 | blacklist ${PATH}/zuluMount-cli |
108 | 108 | ||
109 | # var | 109 | # var |
110 | blacklist /var/spool/cron | 110 | blacklist /var/lib/mysql/mysql.sock |
111 | blacklist /var/spool/anacron | 111 | blacklist /var/lib/mysqld/mysql.sock |
112 | blacklist /var/mail | 112 | blacklist /var/mail |
113 | blacklist /var/run/acpid.socket | 113 | blacklist /var/run/acpid.socket |
114 | blacklist /var/run/docker.sock | ||
114 | blacklist /var/run/minissdpd.sock | 115 | blacklist /var/run/minissdpd.sock |
115 | blacklist /var/run/rpcbind.sock | ||
116 | blacklist /var/run/mysqld/mysqld.sock | ||
117 | blacklist /var/run/mysql/mysqld.sock | 116 | blacklist /var/run/mysql/mysqld.sock |
118 | blacklist /var/lib/mysqld/mysql.sock | 117 | blacklist /var/run/mysqld/mysqld.sock |
119 | blacklist /var/lib/mysql/mysql.sock | 118 | blacklist /var/run/rpcbind.sock |
120 | blacklist /var/run/docker.sock | 119 | blacklist /var/spool/anacron |
120 | blacklist /var/spool/cron | ||
121 | 121 | ||
122 | # etc | 122 | # etc |
123 | blacklist /etc/anacrontab | ||
123 | blacklist /etc/cron* | 124 | blacklist /etc/cron* |
124 | blacklist /etc/profile.d | 125 | blacklist /etc/profile.d |
125 | blacklist /etc/rc.local | 126 | blacklist /etc/rc.local |
126 | blacklist /etc/anacrontab | ||
127 | 127 | ||
128 | # Startup files | 128 | # Startup files |
129 | read-only ${HOME}/.antigen | 129 | read-only ${HOME}/.antigen |
130 | read-only ${HOME}/.bash_login | ||
131 | read-only ${HOME}/.bashrc | ||
132 | read-only ${HOME}/.bash_aliases | 130 | read-only ${HOME}/.bash_aliases |
133 | read-only ${HOME}/.bash_profile | 131 | read-only ${HOME}/.bash_login |
134 | read-only ${HOME}/.bash_logout | 132 | read-only ${HOME}/.bash_logout |
135 | read-only ${HOME}/.zsh.d | 133 | read-only ${HOME}/.bash_profile |
136 | read-only ${HOME}/.zshenv | 134 | read-only ${HOME}/.bashrc |
137 | read-only ${HOME}/.zshrc | ||
138 | read-only ${HOME}/.zshrc.local | ||
139 | read-only ${HOME}/.zlogin | ||
140 | read-only ${HOME}/.zprofile | ||
141 | read-only ${HOME}/.zlogout | ||
142 | read-only ${HOME}/.zsh_files | ||
143 | read-only ${HOME}/.tcshrc | ||
144 | read-only ${HOME}/.cshrc | ||
145 | read-only ${HOME}/.csh_files | ||
146 | read-only ${HOME}/.config/fish | 135 | read-only ${HOME}/.config/fish |
147 | read-only ${HOME}/.local/share/fish | 136 | read-only ${HOME}/.csh_files |
148 | read-only ${HOME}/.profile | 137 | read-only ${HOME}/.cshrc |
149 | read-only ${HOME}/.forward | 138 | read-only ${HOME}/.forward |
139 | read-only ${HOME}/.local/share/fish | ||
150 | read-only ${HOME}/.login | 140 | read-only ${HOME}/.login |
151 | read-only ${HOME}/.logout | 141 | read-only ${HOME}/.logout |
142 | read-only ${HOME}/.pam_environment | ||
152 | read-only ${HOME}/.pgpkey | 143 | read-only ${HOME}/.pgpkey |
153 | read-only ${HOME}/.plan | 144 | read-only ${HOME}/.plan |
145 | read-only ${HOME}/.profile | ||
154 | read-only ${HOME}/.project | 146 | read-only ${HOME}/.project |
155 | read-only ${HOME}/.pam_environment | 147 | read-only ${HOME}/.tcshrc |
148 | read-only ${HOME}/.zlogin | ||
149 | read-only ${HOME}/.zlogout | ||
150 | read-only ${HOME}/.zprofile | ||
151 | read-only ${HOME}/.zsh.d | ||
152 | read-only ${HOME}/.zsh_files | ||
153 | read-only ${HOME}/.zshenv | ||
154 | read-only ${HOME}/.zshrc | ||
155 | read-only ${HOME}/.zshrc.local | ||
156 | 156 | ||
157 | # Initialization files that allow arbitrary command execution | 157 | # Initialization files that allow arbitrary command execution |
158 | read-only ${HOME}/.caffrc | 158 | read-only ${HOME}/.caffrc |
159 | read-only ${HOME}/.dotfiles | 159 | read-only ${HOME}/.dotfiles |
160 | read-only ${HOME}/dotfiles | ||
161 | read-only ${HOME}/.mailcap | ||
162 | read-only ${HOME}/.muttrc | ||
163 | read-only ${HOME}/.mutt/muttrc | ||
164 | read-only ${HOME}/.msmtprc | ||
165 | read-only ${HOME}/.exrc | ||
166 | read-only ${HOME}/_exrc | ||
167 | read-only ${HOME}/.vimrc | ||
168 | read-only ${HOME}/_vimrc | ||
169 | read-only ${HOME}/.gvimrc | ||
170 | read-only ${HOME}/_gvimrc | ||
171 | read-only ${HOME}/.vim | ||
172 | read-only ${HOME}/.emacs | 160 | read-only ${HOME}/.emacs |
173 | read-only ${HOME}/.emacs.d | 161 | read-only ${HOME}/.emacs.d |
174 | read-only ${HOME}/.nano | 162 | read-only ${HOME}/.exrc |
175 | read-only ${HOME}/.tmux.conf | 163 | read-only ${HOME}/.gvimrc |
176 | read-only ${HOME}/.iscreenrc | 164 | read-only ${HOME}/.iscreenrc |
165 | read-only ${HOME}/.mailcap | ||
166 | read-only ${HOME}/.msmtprc | ||
167 | read-only ${HOME}/.mutt/muttrc | ||
168 | read-only ${HOME}/.muttrc | ||
169 | read-only ${HOME}/.nano | ||
177 | read-only ${HOME}/.reportbugrc | 170 | read-only ${HOME}/.reportbugrc |
171 | read-only ${HOME}/.tmux.conf | ||
172 | read-only ${HOME}/.vim | ||
173 | read-only ${HOME}/.vimrc | ||
178 | read-only ${HOME}/.xmonad | 174 | read-only ${HOME}/.xmonad |
179 | read-only ${HOME}/.xscreensaver | 175 | read-only ${HOME}/.xscreensaver |
176 | read-only ${HOME}/_exrc | ||
177 | read-only ${HOME}/_gvimrc | ||
178 | read-only ${HOME}/_vimrc | ||
179 | read-only ${HOME}/dotfiles | ||
180 | 180 | ||
181 | # Make directories commonly found in $PATH read-only | 181 | # Make directories commonly found in $PATH read-only |
182 | read-only ${HOME}/bin | ||
183 | read-only ${HOME}/.gem | 182 | read-only ${HOME}/.gem |
184 | read-only ${HOME}/.luarocks | 183 | read-only ${HOME}/.luarocks |
185 | read-only ${HOME}/.npm-packages | 184 | read-only ${HOME}/.npm-packages |
185 | read-only ${HOME}/bin | ||
186 | 186 | ||
187 | # The following block breaks trash functionality in file managers | 187 | # The following block breaks trash functionality in file managers |
188 | #read-only ${HOME}/.local | 188 | #read-only ${HOME}/.local |
@@ -194,75 +194,75 @@ blacklist ${HOME}/.local/share/Trash | |||
194 | read-only ${HOME}/.local/share/applications | 194 | read-only ${HOME}/.local/share/applications |
195 | 195 | ||
196 | # top secret | 196 | # top secret |
197 | blacklist ${HOME}/.ecryptfs | 197 | blacklist ${HOME}/*.kdb |
198 | blacklist ${HOME}/*.kdbx | ||
199 | blacklist ${HOME}/*.key | ||
198 | blacklist ${HOME}/.Private | 200 | blacklist ${HOME}/.Private |
199 | blacklist ${HOME}/.ssh | 201 | blacklist ${HOME}/.caff |
200 | blacklist ${HOME}/.cert | 202 | blacklist ${HOME}/.cert |
203 | blacklist ${HOME}/.config/keybase | ||
204 | blacklist ${HOME}/.ecryptfs | ||
201 | blacklist ${HOME}/.gnome2/keyrings | 205 | blacklist ${HOME}/.gnome2/keyrings |
202 | blacklist ${HOME}/.local/share/keyrings | 206 | blacklist ${HOME}/.gnupg |
203 | blacklist ${HOME}/.kde4/share/apps/kwallet | ||
204 | blacklist ${HOME}/.kde/share/apps/kwallet | 207 | blacklist ${HOME}/.kde/share/apps/kwallet |
208 | blacklist ${HOME}/.kde4/share/apps/kwallet | ||
209 | blacklist ${HOME}/.local/share/keyrings | ||
205 | blacklist ${HOME}/.local/share/kwalletd | 210 | blacklist ${HOME}/.local/share/kwalletd |
206 | blacklist ${HOME}/.config/keybase | ||
207 | blacklist ${HOME}/.netrc | ||
208 | blacklist ${HOME}/.gnupg | ||
209 | blacklist ${HOME}/.caff | ||
210 | blacklist ${HOME}/.smbcredentials | ||
211 | blacklist ${HOME}/*.kdbx | ||
212 | blacklist ${HOME}/*.kdb | ||
213 | blacklist ${HOME}/*.key | ||
214 | blacklist ${HOME}/.muttrc | ||
215 | blacklist ${HOME}/.mutt/muttrc | ||
216 | blacklist ${HOME}/.msmtprc | 211 | blacklist ${HOME}/.msmtprc |
212 | blacklist ${HOME}/.mutt/muttrc | ||
213 | blacklist ${HOME}/.muttrc | ||
214 | blacklist ${HOME}/.netrc | ||
217 | blacklist ${HOME}/.pki | 215 | blacklist ${HOME}/.pki |
218 | blacklist /etc/shadow | 216 | blacklist ${HOME}/.smbcredentials |
219 | blacklist /etc/gshadow | 217 | blacklist ${HOME}/.ssh |
220 | blacklist /etc/passwd- | 218 | blacklist /etc/group+ |
221 | blacklist /etc/group- | 219 | blacklist /etc/group- |
222 | blacklist /etc/shadow- | 220 | blacklist /etc/gshadow |
221 | blacklist /etc/gshadow+ | ||
223 | blacklist /etc/gshadow- | 222 | blacklist /etc/gshadow- |
224 | blacklist /etc/passwd+ | 223 | blacklist /etc/passwd+ |
225 | blacklist /etc/group+ | 224 | blacklist /etc/passwd- |
225 | blacklist /etc/shadow | ||
226 | blacklist /etc/shadow+ | 226 | blacklist /etc/shadow+ |
227 | blacklist /etc/gshadow+ | 227 | blacklist /etc/shadow- |
228 | blacklist /etc/ssh | 228 | blacklist /etc/ssh |
229 | blacklist /var/backup | ||
230 | blacklist /home/.ecryptfs | 229 | blacklist /home/.ecryptfs |
230 | blacklist /var/backup | ||
231 | 231 | ||
232 | # system directories | 232 | # system directories |
233 | blacklist /sbin | 233 | blacklist /sbin |
234 | blacklist /usr/sbin | ||
235 | blacklist /usr/local/sbin | 234 | blacklist /usr/local/sbin |
235 | blacklist /usr/sbin | ||
236 | 236 | ||
237 | # system management | 237 | # system management |
238 | blacklist ${PATH}/umount | ||
239 | blacklist ${PATH}/mount | ||
240 | blacklist ${PATH}/fusermount | ||
241 | blacklist ${PATH}/ntfs-3g | ||
242 | blacklist ${PATH}/at | 238 | blacklist ${PATH}/at |
243 | blacklist ${PATH}/su | 239 | blacklist ${PATH}/chage |
244 | blacklist ${PATH}/sudo | 240 | blacklist ${PATH}/chfn |
245 | blacklist ${PATH}/xinput | 241 | blacklist ${PATH}/chsh |
242 | blacklist ${PATH}/crontab | ||
246 | blacklist ${PATH}/evtest | 243 | blacklist ${PATH}/evtest |
247 | blacklist ${PATH}/xev | 244 | blacklist ${PATH}/expiry |
248 | blacklist ${PATH}/strace | 245 | blacklist ${PATH}/fusermount |
246 | blacklist ${PATH}/gpasswd | ||
247 | blacklist ${PATH}/ksu | ||
248 | blacklist ${PATH}/mount | ||
249 | blacklist ${PATH}/mount.ecryptfs_private | ||
249 | blacklist ${PATH}/nc | 250 | blacklist ${PATH}/nc |
250 | blacklist ${PATH}/ncat | 251 | blacklist ${PATH}/ncat |
251 | blacklist ${PATH}/gpasswd | ||
252 | blacklist ${PATH}/newgidmap | 252 | blacklist ${PATH}/newgidmap |
253 | blacklist ${PATH}/newgrp | 253 | blacklist ${PATH}/newgrp |
254 | blacklist ${PATH}/newuidmap | 254 | blacklist ${PATH}/newuidmap |
255 | blacklist ${PATH}/ntfs-3g | ||
255 | blacklist ${PATH}/pkexec | 256 | blacklist ${PATH}/pkexec |
257 | blacklist ${PATH}/procmail | ||
256 | blacklist ${PATH}/sg | 258 | blacklist ${PATH}/sg |
257 | blacklist ${PATH}/crontab | 259 | blacklist ${PATH}/strace |
258 | blacklist ${PATH}/ksu | 260 | blacklist ${PATH}/su |
259 | blacklist ${PATH}/chsh | 261 | blacklist ${PATH}/sudo |
260 | blacklist ${PATH}/chfn | 262 | blacklist ${PATH}/umount |
261 | blacklist ${PATH}/chage | ||
262 | blacklist ${PATH}/expiry | ||
263 | blacklist ${PATH}/unix_chkpwd | 263 | blacklist ${PATH}/unix_chkpwd |
264 | blacklist ${PATH}/procmail | 264 | blacklist ${PATH}/xev |
265 | blacklist ${PATH}/mount.ecryptfs_private | 265 | blacklist ${PATH}/xinput |
266 | 266 | ||
267 | # other SUID binaries | 267 | # other SUID binaries |
268 | blacklist /usr/lib/virtualbox | 268 | blacklist /usr/lib/virtualbox |
@@ -276,11 +276,9 @@ blacklist /tmp/tmux-* | |||
276 | # disable terminals running as server resulting in sandbox escape | 276 | # disable terminals running as server resulting in sandbox escape |
277 | blacklist ${PATH}/gnome-terminal | 277 | blacklist ${PATH}/gnome-terminal |
278 | blacklist ${PATH}/gnome-terminal.wrapper | 278 | blacklist ${PATH}/gnome-terminal.wrapper |
279 | blacklist ${PATH}/xfce4-terminal | 279 | blacklist ${PATH}/lilyterm |
280 | blacklist ${PATH}/xfce4-terminal.wrapper | ||
281 | blacklist ${PATH}/mate-terminal | 280 | blacklist ${PATH}/mate-terminal |
282 | blacklist ${PATH}/mate-terminal.wrapper | 281 | blacklist ${PATH}/mate-terminal.wrapper |
283 | blacklist ${PATH}/lilyterm | ||
284 | blacklist ${PATH}/pantheon-terminal | 282 | blacklist ${PATH}/pantheon-terminal |
285 | blacklist ${PATH}/roxterm | 283 | blacklist ${PATH}/roxterm |
286 | blacklist ${PATH}/roxterm-config | 284 | blacklist ${PATH}/roxterm-config |
@@ -288,12 +286,14 @@ blacklist ${PATH}/terminix | |||
288 | blacklist ${PATH}/tilix | 286 | blacklist ${PATH}/tilix |
289 | blacklist ${PATH}/urxvtc | 287 | blacklist ${PATH}/urxvtc |
290 | blacklist ${PATH}/urxvtcd | 288 | blacklist ${PATH}/urxvtcd |
291 | # konsole doesn't seem to have this problem - last tested on Ubuntu 16.04 | 289 | blacklist ${PATH}/xfce4-terminal |
290 | blacklist ${PATH}/xfce4-terminal.wrapper | ||
292 | # blacklist ${PATH}/konsole | 291 | # blacklist ${PATH}/konsole |
292 | # konsole doesn't seem to have this problem - last tested on Ubuntu 16.04 | ||
293 | 293 | ||
294 | # kernel files | 294 | # kernel files |
295 | blacklist /vmlinuz* | ||
296 | blacklist /initrd* | 295 | blacklist /initrd* |
296 | blacklist /vmlinuz* | ||
297 | 297 | ||
298 | # complement noexec ${HOME} and noexec /tmp | 298 | # complement noexec ${HOME} and noexec /tmp |
299 | noexec ${HOME}/.config/pulse | 299 | noexec ${HOME}/.config/pulse |
diff --git a/etc/disable-devel.inc b/etc/disable-devel.inc index a546847f7..9ff58ae2a 100644 --- a/etc/disable-devel.inc +++ b/etc/disable-devel.inc | |||
@@ -1,30 +1,30 @@ | |||
1 | # This file is overwritten during software install. | 1 | # This file is overwritten during software install. |
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include /etc/firejail/disable-devel.local | 3 | include /etc/firejail/disable-devel.local |
4 | 4 | ||
5 | # development tools | 5 | # development tools |
6 | 6 | ||
7 | # GCC | 7 | # GCC |
8 | blacklist /usr/include | ||
9 | #blacklist /usr/lib/gcc - seems to create problems on Gentoo | 8 | #blacklist /usr/lib/gcc - seems to create problems on Gentoo |
10 | blacklist /usr/bin/gcc* | ||
11 | blacklist /usr/bin/cpp* | ||
12 | blacklist /usr/bin/c9* | ||
13 | blacklist /usr/bin/c8* | ||
14 | blacklist /usr/bin/c++* | ||
15 | blacklist /usr/bin/as | 9 | blacklist /usr/bin/as |
16 | blacklist /usr/bin/ld | 10 | blacklist /usr/bin/c++* |
17 | blacklist /usr/bin/gdb | 11 | blacklist /usr/bin/c8* |
12 | blacklist /usr/bin/c9* | ||
13 | blacklist /usr/bin/cpp* | ||
18 | blacklist /usr/bin/g++* | 14 | blacklist /usr/bin/g++* |
15 | blacklist /usr/bin/gcc* | ||
16 | blacklist /usr/bin/gdb | ||
17 | blacklist /usr/bin/ld | ||
18 | blacklist /usr/bin/x86_64-unknown-linux-gnu-gcc* | ||
19 | blacklist /usr/bin/x86_64-linux-gnu-g++* | 19 | blacklist /usr/bin/x86_64-linux-gnu-g++* |
20 | blacklist /usr/bin/x86_64-linux-gnu-gcc* | 20 | blacklist /usr/bin/x86_64-linux-gnu-gcc* |
21 | blacklist /usr/bin/x86_64-unknown-linux-gnu-g++* | 21 | blacklist /usr/bin/x86_64-unknown-linux-gnu-g++* |
22 | blacklist /usr/bin/x86_64-unknown-linux-gnu-gcc* | 22 | blacklist /usr/include |
23 | 23 | ||
24 | # clang/llvm | 24 | # clang/llvm |
25 | blacklist /usr/bin/clang* | 25 | blacklist /usr/bin/clang* |
26 | blacklist /usr/bin/llvm* | ||
27 | blacklist /usr/bin/lldb* | 26 | blacklist /usr/bin/lldb* |
27 | blacklist /usr/bin/llvm* | ||
28 | blacklist /usr/lib/llvm* | 28 | blacklist /usr/lib/llvm* |
29 | 29 | ||
30 | # tcc - Tiny C Compiler | 30 | # tcc - Tiny C Compiler |
@@ -37,15 +37,15 @@ blacklist /usr/bin/valgrind* | |||
37 | blacklist /usr/lib/valgrind | 37 | blacklist /usr/lib/valgrind |
38 | 38 | ||
39 | # Perl | 39 | # Perl |
40 | blacklist /usr/bin/perl | ||
41 | blacklist /usr/bin/cpan* | 40 | blacklist /usr/bin/cpan* |
42 | blacklist /usr/share/perl* | 41 | blacklist /usr/bin/perl |
43 | blacklist /usr/lib/perl* | 42 | blacklist /usr/lib/perl* |
43 | blacklist /usr/share/perl* | ||
44 | 44 | ||
45 | # PHP | 45 | # PHP |
46 | blacklist /usr/bin/php* | 46 | blacklist /usr/bin/php* |
47 | blacklist /usr/share/php* | ||
48 | blacklist /usr/lib/php* | 47 | blacklist /usr/lib/php* |
48 | blacklist /usr/share/php* | ||
49 | 49 | ||
50 | # Ruby | 50 | # Ruby |
51 | blacklist /usr/bin/ruby | 51 | blacklist /usr/bin/ruby |
@@ -54,22 +54,22 @@ blacklist /usr/lib/ruby | |||
54 | # Programs using python: deluge, firefox addons, filezilla, cherrytree, xchat, hexchat, libreoffice, scribus | 54 | # Programs using python: deluge, firefox addons, filezilla, cherrytree, xchat, hexchat, libreoffice, scribus |
55 | # Python 2 | 55 | # Python 2 |
56 | #blacklist /usr/bin/python2* | 56 | #blacklist /usr/bin/python2* |
57 | #blacklist /usr/include/python2* | ||
57 | #blacklist /usr/lib/python2* | 58 | #blacklist /usr/lib/python2* |
58 | #blacklist /usr/local/lib/python2* | 59 | #blacklist /usr/local/lib/python2* |
59 | #blacklist /usr/include/python2* | ||
60 | #blacklist /usr/share/python2* | 60 | #blacklist /usr/share/python2* |
61 | # | 61 | # |
62 | # Python 3 | 62 | # Python 3 |
63 | #blacklist /usr/bin/python3* | 63 | #blacklist /usr/bin/python3* |
64 | #blacklist /usr/include/python3* | ||
64 | #blacklist /usr/lib/python3* | 65 | #blacklist /usr/lib/python3* |
65 | #blacklist /usr/local/lib/python3* | 66 | #blacklist /usr/local/lib/python3* |
66 | #blacklist /usr/share/python3* | 67 | #blacklist /usr/share/python3* |
67 | #blacklist /usr/include/python3* | ||
68 | 68 | ||
69 | #Go | 69 | #Go |
70 | blacklist /usr/bin/gccgo | ||
70 | blacklist /usr/bin/go | 71 | blacklist /usr/bin/go |
71 | blacklist /usr/bin/gofmt | 72 | blacklist /usr/bin/gofmt |
72 | blacklist /usr/bin/gccgo | ||
73 | 73 | ||
74 | #Rust | 74 | #Rust |
75 | blacklist /usr/bin/rust-gdb | 75 | blacklist /usr/bin/rust-gdb |
diff --git a/etc/disable-passwdmgr.inc b/etc/disable-passwdmgr.inc index ae485c4c5..9507d3feb 100644 --- a/etc/disable-passwdmgr.inc +++ b/etc/disable-passwdmgr.inc | |||
@@ -1,9 +1,7 @@ | |||
1 | # This file is overwritten during software install. | 1 | # This file is overwritten during software install. |
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include /etc/firejail/disable-passwdmgr.local | 3 | include /etc/firejail/disable-passwdmgr.local |
4 | 4 | ||
5 | blacklist ${HOME}/.local/share/KeePass | ||
6 | blacklist ${HOME}/.local/share/keepass | ||
7 | blacklist ${HOME}/.config/KeePass | 5 | blacklist ${HOME}/.config/KeePass |
8 | blacklist ${HOME}/.config/keepass | 6 | blacklist ${HOME}/.config/keepass |
9 | blacklist ${HOME}/.config/keepassx | 7 | blacklist ${HOME}/.config/keepassx |
@@ -12,4 +10,6 @@ blacklist ${HOME}/.keepass | |||
12 | blacklist ${HOME}/.keepassx | 10 | blacklist ${HOME}/.keepassx |
13 | blacklist ${HOME}/.keepassxc | 11 | blacklist ${HOME}/.keepassxc |
14 | blacklist ${HOME}/.lastpass | 12 | blacklist ${HOME}/.lastpass |
13 | blacklist ${HOME}/.local/share/KeePass | ||
14 | blacklist ${HOME}/.local/share/keepass | ||
15 | blacklist ${HOME}/.password-store | 15 | blacklist ${HOME}/.password-store |
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index c67a0b378..a54d2a739 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc | |||
@@ -7,6 +7,7 @@ blacklist ${HOME}/.8pecxstudios | |||
7 | blacklist ${HOME}/.AndroidStudio* | 7 | blacklist ${HOME}/.AndroidStudio* |
8 | blacklist ${HOME}/.Atom | 8 | blacklist ${HOME}/.Atom |
9 | blacklist ${HOME}/.FBReader | 9 | blacklist ${HOME}/.FBReader |
10 | blacklist ${HOME}/.FontForge | ||
10 | blacklist ${HOME}/.IdeaIC* | 11 | blacklist ${HOME}/.IdeaIC* |
11 | blacklist ${HOME}/.LuminanceHDR | 12 | blacklist ${HOME}/.LuminanceHDR |
12 | blacklist ${HOME}/.Mathematica | 13 | blacklist ${HOME}/.Mathematica |
@@ -28,10 +29,10 @@ blacklist ${HOME}/.bibletime | |||
28 | blacklist ${HOME}/.claws-mail | 29 | blacklist ${HOME}/.claws-mail |
29 | blacklist ${HOME}/.config/0ad | 30 | blacklist ${HOME}/.config/0ad |
30 | blacklist ${HOME}/.config/2048-qt | 31 | blacklist ${HOME}/.config/2048-qt |
31 | blacklist ${HOME}/.config/akregatorrc | ||
32 | blacklist ${HOME}/.config/Atom | 32 | blacklist ${HOME}/.config/Atom |
33 | blacklist ${HOME}/.config/Audaciousrc | 33 | blacklist ${HOME}/.config/Audaciousrc |
34 | blacklist ${HOME}/.config/Brackets | 34 | blacklist ${HOME}/.config/Brackets |
35 | blacklist ${HOME}/.config/Clementine | ||
35 | blacklist ${HOME}/.config/Cryptocat | 36 | blacklist ${HOME}/.config/Cryptocat |
36 | blacklist ${HOME}/.config/Franz | 37 | blacklist ${HOME}/.config/Franz |
37 | blacklist ${HOME}/.config/Gitter | 38 | blacklist ${HOME}/.config/Gitter |
@@ -52,6 +53,7 @@ blacklist ${HOME}/.config/Slack | |||
52 | blacklist ${HOME}/.config/Thunar | 53 | blacklist ${HOME}/.config/Thunar |
53 | blacklist ${HOME}/.config/VirtualBox | 54 | blacklist ${HOME}/.config/VirtualBox |
54 | blacklist ${HOME}/.config/Wire | 55 | blacklist ${HOME}/.config/Wire |
56 | blacklist ${HOME}/.config/akregatorrc | ||
55 | blacklist ${HOME}/.config/ardour4 | 57 | blacklist ${HOME}/.config/ardour4 |
56 | blacklist ${HOME}/.config/ardour5 | 58 | blacklist ${HOME}/.config/ardour5 |
57 | blacklist ${HOME}/.config/arkrc | 59 | blacklist ${HOME}/.config/arkrc |
@@ -90,8 +92,8 @@ blacklist ${HOME}/.config/flowblade | |||
90 | blacklist ${HOME}/.config/gajim | 92 | blacklist ${HOME}/.config/gajim |
91 | blacklist ${HOME}/.config/galculator | 93 | blacklist ${HOME}/.config/galculator |
92 | blacklist ${HOME}/.config/geany | 94 | blacklist ${HOME}/.config/geany |
93 | blacklist ${HOME}/.config/geeqie | ||
94 | blacklist ${HOME}/.config/gedit | 95 | blacklist ${HOME}/.config/gedit |
96 | blacklist ${HOME}/.config/geeqie | ||
95 | blacklist ${HOME}/.config/ghb | 97 | blacklist ${HOME}/.config/ghb |
96 | blacklist ${HOME}/.config/globaltime | 98 | blacklist ${HOME}/.config/globaltime |
97 | blacklist ${HOME}/.config/google-chrome | 99 | blacklist ${HOME}/.config/google-chrome |
@@ -115,9 +117,9 @@ blacklist ${HOME}/.config/ktorrentrc | |||
115 | blacklist ${HOME}/.config/leafpad | 117 | blacklist ${HOME}/.config/leafpad |
116 | blacklist ${HOME}/.config/libreoffice | 118 | blacklist ${HOME}/.config/libreoffice |
117 | blacklist ${HOME}/.config/lximage-qt | 119 | blacklist ${HOME}/.config/lximage-qt |
120 | blacklist ${HOME}/.config/mate-calc | ||
118 | blacklist ${HOME}/.config/mate/eom | 121 | blacklist ${HOME}/.config/mate/eom |
119 | blacklist ${HOME}/.config/mate/mate-dictionary | 122 | blacklist ${HOME}/.config/mate/mate-dictionary |
120 | blacklist ${HOME}/.config/mate-calc | ||
121 | blacklist ${HOME}/.config/midori | 123 | blacklist ${HOME}/.config/midori |
122 | blacklist ${HOME}/.config/mpv | 124 | blacklist ${HOME}/.config/mpv |
123 | blacklist ${HOME}/.config/mupen64plus | 125 | blacklist ${HOME}/.config/mupen64plus |
@@ -134,7 +136,6 @@ blacklist ${HOME}/.config/pcmanfm | |||
134 | blacklist ${HOME}/.config/pix | 136 | blacklist ${HOME}/.config/pix |
135 | blacklist ${HOME}/.config/pluma | 137 | blacklist ${HOME}/.config/pluma |
136 | blacklist ${HOME}/.config/psi+ | 138 | blacklist ${HOME}/.config/psi+ |
137 | blacklist ${HOME}/.config/ristretto | ||
138 | blacklist ${HOME}/.config/qBittorrent | 139 | blacklist ${HOME}/.config/qBittorrent |
139 | blacklist ${HOME}/.config/qBittorrentrc | 140 | blacklist ${HOME}/.config/qBittorrentrc |
140 | blacklist ${HOME}/.config/qpdfview | 141 | blacklist ${HOME}/.config/qpdfview |
@@ -143,6 +144,7 @@ blacklist ${HOME}/.config/qupzilla | |||
143 | blacklist ${HOME}/.config/qutebrowser | 144 | blacklist ${HOME}/.config/qutebrowser |
144 | blacklist ${HOME}/.config/ranger | 145 | blacklist ${HOME}/.config/ranger |
145 | blacklist ${HOME}/.config/redshift.conf | 146 | blacklist ${HOME}/.config/redshift.conf |
147 | blacklist ${HOME}/.config/ristretto | ||
146 | blacklist ${HOME}/.config/scribus | 148 | blacklist ${HOME}/.config/scribus |
147 | blacklist ${HOME}/.config/skypeforlinux | 149 | blacklist ${HOME}/.config/skypeforlinux |
148 | blacklist ${HOME}/.config/slimjet | 150 | blacklist ${HOME}/.config/slimjet |
@@ -165,9 +167,9 @@ blacklist ${HOME}/.config/wireshark | |||
165 | blacklist ${HOME}/.config/xchat | 167 | blacklist ${HOME}/.config/xchat |
166 | blacklist ${HOME}/.config/xed | 168 | blacklist ${HOME}/.config/xed |
167 | blacklist ${HOME}/.config/xfburn | 169 | blacklist ${HOME}/.config/xfburn |
168 | blacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml | ||
169 | blacklist ${HOME}/.config/xfce4/xfce4-notes.rc | ||
170 | blacklist ${HOME}/.config/xfce4/xfce4-notes.gtkrc | 170 | blacklist ${HOME}/.config/xfce4/xfce4-notes.gtkrc |
171 | blacklist ${HOME}/.config/xfce4/xfce4-notes.rc | ||
172 | blacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml | ||
171 | blacklist ${HOME}/.config/xfce4-dict | 173 | blacklist ${HOME}/.config/xfce4-dict |
172 | blacklist ${HOME}/.config/xiaoyong | 174 | blacklist ${HOME}/.config/xiaoyong |
173 | blacklist ${HOME}/.config/xmms2 | 175 | blacklist ${HOME}/.config/xmms2 |
@@ -185,13 +187,12 @@ blacklist ${HOME}/.dropbox-dist | |||
185 | blacklist ${HOME}/.electrum* | 187 | blacklist ${HOME}/.electrum* |
186 | blacklist ${HOME}/.elinks | 188 | blacklist ${HOME}/.elinks |
187 | blacklist ${HOME}/.emacs | 189 | blacklist ${HOME}/.emacs |
188 | blacklist ${HOME}/.emacs.d | ||
189 | blacklist ${HOME}/.filezilla | ||
190 | blacklist ${HOME}/.emacs | 190 | blacklist ${HOME}/.emacs |
191 | blacklist ${HOME}/.emacs.d | ||
191 | blacklist ${HOME}/.etr | 192 | blacklist ${HOME}/.etr |
193 | blacklist ${HOME}/.filezilla | ||
192 | blacklist ${HOME}/.flowblade | 194 | blacklist ${HOME}/.flowblade |
193 | blacklist ${HOME}/.fltk | 195 | blacklist ${HOME}/.fltk |
194 | blacklist ${HOME}/.FontForge | ||
195 | blacklist ${HOME}/.frozen-bubble | 196 | blacklist ${HOME}/.frozen-bubble |
196 | blacklist ${HOME}/.gimp* | 197 | blacklist ${HOME}/.gimp* |
197 | blacklist ${HOME}/.git-credential-cache | 198 | blacklist ${HOME}/.git-credential-cache |
@@ -208,25 +209,6 @@ blacklist ${HOME}/.icedove | |||
208 | blacklist ${HOME}/.inkscape | 209 | blacklist ${HOME}/.inkscape |
209 | blacklist ${HOME}/.java | 210 | blacklist ${HOME}/.java |
210 | blacklist ${HOME}/.jitsi | 211 | blacklist ${HOME}/.jitsi |
211 | blacklist ${HOME}/.kde4/share/apps/gwenview | ||
212 | blacklist ${HOME}/.kde4/share/apps/kcookiejar | ||
213 | blacklist ${HOME}/.kde4/share/apps/khtml | ||
214 | blacklist ${HOME}/.kde4/share/apps/konqsidebartng | ||
215 | blacklist ${HOME}/.kde4/share/apps/konqueror | ||
216 | blacklist ${HOME}/.kde4/share/apps/okular | ||
217 | blacklist ${HOME}/.kde4/share/config/baloofilerc | ||
218 | blacklist ${HOME}/.kde4/share/config/baloorc | ||
219 | blacklist ${HOME}/.kde4/share/config/gwenviewrc | ||
220 | blacklist ${HOME}/.kde4/share/config/digikam | ||
221 | blacklist ${HOME}/.kde4/share/config/k3brc | ||
222 | blacklist ${HOME}/.kde4/share/config/kcookiejarrc | ||
223 | blacklist ${HOME}/.kde4/share/config/khtmlrc | ||
224 | blacklist ${HOME}/.kde4/share/config/konq_history | ||
225 | blacklist ${HOME}/.kde4/share/config/konqsidebartngrc | ||
226 | blacklist ${HOME}/.kde4/share/config/konquerorrc | ||
227 | blacklist ${HOME}/.kde4/share/config/okularpartrc | ||
228 | blacklist ${HOME}/.kde4/share/config/okularrc | ||
229 | blacklist ${HOME}/.kde4/share/config/ktorrentrc | ||
230 | blacklist ${HOME}/.kde/share/apps/gwenview | 212 | blacklist ${HOME}/.kde/share/apps/gwenview |
231 | blacklist ${HOME}/.kde/share/apps/kcookiejar | 213 | blacklist ${HOME}/.kde/share/apps/kcookiejar |
232 | blacklist ${HOME}/.kde/share/apps/khtml | 214 | blacklist ${HOME}/.kde/share/apps/khtml |
@@ -243,9 +225,28 @@ blacklist ${HOME}/.kde/share/config/khtmlrc | |||
243 | blacklist ${HOME}/.kde/share/config/konq_history | 225 | blacklist ${HOME}/.kde/share/config/konq_history |
244 | blacklist ${HOME}/.kde/share/config/konqsidebartngrc | 226 | blacklist ${HOME}/.kde/share/config/konqsidebartngrc |
245 | blacklist ${HOME}/.kde/share/config/konquerorrc | 227 | blacklist ${HOME}/.kde/share/config/konquerorrc |
228 | blacklist ${HOME}/.kde/share/config/ktorrentrc | ||
246 | blacklist ${HOME}/.kde/share/config/okularpartrc | 229 | blacklist ${HOME}/.kde/share/config/okularpartrc |
247 | blacklist ${HOME}/.kde/share/config/okularrc | 230 | blacklist ${HOME}/.kde/share/config/okularrc |
248 | blacklist ${HOME}/.kde/share/config/ktorrentrc | 231 | blacklist ${HOME}/.kde4/share/config/baloorc |
232 | blacklist ${HOME}/.kde4/share/config/baloofilerc | ||
233 | blacklist ${HOME}/.kde4/share/apps/okular | ||
234 | blacklist ${HOME}/.kde4/share/apps/konqueror | ||
235 | blacklist ${HOME}/.kde4/share/apps/konqsidebartng | ||
236 | blacklist ${HOME}/.kde4/share/apps/khtml | ||
237 | blacklist ${HOME}/.kde4/share/apps/kcookiejar | ||
238 | blacklist ${HOME}/.kde4/share/config/digikam | ||
239 | blacklist ${HOME}/.kde4/share/apps/gwenview | ||
240 | blacklist ${HOME}/.kde4/share/config/kcookiejarrc | ||
241 | blacklist ${HOME}/.kde4/share/config/khtmlrc | ||
242 | blacklist ${HOME}/.kde4/share/config/konq_history | ||
243 | blacklist ${HOME}/.kde4/share/config/konqsidebartngrc | ||
244 | blacklist ${HOME}/.kde4/share/config/konquerorrc | ||
245 | blacklist ${HOME}/.kde4/share/config/okularpartrc | ||
246 | blacklist ${HOME}/.kde4/share/config/okularrc | ||
247 | blacklist ${HOME}/.kde4/share/config/ktorrentrc | ||
248 | blacklist ${HOME}/.kde4/share/config/gwenviewrc | ||
249 | blacklist ${HOME}/.kde4/share/config/k3brc | ||
249 | blacklist ${HOME}/.killingfloor | 250 | blacklist ${HOME}/.killingfloor |
250 | blacklist ${HOME}/.kino-history | 251 | blacklist ${HOME}/.kino-history |
251 | blacklist ${HOME}/.kinorc | 252 | blacklist ${HOME}/.kinorc |
@@ -257,7 +258,6 @@ blacklist ${HOME}/.local/.share/maps-places.json | |||
257 | blacklist ${HOME}/.local/lib/python2.7/site-packages | 258 | blacklist ${HOME}/.local/lib/python2.7/site-packages |
258 | blacklist ${HOME}/.local/share/0ad | 259 | blacklist ${HOME}/.local/share/0ad |
259 | blacklist ${HOME}/.local/share/3909/PapersPlease | 260 | blacklist ${HOME}/.local/share/3909/PapersPlease |
260 | blacklist ${HOME}/.local/share/akregator | ||
261 | blacklist ${HOME}/.local/share/Empathy | 261 | blacklist ${HOME}/.local/share/Empathy |
262 | blacklist ${HOME}/.local/share/JetBrains | 262 | blacklist ${HOME}/.local/share/JetBrains |
263 | blacklist ${HOME}/.local/share/Mumble | 263 | blacklist ${HOME}/.local/share/Mumble |
@@ -267,6 +267,7 @@ blacklist ${HOME}/.local/share/Steam | |||
267 | blacklist ${HOME}/.local/share/SuperHexagon | 267 | blacklist ${HOME}/.local/share/SuperHexagon |
268 | blacklist ${HOME}/.local/share/Terraria | 268 | blacklist ${HOME}/.local/share/Terraria |
269 | blacklist ${HOME}/.local/share/TpLogger | 269 | blacklist ${HOME}/.local/share/TpLogger |
270 | blacklist ${HOME}/.local/share/akregator | ||
270 | blacklist ${HOME}/.local/share/aspyr-media | 271 | blacklist ${HOME}/.local/share/aspyr-media |
271 | blacklist ${HOME}/.local/share/baloo | 272 | blacklist ${HOME}/.local/share/baloo |
272 | blacklist ${HOME}/.local/share/caja-python | 273 | blacklist ${HOME}/.local/share/caja-python |
@@ -287,8 +288,8 @@ blacklist ${HOME}/.local/share/gnome-music | |||
287 | blacklist ${HOME}/.local/share/gnome-photos | 288 | blacklist ${HOME}/.local/share/gnome-photos |
288 | blacklist ${HOME}/.local/share/gwenview | 289 | blacklist ${HOME}/.local/share/gwenview |
289 | blacklist ${HOME}/.local/share/kate | 290 | blacklist ${HOME}/.local/share/kate |
290 | blacklist ${HOME}/.local/share/kwrite | ||
291 | blacklist ${HOME}/.local/share/ktorrentrc | 291 | blacklist ${HOME}/.local/share/ktorrentrc |
292 | blacklist ${HOME}/.local/share/kwrite | ||
292 | blacklist ${HOME}/.local/share/lollypop | 293 | blacklist ${HOME}/.local/share/lollypop |
293 | blacklist ${HOME}/.local/share/meld | 294 | blacklist ${HOME}/.local/share/meld |
294 | blacklist ${HOME}/.local/share/multimc5 | 295 | blacklist ${HOME}/.local/share/multimc5 |
@@ -297,6 +298,7 @@ blacklist ${HOME}/.local/share/nautilus | |||
297 | blacklist ${HOME}/.local/share/nautilus-python | 298 | blacklist ${HOME}/.local/share/nautilus-python |
298 | blacklist ${HOME}/.local/share/nemo | 299 | blacklist ${HOME}/.local/share/nemo |
299 | blacklist ${HOME}/.local/share/nemo-python | 300 | blacklist ${HOME}/.local/share/nemo-python |
301 | blacklist ${HOME}/.local/share/notes | ||
300 | blacklist ${HOME}/.local/share/okular | 302 | blacklist ${HOME}/.local/share/okular |
301 | blacklist ${HOME}/.local/share/orage | 303 | blacklist ${HOME}/.local/share/orage |
302 | blacklist ${HOME}/.local/share/org.kde.gwenview | 304 | blacklist ${HOME}/.local/share/org.kde.gwenview |
@@ -314,7 +316,6 @@ blacklist ${HOME}/.local/share/vpltd | |||
314 | blacklist ${HOME}/.local/share/vulkan | 316 | blacklist ${HOME}/.local/share/vulkan |
315 | blacklist ${HOME}/.local/share/wesnoth | 317 | blacklist ${HOME}/.local/share/wesnoth |
316 | blacklist ${HOME}/.local/share/xplayer | 318 | blacklist ${HOME}/.local/share/xplayer |
317 | blacklist ${HOME}/.local/share/notes | ||
318 | blacklist ${HOME}/.local/share/xreader | 319 | blacklist ${HOME}/.local/share/xreader |
319 | blacklist ${HOME}/.local/share/zathura | 320 | blacklist ${HOME}/.local/share/zathura |
320 | blacklist ${HOME}/.lv2 | 321 | blacklist ${HOME}/.lv2 |
@@ -356,6 +357,7 @@ blacklist ${HOME}/.tconn | |||
356 | blacklist ${HOME}/.thunderbird | 357 | blacklist ${HOME}/.thunderbird |
357 | blacklist ${HOME}/.tooling | 358 | blacklist ${HOME}/.tooling |
358 | blacklist ${HOME}/.ts3client | 359 | blacklist ${HOME}/.ts3client |
360 | blacklist ${HOME}/.tuxguitar* | ||
359 | blacklist ${HOME}/.unknow-horizons | 361 | blacklist ${HOME}/.unknow-horizons |
360 | blacklist ${HOME}/.viking | 362 | blacklist ${HOME}/.viking |
361 | blacklist ${HOME}/.viking-maps | 363 | blacklist ${HOME}/.viking-maps |
@@ -385,7 +387,6 @@ blacklist ${HOME}/.cache/borg | |||
385 | blacklist ${HOME}/.cache/calibre | 387 | blacklist ${HOME}/.cache/calibre |
386 | blacklist ${HOME}/.cache/champlain | 388 | blacklist ${HOME}/.cache/champlain |
387 | blacklist ${HOME}/.cache/chromium | 389 | blacklist ${HOME}/.cache/chromium |
388 | blacklist ${HOME}/.cache/qupzilla | ||
389 | blacklist ${HOME}/.cache/chromium-dev | 390 | blacklist ${HOME}/.cache/chromium-dev |
390 | blacklist ${HOME}/.cache/darktable | 391 | blacklist ${HOME}/.cache/darktable |
391 | blacklist ${HOME}/.cache/epiphany | 392 | blacklist ${HOME}/.cache/epiphany |
@@ -407,6 +408,7 @@ blacklist ${HOME}/.cache/opera-beta | |||
407 | blacklist ${HOME}/.cache/org.gnome.Books | 408 | blacklist ${HOME}/.cache/org.gnome.Books |
408 | blacklist ${HOME}/.cache/peek | 409 | blacklist ${HOME}/.cache/peek |
409 | blacklist ${HOME}/.cache/qBittorrent | 410 | blacklist ${HOME}/.cache/qBittorrent |
411 | blacklist ${HOME}/.cache/qupzilla | ||
410 | blacklist ${HOME}/.cache/qutebrowser | 412 | blacklist ${HOME}/.cache/qutebrowser |
411 | blacklist ${HOME}/.cache/simple-scan | 413 | blacklist ${HOME}/.cache/simple-scan |
412 | blacklist ${HOME}/.cache/slimjet | 414 | blacklist ${HOME}/.cache/slimjet |
@@ -417,5 +419,5 @@ blacklist ${HOME}/.cache/torbrowser | |||
417 | blacklist ${HOME}/.cache/transmission | 419 | blacklist ${HOME}/.cache/transmission |
418 | blacklist ${HOME}/.cache/vivaldi | 420 | blacklist ${HOME}/.cache/vivaldi |
419 | blacklist ${HOME}/.cache/wesnoth | 421 | blacklist ${HOME}/.cache/wesnoth |
420 | blacklist ${HOME}/.cache/xreader | ||
421 | blacklist ${HOME}/.cache/xmms2 | 422 | blacklist ${HOME}/.cache/xmms2 |
423 | blacklist ${HOME}/.cache/xreader | ||
diff --git a/etc/display.profile b/etc/display.profile index ff5d3d2b9..44d37d5b2 100644 --- a/etc/display.profile +++ b/etc/display.profile | |||
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | net none | 15 | net none |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
19 | nosound | 20 | nosound |
21 | notv | ||
20 | protocol unix | 22 | protocol unix |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/dnscrypt-proxy.profile b/etc/dnscrypt-proxy.profile index 075b7ea15..d82efef04 100644 --- a/etc/dnscrypt-proxy.profile +++ b/etc/dnscrypt-proxy.profile | |||
@@ -14,7 +14,9 @@ include /etc/firejail/disable-passwdmgr.inc | |||
14 | include /etc/firejail/disable-programs.inc | 14 | include /etc/firejail/disable-programs.inc |
15 | 15 | ||
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nosound | 18 | nosound |
19 | notv | ||
18 | seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open | 20 | seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open |
19 | 21 | ||
20 | private | 22 | private |
diff --git a/etc/dnsmasq.profile b/etc/dnsmasq.profile index 834805af9..bf52a5d8a 100644 --- a/etc/dnsmasq.profile +++ b/etc/dnsmasq.profile | |||
@@ -16,8 +16,10 @@ include /etc/firejail/disable-programs.inc | |||
16 | caps | 16 | caps |
17 | netfilter | 17 | netfilter |
18 | no3d | 18 | no3d |
19 | nodvd | ||
19 | nonewprivs | 20 | nonewprivs |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | protocol unix,inet,inet6,netlink | 23 | protocol unix,inet,inet6,netlink |
22 | seccomp | 24 | seccomp |
23 | 25 | ||
diff --git a/etc/dolphin.profile b/etc/dolphin.profile index 93acbd09e..7566e927b 100644 --- a/etc/dolphin.profile +++ b/etc/dolphin.profile | |||
@@ -14,18 +14,21 @@ noblacklist ~/.local/share/dolphin | |||
14 | include /etc/firejail/disable-common.inc | 14 | include /etc/firejail/disable-common.inc |
15 | include /etc/firejail/disable-devel.inc | 15 | include /etc/firejail/disable-devel.inc |
16 | include /etc/firejail/disable-passwdmgr.inc | 16 | include /etc/firejail/disable-passwdmgr.inc |
17 | # dolphin needs to be able to start arbitrary applications so we cannot blacklist their files | ||
17 | # include /etc/firejail/disable-programs.inc | 18 | # include /etc/firejail/disable-programs.inc |
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
20 | netfilter | 21 | netfilter |
22 | nodvd | ||
21 | nogroups | 23 | nogroups |
22 | nonewprivs | 24 | nonewprivs |
23 | noroot | 25 | noroot |
26 | notv | ||
27 | novideo | ||
24 | protocol unix | 28 | protocol unix |
25 | seccomp | 29 | seccomp |
26 | shell none | 30 | shell none |
27 | 31 | ||
28 | # dolphin needs to be able to start arbitrary applications so we cannot blacklist their files | ||
29 | # private-bin | 32 | # private-bin |
30 | # private-dev | 33 | # private-dev |
31 | # private-etc | 34 | # private-etc |
diff --git a/etc/dosbox.profile b/etc/dosbox.profile index ff8e26bf9..bec2960f1 100644 --- a/etc/dosbox.profile +++ b/etc/dosbox.profile | |||
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
21 | notv | ||
20 | protocol unix,inet,inet6 | 22 | protocol unix,inet,inet6 |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/dragon.profile b/etc/dragon.profile index e8d82363b..211c2432f 100644 --- a/etc/dragon.profile +++ b/etc/dragon.profile | |||
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
21 | notv | ||
20 | novideo | 22 | novideo |
21 | protocol unix,inet,inet6 | 23 | protocol unix,inet,inet6 |
22 | seccomp | 24 | seccomp |
diff --git a/etc/dropbox.profile b/etc/dropbox.profile index 564a4054d..c8670357c 100644 --- a/etc/dropbox.profile +++ b/etc/dropbox.profile | |||
@@ -26,10 +26,12 @@ include /etc/firejail/whitelist-common.inc | |||
26 | caps.drop all | 26 | caps.drop all |
27 | netfilter | 27 | netfilter |
28 | no3d | 28 | no3d |
29 | nodvd | ||
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
31 | noroot | 32 | noroot |
32 | nosound | 33 | nosound |
34 | notv | ||
33 | novideo | 35 | novideo |
34 | protocol unix,inet,inet6 | 36 | protocol unix,inet,inet6 |
35 | seccomp | 37 | seccomp |
diff --git a/etc/ebook-viewer.profile b/etc/ebook-viewer.profile index 1e8e7bb6c..11499aba0 100644 --- a/etc/ebook-viewer.profile +++ b/etc/ebook-viewer.profile | |||
@@ -4,4 +4,5 @@ | |||
4 | 4 | ||
5 | net none | 5 | net none |
6 | 6 | ||
7 | # Redirect | ||
7 | include /etc/firejail/calibre.profile | 8 | include /etc/firejail/calibre.profile |
diff --git a/etc/electron.profile b/etc/electron.profile index 0377ac073..9b21c1bfd 100644 --- a/etc/electron.profile +++ b/etc/electron.profile | |||
@@ -12,8 +12,10 @@ include /etc/firejail/disable-programs.inc | |||
12 | 12 | ||
13 | caps.drop all | 13 | caps.drop all |
14 | netfilter | 14 | netfilter |
15 | nodvd | ||
15 | nogroups | 16 | nogroups |
16 | nonewprivs | 17 | nonewprivs |
17 | noroot | 18 | noroot |
19 | notv | ||
18 | protocol unix,inet,inet6,netlink | 20 | protocol unix,inet,inet6,netlink |
19 | seccomp | 21 | seccomp |
diff --git a/etc/elinks.profile b/etc/elinks.profile index bd2c090a6..10fd19f71 100644 --- a/etc/elinks.profile +++ b/etc/elinks.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix,inet,inet6 | 27 | protocol unix,inet,inet6 |
26 | seccomp | 28 | seccomp |
diff --git a/etc/emacs.profile b/etc/emacs.profile index db823c029..8351d6c42 100644 --- a/etc/emacs.profile +++ b/etc/emacs.profile | |||
@@ -14,8 +14,10 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
21 | notv | ||
20 | protocol unix,inet,inet6 | 22 | protocol unix,inet,inet6 |
21 | seccomp | 23 | seccomp |
diff --git a/etc/empathy.profile b/etc/empathy.profile index 5eb8d6868..b2cfa369c 100644 --- a/etc/empathy.profile +++ b/etc/empathy.profile | |||
@@ -12,8 +12,10 @@ include /etc/firejail/disable-programs.inc | |||
12 | 12 | ||
13 | caps.drop all | 13 | caps.drop all |
14 | netfilter | 14 | netfilter |
15 | nodvd | ||
15 | nogroups | 16 | nogroups |
16 | nonewprivs | 17 | nonewprivs |
17 | noroot | 18 | noroot |
19 | notv | ||
18 | protocol unix,inet,inet6 | 20 | protocol unix,inet,inet6 |
19 | seccomp | 21 | seccomp |
diff --git a/etc/enchant.profile b/etc/enchant.profile index 5b0d190fa..a7b549a4c 100644 --- a/etc/enchant.profile +++ b/etc/enchant.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | protocol unix | 23 | protocol unix |
22 | seccomp | 24 | seccomp |
23 | shell none | 25 | shell none |
diff --git a/etc/engrampa.profile b/etc/engrampa.profile index b6d8e501f..e10fd6084 100644 --- a/etc/engrampa.profile +++ b/etc/engrampa.profile | |||
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
19 | nosound | 20 | nosound |
21 | notv | ||
20 | novideo | 22 | novideo |
21 | protocol unix | 23 | protocol unix |
22 | seccomp | 24 | seccomp |
diff --git a/etc/eog.profile b/etc/eog.profile index 452bb1a36..54d5a1a88 100644 --- a/etc/eog.profile +++ b/etc/eog.profile | |||
@@ -18,10 +18,12 @@ include /etc/firejail/disable-programs.inc | |||
18 | caps.drop all | 18 | caps.drop all |
19 | net none | 19 | net none |
20 | no3d | 20 | no3d |
21 | nodvd | ||
21 | nogroups | 22 | nogroups |
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
24 | nosound | 25 | nosound |
26 | notv | ||
25 | novideo | 27 | novideo |
26 | protocol unix | 28 | protocol unix |
27 | seccomp | 29 | seccomp |
diff --git a/etc/eom.profile b/etc/eom.profile index 75a9e6764..6fd069b5c 100644 --- a/etc/eom.profile +++ b/etc/eom.profile | |||
@@ -16,10 +16,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
16 | include /etc/firejail/disable-programs.inc | 16 | include /etc/firejail/disable-programs.inc |
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
22 | nosound | 23 | nosound |
24 | notv | ||
23 | novideo | 25 | novideo |
24 | protocol unix | 26 | protocol unix |
25 | seccomp | 27 | seccomp |
diff --git a/etc/epiphany.profile b/etc/epiphany.profile index 86fddace0..0f9a9cf55 100644 --- a/etc/epiphany.profile +++ b/etc/epiphany.profile | |||
@@ -24,6 +24,8 @@ include /etc/firejail/whitelist-common.inc | |||
24 | 24 | ||
25 | caps.drop all | 25 | caps.drop all |
26 | netfilter | 26 | netfilter |
27 | nodvd | ||
27 | nonewprivs | 28 | nonewprivs |
29 | notv | ||
28 | protocol unix,inet,inet6 | 30 | protocol unix,inet,inet6 |
29 | seccomp | 31 | seccomp |
diff --git a/etc/etr.profile b/etc/etr.profile index dedc1e224..96e8b46d9 100644 --- a/etc/etr.profile +++ b/etc/etr.profile | |||
@@ -17,9 +17,11 @@ include /etc/firejail/whitelist-common.inc | |||
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | net none | 19 | net none |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
24 | notv | ||
23 | protocol unix,netlink | 25 | protocol unix,netlink |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
diff --git a/etc/evince.profile b/etc/evince.profile index 1a2b04160..5c6215bb2 100644 --- a/etc/evince.profile +++ b/etc/evince.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
diff --git a/etc/evolution.profile b/etc/evolution.profile index d41ef965a..2f7f25ff8 100644 --- a/etc/evolution.profile +++ b/etc/evolution.profile | |||
@@ -23,10 +23,12 @@ include /etc/firejail/disable-programs.inc | |||
23 | caps.drop all | 23 | caps.drop all |
24 | netfilter | 24 | netfilter |
25 | no3d | 25 | no3d |
26 | nodvd | ||
26 | nogroups | 27 | nogroups |
27 | nonewprivs | 28 | nonewprivs |
28 | noroot | 29 | noroot |
29 | nosound | 30 | nosound |
31 | notv | ||
30 | protocol unix,inet,inet6 | 32 | protocol unix,inet,inet6 |
31 | seccomp | 33 | seccomp |
32 | shell none | 34 | shell none |
diff --git a/etc/exiftool.profile b/etc/exiftool.profile index 3637fc989..565212161 100644 --- a/etc/exiftool.profile +++ b/etc/exiftool.profile | |||
@@ -20,10 +20,12 @@ include /etc/firejail/disable-programs.inc | |||
20 | caps.drop all | 20 | caps.drop all |
21 | net none | 21 | net none |
22 | no3d | 22 | no3d |
23 | nodvd | ||
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
26 | nosound | 27 | nosound |
28 | notv | ||
27 | protocol unix | 29 | protocol unix |
28 | seccomp | 30 | seccomp |
29 | shell none | 31 | shell none |
diff --git a/etc/fbreader.profile b/etc/fbreader.profile index 663ee3bbb..19d45a1d8 100644 --- a/etc/fbreader.profile +++ b/etc/fbreader.profile | |||
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
19 | nosound | 20 | nosound |
21 | notv | ||
20 | protocol unix,inet,inet6 | 22 | protocol unix,inet,inet6 |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/feh.profile b/etc/feh.profile index 1e0d7acc7..61b456e34 100644 --- a/etc/feh.profile +++ b/etc/feh.profile | |||
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | net none | 15 | net none |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
19 | nosound | 20 | nosound |
21 | notv | ||
20 | protocol unix | 22 | protocol unix |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/file-roller.profile b/etc/file-roller.profile index 173bb344f..1ecb3c632 100644 --- a/etc/file-roller.profile +++ b/etc/file-roller.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | caps.drop all | 14 | caps.drop all |
15 | net none | 15 | net none |
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/file.profile b/etc/file.profile index 99d2fd865..9a4dba7ef 100644 --- a/etc/file.profile +++ b/etc/file.profile | |||
@@ -16,9 +16,11 @@ caps.drop all | |||
16 | hostname file | 16 | hostname file |
17 | net none | 17 | net none |
18 | no3d | 18 | no3d |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
diff --git a/etc/filezilla.profile b/etc/filezilla.profile index c349a9e94..63bfd1e0d 100644 --- a/etc/filezilla.profile +++ b/etc/filezilla.profile | |||
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
19 | nosound | 20 | nosound |
21 | notv | ||
20 | protocol unix,inet,inet6 | 22 | protocol unix,inet,inet6 |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/firefox-esr.profile b/etc/firefox-esr.profile index f3400b1e1..9821c7150 100644 --- a/etc/firefox-esr.profile +++ b/etc/firefox-esr.profile | |||
@@ -6,4 +6,5 @@ include /etc/firejail/firefox-esr.local | |||
6 | include /etc/firejail/globals.local | 6 | include /etc/firejail/globals.local |
7 | 7 | ||
8 | 8 | ||
9 | # Redirect | ||
9 | include /etc/firejail/firefox.profile | 10 | include /etc/firejail/firefox.profile |
diff --git a/etc/firefox-nightly.profile b/etc/firefox-nightly.profile new file mode 100644 index 000000000..302f6eb24 --- /dev/null +++ b/etc/firefox-nightly.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile for firefox-nightly | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include /etc/firejail/firefox-nightly.local | ||
5 | # Persistent global definitions | ||
6 | include /etc/firejail/globals.local | ||
7 | |||
8 | |||
9 | # Redirect | ||
10 | include /etc/firejail/firefox.profile | ||
diff --git a/etc/firefox.profile b/etc/firefox.profile index 27f436c4f..7229ba45b 100644 --- a/etc/firefox.profile +++ b/etc/firefox.profile | |||
@@ -52,9 +52,11 @@ include /etc/firejail/whitelist-common.inc | |||
52 | 52 | ||
53 | caps.drop all | 53 | caps.drop all |
54 | netfilter | 54 | netfilter |
55 | nodvd | ||
55 | nogroups | 56 | nogroups |
56 | nonewprivs | 57 | nonewprivs |
57 | noroot | 58 | noroot |
59 | notv | ||
58 | protocol unix,inet,inet6,netlink | 60 | protocol unix,inet,inet6,netlink |
59 | seccomp | 61 | seccomp |
60 | shell none | 62 | shell none |
diff --git a/etc/flashpeak-slimjet.profile b/etc/flashpeak-slimjet.profile index be06dc460..18db4c597 100644 --- a/etc/flashpeak-slimjet.profile +++ b/etc/flashpeak-slimjet.profile | |||
@@ -15,8 +15,7 @@ noblacklist ~/.config/slimjet | |||
15 | noblacklist ~/.pki | 15 | noblacklist ~/.pki |
16 | 16 | ||
17 | include /etc/firejail/disable-common.inc | 17 | include /etc/firejail/disable-common.inc |
18 | # chromium is distributed with a perl script on Arch | 18 | include /etc/firejail/disable-devel.inc |
19 | # include /etc/firejail/disable-devel.inc | ||
20 | include /etc/firejail/disable-programs.inc | 19 | include /etc/firejail/disable-programs.inc |
21 | 20 | ||
22 | mkdir ~/.cache/slimjet | 21 | mkdir ~/.cache/slimjet |
@@ -30,7 +29,9 @@ include /etc/firejail/whitelist-common.inc | |||
30 | 29 | ||
31 | caps.drop all | 30 | caps.drop all |
32 | netfilter | 31 | netfilter |
32 | nodvd | ||
33 | nonewprivs | 33 | nonewprivs |
34 | noroot | 34 | noroot |
35 | notv | ||
35 | protocol unix,inet,inet6,netlink | 36 | protocol unix,inet,inet6,netlink |
36 | seccomp | 37 | seccomp |
diff --git a/etc/flowblade.profile b/etc/flowblade.profile index b5cc8160b..79dab0751 100644 --- a/etc/flowblade.profile +++ b/etc/flowblade.profile | |||
@@ -15,9 +15,11 @@ include /etc/firejail/disable-programs.inc | |||
15 | 15 | ||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
22 | notv | ||
21 | protocol unix,inet,inet6,netlink | 23 | protocol unix,inet,inet6,netlink |
22 | seccomp | 24 | seccomp |
23 | shell none | 25 | shell none |
diff --git a/etc/fontforge.profile b/etc/fontforge.profile index 4b43602b8..29295f8a0 100644 --- a/etc/fontforge.profile +++ b/etc/fontforge.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/fossamail.profile b/etc/fossamail.profile index d49027917..74073d8d1 100644 --- a/etc/fossamail.profile +++ b/etc/fossamail.profile | |||
@@ -17,4 +17,7 @@ whitelist ~/.fossamail | |||
17 | whitelist ~/.gnupg | 17 | whitelist ~/.gnupg |
18 | include /etc/firejail/whitelist-common.inc | 18 | include /etc/firejail/whitelist-common.inc |
19 | 19 | ||
20 | nodvd | ||
21 | notv | ||
22 | |||
20 | include /etc/firejail/firefox.profile | 23 | include /etc/firejail/firefox.profile |
diff --git a/etc/franz.profile b/etc/franz.profile index 82bdabfcd..f83b5018c 100644 --- a/etc/franz.profile +++ b/etc/franz.profile | |||
@@ -24,9 +24,11 @@ include /etc/firejail/whitelist-common.inc | |||
24 | 24 | ||
25 | caps.drop all | 25 | caps.drop all |
26 | netfilter | 26 | netfilter |
27 | nodvd | ||
27 | nogroups | 28 | nogroups |
28 | nonewprivs | 29 | nonewprivs |
29 | noroot | 30 | noroot |
31 | notv | ||
30 | protocol unix,inet,inet6,netlink | 32 | protocol unix,inet,inet6,netlink |
31 | seccomp | 33 | seccomp |
32 | shell none | 34 | shell none |
diff --git a/etc/frozen-bubble.profile b/etc/frozen-bubble.profile index b1d9798bc..40aa6d58d 100644 --- a/etc/frozen-bubble.profile +++ b/etc/frozen-bubble.profile | |||
@@ -17,9 +17,11 @@ include /etc/firejail/whitelist-common.inc | |||
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | net none | 19 | net none |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
24 | notv | ||
23 | protocol unix,netlink | 25 | protocol unix,netlink |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
diff --git a/etc/gajim.profile b/etc/gajim.profile index 451a93c31..f1929c015 100644 --- a/etc/gajim.profile +++ b/etc/gajim.profile | |||
@@ -28,9 +28,11 @@ include /etc/firejail/whitelist-common.inc | |||
28 | 28 | ||
29 | caps.drop all | 29 | caps.drop all |
30 | netfilter | 30 | netfilter |
31 | nodvd | ||
31 | nogroups | 32 | nogroups |
32 | nonewprivs | 33 | nonewprivs |
33 | noroot | 34 | noroot |
35 | notv | ||
34 | protocol unix,inet,inet6 | 36 | protocol unix,inet,inet6 |
35 | seccomp | 37 | seccomp |
36 | shell none | 38 | shell none |
diff --git a/etc/galculator.profile b/etc/galculator.profile index 48ecccd59..a2e855656 100644 --- a/etc/galculator.profile +++ b/etc/galculator.profile | |||
@@ -18,10 +18,12 @@ include /etc/firejail/whitelist-common.inc | |||
18 | 18 | ||
19 | caps.drop all | 19 | caps.drop all |
20 | net none | 20 | net none |
21 | nodvd | ||
21 | nogroups | 22 | nogroups |
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
24 | nosound | 25 | nosound |
26 | notv | ||
25 | protocol unix | 27 | protocol unix |
26 | seccomp | 28 | seccomp |
27 | shell none | 29 | shell none |
diff --git a/etc/geany.profile b/etc/geany.profile index 9ec334fc0..35e405319 100644 --- a/etc/geany.profile +++ b/etc/geany.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix,inet,inet6 | 24 | protocol unix,inet,inet6 |
23 | seccomp | 25 | seccomp |
diff --git a/etc/geary.profile b/etc/geary.profile index 3f9faf058..7878154a6 100644 --- a/etc/geary.profile +++ b/etc/geary.profile | |||
@@ -13,7 +13,6 @@ noblacklist ~/.local/share/geary | |||
13 | 13 | ||
14 | mkdir ~/.gnupg | 14 | mkdir ~/.gnupg |
15 | mkdir ~/.local/share/geary | 15 | mkdir ~/.local/share/geary |
16 | whitelist ~/.config/mimeapps.list | ||
17 | whitelist ~/.gnupg | 16 | whitelist ~/.gnupg |
18 | whitelist ~/.local/share/applications | 17 | whitelist ~/.local/share/applications |
19 | whitelist ~/.local/share/geary | 18 | whitelist ~/.local/share/geary |
@@ -22,7 +21,7 @@ include /etc/firejail/whitelist-common.inc | |||
22 | ignore private-tmp | 21 | ignore private-tmp |
23 | 22 | ||
24 | read-only ~/.config/mimeapps.list | 23 | read-only ~/.config/mimeapps.list |
25 | read-only ~/.local/share/applications | ||
26 | 24 | ||
27 | # allow browsers | 25 | # allow browsers |
26 | # Redirect | ||
28 | include /etc/firejail/firefox.profile | 27 | include /etc/firejail/firefox.profile |
diff --git a/etc/gedit.profile b/etc/gedit.profile index aa91d9518..418575e09 100644 --- a/etc/gedit.profile +++ b/etc/gedit.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | net none | 18 | net none |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | protocol unix | 26 | protocol unix |
25 | seccomp | 27 | seccomp |
26 | shell none | 28 | shell none |
diff --git a/etc/geeqie.profile b/etc/geeqie.profile index 5936787dd..c9f9d0074 100644 --- a/etc/geeqie.profile +++ b/etc/geeqie.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
15 | include /etc/firejail/disable-programs.inc | 15 | include /etc/firejail/disable-programs.inc |
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
diff --git a/etc/ghb.profile b/etc/ghb.profile index 9437cea9e..de6244a32 100644 --- a/etc/ghb.profile +++ b/etc/ghb.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/handbrake.profile | 6 | include /etc/firejail/handbrake.profile |
diff --git a/etc/gimp-2.8.profile b/etc/gimp-2.8.profile index 5228078d9..a4e04af20 100644 --- a/etc/gimp-2.8.profile +++ b/etc/gimp-2.8.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/gimp.profile | 6 | include /etc/firejail/gimp.profile |
diff --git a/etc/gimp.profile b/etc/gimp.profile index d77c4df8d..aa77d6105 100644 --- a/etc/gimp.profile +++ b/etc/gimp.profile | |||
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | net none | 15 | net none |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
19 | nosound | 20 | nosound |
21 | notv | ||
20 | protocol unix | 22 | protocol unix |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/git.profile b/etc/git.profile index a565f3b5a..92bf66b92 100644 --- a/etc/git.profile +++ b/etc/git.profile | |||
@@ -23,10 +23,12 @@ include /etc/firejail/disable-programs.inc | |||
23 | caps.drop all | 23 | caps.drop all |
24 | netfilter | 24 | netfilter |
25 | no3d | 25 | no3d |
26 | nodvd | ||
26 | nogroups | 27 | nogroups |
27 | nonewprivs | 28 | nonewprivs |
28 | noroot | 29 | noroot |
29 | nosound | 30 | nosound |
31 | notv | ||
30 | protocol unix,inet,inet6 | 32 | protocol unix,inet,inet6 |
31 | seccomp | 33 | seccomp |
32 | shell none | 34 | shell none |
diff --git a/etc/gitg.profile b/etc/gitg.profile index a66ef1f92..1a731d507 100644 --- a/etc/gitg.profile +++ b/etc/gitg.profile | |||
@@ -16,15 +16,18 @@ include /etc/firejail/disable-programs.inc | |||
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | no3d | 18 | no3d |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
22 | nosound | 23 | nosound |
24 | notv | ||
23 | novideo | 25 | novideo |
24 | protocol unix,inet,inet6 | 26 | protocol unix,inet,inet6 |
25 | seccomp | 27 | seccomp |
26 | shell none | 28 | shell none |
27 | 29 | ||
30 | private-bin gitg,git,ssh | ||
28 | private-dev | 31 | private-dev |
29 | private-tmp | 32 | private-tmp |
30 | 33 | ||
diff --git a/etc/gitter.profile b/etc/gitter.profile index 1864044d8..f92f4b167 100644 --- a/etc/gitter.profile +++ b/etc/gitter.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | protocol unix,inet,inet6,netlink | 23 | protocol unix,inet,inet6,netlink |
22 | seccomp | 24 | seccomp |
23 | shell none | 25 | shell none |
diff --git a/etc/gjs.profile b/etc/gjs.profile index 739100888..a856d35b5 100644 --- a/etc/gjs.profile +++ b/etc/gjs.profile | |||
@@ -19,9 +19,11 @@ include /etc/firejail/disable-programs.inc | |||
19 | 19 | ||
20 | caps.drop all | 20 | caps.drop all |
21 | netfilter | 21 | netfilter |
22 | nodvd | ||
22 | nogroups | 23 | nogroups |
23 | nonewprivs | 24 | nonewprivs |
24 | noroot | 25 | noroot |
26 | notv | ||
25 | protocol unix,inet,inet6 | 27 | protocol unix,inet,inet6 |
26 | seccomp | 28 | seccomp |
27 | shell none | 29 | shell none |
diff --git a/etc/globaltime.profile b/etc/globaltime.profile index 726619f26..6961a56e9 100644 --- a/etc/globaltime.profile +++ b/etc/globaltime.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix,inet,inet6 | 25 | protocol unix,inet,inet6 |
24 | seccomp | 26 | seccomp |
diff --git a/etc/gnome-2048.profile b/etc/gnome-2048.profile index 996c8e1f4..7aea3f5a8 100644 --- a/etc/gnome-2048.profile +++ b/etc/gnome-2048.profile | |||
@@ -19,8 +19,10 @@ include /etc/firejail/whitelist-common.inc | |||
19 | caps.drop all | 19 | caps.drop all |
20 | netfilter | 20 | netfilter |
21 | no3d | 21 | no3d |
22 | nodvd | ||
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix,inet,inet6 | 27 | protocol unix,inet,inet6 |
26 | seccomp | 28 | seccomp |
diff --git a/etc/gnome-books.profile b/etc/gnome-books.profile index 60bd2f68d..5c1d5f137 100644 --- a/etc/gnome-books.profile +++ b/etc/gnome-books.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix | 27 | protocol unix |
26 | seccomp | 28 | seccomp |
diff --git a/etc/gnome-calculator.profile b/etc/gnome-calculator.profile index 995415edc..4921fb0c4 100644 --- a/etc/gnome-calculator.profile +++ b/etc/gnome-calculator.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/whitelist-common.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | protocol unix,inet,inet6 | 24 | protocol unix,inet,inet6 |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
diff --git a/etc/gnome-chess.profile b/etc/gnome-chess.profile index 8fd6a2eca..688df6dfe 100644 --- a/etc/gnome-chess.profile +++ b/etc/gnome-chess.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/gnome-clocks.profile b/etc/gnome-clocks.profile index e20cbd9fe..d9bac48eb 100644 --- a/etc/gnome-clocks.profile +++ b/etc/gnome-clocks.profile | |||
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc | |||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
21 | notv | ||
20 | novideo | 22 | novideo |
21 | protocol unix,inet,inet6 | 23 | protocol unix,inet,inet6 |
22 | seccomp | 24 | seccomp |
diff --git a/etc/gnome-contacts.profile b/etc/gnome-contacts.profile index 1be74bfd3..90c2c2628 100644 --- a/etc/gnome-contacts.profile +++ b/etc/gnome-contacts.profile | |||
@@ -15,9 +15,11 @@ include /etc/firejail/whitelist-common.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix,inet,inet6 | 24 | protocol unix,inet,inet6 |
23 | seccomp | 25 | seccomp |
diff --git a/etc/gnome-documents.profile b/etc/gnome-documents.profile index e56a32a4a..3254f3fbc 100644 --- a/etc/gnome-documents.profile +++ b/etc/gnome-documents.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix | 27 | protocol unix |
26 | seccomp | 28 | seccomp |
diff --git a/etc/gnome-font-viewer.profile b/etc/gnome-font-viewer.profile index f122f066a..5ccb28840 100644 --- a/etc/gnome-font-viewer.profile +++ b/etc/gnome-font-viewer.profile | |||
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc | |||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
19 | nosound | 20 | nosound |
21 | notv | ||
20 | novideo | 22 | novideo |
21 | protocol unix,inet,inet6 | 23 | protocol unix,inet,inet6 |
22 | seccomp | 24 | seccomp |
diff --git a/etc/gnome-maps.profile b/etc/gnome-maps.profile index 1e60c4470..cdbf5cbe0 100644 --- a/etc/gnome-maps.profile +++ b/etc/gnome-maps.profile | |||
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc | |||
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
22 | nosound | 23 | nosound |
24 | notv | ||
23 | novideo | 25 | novideo |
24 | protocol unix,inet,inet6 | 26 | protocol unix,inet,inet6 |
25 | seccomp | 27 | seccomp |
diff --git a/etc/gnome-music.profile b/etc/gnome-music.profile index 9d7b878cd..d3c61d9b4 100644 --- a/etc/gnome-music.profile +++ b/etc/gnome-music.profile | |||
@@ -18,6 +18,7 @@ no3d | |||
18 | nogroups | 18 | nogroups |
19 | nonewprivs | 19 | nonewprivs |
20 | noroot | 20 | noroot |
21 | notv | ||
21 | novideo | 22 | novideo |
22 | protocol unix | 23 | protocol unix |
23 | seccomp | 24 | seccomp |
diff --git a/etc/gnome-photos.profile b/etc/gnome-photos.profile index 5982b9dbd..0e150f525 100644 --- a/etc/gnome-photos.profile +++ b/etc/gnome-photos.profile | |||
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc | |||
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
22 | nosound | 23 | nosound |
24 | notv | ||
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
diff --git a/etc/gnome-twitch.profile b/etc/gnome-twitch.profile index 9ef09a87b..9c94404d1 100644 --- a/etc/gnome-twitch.profile +++ b/etc/gnome-twitch.profile | |||
@@ -20,9 +20,11 @@ whitelist ${HOME}/.local/share/gnome-twitch | |||
20 | include /etc/firejail/whitelist-common.inc | 20 | include /etc/firejail/whitelist-common.inc |
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | nodvd | ||
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
27 | notv | ||
26 | novideo | 28 | novideo |
27 | protocol unix,inet,inet6 | 29 | protocol unix,inet,inet6 |
28 | seccomp | 30 | seccomp |
diff --git a/etc/gnome-weather.profile b/etc/gnome-weather.profile index 514ef6f15..4ddbbbde2 100644 --- a/etc/gnome-weather.profile +++ b/etc/gnome-weather.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix,inet,inet6 | 27 | protocol unix,inet,inet6 |
26 | seccomp | 28 | seccomp |
diff --git a/etc/goobox.profile b/etc/goobox.profile index 45715f9ce..9bedaa431 100644 --- a/etc/goobox.profile +++ b/etc/goobox.profile | |||
@@ -13,9 +13,11 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
20 | notv | ||
19 | protocol unix | 21 | protocol unix |
20 | seccomp | 22 | seccomp |
21 | shell none | 23 | shell none |
diff --git a/etc/google-chrome-beta.profile b/etc/google-chrome-beta.profile index b6c39bfd2..ac457b92f 100644 --- a/etc/google-chrome-beta.profile +++ b/etc/google-chrome-beta.profile | |||
@@ -10,8 +10,7 @@ noblacklist ~/.config/google-chrome-beta | |||
10 | noblacklist ~/.pki | 10 | noblacklist ~/.pki |
11 | 11 | ||
12 | include /etc/firejail/disable-common.inc | 12 | include /etc/firejail/disable-common.inc |
13 | # chromium is distributed with a perl script on Arch | 13 | include /etc/firejail/disable-devel.inc |
14 | # include /etc/firejail/disable-devel.inc | ||
15 | include /etc/firejail/disable-programs.inc | 14 | include /etc/firejail/disable-programs.inc |
16 | 15 | ||
17 | mkdir ~/.cache/google-chrome-beta | 16 | mkdir ~/.cache/google-chrome-beta |
@@ -25,7 +24,9 @@ include /etc/firejail/whitelist-common.inc | |||
25 | 24 | ||
26 | caps.keep sys_chroot,sys_admin | 25 | caps.keep sys_chroot,sys_admin |
27 | netfilter | 26 | netfilter |
27 | nodvd | ||
28 | nogroups | 28 | nogroups |
29 | notv | ||
29 | shell none | 30 | shell none |
30 | 31 | ||
31 | private-dev | 32 | private-dev |
diff --git a/etc/google-chrome-stable.profile b/etc/google-chrome-stable.profile index df4bd001f..6ade19021 100644 --- a/etc/google-chrome-stable.profile +++ b/etc/google-chrome-stable.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/google-chrome.profile | 6 | include /etc/firejail/google-chrome.profile |
diff --git a/etc/google-chrome-unstable.profile b/etc/google-chrome-unstable.profile index ea111c7f6..3d7a9a715 100644 --- a/etc/google-chrome-unstable.profile +++ b/etc/google-chrome-unstable.profile | |||
@@ -10,8 +10,7 @@ noblacklist ~/.config/google-chrome-unstable | |||
10 | noblacklist ~/.pki | 10 | noblacklist ~/.pki |
11 | 11 | ||
12 | include /etc/firejail/disable-common.inc | 12 | include /etc/firejail/disable-common.inc |
13 | # chromium is distributed with a perl script on Arch | 13 | include /etc/firejail/disable-devel.inc |
14 | # include /etc/firejail/disable-devel.inc | ||
15 | include /etc/firejail/disable-programs.inc | 14 | include /etc/firejail/disable-programs.inc |
16 | 15 | ||
17 | mkdir ~/.cache/google-chrome-unstable | 16 | mkdir ~/.cache/google-chrome-unstable |
@@ -25,7 +24,9 @@ include /etc/firejail/whitelist-common.inc | |||
25 | 24 | ||
26 | caps.keep sys_chroot,sys_admin | 25 | caps.keep sys_chroot,sys_admin |
27 | netfilter | 26 | netfilter |
27 | nodvd | ||
28 | nogroups | 28 | nogroups |
29 | notv | ||
29 | shell none | 30 | shell none |
30 | 31 | ||
31 | private-dev | 32 | private-dev |
diff --git a/etc/google-chrome.profile b/etc/google-chrome.profile index f0d452841..a50e0e89d 100644 --- a/etc/google-chrome.profile +++ b/etc/google-chrome.profile | |||
@@ -10,8 +10,7 @@ noblacklist ~/.config/google-chrome | |||
10 | noblacklist ~/.pki | 10 | noblacklist ~/.pki |
11 | 11 | ||
12 | include /etc/firejail/disable-common.inc | 12 | include /etc/firejail/disable-common.inc |
13 | # chromium is distributed with a perl script on Arch | 13 | include /etc/firejail/disable-devel.inc |
14 | # include /etc/firejail/disable-devel.inc | ||
15 | include /etc/firejail/disable-programs.inc | 14 | include /etc/firejail/disable-programs.inc |
16 | 15 | ||
17 | mkdir ~/.cache/google-chrome | 16 | mkdir ~/.cache/google-chrome |
@@ -25,7 +24,9 @@ include /etc/firejail/whitelist-common.inc | |||
25 | 24 | ||
26 | caps.keep sys_chroot,sys_admin | 25 | caps.keep sys_chroot,sys_admin |
27 | netfilter | 26 | netfilter |
27 | nodvd | ||
28 | nogroups | 28 | nogroups |
29 | notv | ||
29 | shell none | 30 | shell none |
30 | 31 | ||
31 | private-dev | 32 | private-dev |
diff --git a/etc/google-play-music-desktop-player.profile b/etc/google-play-music-desktop-player.profile index 9c6c70f9f..704de6e40 100644 --- a/etc/google-play-music-desktop-player.profile +++ b/etc/google-play-music-desktop-player.profile | |||
@@ -20,9 +20,11 @@ include /etc/firejail/whitelist-common.inc | |||
20 | caps.drop all | 20 | caps.drop all |
21 | netfilter | 21 | netfilter |
22 | no3d | 22 | no3d |
23 | nodvd | ||
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
27 | notv | ||
26 | novideo | 28 | novideo |
27 | protocol unix,inet,inet6,netlink | 29 | protocol unix,inet,inet6,netlink |
28 | seccomp | 30 | seccomp |
diff --git a/etc/gpa.profile b/etc/gpa.profile index 9ffb3abd3..58dfcd3e1 100644 --- a/etc/gpa.profile +++ b/etc/gpa.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | protocol unix,inet,inet6 | 23 | protocol unix,inet,inet6 |
22 | seccomp | 24 | seccomp |
23 | shell none | 25 | shell none |
diff --git a/etc/gpg-agent.profile b/etc/gpg-agent.profile index 0592bd113..13bceaa5a 100644 --- a/etc/gpg-agent.profile +++ b/etc/gpg-agent.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | protocol unix,inet,inet6 | 26 | protocol unix,inet,inet6 |
25 | seccomp | 27 | seccomp |
26 | shell none | 28 | shell none |
diff --git a/etc/gpg.profile b/etc/gpg.profile index 2d745b435..d99afdfe2 100644 --- a/etc/gpg.profile +++ b/etc/gpg.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | protocol unix,inet,inet6 | 26 | protocol unix,inet,inet6 |
25 | seccomp | 27 | seccomp |
26 | shell none | 28 | shell none |
diff --git a/etc/gpicview.profile b/etc/gpicview.profile index f9c56b7ad..ec9245e58 100644 --- a/etc/gpicview.profile +++ b/etc/gpicview.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | protocol unix | 23 | protocol unix |
22 | seccomp | 24 | seccomp |
23 | shell none | 25 | shell none |
diff --git a/etc/gpredict.profile b/etc/gpredict.profile index 475f3deef..f204366c5 100644 --- a/etc/gpredict.profile +++ b/etc/gpredict.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/whitelist-common.inc | |||
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | netfilter | 19 | netfilter |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | protocol unix,inet,inet6 | 26 | protocol unix,inet,inet6 |
25 | seccomp | 27 | seccomp |
26 | shell none | 28 | shell none |
diff --git a/etc/gtar.profile b/etc/gtar.profile index 9d28393bf..d4bf18f95 100644 --- a/etc/gtar.profile +++ b/etc/gtar.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/tar.profile | 6 | include /etc/firejail/tar.profile |
diff --git a/etc/gthumb.profile b/etc/gthumb.profile index 2e1503970..63ad07894 100644 --- a/etc/gthumb.profile +++ b/etc/gthumb.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
15 | include /etc/firejail/disable-programs.inc | 15 | include /etc/firejail/disable-programs.inc |
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
diff --git a/etc/guayadeque.profile b/etc/guayadeque.profile index 22adb9e65..7713f216f 100644 --- a/etc/guayadeque.profile +++ b/etc/guayadeque.profile | |||
@@ -17,6 +17,7 @@ netfilter | |||
17 | nogroups | 17 | nogroups |
18 | nonewprivs | 18 | nonewprivs |
19 | noroot | 19 | noroot |
20 | notv | ||
20 | protocol unix,inet,inet6,netlink | 21 | protocol unix,inet,inet6,netlink |
21 | seccomp | 22 | seccomp |
22 | shell none | 23 | shell none |
diff --git a/etc/gucharmap.profile b/etc/gucharmap.profile index 96bf783c4..b6be37439 100644 --- a/etc/gucharmap.profile +++ b/etc/gucharmap.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/gwenview.profile b/etc/gwenview.profile index 0f2be604b..745468912 100644 --- a/etc/gwenview.profile +++ b/etc/gwenview.profile | |||
@@ -20,9 +20,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
20 | include /etc/firejail/disable-programs.inc | 20 | include /etc/firejail/disable-programs.inc |
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | nodvd | ||
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
27 | notv | ||
28 | novideo | ||
26 | protocol unix | 29 | protocol unix |
27 | seccomp | 30 | seccomp |
28 | shell none | 31 | shell none |
diff --git a/etc/gzip.profile b/etc/gzip.profile index 13960eda0..3f6ecec2c 100644 --- a/etc/gzip.profile +++ b/etc/gzip.profile | |||
@@ -11,7 +11,9 @@ blacklist /tmp/.X11-unix | |||
11 | ignore noroot | 11 | ignore noroot |
12 | net none | 12 | net none |
13 | no3d | 13 | no3d |
14 | nodvd | ||
14 | nosound | 15 | nosound |
16 | notv | ||
15 | shell none | 17 | shell none |
16 | tracelog | 18 | tracelog |
17 | 19 | ||
diff --git a/etc/handbrake-gtk.profile b/etc/handbrake-gtk.profile index 9437cea9e..de6244a32 100644 --- a/etc/handbrake-gtk.profile +++ b/etc/handbrake-gtk.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/handbrake.profile | 6 | include /etc/firejail/handbrake.profile |
diff --git a/etc/handbrake.profile b/etc/handbrake.profile index 2b33051e2..2b32abca6 100644 --- a/etc/handbrake.profile +++ b/etc/handbrake.profile | |||
@@ -18,6 +18,7 @@ nogroups | |||
18 | nonewprivs | 18 | nonewprivs |
19 | noroot | 19 | noroot |
20 | nosound | 20 | nosound |
21 | notv | ||
21 | novideo | 22 | novideo |
22 | protocol unix,inet,inet6,netlink | 23 | protocol unix,inet,inet6,netlink |
23 | seccomp | 24 | seccomp |
diff --git a/etc/hashcat.profile b/etc/hashcat.profile index 662b8a06c..5f08d7cb8 100644 --- a/etc/hashcat.profile +++ b/etc/hashcat.profile | |||
@@ -7,23 +7,28 @@ include /etc/firejail/hashcat.local | |||
7 | include /etc/firejail/globals.local | 7 | include /etc/firejail/globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.hashcat | 9 | noblacklist ${HOME}/.hashcat |
10 | noblacklist /usr/include | ||
10 | 11 | ||
11 | include /etc/firejail/disable-common.inc | 12 | include /etc/firejail/disable-common.inc |
13 | include /etc/firejail/disable-devel.inc | ||
12 | include /etc/firejail/disable-passwdmgr.inc | 14 | include /etc/firejail/disable-passwdmgr.inc |
13 | include /etc/firejail/disable-programs.inc | 15 | include /etc/firejail/disable-programs.inc |
14 | 16 | ||
15 | caps.drop all | 17 | caps.drop all |
16 | net none | 18 | net none |
19 | nodvd | ||
17 | nogroups | 20 | nogroups |
18 | nonewprivs | 21 | nonewprivs |
19 | noroot | 22 | noroot |
20 | nosound | 23 | nosound |
24 | notv | ||
21 | novideo | 25 | novideo |
22 | protocol unix | 26 | protocol unix |
23 | seccomp | 27 | seccomp |
24 | shell none | 28 | shell none |
25 | 29 | ||
26 | disable-mnt | 30 | disable-mnt |
31 | private-bin hashcat | ||
27 | private-dev | 32 | private-dev |
28 | private-tmp | 33 | private-tmp |
29 | 34 | ||
diff --git a/etc/hedgewars.profile b/etc/hedgewars.profile index b6dc1f945..e2775ffce 100644 --- a/etc/hedgewars.profile +++ b/etc/hedgewars.profile | |||
@@ -18,9 +18,11 @@ include /etc/firejail/whitelist-common.inc | |||
18 | 18 | ||
19 | caps.drop all | 19 | caps.drop all |
20 | netfilter | 20 | netfilter |
21 | nodvd | ||
21 | nogroups | 22 | nogroups |
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
25 | notv | ||
24 | seccomp | 26 | seccomp |
25 | tracelog | 27 | tracelog |
26 | 28 | ||
diff --git a/etc/hexchat.profile b/etc/hexchat.profile index ceebb6d18..fc817d9f9 100644 --- a/etc/hexchat.profile +++ b/etc/hexchat.profile | |||
@@ -20,10 +20,12 @@ include /etc/firejail/whitelist-common.inc | |||
20 | caps.drop all | 20 | caps.drop all |
21 | netfilter | 21 | netfilter |
22 | no3d | 22 | no3d |
23 | nodvd | ||
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
26 | nosound | 27 | nosound |
28 | notv | ||
27 | novideo | 29 | novideo |
28 | protocol unix,inet,inet6 | 30 | protocol unix,inet,inet6 |
29 | seccomp | 31 | seccomp |
diff --git a/etc/highlight.profile b/etc/highlight.profile index c314d34cb..83b023a90 100644 --- a/etc/highlight.profile +++ b/etc/highlight.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
diff --git a/etc/hugin.profile b/etc/hugin.profile index 8eb7410ff..d3cd181b1 100644 --- a/etc/hugin.profile +++ b/etc/hugin.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/icecat.profile b/etc/icecat.profile index b8b267dff..ab7e62180 100644 --- a/etc/icecat.profile +++ b/etc/icecat.profile | |||
@@ -37,8 +37,10 @@ include /etc/firejail/whitelist-common.inc | |||
37 | 37 | ||
38 | caps.drop all | 38 | caps.drop all |
39 | netfilter | 39 | netfilter |
40 | nodvd | ||
40 | nonewprivs | 41 | nonewprivs |
41 | noroot | 42 | noroot |
43 | notv | ||
42 | protocol unix,inet,inet6,netlink | 44 | protocol unix,inet,inet6,netlink |
43 | seccomp | 45 | seccomp |
44 | tracelog | 46 | tracelog |
diff --git a/etc/icedove.profile b/etc/icedove.profile index 3931fd0c0..46861d9f2 100644 --- a/etc/icedove.profile +++ b/etc/icedove.profile | |||
@@ -23,4 +23,5 @@ include /etc/firejail/whitelist-common.inc | |||
23 | ignore private-tmp | 23 | ignore private-tmp |
24 | 24 | ||
25 | # allow browsers | 25 | # allow browsers |
26 | # Redirect | ||
26 | include /etc/firejail/firefox.profile | 27 | include /etc/firejail/firefox.profile |
diff --git a/etc/iceweasel.profile b/etc/iceweasel.profile index 62671cb67..f6b57dde0 100644 --- a/etc/iceweasel.profile +++ b/etc/iceweasel.profile | |||
@@ -6,4 +6,5 @@ include /etc/firejail/iceweasel.local | |||
6 | include /etc/firejail/globals.local | 6 | include /etc/firejail/globals.local |
7 | 7 | ||
8 | 8 | ||
9 | # Redirect | ||
9 | include /etc/firejail/firefox.profile | 10 | include /etc/firejail/firefox.profile |
diff --git a/etc/idea.sh.profile b/etc/idea.sh.profile index f0f0637d9..928ec7327 100644 --- a/etc/idea.sh.profile +++ b/etc/idea.sh.profile | |||
@@ -20,9 +20,11 @@ include /etc/firejail/disable-programs.inc | |||
20 | 20 | ||
21 | caps.drop all | 21 | caps.drop all |
22 | netfilter | 22 | netfilter |
23 | nodvd | ||
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
27 | notv | ||
26 | novideo | 28 | novideo |
27 | protocol unix,inet,inet6 | 29 | protocol unix,inet,inet6 |
28 | seccomp | 30 | seccomp |
diff --git a/etc/img2txt.profile b/etc/img2txt.profile index 5117e887b..bd454a2c8 100644 --- a/etc/img2txt.profile +++ b/etc/img2txt.profile | |||
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | net none | 15 | net none |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
19 | nosound | 20 | nosound |
21 | notv | ||
20 | protocol unix | 22 | protocol unix |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/inkscape.profile b/etc/inkscape.profile index 6bba90d14..1d24f5d7d 100644 --- a/etc/inkscape.profile +++ b/etc/inkscape.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/inox.profile b/etc/inox.profile index 98a1ea6a9..6273c4de6 100644 --- a/etc/inox.profile +++ b/etc/inox.profile | |||
@@ -22,3 +22,5 @@ whitelist ~/.pki | |||
22 | include /etc/firejail/whitelist-common.inc | 22 | include /etc/firejail/whitelist-common.inc |
23 | 23 | ||
24 | netfilter | 24 | netfilter |
25 | nodvd | ||
26 | notv | ||
diff --git a/etc/iridium-browser.profile b/etc/iridium-browser.profile index 9e1a4fcc2..1baa07cb7 100644 --- a/etc/iridium-browser.profile +++ b/etc/iridium-browser.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/iridium.profile | 6 | include /etc/firejail/iridium.profile |
diff --git a/etc/iridium.profile b/etc/iridium.profile index 95e94cbf9..db9c5c7cf 100644 --- a/etc/iridium.profile +++ b/etc/iridium.profile | |||
@@ -23,3 +23,5 @@ whitelist ~/.pki | |||
23 | include /etc/firejail/whitelist-common.inc | 23 | include /etc/firejail/whitelist-common.inc |
24 | 24 | ||
25 | netfilter | 25 | netfilter |
26 | nodvd | ||
27 | notv | ||
diff --git a/etc/jd-gui.profile b/etc/jd-gui.profile index 96d4a57ce..5cb1e1828 100644 --- a/etc/jd-gui.profile +++ b/etc/jd-gui.profile | |||
@@ -16,15 +16,18 @@ include /etc/firejail/disable-programs.inc | |||
16 | caps.drop all | 16 | caps.drop all |
17 | net none | 17 | net none |
18 | no3d | 18 | no3d |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
22 | nosound | 23 | nosound |
24 | notv | ||
23 | novideo | 25 | novideo |
24 | protocol unix | 26 | protocol unix |
25 | seccomp | 27 | seccomp |
26 | shell none | 28 | shell none |
27 | 29 | ||
30 | private-bin jd-gui,sh,bash | ||
28 | private-dev | 31 | private-dev |
29 | private-tmp | 32 | private-tmp |
30 | 33 | ||
diff --git a/etc/jitsi.profile b/etc/jitsi.profile index 72f9b5f5b..78a57ff46 100644 --- a/etc/jitsi.profile +++ b/etc/jitsi.profile | |||
@@ -13,9 +13,11 @@ include /etc/firejail/disable-passwdmgr.inc | |||
13 | include /etc/firejail/disable-programs.inc | 13 | include /etc/firejail/disable-programs.inc |
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
20 | notv | ||
19 | protocol unix,inet,inet6 | 21 | protocol unix,inet,inet6 |
20 | seccomp | 22 | seccomp |
21 | shell none | 23 | shell none |
diff --git a/etc/k3b.profile b/etc/k3b.profile index c2aed68c9..87132e775 100644 --- a/etc/k3b.profile +++ b/etc/k3b.profile | |||
@@ -16,9 +16,12 @@ include /etc/firejail/disable-programs.inc | |||
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | no3d | 18 | no3d |
19 | nodvd | ||
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
24 | novideo | ||
22 | protocol unix | 25 | protocol unix |
23 | seccomp | 26 | seccomp |
24 | shell none | 27 | shell none |
diff --git a/etc/kate.profile b/etc/kate.profile index 12d9127b4..ec5d09ce2 100644 --- a/etc/kate.profile +++ b/etc/kate.profile | |||
@@ -19,10 +19,13 @@ include /etc/firejail/disable-programs.inc | |||
19 | 19 | ||
20 | caps.drop all | 20 | caps.drop all |
21 | netfilter | 21 | netfilter |
22 | nodvd | ||
22 | nogroups | 23 | nogroups |
23 | nonewprivs | 24 | nonewprivs |
24 | noroot | 25 | noroot |
25 | nosound | 26 | nosound |
27 | notv | ||
28 | novideo | ||
26 | protocol unix | 29 | protocol unix |
27 | seccomp | 30 | seccomp |
28 | shell none | 31 | shell none |
diff --git a/etc/kcalc.profile b/etc/kcalc.profile index ac4e11195..f334c4c72 100644 --- a/etc/kcalc.profile +++ b/etc/kcalc.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/keepass.profile b/etc/keepass.profile index 543bc01eb..c133ce0fb 100644 --- a/etc/keepass.profile +++ b/etc/keepass.profile | |||
@@ -21,10 +21,13 @@ include /etc/firejail/disable-programs.inc | |||
21 | caps.drop all | 21 | caps.drop all |
22 | netfilter | 22 | netfilter |
23 | no3d | 23 | no3d |
24 | nodvd | ||
24 | nogroups | 25 | nogroups |
25 | nonewprivs | 26 | nonewprivs |
26 | noroot | 27 | noroot |
27 | nosound | 28 | nosound |
29 | notv | ||
30 | novideo | ||
28 | protocol unix,inet,inet6 | 31 | protocol unix,inet,inet6 |
29 | seccomp | 32 | seccomp |
30 | shell none | 33 | shell none |
diff --git a/etc/keepass2.profile b/etc/keepass2.profile index 7d2881099..d29fc6abc 100644 --- a/etc/keepass2.profile +++ b/etc/keepass2.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/keepass.profile | 6 | include /etc/firejail/keepass.profile |
diff --git a/etc/keepassx.profile b/etc/keepassx.profile index 892dd7053..9d943d89c 100644 --- a/etc/keepassx.profile +++ b/etc/keepassx.profile | |||
@@ -19,10 +19,13 @@ caps.drop all | |||
19 | machine-id | 19 | machine-id |
20 | net none | 20 | net none |
21 | no3d | 21 | no3d |
22 | nodvd | ||
22 | nogroups | 23 | nogroups |
23 | nonewprivs | 24 | nonewprivs |
24 | noroot | 25 | noroot |
25 | nosound | 26 | nosound |
27 | notv | ||
28 | novideo | ||
26 | protocol unix | 29 | protocol unix |
27 | seccomp | 30 | seccomp |
28 | shell none | 31 | shell none |
diff --git a/etc/keepassx2.profile b/etc/keepassx2.profile index ab56e0317..e20e06b76 100644 --- a/etc/keepassx2.profile +++ b/etc/keepassx2.profile | |||
@@ -18,10 +18,13 @@ include /etc/firejail/disable-programs.inc | |||
18 | caps.drop all | 18 | caps.drop all |
19 | net none | 19 | net none |
20 | no3d | 20 | no3d |
21 | nodvd | ||
21 | nogroups | 22 | nogroups |
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
24 | nosound | 25 | nosound |
26 | notv | ||
27 | novideo | ||
25 | protocol unix | 28 | protocol unix |
26 | seccomp | 29 | seccomp |
27 | shell none | 30 | shell none |
diff --git a/etc/keepassxc.profile b/etc/keepassxc.profile index c8a494361..f79cda80d 100644 --- a/etc/keepassxc.profile +++ b/etc/keepassxc.profile | |||
@@ -18,10 +18,12 @@ include /etc/firejail/disable-programs.inc | |||
18 | caps.drop all | 18 | caps.drop all |
19 | net none | 19 | net none |
20 | no3d | 20 | no3d |
21 | nodvd | ||
21 | nogroups | 22 | nogroups |
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
24 | nosound | 25 | nosound |
26 | notv | ||
25 | novideo | 27 | novideo |
26 | protocol unix | 28 | protocol unix |
27 | seccomp | 29 | seccomp |
diff --git a/etc/kino.profile b/etc/kino.profile index c64f2d599..240dab8ef 100644 --- a/etc/kino.profile +++ b/etc/kino.profile | |||
@@ -18,6 +18,7 @@ netfilter | |||
18 | nogroups | 18 | nogroups |
19 | nonewprivs | 19 | nonewprivs |
20 | noroot | 20 | noroot |
21 | notv | ||
21 | novideo | 22 | novideo |
22 | protocol unix | 23 | protocol unix |
23 | seccomp | 24 | seccomp |
diff --git a/etc/kmail.profile b/etc/kmail.profile index 876e80cbb..fdc96c97f 100644 --- a/etc/kmail.profile +++ b/etc/kmail.profile | |||
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
21 | notv | ||
20 | protocol unix,inet,inet6,netlink | 22 | protocol unix,inet,inet6,netlink |
21 | seccomp | 23 | seccomp |
22 | tracelog | 24 | tracelog |
diff --git a/etc/knotes.profile b/etc/knotes.profile index 26b607257..a1d303ded 100644 --- a/etc/knotes.profile +++ b/etc/knotes.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | protocol unix | 23 | protocol unix |
22 | seccomp | 24 | seccomp |
23 | shell none | 25 | shell none |
diff --git a/etc/konversation.profile b/etc/konversation.profile index d1c78afbe..8bc263d4d 100644 --- a/etc/konversation.profile +++ b/etc/konversation.profile | |||
@@ -13,8 +13,10 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | noroot | 18 | noroot |
19 | notv | ||
18 | protocol unix,inet,inet6 | 20 | protocol unix,inet,inet6 |
19 | seccomp | 21 | seccomp |
20 | 22 | ||
diff --git a/etc/ktorrent.profile b/etc/ktorrent.profile index 8e396a464..c5b887118 100644 --- a/etc/ktorrent.profile +++ b/etc/ktorrent.profile | |||
@@ -35,10 +35,12 @@ include /etc/firejail/whitelist-common.inc | |||
35 | caps.drop all | 35 | caps.drop all |
36 | netfilter | 36 | netfilter |
37 | no3d | 37 | no3d |
38 | nodvd | ||
38 | nogroups | 39 | nogroups |
39 | nonewprivs | 40 | nonewprivs |
40 | noroot | 41 | noroot |
41 | nosound | 42 | nosound |
43 | notv | ||
42 | novideo | 44 | novideo |
43 | protocol unix,inet,inet6 | 45 | protocol unix,inet,inet6 |
44 | seccomp | 46 | seccomp |
diff --git a/etc/kwrite.profile b/etc/kwrite.profile index b6406cc0d..6ba076dc0 100644 --- a/etc/kwrite.profile +++ b/etc/kwrite.profile | |||
@@ -19,10 +19,13 @@ include /etc/firejail/disable-programs.inc | |||
19 | 19 | ||
20 | caps.drop all | 20 | caps.drop all |
21 | netfilter | 21 | netfilter |
22 | nodvd | ||
22 | nogroups | 23 | nogroups |
23 | nonewprivs | 24 | nonewprivs |
24 | noroot | 25 | noroot |
25 | # nosound - KWrite is using ALSA! | 26 | # nosound - KWrite is using ALSA! |
27 | notv | ||
28 | novideo | ||
26 | protocol unix | 29 | protocol unix |
27 | seccomp | 30 | seccomp |
28 | shell none | 31 | shell none |
diff --git a/etc/leafpad.profile b/etc/leafpad.profile index de44a6771..e7557651b 100644 --- a/etc/leafpad.profile +++ b/etc/leafpad.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
diff --git a/etc/less.profile b/etc/less.profile index fe8a8fa24..e1c42ed76 100644 --- a/etc/less.profile +++ b/etc/less.profile | |||
@@ -11,11 +11,17 @@ blacklist /tmp/.X11-unix | |||
11 | ignore noroot | 11 | ignore noroot |
12 | net none | 12 | net none |
13 | no3d | 13 | no3d |
14 | nodvd | ||
14 | nosound | 15 | nosound |
16 | notv | ||
15 | novideo | 17 | novideo |
16 | shell none | 18 | shell none |
17 | tracelog | 19 | tracelog |
20 | writable-var-log | ||
18 | 21 | ||
22 | # The user can have a custom coloring scritps configured in ~/.lessfilter. | ||
23 | # Enable private-bin if you are not using any filter. | ||
24 | # private-bin less | ||
19 | private-dev | 25 | private-dev |
20 | 26 | ||
21 | memory-deny-write-execute | 27 | memory-deny-write-execute |
diff --git a/etc/libreoffice.profile b/etc/libreoffice.profile index 8387fef98..ec7356002 100644 --- a/etc/libreoffice.profile +++ b/etc/libreoffice.profile | |||
@@ -16,9 +16,11 @@ include /etc/firejail/disable-programs.inc | |||
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
23 | notv | ||
22 | protocol unix,inet,inet6 | 24 | protocol unix,inet,inet6 |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
diff --git a/etc/liferea.profile b/etc/liferea.profile index f9c050acb..afd5fed6b 100644 --- a/etc/liferea.profile +++ b/etc/liferea.profile | |||
@@ -25,10 +25,12 @@ include /etc/firejail/whitelist-common.inc | |||
25 | caps.drop all | 25 | caps.drop all |
26 | netfilter | 26 | netfilter |
27 | # no3d | 27 | # no3d |
28 | nodvd | ||
28 | nogroups | 29 | nogroups |
29 | nonewprivs | 30 | nonewprivs |
30 | noroot | 31 | noroot |
31 | # nosound | 32 | # nosound |
33 | notv | ||
32 | novideo | 34 | novideo |
33 | protocol unix,inet,inet6 | 35 | protocol unix,inet,inet6 |
34 | seccomp | 36 | seccomp |
diff --git a/etc/localc.profile b/etc/localc.profile index c30bb5550..c702a4ece 100644 --- a/etc/localc.profile +++ b/etc/localc.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/libreoffice.profile | 6 | include /etc/firejail/libreoffice.profile |
diff --git a/etc/lodraw.profile b/etc/lodraw.profile index c30bb5550..c702a4ece 100644 --- a/etc/lodraw.profile +++ b/etc/lodraw.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/libreoffice.profile | 6 | include /etc/firejail/libreoffice.profile |
diff --git a/etc/loffice.profile b/etc/loffice.profile index c30bb5550..c702a4ece 100644 --- a/etc/loffice.profile +++ b/etc/loffice.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/libreoffice.profile | 6 | include /etc/firejail/libreoffice.profile |
diff --git a/etc/lofromtemplate.profile b/etc/lofromtemplate.profile index c30bb5550..c702a4ece 100644 --- a/etc/lofromtemplate.profile +++ b/etc/lofromtemplate.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/libreoffice.profile | 6 | include /etc/firejail/libreoffice.profile |
diff --git a/etc/loimpress.profile b/etc/loimpress.profile index c30bb5550..c702a4ece 100644 --- a/etc/loimpress.profile +++ b/etc/loimpress.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/libreoffice.profile | 6 | include /etc/firejail/libreoffice.profile |
diff --git a/etc/lollypop.profile b/etc/lollypop.profile index 22004d95e..587a46353 100644 --- a/etc/lollypop.profile +++ b/etc/lollypop.profile | |||
@@ -18,6 +18,7 @@ no3d | |||
18 | nogroups | 18 | nogroups |
19 | nonewprivs | 19 | nonewprivs |
20 | noroot | 20 | noroot |
21 | notv | ||
21 | novideo | 22 | novideo |
22 | protocol unix,inet,inet6 | 23 | protocol unix,inet,inet6 |
23 | seccomp | 24 | seccomp |
diff --git a/etc/lomath.profile b/etc/lomath.profile index c30bb5550..c702a4ece 100644 --- a/etc/lomath.profile +++ b/etc/lomath.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/libreoffice.profile | 6 | include /etc/firejail/libreoffice.profile |
diff --git a/etc/loweb.profile b/etc/loweb.profile index c30bb5550..c702a4ece 100644 --- a/etc/loweb.profile +++ b/etc/loweb.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/libreoffice.profile | 6 | include /etc/firejail/libreoffice.profile |
diff --git a/etc/lowriter.profile b/etc/lowriter.profile index c30bb5550..c702a4ece 100644 --- a/etc/lowriter.profile +++ b/etc/lowriter.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/libreoffice.profile | 6 | include /etc/firejail/libreoffice.profile |
diff --git a/etc/luminance-hdr.profile b/etc/luminance-hdr.profile index bbceee7c7..bd32e0c70 100644 --- a/etc/luminance-hdr.profile +++ b/etc/luminance-hdr.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/lximage-qt.profile b/etc/lximage-qt.profile index f0eda6fbe..734f16e92 100644 --- a/etc/lximage-qt.profile +++ b/etc/lximage-qt.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
diff --git a/etc/lxmusic.profile b/etc/lxmusic.profile index 230ceaafb..901bdb408 100644 --- a/etc/lxmusic.profile +++ b/etc/lxmusic.profile | |||
@@ -16,9 +16,11 @@ include /etc/firejail/disable-programs.inc | |||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | no3d | 18 | no3d |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
diff --git a/etc/lxterminal.profile b/etc/lxterminal.profile index 771211b31..dbbd1ace0 100644 --- a/etc/lxterminal.profile +++ b/etc/lxterminal.profile | |||
@@ -13,5 +13,7 @@ include /etc/firejail/disable-programs.inc | |||
13 | caps.drop all | 13 | caps.drop all |
14 | netfilter | 14 | netfilter |
15 | # noroot - somehow this breaks on Debian Jessie! | 15 | # noroot - somehow this breaks on Debian Jessie! |
16 | nodvd | ||
17 | notv | ||
16 | protocol unix,inet,inet6 | 18 | protocol unix,inet,inet6 |
17 | seccomp | 19 | seccomp |
diff --git a/etc/lynx.profile b/etc/lynx.profile index 8ff1f88b3..db01a5b8f 100644 --- a/etc/lynx.profile +++ b/etc/lynx.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | protocol unix,inet,inet6 | 24 | protocol unix,inet,inet6 |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
diff --git a/etc/mate-calc.profile b/etc/mate-calc.profile index 220807447..caf3095a5 100644 --- a/etc/mate-calc.profile +++ b/etc/mate-calc.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
diff --git a/etc/mate-calculator.profile b/etc/mate-calculator.profile index 155ccfe7e..43bb3ebb4 100644 --- a/etc/mate-calculator.profile +++ b/etc/mate-calculator.profile | |||
@@ -1,7 +1,6 @@ | |||
1 | # Firejail profile for mate-calculator | 1 | # Firejail profile alias for mate-calc |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | # Persistent local customizations | ||
4 | include /etc/firejail/mate-calculator.local | ||
5 | # Persistent global definitions | ||
6 | include /etc/firejail/globals.local | ||
7 | 3 | ||
4 | |||
5 | # Redirect | ||
6 | include /etc/firejail/mate-calc.profile | ||
diff --git a/etc/mate-color-select.profile b/etc/mate-color-select.profile index 42456d1f6..26ce42fbf 100644 --- a/etc/mate-color-select.profile +++ b/etc/mate-color-select.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/mate-dictionary.profile b/etc/mate-dictionary.profile index bc148fba3..f0de57e0d 100644 --- a/etc/mate-dictionary.profile +++ b/etc/mate-dictionary.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix,inet,inet6 | 25 | protocol unix,inet,inet6 |
24 | seccomp | 26 | seccomp |
diff --git a/etc/mathematica.profile b/etc/mathematica.profile index 64cae12dd..984ea9e97 100644 --- a/etc/mathematica.profile +++ b/etc/mathematica.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/Mathematica.profile | 6 | include /etc/firejail/Mathematica.profile |
diff --git a/etc/mcabber.profile b/etc/mcabber.profile index 8563201ac..bd1ada2b5 100644 --- a/etc/mcabber.profile +++ b/etc/mcabber.profile | |||
@@ -15,9 +15,11 @@ include /etc/firejail/disable-programs.inc | |||
15 | 15 | ||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | nodvd | ||
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | protocol inet,inet6 | 23 | protocol inet,inet6 |
22 | seccomp | 24 | seccomp |
23 | shell none | 25 | shell none |
diff --git a/etc/mediainfo.profile b/etc/mediainfo.profile index 4a2e9246e..d6a55610f 100644 --- a/etc/mediainfo.profile +++ b/etc/mediainfo.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
diff --git a/etc/mediathekview.profile b/etc/mediathekview.profile index 5e980909b..b90e21e66 100644 --- a/etc/mediathekview.profile +++ b/etc/mediathekview.profile | |||
@@ -5,8 +5,14 @@ include /etc/firejail/mediathekview.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include /etc/firejail/globals.local | 6 | include /etc/firejail/globals.local |
7 | 7 | ||
8 | noblacklist ~/.config/mpv | ||
9 | noblacklist ~/.config/smplayer | ||
10 | noblacklist ~/.config/totem | ||
8 | noblacklist ~/.config/vlc | 11 | noblacklist ~/.config/vlc |
12 | noblacklist ~/.java | ||
13 | noblacklist ~/.local/share/totem | ||
9 | noblacklist ~/.mediathek3 | 14 | noblacklist ~/.mediathek3 |
15 | noblacklist ~/.mplayer | ||
10 | 16 | ||
11 | include /etc/firejail/disable-common.inc | 17 | include /etc/firejail/disable-common.inc |
12 | include /etc/firejail/disable-devel.inc | 18 | include /etc/firejail/disable-devel.inc |
@@ -15,8 +21,11 @@ include /etc/firejail/disable-programs.inc | |||
15 | 21 | ||
16 | caps.drop all | 22 | caps.drop all |
17 | netfilter | 23 | netfilter |
24 | nodvd | ||
18 | nonewprivs | 25 | nonewprivs |
19 | noroot | 26 | noroot |
27 | notv | ||
28 | novideo | ||
20 | protocol unix,inet,inet6 | 29 | protocol unix,inet,inet6 |
21 | seccomp | 30 | seccomp |
22 | tracelog | 31 | tracelog |
diff --git a/etc/meld.profile b/etc/meld.profile index 4aeca3771..f1910d0f4 100644 --- a/etc/meld.profile +++ b/etc/meld.profile | |||
@@ -15,15 +15,18 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
26 | 28 | ||
29 | # private-bin meld,python2,python2.7 | ||
27 | private-dev | 30 | private-dev |
28 | private-tmp | 31 | private-tmp |
29 | 32 | ||
diff --git a/etc/midori.profile b/etc/midori.profile index 5b390a170..8ddb37776 100644 --- a/etc/midori.profile +++ b/etc/midori.profile | |||
@@ -35,8 +35,10 @@ include /etc/firejail/whitelist-common.inc | |||
35 | 35 | ||
36 | caps.drop all | 36 | caps.drop all |
37 | netfilter | 37 | netfilter |
38 | nodvd | ||
38 | nonewprivs | 39 | nonewprivs |
39 | # noroot - problems on Ubuntu 14.04 | 40 | # noroot - problems on Ubuntu 14.04 |
41 | notv | ||
40 | protocol unix,inet,inet6,netlink | 42 | protocol unix,inet,inet6,netlink |
41 | seccomp | 43 | seccomp |
42 | tracelog | 44 | tracelog |
diff --git a/etc/mousepad.profile b/etc/mousepad.profile index 5a54afb5b..36365fc2f 100644 --- a/etc/mousepad.profile +++ b/etc/mousepad.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | protocol unix | 23 | protocol unix |
22 | seccomp | 24 | seccomp |
23 | shell none | 25 | shell none |
diff --git a/etc/multimc5.profile b/etc/multimc5.profile index a2f5d46b4..91a269ffb 100644 --- a/etc/multimc5.profile +++ b/etc/multimc5.profile | |||
@@ -22,15 +22,19 @@ include /etc/firejail/whitelist-common.inc | |||
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | netfilter | 24 | netfilter |
25 | nodvd | ||
25 | nogroups | 26 | nogroups |
26 | nonewprivs | 27 | nonewprivs |
27 | noroot | 28 | noroot |
29 | notv | ||
28 | novideo | 30 | novideo |
29 | protocol unix,inet,inet6 | 31 | protocol unix,inet,inet6 |
30 | # seccomp | 32 | # seccomp |
31 | shell none | 33 | shell none |
32 | 34 | ||
33 | disable-mnt | 35 | disable-mnt |
36 | # private-bin works, but causes weirdness | ||
37 | # private-bin multimc5,bash,mkdir,which,zenity,kdialog,ldd,chmod,valgrind,apt-file,pkgfile,dnf,yum,zypper,pfl,java,grep,sort,awk,readlink,dirname | ||
34 | private-dev | 38 | private-dev |
35 | private-tmp | 39 | private-tmp |
36 | 40 | ||
diff --git a/etc/mumble.profile b/etc/mumble.profile index 048b31b81..e58dc93f4 100644 --- a/etc/mumble.profile +++ b/etc/mumble.profile | |||
@@ -22,9 +22,11 @@ include /etc/firejail/whitelist-common.inc | |||
22 | caps.drop all | 22 | caps.drop all |
23 | netfilter | 23 | netfilter |
24 | no3d | 24 | no3d |
25 | nodvd | ||
25 | nogroups | 26 | nogroups |
26 | nonewprivs | 27 | nonewprivs |
27 | noroot | 28 | noroot |
29 | notv | ||
28 | protocol unix,inet,inet6 | 30 | protocol unix,inet,inet6 |
29 | seccomp | 31 | seccomp |
30 | shell none | 32 | shell none |
diff --git a/etc/mupdf.profile b/etc/mupdf.profile index 4b98552c4..c7bb458df 100644 --- a/etc/mupdf.profile +++ b/etc/mupdf.profile | |||
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | net none | 15 | net none |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
19 | nosound | 20 | nosound |
21 | notv | ||
20 | protocol unix | 22 | protocol unix |
21 | seccomp | 23 | seccomp |
22 | # seccomp.keep access,arch_prctl,brk,clone,close,connect,execve,exit_group,fchmod,fchown,fcntl,fstat,futex,getcwd,getpeername,getrlimit,getsockname,getsockopt,lseek,lstat,mlock,mmap,mprotect,mremap,munmap,nanosleep,open,poll,prctl,read,recvfrom,recvmsg,restart_syscall,rt_sigaction,rt_sigprocmask,select,sendmsg,set_robust_list,set_tid_address,setresgid,setresuid,shmat,shmctl,shmget,shutdown,socket,stat,sysinfo,uname,unshare,wait4,write,writev | 24 | # seccomp.keep access,arch_prctl,brk,clone,close,connect,execve,exit_group,fchmod,fchown,fcntl,fstat,futex,getcwd,getpeername,getrlimit,getsockname,getsockopt,lseek,lstat,mlock,mmap,mprotect,mremap,munmap,nanosleep,open,poll,prctl,read,recvfrom,recvmsg,restart_syscall,rt_sigaction,rt_sigprocmask,select,sendmsg,set_robust_list,set_tid_address,setresgid,setresuid,shmat,shmctl,shmget,shutdown,socket,stat,sysinfo,uname,unshare,wait4,write,writev |
@@ -27,5 +29,6 @@ tracelog | |||
27 | private-dev | 29 | private-dev |
28 | private-etc fonts | 30 | private-etc fonts |
29 | private-tmp | 31 | private-tmp |
32 | |||
30 | # mupdf will never write anything | 33 | # mupdf will never write anything |
31 | read-only ${HOME} | 34 | read-only ${HOME} |
diff --git a/etc/mupen64plus.profile b/etc/mupen64plus.profile index f0680c4ce..9f3be0d27 100644 --- a/etc/mupen64plus.profile +++ b/etc/mupen64plus.profile | |||
@@ -22,6 +22,8 @@ include /etc/firejail/whitelist-common.inc | |||
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | net none | 24 | net none |
25 | nodvd | ||
25 | nonewprivs | 26 | nonewprivs |
26 | noroot | 27 | noroot |
28 | notv | ||
27 | seccomp | 29 | seccomp |
diff --git a/etc/mutt.profile b/etc/mutt.profile index e2b9b38ec..206edefae 100644 --- a/etc/mutt.profile +++ b/etc/mutt.profile | |||
@@ -38,10 +38,12 @@ include /etc/firejail/disable-programs.inc | |||
38 | caps.drop all | 38 | caps.drop all |
39 | netfilter | 39 | netfilter |
40 | no3d | 40 | no3d |
41 | nodvd | ||
41 | nogroups | 42 | nogroups |
42 | nonewprivs | 43 | nonewprivs |
43 | noroot | 44 | noroot |
44 | nosound | 45 | nosound |
46 | notv | ||
45 | protocol unix,inet,inet6 | 47 | protocol unix,inet,inet6 |
46 | seccomp | 48 | seccomp |
47 | shell none | 49 | shell none |
diff --git a/etc/nautilus.profile b/etc/nautilus.profile index 2da8f32d7..57d6faa17 100644 --- a/etc/nautilus.profile +++ b/etc/nautilus.profile | |||
@@ -20,9 +20,11 @@ include /etc/firejail/disable-passwdmgr.inc | |||
20 | 20 | ||
21 | caps.drop all | 21 | caps.drop all |
22 | netfilter | 22 | netfilter |
23 | nodvd | ||
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
27 | notv | ||
26 | protocol unix | 28 | protocol unix |
27 | seccomp | 29 | seccomp |
28 | shell none | 30 | shell none |
diff --git a/etc/nemo.profile b/etc/nemo.profile index e2219825a..b11ad645a 100644 --- a/etc/nemo.profile +++ b/etc/nemo.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix,inet,inet6 | 27 | protocol unix,inet,inet6 |
26 | seccomp | 28 | seccomp |
diff --git a/etc/netsurf.profile b/etc/netsurf.profile index 68df57539..64aa068b1 100644 --- a/etc/netsurf.profile +++ b/etc/netsurf.profile | |||
@@ -21,8 +21,10 @@ include /etc/firejail/whitelist-common.inc | |||
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | netfilter | 23 | netfilter |
24 | nodvd | ||
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
27 | notv | ||
26 | protocol unix,inet,inet6,netlink | 28 | protocol unix,inet,inet6,netlink |
27 | seccomp | 29 | seccomp |
28 | tracelog | 30 | tracelog |
diff --git a/etc/nylas.profile b/etc/nylas.profile index 6b6697522..5d84d1326 100644 --- a/etc/nylas.profile +++ b/etc/nylas.profile | |||
@@ -20,10 +20,12 @@ include /etc/firejail/whitelist-common.inc | |||
20 | 20 | ||
21 | caps.drop all | 21 | caps.drop all |
22 | netfilter | 22 | netfilter |
23 | nodvd | ||
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
26 | nosound | 27 | nosound |
28 | notv | ||
27 | protocol unix,inet,inet6,netlink | 29 | protocol unix,inet,inet6,netlink |
28 | seccomp | 30 | seccomp |
29 | shell none | 31 | shell none |
diff --git a/etc/obs.profile b/etc/obs.profile index 3dbacbf57..187862752 100644 --- a/etc/obs.profile +++ b/etc/obs.profile | |||
@@ -13,14 +13,17 @@ include /etc/firejail/disable-passwdmgr.inc | |||
13 | include /etc/firejail/disable-programs.inc | 13 | include /etc/firejail/disable-programs.inc |
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
20 | notv | ||
19 | protocol unix,inet,inet6 | 21 | protocol unix,inet,inet6 |
20 | seccomp | 22 | seccomp |
21 | shell none | 23 | shell none |
22 | tracelog | 24 | tracelog |
23 | 25 | ||
26 | private-bin obs | ||
24 | private-dev | 27 | private-dev |
25 | private-tmp | 28 | private-tmp |
26 | 29 | ||
diff --git a/etc/odt2txt.profile b/etc/odt2txt.profile index 06b4c16e0..da2d03635 100644 --- a/etc/odt2txt.profile +++ b/etc/odt2txt.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
diff --git a/etc/okular.profile b/etc/okular.profile index 331b625b8..d03891ebe 100644 --- a/etc/okular.profile +++ b/etc/okular.profile | |||
@@ -22,10 +22,13 @@ include /etc/firejail/disable-programs.inc | |||
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | netfilter | 24 | netfilter |
25 | nodvd | ||
25 | nogroups | 26 | nogroups |
26 | nonewprivs | 27 | nonewprivs |
27 | noroot | 28 | noroot |
28 | nosound | 29 | nosound |
30 | notv | ||
31 | novideo | ||
29 | protocol unix | 32 | protocol unix |
30 | seccomp | 33 | seccomp |
31 | shell none | 34 | shell none |
diff --git a/etc/open-invaders.profile b/etc/open-invaders.profile index 2587027ab..998d57f62 100644 --- a/etc/open-invaders.profile +++ b/etc/open-invaders.profile | |||
@@ -17,9 +17,11 @@ include /etc/firejail/whitelist-common.inc | |||
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | net none | 19 | net none |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
24 | notv | ||
23 | protocol unix,netlink | 25 | protocol unix,netlink |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
diff --git a/etc/openshot.profile b/etc/openshot.profile index b5ace455e..02f4665d6 100644 --- a/etc/openshot.profile +++ b/etc/openshot.profile | |||
@@ -15,9 +15,11 @@ include /etc/firejail/disable-programs.inc | |||
15 | 15 | ||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
22 | notv | ||
21 | protocol unix,inet,inet6,netlink | 23 | protocol unix,inet,inet6,netlink |
22 | seccomp | 24 | seccomp |
23 | shell none | 25 | shell none |
diff --git a/etc/opera-beta.profile b/etc/opera-beta.profile index 078f5a0dd..c295a2082 100644 --- a/etc/opera-beta.profile +++ b/etc/opera-beta.profile | |||
@@ -22,3 +22,5 @@ whitelist ~/.pki | |||
22 | include /etc/firejail/whitelist-common.inc | 22 | include /etc/firejail/whitelist-common.inc |
23 | 23 | ||
24 | netfilter | 24 | netfilter |
25 | nodvd | ||
26 | notv | ||
diff --git a/etc/opera.profile b/etc/opera.profile index 7802a124a..553ea6790 100644 --- a/etc/opera.profile +++ b/etc/opera.profile | |||
@@ -26,3 +26,5 @@ whitelist ~/.pki | |||
26 | include /etc/firejail/whitelist-common.inc | 26 | include /etc/firejail/whitelist-common.inc |
27 | 27 | ||
28 | netfilter | 28 | netfilter |
29 | nodvd | ||
30 | notv | ||
diff --git a/etc/orage.profile b/etc/orage.profile index 132b526b4..209c7e9db 100644 --- a/etc/orage.profile +++ b/etc/orage.profile | |||
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc | |||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | no3d | 18 | no3d |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
22 | nosound | 23 | nosound |
24 | notv | ||
23 | novideo | 25 | novideo |
24 | protocol unix | 26 | protocol unix |
25 | seccomp | 27 | seccomp |
diff --git a/etc/palemoon.profile b/etc/palemoon.profile index e3e498195..054e876c5 100644 --- a/etc/palemoon.profile +++ b/etc/palemoon.profile | |||
@@ -41,9 +41,11 @@ include /etc/firejail/whitelist-common.inc | |||
41 | 41 | ||
42 | caps.drop all | 42 | caps.drop all |
43 | netfilter | 43 | netfilter |
44 | nodvd | ||
44 | nogroups | 45 | nogroups |
45 | nonewprivs | 46 | nonewprivs |
46 | noroot | 47 | noroot |
48 | notv | ||
47 | protocol unix,inet,inet6,netlink | 49 | protocol unix,inet,inet6,netlink |
48 | seccomp | 50 | seccomp |
49 | shell none | 51 | shell none |
diff --git a/etc/parole.profile b/etc/parole.profile index 00a12afd9..794d91481 100644 --- a/etc/parole.profile +++ b/etc/parole.profile | |||
@@ -13,8 +13,10 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | nodvd | ||
16 | nonewprivs | 17 | nonewprivs |
17 | noroot | 18 | noroot |
19 | notv | ||
18 | protocol unix,inet,inet6 | 20 | protocol unix,inet,inet6 |
19 | seccomp | 21 | seccomp |
20 | shell none | 22 | shell none |
diff --git a/etc/pcmanfm.profile b/etc/pcmanfm.profile index f2bc908df..3b739b2ac 100644 --- a/etc/pcmanfm.profile +++ b/etc/pcmanfm.profile | |||
@@ -17,9 +17,11 @@ include /etc/firejail/disable-passwdmgr.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | net none | 18 | net none |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
22 | nosound | 23 | nosound |
24 | notv | ||
23 | novideo | 25 | novideo |
24 | protocol unix | 26 | protocol unix |
25 | seccomp | 27 | seccomp |
diff --git a/etc/pdfsam.profile b/etc/pdfsam.profile index 0f25f1fa5..fd52fb9ee 100644 --- a/etc/pdfsam.profile +++ b/etc/pdfsam.profile | |||
@@ -15,15 +15,18 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
26 | 28 | ||
29 | private-bin pdfsam,sh,bash,java,archlinux-java,grep,awk,dirname,uname,which,sort,find,readlink,expr,ls,java-config | ||
27 | private-dev | 30 | private-dev |
28 | private-tmp | 31 | private-tmp |
29 | 32 | ||
diff --git a/etc/pdftotext.profile b/etc/pdftotext.profile index 89fb295dd..540a428cc 100644 --- a/etc/pdftotext.profile +++ b/etc/pdftotext.profile | |||
@@ -15,10 +15,13 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
24 | novideo | ||
22 | protocol unix | 25 | protocol unix |
23 | seccomp | 26 | seccomp |
24 | shell none | 27 | shell none |
diff --git a/etc/peek.profile b/etc/peek.profile index 2860d3663..13c0c72e0 100644 --- a/etc/peek.profile +++ b/etc/peek.profile | |||
@@ -15,15 +15,18 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
26 | 28 | ||
29 | # private-bin breaks gif mode, mp4 and webm mode work fine however | ||
27 | # private-bin peek,convert,ffmpeg | 30 | # private-bin peek,convert,ffmpeg |
28 | private-dev | 31 | private-dev |
29 | private-tmp | 32 | private-tmp |
diff --git a/etc/picard.profile b/etc/picard.profile index ccdbc5116..8dc79b4ad 100644 --- a/etc/picard.profile +++ b/etc/picard.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | 15 | ||
16 | caps.drop all | 16 | caps.drop all |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix,inet,inet6 | 25 | protocol unix,inet,inet6 |
24 | seccomp | 26 | seccomp |
diff --git a/etc/pidgin.profile b/etc/pidgin.profile index 7bc88a814..dd610920a 100644 --- a/etc/pidgin.profile +++ b/etc/pidgin.profile | |||
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
21 | notv | ||
20 | protocol unix,inet,inet6 | 22 | protocol unix,inet,inet6 |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/pingus.profile b/etc/pingus.profile index 848bf88ad..68d5a98ad 100644 --- a/etc/pingus.profile +++ b/etc/pingus.profile | |||
@@ -17,9 +17,11 @@ include /etc/firejail/whitelist-common.inc | |||
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | net none | 19 | net none |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
24 | notv | ||
23 | protocol unix,netlink | 25 | protocol unix,netlink |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
diff --git a/etc/pithos.profile b/etc/pithos.profile index 7eea5d8c2..b81e0b634 100644 --- a/etc/pithos.profile +++ b/etc/pithos.profile | |||
@@ -15,15 +15,18 @@ include /etc/firejail/whitelist-common.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix,inet,inet6 | 24 | protocol unix,inet,inet6 |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
25 | 27 | ||
26 | disable-mnt | 28 | disable-mnt |
29 | # private-bin pithos,python,python3,python3.6 | ||
27 | private-dev | 30 | private-dev |
28 | private-tmp | 31 | private-tmp |
29 | 32 | ||
diff --git a/etc/pix.profile b/etc/pix.profile index 0d1d46fd6..ed9298727 100644 --- a/etc/pix.profile +++ b/etc/pix.profile | |||
@@ -16,10 +16,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
16 | include /etc/firejail/disable-programs.inc | 16 | include /etc/firejail/disable-programs.inc |
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
22 | nosound | 23 | nosound |
24 | notv | ||
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
diff --git a/etc/pluma.profile b/etc/pluma.profile index 75bdeadc4..d17a64d1d 100644 --- a/etc/pluma.profile +++ b/etc/pluma.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
23 | tracelog | 25 | tracelog |
diff --git a/etc/polari.profile b/etc/polari.profile index e2788b7d0..a990194c9 100644 --- a/etc/polari.profile +++ b/etc/polari.profile | |||
@@ -27,10 +27,12 @@ include /etc/firejail/whitelist-common.inc | |||
27 | caps.drop all | 27 | caps.drop all |
28 | netfilter | 28 | netfilter |
29 | no3d | 29 | no3d |
30 | nodvd | ||
30 | nogroups | 31 | nogroups |
31 | nonewprivs | 32 | nonewprivs |
32 | noroot | 33 | noroot |
33 | nosound | 34 | nosound |
35 | notv | ||
34 | protocol unix,inet,inet6 | 36 | protocol unix,inet,inet6 |
35 | seccomp | 37 | seccomp |
36 | shell none | 38 | shell none |
diff --git a/etc/psi-plus.profile b/etc/psi-plus.profile index 27ee2500c..72c52d967 100644 --- a/etc/psi-plus.profile +++ b/etc/psi-plus.profile | |||
@@ -25,9 +25,11 @@ include /etc/firejail/whitelist-common.inc | |||
25 | caps.drop all | 25 | caps.drop all |
26 | netfilter | 26 | netfilter |
27 | no3d | 27 | no3d |
28 | nodvd | ||
28 | nogroups | 29 | nogroups |
29 | nonewprivs | 30 | nonewprivs |
30 | noroot | 31 | noroot |
32 | notv | ||
31 | novideo | 33 | novideo |
32 | protocol unix,inet,inet6 | 34 | protocol unix,inet,inet6 |
33 | seccomp | 35 | seccomp |
diff --git a/etc/qbittorrent.profile b/etc/qbittorrent.profile index 025a6fa61..ea635ab6e 100644 --- a/etc/qbittorrent.profile +++ b/etc/qbittorrent.profile | |||
@@ -29,10 +29,12 @@ include /etc/firejail/whitelist-common.inc | |||
29 | caps.drop all | 29 | caps.drop all |
30 | machine-id | 30 | machine-id |
31 | netfilter | 31 | netfilter |
32 | nodvd | ||
32 | nogroups | 33 | nogroups |
33 | nonewprivs | 34 | nonewprivs |
34 | noroot | 35 | noroot |
35 | nosound | 36 | nosound |
37 | notv | ||
36 | protocol unix,inet,inet6,netlink | 38 | protocol unix,inet,inet6,netlink |
37 | seccomp | 39 | seccomp |
38 | # shell none | 40 | # shell none |
diff --git a/etc/qemu-launcher.profile b/etc/qemu-launcher.profile index 0f3235266..2738e04bb 100644 --- a/etc/qemu-launcher.profile +++ b/etc/qemu-launcher.profile | |||
@@ -13,9 +13,11 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
20 | notv | ||
19 | protocol unix,inet,inet6 | 21 | protocol unix,inet,inet6 |
20 | seccomp | 22 | seccomp |
21 | shell none | 23 | shell none |
diff --git a/etc/qemu-system-x86_64.profile b/etc/qemu-system-x86_64.profile index b1b8e9319..7a60007fe 100644 --- a/etc/qemu-system-x86_64.profile +++ b/etc/qemu-system-x86_64.profile | |||
@@ -12,9 +12,11 @@ include /etc/firejail/disable-programs.inc | |||
12 | 12 | ||
13 | caps.drop all | 13 | caps.drop all |
14 | netfilter | 14 | netfilter |
15 | nodvd | ||
15 | nogroups | 16 | nogroups |
16 | nonewprivs | 17 | nonewprivs |
17 | noroot | 18 | noroot |
19 | notv | ||
18 | protocol unix,inet,inet6 | 20 | protocol unix,inet,inet6 |
19 | seccomp | 21 | seccomp |
20 | shell none | 22 | shell none |
diff --git a/etc/qlipper.profile b/etc/qlipper.profile index 98c794624..796015654 100644 --- a/etc/qlipper.profile +++ b/etc/qlipper.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
diff --git a/etc/qpdfview.profile b/etc/qpdfview.profile index 596171420..2c652c688 100644 --- a/etc/qpdfview.profile +++ b/etc/qpdfview.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
15 | include /etc/firejail/disable-programs.inc | 15 | include /etc/firejail/disable-programs.inc |
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
diff --git a/etc/qtox.profile b/etc/qtox.profile index 08cbcd332..5cbe68c90 100644 --- a/etc/qtox.profile +++ b/etc/qtox.profile | |||
@@ -22,9 +22,11 @@ include /etc/firejail/whitelist-common.inc | |||
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | netfilter | 24 | netfilter |
25 | nodvd | ||
25 | nogroups | 26 | nogroups |
26 | nonewprivs | 27 | nonewprivs |
27 | noroot | 28 | noroot |
29 | notv | ||
28 | protocol unix,inet,inet6 | 30 | protocol unix,inet,inet6 |
29 | seccomp | 31 | seccomp |
30 | shell none | 32 | shell none |
diff --git a/etc/quassel.profile b/etc/quassel.profile index 9e9ecfce9..af0f723f1 100644 --- a/etc/quassel.profile +++ b/etc/quassel.profile | |||
@@ -12,7 +12,9 @@ include /etc/firejail/disable-programs.inc | |||
12 | 12 | ||
13 | caps.drop all | 13 | caps.drop all |
14 | netfilter | 14 | netfilter |
15 | nodvd | ||
15 | nonewprivs | 16 | nonewprivs |
16 | noroot | 17 | noroot |
18 | notv | ||
17 | protocol unix,inet,inet6 | 19 | protocol unix,inet,inet6 |
18 | seccomp | 20 | seccomp |
diff --git a/etc/quiterss.profile b/etc/quiterss.profile index 934763a25..6f20f6d7f 100644 --- a/etc/quiterss.profile +++ b/etc/quiterss.profile | |||
@@ -28,10 +28,12 @@ include /etc/firejail/whitelist-common.inc | |||
28 | 28 | ||
29 | caps.drop all | 29 | caps.drop all |
30 | netfilter | 30 | netfilter |
31 | nodvd | ||
31 | nogroups | 32 | nogroups |
32 | nonewprivs | 33 | nonewprivs |
33 | noroot | 34 | noroot |
34 | nosound | 35 | nosound |
36 | notv | ||
35 | protocol unix,inet,inet6 | 37 | protocol unix,inet,inet6 |
36 | seccomp | 38 | seccomp |
37 | shell none | 39 | shell none |
diff --git a/etc/qupzilla.profile b/etc/qupzilla.profile index 6d0c16785..7b7086bde 100644 --- a/etc/qupzilla.profile +++ b/etc/qupzilla.profile | |||
@@ -20,7 +20,9 @@ include /etc/firejail/whitelist-common.inc | |||
20 | 20 | ||
21 | caps.drop all | 21 | caps.drop all |
22 | netfilter | 22 | netfilter |
23 | nodvd | ||
23 | noroot | 24 | noroot |
25 | notv | ||
24 | protocol unix,inet,inet6,netlink | 26 | protocol unix,inet,inet6,netlink |
25 | seccomp | 27 | seccomp |
26 | tracelog | 28 | tracelog |
diff --git a/etc/qutebrowser.profile b/etc/qutebrowser.profile index 9eb0c9075..31721617f 100644 --- a/etc/qutebrowser.profile +++ b/etc/qutebrowser.profile | |||
@@ -23,8 +23,10 @@ include /etc/firejail/whitelist-common.inc | |||
23 | 23 | ||
24 | caps.drop all | 24 | caps.drop all |
25 | netfilter | 25 | netfilter |
26 | nodvd | ||
26 | nonewprivs | 27 | nonewprivs |
27 | noroot | 28 | noroot |
29 | notv | ||
28 | protocol unix,inet,inet6,netlink | 30 | protocol unix,inet,inet6,netlink |
29 | seccomp | 31 | seccomp |
30 | tracelog | 32 | tracelog |
diff --git a/etc/rambox.profile b/etc/rambox.profile index a5b87e901..2696df86b 100644 --- a/etc/rambox.profile +++ b/etc/rambox.profile | |||
@@ -21,9 +21,11 @@ include /etc/firejail/whitelist-common.inc | |||
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | netfilter | 23 | netfilter |
24 | nodvd | ||
24 | nogroups | 25 | nogroups |
25 | nonewprivs | 26 | nonewprivs |
26 | noroot | 27 | noroot |
28 | notv | ||
27 | protocol unix,inet,inet6,netlink | 29 | protocol unix,inet,inet6,netlink |
28 | seccomp | 30 | seccomp |
29 | # tracelog | 31 | # tracelog |
diff --git a/etc/ranger.profile b/etc/ranger.profile index 3767c7ba8..717eca099 100644 --- a/etc/ranger.profile +++ b/etc/ranger.profile | |||
@@ -18,10 +18,12 @@ include /etc/firejail/disable-programs.inc | |||
18 | 18 | ||
19 | caps.drop all | 19 | caps.drop all |
20 | net none | 20 | net none |
21 | nodvd | ||
21 | nogroups | 22 | nogroups |
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
24 | nosound | 25 | nosound |
26 | notv | ||
25 | protocol unix | 27 | protocol unix |
26 | seccomp | 28 | seccomp |
27 | 29 | ||
diff --git a/etc/remmina.profile b/etc/remmina.profile index 39b5b2acd..3bb6aa0b1 100644 --- a/etc/remmina.profile +++ b/etc/remmina.profile | |||
@@ -15,9 +15,11 @@ include /etc/firejail/disable-passwdmgr.inc | |||
15 | include /etc/firejail/disable-programs.inc | 15 | include /etc/firejail/disable-programs.inc |
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix,inet,inet6 | 24 | protocol unix,inet,inet6 |
23 | seccomp | 25 | seccomp |
diff --git a/etc/rhythmbox.profile b/etc/rhythmbox.profile index ac8882165..bcd72be9a 100644 --- a/etc/rhythmbox.profile +++ b/etc/rhythmbox.profile | |||
@@ -17,6 +17,7 @@ netfilter | |||
17 | nogroups | 17 | nogroups |
18 | nonewprivs | 18 | nonewprivs |
19 | noroot | 19 | noroot |
20 | notv | ||
20 | novideo | 21 | novideo |
21 | protocol unix,inet,inet6 | 22 | protocol unix,inet,inet6 |
22 | seccomp | 23 | seccomp |
diff --git a/etc/riot-web.profile b/etc/riot-web.profile index 93f389bbc..c714652df 100644 --- a/etc/riot-web.profile +++ b/etc/riot-web.profile | |||
@@ -10,4 +10,5 @@ noblacklist ~/.config/Riot | |||
10 | whitelist ~/.config/Riot | 10 | whitelist ~/.config/Riot |
11 | include /etc/firejail/whitelist-common.inc | 11 | include /etc/firejail/whitelist-common.inc |
12 | 12 | ||
13 | # Redirect | ||
13 | include /etc/firejail/electron.profile | 14 | include /etc/firejail/electron.profile |
diff --git a/etc/ristretto.profile b/etc/ristretto.profile index 8070254ac..3de5de34a 100644 --- a/etc/ristretto.profile +++ b/etc/ristretto.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix | 27 | protocol unix |
26 | seccomp | 28 | seccomp |
diff --git a/etc/rtorrent.profile b/etc/rtorrent.profile index b9f9960f4..a44d99e5b 100644 --- a/etc/rtorrent.profile +++ b/etc/rtorrent.profile | |||
@@ -13,9 +13,11 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | nodvd | ||
16 | nonewprivs | 17 | nonewprivs |
17 | noroot | 18 | noroot |
18 | nosound | 19 | nosound |
20 | notv | ||
19 | protocol unix,inet,inet6 | 21 | protocol unix,inet,inet6 |
20 | seccomp | 22 | seccomp |
21 | shell none | 23 | shell none |
diff --git a/etc/scribus.profile b/etc/scribus.profile index 7e117dcd1..acd6b2239 100644 --- a/etc/scribus.profile +++ b/etc/scribus.profile | |||
@@ -5,7 +5,7 @@ include /etc/firejail/scribus.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include /etc/firejail/globals.local | 6 | include /etc/firejail/globals.local |
7 | 7 | ||
8 | # Support for PDF readers (Scribus 1.5 and higher) | 8 | # Support for PDF readers comes with Scribus 1.5 and higher |
9 | noblacklist ~/.config/okularpartrc | 9 | noblacklist ~/.config/okularpartrc |
10 | noblacklist ~/.config/okularrc | 10 | noblacklist ~/.config/okularrc |
11 | noblacklist ~/.config/scribus | 11 | noblacklist ~/.config/scribus |
@@ -27,9 +27,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
27 | include /etc/firejail/disable-programs.inc | 27 | include /etc/firejail/disable-programs.inc |
28 | 28 | ||
29 | caps.drop all | 29 | caps.drop all |
30 | nodvd | ||
30 | nonewprivs | 31 | nonewprivs |
31 | noroot | 32 | noroot |
32 | nosound | 33 | nosound |
34 | notv | ||
35 | novideo | ||
33 | protocol unix | 36 | protocol unix |
34 | seccomp | 37 | seccomp |
35 | tracelog | 38 | tracelog |
diff --git a/etc/sdat2img.profile b/etc/sdat2img.profile index 7311594c0..ce4c4d416 100644 --- a/etc/sdat2img.profile +++ b/etc/sdat2img.profile | |||
@@ -15,15 +15,18 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
26 | 28 | ||
29 | # private-bin sdat2img,env,python,python3,python3.6 | ||
27 | private-dev | 30 | private-dev |
28 | 31 | ||
29 | noexec ${HOME} | 32 | noexec ${HOME} |
diff --git a/etc/seamonkey-bin.profile b/etc/seamonkey-bin.profile index 25e882b32..1ceed99fd 100644 --- a/etc/seamonkey-bin.profile +++ b/etc/seamonkey-bin.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/seamonkey.profile | 6 | include /etc/firejail/seamonkey.profile |
diff --git a/etc/seamonkey.profile b/etc/seamonkey.profile index 072a9fef5..36dde66b0 100644 --- a/etc/seamonkey.profile +++ b/etc/seamonkey.profile | |||
@@ -37,8 +37,10 @@ include /etc/firejail/whitelist-common.inc | |||
37 | 37 | ||
38 | caps.drop all | 38 | caps.drop all |
39 | netfilter | 39 | netfilter |
40 | nodvd | ||
40 | nonewprivs | 41 | nonewprivs |
41 | noroot | 42 | noroot |
43 | notv | ||
42 | protocol unix,inet,inet6,netlink | 44 | protocol unix,inet,inet6,netlink |
43 | seccomp | 45 | seccomp |
44 | tracelog | 46 | tracelog |
diff --git a/etc/server.profile b/etc/server.profile index b0dd13f80..04ef555de 100644 --- a/etc/server.profile +++ b/etc/server.profile | |||
@@ -21,7 +21,10 @@ include /etc/firejail/disable-programs.inc | |||
21 | 21 | ||
22 | caps | 22 | caps |
23 | no3d | 23 | no3d |
24 | nodvd | ||
24 | nosound | 25 | nosound |
26 | notv | ||
27 | novideo | ||
25 | seccomp | 28 | seccomp |
26 | 29 | ||
27 | # disable-mnt | 30 | # disable-mnt |
diff --git a/etc/silentarmy.profile b/etc/silentarmy.profile index d5d92670b..abc68a499 100644 --- a/etc/silentarmy.profile +++ b/etc/silentarmy.profile | |||
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
19 | nosound | 20 | nosound |
21 | notv | ||
20 | novideo | 22 | novideo |
21 | protocol unix,inet,inet6 | 23 | protocol unix,inet,inet6 |
22 | seccomp | 24 | seccomp |
diff --git a/etc/simple-scan.profile b/etc/simple-scan.profile index a55388fee..05ed9f813 100644 --- a/etc/simple-scan.profile +++ b/etc/simple-scan.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | protocol unix,inet,inet6 | 23 | protocol unix,inet,inet6 |
22 | shell none | 24 | shell none |
23 | # seccomp | 25 | # seccomp |
diff --git a/etc/simutrans.profile b/etc/simutrans.profile index d67d2a575..fda5204e2 100644 --- a/etc/simutrans.profile +++ b/etc/simutrans.profile | |||
@@ -17,9 +17,11 @@ include /etc/firejail/whitelist-common.inc | |||
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | net none | 19 | net none |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
24 | notv | ||
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
diff --git a/etc/skanlite.profile b/etc/skanlite.profile index 25f0107f8..0338bc452 100644 --- a/etc/skanlite.profile +++ b/etc/skanlite.profile | |||
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
19 | nosound | 20 | nosound |
21 | notv | ||
20 | # protocol unix,inet,inet6 | 22 | # protocol unix,inet,inet6 |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/skype.profile b/etc/skype.profile index 396563f0c..f3e504a3f 100644 --- a/etc/skype.profile +++ b/etc/skype.profile | |||
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
21 | notv | ||
20 | protocol unix,inet,inet6 | 22 | protocol unix,inet,inet6 |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/skypeforlinux.profile b/etc/skypeforlinux.profile index 7037961f8..b69a208a8 100644 --- a/etc/skypeforlinux.profile +++ b/etc/skypeforlinux.profile | |||
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
21 | notv | ||
20 | protocol unix,inet,inet6,netlink | 22 | protocol unix,inet,inet6,netlink |
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
diff --git a/etc/slack.profile b/etc/slack.profile index d2fb74af8..9025e4f75 100644 --- a/etc/slack.profile +++ b/etc/slack.profile | |||
@@ -24,9 +24,11 @@ include /etc/firejail/whitelist-common.inc | |||
24 | caps.drop all | 24 | caps.drop all |
25 | name slack | 25 | name slack |
26 | netfilter | 26 | netfilter |
27 | nodvd | ||
27 | nogroups | 28 | nogroups |
28 | nonewprivs | 29 | nonewprivs |
29 | noroot | 30 | noroot |
31 | notv | ||
30 | protocol unix,inet,inet6,netlink | 32 | protocol unix,inet,inet6,netlink |
31 | seccomp | 33 | seccomp |
32 | shell none | 34 | shell none |
diff --git a/etc/smplayer.profile b/etc/smplayer.profile index d8861f937..ea80b2b0a 100644 --- a/etc/smplayer.profile +++ b/etc/smplayer.profile | |||
@@ -22,7 +22,7 @@ protocol unix,inet,inet6,netlink | |||
22 | seccomp | 22 | seccomp |
23 | shell none | 23 | shell none |
24 | 24 | ||
25 | private-bin smplayer,mplayer | 25 | private-bin smplayer,mplayer,mpv |
26 | private-dev | 26 | private-dev |
27 | private-tmp | 27 | private-tmp |
28 | 28 | ||
diff --git a/etc/snap.profile b/etc/snap.profile index 38aef7c23..238dffeab 100644 --- a/etc/snap.profile +++ b/etc/snap.profile | |||
@@ -14,3 +14,5 @@ include /etc/firejail/disable-programs.inc | |||
14 | whitelist ${DOWNLOADS} | 14 | whitelist ${DOWNLOADS} |
15 | whitelist ~/snap | 15 | whitelist ~/snap |
16 | include /etc/firejail/whitelist-common.inc | 16 | include /etc/firejail/whitelist-common.inc |
17 | nodvd | ||
18 | notv | ||
diff --git a/etc/soffice.profile b/etc/soffice.profile index c30bb5550..c702a4ece 100644 --- a/etc/soffice.profile +++ b/etc/soffice.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/libreoffice.profile | 6 | include /etc/firejail/libreoffice.profile |
diff --git a/etc/soundconverter.profile b/etc/soundconverter.profile index 12ae63cf9..5d7129b5a 100644 --- a/etc/soundconverter.profile +++ b/etc/soundconverter.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | caps.drop all | 14 | caps.drop all |
15 | net none | 15 | net none |
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | novideo | 23 | novideo |
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
diff --git a/etc/spotify.profile b/etc/spotify.profile index 64805153c..8eac3610b 100644 --- a/etc/spotify.profile +++ b/etc/spotify.profile | |||
@@ -36,6 +36,7 @@ netfilter | |||
36 | nogroups | 36 | nogroups |
37 | nonewprivs | 37 | nonewprivs |
38 | noroot | 38 | noroot |
39 | notv | ||
39 | protocol unix,inet,inet6,netlink | 40 | protocol unix,inet,inet6,netlink |
40 | seccomp | 41 | seccomp |
41 | shell none | 42 | shell none |
diff --git a/etc/sqlitebrowser.profile b/etc/sqlitebrowser.profile index ac7daa873..65e8073c9 100644 --- a/etc/sqlitebrowser.profile +++ b/etc/sqlitebrowser.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
diff --git a/etc/ssh-agent.profile b/etc/ssh-agent.profile index f2c88c943..ba5115521 100644 --- a/etc/ssh-agent.profile +++ b/etc/ssh-agent.profile | |||
@@ -19,7 +19,9 @@ include /etc/firejail/disable-programs.inc | |||
19 | caps.drop all | 19 | caps.drop all |
20 | netfilter | 20 | netfilter |
21 | no3d | 21 | no3d |
22 | nodvd | ||
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
25 | notv | ||
24 | protocol unix,inet,inet6 | 26 | protocol unix,inet,inet6 |
25 | seccomp | 27 | seccomp |
diff --git a/etc/ssh.profile b/etc/ssh.profile index ac3b7a0ba..da852c6ba 100644 --- a/etc/ssh.profile +++ b/etc/ssh.profile | |||
@@ -18,10 +18,12 @@ caps.drop all | |||
18 | ipc-namespace | 18 | ipc-namespace |
19 | netfilter | 19 | netfilter |
20 | no3d | 20 | no3d |
21 | nodvd | ||
21 | nogroups | 22 | nogroups |
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
24 | nosound | 25 | nosound |
26 | notv | ||
25 | protocol unix,inet,inet6 | 27 | protocol unix,inet,inet6 |
26 | seccomp | 28 | seccomp |
27 | shell none | 29 | shell none |
diff --git a/etc/start-tor-browser.profile b/etc/start-tor-browser.profile index 26154508a..ca521e08c 100644 --- a/etc/start-tor-browser.profile +++ b/etc/start-tor-browser.profile | |||
@@ -13,9 +13,11 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | nodvd | ||
16 | nogroups | 17 | nogroups |
17 | nonewprivs | 18 | nonewprivs |
18 | noroot | 19 | noroot |
20 | notv | ||
19 | protocol unix,inet,inet6 | 21 | protocol unix,inet,inet6 |
20 | seccomp | 22 | seccomp |
21 | shell none | 23 | shell none |
diff --git a/etc/steam.profile b/etc/steam.profile index d928e660d..96899038a 100644 --- a/etc/steam.profile +++ b/etc/steam.profile | |||
@@ -24,9 +24,11 @@ include /etc/firejail/disable-programs.inc | |||
24 | 24 | ||
25 | caps.drop all | 25 | caps.drop all |
26 | netfilter | 26 | netfilter |
27 | nodvd | ||
27 | nogroups | 28 | nogroups |
28 | nonewprivs | 29 | nonewprivs |
29 | noroot | 30 | noroot |
31 | notv | ||
30 | # novideo | 32 | # novideo |
31 | protocol unix,inet,inet6,netlink | 33 | protocol unix,inet,inet6,netlink |
32 | seccomp | 34 | seccomp |
diff --git a/etc/stellarium.profile b/etc/stellarium.profile index 768fbd082..89e2d1a30 100644 --- a/etc/stellarium.profile +++ b/etc/stellarium.profile | |||
@@ -21,10 +21,12 @@ include /etc/firejail/whitelist-common.inc | |||
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | netfilter | 23 | netfilter |
24 | nodvd | ||
24 | nogroups | 25 | nogroups |
25 | nonewprivs | 26 | nonewprivs |
26 | noroot | 27 | noroot |
27 | nosound | 28 | nosound |
29 | notv | ||
28 | protocol unix,inet,inet6,netlink | 30 | protocol unix,inet,inet6,netlink |
29 | seccomp | 31 | seccomp |
30 | shell none | 32 | shell none |
diff --git a/etc/strings.profile b/etc/strings.profile index 09957ae09..83561cae5 100644 --- a/etc/strings.profile +++ b/etc/strings.profile | |||
@@ -11,12 +11,16 @@ blacklist /tmp/.X11-unix | |||
11 | ignore noroot | 11 | ignore noroot |
12 | net none | 12 | net none |
13 | no3d | 13 | no3d |
14 | nodvd | ||
14 | nosound | 15 | nosound |
16 | notv | ||
15 | novideo | 17 | novideo |
16 | shell none | 18 | shell none |
17 | tracelog | 19 | tracelog |
18 | 20 | ||
21 | private-bin strings | ||
19 | private-dev | 22 | private-dev |
23 | private-lib | ||
20 | 24 | ||
21 | memory-deny-write-execute | 25 | memory-deny-write-execute |
22 | 26 | ||
diff --git a/etc/supertux2.profile b/etc/supertux2.profile index 4e70f9e8c..cd6496a7b 100644 --- a/etc/supertux2.profile +++ b/etc/supertux2.profile | |||
@@ -17,9 +17,11 @@ include /etc/firejail/whitelist-common.inc | |||
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | net none | 19 | net none |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
24 | notv | ||
23 | protocol unix,netlink | 25 | protocol unix,netlink |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
diff --git a/etc/synfigstudio.profile b/etc/synfigstudio.profile index 6861e6efb..08ece1e9b 100644 --- a/etc/synfigstudio.profile +++ b/etc/synfigstudio.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | 15 | ||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
diff --git a/etc/tar.profile b/etc/tar.profile index 817e51542..34a4f34d6 100644 --- a/etc/tar.profile +++ b/etc/tar.profile | |||
@@ -12,7 +12,9 @@ hostname tar | |||
12 | ignore noroot | 12 | ignore noroot |
13 | net none | 13 | net none |
14 | no3d | 14 | no3d |
15 | nodvd | ||
15 | nosound | 16 | nosound |
17 | notv | ||
16 | shell none | 18 | shell none |
17 | tracelog | 19 | tracelog |
18 | 20 | ||
diff --git a/etc/telegram-desktop.profile b/etc/telegram-desktop.profile index 844595b3f..df6557a90 100644 --- a/etc/telegram-desktop.profile +++ b/etc/telegram-desktop.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/telegram.profile | 6 | include /etc/firejail/telegram.profile |
diff --git a/etc/telegram.profile b/etc/telegram.profile index e40233c35..e3ccaf1a0 100644 --- a/etc/telegram.profile +++ b/etc/telegram.profile | |||
@@ -13,8 +13,10 @@ include /etc/firejail/disable-programs.inc | |||
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | netfilter | 15 | netfilter |
16 | nodvd | ||
16 | nonewprivs | 17 | nonewprivs |
17 | noroot | 18 | noroot |
19 | notv | ||
18 | protocol unix,inet,inet6 | 20 | protocol unix,inet,inet6 |
19 | seccomp | 21 | seccomp |
20 | 22 | ||
diff --git a/etc/thunar.profile b/etc/thunar.profile index 044f22d29..1545e8c7e 100644 --- a/etc/thunar.profile +++ b/etc/thunar.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/Thunar.profile | 6 | include /etc/firejail/Thunar.profile |
diff --git a/etc/thunderbird.profile b/etc/thunderbird.profile index d3b7ee871..17bf51873 100644 --- a/etc/thunderbird.profile +++ b/etc/thunderbird.profile | |||
@@ -18,7 +18,6 @@ mkdir ~/.gnupg | |||
18 | mkdir ~/.icedove | 18 | mkdir ~/.icedove |
19 | mkdir ~/.thunderbird | 19 | mkdir ~/.thunderbird |
20 | whitelist ~/.cache/thunderbird | 20 | whitelist ~/.cache/thunderbird |
21 | whitelist ~/.config/mimeapps.list | ||
22 | whitelist ~/.gnupg | 21 | whitelist ~/.gnupg |
23 | whitelist ~/.icedove | 22 | whitelist ~/.icedove |
24 | whitelist ~/.local/share/applications | 23 | whitelist ~/.local/share/applications |
@@ -28,7 +27,7 @@ include /etc/firejail/whitelist-common.inc | |||
28 | ignore private-tmp | 27 | ignore private-tmp |
29 | 28 | ||
30 | read-only ~/.config/mimeapps.list | 29 | read-only ~/.config/mimeapps.list |
31 | read-only ~/.local/share/applications | ||
32 | 30 | ||
33 | # allow browsers | 31 | # allow browsers |
32 | # Redirect | ||
34 | include /etc/firejail/firefox.profile | 33 | include /etc/firejail/firefox.profile |
diff --git a/etc/tracker.profile b/etc/tracker.profile index feb8b4fd3..ded2ae2e5 100644 --- a/etc/tracker.profile +++ b/etc/tracker.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | protocol unix | 26 | protocol unix |
25 | seccomp | 27 | seccomp |
26 | shell none | 28 | shell none |
diff --git a/etc/transmission-cli.profile b/etc/transmission-cli.profile index e8fdd81d7..5752c96f3 100644 --- a/etc/transmission-cli.profile +++ b/etc/transmission-cli.profile | |||
@@ -15,9 +15,11 @@ include /etc/firejail/disable-programs.inc | |||
15 | 15 | ||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | nodvd | ||
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | protocol unix,inet,inet6 | 23 | protocol unix,inet,inet6 |
22 | seccomp | 24 | seccomp |
23 | shell none | 25 | shell none |
diff --git a/etc/transmission-gtk.profile b/etc/transmission-gtk.profile index b3cf5213a..c4bf7a08d 100644 --- a/etc/transmission-gtk.profile +++ b/etc/transmission-gtk.profile | |||
@@ -22,9 +22,11 @@ include /etc/firejail/whitelist-common.inc | |||
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | netfilter | 24 | netfilter |
25 | nodvd | ||
25 | nonewprivs | 26 | nonewprivs |
26 | noroot | 27 | noroot |
27 | nosound | 28 | nosound |
29 | notv | ||
28 | protocol unix,inet,inet6 | 30 | protocol unix,inet,inet6 |
29 | seccomp | 31 | seccomp |
30 | shell none | 32 | shell none |
diff --git a/etc/transmission-qt.profile b/etc/transmission-qt.profile index 433fb716e..02e9a5052 100644 --- a/etc/transmission-qt.profile +++ b/etc/transmission-qt.profile | |||
@@ -22,9 +22,11 @@ include /etc/firejail/whitelist-common.inc | |||
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | netfilter | 24 | netfilter |
25 | nodvd | ||
25 | nonewprivs | 26 | nonewprivs |
26 | noroot | 27 | noroot |
27 | nosound | 28 | nosound |
29 | notv | ||
28 | protocol unix,inet,inet6 | 30 | protocol unix,inet,inet6 |
29 | seccomp | 31 | seccomp |
30 | shell none | 32 | shell none |
diff --git a/etc/transmission-show.profile b/etc/transmission-show.profile index e87ab51df..130defc8e 100644 --- a/etc/transmission-show.profile +++ b/etc/transmission-show.profile | |||
@@ -15,9 +15,11 @@ include /etc/firejail/disable-programs.inc | |||
15 | 15 | ||
16 | caps.drop all | 16 | caps.drop all |
17 | net none | 17 | net none |
18 | nodvd | ||
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | protocol unix | 23 | protocol unix |
22 | seccomp | 24 | seccomp |
23 | shell none | 25 | shell none |
diff --git a/etc/truecraft.profile b/etc/truecraft.profile index 850845c95..4e48f6c6b 100644 --- a/etc/truecraft.profile +++ b/etc/truecraft.profile | |||
@@ -20,9 +20,11 @@ whitelist ${HOME}/.config/truecraft | |||
20 | include /etc/firejail/whitelist-common.inc | 20 | include /etc/firejail/whitelist-common.inc |
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | nodvd | ||
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
27 | notv | ||
26 | novideo | 28 | novideo |
27 | protocol unix,inet,inet6 | 29 | protocol unix,inet,inet6 |
28 | seccomp | 30 | seccomp |
diff --git a/etc/tuxguitar.profile b/etc/tuxguitar.profile new file mode 100644 index 000000000..ddbcce3f6 --- /dev/null +++ b/etc/tuxguitar.profile | |||
@@ -0,0 +1,31 @@ | |||
1 | # Firejail profile for tuxguitar | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include /etc/firejail/tuxguitar.local | ||
5 | # Persistent global definitions | ||
6 | include /etc/firejail/globals.local | ||
7 | |||
8 | noblacklist ~/.java | ||
9 | noblacklist ~/.tuxguitar* | ||
10 | |||
11 | include /etc/firejail/disable-common.inc | ||
12 | include /etc/firejail/disable-devel.inc | ||
13 | include /etc/firejail/disable-passwdmgr.inc | ||
14 | include /etc/firejail/disable-programs.inc | ||
15 | |||
16 | caps.drop all | ||
17 | no3d | ||
18 | nodvd | ||
19 | nonewprivs | ||
20 | noroot | ||
21 | notv | ||
22 | novideo | ||
23 | protocol unix,inet,inet6 | ||
24 | seccomp | ||
25 | tracelog | ||
26 | |||
27 | private-dev | ||
28 | private-tmp | ||
29 | |||
30 | # noexec ${HOME} - tuxguitar may fail to launch | ||
31 | noexec /tmp | ||
diff --git a/etc/uget-gtk.profile b/etc/uget-gtk.profile index 775ac8a96..877ad635b 100644 --- a/etc/uget-gtk.profile +++ b/etc/uget-gtk.profile | |||
@@ -18,9 +18,11 @@ include /etc/firejail/whitelist-common.inc | |||
18 | 18 | ||
19 | caps.drop all | 19 | caps.drop all |
20 | netfilter | 20 | netfilter |
21 | nodvd | ||
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | protocol unix,inet,inet6 | 26 | protocol unix,inet,inet6 |
25 | seccomp | 27 | seccomp |
26 | shell none | 28 | shell none |
diff --git a/etc/unbound.profile b/etc/unbound.profile index 091d59c1a..c1cb86893 100644 --- a/etc/unbound.profile +++ b/etc/unbound.profile | |||
@@ -14,7 +14,9 @@ include /etc/firejail/disable-passwdmgr.inc | |||
14 | include /etc/firejail/disable-programs.inc | 14 | include /etc/firejail/disable-programs.inc |
15 | 15 | ||
16 | no3d | 16 | no3d |
17 | nodvd | ||
17 | nosound | 18 | nosound |
19 | notv | ||
18 | seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open | 20 | seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open |
19 | 21 | ||
20 | private | 22 | private |
diff --git a/etc/unknown-horizons.profile b/etc/unknown-horizons.profile index e09b65632..5f70843d6 100644 --- a/etc/unknown-horizons.profile +++ b/etc/unknown-horizons.profile | |||
@@ -16,9 +16,11 @@ whitelist ~/.unknown-horizons | |||
16 | include /etc/firejail/whitelist-common.inc | 16 | include /etc/firejail/whitelist-common.inc |
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
23 | notv | ||
22 | protocol unix,netlink,inet,inet6 | 24 | protocol unix,netlink,inet,inet6 |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
diff --git a/etc/unrar.profile b/etc/unrar.profile index 8d8fda952..6a3ac5527 100644 --- a/etc/unrar.profile +++ b/etc/unrar.profile | |||
@@ -12,7 +12,9 @@ hostname unrar | |||
12 | ignore noroot | 12 | ignore noroot |
13 | net none | 13 | net none |
14 | no3d | 14 | no3d |
15 | nodvd | ||
15 | nosound | 16 | nosound |
17 | notv | ||
16 | shell none | 18 | shell none |
17 | tracelog | 19 | tracelog |
18 | 20 | ||
diff --git a/etc/unzip.profile b/etc/unzip.profile index 6556b4f56..bb30d74cd 100644 --- a/etc/unzip.profile +++ b/etc/unzip.profile | |||
@@ -12,7 +12,9 @@ hostname unzip | |||
12 | ignore noroot | 12 | ignore noroot |
13 | net none | 13 | net none |
14 | no3d | 14 | no3d |
15 | nodvd | ||
15 | nosound | 16 | nosound |
17 | notv | ||
16 | shell none | 18 | shell none |
17 | tracelog | 19 | tracelog |
18 | 20 | ||
diff --git a/etc/uudeview.profile b/etc/uudeview.profile index 22457bf2c..192d13f80 100644 --- a/etc/uudeview.profile +++ b/etc/uudeview.profile | |||
@@ -10,7 +10,9 @@ include /etc/firejail/globals.local | |||
10 | hostname uudeview | 10 | hostname uudeview |
11 | ignore noroot | 11 | ignore noroot |
12 | net none | 12 | net none |
13 | nodvd | ||
13 | nosound | 14 | nosound |
15 | notv | ||
14 | shell none | 16 | shell none |
15 | tracelog | 17 | tracelog |
16 | 18 | ||
diff --git a/etc/uzbl-browser.profile b/etc/uzbl-browser.profile index caae3659e..e7c931f30 100644 --- a/etc/uzbl-browser.profile +++ b/etc/uzbl-browser.profile | |||
@@ -25,8 +25,10 @@ include /etc/firejail/whitelist-common.inc | |||
25 | 25 | ||
26 | caps.drop all | 26 | caps.drop all |
27 | netfilter | 27 | netfilter |
28 | nodvd | ||
28 | nonewprivs | 29 | nonewprivs |
29 | noroot | 30 | noroot |
31 | notv | ||
30 | protocol unix,inet,inet6 | 32 | protocol unix,inet,inet6 |
31 | seccomp | 33 | seccomp |
32 | tracelog | 34 | tracelog |
diff --git a/etc/viewnior.profile b/etc/viewnior.profile index 9235d149c..a02845885 100644 --- a/etc/viewnior.profile +++ b/etc/viewnior.profile | |||
@@ -19,10 +19,12 @@ include /etc/firejail/disable-programs.inc | |||
19 | 19 | ||
20 | caps.drop all | 20 | caps.drop all |
21 | net none | 21 | net none |
22 | nodvd | ||
22 | nogroups | 23 | nogroups |
23 | nonewprivs | 24 | nonewprivs |
24 | noroot | 25 | noroot |
25 | nosound | 26 | nosound |
27 | notv | ||
26 | protocol unix | 28 | protocol unix |
27 | seccomp | 29 | seccomp |
28 | shell none | 30 | shell none |
diff --git a/etc/viking.profile b/etc/viking.profile index aa26388f8..30e89b511 100644 --- a/etc/viking.profile +++ b/etc/viking.profile | |||
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc | |||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | no3d | 18 | no3d |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
22 | nosound | 23 | nosound |
24 | notv | ||
23 | protocol unix,inet,inet6 | 25 | protocol unix,inet,inet6 |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
diff --git a/etc/vim.profile b/etc/vim.profile index 815676da8..7b5566f5b 100644 --- a/etc/vim.profile +++ b/etc/vim.profile | |||
@@ -15,8 +15,10 @@ include /etc/firejail/disable-programs.inc | |||
15 | 15 | ||
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
22 | notv | ||
21 | protocol unix,inet,inet6 | 23 | protocol unix,inet,inet6 |
22 | seccomp | 24 | seccomp |
diff --git a/etc/virtualbox.profile b/etc/virtualbox.profile index e94dec35c..6e153d559 100644 --- a/etc/virtualbox.profile +++ b/etc/virtualbox.profile | |||
@@ -24,3 +24,5 @@ include /etc/firejail/whitelist-common.inc | |||
24 | 24 | ||
25 | caps.drop all | 25 | caps.drop all |
26 | netfilter | 26 | netfilter |
27 | nodvd | ||
28 | notv | ||
diff --git a/etc/vivaldi-beta.profile b/etc/vivaldi-beta.profile index 4fa8a877c..d1ceb74f4 100644 --- a/etc/vivaldi-beta.profile +++ b/etc/vivaldi-beta.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/vivaldi.profile | 6 | include /etc/firejail/vivaldi.profile |
diff --git a/etc/vivaldi-stable.profile b/etc/vivaldi-stable.profile index 4fa8a877c..d1ceb74f4 100644 --- a/etc/vivaldi-stable.profile +++ b/etc/vivaldi-stable.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/vivaldi.profile | 6 | include /etc/firejail/vivaldi.profile |
diff --git a/etc/vivaldi.profile b/etc/vivaldi.profile index ae9b49e8c..503916b26 100644 --- a/etc/vivaldi.profile +++ b/etc/vivaldi.profile | |||
@@ -21,7 +21,9 @@ include /etc/firejail/whitelist-common.inc | |||
21 | 21 | ||
22 | caps.keep sys_chroot,sys_admin | 22 | caps.keep sys_chroot,sys_admin |
23 | netfilter | 23 | netfilter |
24 | nodvd | ||
24 | nogroups | 25 | nogroups |
26 | notv | ||
25 | shell none | 27 | shell none |
26 | 28 | ||
27 | private-dev | 29 | private-dev |
diff --git a/etc/vym.profile b/etc/vym.profile index f769dda16..4f60b2ada 100644 --- a/etc/vym.profile +++ b/etc/vym.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
diff --git a/etc/w3m.profile b/etc/w3m.profile index fc5ee2bad..b25e19135 100644 --- a/etc/w3m.profile +++ b/etc/w3m.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | protocol unix,inet,inet6 | 26 | protocol unix,inet,inet6 |
25 | seccomp | 27 | seccomp |
26 | shell none | 28 | shell none |
diff --git a/etc/warzone2100.profile b/etc/warzone2100.profile index 9569226aa..976f7db5f 100644 --- a/etc/warzone2100.profile +++ b/etc/warzone2100.profile | |||
@@ -20,9 +20,11 @@ include /etc/firejail/whitelist-common.inc | |||
20 | 20 | ||
21 | caps.drop all | 21 | caps.drop all |
22 | netfilter | 22 | netfilter |
23 | nodvd | ||
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
25 | noroot | 26 | noroot |
27 | notv | ||
26 | protocol unix,inet,inet6,netlink | 28 | protocol unix,inet,inet6,netlink |
27 | seccomp | 29 | seccomp |
28 | shell none | 30 | shell none |
diff --git a/etc/waterfox.profile b/etc/waterfox.profile index 893d45719..76b7c86ba 100644 --- a/etc/waterfox.profile +++ b/etc/waterfox.profile | |||
@@ -52,9 +52,11 @@ include /etc/firejail/whitelist-common.inc | |||
52 | 52 | ||
53 | caps.drop all | 53 | caps.drop all |
54 | netfilter | 54 | netfilter |
55 | nodvd | ||
55 | nogroups | 56 | nogroups |
56 | nonewprivs | 57 | nonewprivs |
57 | noroot | 58 | noroot |
59 | notv | ||
58 | protocol unix,inet,inet6,netlink | 60 | protocol unix,inet,inet6,netlink |
59 | seccomp | 61 | seccomp |
60 | shell none | 62 | shell none |
diff --git a/etc/weechat-curses.profile b/etc/weechat-curses.profile index 2d3f6c963..0da7d45d6 100644 --- a/etc/weechat-curses.profile +++ b/etc/weechat-curses.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/weechat.profile | 6 | include /etc/firejail/weechat.profile |
diff --git a/etc/weechat.profile b/etc/weechat.profile index 833414f3e..b0971ae19 100644 --- a/etc/weechat.profile +++ b/etc/weechat.profile | |||
@@ -12,8 +12,10 @@ include /etc/firejail/disable-programs.inc | |||
12 | 12 | ||
13 | caps.drop all | 13 | caps.drop all |
14 | netfilter | 14 | netfilter |
15 | nodvd | ||
15 | nonewprivs | 16 | nonewprivs |
16 | noroot | 17 | noroot |
18 | notv | ||
17 | protocol unix,inet,inet6 | 19 | protocol unix,inet,inet6 |
18 | seccomp | 20 | seccomp |
19 | 21 | ||
diff --git a/etc/wesnoth.profile b/etc/wesnoth.profile index 9798e0ace..d6318c81b 100644 --- a/etc/wesnoth.profile +++ b/etc/wesnoth.profile | |||
@@ -23,8 +23,10 @@ whitelist ${HOME}/.local/share/wesnoth | |||
23 | include /etc/firejail/whitelist-common.inc | 23 | include /etc/firejail/whitelist-common.inc |
24 | 24 | ||
25 | caps.drop all | 25 | caps.drop all |
26 | nodvd | ||
26 | nonewprivs | 27 | nonewprivs |
27 | noroot | 28 | noroot |
29 | notv | ||
28 | protocol unix,inet,inet6 | 30 | protocol unix,inet,inet6 |
29 | seccomp | 31 | seccomp |
30 | 32 | ||
diff --git a/etc/wget.profile b/etc/wget.profile index 7ab24aa8f..5072cb9c5 100644 --- a/etc/wget.profile +++ b/etc/wget.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix,inet,inet6 | 27 | protocol unix,inet,inet6 |
26 | seccomp | 28 | seccomp |
diff --git a/etc/wine.profile b/etc/wine.profile index 00eea2b7c..b1bc7df78 100644 --- a/etc/wine.profile +++ b/etc/wine.profile | |||
@@ -17,7 +17,9 @@ include /etc/firejail/disable-programs.inc | |||
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | netfilter | 19 | netfilter |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
24 | notv | ||
23 | seccomp | 25 | seccomp |
diff --git a/etc/wire.profile b/etc/wire.profile index aacea9940..af14f686f 100644 --- a/etc/wire.profile +++ b/etc/wire.profile | |||
@@ -18,9 +18,11 @@ include /etc/firejail/disable-programs.inc | |||
18 | 18 | ||
19 | caps.drop all | 19 | caps.drop all |
20 | netfilter | 20 | netfilter |
21 | nodvd | ||
21 | nogroups | 22 | nogroups |
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
25 | notv | ||
24 | protocol unix,inet,inet6,netlink | 26 | protocol unix,inet,inet6,netlink |
25 | seccomp | 27 | seccomp |
26 | shell none | 28 | shell none |
diff --git a/etc/wireshark-gtk.profile b/etc/wireshark-gtk.profile index 35a76a978..38599b85e 100644 --- a/etc/wireshark-gtk.profile +++ b/etc/wireshark-gtk.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/wireshark.profile | 6 | include /etc/firejail/wireshark.profile |
diff --git a/etc/wireshark-qt.profile b/etc/wireshark-qt.profile index 35a76a978..38599b85e 100644 --- a/etc/wireshark-qt.profile +++ b/etc/wireshark-qt.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/wireshark.profile | 6 | include /etc/firejail/wireshark.profile |
diff --git a/etc/wireshark.profile b/etc/wireshark.profile index 8a25ec011..57f4f2f5b 100644 --- a/etc/wireshark.profile +++ b/etc/wireshark.profile | |||
@@ -18,7 +18,9 @@ no3d | |||
18 | # nogroups - breaks unprivileged wireshark usage | 18 | # nogroups - breaks unprivileged wireshark usage |
19 | # nonewprivs - breaks unprivileged wireshark usage | 19 | # nonewprivs - breaks unprivileged wireshark usage |
20 | # noroot | 20 | # noroot |
21 | nodvd | ||
21 | nosound | 22 | nosound |
23 | notv | ||
22 | # protocol unix,inet,inet6,netlink | 24 | # protocol unix,inet,inet6,netlink |
23 | # seccomp - breaks unprivileged wireshark usage | 25 | # seccomp - breaks unprivileged wireshark usage |
24 | shell none | 26 | shell none |
diff --git a/etc/xchat.profile b/etc/xchat.profile index 795e7ecd6..ab62160b5 100644 --- a/etc/xchat.profile +++ b/etc/xchat.profile | |||
@@ -12,8 +12,10 @@ include /etc/firejail/disable-devel.inc | |||
12 | include /etc/firejail/disable-programs.inc | 12 | include /etc/firejail/disable-programs.inc |
13 | 13 | ||
14 | caps.drop all | 14 | caps.drop all |
15 | nodvd | ||
15 | nonewprivs | 16 | nonewprivs |
16 | noroot | 17 | noroot |
18 | notv | ||
17 | protocol unix,inet,inet6 | 19 | protocol unix,inet,inet6 |
18 | seccomp | 20 | seccomp |
19 | 21 | ||
diff --git a/etc/xed.profile b/etc/xed.profile index 17d0ad9d9..758fb5526 100644 --- a/etc/xed.profile +++ b/etc/xed.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | seccomp | 23 | seccomp |
22 | shell none | 24 | shell none |
23 | tracelog | 25 | tracelog |
diff --git a/etc/xfburn.profile b/etc/xfburn.profile index dbacf6462..e80685f0e 100644 --- a/etc/xfburn.profile +++ b/etc/xfburn.profile | |||
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc | |||
14 | 14 | ||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | nodvd | ||
17 | nogroups | 18 | nogroups |
18 | nonewprivs | 19 | nonewprivs |
19 | noroot | 20 | noroot |
20 | nosound | 21 | nosound |
22 | notv | ||
21 | protocol unix | 23 | protocol unix |
22 | seccomp | 24 | seccomp |
23 | shell none | 25 | shell none |
diff --git a/etc/xfce4-dict.profile b/etc/xfce4-dict.profile index 26f65ee1c..ab52d17e9 100644 --- a/etc/xfce4-dict.profile +++ b/etc/xfce4-dict.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix,inet,inet6 | 25 | protocol unix,inet,inet6 |
24 | seccomp | 26 | seccomp |
diff --git a/etc/xfce4-notes.profile b/etc/xfce4-notes.profile index 6f026c2e7..868b4796b 100644 --- a/etc/xfce4-notes.profile +++ b/etc/xfce4-notes.profile | |||
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix | 27 | protocol unix |
26 | seccomp | 28 | seccomp |
diff --git a/etc/xiphos.profile b/etc/xiphos.profile index eb894d8b5..38e568860 100644 --- a/etc/xiphos.profile +++ b/etc/xiphos.profile | |||
@@ -22,10 +22,12 @@ include /etc/firejail/whitelist-common.inc | |||
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | netfilter | 24 | netfilter |
25 | nodvd | ||
25 | nogroups | 26 | nogroups |
26 | nonewprivs | 27 | nonewprivs |
27 | noroot | 28 | noroot |
28 | nosound | 29 | nosound |
30 | notv | ||
29 | protocol unix,inet,inet6 | 31 | protocol unix,inet,inet6 |
30 | seccomp | 32 | seccomp |
31 | shell none | 33 | shell none |
diff --git a/etc/xmms.profile b/etc/xmms.profile index d2cf00a36..d2e6eddac 100644 --- a/etc/xmms.profile +++ b/etc/xmms.profile | |||
@@ -17,6 +17,7 @@ netfilter | |||
17 | no3d | 17 | no3d |
18 | nonewprivs | 18 | nonewprivs |
19 | noroot | 19 | noroot |
20 | notv | ||
20 | protocol unix,inet,inet6 | 21 | protocol unix,inet,inet6 |
21 | seccomp | 22 | seccomp |
22 | shell none | 23 | shell none |
diff --git a/etc/xonotic-glx.profile b/etc/xonotic-glx.profile index 8be8b2d7b..041a063bb 100644 --- a/etc/xonotic-glx.profile +++ b/etc/xonotic-glx.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/xonotic.profile | 6 | include /etc/firejail/xonotic.profile |
diff --git a/etc/xonotic-sdl.profile b/etc/xonotic-sdl.profile index 8be8b2d7b..041a063bb 100644 --- a/etc/xonotic-sdl.profile +++ b/etc/xonotic-sdl.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/xonotic.profile | 6 | include /etc/firejail/xonotic.profile |
diff --git a/etc/xonotic.profile b/etc/xonotic.profile index 95a2a2dbd..c7db00daf 100644 --- a/etc/xonotic.profile +++ b/etc/xonotic.profile | |||
@@ -18,9 +18,11 @@ include /etc/firejail/whitelist-common.inc | |||
18 | 18 | ||
19 | caps.drop all | 19 | caps.drop all |
20 | netfilter | 20 | netfilter |
21 | nodvd | ||
21 | nogroups | 22 | nogroups |
22 | nonewprivs | 23 | nonewprivs |
23 | noroot | 24 | noroot |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix,inet,inet6 | 27 | protocol unix,inet,inet6 |
26 | seccomp | 28 | seccomp |
diff --git a/etc/xpdf.profile b/etc/xpdf.profile index be69ebe1a..f34358521 100644 --- a/etc/xpdf.profile +++ b/etc/xpdf.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | caps.drop all | 15 | caps.drop all |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | novideo | 24 | novideo |
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
diff --git a/etc/xplayer.profile b/etc/xplayer.profile index afa3deac6..0722768d1 100644 --- a/etc/xplayer.profile +++ b/etc/xplayer.profile | |||
@@ -18,6 +18,7 @@ netfilter | |||
18 | nogroups | 18 | nogroups |
19 | nonewprivs | 19 | nonewprivs |
20 | noroot | 20 | noroot |
21 | notv | ||
21 | protocol unix,inet,inet6 | 22 | protocol unix,inet,inet6 |
22 | seccomp | 23 | seccomp |
23 | shell none | 24 | shell none |
diff --git a/etc/xpra.profile b/etc/xpra.profile index ed393d70b..2bd91e8b5 100644 --- a/etc/xpra.profile +++ b/etc/xpra.profile | |||
@@ -21,15 +21,19 @@ include /etc/firejail/disable-passwdmgr.inc | |||
21 | include /etc/firejail/disable-programs.inc | 21 | include /etc/firejail/disable-programs.inc |
22 | 22 | ||
23 | whitelist /var/lib/xkb | 23 | whitelist /var/lib/xkb |
24 | include /etc/firejail/whitelist-common.inc | 24 | # whitelisting home directory, or including whitelist-common.inc |
25 | # will crash xpra on some platforms | ||
25 | 26 | ||
26 | caps.drop all | 27 | caps.drop all |
27 | # xpra needs to be allowed access to the abstract Unix socket namespace. | 28 | # xpra needs to be allowed access to the abstract Unix socket namespace. |
29 | nodvd | ||
28 | nogroups | 30 | nogroups |
29 | nonewprivs | 31 | nonewprivs |
30 | # In noroot mode, xpra cannot create a socket in the real /tmp/.X11-unix. | 32 | # In noroot mode, xpra cannot create a socket in the real /tmp/.X11-unix. |
31 | #noroot | 33 | #noroot |
32 | nosound | 34 | nosound |
35 | notv | ||
36 | novideo | ||
33 | protocol unix | 37 | protocol unix |
34 | seccomp | 38 | seccomp |
35 | shell none | 39 | shell none |
diff --git a/etc/xreader.profile b/etc/xreader.profile index 2abe569c5..107cefe5e 100644 --- a/etc/xreader.profile +++ b/etc/xreader.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
15 | include /etc/firejail/disable-programs.inc | 15 | include /etc/firejail/disable-programs.inc |
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
diff --git a/etc/xviewer.profile b/etc/xviewer.profile index 7c9886b29..70ad3b895 100644 --- a/etc/xviewer.profile +++ b/etc/xviewer.profile | |||
@@ -16,10 +16,12 @@ include /etc/firejail/disable-passwdmgr.inc | |||
16 | include /etc/firejail/disable-programs.inc | 16 | include /etc/firejail/disable-programs.inc |
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | nodvd | ||
19 | nogroups | 20 | nogroups |
20 | nonewprivs | 21 | nonewprivs |
21 | noroot | 22 | noroot |
22 | nosound | 23 | nosound |
24 | notv | ||
23 | protocol unix | 25 | protocol unix |
24 | seccomp | 26 | seccomp |
25 | shell none | 27 | shell none |
diff --git a/etc/xz.profile b/etc/xz.profile index b552f59c0..d77fc85b4 100644 --- a/etc/xz.profile +++ b/etc/xz.profile | |||
@@ -2,4 +2,5 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | 4 | ||
5 | # Redirect | ||
5 | include /etc/firejail/cpio.profile | 6 | include /etc/firejail/cpio.profile |
diff --git a/etc/xzdec.profile b/etc/xzdec.profile index 0d5b8dda6..7f21f5d2f 100644 --- a/etc/xzdec.profile +++ b/etc/xzdec.profile | |||
@@ -11,7 +11,9 @@ blacklist /tmp/.X11-unix | |||
11 | ignore noroot | 11 | ignore noroot |
12 | net none | 12 | net none |
13 | no3d | 13 | no3d |
14 | nodvd | ||
14 | nosound | 15 | nosound |
16 | notv | ||
15 | shell none | 17 | shell none |
16 | tracelog | 18 | tracelog |
17 | 19 | ||
diff --git a/etc/youtube-dl.profile b/etc/youtube-dl.profile index fea7284c8..e20fb3e99 100644 --- a/etc/youtube-dl.profile +++ b/etc/youtube-dl.profile | |||
@@ -17,10 +17,12 @@ caps.drop all | |||
17 | ipc-namespace | 17 | ipc-namespace |
18 | netfilter | 18 | netfilter |
19 | no3d | 19 | no3d |
20 | nodvd | ||
20 | nogroups | 21 | nogroups |
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
23 | nosound | 24 | nosound |
25 | notv | ||
24 | novideo | 26 | novideo |
25 | protocol unix,inet,inet6 | 27 | protocol unix,inet,inet6 |
26 | seccomp | 28 | seccomp |
diff --git a/etc/zathura.profile b/etc/zathura.profile index 0552f85a9..0036a3521 100644 --- a/etc/zathura.profile +++ b/etc/zathura.profile | |||
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc | |||
15 | 15 | ||
16 | caps.drop all | 16 | caps.drop all |
17 | net none | 17 | net none |
18 | nodvd | ||
18 | nogroups | 19 | nogroups |
19 | nonewprivs | 20 | nonewprivs |
20 | noroot | 21 | noroot |
21 | nosound | 22 | nosound |
23 | notv | ||
22 | protocol unix | 24 | protocol unix |
23 | seccomp | 25 | seccomp |
24 | shell none | 26 | shell none |
diff --git a/etc/zoom.profile b/etc/zoom.profile index 4ef756d9f..381df9ab5 100644 --- a/etc/zoom.profile +++ b/etc/zoom.profile | |||
@@ -18,8 +18,10 @@ include /etc/firejail/whitelist-common.inc | |||
18 | 18 | ||
19 | caps.drop all | 19 | caps.drop all |
20 | netfilter | 20 | netfilter |
21 | nodvd | ||
21 | nonewprivs | 22 | nonewprivs |
22 | noroot | 23 | noroot |
24 | notv | ||
23 | protocol unix,inet,inet6 | 25 | protocol unix,inet,inet6 |
24 | seccomp | 26 | seccomp |
25 | 27 | ||
diff --git a/platform/debian/conffiles b/platform/debian/conffiles index afd22c041..360ac8921 100644 --- a/platform/debian/conffiles +++ b/platform/debian/conffiles | |||
@@ -298,6 +298,7 @@ | |||
298 | /etc/firejail/transmission-qt.profile | 298 | /etc/firejail/transmission-qt.profile |
299 | /etc/firejail/transmission-show.profile | 299 | /etc/firejail/transmission-show.profile |
300 | /etc/firejail/truecraft.profile | 300 | /etc/firejail/truecraft.profile |
301 | /etc/firejail/tuxguitar.profile | ||
301 | /etc/firejail/uget-gtk.profile | 302 | /etc/firejail/uget-gtk.profile |
302 | /etc/firejail/unbound.profile | 303 | /etc/firejail/unbound.profile |
303 | /etc/firejail/unknown-horizons.profile | 304 | /etc/firejail/unknown-horizons.profile |
diff --git a/platform/rpm/firejail.spec b/platform/rpm/firejail.spec index ab908ef49..fa92ded94 100644 --- a/platform/rpm/firejail.spec +++ b/platform/rpm/firejail.spec | |||
@@ -3,7 +3,7 @@ Version: __VERSION__ | |||
3 | Release: 1 | 3 | Release: 1 |
4 | Summary: Linux namepaces sandbox program | 4 | Summary: Linux namepaces sandbox program |
5 | 5 | ||
6 | License: GPL+ | 6 | License: GPLv2+ |
7 | Group: Development/Tools | 7 | Group: Development/Tools |
8 | Source0: https://github.com/netblue30/firejail/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz | 8 | Source0: https://github.com/netblue30/firejail/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz |
9 | URL: http://github.com/netblue30/firejail | 9 | URL: http://github.com/netblue30/firejail |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index bcf2ced1e..d66b026b0 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -80,6 +80,7 @@ file-roller | |||
80 | filezilla | 80 | filezilla |
81 | firefox | 81 | firefox |
82 | firefox-esr | 82 | firefox-esr |
83 | firefox-nightly | ||
83 | flashpeak-slimjet | 84 | flashpeak-slimjet |
84 | flowblade | 85 | flowblade |
85 | fontforge | 86 | fontforge |
@@ -267,6 +268,7 @@ transmission-gtk | |||
267 | transmission-qt | 268 | transmission-qt |
268 | transmission-show | 269 | transmission-show |
269 | truecraft | 270 | truecraft |
271 | tuxguitar | ||
270 | uget-gtk | 272 | uget-gtk |
271 | unbound | 273 | unbound |
272 | unknown-horizons | 274 | unknown-horizons |
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index 86f730aa0..5f16d1a5d 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -57,6 +57,7 @@ | |||
57 | #define RUN_SECCOMP_AMD64 "/run/firejail/mnt/seccomp.amd64" // amd64 filter installed on i386 architectures | 57 | #define RUN_SECCOMP_AMD64 "/run/firejail/mnt/seccomp.amd64" // amd64 filter installed on i386 architectures |
58 | #define RUN_SECCOMP_I386 "/run/firejail/mnt/seccomp.i386" // i386 filter installed on amd64 architectures | 58 | #define RUN_SECCOMP_I386 "/run/firejail/mnt/seccomp.i386" // i386 filter installed on amd64 architectures |
59 | #define RUN_SECCOMP_MDWX "/run/firejail/mnt/seccomp.mdwx" // filter for memory-deny-write-execute | 59 | #define RUN_SECCOMP_MDWX "/run/firejail/mnt/seccomp.mdwx" // filter for memory-deny-write-execute |
60 | #define RUN_SECCOMP_POSTEXEC "/run/firejail/mnt/seccomp.postexec" // filter for post-exec library | ||
60 | #define PATH_SECCOMP_DEFAULT (LIBDIR "/firejail/seccomp") // default filter built during make | 61 | #define PATH_SECCOMP_DEFAULT (LIBDIR "/firejail/seccomp") // default filter built during make |
61 | #define PATH_SECCOMP_DEFAULT_DEBUG (LIBDIR "/firejail/seccomp.debug") // default filter built during make | 62 | #define PATH_SECCOMP_DEFAULT_DEBUG (LIBDIR "/firejail/seccomp.debug") // default filter built during make |
62 | #define PATH_SECCOMP_AMD64 (LIBDIR "/firejail/seccomp.amd64") // amd64 filter built during make | 63 | #define PATH_SECCOMP_AMD64 (LIBDIR "/firejail/seccomp.amd64") // amd64 filter built during make |
@@ -305,6 +306,7 @@ extern int arg_overlay_keep; // place overlay diff in a known directory | |||
305 | extern int arg_overlay_reuse; // allow the reuse of overlays | 306 | extern int arg_overlay_reuse; // allow the reuse of overlays |
306 | 307 | ||
307 | extern int arg_seccomp; // enable default seccomp filter | 308 | extern int arg_seccomp; // enable default seccomp filter |
309 | extern int arg_seccomp_postexec; // need postexec ld.preload library? | ||
308 | 310 | ||
309 | extern int arg_caps_default_filter; // enable default capabilities filter | 311 | extern int arg_caps_default_filter; // enable default capabilities filter |
310 | extern int arg_caps_drop; // drop list | 312 | extern int arg_caps_drop; // drop list |
@@ -360,6 +362,8 @@ extern int arg_machineid; // preserve /etc/machine-id | |||
360 | extern int arg_disable_mnt; // disable /mnt and /media | 362 | extern int arg_disable_mnt; // disable /mnt and /media |
361 | extern int arg_noprofile; // use default.profile if none other found/specified | 363 | extern int arg_noprofile; // use default.profile if none other found/specified |
362 | extern int arg_memory_deny_write_execute; // block writable and executable memory | 364 | extern int arg_memory_deny_write_execute; // block writable and executable memory |
365 | extern int arg_notv; // --notv | ||
366 | extern int arg_nodvd; // --nodvd | ||
363 | 367 | ||
364 | extern int login_shell; | 368 | extern int login_shell; |
365 | extern int parent_to_child_fds[2]; | 369 | extern int parent_to_child_fds[2]; |
@@ -512,6 +516,8 @@ void fs_private_dev(void); | |||
512 | void fs_dev_disable_sound(void); | 516 | void fs_dev_disable_sound(void); |
513 | void fs_dev_disable_3d(void); | 517 | void fs_dev_disable_3d(void); |
514 | void fs_dev_disable_video(void); | 518 | void fs_dev_disable_video(void); |
519 | void fs_dev_disable_tv(void); | ||
520 | void fs_dev_disable_dvd(void); | ||
515 | 521 | ||
516 | // fs_home.c | 522 | // fs_home.c |
517 | // private mode (--private) | 523 | // private mode (--private) |
@@ -549,8 +555,6 @@ void caps_drop_dac_override(void); | |||
549 | 555 | ||
550 | // syscall.c | 556 | // syscall.c |
551 | const char *syscall_find_nr(int nr); | 557 | const char *syscall_find_nr(int nr); |
552 | // return -1 if error, 0 if no error | ||
553 | int syscall_check_list(const char *slist, void (*callback)(int syscall, int arg), int arg); | ||
554 | 558 | ||
555 | // fs_trace.c | 559 | // fs_trace.c |
556 | void fs_trace_preload(void); | 560 | void fs_trace_preload(void); |
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c index fdaa0b355..0dbbb65a0 100644 --- a/src/firejail/fs_dev.c +++ b/src/firejail/fs_dev.c | |||
@@ -31,41 +31,52 @@ | |||
31 | #include <sys/sysmacros.h> | 31 | #include <sys/sysmacros.h> |
32 | #include <sys/types.h> | 32 | #include <sys/types.h> |
33 | 33 | ||
34 | // device type | ||
35 | typedef enum { | ||
36 | DEV_NONE = 0, | ||
37 | DEV_SOUND, | ||
38 | DEV_3D, | ||
39 | DEV_VIDEO, | ||
40 | DEV_TV, | ||
41 | DEV_DVD, | ||
42 | } DEV_TYPE; | ||
43 | |||
44 | |||
34 | typedef struct { | 45 | typedef struct { |
35 | const char *dev_fname; | 46 | const char *dev_fname; |
36 | const char *run_fname; | 47 | const char *run_fname; |
37 | int sound; | 48 | DEV_TYPE type; |
38 | int hw3d; | ||
39 | int video; | ||
40 | } DevEntry; | 49 | } DevEntry; |
41 | 50 | ||
42 | static DevEntry dev[] = { | 51 | static DevEntry dev[] = { |
43 | {"/dev/snd", RUN_DEV_DIR "/snd", 1, 0, 0}, // sound device | 52 | {"/dev/snd", RUN_DEV_DIR "/snd", DEV_SOUND}, // sound device |
44 | {"/dev/dri", RUN_DEV_DIR "/dri", 0, 1, 0}, // 3d device | 53 | {"/dev/dri", RUN_DEV_DIR "/dri", DEV_3D}, // 3d device |
45 | {"/dev/nvidia0", RUN_DEV_DIR "/nvidia0", 0, 1, 0}, | 54 | {"/dev/nvidia0", RUN_DEV_DIR "/nvidia0", DEV_3D}, |
46 | {"/dev/nvidia1", RUN_DEV_DIR "/nvidia1", 0, 1, 0}, | 55 | {"/dev/nvidia1", RUN_DEV_DIR "/nvidia1", DEV_3D}, |
47 | {"/dev/nvidia2", RUN_DEV_DIR "/nvidia2", 0, 1, 0}, | 56 | {"/dev/nvidia2", RUN_DEV_DIR "/nvidia2", DEV_3D}, |
48 | {"/dev/nvidia3", RUN_DEV_DIR "/nvidia3", 0, 1, 0}, | 57 | {"/dev/nvidia3", RUN_DEV_DIR "/nvidia3", DEV_3D}, |
49 | {"/dev/nvidia4", RUN_DEV_DIR "/nvidia4", 0, 1, 0}, | 58 | {"/dev/nvidia4", RUN_DEV_DIR "/nvidia4", DEV_3D}, |
50 | {"/dev/nvidia5", RUN_DEV_DIR "/nvidia5", 0, 1, 0}, | 59 | {"/dev/nvidia5", RUN_DEV_DIR "/nvidia5", DEV_3D}, |
51 | {"/dev/nvidia6", RUN_DEV_DIR "/nvidia6", 0, 1, 0}, | 60 | {"/dev/nvidia6", RUN_DEV_DIR "/nvidia6", DEV_3D}, |
52 | {"/dev/nvidia7", RUN_DEV_DIR "/nvidia7", 0, 1, 0}, | 61 | {"/dev/nvidia7", RUN_DEV_DIR "/nvidia7", DEV_3D}, |
53 | {"/dev/nvidia8", RUN_DEV_DIR "/nvidia8", 0, 1, 0}, | 62 | {"/dev/nvidia8", RUN_DEV_DIR "/nvidia8", DEV_3D}, |
54 | {"/dev/nvidia9", RUN_DEV_DIR "/nvidia9", 0, 1, 0}, | 63 | {"/dev/nvidia9", RUN_DEV_DIR "/nvidia9", DEV_3D}, |
55 | {"/dev/nvidiactl", RUN_DEV_DIR "/nvidiactl", 0, 1, 0}, | 64 | {"/dev/nvidiactl", RUN_DEV_DIR "/nvidiactl", DEV_3D}, |
56 | {"/dev/nvidia-modeset", RUN_DEV_DIR "/nvidia-modeset", 0, 1, 0}, | 65 | {"/dev/nvidia-modeset", RUN_DEV_DIR "/nvidia-modeset", DEV_3D}, |
57 | {"/dev/nvidia-uvm", RUN_DEV_DIR "/nvidia-uvm", 0, 1, 0}, | 66 | {"/dev/nvidia-uvm", RUN_DEV_DIR "/nvidia-uvm", DEV_3D}, |
58 | {"/dev/video0", RUN_DEV_DIR "/video0", 0, 0, 1}, // video camera devices | 67 | {"/dev/video0", RUN_DEV_DIR "/video0", DEV_VIDEO}, // video camera devices |
59 | {"/dev/video1", RUN_DEV_DIR "/video1", 0, 0, 1}, | 68 | {"/dev/video1", RUN_DEV_DIR "/video1", DEV_VIDEO}, |
60 | {"/dev/video2", RUN_DEV_DIR "/video2", 0, 0, 1}, | 69 | {"/dev/video2", RUN_DEV_DIR "/video2", DEV_VIDEO}, |
61 | {"/dev/video3", RUN_DEV_DIR "/video3", 0, 0, 1}, | 70 | {"/dev/video3", RUN_DEV_DIR "/video3", DEV_VIDEO}, |
62 | {"/dev/video4", RUN_DEV_DIR "/video4", 0, 0, 1}, | 71 | {"/dev/video4", RUN_DEV_DIR "/video4", DEV_VIDEO}, |
63 | {"/dev/video5", RUN_DEV_DIR "/video5", 0, 0, 1}, | 72 | {"/dev/video5", RUN_DEV_DIR "/video5", DEV_VIDEO}, |
64 | {"/dev/video6", RUN_DEV_DIR "/video6", 0, 0, 1}, | 73 | {"/dev/video6", RUN_DEV_DIR "/video6", DEV_VIDEO}, |
65 | {"/dev/video7", RUN_DEV_DIR "/video7", 0, 0, 1}, | 74 | {"/dev/video7", RUN_DEV_DIR "/video7", DEV_VIDEO}, |
66 | {"/dev/video8", RUN_DEV_DIR "/video8", 0, 0, 1}, | 75 | {"/dev/video8", RUN_DEV_DIR "/video8", DEV_VIDEO}, |
67 | {"/dev/video9", RUN_DEV_DIR "/video9", 0, 0, 1}, | 76 | {"/dev/video9", RUN_DEV_DIR "/video9", DEV_VIDEO}, |
68 | {NULL, NULL, 0, 0, 0} | 77 | {"/dev/dvb", RUN_DEV_DIR "/dvb", DEV_TV}, // DVB (Digital Video Broadcasting) - TV device |
78 | {"/dev/sr0", RUN_DEV_DIR "/sr0", DEV_DVD}, // for DVD and audio CD players | ||
79 | {NULL, NULL, DEV_NONE} | ||
69 | }; | 80 | }; |
70 | 81 | ||
71 | static void deventry_mount(void) { | 82 | static void deventry_mount(void) { |
@@ -73,31 +84,40 @@ static void deventry_mount(void) { | |||
73 | while (dev[i].dev_fname != NULL) { | 84 | while (dev[i].dev_fname != NULL) { |
74 | struct stat s; | 85 | struct stat s; |
75 | if (stat(dev[i].run_fname, &s) == 0) { | 86 | if (stat(dev[i].run_fname, &s) == 0) { |
76 | int dir = is_dir(dev[i].run_fname); | 87 | |
77 | if (arg_debug) | 88 | // check device type and subsystem configuration |
78 | printf("mounting %s %s\n", dev[i].run_fname, (dir)? "directory": "file"); | 89 | if ((dev[i].type == DEV_SOUND && arg_nosound == 0) || |
79 | if (dir) { | 90 | (dev[i].type == DEV_3D && arg_no3d == 0) || |
80 | mkdir_attr(dev[i].dev_fname, 0755, 0, 0); | 91 | (dev[i].type == DEV_VIDEO && arg_novideo == 0) || |
81 | } | 92 | (dev[i].type == DEV_TV && arg_notv == 0) || |
82 | else { | 93 | (dev[i].type == DEV_DVD && arg_nodvd == 0)) { |
83 | struct stat s; | 94 | |
84 | if (stat(dev[i].run_fname, &s) == -1) { | 95 | int dir = is_dir(dev[i].run_fname); |
85 | if (arg_debug) | 96 | if (arg_debug) |
86 | fwarning("cannot stat %s file\n", dev[i].run_fname); | 97 | printf("mounting %s %s\n", dev[i].run_fname, (dir)? "directory": "file"); |
87 | i++; | 98 | if (dir) { |
88 | continue; | 99 | mkdir_attr(dev[i].dev_fname, 0755, 0, 0); |
89 | } | 100 | } |
90 | FILE *fp = fopen(dev[i].dev_fname, "w"); | 101 | else { |
91 | if (fp) { | 102 | struct stat s; |
92 | fprintf(fp, "\n"); | 103 | if (stat(dev[i].run_fname, &s) == -1) { |
93 | SET_PERMS_STREAM(fp, s.st_uid, s.st_gid, s.st_mode); | 104 | if (arg_debug) |
94 | fclose(fp); | 105 | fwarning("cannot stat %s file\n", dev[i].run_fname); |
106 | i++; | ||
107 | continue; | ||
108 | } | ||
109 | FILE *fp = fopen(dev[i].dev_fname, "w"); | ||
110 | if (fp) { | ||
111 | fprintf(fp, "\n"); | ||
112 | SET_PERMS_STREAM(fp, s.st_uid, s.st_gid, s.st_mode); | ||
113 | fclose(fp); | ||
114 | } | ||
95 | } | 115 | } |
116 | |||
117 | if (mount(dev[i].run_fname, dev[i].dev_fname, NULL, MS_BIND|MS_REC, NULL) < 0) | ||
118 | errExit("mounting dev file"); | ||
119 | fs_logger2("whitelist", dev[i].dev_fname); | ||
96 | } | 120 | } |
97 | |||
98 | if (mount(dev[i].run_fname, dev[i].dev_fname, NULL, MS_BIND|MS_REC, NULL) < 0) | ||
99 | errExit("mounting dev file"); | ||
100 | fs_logger2("whitelist", dev[i].dev_fname); | ||
101 | } | 121 | } |
102 | 122 | ||
103 | i++; | 123 | i++; |
@@ -140,7 +160,7 @@ void fs_private_dev(void){ | |||
140 | // keep a copy of dev directory | 160 | // keep a copy of dev directory |
141 | mkdir_attr(RUN_DEV_DIR, 0755, 0, 0); | 161 | mkdir_attr(RUN_DEV_DIR, 0755, 0, 0); |
142 | if (mount("/dev", RUN_DEV_DIR, NULL, MS_BIND|MS_REC, NULL) < 0) | 162 | if (mount("/dev", RUN_DEV_DIR, NULL, MS_BIND|MS_REC, NULL) < 0) |
143 | errExit("mounting /dev/dri"); | 163 | errExit("mounting /dev"); |
144 | 164 | ||
145 | // create DEVLOG_FILE | 165 | // create DEVLOG_FILE |
146 | int have_devlog = 0; | 166 | int have_devlog = 0; |
@@ -163,6 +183,7 @@ void fs_private_dev(void){ | |||
163 | errExit("mounting /dev"); | 183 | errExit("mounting /dev"); |
164 | fs_logger("tmpfs /dev"); | 184 | fs_logger("tmpfs /dev"); |
165 | 185 | ||
186 | // optional devices: sound, video cards etc... | ||
166 | deventry_mount(); | 187 | deventry_mount(); |
167 | 188 | ||
168 | // bring back /dev/log | 189 | // bring back /dev/log |
@@ -177,8 +198,7 @@ void fs_private_dev(void){ | |||
177 | } | 198 | } |
178 | } | 199 | } |
179 | if (mount(RUN_RO_DIR, RUN_DEV_DIR, "none", MS_BIND, "mode=400,gid=0") < 0) | 200 | if (mount(RUN_RO_DIR, RUN_DEV_DIR, "none", MS_BIND, "mode=400,gid=0") < 0) |
180 | errExit("disable /dev/snd"); | 201 | errExit("disable run dev directory"); |
181 | |||
182 | 202 | ||
183 | // create /dev/shm | 203 | // create /dev/shm |
184 | if (arg_debug) | 204 | if (arg_debug) |
@@ -186,7 +206,7 @@ void fs_private_dev(void){ | |||
186 | mkdir_attr("/dev/shm", 01777, 0, 0); | 206 | mkdir_attr("/dev/shm", 01777, 0, 0); |
187 | fs_logger("mkdir /dev/shm"); | 207 | fs_logger("mkdir /dev/shm"); |
188 | 208 | ||
189 | // create devices | 209 | // create default devices |
190 | create_char_dev("/dev/zero", 0666, 1, 5); // mknod -m 666 /dev/zero c 1 5 | 210 | create_char_dev("/dev/zero", 0666, 1, 5); // mknod -m 666 /dev/zero c 1 5 |
191 | fs_logger("mknod /dev/zero"); | 211 | fs_logger("mknod /dev/zero"); |
192 | create_char_dev("/dev/null", 0666, 1, 3); // mknod -m 666 /dev/null c 1 3 | 212 | create_char_dev("/dev/null", 0666, 1, 3); // mknod -m 666 /dev/null c 1 3 |
@@ -234,6 +254,14 @@ void fs_private_dev(void){ | |||
234 | create_link("/proc/self/fd/1", "/dev/stdout"); | 254 | create_link("/proc/self/fd/1", "/dev/stdout"); |
235 | create_link("/proc/self/fd/2", "/dev/stderr"); | 255 | create_link("/proc/self/fd/2", "/dev/stderr"); |
236 | #endif | 256 | #endif |
257 | |||
258 | // symlinks for DVD/CD players | ||
259 | if (stat("/dev/sr0", &s) == 0) { | ||
260 | create_link("/dev/sr0", "/dev/cdrom"); | ||
261 | create_link("/dev/sr0", "/dev/cdrw"); | ||
262 | create_link("/dev/sr0", "/dev/dvd"); | ||
263 | create_link("/dev/sr0", "/dev/dvdrw"); | ||
264 | } | ||
237 | } | 265 | } |
238 | 266 | ||
239 | 267 | ||
@@ -294,7 +322,7 @@ static void disable_file_or_dir(const char *fname) { | |||
294 | void fs_dev_disable_sound(void) { | 322 | void fs_dev_disable_sound(void) { |
295 | int i = 0; | 323 | int i = 0; |
296 | while (dev[i].dev_fname != NULL) { | 324 | while (dev[i].dev_fname != NULL) { |
297 | if (dev[i].sound) | 325 | if (dev[i].type == DEV_SOUND) |
298 | disable_file_or_dir(dev[i].dev_fname); | 326 | disable_file_or_dir(dev[i].dev_fname); |
299 | i++; | 327 | i++; |
300 | } | 328 | } |
@@ -303,7 +331,7 @@ void fs_dev_disable_sound(void) { | |||
303 | void fs_dev_disable_video(void) { | 331 | void fs_dev_disable_video(void) { |
304 | int i = 0; | 332 | int i = 0; |
305 | while (dev[i].dev_fname != NULL) { | 333 | while (dev[i].dev_fname != NULL) { |
306 | if (dev[i].video) | 334 | if (dev[i].type == DEV_VIDEO) |
307 | disable_file_or_dir(dev[i].dev_fname); | 335 | disable_file_or_dir(dev[i].dev_fname); |
308 | i++; | 336 | i++; |
309 | } | 337 | } |
@@ -312,7 +340,25 @@ void fs_dev_disable_video(void) { | |||
312 | void fs_dev_disable_3d(void) { | 340 | void fs_dev_disable_3d(void) { |
313 | int i = 0; | 341 | int i = 0; |
314 | while (dev[i].dev_fname != NULL) { | 342 | while (dev[i].dev_fname != NULL) { |
315 | if (dev[i].hw3d) | 343 | if (dev[i].type == DEV_3D) |
344 | disable_file_or_dir(dev[i].dev_fname); | ||
345 | i++; | ||
346 | } | ||
347 | } | ||
348 | |||
349 | void fs_dev_disable_tv(void) { | ||
350 | int i = 0; | ||
351 | while (dev[i].dev_fname != NULL) { | ||
352 | if (dev[i].type == DEV_TV) | ||
353 | disable_file_or_dir(dev[i].dev_fname); | ||
354 | i++; | ||
355 | } | ||
356 | } | ||
357 | |||
358 | void fs_dev_disable_dvd(void) { | ||
359 | int i = 0; | ||
360 | while (dev[i].dev_fname != NULL) { | ||
361 | if (dev[i].type == DEV_DVD) | ||
316 | disable_file_or_dir(dev[i].dev_fname); | 362 | disable_file_or_dir(dev[i].dev_fname); |
317 | i++; | 363 | i++; |
318 | } | 364 | } |
diff --git a/src/firejail/fs_trace.c b/src/firejail/fs_trace.c index df76f4fe1..c87d29b5c 100644 --- a/src/firejail/fs_trace.c +++ b/src/firejail/fs_trace.c | |||
@@ -63,6 +63,11 @@ void fs_trace(void) { | |||
63 | if (!arg_quiet) | 63 | if (!arg_quiet) |
64 | printf("Blacklist violations are logged to syslog\n"); | 64 | printf("Blacklist violations are logged to syslog\n"); |
65 | } | 65 | } |
66 | if (arg_seccomp_postexec) { | ||
67 | fprintf(fp, "%s/libpostexecseccomp.so\n", prefix); | ||
68 | if (!arg_quiet) | ||
69 | printf("Post-exec seccomp protector enabled\n"); | ||
70 | } | ||
66 | 71 | ||
67 | SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH); | 72 | SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH); |
68 | fclose(fp); | 73 | fclose(fp); |
diff --git a/src/firejail/main.c b/src/firejail/main.c index 9cff080a0..9726c0b8a 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -56,6 +56,7 @@ int arg_overlay_keep = 0; // place overlay diff in a known directory | |||
56 | int arg_overlay_reuse = 0; // allow the reuse of overlays | 56 | int arg_overlay_reuse = 0; // allow the reuse of overlays |
57 | 57 | ||
58 | int arg_seccomp = 0; // enable default seccomp filter | 58 | int arg_seccomp = 0; // enable default seccomp filter |
59 | int arg_seccomp_postexec = 0; // need postexec ld.preload library? | ||
59 | 60 | ||
60 | int arg_caps_default_filter = 0; // enable default capabilities filter | 61 | int arg_caps_default_filter = 0; // enable default capabilities filter |
61 | int arg_caps_drop = 0; // drop list | 62 | int arg_caps_drop = 0; // drop list |
@@ -112,7 +113,8 @@ int arg_writable_var_log = 0; // writable /var/log | |||
112 | int arg_disable_mnt = 0; // disable /mnt and /media | 113 | int arg_disable_mnt = 0; // disable /mnt and /media |
113 | int arg_noprofile = 0; // use default.profile if none other found/specified | 114 | int arg_noprofile = 0; // use default.profile if none other found/specified |
114 | int arg_memory_deny_write_execute = 0; // block writable and executable memory | 115 | int arg_memory_deny_write_execute = 0; // block writable and executable memory |
115 | 116 | int arg_notv = 0; // --notv | |
117 | int arg_nodvd = 0; // --nodvd | ||
116 | int login_shell = 0; | 118 | int login_shell = 0; |
117 | 119 | ||
118 | 120 | ||
@@ -1021,7 +1023,7 @@ int main(int argc, char **argv) { | |||
1021 | } | 1023 | } |
1022 | else { | 1024 | else { |
1023 | // check --output option and execute it; | 1025 | // check --output option and execute it; |
1024 | check_output(argc, argv); // the function will not return if --output option was found | 1026 | check_output(argc, argv); // the function will not return if --output or --output-stderr option was found |
1025 | } | 1027 | } |
1026 | 1028 | ||
1027 | 1029 | ||
@@ -1676,22 +1678,22 @@ int main(int argc, char **argv) { | |||
1676 | exit_err_feature("noroot"); | 1678 | exit_err_feature("noroot"); |
1677 | } | 1679 | } |
1678 | #endif | 1680 | #endif |
1679 | else if (strcmp(argv[i], "--nonewprivs") == 0) { | 1681 | else if (strcmp(argv[i], "--nonewprivs") == 0) |
1680 | arg_nonewprivs = 1; | 1682 | arg_nonewprivs = 1; |
1681 | } | ||
1682 | else if (strncmp(argv[i], "--env=", 6) == 0) | 1683 | else if (strncmp(argv[i], "--env=", 6) == 0) |
1683 | env_store(argv[i] + 6, SETENV); | 1684 | env_store(argv[i] + 6, SETENV); |
1684 | else if (strncmp(argv[i], "--rmenv=", 8) == 0) | 1685 | else if (strncmp(argv[i], "--rmenv=", 8) == 0) |
1685 | env_store(argv[i] + 8, RMENV); | 1686 | env_store(argv[i] + 8, RMENV); |
1686 | else if (strcmp(argv[i], "--nosound") == 0) { | 1687 | else if (strcmp(argv[i], "--nosound") == 0) |
1687 | arg_nosound = 1; | 1688 | arg_nosound = 1; |
1688 | } | 1689 | else if (strcmp(argv[i], "--novideo") == 0) |
1689 | else if (strcmp(argv[i], "--novideo") == 0) { | ||
1690 | arg_novideo = 1; | 1690 | arg_novideo = 1; |
1691 | } | 1691 | else if (strcmp(argv[i], "--no3d") == 0) |
1692 | else if (strcmp(argv[i], "--no3d") == 0) { | ||
1693 | arg_no3d = 1; | 1692 | arg_no3d = 1; |
1694 | } | 1693 | else if (strcmp(argv[i], "--notv") == 0) |
1694 | arg_notv = 1; | ||
1695 | else if (strcmp(argv[i], "--nodvd") == 0) | ||
1696 | arg_nodvd = 1; | ||
1695 | 1697 | ||
1696 | //************************************* | 1698 | //************************************* |
1697 | // network | 1699 | // network |
diff --git a/src/firejail/output.c b/src/firejail/output.c index 9fb4ad6b1..abdfa4d3b 100644 --- a/src/firejail/output.c +++ b/src/firejail/output.c | |||
@@ -27,12 +27,18 @@ void check_output(int argc, char **argv) { | |||
27 | 27 | ||
28 | int i; | 28 | int i; |
29 | int outindex = 0; | 29 | int outindex = 0; |
30 | 30 | int enable_stderr = 0; | |
31 | |||
31 | for (i = 1; i < argc; i++) { | 32 | for (i = 1; i < argc; i++) { |
32 | if (strncmp(argv[i], "--output=", 9) == 0) { | 33 | if (strncmp(argv[i], "--output=", 9) == 0) { |
33 | outindex = i; | 34 | outindex = i; |
34 | break; | 35 | break; |
35 | } | 36 | } |
37 | if (strncmp(argv[i], "--output-stderr=", 16) == 0) { | ||
38 | outindex = i; | ||
39 | enable_stderr = 1; | ||
40 | break; | ||
41 | } | ||
36 | } | 42 | } |
37 | if (!outindex) | 43 | if (!outindex) |
38 | return; | 44 | return; |
@@ -40,9 +46,9 @@ void check_output(int argc, char **argv) { | |||
40 | 46 | ||
41 | // check filename | 47 | // check filename |
42 | drop_privs(0); | 48 | drop_privs(0); |
43 | char *outfile = NULL; | 49 | char *outfile = argv[outindex]; |
44 | invalid_filename(argv[outindex] + 9); | 50 | outfile += (enable_stderr)? 16:9; |
45 | outfile = argv[outindex] + 9; | 51 | invalid_filename(outfile); |
46 | 52 | ||
47 | // do not accept directories, links, and files with ".." | 53 | // do not accept directories, links, and files with ".." |
48 | if (strstr(outfile, "..") || is_link(outfile) || is_dir(outfile)) { | 54 | if (strstr(outfile, "..") || is_link(outfile) || is_dir(outfile)) { |
@@ -80,9 +86,15 @@ void check_output(int argc, char **argv) { | |||
80 | for (i = 0; i < argc; i++) { | 86 | for (i = 0; i < argc; i++) { |
81 | if (strncmp(argv[i], "--output=", 9) == 0) | 87 | if (strncmp(argv[i], "--output=", 9) == 0) |
82 | continue; | 88 | continue; |
89 | if (strncmp(argv[i], "--output-stderr=", 16) == 0) | ||
90 | continue; | ||
83 | ptr += sprintf(ptr, "%s ", argv[i]); | 91 | ptr += sprintf(ptr, "%s ", argv[i]); |
84 | } | 92 | } |
85 | sprintf(ptr, "2>&1 | %s/firejail/ftee %s", LIBDIR, outfile); | 93 | |
94 | if (enable_stderr) | ||
95 | sprintf(ptr, "2>&1 | %s/firejail/ftee %s", LIBDIR, outfile); | ||
96 | else | ||
97 | sprintf(ptr, " | %s/firejail/ftee %s", LIBDIR, outfile); | ||
86 | 98 | ||
87 | // run command | 99 | // run command |
88 | char *a[4]; | 100 | char *a[4]; |
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c index 9c474415d..583cc4610 100644 --- a/src/firejail/preproc.c +++ b/src/firejail/preproc.c | |||
@@ -85,9 +85,12 @@ void preproc_mount_mnt_dir(void) { | |||
85 | 85 | ||
86 | if (arg_memory_deny_write_execute) | 86 | if (arg_memory_deny_write_execute) |
87 | copy_file(PATH_SECCOMP_MDWX, RUN_SECCOMP_MDWX, getuid(), getgid(), 0644); // root needed | 87 | copy_file(PATH_SECCOMP_MDWX, RUN_SECCOMP_MDWX, getuid(), getgid(), 0644); // root needed |
88 | // as root, create an empty RUN_SECCOMP_PROTOCOL file | 88 | // as root, create empty RUN_SECCOMP_PROTOCOL and RUN_SECCOMP_POSTEXEC files |
89 | create_empty_file_as_root(RUN_SECCOMP_PROTOCOL, 0644); | 89 | create_empty_file_as_root(RUN_SECCOMP_PROTOCOL, 0644); |
90 | if (set_perms(RUN_SECCOMP_PROTOCOL, getuid(), getgid(), 0644)) | 90 | if (set_perms(RUN_SECCOMP_PROTOCOL, getuid(), getgid(), 0644)) |
91 | errExit("set_perms"); | 91 | errExit("set_perms"); |
92 | create_empty_file_as_root(RUN_SECCOMP_POSTEXEC, 0644); | ||
93 | if (set_perms(RUN_SECCOMP_POSTEXEC, getuid(), getgid(), 0644)) | ||
94 | errExit("set_perms"); | ||
92 | } | 95 | } |
93 | } | 96 | } |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index 708251b0b..7753ee3b2 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -225,6 +225,14 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
225 | arg_nosound = 1; | 225 | arg_nosound = 1; |
226 | return 0; | 226 | return 0; |
227 | } | 227 | } |
228 | else if (strcmp(ptr, "notv") == 0) { | ||
229 | arg_notv = 1; | ||
230 | return 0; | ||
231 | } | ||
232 | else if (strcmp(ptr, "nodvd") == 0) { | ||
233 | arg_nodvd = 1; | ||
234 | return 0; | ||
235 | } | ||
228 | else if (strcmp(ptr, "novideo") == 0) { | 236 | else if (strcmp(ptr, "novideo") == 0) { |
229 | arg_novideo = 1; | 237 | arg_novideo = 1; |
230 | return 0; | 238 | return 0; |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index 6c0fdebe3..568549cbf 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -664,10 +664,15 @@ int sandbox(void* sandbox_arg) { | |||
664 | if (rv) | 664 | if (rv) |
665 | exit(rv); | 665 | exit(rv); |
666 | } | 666 | } |
667 | if (arg_seccomp && (cfg.seccomp_list || cfg.seccomp_list_drop || cfg.seccomp_list_keep)) | ||
668 | arg_seccomp_postexec = 1; | ||
667 | #endif | 669 | #endif |
668 | 670 | ||
671 | // need ld.so.preload if tracing or seccomp with any non-default lists | ||
672 | bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec; | ||
673 | |||
669 | // trace pre-install | 674 | // trace pre-install |
670 | if (arg_trace || arg_tracelog) | 675 | if (need_preload) |
671 | fs_trace_preload(); | 676 | fs_trace_preload(); |
672 | 677 | ||
673 | // store hosts file | 678 | // store hosts file |
@@ -704,7 +709,7 @@ int sandbox(void* sandbox_arg) { | |||
704 | //**************************** | 709 | //**************************** |
705 | // trace pre-install, this time inside chroot | 710 | // trace pre-install, this time inside chroot |
706 | //**************************** | 711 | //**************************** |
707 | if (arg_trace || arg_tracelog) | 712 | if (need_preload) |
708 | fs_trace_preload(); | 713 | fs_trace_preload(); |
709 | } | 714 | } |
710 | else | 715 | else |
@@ -767,7 +772,7 @@ int sandbox(void* sandbox_arg) { | |||
767 | else { | 772 | else { |
768 | fs_private_dir_list("/etc", RUN_ETC_DIR, cfg.etc_private_keep); | 773 | fs_private_dir_list("/etc", RUN_ETC_DIR, cfg.etc_private_keep); |
769 | // create /etc/ld.so.preload file again | 774 | // create /etc/ld.so.preload file again |
770 | if (arg_trace || arg_tracelog) | 775 | if (need_preload) |
771 | fs_trace_preload(); | 776 | fs_trace_preload(); |
772 | } | 777 | } |
773 | } | 778 | } |
@@ -876,7 +881,7 @@ int sandbox(void* sandbox_arg) { | |||
876 | fs_blacklist(); // mkdir and mkfile are processed all over again | 881 | fs_blacklist(); // mkdir and mkfile are processed all over again |
877 | 882 | ||
878 | //**************************** | 883 | //**************************** |
879 | // nosound/no3d and fix for pulseaudio 7.0 | 884 | // nosound/no3d/notv/novideo and fix for pulseaudio 7.0 |
880 | //**************************** | 885 | //**************************** |
881 | if (arg_nosound) { | 886 | if (arg_nosound) { |
882 | // disable pulseaudio | 887 | // disable pulseaudio |
@@ -891,18 +896,19 @@ int sandbox(void* sandbox_arg) { | |||
891 | if (arg_no3d) | 896 | if (arg_no3d) |
892 | fs_dev_disable_3d(); | 897 | fs_dev_disable_3d(); |
893 | 898 | ||
894 | //**************************** | 899 | if (arg_notv) |
895 | // novideo | 900 | fs_dev_disable_tv(); |
896 | //**************************** | 901 | |
897 | if (arg_novideo) { | 902 | if (arg_nodvd) |
898 | // disable /dev/video* | 903 | fs_dev_disable_dvd(); |
904 | |||
905 | if (arg_novideo) | ||
899 | fs_dev_disable_video(); | 906 | fs_dev_disable_video(); |
900 | } | ||
901 | 907 | ||
902 | //**************************** | 908 | //**************************** |
903 | // install trace | 909 | // install trace |
904 | //**************************** | 910 | //**************************** |
905 | if (arg_trace || arg_tracelog) | 911 | if (need_preload) |
906 | fs_trace(); | 912 | fs_trace(); |
907 | 913 | ||
908 | //**************************** | 914 | //**************************** |
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c index 13d8d44fa..516c97fa0 100644 --- a/src/firejail/seccomp.c +++ b/src/firejail/seccomp.c | |||
@@ -41,7 +41,7 @@ char *seccomp_check_list(const char *str) { | |||
41 | const char *ptr1 = str; | 41 | const char *ptr1 = str; |
42 | char *ptr2 = rv; | 42 | char *ptr2 = rv; |
43 | while (*ptr1 != '\0') { | 43 | while (*ptr1 != '\0') { |
44 | if (isalnum(*ptr1) || *ptr1 == '_' || *ptr1 == ',' || *ptr1 == ':') | 44 | if (isalnum(*ptr1) || *ptr1 == '_' || *ptr1 == ',' || *ptr1 == ':' || *ptr1 == '@' || *ptr1 == '-') |
45 | *ptr2++ = *ptr1++; | 45 | *ptr2++ = *ptr1++; |
46 | else { | 46 | else { |
47 | fprintf(stderr, "Error: invalid syscall list\n"); | 47 | fprintf(stderr, "Error: invalid syscall list\n"); |
@@ -145,11 +145,11 @@ int seccomp_filter_drop(int enforce_seccomp) { | |||
145 | // build the seccomp filter as a regular user | 145 | // build the seccomp filter as a regular user |
146 | int rv; | 146 | int rv; |
147 | if (arg_allow_debuggers) | 147 | if (arg_allow_debuggers) |
148 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 6, | 148 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 7, |
149 | PATH_FSECCOMP, "default", "drop", RUN_SECCOMP_CFG, cfg.seccomp_list, "allow-debuggers"); | 149 | PATH_FSECCOMP, "default", "drop", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list, "allow-debuggers"); |
150 | else | 150 | else |
151 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 5, | 151 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 6, |
152 | PATH_FSECCOMP, "default", "drop", RUN_SECCOMP_CFG, cfg.seccomp_list); | 152 | PATH_FSECCOMP, "default", "drop", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list); |
153 | if (rv) | 153 | if (rv) |
154 | exit(rv); | 154 | exit(rv); |
155 | } | 155 | } |
@@ -163,11 +163,11 @@ int seccomp_filter_drop(int enforce_seccomp) { | |||
163 | // build the seccomp filter as a regular user | 163 | // build the seccomp filter as a regular user |
164 | int rv; | 164 | int rv; |
165 | if (arg_allow_debuggers) | 165 | if (arg_allow_debuggers) |
166 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 5, | 166 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 6, |
167 | PATH_FSECCOMP, "drop", RUN_SECCOMP_CFG, cfg.seccomp_list_drop, "allow-debuggers"); | 167 | PATH_FSECCOMP, "drop", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list_drop, "allow-debuggers"); |
168 | else | 168 | else |
169 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4, | 169 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 5, |
170 | PATH_FSECCOMP, "drop", RUN_SECCOMP_CFG, cfg.seccomp_list_drop); | 170 | PATH_FSECCOMP, "drop", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list_drop); |
171 | 171 | ||
172 | if (rv) | 172 | if (rv) |
173 | exit(rv); | 173 | exit(rv); |
@@ -183,9 +183,14 @@ int seccomp_filter_drop(int enforce_seccomp) { | |||
183 | exit(1); | 183 | exit(1); |
184 | } | 184 | } |
185 | 185 | ||
186 | if (arg_debug && access(PATH_FSECCOMP, X_OK) == 0) | 186 | if (arg_debug && access(PATH_FSECCOMP, X_OK) == 0) { |
187 | sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3, | 187 | sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3, |
188 | PATH_FSECCOMP, "print", RUN_SECCOMP_CFG); | 188 | PATH_FSECCOMP, "print", RUN_SECCOMP_CFG); |
189 | struct stat st; | ||
190 | if (stat(RUN_SECCOMP_POSTEXEC, &st) != -1 && st.st_size != 0) | ||
191 | sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3, | ||
192 | PATH_FSECCOMP, "print", RUN_SECCOMP_POSTEXEC); | ||
193 | } | ||
189 | 194 | ||
190 | return 0; | 195 | return 0; |
191 | } | 196 | } |
@@ -196,14 +201,19 @@ int seccomp_filter_keep(void) { | |||
196 | printf("Build drop seccomp filter\n"); | 201 | printf("Build drop seccomp filter\n"); |
197 | 202 | ||
198 | // build the seccomp filter as a regular user | 203 | // build the seccomp filter as a regular user |
199 | sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4, | 204 | sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 5, |
200 | PATH_FSECCOMP, "keep", RUN_SECCOMP_CFG, cfg.seccomp_list_keep); | 205 | PATH_FSECCOMP, "keep", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list_keep); |
201 | if (arg_debug) | 206 | if (arg_debug) |
202 | printf("seccomp filter configured\n"); | 207 | printf("seccomp filter configured\n"); |
203 | 208 | ||
204 | 209 | ||
205 | if (arg_debug && access(PATH_FSECCOMP, X_OK) == 0) | 210 | if (arg_debug && access(PATH_FSECCOMP, X_OK) == 0) { |
206 | sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FSECCOMP, "print", RUN_SECCOMP_CFG); | 211 | sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FSECCOMP, "print", RUN_SECCOMP_CFG); |
212 | struct stat st; | ||
213 | if (stat(RUN_SECCOMP_POSTEXEC, &st) != -1 && st.st_size != 0) | ||
214 | sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FSECCOMP, "print", RUN_SECCOMP_POSTEXEC); | ||
215 | } | ||
216 | |||
207 | return seccomp_load(RUN_SECCOMP_CFG); | 217 | return seccomp_load(RUN_SECCOMP_CFG); |
208 | } | 218 | } |
209 | 219 | ||
diff --git a/src/firejail/usage.c b/src/firejail/usage.c index 71bb6f24e..b9ab00eae 100644 --- a/src/firejail/usage.c +++ b/src/firejail/usage.c | |||
@@ -134,11 +134,12 @@ void usage(void) { | |||
134 | printf(" --novideo - disable video devices.\n"); | 134 | printf(" --novideo - disable video devices.\n"); |
135 | printf(" --nowhitelist=filename - disable whitelist for file or directory .\n"); | 135 | printf(" --nowhitelist=filename - disable whitelist for file or directory .\n"); |
136 | printf(" --output=logfile - stdout logging and log rotation.\n"); | 136 | printf(" --output=logfile - stdout logging and log rotation.\n"); |
137 | printf(" --output-stderr=logfile - stdout and stderr logging and log rotation.\n"); | ||
137 | printf(" --overlay - mount a filesystem overlay on top of the current filesystem.\n"); | 138 | printf(" --overlay - mount a filesystem overlay on top of the current filesystem.\n"); |
138 | printf(" --overlay-named=name - mount a filesystem overlay on top of the current\n"); | 139 | printf(" --overlay-named=name - mount a filesystem overlay on top of the current\n"); |
139 | printf("\tfilesystem, and store it in name directory.\n"); | 140 | printf("\tfilesystem, and store it in name directory.\n"); |
140 | printf(" --overlay-tmpfs - mount a temporary filesystem overlay on top of the current\n"); | 141 | printf(" --overlay-tmpfs - mount a temporary filesystem overlay on top of the\n"); |
141 | printf("\tfilesystem.\n"); | 142 | printf("\tcurrent filesystem.\n"); |
142 | printf(" --overlay-clean - clean all overlays stored in $HOME/.firejail directory.\n"); | 143 | printf(" --overlay-clean - clean all overlays stored in $HOME/.firejail directory.\n"); |
143 | printf(" --private - temporary home directory.\n"); | 144 | printf(" --private - temporary home directory.\n"); |
144 | printf(" --private=directory - use directory as user home.\n"); | 145 | printf(" --private=directory - use directory as user home.\n"); |
diff --git a/src/fseccomp/fseccomp.h b/src/fseccomp/fseccomp.h index 0db670380..144b612ae 100644 --- a/src/fseccomp/fseccomp.h +++ b/src/fseccomp/fseccomp.h | |||
@@ -30,8 +30,9 @@ extern int arg_quiet; | |||
30 | 30 | ||
31 | // syscall.c | 31 | // syscall.c |
32 | void syscall_print(void); | 32 | void syscall_print(void); |
33 | int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, int arg), int fd, int arg); | 33 | int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, int arg, void *ptrarg), int fd, int arg, void *ptrarg); |
34 | const char *syscall_find_nr(int nr); | 34 | const char *syscall_find_nr(int nr); |
35 | void syscalls_in_list(const char *list, const char *slist, int fd, char **prelist, char **postlist); | ||
35 | 36 | ||
36 | // errno.c | 37 | // errno.c |
37 | void errno_print(void); | 38 | void errno_print(void); |
@@ -49,9 +50,9 @@ void seccomp_secondary_32(const char *fname); | |||
49 | // seccomp_file.c | 50 | // seccomp_file.c |
50 | void write_to_file(int fd, const void *data, int size); | 51 | void write_to_file(int fd, const void *data, int size); |
51 | void filter_init(int fd); | 52 | void filter_init(int fd); |
52 | void filter_add_whitelist(int fd, int syscall, int arg); | 53 | void filter_add_whitelist(int fd, int syscall, int arg, void *ptrarg); |
53 | void filter_add_blacklist(int fd, int syscall, int arg); | 54 | void filter_add_blacklist(int fd, int syscall, int arg, void *ptrarg); |
54 | void filter_add_errno(int fd, int syscall, int arg); | 55 | void filter_add_errno(int fd, int syscall, int arg, void *ptrarg); |
55 | void filter_end_blacklist(int fd); | 56 | void filter_end_blacklist(int fd); |
56 | void filter_end_whitelist(int fd); | 57 | void filter_end_whitelist(int fd); |
57 | 58 | ||
@@ -59,11 +60,11 @@ void filter_end_whitelist(int fd); | |||
59 | // default list | 60 | // default list |
60 | void seccomp_default(const char *fname, int allow_debuggers); | 61 | void seccomp_default(const char *fname, int allow_debuggers); |
61 | // drop list | 62 | // drop list |
62 | void seccomp_drop(const char *fname, char *list, int allow_debuggers); | 63 | void seccomp_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers); |
63 | // default+drop list | 64 | // default+drop list |
64 | void seccomp_default_drop(const char *fname, char *list, int allow_debuggers); | 65 | void seccomp_default_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers); |
65 | // whitelisted filter | 66 | // whitelisted filter |
66 | void seccomp_keep(const char *fname, char *list); | 67 | void seccomp_keep(const char *fname1, const char *fname2, char *list); |
67 | // block writable and executable memory | 68 | // block writable and executable memory |
68 | void memory_deny_write_execute(const char *fname); | 69 | void memory_deny_write_execute(const char *fname); |
69 | 70 | ||
diff --git a/src/fseccomp/main.c b/src/fseccomp/main.c index 3d95d5bb2..3bf7de0fa 100644 --- a/src/fseccomp/main.c +++ b/src/fseccomp/main.c | |||
@@ -30,11 +30,11 @@ static void usage(void) { | |||
30 | printf("\tfseccomp secondary 32 file\n"); | 30 | printf("\tfseccomp secondary 32 file\n"); |
31 | printf("\tfseccomp default file\n"); | 31 | printf("\tfseccomp default file\n"); |
32 | printf("\tfseccomp default file allow-debuggers\n"); | 32 | printf("\tfseccomp default file allow-debuggers\n"); |
33 | printf("\tfseccomp drop file list\n"); | 33 | printf("\tfseccomp drop file1 file2 list\n"); |
34 | printf("\tfseccomp drop file list allow-debuggers\n"); | 34 | printf("\tfseccomp drop file1 file2 list allow-debuggers\n"); |
35 | printf("\tfseccomp default drop file list\n"); | 35 | printf("\tfseccomp default drop file1 file2 list\n"); |
36 | printf("\tfseccomp default drop file list allow-debuggers\n"); | 36 | printf("\tfseccomp default drop file1 file2 list allow-debuggers\n"); |
37 | printf("\tfseccomp keep file list\n"); | 37 | printf("\tfseccomp keep file1 file2 list\n"); |
38 | printf("\tfseccomp memory-deny-write-execute file\n"); | 38 | printf("\tfseccomp memory-deny-write-execute file\n"); |
39 | printf("\tfseccomp print file\n"); | 39 | printf("\tfseccomp print file\n"); |
40 | } | 40 | } |
@@ -78,16 +78,16 @@ printf("\n"); | |||
78 | seccomp_default(argv[2], 0); | 78 | seccomp_default(argv[2], 0); |
79 | else if (argc == 4 && strcmp(argv[1], "default") == 0 && strcmp(argv[3], "allow-debuggers") == 0) | 79 | else if (argc == 4 && strcmp(argv[1], "default") == 0 && strcmp(argv[3], "allow-debuggers") == 0) |
80 | seccomp_default(argv[2], 1); | 80 | seccomp_default(argv[2], 1); |
81 | else if (argc == 4 && strcmp(argv[1], "drop") == 0) | 81 | else if (argc == 5 && strcmp(argv[1], "drop") == 0) |
82 | seccomp_drop(argv[2], argv[3], 0); | 82 | seccomp_drop(argv[2], argv[3], argv[4], 0); |
83 | else if (argc == 5 && strcmp(argv[1], "drop") == 0 && strcmp(argv[4], "allow-debuggers") == 0) | 83 | else if (argc == 6 && strcmp(argv[1], "drop") == 0 && strcmp(argv[5], "allow-debuggers") == 0) |
84 | seccomp_drop(argv[2], argv[3], 1); | 84 | seccomp_drop(argv[2], argv[3], argv[4], 1); |
85 | else if (argc == 5 && strcmp(argv[1], "default") == 0 && strcmp(argv[2], "drop") == 0) | 85 | else if (argc == 6 && strcmp(argv[1], "default") == 0 && strcmp(argv[2], "drop") == 0) |
86 | seccomp_default_drop(argv[3], argv[4], 0); | 86 | seccomp_default_drop(argv[3], argv[4], argv[5], 0); |
87 | else if (argc == 6 && strcmp(argv[1], "default") == 0 && strcmp(argv[2], "drop") == 0 && strcmp(argv[5], "allow-debuggers") == 0) | 87 | else if (argc == 7 && strcmp(argv[1], "default") == 0 && strcmp(argv[2], "drop") == 0 && strcmp(argv[6], "allow-debuggers") == 0) |
88 | seccomp_default_drop(argv[3], argv[4], 1); | 88 | seccomp_default_drop(argv[3], argv[4], argv[5], 1); |
89 | else if (argc == 4 && strcmp(argv[1], "keep") == 0) | 89 | else if (argc == 5 && strcmp(argv[1], "keep") == 0) |
90 | seccomp_keep(argv[2], argv[3]); | 90 | seccomp_keep(argv[2], argv[3], argv[4]); |
91 | else if (argc == 3 && strcmp(argv[1], "memory-deny-write-execute") == 0) | 91 | else if (argc == 3 && strcmp(argv[1], "memory-deny-write-execute") == 0) |
92 | memory_deny_write_execute(argv[2]); | 92 | memory_deny_write_execute(argv[2]); |
93 | else if (argc == 3 && strcmp(argv[1], "print") == 0) | 93 | else if (argc == 3 && strcmp(argv[1], "print") == 0) |
diff --git a/src/fseccomp/seccomp.c b/src/fseccomp/seccomp.c index a3db46aad..c49681476 100644 --- a/src/fseccomp/seccomp.c +++ b/src/fseccomp/seccomp.c | |||
@@ -27,9 +27,9 @@ | |||
27 | static void add_default_list(int fd, int allow_debuggers) { | 27 | static void add_default_list(int fd, int allow_debuggers) { |
28 | int r; | 28 | int r; |
29 | if (!allow_debuggers) | 29 | if (!allow_debuggers) |
30 | r = syscall_check_list("@default-nodebuggers", filter_add_blacklist, fd, 0); | 30 | r = syscall_check_list("@default-nodebuggers", filter_add_blacklist, fd, 0, NULL); |
31 | else | 31 | else |
32 | r = syscall_check_list("@default", filter_add_blacklist, fd, 0); | 32 | r = syscall_check_list("@default", filter_add_blacklist, fd, 0, NULL); |
33 | 33 | ||
34 | assert(r == 0); | 34 | assert(r == 0); |
35 | //#ifdef SYS_mknod - emoved in 0.9.29 - it breaks Zotero extension | 35 | //#ifdef SYS_mknod - emoved in 0.9.29 - it breaks Zotero extension |
@@ -56,7 +56,7 @@ void seccomp_default(const char *fname, int allow_debuggers) { | |||
56 | exit(1); | 56 | exit(1); |
57 | } | 57 | } |
58 | 58 | ||
59 | // build filter | 59 | // build filter (no post-exec filter needed because default list is fine for us) |
60 | filter_init(fd); | 60 | filter_init(fd); |
61 | add_default_list(fd, allow_debuggers); | 61 | add_default_list(fd, allow_debuggers); |
62 | filter_end_blacklist(fd); | 62 | filter_end_blacklist(fd); |
@@ -66,20 +66,44 @@ void seccomp_default(const char *fname, int allow_debuggers) { | |||
66 | } | 66 | } |
67 | 67 | ||
68 | // drop list | 68 | // drop list |
69 | void seccomp_drop(const char *fname, char *list, int allow_debuggers) { | 69 | void seccomp_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers) { |
70 | assert(fname); | 70 | assert(fname1); |
71 | assert(fname2); | ||
71 | (void) allow_debuggers; // todo: to implemnet it | 72 | (void) allow_debuggers; // todo: to implemnet it |
72 | 73 | ||
73 | // open file | 74 | // open file for pre-exec filter |
74 | int fd = open(fname, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); | 75 | int fd = open(fname1, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); |
75 | if (fd < 0) { | 76 | if (fd < 0) { |
76 | fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname); | 77 | fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname1); |
77 | exit(1); | 78 | exit(1); |
78 | } | 79 | } |
79 | 80 | ||
80 | // build filter | 81 | // build pre-exec filter: don't blacklist any syscalls in @default-keep |
81 | filter_init(fd); | 82 | filter_init(fd); |
82 | if (syscall_check_list(list, filter_add_blacklist, fd, 0)) { | 83 | char *prelist, *postlist; |
84 | syscalls_in_list(list, "@default-keep", fd, &prelist, &postlist); | ||
85 | if (prelist) | ||
86 | if (syscall_check_list(prelist, filter_add_blacklist, fd, 0, NULL)) { | ||
87 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); | ||
88 | exit(1); | ||
89 | } | ||
90 | filter_end_blacklist(fd); | ||
91 | // close file | ||
92 | close(fd); | ||
93 | |||
94 | if (!postlist) | ||
95 | return; | ||
96 | |||
97 | // open file for post-exec filter | ||
98 | fd = open(fname2, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); | ||
99 | if (fd < 0) { | ||
100 | fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname2); | ||
101 | exit(1); | ||
102 | } | ||
103 | |||
104 | // build post-exec filter: blacklist remaining syscalls | ||
105 | filter_init(fd); | ||
106 | if (syscall_check_list(postlist, filter_add_blacklist, fd, 0, NULL)) { | ||
83 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); | 107 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); |
84 | exit(1); | 108 | exit(1); |
85 | } | 109 | } |
@@ -90,20 +114,46 @@ void seccomp_drop(const char *fname, char *list, int allow_debuggers) { | |||
90 | } | 114 | } |
91 | 115 | ||
92 | // default+drop | 116 | // default+drop |
93 | void seccomp_default_drop(const char *fname, char *list, int allow_debuggers) { | 117 | void seccomp_default_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers) { |
94 | assert(fname); | 118 | assert(fname1); |
119 | assert(fname2); | ||
95 | 120 | ||
96 | // open file | 121 | // open file |
97 | int fd = open(fname, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); | 122 | int fd = open(fname1, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); |
98 | if (fd < 0) { | 123 | if (fd < 0) { |
99 | fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname); | 124 | fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname1); |
100 | exit(1); | 125 | exit(1); |
101 | } | 126 | } |
102 | 127 | ||
103 | // build filter | 128 | // build pre-exec filter: blacklist @default, don't blacklist |
129 | // any listed syscalls in @default-keep | ||
104 | filter_init(fd); | 130 | filter_init(fd); |
105 | add_default_list(fd, allow_debuggers); | 131 | add_default_list(fd, allow_debuggers); |
106 | if (syscall_check_list(list, filter_add_blacklist, fd, 0)) { | 132 | char *prelist, *postlist; |
133 | syscalls_in_list(list, "@default-keep", fd, &prelist, &postlist); | ||
134 | if (prelist) | ||
135 | if (syscall_check_list(prelist, filter_add_blacklist, fd, 0, NULL)) { | ||
136 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); | ||
137 | exit(1); | ||
138 | } | ||
139 | filter_end_blacklist(fd); | ||
140 | |||
141 | // close file | ||
142 | close(fd); | ||
143 | |||
144 | if (!postlist) | ||
145 | return; | ||
146 | |||
147 | // open file for post-exec filter | ||
148 | fd = open(fname2, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); | ||
149 | if (fd < 0) { | ||
150 | fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname2); | ||
151 | exit(1); | ||
152 | } | ||
153 | |||
154 | // build post-exec filter: blacklist remaining syscalls | ||
155 | filter_init(fd); | ||
156 | if (syscall_check_list(postlist, filter_add_blacklist, fd, 0, NULL)) { | ||
107 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); | 157 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); |
108 | exit(1); | 158 | exit(1); |
109 | } | 159 | } |
@@ -113,22 +163,42 @@ void seccomp_default_drop(const char *fname, char *list, int allow_debuggers) { | |||
113 | close(fd); | 163 | close(fd); |
114 | } | 164 | } |
115 | 165 | ||
116 | void seccomp_keep(const char *fname, char *list) { | 166 | void seccomp_keep(const char *fname1, const char *fname2, char *list) { |
117 | // open file | 167 | // open file for pre-exec filter |
118 | int fd = open(fname, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); | 168 | int fd = open(fname1, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); |
119 | if (fd < 0) { | 169 | if (fd < 0) { |
120 | fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname); | 170 | fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname1); |
121 | exit(1); | 171 | exit(1); |
122 | } | 172 | } |
123 | 173 | ||
124 | // build filter | 174 | // build pre-exec filter: whitelist also @default-keep |
125 | filter_init(fd); | 175 | filter_init(fd); |
126 | // these syscalls are used by firejail after the seccomp filter is initialized | 176 | // these syscalls are used by firejail after the seccomp filter is initialized |
127 | int r; | 177 | int r; |
128 | r = syscall_check_list("@default-keep", filter_add_whitelist, fd, 0); | 178 | r = syscall_check_list("@default-keep", filter_add_whitelist, fd, 0, NULL); |
129 | assert(r == 0); | 179 | assert(r == 0); |
130 | 180 | ||
131 | if (syscall_check_list(list, filter_add_whitelist, fd, 0)) { | 181 | if (syscall_check_list(list, filter_add_whitelist, fd, 0, NULL)) { |
182 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); | ||
183 | exit(1); | ||
184 | } | ||
185 | |||
186 | filter_end_whitelist(fd); | ||
187 | |||
188 | // close file | ||
189 | close(fd); | ||
190 | |||
191 | // open file for post-exec filter | ||
192 | fd = open(fname2, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); | ||
193 | if (fd < 0) { | ||
194 | fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname2); | ||
195 | exit(1); | ||
196 | } | ||
197 | |||
198 | // build post-exec filter: whitelist without @default-keep | ||
199 | filter_init(fd); | ||
200 | |||
201 | if (syscall_check_list(list, filter_add_whitelist, fd, 0, NULL)) { | ||
132 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); | 202 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); |
133 | exit(1); | 203 | exit(1); |
134 | } | 204 | } |
diff --git a/src/fseccomp/seccomp_file.c b/src/fseccomp/seccomp_file.c index 16ffd5302..2d5ee115d 100644 --- a/src/fseccomp/seccomp_file.c +++ b/src/fseccomp/seccomp_file.c | |||
@@ -60,8 +60,9 @@ void filter_init(int fd) { | |||
60 | write_to_file(fd, filter, sizeof(filter)); | 60 | write_to_file(fd, filter, sizeof(filter)); |
61 | } | 61 | } |
62 | 62 | ||
63 | void filter_add_whitelist(int fd, int syscall, int arg) { | 63 | void filter_add_whitelist(int fd, int syscall, int arg, void *ptrarg) { |
64 | (void) arg; | 64 | (void) arg; |
65 | (void) ptrarg; | ||
65 | 66 | ||
66 | struct sock_filter filter[] = { | 67 | struct sock_filter filter[] = { |
67 | WHITELIST(syscall) | 68 | WHITELIST(syscall) |
@@ -69,8 +70,9 @@ void filter_add_whitelist(int fd, int syscall, int arg) { | |||
69 | write_to_file(fd, filter, sizeof(filter)); | 70 | write_to_file(fd, filter, sizeof(filter)); |
70 | } | 71 | } |
71 | 72 | ||
72 | void filter_add_blacklist(int fd, int syscall, int arg) { | 73 | void filter_add_blacklist(int fd, int syscall, int arg, void *ptrarg) { |
73 | (void) arg; | 74 | (void) arg; |
75 | (void) ptrarg; | ||
74 | 76 | ||
75 | struct sock_filter filter[] = { | 77 | struct sock_filter filter[] = { |
76 | BLACKLIST(syscall) | 78 | BLACKLIST(syscall) |
@@ -78,7 +80,8 @@ void filter_add_blacklist(int fd, int syscall, int arg) { | |||
78 | write_to_file(fd, filter, sizeof(filter)); | 80 | write_to_file(fd, filter, sizeof(filter)); |
79 | } | 81 | } |
80 | 82 | ||
81 | void filter_add_errno(int fd, int syscall, int arg) { | 83 | void filter_add_errno(int fd, int syscall, int arg, void *ptrarg) { |
84 | (void) ptrarg; | ||
82 | struct sock_filter filter[] = { | 85 | struct sock_filter filter[] = { |
83 | BLACKLIST_ERRNO(syscall, arg) | 86 | BLACKLIST_ERRNO(syscall, arg) |
84 | }; | 87 | }; |
diff --git a/src/fseccomp/syscall.c b/src/fseccomp/syscall.c index 5893a2ea8..b9e6d995b 100644 --- a/src/fseccomp/syscall.c +++ b/src/fseccomp/syscall.c | |||
@@ -17,7 +17,9 @@ | |||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | 17 | * with this program; if not, write to the Free Software Foundation, Inc., |
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #define _GNU_SOURCE | ||
20 | #include "fseccomp.h" | 21 | #include "fseccomp.h" |
22 | #include <stdio.h> | ||
21 | #include <sys/syscall.h> | 23 | #include <sys/syscall.h> |
22 | 24 | ||
23 | typedef struct { | 25 | typedef struct { |
@@ -30,6 +32,13 @@ typedef struct { | |||
30 | const char * const list; | 32 | const char * const list; |
31 | } SyscallGroupList; | 33 | } SyscallGroupList; |
32 | 34 | ||
35 | typedef struct { | ||
36 | const char *slist; | ||
37 | char *prelist, *postlist; | ||
38 | bool found; | ||
39 | int syscall; | ||
40 | } SyscallCheckList; | ||
41 | |||
33 | static const SyscallEntry syslist[] = { | 42 | static const SyscallEntry syslist[] = { |
34 | // | 43 | // |
35 | // code generated using tools/extract-syscall | 44 | // code generated using tools/extract-syscall |
@@ -174,6 +183,7 @@ static const SyscallGroupList sysgroups[] = { | |||
174 | }, | 183 | }, |
175 | { .name = "@default-keep", .list = | 184 | { .name = "@default-keep", .list = |
176 | "dup," | 185 | "dup," |
186 | "execve," | ||
177 | "prctl," | 187 | "prctl," |
178 | "setgid," | 188 | "setgid," |
179 | "setgroups," | 189 | "setgroups," |
@@ -449,7 +459,7 @@ error: | |||
449 | } | 459 | } |
450 | 460 | ||
451 | // return 1 if error, 0 if OK | 461 | // return 1 if error, 0 if OK |
452 | int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, int arg), int fd, int arg) { | 462 | int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, int arg, void *ptrarg), int fd, int arg, void *ptrarg) { |
453 | // don't allow empty lists | 463 | // don't allow empty lists |
454 | if (slist == NULL || *slist == '\0') { | 464 | if (slist == NULL || *slist == '\0') { |
455 | fprintf(stderr, "Error fseccomp: empty syscall lists are not allowed\n"); | 465 | fprintf(stderr, "Error fseccomp: empty syscall lists are not allowed\n"); |
@@ -477,7 +487,7 @@ int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, | |||
477 | fprintf(stderr, "Error fseccomp: unknown syscall group %s\n", ptr); | 487 | fprintf(stderr, "Error fseccomp: unknown syscall group %s\n", ptr); |
478 | exit(1); | 488 | exit(1); |
479 | } | 489 | } |
480 | syscall_check_list(new_list, callback, fd, arg); | 490 | syscall_check_list(new_list, callback, fd, arg, ptrarg); |
481 | } | 491 | } |
482 | else { | 492 | else { |
483 | syscall_process_name(ptr, &syscall_nr, &error_nr); | 493 | syscall_process_name(ptr, &syscall_nr, &error_nr); |
@@ -487,9 +497,9 @@ int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, | |||
487 | } | 497 | } |
488 | else if (callback != NULL) { | 498 | else if (callback != NULL) { |
489 | if (error_nr != -1) | 499 | if (error_nr != -1) |
490 | filter_add_errno(fd, syscall_nr, error_nr); | 500 | filter_add_errno(fd, syscall_nr, error_nr, ptrarg); |
491 | else | 501 | else |
492 | callback(fd, syscall_nr, arg); | 502 | callback(fd, syscall_nr, arg, ptrarg); |
493 | } | 503 | } |
494 | } | 504 | } |
495 | ptr = strtok_r(NULL, ",", &saveptr); | 505 | ptr = strtok_r(NULL, ",", &saveptr); |
@@ -498,3 +508,49 @@ int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, | |||
498 | free(str); | 508 | free(str); |
499 | return 0; | 509 | return 0; |
500 | } | 510 | } |
511 | |||
512 | static void find_syscall(int fd, int syscall, int arg, void *ptrarg) { | ||
513 | (void)fd; | ||
514 | SyscallCheckList *ptr = ptrarg; | ||
515 | if (syscall == ptr->syscall) | ||
516 | ptr->found = true; | ||
517 | } | ||
518 | |||
519 | // go through list2 and find matches for problem syscall | ||
520 | static void syscall_in_list(int fd, int syscall, int arg, void *ptrarg) { | ||
521 | (void)arg; | ||
522 | SyscallCheckList *ptr = ptrarg; | ||
523 | SyscallCheckList sl; | ||
524 | sl.found = false; | ||
525 | sl.syscall = syscall; | ||
526 | syscall_check_list(ptr->slist, find_syscall, fd, 0, &sl); | ||
527 | // if found in the problem list, add to post-exec list | ||
528 | if (sl.found) | ||
529 | if (ptr->postlist) { | ||
530 | if (asprintf(&ptr->postlist, "%s,%s", ptr->postlist, syscall_find_nr(syscall)) == -1) | ||
531 | errExit("asprintf"); | ||
532 | } | ||
533 | else | ||
534 | ptr->postlist = strdup(syscall_find_nr(syscall)); | ||
535 | else // no problem, add to pre-exec list | ||
536 | if (ptr->prelist) { | ||
537 | if (asprintf(&ptr->prelist, "%s,%s", ptr->prelist, syscall_find_nr(syscall)) == -1) | ||
538 | errExit("asprintf"); | ||
539 | } | ||
540 | else | ||
541 | ptr->prelist = strdup(syscall_find_nr(syscall)); | ||
542 | } | ||
543 | |||
544 | // go through list and find matches for syscalls in list @default-keep | ||
545 | void syscalls_in_list(const char *list, const char *slist, int fd, char **prelist, char **postlist) { | ||
546 | SyscallCheckList sl; | ||
547 | // these syscalls are used by firejail after the seccomp filter is initialized | ||
548 | sl.slist = slist; | ||
549 | sl.prelist = NULL; | ||
550 | sl.postlist = NULL; | ||
551 | syscall_check_list(list, syscall_in_list, 0, 0, &sl); | ||
552 | if (!arg_quiet) | ||
553 | printf("list in: %s, check list: %s prelist: %s, postlist: %s\n", list, sl.slist, sl.prelist, sl.postlist); | ||
554 | *prelist = sl.prelist; | ||
555 | *postlist = sl.postlist; | ||
556 | } | ||
diff --git a/src/libpostexecseccomp/Makefile.in b/src/libpostexecseccomp/Makefile.in new file mode 100644 index 000000000..92803342c --- /dev/null +++ b/src/libpostexecseccomp/Makefile.in | |||
@@ -0,0 +1,26 @@ | |||
1 | CC=@CC@ | ||
2 | PREFIX=@prefix@ | ||
3 | VERSION=@PACKAGE_VERSION@ | ||
4 | NAME=@PACKAGE_NAME@ | ||
5 | HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@ | ||
6 | |||
7 | H_FILE_LIST = $(sort $(wildcard *.[h])) | ||
8 | C_FILE_LIST = $(sort $(wildcard *.c)) | ||
9 | OBJS = $(C_FILE_LIST:.c=.o) | ||
10 | BINOBJS = $(foreach file, $(OBJS), $file) | ||
11 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIC -Wformat -Wformat-security | ||
12 | LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now | ||
13 | |||
14 | all: libpostexecseccomp.so | ||
15 | |||
16 | %.o : %.c $(H_FILE_LIST) | ||
17 | $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@ | ||
18 | |||
19 | libpostexecseccomp.so: $(OBJS) | ||
20 | $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl | ||
21 | |||
22 | |||
23 | clean:; rm -f $(OBJS) libpostexecseccomp.so | ||
24 | |||
25 | distclean: clean | ||
26 | rm -fr Makefile | ||
diff --git a/src/libpostexecseccomp/libpostexecseccomp.c b/src/libpostexecseccomp/libpostexecseccomp.c new file mode 100644 index 000000000..2c9d02c84 --- /dev/null +++ b/src/libpostexecseccomp/libpostexecseccomp.c | |||
@@ -0,0 +1,54 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2017 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #include "libpostexecseccomp.h" | ||
21 | #include "../include/seccomp.h" | ||
22 | #include <fcntl.h> | ||
23 | #include <linux/filter.h> | ||
24 | #include <sys/mman.h> | ||
25 | #include <sys/prctl.h> | ||
26 | #include <unistd.h> | ||
27 | |||
28 | __attribute__((constructor)) | ||
29 | static void load_seccomp(void) { | ||
30 | int fd = open(RUN_SECCOMP_POSTEXEC, O_RDONLY); | ||
31 | if (fd == -1) | ||
32 | return; | ||
33 | |||
34 | int size = lseek(fd, 0, SEEK_END); | ||
35 | unsigned short entries = (unsigned short) size / (unsigned short) sizeof(struct sock_filter); | ||
36 | struct sock_filter *filter = MAP_FAILED; | ||
37 | if (size != 0) | ||
38 | filter = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0); | ||
39 | |||
40 | close(fd); | ||
41 | |||
42 | if (size == 0 || filter == MAP_FAILED) | ||
43 | return; | ||
44 | |||
45 | // install filter | ||
46 | struct sock_fprog prog = { | ||
47 | .len = entries, | ||
48 | .filter = filter, | ||
49 | }; | ||
50 | |||
51 | prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | ||
52 | prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | ||
53 | munmap(filter, size); | ||
54 | } | ||
diff --git a/src/libpostexecseccomp/libpostexecseccomp.h b/src/libpostexecseccomp/libpostexecseccomp.h new file mode 100644 index 000000000..c4aca540a --- /dev/null +++ b/src/libpostexecseccomp/libpostexecseccomp.h | |||
@@ -0,0 +1,25 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2017 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #ifndef LIBPOSTEXECSECCOMP_H | ||
21 | #define LIBPOSTEXECSECCOMP_H | ||
22 | |||
23 | #define RUN_SECCOMP_POSTEXEC "/run/firejail/mnt/seccomp.postexec" | ||
24 | |||
25 | #endif | ||
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt index f446f37b8..5bd4f6ef8 100644 --- a/src/man/firejail-profile.txt +++ b/src/man/firejail-profile.txt | |||
@@ -411,6 +411,9 @@ env LD_LIBRARY_PATH=/opt/test/lib | |||
411 | env CFLAGS="-W -Wall -Werror" | 411 | env CFLAGS="-W -Wall -Werror" |
412 | 412 | ||
413 | .TP | 413 | .TP |
414 | \fBnodvd | ||
415 | Disable DVD and audio CD devices. | ||
416 | .TP | ||
414 | \fBnogroups | 417 | \fBnogroups |
415 | Disable supplementary user groups | 418 | Disable supplementary user groups |
416 | .TP | 419 | .TP |
@@ -423,6 +426,9 @@ Enable IPC namespace. | |||
423 | \fBnosound | 426 | \fBnosound |
424 | Disable sound system. | 427 | Disable sound system. |
425 | .TP | 428 | .TP |
429 | \fBnotv | ||
430 | Disable DVB (Digital Video Broadcasting) TV devices. | ||
431 | .TP | ||
426 | \fBnovideo | 432 | \fBnovideo |
427 | Disable video devices. | 433 | Disable video devices. |
428 | .TP | 434 | .TP |
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index bf18167b2..be73429bc 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -974,6 +974,15 @@ $ nc dict.org 2628 | |||
974 | 220 pan.alephnull.com dictd 1.12.1/rf on Linux 3.14-1-amd64 | 974 | 220 pan.alephnull.com dictd 1.12.1/rf on Linux 3.14-1-amd64 |
975 | .br | 975 | .br |
976 | .TP | 976 | .TP |
977 | \fB\-\-nodvd | ||
978 | Disable DVD and audio CD devices. | ||
979 | .br | ||
980 | |||
981 | .br | ||
982 | Example: | ||
983 | .br | ||
984 | $ firejail \-\-nodvd | ||
985 | .TP | ||
977 | \fB\-\-noexec=dirname_or_filename | 986 | \fB\-\-noexec=dirname_or_filename |
978 | Remount directory or file noexec, nodev and nosuid. | 987 | Remount directory or file noexec, nodev and nosuid. |
979 | .br | 988 | .br |
@@ -1084,6 +1093,16 @@ Example: | |||
1084 | $ firejail \-\-nosound firefox | 1093 | $ firejail \-\-nosound firefox |
1085 | 1094 | ||
1086 | .TP | 1095 | .TP |
1096 | \fB\-\-notv | ||
1097 | Disable DVB (Digital Video Broadcasting) TV devices. | ||
1098 | .br | ||
1099 | |||
1100 | .br | ||
1101 | Example: | ||
1102 | .br | ||
1103 | $ firejail \-\-notv vlc | ||
1104 | |||
1105 | .TP | ||
1087 | \fB\-\-novideo | 1106 | \fB\-\-novideo |
1088 | Disable video devices. | 1107 | Disable video devices. |
1089 | .br | 1108 | .br |
@@ -1120,6 +1139,10 @@ $ ls -l sandboxlog* | |||
1120 | -rw-r--r-- 1 netblue netblue 511488 Jun 2 07:48 sandboxlog.5 | 1139 | -rw-r--r-- 1 netblue netblue 511488 Jun 2 07:48 sandboxlog.5 |
1121 | 1140 | ||
1122 | .TP | 1141 | .TP |
1142 | \fB\-\-output-stderr=logfile | ||
1143 | Similar to \-\-output, but stderr is also stored. | ||
1144 | |||
1145 | .TP | ||
1123 | \fB\-\-overlay | 1146 | \fB\-\-overlay |
1124 | Mount a filesystem overlay on top of the current filesystem. Unlike the regular filesystem container, | 1147 | Mount a filesystem overlay on top of the current filesystem. Unlike the regular filesystem container, |
1125 | the system directories are mounted read-write. All filesystem modifications go into the overlay. | 1148 | the system directories are mounted read-write. All filesystem modifications go into the overlay. |
@@ -1555,6 +1578,32 @@ $ rm testfile | |||
1555 | rm: cannot remove `testfile': Operation not permitted | 1578 | rm: cannot remove `testfile': Operation not permitted |
1556 | .br | 1579 | .br |
1557 | 1580 | ||
1581 | .br | ||
1582 | If the blocked system calls would also block Firejail from operating, | ||
1583 | they are handled by adding a preloaded library which performs seccomp | ||
1584 | system calls later. | ||
1585 | .br | ||
1586 | |||
1587 | .br | ||
1588 | Example: | ||
1589 | .br | ||
1590 | |||
1591 | .br | ||
1592 | $ firejail \-\-noprofile \-\-shell=none \-\-seccomp=execve bash | ||
1593 | .br | ||
1594 | Parent pid 32751, child pid 32752 | ||
1595 | .br | ||
1596 | Post-exec seccomp protector enabled | ||
1597 | .br | ||
1598 | list in: execve, check list: @default-keep prelist: (null), postlist: execve | ||
1599 | .br | ||
1600 | Child process initialized in 46.44 ms | ||
1601 | .br | ||
1602 | $ ls | ||
1603 | .br | ||
1604 | Bad system call | ||
1605 | .br | ||
1606 | |||
1558 | .TP | 1607 | .TP |
1559 | \fB\-\-seccomp.drop=syscall,syscall,syscall | 1608 | \fB\-\-seccomp.drop=syscall,syscall,syscall |
1560 | Enable seccomp filter, and blacklist the syscalls specified by the command. | 1609 | Enable seccomp filter, and blacklist the syscalls specified by the command. |