369 files changed, 1463 insertions, 373 deletions

diff --git a/Makefile.in b/Makefile.in
index 6d8bf5f72..d9d7bcd37 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -1,6 +1,6 @@
 all: apps man filters
 MYLIBS = src/lib
-APPS = src/firejail src/firemon src/firecfg src/libtrace src/libtracelog src/ftee src/faudit src/fnet src/fseccomp src/fcopy src/fldd
+APPS = src/firejail src/firemon src/firecfg src/libtrace src/libtracelog src/ftee src/faudit src/fnet src/fseccomp src/fcopy src/fldd src/libpostexecseccomp
 MANPAGES = firejail.1 firemon.1 firecfg.1 firejail-profile.5 firejail-login.5
 SECCOMP_FILTERS = seccomp seccomp.i386 seccomp.amd64
 
@@ -85,6 +85,7 @@ realinstall:
         install -m 0755 -d $(DESTDIR)/$(libdir)/firejail
         install -c -m 0644 src/libtrace/libtrace.so $(DESTDIR)/$(libdir)/firejail/.
         install -c -m 0644 src/libtracelog/libtracelog.so $(DESTDIR)/$(libdir)/firejail/.
+        install -c -m 0644 src/libpostexecseccomp/libpostexecseccomp.so $(DESTDIR)/$(libdir)/firejail/.
         install -c -m 0755 src/ftee/ftee $(DESTDIR)/$(libdir)/firejail/.
         install -c -m 0755 src/fshaper/fshaper.sh $(DESTDIR)/$(libdir)/firejail/.
 ifeq ($(HAVE_GIT_INSTALL),-DHAVE_GIT_INSTALL)
@@ -159,11 +160,13 @@ install-strip: all
         strip src/firecfg/firecfg
         strip src/libtrace/libtrace.so
         strip src/libtracelog/libtracelog.so
+        strip src/libpostexecseccomp/libpostexecseccomp.so
         strip src/ftee/ftee
         strip src/faudit/faudit
         strip src/fnet/fnet
         strip src/fseccomp/fseccomp
         strip src/fcopy/fcopy
+        strip src/fldd/fldd
         $(MAKE) realinstall
 
 uninstall:
diff --git a/README b/README
index fefdedd94..f2dc9ec91 100644
--- a/README
+++ b/README
@@ -336,6 +336,8 @@ pirate486743186 (https://github.com/pirate486743186)
         - KMail profile
 Pixel Fairy (https://github.com/xahare)
         - added fjclip.py, fjdisplay.py and fjresize.py in contrib section
+PizzaDude (https://github.com/pizzadude)
+        - add mpv support to smplayer
 pshpsh (https://github.com/pshpsh)
         - added FossaMail profile
 pstn (https://github.com/pstn)
diff --git a/README.md b/README.md
index 63ee3f51a..58656e710 100644
--- a/README.md
+++ b/README.md
@@ -112,6 +112,10 @@ Use this issue to request new profiles: [#1139](https://github.com/netblue30/fir
               Example:
               $ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 fire‐
               fox
+
+       --output-stderr=logfile
+              Similar to --output, but stderr is also stored.
+
 `````
 
 ## /etc/firejail/firejail.config
diff --git a/RELNOTES b/RELNOTES
index 8122d5abb..25cacb281 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,5 +1,6 @@
 firejail (0.9.49) baseline; urgency=low
   * work in progress!
+  * modif: --output split in two commands, --output and --output-stderr
   * feature: per-profile disable-mnt (--disable-mnt)
   * feature: per-profile support to set X11 Xephyr screen size (--xephyr-screen)
   * enhancement: /proc/sys mounting
diff --git a/configure b/configure
index 3dda0918e..2d2059779 100755
--- a/configure
+++ b/configure
@@ -3823,7 +3823,7 @@ if test "$prefix" = /usr; then
         sysconfdir="/etc"
 fi
 
-ac_config_files="$ac_config_files Makefile src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile"
+ac_config_files="$ac_config_files Makefile src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile"
 
 cat >confcache <<\_ACEOF
 # This file is a shell script that caches the results of configure
@@ -4545,6 +4545,7 @@ do
     "src/faudit/Makefile") CONFIG_FILES="$CONFIG_FILES src/faudit/Makefile" ;;
     "src/fseccomp/Makefile") CONFIG_FILES="$CONFIG_FILES src/fseccomp/Makefile" ;;
     "src/fldd/Makefile") CONFIG_FILES="$CONFIG_FILES src/fldd/Makefile" ;;
+    "src/libpostexecseccomp/Makefile") CONFIG_FILES="$CONFIG_FILES src/libpostexecseccomp/Makefile" ;;
 
   *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;;
   esac
diff --git a/configure.ac b/configure.ac
index 09fc3f587..8552c48eb 100644
--- a/configure.ac
+++ b/configure.ac
@@ -177,7 +177,7 @@ fi
 
 AC_OUTPUT(Makefile src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile \
 src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile \
-src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile)
+src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile)
 
 echo
 echo "Configuration options:"
diff --git a/etc/0ad.profile b/etc/0ad.profile
index af6e32947..9ca9834a8 100644
--- a/etc/0ad.profile
+++ b/etc/0ad.profile
@@ -24,9 +24,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/2048-qt.profile b/etc/2048-qt.profile
index d8c402d34..06cc69503 100644
--- a/etc/2048-qt.profile
+++ b/etc/2048-qt.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/7z.profile b/etc/7z.profile
index 5e2b76f18..ea67bbe19 100644
--- a/etc/7z.profile
+++ b/etc/7z.profile
@@ -11,8 +11,9 @@ blacklist /tmp/.X11-unix
 ignore noroot
 net none
 no3d
+nodvd
 nosound
-nosound
+notv
 novideo
 shell none
 tracelog
diff --git a/etc/Cryptocat.profile b/etc/Cryptocat.profile
index dc45a32b7..add122a5e 100644
--- a/etc/Cryptocat.profile
+++ b/etc/Cryptocat.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/Cyberfox.profile b/etc/Cyberfox.profile
index 4d0f7cac8..202bc26f4 100644
--- a/etc/Cyberfox.profile
+++ b/etc/Cyberfox.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/cyberfox.profile
diff --git a/etc/FossaMail.profile b/etc/FossaMail.profile
index 3b8c093ef..01e338ef2 100644
--- a/etc/FossaMail.profile
+++ b/etc/FossaMail.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/fossamail.profile
diff --git a/etc/Mathematica.profile b/etc/Mathematica.profile
index 8f6e33f7b..924f74389 100644
--- a/etc/Mathematica.profile
+++ b/etc/Mathematica.profile
@@ -21,6 +21,8 @@ whitelist ~/Documents/Wolfram Mathematica
 include /etc/firejail/whitelist-common.inc
 
 caps.drop all
+nodvd
 nonewprivs
 noroot
+notv
 seccomp
diff --git a/etc/Telegram.profile b/etc/Telegram.profile
index 844595b3f..df6557a90 100644
--- a/etc/Telegram.profile
+++ b/etc/Telegram.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/telegram.profile
diff --git a/etc/Thunar.profile b/etc/Thunar.profile
index 7bb66240e..f4a5c9f54 100644
--- a/etc/Thunar.profile
+++ b/etc/Thunar.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/VirtualBox.profile b/etc/VirtualBox.profile
index 706a3611b..dedf448ae 100644
--- a/etc/VirtualBox.profile
+++ b/etc/VirtualBox.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/virtualbox.profile
diff --git a/etc/Wire.profile b/etc/Wire.profile
index a2c0f0099..26b683f84 100644
--- a/etc/Wire.profile
+++ b/etc/Wire.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/wire.profile
diff --git a/etc/Xephyr.profile b/etc/Xephyr.profile
index db3b3858c..c0c322b67 100644
--- a/etc/Xephyr.profile
+++ b/etc/Xephyr.profile
@@ -22,11 +22,13 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 # Xephyr needs to be allowed access to the abstract Unix socket namespace.
+nodvd
 nogroups
 nonewprivs
 # In noroot mode, Xephyr cannot create a socket in the real /tmp/.X11-unix.
 # noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/Xvfb.profile b/etc/Xvfb.profile
index ce17a9732..7921e0d06 100644
--- a/etc/Xvfb.profile
+++ b/etc/Xvfb.profile
@@ -23,11 +23,13 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 # Xvfb needs to be allowed access to the abstract Unix socket namespace.
+nodvd
 nogroups
 nonewprivs
 # In noroot mode, Xvfb cannot create a socket in the real /tmp/.X11-unix.
 #noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/abrowser.profile b/etc/abrowser.profile
index a7fbb63d9..3251ef8aa 100644
--- a/etc/abrowser.profile
+++ b/etc/abrowser.profile
@@ -37,8 +37,10 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 tracelog
diff --git a/etc/akregator.profile b/etc/akregator.profile
index 36886b961..12bb06fb5 100644
--- a/etc/akregator.profile
+++ b/etc/akregator.profile
@@ -16,9 +16,11 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/amarok.profile b/etc/amarok.profile
index 28398e2c1..e10cfbefe 100644
--- a/etc/amarok.profile
+++ b/etc/amarok.profile
@@ -16,6 +16,7 @@ netfilter
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 # seccomp
 shell none
diff --git a/etc/android-studio.profile b/etc/android-studio.profile
index 3f4795195..1e1953780 100644
--- a/etc/android-studio.profile
+++ b/etc/android-studio.profile
@@ -20,9 +20,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/apktool.profile b/etc/apktool.profile
index e057e4c0f..bdd711964 100644
--- a/etc/apktool.profile
+++ b/etc/apktool.profile
@@ -14,15 +14,18 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
 shell none
 
+private-bin apktool,bash,java,dirname,basename,expr
 private-dev
 
 noexec ${HOME}
diff --git a/etc/arduino.profile b/etc/arduino.profile
index 2734e59a4..b529ec266 100644
--- a/etc/arduino.profile
+++ b/etc/arduino.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/ark.profile b/etc/ark.profile
index 7c8574973..2ed25a4e6 100644
--- a/etc/ark.profile
+++ b/etc/ark.profile
@@ -14,10 +14,13 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
+novideo
 protocol unix
 seccomp
 shell none
diff --git a/etc/arm.profile b/etc/arm.profile
index 5686c3301..53d290b49 100644
--- a/etc/arm.profile
+++ b/etc/arm.profile
@@ -20,10 +20,12 @@ caps.drop all
 ipc-namespace
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
@@ -31,7 +33,7 @@ shell none
 tracelog
 
 disable-mnt
-# private-bin arm,tor,sh,python2,python2.7,ps,lsof,ldconfig
+# private-bin arm,tor,sh,bash,python2,python2.7,ps,lsof,ldconfig
 private-dev
 private-etc tor,passwd
 private-tmp
diff --git a/etc/atom-beta.profile b/etc/atom-beta.profile
index acce287c7..4869ef4ea 100644
--- a/etc/atom-beta.profile
+++ b/etc/atom-beta.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6,netlink
 seccomp
diff --git a/etc/atom.profile b/etc/atom.profile
index 0b763997e..8629c3dd8 100644
--- a/etc/atom.profile
+++ b/etc/atom.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6,netlink
 seccomp
diff --git a/etc/atool.profile b/etc/atool.profile
index a1da26076..c2e772f9d 100644
--- a/etc/atool.profile
+++ b/etc/atool.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/atril.profile b/etc/atril.profile
index 5cac339ca..7109d343e 100644
--- a/etc/atril.profile
+++ b/etc/atril.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/audacious.profile b/etc/audacious.profile
index 15bf6c013..3baa0ddba 100644
--- a/etc/audacious.profile
+++ b/etc/audacious.profile
@@ -17,6 +17,8 @@ caps.drop all
 netfilter
 nonewprivs
 noroot
+notv
+novideo
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/audacity.profile b/etc/audacity.profile
index 0f88886e7..b5a15b04c 100644
--- a/etc/audacity.profile
+++ b/etc/audacity.profile
@@ -15,9 +15,11 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/aweather.profile b/etc/aweather.profile
index 9068c39c7..ef811b330 100644
--- a/etc/aweather.profile
+++ b/etc/aweather.profile
@@ -18,10 +18,12 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/baloo_file.profile b/etc/baloo_file.profile
index 9c2909b0f..2809089e6 100644
--- a/etc/baloo_file.profile
+++ b/etc/baloo_file.profile
@@ -18,10 +18,12 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 # Baloo makes ioprio_set system calls, which are blacklisted by default.
@@ -36,6 +38,6 @@ noexec /tmp
 
 # Make home directory read-only and allow writing only to ~/.local/share
 # Note: Baloo will not be able to update the "first run" key in its configuration files.
-# noexec     ${HOME}/.local/share
 # read-only  ${HOME}
 # read-write ${HOME}/.local/share
+# noexec     ${HOME}/.local/share
diff --git a/etc/baobab.profile b/etc/baobab.profile
index 1336a220c..ef733632d 100644
--- a/etc/baobab.profile
+++ b/etc/baobab.profile
@@ -14,15 +14,18 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
 shell none
 
+private-bin baobab
 private-dev
 private-tmp
 
diff --git a/etc/bibletime.profile b/etc/bibletime.profile
index d59c8e05c..73d31c205 100644
--- a/etc/bibletime.profile
+++ b/etc/bibletime.profile
@@ -24,10 +24,12 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6,netlink
 seccomp
diff --git a/etc/bitlbee.profile b/etc/bitlbee.profile
index 9c32cca44..0b61e7b9f 100644
--- a/etc/bitlbee.profile
+++ b/etc/bitlbee.profile
@@ -15,8 +15,10 @@ include /etc/firejail/disable-programs.inc
 
 netfilter
 no3d
+nodvd
 nonewprivs
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/bleachbit.profile b/etc/bleachbit.profile
index dab328163..f3498e9b9 100644
--- a/etc/bleachbit.profile
+++ b/etc/bleachbit.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/blender.profile b/etc/blender.profile
index f4c566c0d..f7ecbce55 100644
--- a/etc/blender.profile
+++ b/etc/blender.profile
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/bless.profile b/etc/bless.profile
index 6c6558b1c..e4d2f0730 100644
--- a/etc/bless.profile
+++ b/etc/bless.profile
@@ -15,15 +15,18 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
 shell none
 
+# private-bin bless,sh,bash,mono
 private-dev
 private-etc fonts,mono
 private-tmp
diff --git a/etc/brasero.profile b/etc/brasero.profile
index ee7fe8efa..eff4cba43 100644
--- a/etc/brasero.profile
+++ b/etc/brasero.profile
@@ -17,6 +17,7 @@ nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/brave.profile b/etc/brave.profile
index 20dbf6c52..4a908c884 100644
--- a/etc/brave.profile
+++ b/etc/brave.profile
@@ -30,6 +30,8 @@ include /etc/firejail/whitelist-common.inc
 netfilter
 # nonewprivs
 # noroot
+nodvd
+notv
 # protocol unix,inet,inet6,netlink
 # seccomp
 
diff --git a/etc/caja.profile b/etc/caja.profile
index 1350b63dd..d234e6c9b 100644
--- a/etc/caja.profile
+++ b/etc/caja.profile
@@ -19,9 +19,11 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/calibre.profile b/etc/calibre.profile
index 726a33db8..aa0de473c 100644
--- a/etc/calibre.profile
+++ b/etc/calibre.profile
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/catfish.profile b/etc/catfish.profile
index 759b5e384..498f3b6ee 100644
--- a/etc/catfish.profile
+++ b/etc/catfish.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-devel.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/cherrytree.profile b/etc/cherrytree.profile
index fe0153959..88be562c8 100644
--- a/etc/cherrytree.profile
+++ b/etc/cherrytree.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6,netlink
 seccomp
diff --git a/etc/chromium-browser.profile b/etc/chromium-browser.profile
index dcafbaaa9..472841e92 100644
--- a/etc/chromium-browser.profile
+++ b/etc/chromium-browser.profile
@@ -1,5 +1,5 @@
 # Firejail profile alias for chromium
 # This file is overwritten after every install/update
 
-
+# Redirect
 include /etc/firejail/chromium.profile
diff --git a/etc/chromium.profile b/etc/chromium.profile
index cec5366d9..9be99e68a 100644
--- a/etc/chromium.profile
+++ b/etc/chromium.profile
@@ -11,8 +11,7 @@ noblacklist ~/.config/chromium-flags.conf
 noblacklist ~/.pki
 
 include /etc/firejail/disable-common.inc
-# chromium is distributed with a perl script on Arch
-# include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 
 mkdir ~/.cache/chromium
@@ -27,9 +26,12 @@ include /etc/firejail/whitelist-common.inc
 
 caps.keep sys_chroot,sys_admin
 netfilter
+nodvd
 nogroups
+notv
 shell none
 
+# private-bin chromium,chromium-browser,chromedriver
 private-dev
 # private-tmp - problems with multiple browser sessions
 
diff --git a/etc/claws-mail.profile b/etc/claws-mail.profile
index 730e27e33..bc045fb77 100644
--- a/etc/claws-mail.profile
+++ b/etc/claws-mail.profile
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/clementine.profile b/etc/clementine.profile
index 13a14af3b..14437db3e 100644
--- a/etc/clementine.profile
+++ b/etc/clementine.profile
@@ -5,6 +5,7 @@ include /etc/firejail/clementine.local
 # Persistent global definitions
 include /etc/firejail/globals.local
 
+noblacklist ~/.config/Clementine
 
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
@@ -14,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 # Clementine makes ioprio_set system calls, which are blacklisted by default.
diff --git a/etc/clipit.profile b/etc/clipit.profile
index 444943061..e6ee7b636 100644
--- a/etc/clipit.profile
+++ b/etc/clipit.profile
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/cmus.profile b/etc/cmus.profile
index fc6476267..cf0830475 100644
--- a/etc/cmus.profile
+++ b/etc/cmus.profile
@@ -16,6 +16,7 @@ caps.drop all
 netfilter
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/conkeror.profile b/etc/conkeror.profile
index b4cd3369a..f6a9eefb6 100644
--- a/etc/conkeror.profile
+++ b/etc/conkeror.profile
@@ -25,7 +25,9 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/corebird.profile b/etc/corebird.profile
index 62941164f..87f7a970b 100644
--- a/etc/corebird.profile
+++ b/etc/corebird.profile
@@ -13,6 +13,8 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/cpio.profile b/etc/cpio.profile
index c5d7680a3..f082d2e40 100644
--- a/etc/cpio.profile
+++ b/etc/cpio.profile
@@ -19,7 +19,9 @@ caps.drop all
 net none
 net none
 no3d
+nodvd
 nosound
+notv
 seccomp
 shell none
 tracelog
diff --git a/etc/cryptocat.profile b/etc/cryptocat.profile
index 021ce32d4..04301ffbd 100644
--- a/etc/cryptocat.profile
+++ b/etc/cryptocat.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/Cryptocat.profile
diff --git a/etc/curl.profile b/etc/curl.profile
index 34874d270..af7eabf59 100644
--- a/etc/curl.profile
+++ b/etc/curl.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/cvlc.profile b/etc/cvlc.profile
index 460966321..ee1346617 100644
--- a/etc/cvlc.profile
+++ b/etc/cvlc.profile
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/cyberfox.profile b/etc/cyberfox.profile
index 3c18ef002..63f6ea845 100644
--- a/etc/cyberfox.profile
+++ b/etc/cyberfox.profile
@@ -52,9 +52,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/darktable.profile b/etc/darktable.profile
index 47d4710ad..e04163486 100644
--- a/etc/darktable.profile
+++ b/etc/darktable.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/deadbeef.profile b/etc/deadbeef.profile
index 905920d42..3367aa8f4 100644
--- a/etc/deadbeef.profile
+++ b/etc/deadbeef.profile
@@ -18,6 +18,7 @@ no3d
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/default.profile b/etc/default.profile
index 693f89ad3..82eded802 100644
--- a/etc/default.profile
+++ b/etc/default.profile
@@ -16,10 +16,13 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 # ipc-namespace
 netfilter
+# no3d
+# nodvd
 # nogroups
 nonewprivs
 noroot
 # nosound
+# notv
 # novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/deluge.profile b/etc/deluge.profile
index bb45c4371..c311d2fa7 100644
--- a/etc/deluge.profile
+++ b/etc/deluge.profile
@@ -19,9 +19,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/dex2jar.profile b/etc/dex2jar.profile
index 5e971a5d4..5261bb865 100644
--- a/etc/dex2jar.profile
+++ b/etc/dex2jar.profile
@@ -15,15 +15,18 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
 shell none
 
+private-bin dex2jar,java,sh,bash,expr,dirname,ls,uname,grep
 private-dev
 
 noexec ${HOME}
diff --git a/etc/dia.profile b/etc/dia.profile
index 2072314cb..a625ab36d 100644
--- a/etc/dia.profile
+++ b/etc/dia.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/digikam.profile b/etc/digikam.profile
index 35365984e..43191ec06 100644
--- a/etc/digikam.profile
+++ b/etc/digikam.profile
@@ -16,9 +16,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 # seccomp.keep fallocate,getrusage,openat,access,arch_prctl,bind,brk,chdir,chmod,clock_getres,clone,close,connect,dup2,dup3,eventfd2,execve,fadvise64,fcntl,fdatasync,flock,fstat,fstatfs,ftruncate,futex,getcwd,getdents,getegid,geteuid,getgid,getpeername,getpgrp,getpid,getppid,getrandom,getresgid,getresuid,getrlimit,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,ioctl,lseek,lstat,madvise,mbind,memfd_create,mkdir,mmap,mprotect,msync,munmap,nanosleep,open,pipe,pipe2,poll,ppoll,prctl,pread64,pwrite64,read,readlink,readlinkat,recvfrom,recvmsg,rename,rt_sigaction,rt_sigprocmask,rt_sigreturn,sched_getaffinity,sched_getparam,sched_get_priority_max,sched_get_priority_min,sched_getscheduler,sched_setscheduler,sched_yield,sendmsg,sendto,setgid,setresgid,setresuid,set_robust_list,setsid,setsockopt,set_tid_address,setuid,shmat,shmctl,shmdt,shmget,shutdown,socket,stat,statfs,sysinfo,timerfd_create,umask,uname,unlink,wait4,waitid,write,writev,fchmod,fchown,unshare,exit,exit_group
diff --git a/etc/dillo.profile b/etc/dillo.profile
index 4601be8dc..aa8a395e1 100644
--- a/etc/dillo.profile
+++ b/etc/dillo.profile
@@ -21,8 +21,10 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 tracelog
diff --git a/etc/dino.profile b/etc/dino.profile
index 0501cd408..72f4f40b2 100644
--- a/etc/dino.profile
+++ b/etc/dino.profile
@@ -20,10 +20,12 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index f23a03876..3606d6308 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -3,102 +3,102 @@
 include /etc/firejail/disable-common.local
 
 # History files in $HOME
-blacklist-nolog ${HOME}/.history
 blacklist-nolog ${HOME}/.*_history
+blacklist-nolog ${HOME}/.adobe
 blacklist-nolog ${HOME}/.bash_history
+blacklist-nolog ${HOME}/.history
 blacklist-nolog ${HOME}/.local/share/fish/fish_history
-blacklist-nolog ${HOME}/.adobe
 blacklist-nolog ${HOME}/.macromedia
 
 # X11 session autostart
-blacklist ${HOME}/.xinitrc
-blacklist ${HOME}/.xserverrc
-blacklist /etc/X11/Xsession.d
+# blacklist ${HOME}/.xpra - this will kill --x11=xpra cmdline option for all programs
 blacklist ${HOME}/.Xsession
-blacklist ${HOME}/.xsession
-blacklist ${HOME}/.xsessionrc
-blacklist ${HOME}/.xprofile
-blacklist ${HOME}/.gnomerc
-blacklist /etc/xdg/autostart
 blacklist ${HOME}/.config/autostart
-blacklist ${HOME}/.local/share/autostart
-blacklist ${HOME}/.kde4/share/config/startupconfig
-blacklist ${HOME}/.kde4/env
-blacklist ${HOME}/.kde4/Autostart
-blacklist ${HOME}/.kde4/share/autostart
-blacklist ${HOME}/.kde4/shutdown
-blacklist ${HOME}/.kde/share/config/startupconfig
-blacklist ${HOME}/.kde/env
-blacklist ${HOME}/.kde/Autostart
-blacklist ${HOME}/.kde/share/autostart
-blacklist ${HOME}/.kde/shutdown
-blacklist ${HOME}/.config/startupconfig
 blacklist ${HOME}/.config/autostart-scripts
-blacklist ${HOME}/.config/plasma-workspace/env
-blacklist ${HOME}/.config/plasma-workspace/shutdown
 blacklist ${HOME}/.config/lxsession/LXDE/autostart
 blacklist ${HOME}/.config/openbox/autostart
 blacklist ${HOME}/.config/openbox/environment
+blacklist ${HOME}/.config/plasma-workspace/env
+blacklist ${HOME}/.config/plasma-workspace/shutdown
+blacklist ${HOME}/.config/startupconfig
 blacklist ${HOME}/.fluxbox/startup
-# blacklist ${HOME}/.xpra - this will kill --x11=xpra cmdline option for all programs
+blacklist ${HOME}/.gnomerc
+blacklist ${HOME}/.kde/Autostart
+blacklist ${HOME}/.kde/env
+blacklist ${HOME}/.kde/share/autostart
+blacklist ${HOME}/.kde/share/config/startupconfig
+blacklist ${HOME}/.kde/shutdown
+blacklist ${HOME}/.kde4/env
+blacklist ${HOME}/.kde4/Autostart
+blacklist ${HOME}/.kde4/share/autostart
+blacklist ${HOME}/.kde4/shutdown
+blacklist ${HOME}/.kde4/share/config/startupconfig
+blacklist ${HOME}/.local/share/autostart
+blacklist ${HOME}/.xinitrc
+blacklist ${HOME}/.xprofile
+blacklist ${HOME}/.xserverrc
+blacklist ${HOME}/.xsession
+blacklist ${HOME}/.xsessionrc
+blacklist /etc/X11/Xsession.d
+blacklist /etc/xdg/autostart
 
 # KDE config
-blacklist ${HOME}/.kde4/share/apps/konsole
-blacklist ${HOME}/.kde4/share/apps/kwin
-blacklist ${HOME}/.kde4/share/apps/plasma
-blacklist ${HOME}/.kde4/share/apps/solid
-blacklist ${HOME}/.kde4/share/config/*.notifyrc
-read-only ${HOME}/.kde4/share/config/kdeglobals
-blacklist ${HOME}/.kde4/share/config/khotkeysrc
-blacklist ${HOME}/.kde4/share/config/krunnerrc
-blacklist ${HOME}/.kde4/share/config/plasma-desktop-appletsrc
-read-only ${HOME}/.kde4/share/kde4/services
+blacklist ${HOME}/.config/*.notifyrc
+blacklist ${HOME}/.config/khotkeysrc
+blacklist ${HOME}/.config/krunnerrc
+blacklist ${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc
 blacklist ${HOME}/.kde/share/apps/konsole
 blacklist ${HOME}/.kde/share/apps/kwin
 blacklist ${HOME}/.kde/share/apps/plasma
 blacklist ${HOME}/.kde/share/apps/solid
 blacklist ${HOME}/.kde/share/config/*.notifyrc
-read-only ${HOME}/.kde/share/config/kdeglobals
 blacklist ${HOME}/.kde/share/config/khotkeysrc
 blacklist ${HOME}/.kde/share/config/krunnerrc
 blacklist ${HOME}/.kde/share/config/plasma-desktop-appletsrc
-read-only ${HOME}/.kde/share/kde4/services
-blacklist ${HOME}/.config/*.notifyrc
-read-only ${HOME}/.config/kdeglobals
-blacklist ${HOME}/.config/khotkeysrc
-blacklist ${HOME}/.config/krunnerrc
-blacklist ${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc
+blacklist ${HOME}/.kde4/share/apps/plasma
+blacklist ${HOME}/.kde4/share/apps/konsole
+blacklist ${HOME}/.kde4/share/apps/kwin
+blacklist ${HOME}/.kde4/share/config/krunnerrc
+blacklist ${HOME}/.kde4/share/config/plasma-desktop-appletsrc
+blacklist ${HOME}/.kde4/share/config/khotkeysrc
+blacklist ${HOME}/.kde4/share/apps/solid
+blacklist ${HOME}/.kde4/share/config/*.notifyrc
 blacklist ${HOME}/.local/share/kglobalaccel
 blacklist ${HOME}/.local/share/konsole
-read-only ${HOME}/.local/share/kservices5
 blacklist ${HOME}/.local/share/kwin
 blacklist ${HOME}/.local/share/plasma
 blacklist ${HOME}/.local/share/solid
+read-only ${HOME}/.config/kdeglobals
+read-only ${HOME}/.kde/share/config/kdeglobals
+read-only ${HOME}/.kde/share/kde4/services
+read-only ${HOME}/.kde4/share/kde4/services
+read-only ${HOME}/.kde4/share/config/kdeglobals
+read-only ${HOME}/.local/share/kservices5
 
 # systemd
-blacklist ${HOME}/.local/share/systemd
 blacklist ${HOME}/.config/systemd
+blacklist ${HOME}/.local/share/systemd
 
 # VirtualBox
 blacklist ${HOME}/.VirtualBox
-blacklist ${HOME}/VirtualBox VMs
 blacklist ${HOME}/.config/VirtualBox
+blacklist ${HOME}/VirtualBox VMs
 
 # VeraCrypt
+blacklist ${HOME}/.VeraCrypt
 blacklist ${PATH}/veracrypt
 blacklist ${PATH}/veracrypt-uninstall.sh
-blacklist /usr/share/veracrypt
 blacklist /usr/share/applications/veracrypt.*
 blacklist /usr/share/pixmaps/veracrypt.*
-blacklist ${HOME}/.VeraCrypt
+blacklist /usr/share/veracrypt
 
 # TrueCrypt
+blacklist ${HOME}/.TrueCrypt
 blacklist ${PATH}/truecrypt
 blacklist ${PATH}/truecrypt-uninstall.sh
-blacklist /usr/share/truecrypt
 blacklist /usr/share/applications/truecrypt.*
 blacklist /usr/share/pixmaps/truecrypt.*
-blacklist ${HOME}/.TrueCrypt
+blacklist /usr/share/truecrypt
 
 # zuluCrypt
 blacklist ${HOME}/.zuluCrypt
@@ -107,82 +107,82 @@ blacklist ${PATH}/zuluCrypt-cli
 blacklist ${PATH}/zuluMount-cli
 
 # var
-blacklist /var/spool/cron
-blacklist /var/spool/anacron
+blacklist /var/lib/mysql/mysql.sock
+blacklist /var/lib/mysqld/mysql.sock
 blacklist /var/mail
 blacklist /var/run/acpid.socket
+blacklist /var/run/docker.sock
 blacklist /var/run/minissdpd.sock
-blacklist /var/run/rpcbind.sock
-blacklist /var/run/mysqld/mysqld.sock
 blacklist /var/run/mysql/mysqld.sock
-blacklist /var/lib/mysqld/mysql.sock
-blacklist /var/lib/mysql/mysql.sock
-blacklist /var/run/docker.sock
+blacklist /var/run/mysqld/mysqld.sock
+blacklist /var/run/rpcbind.sock
+blacklist /var/spool/anacron
+blacklist /var/spool/cron
 
 # etc
+blacklist /etc/anacrontab
 blacklist /etc/cron*
 blacklist /etc/profile.d
 blacklist /etc/rc.local
-blacklist /etc/anacrontab
 
 # Startup files
 read-only ${HOME}/.antigen
-read-only ${HOME}/.bash_login
-read-only ${HOME}/.bashrc
 read-only ${HOME}/.bash_aliases
-read-only ${HOME}/.bash_profile
+read-only ${HOME}/.bash_login
 read-only ${HOME}/.bash_logout
-read-only ${HOME}/.zsh.d
-read-only ${HOME}/.zshenv
-read-only ${HOME}/.zshrc
-read-only ${HOME}/.zshrc.local
-read-only ${HOME}/.zlogin
-read-only ${HOME}/.zprofile
-read-only ${HOME}/.zlogout
-read-only ${HOME}/.zsh_files
-read-only ${HOME}/.tcshrc
-read-only ${HOME}/.cshrc
-read-only ${HOME}/.csh_files
+read-only ${HOME}/.bash_profile
+read-only ${HOME}/.bashrc
 read-only ${HOME}/.config/fish
-read-only ${HOME}/.local/share/fish
-read-only ${HOME}/.profile
+read-only ${HOME}/.csh_files
+read-only ${HOME}/.cshrc
 read-only ${HOME}/.forward
+read-only ${HOME}/.local/share/fish
 read-only ${HOME}/.login
 read-only ${HOME}/.logout
+read-only ${HOME}/.pam_environment
 read-only ${HOME}/.pgpkey
 read-only ${HOME}/.plan
+read-only ${HOME}/.profile
 read-only ${HOME}/.project
-read-only ${HOME}/.pam_environment
+read-only ${HOME}/.tcshrc
+read-only ${HOME}/.zlogin
+read-only ${HOME}/.zlogout
+read-only ${HOME}/.zprofile
+read-only ${HOME}/.zsh.d
+read-only ${HOME}/.zsh_files
+read-only ${HOME}/.zshenv
+read-only ${HOME}/.zshrc
+read-only ${HOME}/.zshrc.local
 
 # Initialization files that allow arbitrary command execution
 read-only ${HOME}/.caffrc
 read-only ${HOME}/.dotfiles
-read-only ${HOME}/dotfiles
-read-only ${HOME}/.mailcap
-read-only ${HOME}/.muttrc
-read-only ${HOME}/.mutt/muttrc
-read-only ${HOME}/.msmtprc
-read-only ${HOME}/.exrc
-read-only ${HOME}/_exrc
-read-only ${HOME}/.vimrc
-read-only ${HOME}/_vimrc
-read-only ${HOME}/.gvimrc
-read-only ${HOME}/_gvimrc
-read-only ${HOME}/.vim
 read-only ${HOME}/.emacs
 read-only ${HOME}/.emacs.d
-read-only ${HOME}/.nano
-read-only ${HOME}/.tmux.conf
+read-only ${HOME}/.exrc
+read-only ${HOME}/.gvimrc
 read-only ${HOME}/.iscreenrc
+read-only ${HOME}/.mailcap
+read-only ${HOME}/.msmtprc
+read-only ${HOME}/.mutt/muttrc
+read-only ${HOME}/.muttrc
+read-only ${HOME}/.nano
 read-only ${HOME}/.reportbugrc
+read-only ${HOME}/.tmux.conf
+read-only ${HOME}/.vim
+read-only ${HOME}/.vimrc
 read-only ${HOME}/.xmonad
 read-only ${HOME}/.xscreensaver
+read-only ${HOME}/_exrc
+read-only ${HOME}/_gvimrc
+read-only ${HOME}/_vimrc
+read-only ${HOME}/dotfiles
 
 # Make directories commonly found in $PATH read-only
-read-only ${HOME}/bin
 read-only ${HOME}/.gem
 read-only ${HOME}/.luarocks
 read-only ${HOME}/.npm-packages
+read-only ${HOME}/bin
 
 # The following block breaks trash functionality in file managers
 #read-only  ${HOME}/.local
@@ -194,75 +194,75 @@ blacklist   ${HOME}/.local/share/Trash
 read-only ${HOME}/.local/share/applications
 
 # top secret
-blacklist ${HOME}/.ecryptfs
+blacklist ${HOME}/*.kdb
+blacklist ${HOME}/*.kdbx
+blacklist ${HOME}/*.key
 blacklist ${HOME}/.Private
-blacklist ${HOME}/.ssh
+blacklist ${HOME}/.caff
 blacklist ${HOME}/.cert
+blacklist ${HOME}/.config/keybase
+blacklist ${HOME}/.ecryptfs
 blacklist ${HOME}/.gnome2/keyrings
-blacklist ${HOME}/.local/share/keyrings
-blacklist ${HOME}/.kde4/share/apps/kwallet
+blacklist ${HOME}/.gnupg
 blacklist ${HOME}/.kde/share/apps/kwallet
+blacklist ${HOME}/.kde4/share/apps/kwallet
+blacklist ${HOME}/.local/share/keyrings
 blacklist ${HOME}/.local/share/kwalletd
-blacklist ${HOME}/.config/keybase
-blacklist ${HOME}/.netrc
-blacklist ${HOME}/.gnupg
-blacklist ${HOME}/.caff
-blacklist ${HOME}/.smbcredentials
-blacklist ${HOME}/*.kdbx
-blacklist ${HOME}/*.kdb
-blacklist ${HOME}/*.key
-blacklist ${HOME}/.muttrc
-blacklist ${HOME}/.mutt/muttrc
 blacklist ${HOME}/.msmtprc
+blacklist ${HOME}/.mutt/muttrc
+blacklist ${HOME}/.muttrc
+blacklist ${HOME}/.netrc
 blacklist ${HOME}/.pki
-blacklist /etc/shadow
-blacklist /etc/gshadow
-blacklist /etc/passwd-
+blacklist ${HOME}/.smbcredentials
+blacklist ${HOME}/.ssh
+blacklist /etc/group+
 blacklist /etc/group-
-blacklist /etc/shadow-
+blacklist /etc/gshadow
+blacklist /etc/gshadow+
 blacklist /etc/gshadow-
 blacklist /etc/passwd+
-blacklist /etc/group+
+blacklist /etc/passwd-
+blacklist /etc/shadow
 blacklist /etc/shadow+
-blacklist /etc/gshadow+
+blacklist /etc/shadow-
 blacklist /etc/ssh
-blacklist /var/backup
 blacklist /home/.ecryptfs
+blacklist /var/backup
 
 # system directories
 blacklist /sbin
-blacklist /usr/sbin
 blacklist /usr/local/sbin
+blacklist /usr/sbin
 
 # system management
-blacklist ${PATH}/umount
-blacklist ${PATH}/mount
-blacklist ${PATH}/fusermount
-blacklist ${PATH}/ntfs-3g
 blacklist ${PATH}/at
-blacklist ${PATH}/su
-blacklist ${PATH}/sudo
-blacklist ${PATH}/xinput
+blacklist ${PATH}/chage
+blacklist ${PATH}/chfn
+blacklist ${PATH}/chsh
+blacklist ${PATH}/crontab
 blacklist ${PATH}/evtest
-blacklist ${PATH}/xev
-blacklist ${PATH}/strace
+blacklist ${PATH}/expiry
+blacklist ${PATH}/fusermount
+blacklist ${PATH}/gpasswd
+blacklist ${PATH}/ksu
+blacklist ${PATH}/mount
+blacklist ${PATH}/mount.ecryptfs_private
 blacklist ${PATH}/nc
 blacklist ${PATH}/ncat
-blacklist ${PATH}/gpasswd
 blacklist ${PATH}/newgidmap
 blacklist ${PATH}/newgrp
 blacklist ${PATH}/newuidmap
+blacklist ${PATH}/ntfs-3g
 blacklist ${PATH}/pkexec
+blacklist ${PATH}/procmail
 blacklist ${PATH}/sg
-blacklist ${PATH}/crontab
-blacklist ${PATH}/ksu
-blacklist ${PATH}/chsh
-blacklist ${PATH}/chfn
-blacklist ${PATH}/chage
-blacklist ${PATH}/expiry
+blacklist ${PATH}/strace
+blacklist ${PATH}/su
+blacklist ${PATH}/sudo
+blacklist ${PATH}/umount
 blacklist ${PATH}/unix_chkpwd
-blacklist ${PATH}/procmail
-blacklist ${PATH}/mount.ecryptfs_private
+blacklist ${PATH}/xev
+blacklist ${PATH}/xinput
 
 # other SUID binaries
 blacklist /usr/lib/virtualbox
@@ -276,11 +276,9 @@ blacklist /tmp/tmux-*
 # disable terminals running as server resulting in sandbox escape
 blacklist ${PATH}/gnome-terminal
 blacklist ${PATH}/gnome-terminal.wrapper
-blacklist ${PATH}/xfce4-terminal
-blacklist ${PATH}/xfce4-terminal.wrapper
+blacklist ${PATH}/lilyterm
 blacklist ${PATH}/mate-terminal
 blacklist ${PATH}/mate-terminal.wrapper
-blacklist ${PATH}/lilyterm
 blacklist ${PATH}/pantheon-terminal
 blacklist ${PATH}/roxterm
 blacklist ${PATH}/roxterm-config
@@ -288,12 +286,14 @@ blacklist ${PATH}/terminix
 blacklist ${PATH}/tilix
 blacklist ${PATH}/urxvtc
 blacklist ${PATH}/urxvtcd
-# konsole doesn't seem to have this problem - last tested on Ubuntu 16.04
+blacklist ${PATH}/xfce4-terminal
+blacklist ${PATH}/xfce4-terminal.wrapper
 # blacklist ${PATH}/konsole
+# konsole doesn't seem to have this problem - last tested on Ubuntu 16.04
 
 # kernel files
-blacklist /vmlinuz*
 blacklist /initrd*
+blacklist /vmlinuz*
 
 # complement noexec ${HOME} and noexec /tmp
 noexec ${HOME}/.config/pulse
diff --git a/etc/disable-devel.inc b/etc/disable-devel.inc
index a546847f7..9ff58ae2a 100644
--- a/etc/disable-devel.inc
+++ b/etc/disable-devel.inc
@@ -1,30 +1,30 @@
-# This file is overwritten during software install. 
+# This file is overwritten during software install.
 # Persistent customizations should go in a .local file.
 include /etc/firejail/disable-devel.local
 
 # development tools
 
 # GCC
-blacklist /usr/include
 #blacklist /usr/lib/gcc - seems to create problems on Gentoo
-blacklist /usr/bin/gcc*
-blacklist /usr/bin/cpp*
-blacklist /usr/bin/c9*
-blacklist /usr/bin/c8*
-blacklist /usr/bin/c++*
 blacklist /usr/bin/as
-blacklist /usr/bin/ld
-blacklist /usr/bin/gdb
+blacklist /usr/bin/c++*
+blacklist /usr/bin/c8*
+blacklist /usr/bin/c9*
+blacklist /usr/bin/cpp*
 blacklist /usr/bin/g++*
+blacklist /usr/bin/gcc*
+blacklist /usr/bin/gdb
+blacklist /usr/bin/ld
+blacklist /usr/bin/x86_64-unknown-linux-gnu-gcc*
 blacklist /usr/bin/x86_64-linux-gnu-g++*
 blacklist /usr/bin/x86_64-linux-gnu-gcc*
 blacklist /usr/bin/x86_64-unknown-linux-gnu-g++*
-blacklist /usr/bin/x86_64-unknown-linux-gnu-gcc*
+blacklist /usr/include
 
 # clang/llvm
 blacklist /usr/bin/clang*
-blacklist /usr/bin/llvm*
 blacklist /usr/bin/lldb*
+blacklist /usr/bin/llvm*
 blacklist /usr/lib/llvm*
 
 # tcc - Tiny C Compiler
@@ -37,15 +37,15 @@ blacklist /usr/bin/valgrind*
 blacklist /usr/lib/valgrind
 
 # Perl
-blacklist /usr/bin/perl
 blacklist /usr/bin/cpan*
-blacklist /usr/share/perl*
+blacklist /usr/bin/perl
 blacklist /usr/lib/perl*
+blacklist /usr/share/perl*
 
 # PHP
 blacklist /usr/bin/php*
-blacklist /usr/share/php*
 blacklist /usr/lib/php*
+blacklist /usr/share/php*
 
 # Ruby
 blacklist /usr/bin/ruby
@@ -54,22 +54,22 @@ blacklist /usr/lib/ruby
 # Programs using python: deluge, firefox addons, filezilla, cherrytree, xchat, hexchat, libreoffice, scribus
 # Python 2
 #blacklist /usr/bin/python2*
+#blacklist /usr/include/python2*
 #blacklist /usr/lib/python2*
 #blacklist /usr/local/lib/python2*
-#blacklist /usr/include/python2*
 #blacklist /usr/share/python2*
 #
 # Python 3
 #blacklist /usr/bin/python3*
+#blacklist /usr/include/python3*
 #blacklist /usr/lib/python3*
 #blacklist /usr/local/lib/python3*
 #blacklist /usr/share/python3*
-#blacklist /usr/include/python3*
 
 #Go
+blacklist /usr/bin/gccgo
 blacklist /usr/bin/go
 blacklist /usr/bin/gofmt
-blacklist /usr/bin/gccgo
 
 #Rust
 blacklist /usr/bin/rust-gdb
diff --git a/etc/disable-passwdmgr.inc b/etc/disable-passwdmgr.inc
index ae485c4c5..9507d3feb 100644
--- a/etc/disable-passwdmgr.inc
+++ b/etc/disable-passwdmgr.inc
@@ -1,9 +1,7 @@
-# This file is overwritten during software install. 
+# This file is overwritten during software install.
 # Persistent customizations should go in a .local file.
 include /etc/firejail/disable-passwdmgr.local
 
-blacklist ${HOME}/.local/share/KeePass
-blacklist ${HOME}/.local/share/keepass
 blacklist ${HOME}/.config/KeePass
 blacklist ${HOME}/.config/keepass
 blacklist ${HOME}/.config/keepassx
@@ -12,4 +10,6 @@ blacklist ${HOME}/.keepass
 blacklist ${HOME}/.keepassx
 blacklist ${HOME}/.keepassxc
 blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.local/share/KeePass
+blacklist ${HOME}/.local/share/keepass
 blacklist ${HOME}/.password-store
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index c67a0b378..a54d2a739 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -7,6 +7,7 @@ blacklist ${HOME}/.8pecxstudios
 blacklist ${HOME}/.AndroidStudio*
 blacklist ${HOME}/.Atom
 blacklist ${HOME}/.FBReader
+blacklist ${HOME}/.FontForge
 blacklist ${HOME}/.IdeaIC*
 blacklist ${HOME}/.LuminanceHDR
 blacklist ${HOME}/.Mathematica
@@ -28,10 +29,10 @@ blacklist ${HOME}/.bibletime
 blacklist ${HOME}/.claws-mail
 blacklist ${HOME}/.config/0ad
 blacklist ${HOME}/.config/2048-qt
-blacklist ${HOME}/.config/akregatorrc
 blacklist ${HOME}/.config/Atom
 blacklist ${HOME}/.config/Audaciousrc
 blacklist ${HOME}/.config/Brackets
+blacklist ${HOME}/.config/Clementine
 blacklist ${HOME}/.config/Cryptocat
 blacklist ${HOME}/.config/Franz
 blacklist ${HOME}/.config/Gitter
@@ -52,6 +53,7 @@ blacklist ${HOME}/.config/Slack
 blacklist ${HOME}/.config/Thunar
 blacklist ${HOME}/.config/VirtualBox
 blacklist ${HOME}/.config/Wire
+blacklist ${HOME}/.config/akregatorrc
 blacklist ${HOME}/.config/ardour4
 blacklist ${HOME}/.config/ardour5
 blacklist ${HOME}/.config/arkrc
@@ -90,8 +92,8 @@ blacklist ${HOME}/.config/flowblade
 blacklist ${HOME}/.config/gajim
 blacklist ${HOME}/.config/galculator
 blacklist ${HOME}/.config/geany
-blacklist ${HOME}/.config/geeqie
 blacklist ${HOME}/.config/gedit
+blacklist ${HOME}/.config/geeqie
 blacklist ${HOME}/.config/ghb
 blacklist ${HOME}/.config/globaltime
 blacklist ${HOME}/.config/google-chrome
@@ -115,9 +117,9 @@ blacklist ${HOME}/.config/ktorrentrc
 blacklist ${HOME}/.config/leafpad
 blacklist ${HOME}/.config/libreoffice
 blacklist ${HOME}/.config/lximage-qt
+blacklist ${HOME}/.config/mate-calc
 blacklist ${HOME}/.config/mate/eom
 blacklist ${HOME}/.config/mate/mate-dictionary
-blacklist ${HOME}/.config/mate-calc
 blacklist ${HOME}/.config/midori
 blacklist ${HOME}/.config/mpv
 blacklist ${HOME}/.config/mupen64plus
@@ -134,7 +136,6 @@ blacklist ${HOME}/.config/pcmanfm
 blacklist ${HOME}/.config/pix
 blacklist ${HOME}/.config/pluma
 blacklist ${HOME}/.config/psi+
-blacklist ${HOME}/.config/ristretto
 blacklist ${HOME}/.config/qBittorrent
 blacklist ${HOME}/.config/qBittorrentrc
 blacklist ${HOME}/.config/qpdfview
@@ -143,6 +144,7 @@ blacklist ${HOME}/.config/qupzilla
 blacklist ${HOME}/.config/qutebrowser
 blacklist ${HOME}/.config/ranger
 blacklist ${HOME}/.config/redshift.conf
+blacklist ${HOME}/.config/ristretto
 blacklist ${HOME}/.config/scribus
 blacklist ${HOME}/.config/skypeforlinux
 blacklist ${HOME}/.config/slimjet
@@ -165,9 +167,9 @@ blacklist ${HOME}/.config/wireshark
 blacklist ${HOME}/.config/xchat
 blacklist ${HOME}/.config/xed
 blacklist ${HOME}/.config/xfburn
-blacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml
-blacklist ${HOME}/.config/xfce4/xfce4-notes.rc
 blacklist ${HOME}/.config/xfce4/xfce4-notes.gtkrc
+blacklist ${HOME}/.config/xfce4/xfce4-notes.rc
+blacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml
 blacklist ${HOME}/.config/xfce4-dict
 blacklist ${HOME}/.config/xiaoyong
 blacklist ${HOME}/.config/xmms2
@@ -185,13 +187,12 @@ blacklist ${HOME}/.dropbox-dist
 blacklist ${HOME}/.electrum*
 blacklist ${HOME}/.elinks
 blacklist ${HOME}/.emacs
-blacklist ${HOME}/.emacs.d
-blacklist ${HOME}/.filezilla
 blacklist ${HOME}/.emacs
+blacklist ${HOME}/.emacs.d
 blacklist ${HOME}/.etr
+blacklist ${HOME}/.filezilla
 blacklist ${HOME}/.flowblade
 blacklist ${HOME}/.fltk
-blacklist ${HOME}/.FontForge
 blacklist ${HOME}/.frozen-bubble
 blacklist ${HOME}/.gimp*
 blacklist ${HOME}/.git-credential-cache
@@ -208,25 +209,6 @@ blacklist ${HOME}/.icedove
 blacklist ${HOME}/.inkscape
 blacklist ${HOME}/.java
 blacklist ${HOME}/.jitsi
-blacklist ${HOME}/.kde4/share/apps/gwenview
-blacklist ${HOME}/.kde4/share/apps/kcookiejar
-blacklist ${HOME}/.kde4/share/apps/khtml
-blacklist ${HOME}/.kde4/share/apps/konqsidebartng
-blacklist ${HOME}/.kde4/share/apps/konqueror
-blacklist ${HOME}/.kde4/share/apps/okular
-blacklist ${HOME}/.kde4/share/config/baloofilerc
-blacklist ${HOME}/.kde4/share/config/baloorc
-blacklist ${HOME}/.kde4/share/config/gwenviewrc
-blacklist ${HOME}/.kde4/share/config/digikam
-blacklist ${HOME}/.kde4/share/config/k3brc
-blacklist ${HOME}/.kde4/share/config/kcookiejarrc
-blacklist ${HOME}/.kde4/share/config/khtmlrc
-blacklist ${HOME}/.kde4/share/config/konq_history
-blacklist ${HOME}/.kde4/share/config/konqsidebartngrc
-blacklist ${HOME}/.kde4/share/config/konquerorrc
-blacklist ${HOME}/.kde4/share/config/okularpartrc
-blacklist ${HOME}/.kde4/share/config/okularrc
-blacklist ${HOME}/.kde4/share/config/ktorrentrc
 blacklist ${HOME}/.kde/share/apps/gwenview
 blacklist ${HOME}/.kde/share/apps/kcookiejar
 blacklist ${HOME}/.kde/share/apps/khtml
@@ -243,9 +225,28 @@ blacklist ${HOME}/.kde/share/config/khtmlrc
 blacklist ${HOME}/.kde/share/config/konq_history
 blacklist ${HOME}/.kde/share/config/konqsidebartngrc
 blacklist ${HOME}/.kde/share/config/konquerorrc
+blacklist ${HOME}/.kde/share/config/ktorrentrc
 blacklist ${HOME}/.kde/share/config/okularpartrc
 blacklist ${HOME}/.kde/share/config/okularrc
-blacklist ${HOME}/.kde/share/config/ktorrentrc
+blacklist ${HOME}/.kde4/share/config/baloorc
+blacklist ${HOME}/.kde4/share/config/baloofilerc
+blacklist ${HOME}/.kde4/share/apps/okular
+blacklist ${HOME}/.kde4/share/apps/konqueror
+blacklist ${HOME}/.kde4/share/apps/konqsidebartng
+blacklist ${HOME}/.kde4/share/apps/khtml
+blacklist ${HOME}/.kde4/share/apps/kcookiejar
+blacklist ${HOME}/.kde4/share/config/digikam
+blacklist ${HOME}/.kde4/share/apps/gwenview
+blacklist ${HOME}/.kde4/share/config/kcookiejarrc
+blacklist ${HOME}/.kde4/share/config/khtmlrc
+blacklist ${HOME}/.kde4/share/config/konq_history
+blacklist ${HOME}/.kde4/share/config/konqsidebartngrc
+blacklist ${HOME}/.kde4/share/config/konquerorrc
+blacklist ${HOME}/.kde4/share/config/okularpartrc
+blacklist ${HOME}/.kde4/share/config/okularrc
+blacklist ${HOME}/.kde4/share/config/ktorrentrc
+blacklist ${HOME}/.kde4/share/config/gwenviewrc
+blacklist ${HOME}/.kde4/share/config/k3brc
 blacklist ${HOME}/.killingfloor
 blacklist ${HOME}/.kino-history
 blacklist ${HOME}/.kinorc
@@ -257,7 +258,6 @@ blacklist ${HOME}/.local/.share/maps-places.json
 blacklist ${HOME}/.local/lib/python2.7/site-packages
 blacklist ${HOME}/.local/share/0ad
 blacklist ${HOME}/.local/share/3909/PapersPlease
-blacklist ${HOME}/.local/share/akregator
 blacklist ${HOME}/.local/share/Empathy
 blacklist ${HOME}/.local/share/JetBrains
 blacklist ${HOME}/.local/share/Mumble
@@ -267,6 +267,7 @@ blacklist ${HOME}/.local/share/Steam
 blacklist ${HOME}/.local/share/SuperHexagon
 blacklist ${HOME}/.local/share/Terraria
 blacklist ${HOME}/.local/share/TpLogger
+blacklist ${HOME}/.local/share/akregator
 blacklist ${HOME}/.local/share/aspyr-media
 blacklist ${HOME}/.local/share/baloo
 blacklist ${HOME}/.local/share/caja-python
@@ -287,8 +288,8 @@ blacklist ${HOME}/.local/share/gnome-music
 blacklist ${HOME}/.local/share/gnome-photos
 blacklist ${HOME}/.local/share/gwenview
 blacklist ${HOME}/.local/share/kate
-blacklist ${HOME}/.local/share/kwrite
 blacklist ${HOME}/.local/share/ktorrentrc
+blacklist ${HOME}/.local/share/kwrite
 blacklist ${HOME}/.local/share/lollypop
 blacklist ${HOME}/.local/share/meld
 blacklist ${HOME}/.local/share/multimc5
@@ -297,6 +298,7 @@ blacklist ${HOME}/.local/share/nautilus
 blacklist ${HOME}/.local/share/nautilus-python
 blacklist ${HOME}/.local/share/nemo
 blacklist ${HOME}/.local/share/nemo-python
+blacklist ${HOME}/.local/share/notes
 blacklist ${HOME}/.local/share/okular
 blacklist ${HOME}/.local/share/orage
 blacklist ${HOME}/.local/share/org.kde.gwenview
@@ -314,7 +316,6 @@ blacklist ${HOME}/.local/share/vpltd
 blacklist ${HOME}/.local/share/vulkan
 blacklist ${HOME}/.local/share/wesnoth
 blacklist ${HOME}/.local/share/xplayer
-blacklist ${HOME}/.local/share/notes
 blacklist ${HOME}/.local/share/xreader
 blacklist ${HOME}/.local/share/zathura
 blacklist ${HOME}/.lv2
@@ -356,6 +357,7 @@ blacklist ${HOME}/.tconn
 blacklist ${HOME}/.thunderbird
 blacklist ${HOME}/.tooling
 blacklist ${HOME}/.ts3client
+blacklist ${HOME}/.tuxguitar*
 blacklist ${HOME}/.unknow-horizons
 blacklist ${HOME}/.viking
 blacklist ${HOME}/.viking-maps
@@ -385,7 +387,6 @@ blacklist ${HOME}/.cache/borg
 blacklist ${HOME}/.cache/calibre
 blacklist ${HOME}/.cache/champlain
 blacklist ${HOME}/.cache/chromium
-blacklist ${HOME}/.cache/qupzilla
 blacklist ${HOME}/.cache/chromium-dev
 blacklist ${HOME}/.cache/darktable
 blacklist ${HOME}/.cache/epiphany
@@ -407,6 +408,7 @@ blacklist ${HOME}/.cache/opera-beta
 blacklist ${HOME}/.cache/org.gnome.Books
 blacklist ${HOME}/.cache/peek
 blacklist ${HOME}/.cache/qBittorrent
+blacklist ${HOME}/.cache/qupzilla
 blacklist ${HOME}/.cache/qutebrowser
 blacklist ${HOME}/.cache/simple-scan
 blacklist ${HOME}/.cache/slimjet
@@ -417,5 +419,5 @@ blacklist ${HOME}/.cache/torbrowser
 blacklist ${HOME}/.cache/transmission
 blacklist ${HOME}/.cache/vivaldi
 blacklist ${HOME}/.cache/wesnoth
-blacklist ${HOME}/.cache/xreader
 blacklist ${HOME}/.cache/xmms2
+blacklist ${HOME}/.cache/xreader
diff --git a/etc/display.profile b/etc/display.profile
index ff5d3d2b9..44d37d5b2 100644
--- a/etc/display.profile
+++ b/etc/display.profile
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/dnscrypt-proxy.profile b/etc/dnscrypt-proxy.profile
index 075b7ea15..d82efef04 100644
--- a/etc/dnscrypt-proxy.profile
+++ b/etc/dnscrypt-proxy.profile
@@ -14,7 +14,9 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 no3d
+nodvd
 nosound
+notv
 seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open
 
 private
diff --git a/etc/dnsmasq.profile b/etc/dnsmasq.profile
index 834805af9..bf52a5d8a 100644
--- a/etc/dnsmasq.profile
+++ b/etc/dnsmasq.profile
@@ -16,8 +16,10 @@ include /etc/firejail/disable-programs.inc
 caps
 netfilter
 no3d
+nodvd
 nonewprivs
 nosound
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 
diff --git a/etc/dolphin.profile b/etc/dolphin.profile
index 93acbd09e..7566e927b 100644
--- a/etc/dolphin.profile
+++ b/etc/dolphin.profile
@@ -14,18 +14,21 @@ noblacklist ~/.local/share/dolphin
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
+# dolphin needs to be able to start arbitrary applications so we cannot blacklist their files
 # include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
+novideo
 protocol unix
 seccomp
 shell none
 
-# dolphin needs to be able to start arbitrary applications so we cannot blacklist their files
 # private-bin
 # private-dev
 # private-etc
diff --git a/etc/dosbox.profile b/etc/dosbox.profile
index ff8e26bf9..bec2960f1 100644
--- a/etc/dosbox.profile
+++ b/etc/dosbox.profile
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/dragon.profile b/etc/dragon.profile
index e8d82363b..211c2432f 100644
--- a/etc/dragon.profile
+++ b/etc/dragon.profile
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/dropbox.profile b/etc/dropbox.profile
index 564a4054d..c8670357c 100644
--- a/etc/dropbox.profile
+++ b/etc/dropbox.profile
@@ -26,10 +26,12 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/ebook-viewer.profile b/etc/ebook-viewer.profile
index 1e8e7bb6c..11499aba0 100644
--- a/etc/ebook-viewer.profile
+++ b/etc/ebook-viewer.profile
@@ -4,4 +4,5 @@
 
 net none
 
+# Redirect
 include /etc/firejail/calibre.profile
diff --git a/etc/electron.profile b/etc/electron.profile
index 0377ac073..9b21c1bfd 100644
--- a/etc/electron.profile
+++ b/etc/electron.profile
@@ -12,8 +12,10 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
diff --git a/etc/elinks.profile b/etc/elinks.profile
index bd2c090a6..10fd19f71 100644
--- a/etc/elinks.profile
+++ b/etc/elinks.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/emacs.profile b/etc/emacs.profile
index db823c029..8351d6c42 100644
--- a/etc/emacs.profile
+++ b/etc/emacs.profile
@@ -14,8 +14,10 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/empathy.profile b/etc/empathy.profile
index 5eb8d6868..b2cfa369c 100644
--- a/etc/empathy.profile
+++ b/etc/empathy.profile
@@ -12,8 +12,10 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/enchant.profile b/etc/enchant.profile
index 5b0d190fa..a7b549a4c 100644
--- a/etc/enchant.profile
+++ b/etc/enchant.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/engrampa.profile b/etc/engrampa.profile
index b6d8e501f..e10fd6084 100644
--- a/etc/engrampa.profile
+++ b/etc/engrampa.profile
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/eog.profile b/etc/eog.profile
index 452bb1a36..54d5a1a88 100644
--- a/etc/eog.profile
+++ b/etc/eog.profile
@@ -18,10 +18,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/eom.profile b/etc/eom.profile
index 75a9e6764..6fd069b5c 100644
--- a/etc/eom.profile
+++ b/etc/eom.profile
@@ -16,10 +16,12 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/epiphany.profile b/etc/epiphany.profile
index 86fddace0..0f9a9cf55 100644
--- a/etc/epiphany.profile
+++ b/etc/epiphany.profile
@@ -24,6 +24,8 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
+notv
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/etr.profile b/etc/etr.profile
index dedc1e224..96e8b46d9 100644
--- a/etc/etr.profile
+++ b/etc/etr.profile
@@ -17,9 +17,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,netlink
 seccomp
 shell none
diff --git a/etc/evince.profile b/etc/evince.profile
index 1a2b04160..5c6215bb2 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/evolution.profile b/etc/evolution.profile
index d41ef965a..2f7f25ff8 100644
--- a/etc/evolution.profile
+++ b/etc/evolution.profile
@@ -23,10 +23,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/exiftool.profile b/etc/exiftool.profile
index 3637fc989..565212161 100644
--- a/etc/exiftool.profile
+++ b/etc/exiftool.profile
@@ -20,10 +20,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/fbreader.profile b/etc/fbreader.profile
index 663ee3bbb..19d45a1d8 100644
--- a/etc/fbreader.profile
+++ b/etc/fbreader.profile
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/feh.profile b/etc/feh.profile
index 1e0d7acc7..61b456e34 100644
--- a/etc/feh.profile
+++ b/etc/feh.profile
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/file-roller.profile b/etc/file-roller.profile
index 173bb344f..1ecb3c632 100644
--- a/etc/file-roller.profile
+++ b/etc/file-roller.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/file.profile b/etc/file.profile
index 99d2fd865..9a4dba7ef 100644
--- a/etc/file.profile
+++ b/etc/file.profile
@@ -16,9 +16,11 @@ caps.drop all
 hostname file
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/filezilla.profile b/etc/filezilla.profile
index c349a9e94..63bfd1e0d 100644
--- a/etc/filezilla.profile
+++ b/etc/filezilla.profile
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/firefox-esr.profile b/etc/firefox-esr.profile
index f3400b1e1..9821c7150 100644
--- a/etc/firefox-esr.profile
+++ b/etc/firefox-esr.profile
@@ -6,4 +6,5 @@ include /etc/firejail/firefox-esr.local
 include /etc/firejail/globals.local
 
 
+# Redirect
 include /etc/firejail/firefox.profile
diff --git a/etc/firefox-nightly.profile b/etc/firefox-nightly.profile
new file mode 100644
index 000000000..302f6eb24
--- /dev/null
+++ b/etc/firefox-nightly.profile
@@ -0,0 +1,10 @@
+# Firejail profile for firefox-nightly
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/firefox-nightly.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+# Redirect
+include /etc/firejail/firefox.profile
diff --git a/etc/firefox.profile b/etc/firefox.profile
index 27f436c4f..7229ba45b 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -52,9 +52,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/flashpeak-slimjet.profile b/etc/flashpeak-slimjet.profile
index be06dc460..18db4c597 100644
--- a/etc/flashpeak-slimjet.profile
+++ b/etc/flashpeak-slimjet.profile
@@ -15,8 +15,7 @@ noblacklist ~/.config/slimjet
 noblacklist ~/.pki
 
 include /etc/firejail/disable-common.inc
-# chromium is distributed with a perl script on Arch
-# include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 
 mkdir ~/.cache/slimjet
@@ -30,7 +29,9 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
diff --git a/etc/flowblade.profile b/etc/flowblade.profile
index b5cc8160b..79dab0751 100644
--- a/etc/flowblade.profile
+++ b/etc/flowblade.profile
@@ -15,9 +15,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/fontforge.profile b/etc/fontforge.profile
index 4b43602b8..29295f8a0 100644
--- a/etc/fontforge.profile
+++ b/etc/fontforge.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/fossamail.profile b/etc/fossamail.profile
index d49027917..74073d8d1 100644
--- a/etc/fossamail.profile
+++ b/etc/fossamail.profile
@@ -17,4 +17,7 @@ whitelist ~/.fossamail
 whitelist ~/.gnupg
 include /etc/firejail/whitelist-common.inc
 
+nodvd
+notv
+
 include /etc/firejail/firefox.profile
diff --git a/etc/franz.profile b/etc/franz.profile
index 82bdabfcd..f83b5018c 100644
--- a/etc/franz.profile
+++ b/etc/franz.profile
@@ -24,9 +24,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/frozen-bubble.profile b/etc/frozen-bubble.profile
index b1d9798bc..40aa6d58d 100644
--- a/etc/frozen-bubble.profile
+++ b/etc/frozen-bubble.profile
@@ -17,9 +17,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,netlink
 seccomp
 shell none
diff --git a/etc/gajim.profile b/etc/gajim.profile
index 451a93c31..f1929c015 100644
--- a/etc/gajim.profile
+++ b/etc/gajim.profile
@@ -28,9 +28,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/galculator.profile b/etc/galculator.profile
index 48ecccd59..a2e855656 100644
--- a/etc/galculator.profile
+++ b/etc/galculator.profile
@@ -18,10 +18,12 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/geany.profile b/etc/geany.profile
index 9ec334fc0..35e405319 100644
--- a/etc/geany.profile
+++ b/etc/geany.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/geary.profile b/etc/geary.profile
index 3f9faf058..7878154a6 100644
--- a/etc/geary.profile
+++ b/etc/geary.profile
@@ -13,7 +13,6 @@ noblacklist ~/.local/share/geary
 
 mkdir ~/.gnupg
 mkdir ~/.local/share/geary
-whitelist ~/.config/mimeapps.list
 whitelist ~/.gnupg
 whitelist ~/.local/share/applications
 whitelist ~/.local/share/geary
@@ -22,7 +21,7 @@ include /etc/firejail/whitelist-common.inc
 ignore private-tmp
 
 read-only ~/.config/mimeapps.list
-read-only ~/.local/share/applications
 
 # allow browsers
+# Redirect
 include /etc/firejail/firefox.profile
diff --git a/etc/gedit.profile b/etc/gedit.profile
index aa91d9518..418575e09 100644
--- a/etc/gedit.profile
+++ b/etc/gedit.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/geeqie.profile b/etc/geeqie.profile
index 5936787dd..c9f9d0074 100644
--- a/etc/geeqie.profile
+++ b/etc/geeqie.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/ghb.profile b/etc/ghb.profile
index 9437cea9e..de6244a32 100644
--- a/etc/ghb.profile
+++ b/etc/ghb.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/handbrake.profile
diff --git a/etc/gimp-2.8.profile b/etc/gimp-2.8.profile
index 5228078d9..a4e04af20 100644
--- a/etc/gimp-2.8.profile
+++ b/etc/gimp-2.8.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/gimp.profile
diff --git a/etc/gimp.profile b/etc/gimp.profile
index d77c4df8d..aa77d6105 100644
--- a/etc/gimp.profile
+++ b/etc/gimp.profile
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/git.profile b/etc/git.profile
index a565f3b5a..92bf66b92 100644
--- a/etc/git.profile
+++ b/etc/git.profile
@@ -23,10 +23,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/gitg.profile b/etc/gitg.profile
index a66ef1f92..1a731d507 100644
--- a/etc/gitg.profile
+++ b/etc/gitg.profile
@@ -16,15 +16,18 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
 shell none
 
+private-bin gitg,git,ssh
 private-dev
 private-tmp
 
diff --git a/etc/gitter.profile b/etc/gitter.profile
index 1864044d8..f92f4b167 100644
--- a/etc/gitter.profile
+++ b/etc/gitter.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/gjs.profile b/etc/gjs.profile
index 739100888..a856d35b5 100644
--- a/etc/gjs.profile
+++ b/etc/gjs.profile
@@ -19,9 +19,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/globaltime.profile b/etc/globaltime.profile
index 726619f26..6961a56e9 100644
--- a/etc/globaltime.profile
+++ b/etc/globaltime.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/gnome-2048.profile b/etc/gnome-2048.profile
index 996c8e1f4..7aea3f5a8 100644
--- a/etc/gnome-2048.profile
+++ b/etc/gnome-2048.profile
@@ -19,8 +19,10 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/gnome-books.profile b/etc/gnome-books.profile
index 60bd2f68d..5c1d5f137 100644
--- a/etc/gnome-books.profile
+++ b/etc/gnome-books.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/gnome-calculator.profile b/etc/gnome-calculator.profile
index 995415edc..4921fb0c4 100644
--- a/etc/gnome-calculator.profile
+++ b/etc/gnome-calculator.profile
@@ -15,10 +15,12 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/gnome-chess.profile b/etc/gnome-chess.profile
index 8fd6a2eca..688df6dfe 100644
--- a/etc/gnome-chess.profile
+++ b/etc/gnome-chess.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/gnome-clocks.profile b/etc/gnome-clocks.profile
index e20cbd9fe..d9bac48eb 100644
--- a/etc/gnome-clocks.profile
+++ b/etc/gnome-clocks.profile
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/gnome-contacts.profile b/etc/gnome-contacts.profile
index 1be74bfd3..90c2c2628 100644
--- a/etc/gnome-contacts.profile
+++ b/etc/gnome-contacts.profile
@@ -15,9 +15,11 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/gnome-documents.profile b/etc/gnome-documents.profile
index e56a32a4a..3254f3fbc 100644
--- a/etc/gnome-documents.profile
+++ b/etc/gnome-documents.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/gnome-font-viewer.profile b/etc/gnome-font-viewer.profile
index f122f066a..5ccb28840 100644
--- a/etc/gnome-font-viewer.profile
+++ b/etc/gnome-font-viewer.profile
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/gnome-maps.profile b/etc/gnome-maps.profile
index 1e60c4470..cdbf5cbe0 100644
--- a/etc/gnome-maps.profile
+++ b/etc/gnome-maps.profile
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/gnome-music.profile b/etc/gnome-music.profile
index 9d7b878cd..d3c61d9b4 100644
--- a/etc/gnome-music.profile
+++ b/etc/gnome-music.profile
@@ -18,6 +18,7 @@ no3d
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/gnome-photos.profile b/etc/gnome-photos.profile
index 5982b9dbd..0e150f525 100644
--- a/etc/gnome-photos.profile
+++ b/etc/gnome-photos.profile
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/gnome-twitch.profile b/etc/gnome-twitch.profile
index 9ef09a87b..9c94404d1 100644
--- a/etc/gnome-twitch.profile
+++ b/etc/gnome-twitch.profile
@@ -20,9 +20,11 @@ whitelist ${HOME}/.local/share/gnome-twitch
 include /etc/firejail/whitelist-common.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/gnome-weather.profile b/etc/gnome-weather.profile
index 514ef6f15..4ddbbbde2 100644
--- a/etc/gnome-weather.profile
+++ b/etc/gnome-weather.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/goobox.profile b/etc/goobox.profile
index 45715f9ce..9bedaa431 100644
--- a/etc/goobox.profile
+++ b/etc/goobox.profile
@@ -13,9 +13,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/google-chrome-beta.profile b/etc/google-chrome-beta.profile
index b6c39bfd2..ac457b92f 100644
--- a/etc/google-chrome-beta.profile
+++ b/etc/google-chrome-beta.profile
@@ -10,8 +10,7 @@ noblacklist ~/.config/google-chrome-beta
 noblacklist ~/.pki
 
 include /etc/firejail/disable-common.inc
-# chromium is distributed with a perl script on Arch
-# include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 
 mkdir ~/.cache/google-chrome-beta
@@ -25,7 +24,9 @@ include /etc/firejail/whitelist-common.inc
 
 caps.keep sys_chroot,sys_admin
 netfilter
+nodvd
 nogroups
+notv
 shell none
 
 private-dev
diff --git a/etc/google-chrome-stable.profile b/etc/google-chrome-stable.profile
index df4bd001f..6ade19021 100644
--- a/etc/google-chrome-stable.profile
+++ b/etc/google-chrome-stable.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/google-chrome.profile
diff --git a/etc/google-chrome-unstable.profile b/etc/google-chrome-unstable.profile
index ea111c7f6..3d7a9a715 100644
--- a/etc/google-chrome-unstable.profile
+++ b/etc/google-chrome-unstable.profile
@@ -10,8 +10,7 @@ noblacklist ~/.config/google-chrome-unstable
 noblacklist ~/.pki
 
 include /etc/firejail/disable-common.inc
-# chromium is distributed with a perl script on Arch
-# include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 
 mkdir ~/.cache/google-chrome-unstable
@@ -25,7 +24,9 @@ include /etc/firejail/whitelist-common.inc
 
 caps.keep sys_chroot,sys_admin
 netfilter
+nodvd
 nogroups
+notv
 shell none
 
 private-dev
diff --git a/etc/google-chrome.profile b/etc/google-chrome.profile
index f0d452841..a50e0e89d 100644
--- a/etc/google-chrome.profile
+++ b/etc/google-chrome.profile
@@ -10,8 +10,7 @@ noblacklist ~/.config/google-chrome
 noblacklist ~/.pki
 
 include /etc/firejail/disable-common.inc
-# chromium is distributed with a perl script on Arch
-# include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 
 mkdir ~/.cache/google-chrome
@@ -25,7 +24,9 @@ include /etc/firejail/whitelist-common.inc
 
 caps.keep sys_chroot,sys_admin
 netfilter
+nodvd
 nogroups
+notv
 shell none
 
 private-dev
diff --git a/etc/google-play-music-desktop-player.profile b/etc/google-play-music-desktop-player.profile
index 9c6c70f9f..704de6e40 100644
--- a/etc/google-play-music-desktop-player.profile
+++ b/etc/google-play-music-desktop-player.profile
@@ -20,9 +20,11 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6,netlink
 seccomp
diff --git a/etc/gpa.profile b/etc/gpa.profile
index 9ffb3abd3..58dfcd3e1 100644
--- a/etc/gpa.profile
+++ b/etc/gpa.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/gpg-agent.profile b/etc/gpg-agent.profile
index 0592bd113..13bceaa5a 100644
--- a/etc/gpg-agent.profile
+++ b/etc/gpg-agent.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/gpg.profile b/etc/gpg.profile
index 2d745b435..d99afdfe2 100644
--- a/etc/gpg.profile
+++ b/etc/gpg.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/gpicview.profile b/etc/gpicview.profile
index f9c56b7ad..ec9245e58 100644
--- a/etc/gpicview.profile
+++ b/etc/gpicview.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/gpredict.profile b/etc/gpredict.profile
index 475f3deef..f204366c5 100644
--- a/etc/gpredict.profile
+++ b/etc/gpredict.profile
@@ -17,10 +17,12 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/gtar.profile b/etc/gtar.profile
index 9d28393bf..d4bf18f95 100644
--- a/etc/gtar.profile
+++ b/etc/gtar.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/tar.profile
diff --git a/etc/gthumb.profile b/etc/gthumb.profile
index 2e1503970..63ad07894 100644
--- a/etc/gthumb.profile
+++ b/etc/gthumb.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/guayadeque.profile b/etc/guayadeque.profile
index 22adb9e65..7713f216f 100644
--- a/etc/guayadeque.profile
+++ b/etc/guayadeque.profile
@@ -17,6 +17,7 @@ netfilter
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/gucharmap.profile b/etc/gucharmap.profile
index 96bf783c4..b6be37439 100644
--- a/etc/gucharmap.profile
+++ b/etc/gucharmap.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/gwenview.profile b/etc/gwenview.profile
index 0f2be604b..745468912 100644
--- a/etc/gwenview.profile
+++ b/etc/gwenview.profile
@@ -20,9 +20,12 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
+novideo
 protocol unix
 seccomp
 shell none
diff --git a/etc/gzip.profile b/etc/gzip.profile
index 13960eda0..3f6ecec2c 100644
--- a/etc/gzip.profile
+++ b/etc/gzip.profile
@@ -11,7 +11,9 @@ blacklist /tmp/.X11-unix
 ignore noroot
 net none
 no3d
+nodvd
 nosound
+notv
 shell none
 tracelog
 
diff --git a/etc/handbrake-gtk.profile b/etc/handbrake-gtk.profile
index 9437cea9e..de6244a32 100644
--- a/etc/handbrake-gtk.profile
+++ b/etc/handbrake-gtk.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/handbrake.profile
diff --git a/etc/handbrake.profile b/etc/handbrake.profile
index 2b33051e2..2b32abca6 100644
--- a/etc/handbrake.profile
+++ b/etc/handbrake.profile
@@ -18,6 +18,7 @@ nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6,netlink
 seccomp
diff --git a/etc/hashcat.profile b/etc/hashcat.profile
index 662b8a06c..5f08d7cb8 100644
--- a/etc/hashcat.profile
+++ b/etc/hashcat.profile
@@ -7,23 +7,28 @@ include /etc/firejail/hashcat.local
 include /etc/firejail/globals.local
 
 noblacklist ${HOME}/.hashcat
+noblacklist /usr/include
 
 include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
 shell none
 
 disable-mnt
+private-bin hashcat
 private-dev
 private-tmp
 
diff --git a/etc/hedgewars.profile b/etc/hedgewars.profile
index b6dc1f945..e2775ffce 100644
--- a/etc/hedgewars.profile
+++ b/etc/hedgewars.profile
@@ -18,9 +18,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 seccomp
 tracelog
 
diff --git a/etc/hexchat.profile b/etc/hexchat.profile
index ceebb6d18..fc817d9f9 100644
--- a/etc/hexchat.profile
+++ b/etc/hexchat.profile
@@ -20,10 +20,12 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/highlight.profile b/etc/highlight.profile
index c314d34cb..83b023a90 100644
--- a/etc/highlight.profile
+++ b/etc/highlight.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/hugin.profile b/etc/hugin.profile
index 8eb7410ff..d3cd181b1 100644
--- a/etc/hugin.profile
+++ b/etc/hugin.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/icecat.profile b/etc/icecat.profile
index b8b267dff..ab7e62180 100644
--- a/etc/icecat.profile
+++ b/etc/icecat.profile
@@ -37,8 +37,10 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 tracelog
diff --git a/etc/icedove.profile b/etc/icedove.profile
index 3931fd0c0..46861d9f2 100644
--- a/etc/icedove.profile
+++ b/etc/icedove.profile
@@ -23,4 +23,5 @@ include /etc/firejail/whitelist-common.inc
 ignore private-tmp
 
 # allow browsers
+# Redirect
 include /etc/firejail/firefox.profile
diff --git a/etc/iceweasel.profile b/etc/iceweasel.profile
index 62671cb67..f6b57dde0 100644
--- a/etc/iceweasel.profile
+++ b/etc/iceweasel.profile
@@ -6,4 +6,5 @@ include /etc/firejail/iceweasel.local
 include /etc/firejail/globals.local
 
 
+# Redirect
 include /etc/firejail/firefox.profile
diff --git a/etc/idea.sh.profile b/etc/idea.sh.profile
index f0f0637d9..928ec7327 100644
--- a/etc/idea.sh.profile
+++ b/etc/idea.sh.profile
@@ -20,9 +20,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/img2txt.profile b/etc/img2txt.profile
index 5117e887b..bd454a2c8 100644
--- a/etc/img2txt.profile
+++ b/etc/img2txt.profile
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/inkscape.profile b/etc/inkscape.profile
index 6bba90d14..1d24f5d7d 100644
--- a/etc/inkscape.profile
+++ b/etc/inkscape.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/inox.profile b/etc/inox.profile
index 98a1ea6a9..6273c4de6 100644
--- a/etc/inox.profile
+++ b/etc/inox.profile
@@ -22,3 +22,5 @@ whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
 
 netfilter
+nodvd
+notv
diff --git a/etc/iridium-browser.profile b/etc/iridium-browser.profile
index 9e1a4fcc2..1baa07cb7 100644
--- a/etc/iridium-browser.profile
+++ b/etc/iridium-browser.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/iridium.profile
diff --git a/etc/iridium.profile b/etc/iridium.profile
index 95e94cbf9..db9c5c7cf 100644
--- a/etc/iridium.profile
+++ b/etc/iridium.profile
@@ -23,3 +23,5 @@ whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
 
 netfilter
+nodvd
+notv
diff --git a/etc/jd-gui.profile b/etc/jd-gui.profile
index 96d4a57ce..5cb1e1828 100644
--- a/etc/jd-gui.profile
+++ b/etc/jd-gui.profile
@@ -16,15 +16,18 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
 shell none
 
+private-bin jd-gui,sh,bash
 private-dev
 private-tmp
 
diff --git a/etc/jitsi.profile b/etc/jitsi.profile
index 72f9b5f5b..78a57ff46 100644
--- a/etc/jitsi.profile
+++ b/etc/jitsi.profile
@@ -13,9 +13,11 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/k3b.profile b/etc/k3b.profile
index c2aed68c9..87132e775 100644
--- a/etc/k3b.profile
+++ b/etc/k3b.profile
@@ -16,9 +16,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 no3d
+nodvd
 nonewprivs
 noroot
 nosound
+notv
+novideo
 protocol unix
 seccomp
 shell none
diff --git a/etc/kate.profile b/etc/kate.profile
index 12d9127b4..ec5d09ce2 100644
--- a/etc/kate.profile
+++ b/etc/kate.profile
@@ -19,10 +19,13 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
+novideo
 protocol unix
 seccomp
 shell none
diff --git a/etc/kcalc.profile b/etc/kcalc.profile
index ac4e11195..f334c4c72 100644
--- a/etc/kcalc.profile
+++ b/etc/kcalc.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/keepass.profile b/etc/keepass.profile
index 543bc01eb..c133ce0fb 100644
--- a/etc/keepass.profile
+++ b/etc/keepass.profile
@@ -21,10 +21,13 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
+novideo
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/keepass2.profile b/etc/keepass2.profile
index 7d2881099..d29fc6abc 100644
--- a/etc/keepass2.profile
+++ b/etc/keepass2.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/keepass.profile
diff --git a/etc/keepassx.profile b/etc/keepassx.profile
index 892dd7053..9d943d89c 100644
--- a/etc/keepassx.profile
+++ b/etc/keepassx.profile
@@ -19,10 +19,13 @@ caps.drop all
 machine-id
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
+novideo
 protocol unix
 seccomp
 shell none
diff --git a/etc/keepassx2.profile b/etc/keepassx2.profile
index ab56e0317..e20e06b76 100644
--- a/etc/keepassx2.profile
+++ b/etc/keepassx2.profile
@@ -18,10 +18,13 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
+novideo
 protocol unix
 seccomp
 shell none
diff --git a/etc/keepassxc.profile b/etc/keepassxc.profile
index c8a494361..f79cda80d 100644
--- a/etc/keepassxc.profile
+++ b/etc/keepassxc.profile
@@ -18,10 +18,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/kino.profile b/etc/kino.profile
index c64f2d599..240dab8ef 100644
--- a/etc/kino.profile
+++ b/etc/kino.profile
@@ -18,6 +18,7 @@ netfilter
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/kmail.profile b/etc/kmail.profile
index 876e80cbb..fdc96c97f 100644
--- a/etc/kmail.profile
+++ b/etc/kmail.profile
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 tracelog
diff --git a/etc/knotes.profile b/etc/knotes.profile
index 26b607257..a1d303ded 100644
--- a/etc/knotes.profile
+++ b/etc/knotes.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/konversation.profile b/etc/konversation.profile
index d1c78afbe..8bc263d4d 100644
--- a/etc/konversation.profile
+++ b/etc/konversation.profile
@@ -13,8 +13,10 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 
diff --git a/etc/ktorrent.profile b/etc/ktorrent.profile
index 8e396a464..c5b887118 100644
--- a/etc/ktorrent.profile
+++ b/etc/ktorrent.profile
@@ -35,10 +35,12 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/kwrite.profile b/etc/kwrite.profile
index b6406cc0d..6ba076dc0 100644
--- a/etc/kwrite.profile
+++ b/etc/kwrite.profile
@@ -19,10 +19,13 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 # nosound - KWrite is using ALSA!
+notv
+novideo
 protocol unix
 seccomp
 shell none
diff --git a/etc/leafpad.profile b/etc/leafpad.profile
index de44a6771..e7557651b 100644
--- a/etc/leafpad.profile
+++ b/etc/leafpad.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/less.profile b/etc/less.profile
index fe8a8fa24..e1c42ed76 100644
--- a/etc/less.profile
+++ b/etc/less.profile
@@ -11,11 +11,17 @@ blacklist /tmp/.X11-unix
 ignore noroot
 net none
 no3d
+nodvd
 nosound
+notv
 novideo
 shell none
 tracelog
+writable-var-log
 
+# The user can have a custom coloring scritps configured in ~/.lessfilter.
+# Enable private-bin if you are not using any filter.
+# private-bin less
 private-dev
 
 memory-deny-write-execute
diff --git a/etc/libreoffice.profile b/etc/libreoffice.profile
index 8387fef98..ec7356002 100644
--- a/etc/libreoffice.profile
+++ b/etc/libreoffice.profile
@@ -16,9 +16,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/liferea.profile b/etc/liferea.profile
index f9c050acb..afd5fed6b 100644
--- a/etc/liferea.profile
+++ b/etc/liferea.profile
@@ -25,10 +25,12 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
 # no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 # nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/localc.profile b/etc/localc.profile
index c30bb5550..c702a4ece 100644
--- a/etc/localc.profile
+++ b/etc/localc.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/libreoffice.profile
diff --git a/etc/lodraw.profile b/etc/lodraw.profile
index c30bb5550..c702a4ece 100644
--- a/etc/lodraw.profile
+++ b/etc/lodraw.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/libreoffice.profile
diff --git a/etc/loffice.profile b/etc/loffice.profile
index c30bb5550..c702a4ece 100644
--- a/etc/loffice.profile
+++ b/etc/loffice.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/libreoffice.profile
diff --git a/etc/lofromtemplate.profile b/etc/lofromtemplate.profile
index c30bb5550..c702a4ece 100644
--- a/etc/lofromtemplate.profile
+++ b/etc/lofromtemplate.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/libreoffice.profile
diff --git a/etc/loimpress.profile b/etc/loimpress.profile
index c30bb5550..c702a4ece 100644
--- a/etc/loimpress.profile
+++ b/etc/loimpress.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/libreoffice.profile
diff --git a/etc/lollypop.profile b/etc/lollypop.profile
index 22004d95e..587a46353 100644
--- a/etc/lollypop.profile
+++ b/etc/lollypop.profile
@@ -18,6 +18,7 @@ no3d
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/lomath.profile b/etc/lomath.profile
index c30bb5550..c702a4ece 100644
--- a/etc/lomath.profile
+++ b/etc/lomath.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/libreoffice.profile
diff --git a/etc/loweb.profile b/etc/loweb.profile
index c30bb5550..c702a4ece 100644
--- a/etc/loweb.profile
+++ b/etc/loweb.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/libreoffice.profile
diff --git a/etc/lowriter.profile b/etc/lowriter.profile
index c30bb5550..c702a4ece 100644
--- a/etc/lowriter.profile
+++ b/etc/lowriter.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/libreoffice.profile
diff --git a/etc/luminance-hdr.profile b/etc/luminance-hdr.profile
index bbceee7c7..bd32e0c70 100644
--- a/etc/luminance-hdr.profile
+++ b/etc/luminance-hdr.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/lximage-qt.profile b/etc/lximage-qt.profile
index f0eda6fbe..734f16e92 100644
--- a/etc/lximage-qt.profile
+++ b/etc/lximage-qt.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/lxmusic.profile b/etc/lxmusic.profile
index 230ceaafb..901bdb408 100644
--- a/etc/lxmusic.profile
+++ b/etc/lxmusic.profile
@@ -16,9 +16,11 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/lxterminal.profile b/etc/lxterminal.profile
index 771211b31..dbbd1ace0 100644
--- a/etc/lxterminal.profile
+++ b/etc/lxterminal.profile
@@ -13,5 +13,7 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 # noroot - somehow this breaks on Debian Jessie!
+nodvd
+notv
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/lynx.profile b/etc/lynx.profile
index 8ff1f88b3..db01a5b8f 100644
--- a/etc/lynx.profile
+++ b/etc/lynx.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/mate-calc.profile b/etc/mate-calc.profile
index 220807447..caf3095a5 100644
--- a/etc/mate-calc.profile
+++ b/etc/mate-calc.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/mate-calculator.profile b/etc/mate-calculator.profile
index 155ccfe7e..43bb3ebb4 100644
--- a/etc/mate-calculator.profile
+++ b/etc/mate-calculator.profile
@@ -1,7 +1,6 @@
-# Firejail profile for mate-calculator
+# Firejail profile alias for mate-calc
 # This file is overwritten after every install/update
-# Persistent local customizations
-include /etc/firejail/mate-calculator.local
-# Persistent global definitions
-include /etc/firejail/globals.local
 
+
+# Redirect
+include /etc/firejail/mate-calc.profile
diff --git a/etc/mate-color-select.profile b/etc/mate-color-select.profile
index 42456d1f6..26ce42fbf 100644
--- a/etc/mate-color-select.profile
+++ b/etc/mate-color-select.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/mate-dictionary.profile b/etc/mate-dictionary.profile
index bc148fba3..f0de57e0d 100644
--- a/etc/mate-dictionary.profile
+++ b/etc/mate-dictionary.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/mathematica.profile b/etc/mathematica.profile
index 64cae12dd..984ea9e97 100644
--- a/etc/mathematica.profile
+++ b/etc/mathematica.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/Mathematica.profile
diff --git a/etc/mcabber.profile b/etc/mcabber.profile
index 8563201ac..bd1ada2b5 100644
--- a/etc/mcabber.profile
+++ b/etc/mcabber.profile
@@ -15,9 +15,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
 nosound
+notv
 protocol inet,inet6
 seccomp
 shell none
diff --git a/etc/mediainfo.profile b/etc/mediainfo.profile
index 4a2e9246e..d6a55610f 100644
--- a/etc/mediainfo.profile
+++ b/etc/mediainfo.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/mediathekview.profile b/etc/mediathekview.profile
index 5e980909b..b90e21e66 100644
--- a/etc/mediathekview.profile
+++ b/etc/mediathekview.profile
@@ -5,8 +5,14 @@ include /etc/firejail/mediathekview.local
 # Persistent global definitions
 include /etc/firejail/globals.local
 
+noblacklist ~/.config/mpv
+noblacklist ~/.config/smplayer
+noblacklist ~/.config/totem
 noblacklist ~/.config/vlc
+noblacklist ~/.java
+noblacklist ~/.local/share/totem
 noblacklist ~/.mediathek3
+noblacklist ~/.mplayer
 
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
@@ -15,8 +21,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
+novideo
 protocol unix,inet,inet6
 seccomp
 tracelog
diff --git a/etc/meld.profile b/etc/meld.profile
index 4aeca3771..f1910d0f4 100644
--- a/etc/meld.profile
+++ b/etc/meld.profile
@@ -15,15 +15,18 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
 shell none
 
+# private-bin meld,python2,python2.7
 private-dev
 private-tmp
 
diff --git a/etc/midori.profile b/etc/midori.profile
index 5b390a170..8ddb37776 100644
--- a/etc/midori.profile
+++ b/etc/midori.profile
@@ -35,8 +35,10 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 # noroot - problems on Ubuntu 14.04
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 tracelog
diff --git a/etc/mousepad.profile b/etc/mousepad.profile
index 5a54afb5b..36365fc2f 100644
--- a/etc/mousepad.profile
+++ b/etc/mousepad.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/multimc5.profile b/etc/multimc5.profile
index a2f5d46b4..91a269ffb 100644
--- a/etc/multimc5.profile
+++ b/etc/multimc5.profile
@@ -22,15 +22,19 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 # seccomp
 shell none
 
 disable-mnt
+# private-bin works, but causes weirdness
+# private-bin multimc5,bash,mkdir,which,zenity,kdialog,ldd,chmod,valgrind,apt-file,pkgfile,dnf,yum,zypper,pfl,java,grep,sort,awk,readlink,dirname
 private-dev
 private-tmp
 
diff --git a/etc/mumble.profile b/etc/mumble.profile
index 048b31b81..e58dc93f4 100644
--- a/etc/mumble.profile
+++ b/etc/mumble.profile
@@ -22,9 +22,11 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/mupdf.profile b/etc/mupdf.profile
index 4b98552c4..c7bb458df 100644
--- a/etc/mupdf.profile
+++ b/etc/mupdf.profile
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 # seccomp.keep access,arch_prctl,brk,clone,close,connect,execve,exit_group,fchmod,fchown,fcntl,fstat,futex,getcwd,getpeername,getrlimit,getsockname,getsockopt,lseek,lstat,mlock,mmap,mprotect,mremap,munmap,nanosleep,open,poll,prctl,read,recvfrom,recvmsg,restart_syscall,rt_sigaction,rt_sigprocmask,select,sendmsg,set_robust_list,set_tid_address,setresgid,setresuid,shmat,shmctl,shmget,shutdown,socket,stat,sysinfo,uname,unshare,wait4,write,writev
@@ -27,5 +29,6 @@ tracelog
 private-dev
 private-etc fonts
 private-tmp
+
 # mupdf will never write anything
 read-only ${HOME}
diff --git a/etc/mupen64plus.profile b/etc/mupen64plus.profile
index f0680c4ce..9f3be0d27 100644
--- a/etc/mupen64plus.profile
+++ b/etc/mupen64plus.profile
@@ -22,6 +22,8 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 net none
+nodvd
 nonewprivs
 noroot
+notv
 seccomp
diff --git a/etc/mutt.profile b/etc/mutt.profile
index e2b9b38ec..206edefae 100644
--- a/etc/mutt.profile
+++ b/etc/mutt.profile
@@ -38,10 +38,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/nautilus.profile b/etc/nautilus.profile
index 2da8f32d7..57d6faa17 100644
--- a/etc/nautilus.profile
+++ b/etc/nautilus.profile
@@ -20,9 +20,11 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/nemo.profile b/etc/nemo.profile
index e2219825a..b11ad645a 100644
--- a/etc/nemo.profile
+++ b/etc/nemo.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/netsurf.profile b/etc/netsurf.profile
index 68df57539..64aa068b1 100644
--- a/etc/netsurf.profile
+++ b/etc/netsurf.profile
@@ -21,8 +21,10 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 tracelog
diff --git a/etc/nylas.profile b/etc/nylas.profile
index 6b6697522..5d84d1326 100644
--- a/etc/nylas.profile
+++ b/etc/nylas.profile
@@ -20,10 +20,12 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/obs.profile b/etc/obs.profile
index 3dbacbf57..187862752 100644
--- a/etc/obs.profile
+++ b/etc/obs.profile
@@ -13,14 +13,17 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
 tracelog
 
+private-bin obs
 private-dev
 private-tmp
 
diff --git a/etc/odt2txt.profile b/etc/odt2txt.profile
index 06b4c16e0..da2d03635 100644
--- a/etc/odt2txt.profile
+++ b/etc/odt2txt.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/okular.profile b/etc/okular.profile
index 331b625b8..d03891ebe 100644
--- a/etc/okular.profile
+++ b/etc/okular.profile
@@ -22,10 +22,13 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
+novideo
 protocol unix
 seccomp
 shell none
diff --git a/etc/open-invaders.profile b/etc/open-invaders.profile
index 2587027ab..998d57f62 100644
--- a/etc/open-invaders.profile
+++ b/etc/open-invaders.profile
@@ -17,9 +17,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,netlink
 seccomp
 shell none
diff --git a/etc/openshot.profile b/etc/openshot.profile
index b5ace455e..02f4665d6 100644
--- a/etc/openshot.profile
+++ b/etc/openshot.profile
@@ -15,9 +15,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/opera-beta.profile b/etc/opera-beta.profile
index 078f5a0dd..c295a2082 100644
--- a/etc/opera-beta.profile
+++ b/etc/opera-beta.profile
@@ -22,3 +22,5 @@ whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
 
 netfilter
+nodvd
+notv
diff --git a/etc/opera.profile b/etc/opera.profile
index 7802a124a..553ea6790 100644
--- a/etc/opera.profile
+++ b/etc/opera.profile
@@ -26,3 +26,5 @@ whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
 
 netfilter
+nodvd
+notv
diff --git a/etc/orage.profile b/etc/orage.profile
index 132b526b4..209c7e9db 100644
--- a/etc/orage.profile
+++ b/etc/orage.profile
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/palemoon.profile b/etc/palemoon.profile
index e3e498195..054e876c5 100644
--- a/etc/palemoon.profile
+++ b/etc/palemoon.profile
@@ -41,9 +41,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/parole.profile b/etc/parole.profile
index 00a12afd9..794d91481 100644
--- a/etc/parole.profile
+++ b/etc/parole.profile
@@ -13,8 +13,10 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/pcmanfm.profile b/etc/pcmanfm.profile
index f2bc908df..3b739b2ac 100644
--- a/etc/pcmanfm.profile
+++ b/etc/pcmanfm.profile
@@ -17,9 +17,11 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 net none
 no3d
+nodvd
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/pdfsam.profile b/etc/pdfsam.profile
index 0f25f1fa5..fd52fb9ee 100644
--- a/etc/pdfsam.profile
+++ b/etc/pdfsam.profile
@@ -15,15 +15,18 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
 shell none
 
+private-bin pdfsam,sh,bash,java,archlinux-java,grep,awk,dirname,uname,which,sort,find,readlink,expr,ls,java-config
 private-dev
 private-tmp
 
diff --git a/etc/pdftotext.profile b/etc/pdftotext.profile
index 89fb295dd..540a428cc 100644
--- a/etc/pdftotext.profile
+++ b/etc/pdftotext.profile
@@ -15,10 +15,13 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
+novideo
 protocol unix
 seccomp
 shell none
diff --git a/etc/peek.profile b/etc/peek.profile
index 2860d3663..13c0c72e0 100644
--- a/etc/peek.profile
+++ b/etc/peek.profile
@@ -15,15 +15,18 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
 shell none
 
+# private-bin breaks gif mode, mp4 and webm mode work fine however
 # private-bin peek,convert,ffmpeg
 private-dev
 private-tmp
diff --git a/etc/picard.profile b/etc/picard.profile
index ccdbc5116..8dc79b4ad 100644
--- a/etc/picard.profile
+++ b/etc/picard.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/pidgin.profile b/etc/pidgin.profile
index 7bc88a814..dd610920a 100644
--- a/etc/pidgin.profile
+++ b/etc/pidgin.profile
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/pingus.profile b/etc/pingus.profile
index 848bf88ad..68d5a98ad 100644
--- a/etc/pingus.profile
+++ b/etc/pingus.profile
@@ -17,9 +17,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,netlink
 seccomp
 shell none
diff --git a/etc/pithos.profile b/etc/pithos.profile
index 7eea5d8c2..b81e0b634 100644
--- a/etc/pithos.profile
+++ b/etc/pithos.profile
@@ -15,15 +15,18 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
 shell none
 
 disable-mnt
+# private-bin pithos,python,python3,python3.6
 private-dev
 private-tmp
 
diff --git a/etc/pix.profile b/etc/pix.profile
index 0d1d46fd6..ed9298727 100644
--- a/etc/pix.profile
+++ b/etc/pix.profile
@@ -16,10 +16,12 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/pluma.profile b/etc/pluma.profile
index 75bdeadc4..d17a64d1d 100644
--- a/etc/pluma.profile
+++ b/etc/pluma.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 seccomp
 shell none
 tracelog
diff --git a/etc/polari.profile b/etc/polari.profile
index e2788b7d0..a990194c9 100644
--- a/etc/polari.profile
+++ b/etc/polari.profile
@@ -27,10 +27,12 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/psi-plus.profile b/etc/psi-plus.profile
index 27ee2500c..72c52d967 100644
--- a/etc/psi-plus.profile
+++ b/etc/psi-plus.profile
@@ -25,9 +25,11 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/qbittorrent.profile b/etc/qbittorrent.profile
index 025a6fa61..ea635ab6e 100644
--- a/etc/qbittorrent.profile
+++ b/etc/qbittorrent.profile
@@ -29,10 +29,12 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 machine-id
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 # shell none
diff --git a/etc/qemu-launcher.profile b/etc/qemu-launcher.profile
index 0f3235266..2738e04bb 100644
--- a/etc/qemu-launcher.profile
+++ b/etc/qemu-launcher.profile
@@ -13,9 +13,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/qemu-system-x86_64.profile b/etc/qemu-system-x86_64.profile
index b1b8e9319..7a60007fe 100644
--- a/etc/qemu-system-x86_64.profile
+++ b/etc/qemu-system-x86_64.profile
@@ -12,9 +12,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/qlipper.profile b/etc/qlipper.profile
index 98c794624..796015654 100644
--- a/etc/qlipper.profile
+++ b/etc/qlipper.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/qpdfview.profile b/etc/qpdfview.profile
index 596171420..2c652c688 100644
--- a/etc/qpdfview.profile
+++ b/etc/qpdfview.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/qtox.profile b/etc/qtox.profile
index 08cbcd332..5cbe68c90 100644
--- a/etc/qtox.profile
+++ b/etc/qtox.profile
@@ -22,9 +22,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/quassel.profile b/etc/quassel.profile
index 9e9ecfce9..af0f723f1 100644
--- a/etc/quassel.profile
+++ b/etc/quassel.profile
@@ -12,7 +12,9 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/quiterss.profile b/etc/quiterss.profile
index 934763a25..6f20f6d7f 100644
--- a/etc/quiterss.profile
+++ b/etc/quiterss.profile
@@ -28,10 +28,12 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/qupzilla.profile b/etc/qupzilla.profile
index 6d0c16785..7b7086bde 100644
--- a/etc/qupzilla.profile
+++ b/etc/qupzilla.profile
@@ -20,7 +20,9 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 tracelog
diff --git a/etc/qutebrowser.profile b/etc/qutebrowser.profile
index 9eb0c9075..31721617f 100644
--- a/etc/qutebrowser.profile
+++ b/etc/qutebrowser.profile
@@ -23,8 +23,10 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 tracelog
diff --git a/etc/rambox.profile b/etc/rambox.profile
index a5b87e901..2696df86b 100644
--- a/etc/rambox.profile
+++ b/etc/rambox.profile
@@ -21,9 +21,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 # tracelog
diff --git a/etc/ranger.profile b/etc/ranger.profile
index 3767c7ba8..717eca099 100644
--- a/etc/ranger.profile
+++ b/etc/ranger.profile
@@ -18,10 +18,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 
diff --git a/etc/remmina.profile b/etc/remmina.profile
index 39b5b2acd..3bb6aa0b1 100644
--- a/etc/remmina.profile
+++ b/etc/remmina.profile
@@ -15,9 +15,11 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/rhythmbox.profile b/etc/rhythmbox.profile
index ac8882165..bcd72be9a 100644
--- a/etc/rhythmbox.profile
+++ b/etc/rhythmbox.profile
@@ -17,6 +17,7 @@ netfilter
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/riot-web.profile b/etc/riot-web.profile
index 93f389bbc..c714652df 100644
--- a/etc/riot-web.profile
+++ b/etc/riot-web.profile
@@ -10,4 +10,5 @@ noblacklist ~/.config/Riot
 whitelist ~/.config/Riot
 include /etc/firejail/whitelist-common.inc
 
+# Redirect
 include /etc/firejail/electron.profile
diff --git a/etc/ristretto.profile b/etc/ristretto.profile
index 8070254ac..3de5de34a 100644
--- a/etc/ristretto.profile
+++ b/etc/ristretto.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/rtorrent.profile b/etc/rtorrent.profile
index b9f9960f4..a44d99e5b 100644
--- a/etc/rtorrent.profile
+++ b/etc/rtorrent.profile
@@ -13,9 +13,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/scribus.profile b/etc/scribus.profile
index 7e117dcd1..acd6b2239 100644
--- a/etc/scribus.profile
+++ b/etc/scribus.profile
@@ -5,7 +5,7 @@ include /etc/firejail/scribus.local
 # Persistent global definitions
 include /etc/firejail/globals.local
 
-# Support for PDF readers (Scribus 1.5 and higher)
+# Support for PDF readers comes with Scribus 1.5 and higher
 noblacklist ~/.config/okularpartrc
 noblacklist ~/.config/okularrc
 noblacklist ~/.config/scribus
@@ -27,9 +27,12 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nonewprivs
 noroot
 nosound
+notv
+novideo
 protocol unix
 seccomp
 tracelog
diff --git a/etc/sdat2img.profile b/etc/sdat2img.profile
index 7311594c0..ce4c4d416 100644
--- a/etc/sdat2img.profile
+++ b/etc/sdat2img.profile
@@ -15,15 +15,18 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
 shell none
 
+# private-bin sdat2img,env,python,python3,python3.6
 private-dev
 
 noexec ${HOME}
diff --git a/etc/seamonkey-bin.profile b/etc/seamonkey-bin.profile
index 25e882b32..1ceed99fd 100644
--- a/etc/seamonkey-bin.profile
+++ b/etc/seamonkey-bin.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/seamonkey.profile
diff --git a/etc/seamonkey.profile b/etc/seamonkey.profile
index 072a9fef5..36dde66b0 100644
--- a/etc/seamonkey.profile
+++ b/etc/seamonkey.profile
@@ -37,8 +37,10 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 tracelog
diff --git a/etc/server.profile b/etc/server.profile
index b0dd13f80..04ef555de 100644
--- a/etc/server.profile
+++ b/etc/server.profile
@@ -21,7 +21,10 @@ include /etc/firejail/disable-programs.inc
 
 caps
 no3d
+nodvd
 nosound
+notv
+novideo
 seccomp
 
 # disable-mnt
diff --git a/etc/silentarmy.profile b/etc/silentarmy.profile
index d5d92670b..abc68a499 100644
--- a/etc/silentarmy.profile
+++ b/etc/silentarmy.profile
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/simple-scan.profile b/etc/simple-scan.profile
index a55388fee..05ed9f813 100644
--- a/etc/simple-scan.profile
+++ b/etc/simple-scan.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 shell none
 # seccomp
diff --git a/etc/simutrans.profile b/etc/simutrans.profile
index d67d2a575..fda5204e2 100644
--- a/etc/simutrans.profile
+++ b/etc/simutrans.profile
@@ -17,9 +17,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/skanlite.profile b/etc/skanlite.profile
index 25f0107f8..0338bc452 100644
--- a/etc/skanlite.profile
+++ b/etc/skanlite.profile
@@ -13,10 +13,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 # protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/skype.profile b/etc/skype.profile
index 396563f0c..f3e504a3f 100644
--- a/etc/skype.profile
+++ b/etc/skype.profile
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/skypeforlinux.profile b/etc/skypeforlinux.profile
index 7037961f8..b69a208a8 100644
--- a/etc/skypeforlinux.profile
+++ b/etc/skypeforlinux.profile
@@ -14,9 +14,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/slack.profile b/etc/slack.profile
index d2fb74af8..9025e4f75 100644
--- a/etc/slack.profile
+++ b/etc/slack.profile
@@ -24,9 +24,11 @@ include /etc/firejail/whitelist-common.inc
 caps.drop all
 name slack
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/smplayer.profile b/etc/smplayer.profile
index d8861f937..ea80b2b0a 100644
--- a/etc/smplayer.profile
+++ b/etc/smplayer.profile
@@ -22,7 +22,7 @@ protocol unix,inet,inet6,netlink
 seccomp
 shell none
 
-private-bin smplayer,mplayer
+private-bin smplayer,mplayer,mpv
 private-dev
 private-tmp
 
diff --git a/etc/snap.profile b/etc/snap.profile
index 38aef7c23..238dffeab 100644
--- a/etc/snap.profile
+++ b/etc/snap.profile
@@ -14,3 +14,5 @@ include /etc/firejail/disable-programs.inc
 whitelist ${DOWNLOADS}
 whitelist ~/snap
 include /etc/firejail/whitelist-common.inc
+nodvd
+notv
diff --git a/etc/soffice.profile b/etc/soffice.profile
index c30bb5550..c702a4ece 100644
--- a/etc/soffice.profile
+++ b/etc/soffice.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/libreoffice.profile
diff --git a/etc/soundconverter.profile b/etc/soundconverter.profile
index 12ae63cf9..5d7129b5a 100644
--- a/etc/soundconverter.profile
+++ b/etc/soundconverter.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/spotify.profile b/etc/spotify.profile
index 64805153c..8eac3610b 100644
--- a/etc/spotify.profile
+++ b/etc/spotify.profile
@@ -36,6 +36,7 @@ netfilter
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/sqlitebrowser.profile b/etc/sqlitebrowser.profile
index ac7daa873..65e8073c9 100644
--- a/etc/sqlitebrowser.profile
+++ b/etc/sqlitebrowser.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/ssh-agent.profile b/etc/ssh-agent.profile
index f2c88c943..ba5115521 100644
--- a/etc/ssh-agent.profile
+++ b/etc/ssh-agent.profile
@@ -19,7 +19,9 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/ssh.profile b/etc/ssh.profile
index ac3b7a0ba..da852c6ba 100644
--- a/etc/ssh.profile
+++ b/etc/ssh.profile
@@ -18,10 +18,12 @@ caps.drop all
 ipc-namespace
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/start-tor-browser.profile b/etc/start-tor-browser.profile
index 26154508a..ca521e08c 100644
--- a/etc/start-tor-browser.profile
+++ b/etc/start-tor-browser.profile
@@ -13,9 +13,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/steam.profile b/etc/steam.profile
index d928e660d..96899038a 100644
--- a/etc/steam.profile
+++ b/etc/steam.profile
@@ -24,9 +24,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 # novideo
 protocol unix,inet,inet6,netlink
 seccomp
diff --git a/etc/stellarium.profile b/etc/stellarium.profile
index 768fbd082..89e2d1a30 100644
--- a/etc/stellarium.profile
+++ b/etc/stellarium.profile
@@ -21,10 +21,12 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/strings.profile b/etc/strings.profile
index 09957ae09..83561cae5 100644
--- a/etc/strings.profile
+++ b/etc/strings.profile
@@ -11,12 +11,16 @@ blacklist /tmp/.X11-unix
 ignore noroot
 net none
 no3d
+nodvd
 nosound
+notv
 novideo
 shell none
 tracelog
 
+private-bin strings
 private-dev
+private-lib
 
 memory-deny-write-execute
 
diff --git a/etc/supertux2.profile b/etc/supertux2.profile
index 4e70f9e8c..cd6496a7b 100644
--- a/etc/supertux2.profile
+++ b/etc/supertux2.profile
@@ -17,9 +17,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,netlink
 seccomp
 shell none
diff --git a/etc/synfigstudio.profile b/etc/synfigstudio.profile
index 6861e6efb..08ece1e9b 100644
--- a/etc/synfigstudio.profile
+++ b/etc/synfigstudio.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/tar.profile b/etc/tar.profile
index 817e51542..34a4f34d6 100644
--- a/etc/tar.profile
+++ b/etc/tar.profile
@@ -12,7 +12,9 @@ hostname tar
 ignore noroot
 net none
 no3d
+nodvd
 nosound
+notv
 shell none
 tracelog
 
diff --git a/etc/telegram-desktop.profile b/etc/telegram-desktop.profile
index 844595b3f..df6557a90 100644
--- a/etc/telegram-desktop.profile
+++ b/etc/telegram-desktop.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/telegram.profile
diff --git a/etc/telegram.profile b/etc/telegram.profile
index e40233c35..e3ccaf1a0 100644
--- a/etc/telegram.profile
+++ b/etc/telegram.profile
@@ -13,8 +13,10 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 
diff --git a/etc/thunar.profile b/etc/thunar.profile
index 044f22d29..1545e8c7e 100644
--- a/etc/thunar.profile
+++ b/etc/thunar.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/Thunar.profile
diff --git a/etc/thunderbird.profile b/etc/thunderbird.profile
index d3b7ee871..17bf51873 100644
--- a/etc/thunderbird.profile
+++ b/etc/thunderbird.profile
@@ -18,7 +18,6 @@ mkdir ~/.gnupg
 mkdir ~/.icedove
 mkdir ~/.thunderbird
 whitelist ~/.cache/thunderbird
-whitelist ~/.config/mimeapps.list
 whitelist ~/.gnupg
 whitelist ~/.icedove
 whitelist ~/.local/share/applications
@@ -28,7 +27,7 @@ include /etc/firejail/whitelist-common.inc
 ignore private-tmp
 
 read-only ~/.config/mimeapps.list
-read-only ~/.local/share/applications
 
 # allow browsers
+# Redirect
 include /etc/firejail/firefox.profile
diff --git a/etc/tracker.profile b/etc/tracker.profile
index feb8b4fd3..ded2ae2e5 100644
--- a/etc/tracker.profile
+++ b/etc/tracker.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/transmission-cli.profile b/etc/transmission-cli.profile
index e8fdd81d7..5752c96f3 100644
--- a/etc/transmission-cli.profile
+++ b/etc/transmission-cli.profile
@@ -15,9 +15,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/transmission-gtk.profile b/etc/transmission-gtk.profile
index b3cf5213a..c4bf7a08d 100644
--- a/etc/transmission-gtk.profile
+++ b/etc/transmission-gtk.profile
@@ -22,9 +22,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/transmission-qt.profile b/etc/transmission-qt.profile
index 433fb716e..02e9a5052 100644
--- a/etc/transmission-qt.profile
+++ b/etc/transmission-qt.profile
@@ -22,9 +22,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/transmission-show.profile b/etc/transmission-show.profile
index e87ab51df..130defc8e 100644
--- a/etc/transmission-show.profile
+++ b/etc/transmission-show.profile
@@ -15,9 +15,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+nodvd
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/truecraft.profile b/etc/truecraft.profile
index 850845c95..4e48f6c6b 100644
--- a/etc/truecraft.profile
+++ b/etc/truecraft.profile
@@ -20,9 +20,11 @@ whitelist ${HOME}/.config/truecraft
 include /etc/firejail/whitelist-common.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/tuxguitar.profile b/etc/tuxguitar.profile
new file mode 100644
index 000000000..ddbcce3f6
--- /dev/null
+++ b/etc/tuxguitar.profile
@@ -0,0 +1,31 @@
+# Firejail profile for tuxguitar
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/tuxguitar.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+noblacklist ~/.java
+noblacklist ~/.tuxguitar*
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+no3d
+nodvd
+nonewprivs
+noroot
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+tracelog
+
+private-dev
+private-tmp
+
+# noexec ${HOME} - tuxguitar may fail to launch
+noexec /tmp
diff --git a/etc/uget-gtk.profile b/etc/uget-gtk.profile
index 775ac8a96..877ad635b 100644
--- a/etc/uget-gtk.profile
+++ b/etc/uget-gtk.profile
@@ -18,9 +18,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/unbound.profile b/etc/unbound.profile
index 091d59c1a..c1cb86893 100644
--- a/etc/unbound.profile
+++ b/etc/unbound.profile
@@ -14,7 +14,9 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 no3d
+nodvd
 nosound
+notv
 seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open
 
 private
diff --git a/etc/unknown-horizons.profile b/etc/unknown-horizons.profile
index e09b65632..5f70843d6 100644
--- a/etc/unknown-horizons.profile
+++ b/etc/unknown-horizons.profile
@@ -16,9 +16,11 @@ whitelist ~/.unknown-horizons
 include /etc/firejail/whitelist-common.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,netlink,inet,inet6
 seccomp
 shell none
diff --git a/etc/unrar.profile b/etc/unrar.profile
index 8d8fda952..6a3ac5527 100644
--- a/etc/unrar.profile
+++ b/etc/unrar.profile
@@ -12,7 +12,9 @@ hostname unrar
 ignore noroot
 net none
 no3d
+nodvd
 nosound
+notv
 shell none
 tracelog
 
diff --git a/etc/unzip.profile b/etc/unzip.profile
index 6556b4f56..bb30d74cd 100644
--- a/etc/unzip.profile
+++ b/etc/unzip.profile
@@ -12,7 +12,9 @@ hostname unzip
 ignore noroot
 net none
 no3d
+nodvd
 nosound
+notv
 shell none
 tracelog
 
diff --git a/etc/uudeview.profile b/etc/uudeview.profile
index 22457bf2c..192d13f80 100644
--- a/etc/uudeview.profile
+++ b/etc/uudeview.profile
@@ -10,7 +10,9 @@ include /etc/firejail/globals.local
 hostname uudeview
 ignore noroot
 net none
+nodvd
 nosound
+notv
 shell none
 tracelog
 
diff --git a/etc/uzbl-browser.profile b/etc/uzbl-browser.profile
index caae3659e..e7c931f30 100644
--- a/etc/uzbl-browser.profile
+++ b/etc/uzbl-browser.profile
@@ -25,8 +25,10 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 tracelog
diff --git a/etc/viewnior.profile b/etc/viewnior.profile
index 9235d149c..a02845885 100644
--- a/etc/viewnior.profile
+++ b/etc/viewnior.profile
@@ -19,10 +19,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/viking.profile b/etc/viking.profile
index aa26388f8..30e89b511 100644
--- a/etc/viking.profile
+++ b/etc/viking.profile
@@ -16,10 +16,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/vim.profile b/etc/vim.profile
index 815676da8..7b5566f5b 100644
--- a/etc/vim.profile
+++ b/etc/vim.profile
@@ -15,8 +15,10 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/virtualbox.profile b/etc/virtualbox.profile
index e94dec35c..6e153d559 100644
--- a/etc/virtualbox.profile
+++ b/etc/virtualbox.profile
@@ -24,3 +24,5 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
+notv
diff --git a/etc/vivaldi-beta.profile b/etc/vivaldi-beta.profile
index 4fa8a877c..d1ceb74f4 100644
--- a/etc/vivaldi-beta.profile
+++ b/etc/vivaldi-beta.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/vivaldi.profile
diff --git a/etc/vivaldi-stable.profile b/etc/vivaldi-stable.profile
index 4fa8a877c..d1ceb74f4 100644
--- a/etc/vivaldi-stable.profile
+++ b/etc/vivaldi-stable.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/vivaldi.profile
diff --git a/etc/vivaldi.profile b/etc/vivaldi.profile
index ae9b49e8c..503916b26 100644
--- a/etc/vivaldi.profile
+++ b/etc/vivaldi.profile
@@ -21,7 +21,9 @@ include /etc/firejail/whitelist-common.inc
 
 caps.keep sys_chroot,sys_admin
 netfilter
+nodvd
 nogroups
+notv
 shell none
 
 private-dev
diff --git a/etc/vym.profile b/etc/vym.profile
index f769dda16..4f60b2ada 100644
--- a/etc/vym.profile
+++ b/etc/vym.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/w3m.profile b/etc/w3m.profile
index fc5ee2bad..b25e19135 100644
--- a/etc/w3m.profile
+++ b/etc/w3m.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/warzone2100.profile b/etc/warzone2100.profile
index 9569226aa..976f7db5f 100644
--- a/etc/warzone2100.profile
+++ b/etc/warzone2100.profile
@@ -20,9 +20,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/waterfox.profile b/etc/waterfox.profile
index 893d45719..76b7c86ba 100644
--- a/etc/waterfox.profile
+++ b/etc/waterfox.profile
@@ -52,9 +52,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/weechat-curses.profile b/etc/weechat-curses.profile
index 2d3f6c963..0da7d45d6 100644
--- a/etc/weechat-curses.profile
+++ b/etc/weechat-curses.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/weechat.profile
diff --git a/etc/weechat.profile b/etc/weechat.profile
index 833414f3e..b0971ae19 100644
--- a/etc/weechat.profile
+++ b/etc/weechat.profile
@@ -12,8 +12,10 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 
diff --git a/etc/wesnoth.profile b/etc/wesnoth.profile
index 9798e0ace..d6318c81b 100644
--- a/etc/wesnoth.profile
+++ b/etc/wesnoth.profile
@@ -23,8 +23,10 @@ whitelist ${HOME}/.local/share/wesnoth
 include /etc/firejail/whitelist-common.inc
 
 caps.drop all
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 
diff --git a/etc/wget.profile b/etc/wget.profile
index 7ab24aa8f..5072cb9c5 100644
--- a/etc/wget.profile
+++ b/etc/wget.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/wine.profile b/etc/wine.profile
index 00eea2b7c..b1bc7df78 100644
--- a/etc/wine.profile
+++ b/etc/wine.profile
@@ -17,7 +17,9 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 seccomp
diff --git a/etc/wire.profile b/etc/wire.profile
index aacea9940..af14f686f 100644
--- a/etc/wire.profile
+++ b/etc/wire.profile
@@ -18,9 +18,11 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
diff --git a/etc/wireshark-gtk.profile b/etc/wireshark-gtk.profile
index 35a76a978..38599b85e 100644
--- a/etc/wireshark-gtk.profile
+++ b/etc/wireshark-gtk.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/wireshark.profile
diff --git a/etc/wireshark-qt.profile b/etc/wireshark-qt.profile
index 35a76a978..38599b85e 100644
--- a/etc/wireshark-qt.profile
+++ b/etc/wireshark-qt.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/wireshark.profile
diff --git a/etc/wireshark.profile b/etc/wireshark.profile
index 8a25ec011..57f4f2f5b 100644
--- a/etc/wireshark.profile
+++ b/etc/wireshark.profile
@@ -18,7 +18,9 @@ no3d
 # nogroups - breaks unprivileged wireshark usage
 # nonewprivs - breaks unprivileged wireshark usage
 # noroot
+nodvd
 nosound
+notv
 # protocol unix,inet,inet6,netlink
 # seccomp - breaks unprivileged wireshark usage
 shell none
diff --git a/etc/xchat.profile b/etc/xchat.profile
index 795e7ecd6..ab62160b5 100644
--- a/etc/xchat.profile
+++ b/etc/xchat.profile
@@ -12,8 +12,10 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 
diff --git a/etc/xed.profile b/etc/xed.profile
index 17d0ad9d9..758fb5526 100644
--- a/etc/xed.profile
+++ b/etc/xed.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 seccomp
 shell none
 tracelog
diff --git a/etc/xfburn.profile b/etc/xfburn.profile
index dbacf6462..e80685f0e 100644
--- a/etc/xfburn.profile
+++ b/etc/xfburn.profile
@@ -14,10 +14,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/xfce4-dict.profile b/etc/xfce4-dict.profile
index 26f65ee1c..ab52d17e9 100644
--- a/etc/xfce4-dict.profile
+++ b/etc/xfce4-dict.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/xfce4-notes.profile b/etc/xfce4-notes.profile
index 6f026c2e7..868b4796b 100644
--- a/etc/xfce4-notes.profile
+++ b/etc/xfce4-notes.profile
@@ -17,10 +17,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/xiphos.profile b/etc/xiphos.profile
index eb894d8b5..38e568860 100644
--- a/etc/xiphos.profile
+++ b/etc/xiphos.profile
@@ -22,10 +22,12 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/xmms.profile b/etc/xmms.profile
index d2cf00a36..d2e6eddac 100644
--- a/etc/xmms.profile
+++ b/etc/xmms.profile
@@ -17,6 +17,7 @@ netfilter
 no3d
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/xonotic-glx.profile b/etc/xonotic-glx.profile
index 8be8b2d7b..041a063bb 100644
--- a/etc/xonotic-glx.profile
+++ b/etc/xonotic-glx.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/xonotic.profile
diff --git a/etc/xonotic-sdl.profile b/etc/xonotic-sdl.profile
index 8be8b2d7b..041a063bb 100644
--- a/etc/xonotic-sdl.profile
+++ b/etc/xonotic-sdl.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/xonotic.profile
diff --git a/etc/xonotic.profile b/etc/xonotic.profile
index 95a2a2dbd..c7db00daf 100644
--- a/etc/xonotic.profile
+++ b/etc/xonotic.profile
@@ -18,9 +18,11 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nogroups
 nonewprivs
 noroot
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/xpdf.profile b/etc/xpdf.profile
index be69ebe1a..f34358521 100644
--- a/etc/xpdf.profile
+++ b/etc/xpdf.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 caps.drop all
 net none
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix
 seccomp
diff --git a/etc/xplayer.profile b/etc/xplayer.profile
index afa3deac6..0722768d1 100644
--- a/etc/xplayer.profile
+++ b/etc/xplayer.profile
@@ -18,6 +18,7 @@ netfilter
 nogroups
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 shell none
diff --git a/etc/xpra.profile b/etc/xpra.profile
index ed393d70b..2bd91e8b5 100644
--- a/etc/xpra.profile
+++ b/etc/xpra.profile
@@ -21,15 +21,19 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 whitelist /var/lib/xkb
-include /etc/firejail/whitelist-common.inc
+# whitelisting home directory, or including whitelist-common.inc
+# will crash xpra on some platforms
 
 caps.drop all
 # xpra needs to be allowed access to the abstract Unix socket namespace.
+nodvd
 nogroups
 nonewprivs
 # In noroot mode, xpra cannot create a socket in the real /tmp/.X11-unix.
 #noroot
 nosound
+notv
+novideo
 protocol unix
 seccomp
 shell none
diff --git a/etc/xreader.profile b/etc/xreader.profile
index 2abe569c5..107cefe5e 100644
--- a/etc/xreader.profile
+++ b/etc/xreader.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/xviewer.profile b/etc/xviewer.profile
index 7c9886b29..70ad3b895 100644
--- a/etc/xviewer.profile
+++ b/etc/xviewer.profile
@@ -16,10 +16,12 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
 caps.drop all
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/xz.profile b/etc/xz.profile
index b552f59c0..d77fc85b4 100644
--- a/etc/xz.profile
+++ b/etc/xz.profile
@@ -2,4 +2,5 @@
 # This file is overwritten after every install/update
 
 
+# Redirect
 include /etc/firejail/cpio.profile
diff --git a/etc/xzdec.profile b/etc/xzdec.profile
index 0d5b8dda6..7f21f5d2f 100644
--- a/etc/xzdec.profile
+++ b/etc/xzdec.profile
@@ -11,7 +11,9 @@ blacklist /tmp/.X11-unix
 ignore noroot
 net none
 no3d
+nodvd
 nosound
+notv
 shell none
 tracelog
 
diff --git a/etc/youtube-dl.profile b/etc/youtube-dl.profile
index fea7284c8..e20fb3e99 100644
--- a/etc/youtube-dl.profile
+++ b/etc/youtube-dl.profile
@@ -17,10 +17,12 @@ caps.drop all
 ipc-namespace
 netfilter
 no3d
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 novideo
 protocol unix,inet,inet6
 seccomp
diff --git a/etc/zathura.profile b/etc/zathura.profile
index 0552f85a9..0036a3521 100644
--- a/etc/zathura.profile
+++ b/etc/zathura.profile
@@ -15,10 +15,12 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 net none
+nodvd
 nogroups
 nonewprivs
 noroot
 nosound
+notv
 protocol unix
 seccomp
 shell none
diff --git a/etc/zoom.profile b/etc/zoom.profile
index 4ef756d9f..381df9ab5 100644
--- a/etc/zoom.profile
+++ b/etc/zoom.profile
@@ -18,8 +18,10 @@ include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
+nodvd
 nonewprivs
 noroot
+notv
 protocol unix,inet,inet6
 seccomp
 
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index afd22c041..360ac8921 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -298,6 +298,7 @@
 /etc/firejail/transmission-qt.profile
 /etc/firejail/transmission-show.profile
 /etc/firejail/truecraft.profile
+/etc/firejail/tuxguitar.profile
 /etc/firejail/uget-gtk.profile
 /etc/firejail/unbound.profile
 /etc/firejail/unknown-horizons.profile
diff --git a/platform/rpm/firejail.spec b/platform/rpm/firejail.spec
index ab908ef49..fa92ded94 100644
--- a/platform/rpm/firejail.spec
+++ b/platform/rpm/firejail.spec
@@ -3,7 +3,7 @@ Version: __VERSION__
 Release: 1
 Summary: Linux namepaces sandbox program
 
-License: GPL+
+License: GPLv2+
 Group: Development/Tools
 Source0: https://github.com/netblue30/firejail/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz
 URL: http://github.com/netblue30/firejail
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index bcf2ced1e..d66b026b0 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -80,6 +80,7 @@ file-roller
 filezilla
 firefox
 firefox-esr
+firefox-nightly
 flashpeak-slimjet
 flowblade
 fontforge
@@ -267,6 +268,7 @@ transmission-gtk
 transmission-qt
 transmission-show
 truecraft
+tuxguitar
 uget-gtk
 unbound
 unknown-horizons
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 86f730aa0..5f16d1a5d 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -57,6 +57,7 @@
 #define RUN_SECCOMP_AMD64       "/run/firejail/mnt/seccomp.amd64"       // amd64 filter installed on i386 architectures
 #define RUN_SECCOMP_I386        "/run/firejail/mnt/seccomp.i386"                // i386 filter installed on amd64 architectures
 #define RUN_SECCOMP_MDWX        "/run/firejail/mnt/seccomp.mdwx"                // filter for memory-deny-write-execute
+#define RUN_SECCOMP_POSTEXEC    "/run/firejail/mnt/seccomp.postexec"            // filter for post-exec library
 #define PATH_SECCOMP_DEFAULT (LIBDIR "/firejail/seccomp")                       // default filter built during make
 #define PATH_SECCOMP_DEFAULT_DEBUG (LIBDIR "/firejail/seccomp.debug")   // default filter built during make
 #define PATH_SECCOMP_AMD64 (LIBDIR "/firejail/seccomp.amd64")           // amd64 filter built during make
@@ -305,6 +306,7 @@ extern int arg_overlay_keep;	// place overlay diff in a known directory
 extern int arg_overlay_reuse;   // allow the reuse of overlays
 
 extern int arg_seccomp; // enable default seccomp filter
+extern int arg_seccomp_postexec;        // need postexec ld.preload library?
 
 extern int arg_caps_default_filter;     // enable default capabilities filter
 extern int arg_caps_drop;               // drop list
@@ -360,6 +362,8 @@ extern int arg_machineid;	// preserve /etc/machine-id
 extern int arg_disable_mnt;     // disable /mnt and /media
 extern int arg_noprofile;       // use default.profile if none other found/specified
 extern int arg_memory_deny_write_execute;       // block writable and executable memory
+extern int arg_notv;    // --notv
+extern int arg_nodvd;   // --nodvd
 
 extern int login_shell;
 extern int parent_to_child_fds[2];
@@ -512,6 +516,8 @@ void fs_private_dev(void);
 void fs_dev_disable_sound(void);
 void fs_dev_disable_3d(void);
 void fs_dev_disable_video(void);
+void fs_dev_disable_tv(void);
+void fs_dev_disable_dvd(void);
 
 // fs_home.c
 // private mode (--private)
@@ -549,8 +555,6 @@ void caps_drop_dac_override(void);
 
 // syscall.c
 const char *syscall_find_nr(int nr);
-// return -1 if error, 0 if no error
-int syscall_check_list(const char *slist, void (*callback)(int syscall, int arg), int arg);
 
 // fs_trace.c
 void fs_trace_preload(void);
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
index fdaa0b355..0dbbb65a0 100644
--- a/src/firejail/fs_dev.c
+++ b/src/firejail/fs_dev.c
@@ -31,41 +31,52 @@
 #include <sys/sysmacros.h>
 #include <sys/types.h>
 
+// device type
+typedef enum {
+        DEV_NONE = 0,
+        DEV_SOUND,
+        DEV_3D,
+        DEV_VIDEO,
+        DEV_TV,
+        DEV_DVD,
+} DEV_TYPE;
+
+
 typedef struct {
         const char *dev_fname;
         const char *run_fname;
-        int sound;
-        int hw3d;
-        int video;
+        DEV_TYPE  type;
 } DevEntry;
 
 static DevEntry dev[] = {
-        {"/dev/snd", RUN_DEV_DIR "/snd", 1, 0, 0},      // sound device
-        {"/dev/dri", RUN_DEV_DIR "/dri", 0, 1, 0},              // 3d device
-        {"/dev/nvidia0", RUN_DEV_DIR "/nvidia0", 0, 1, 0},
-        {"/dev/nvidia1", RUN_DEV_DIR "/nvidia1", 0, 1, 0},
-        {"/dev/nvidia2", RUN_DEV_DIR "/nvidia2", 0, 1, 0},
-        {"/dev/nvidia3", RUN_DEV_DIR "/nvidia3", 0, 1, 0},
-        {"/dev/nvidia4", RUN_DEV_DIR "/nvidia4", 0, 1, 0},
-        {"/dev/nvidia5", RUN_DEV_DIR "/nvidia5", 0, 1, 0},
-        {"/dev/nvidia6", RUN_DEV_DIR "/nvidia6", 0, 1, 0},
-        {"/dev/nvidia7", RUN_DEV_DIR "/nvidia7", 0, 1, 0},
-        {"/dev/nvidia8", RUN_DEV_DIR "/nvidia8", 0, 1, 0},
-        {"/dev/nvidia9", RUN_DEV_DIR "/nvidia9", 0, 1, 0},
-        {"/dev/nvidiactl", RUN_DEV_DIR "/nvidiactl", 0, 1, 0},
-        {"/dev/nvidia-modeset", RUN_DEV_DIR "/nvidia-modeset", 0, 1, 0},
-        {"/dev/nvidia-uvm", RUN_DEV_DIR "/nvidia-uvm", 0, 1, 0},
-        {"/dev/video0", RUN_DEV_DIR "/video0", 0, 0, 1}, // video camera devices
-        {"/dev/video1", RUN_DEV_DIR "/video1", 0, 0, 1},
-        {"/dev/video2", RUN_DEV_DIR "/video2", 0, 0, 1},
-        {"/dev/video3", RUN_DEV_DIR "/video3", 0, 0, 1},
-        {"/dev/video4", RUN_DEV_DIR "/video4", 0, 0, 1},
-        {"/dev/video5", RUN_DEV_DIR "/video5", 0, 0, 1},
-        {"/dev/video6", RUN_DEV_DIR "/video6", 0, 0, 1},
-        {"/dev/video7", RUN_DEV_DIR "/video7", 0, 0, 1},
-        {"/dev/video8", RUN_DEV_DIR "/video8", 0, 0, 1},
-        {"/dev/video9", RUN_DEV_DIR "/video9", 0, 0, 1},
-        {NULL, NULL, 0, 0, 0}
+        {"/dev/snd", RUN_DEV_DIR "/snd", DEV_SOUND},    // sound device
+        {"/dev/dri", RUN_DEV_DIR "/dri", DEV_3D},               // 3d device
+        {"/dev/nvidia0", RUN_DEV_DIR "/nvidia0", DEV_3D},
+        {"/dev/nvidia1", RUN_DEV_DIR "/nvidia1", DEV_3D},
+        {"/dev/nvidia2", RUN_DEV_DIR "/nvidia2", DEV_3D},
+        {"/dev/nvidia3", RUN_DEV_DIR "/nvidia3", DEV_3D},
+        {"/dev/nvidia4", RUN_DEV_DIR "/nvidia4", DEV_3D},
+        {"/dev/nvidia5", RUN_DEV_DIR "/nvidia5", DEV_3D},
+        {"/dev/nvidia6", RUN_DEV_DIR "/nvidia6", DEV_3D},
+        {"/dev/nvidia7", RUN_DEV_DIR "/nvidia7", DEV_3D},
+        {"/dev/nvidia8", RUN_DEV_DIR "/nvidia8", DEV_3D},
+        {"/dev/nvidia9", RUN_DEV_DIR "/nvidia9", DEV_3D},
+        {"/dev/nvidiactl", RUN_DEV_DIR "/nvidiactl", DEV_3D},
+        {"/dev/nvidia-modeset", RUN_DEV_DIR "/nvidia-modeset", DEV_3D},
+        {"/dev/nvidia-uvm", RUN_DEV_DIR "/nvidia-uvm", DEV_3D},
+        {"/dev/video0", RUN_DEV_DIR "/video0", DEV_VIDEO}, // video camera devices
+        {"/dev/video1", RUN_DEV_DIR "/video1", DEV_VIDEO},
+        {"/dev/video2", RUN_DEV_DIR "/video2", DEV_VIDEO},
+        {"/dev/video3", RUN_DEV_DIR "/video3", DEV_VIDEO},
+        {"/dev/video4", RUN_DEV_DIR "/video4", DEV_VIDEO},
+        {"/dev/video5", RUN_DEV_DIR "/video5", DEV_VIDEO},
+        {"/dev/video6", RUN_DEV_DIR "/video6", DEV_VIDEO},
+        {"/dev/video7", RUN_DEV_DIR "/video7", DEV_VIDEO},
+        {"/dev/video8", RUN_DEV_DIR "/video8", DEV_VIDEO},
+        {"/dev/video9", RUN_DEV_DIR "/video9", DEV_VIDEO},
+        {"/dev/dvb", RUN_DEV_DIR "/dvb", DEV_TV}, // DVB (Digital Video Broadcasting) - TV device
+        {"/dev/sr0", RUN_DEV_DIR "/sr0", DEV_DVD}, // for DVD and audio CD players
+        {NULL, NULL, DEV_NONE}
 };
 
 static void deventry_mount(void) {
@@ -73,31 +84,40 @@ static void deventry_mount(void) {
         while (dev[i].dev_fname != NULL) {
                 struct stat s;
                 if (stat(dev[i].run_fname, &s) == 0) {
-                        int dir = is_dir(dev[i].run_fname);
-                        if (arg_debug)
-                                printf("mounting %s %s\n", dev[i].run_fname, (dir)? "directory": "file");
-                        if (dir) {
-                                mkdir_attr(dev[i].dev_fname, 0755, 0, 0);
-                        }
-                        else {
-                                struct stat s;
-                                if (stat(dev[i].run_fname, &s) == -1) {
-                                        if (arg_debug)
-                                                fwarning("cannot stat %s file\n", dev[i].run_fname);
-                                        i++;
-                                        continue;
+                        
+                        // check device type and subsystem configuration
+                        if ((dev[i].type == DEV_SOUND && arg_nosound == 0) ||
+                            (dev[i].type == DEV_3D && arg_no3d == 0) ||
+                            (dev[i].type == DEV_VIDEO && arg_novideo == 0) ||
+                            (dev[i].type == DEV_TV && arg_notv == 0) ||
+                            (dev[i].type == DEV_DVD && arg_nodvd == 0)) {
+                        
+                                int dir = is_dir(dev[i].run_fname);
+                                if (arg_debug)
+                                        printf("mounting %s %s\n", dev[i].run_fname, (dir)? "directory": "file");
+                                if (dir) {
+                                        mkdir_attr(dev[i].dev_fname, 0755, 0, 0);
                                 }
-                                FILE *fp = fopen(dev[i].dev_fname, "w");
-                                if (fp) {
-                                        fprintf(fp, "\n");
-                                        SET_PERMS_STREAM(fp, s.st_uid, s.st_gid, s.st_mode);
-                                        fclose(fp);
+                                else {
+                                        struct stat s;
+                                        if (stat(dev[i].run_fname, &s) == -1) {
+                                                if (arg_debug)
+                                                        fwarning("cannot stat %s file\n", dev[i].run_fname);
+                                                i++;
+                                                continue;
+                                        }
+                                        FILE *fp = fopen(dev[i].dev_fname, "w");
+                                        if (fp) {
+                                                fprintf(fp, "\n");
+                                                SET_PERMS_STREAM(fp, s.st_uid, s.st_gid, s.st_mode);
+                                                fclose(fp);
+                                        }
                                 }
+        
+                                if (mount(dev[i].run_fname, dev[i].dev_fname, NULL, MS_BIND|MS_REC, NULL) < 0)
+                                        errExit("mounting dev file");
+                                fs_logger2("whitelist", dev[i].dev_fname);
                         }
-
-                        if (mount(dev[i].run_fname, dev[i].dev_fname, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mounting dev file");
-                        fs_logger2("whitelist", dev[i].dev_fname);
                 }
 
                 i++;
@@ -140,7 +160,7 @@ void fs_private_dev(void){
         // keep a copy of dev directory
         mkdir_attr(RUN_DEV_DIR, 0755, 0, 0);
         if (mount("/dev", RUN_DEV_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                errExit("mounting /dev/dri");
+                errExit("mounting /dev");
 
         // create DEVLOG_FILE
         int have_devlog = 0;
@@ -163,6 +183,7 @@ void fs_private_dev(void){
                 errExit("mounting /dev");
         fs_logger("tmpfs /dev");
 
+        // optional devices: sound, video cards etc...
         deventry_mount();
 
         // bring back /dev/log
@@ -177,8 +198,7 @@ void fs_private_dev(void){
                 }
         }
         if (mount(RUN_RO_DIR, RUN_DEV_DIR, "none", MS_BIND, "mode=400,gid=0") < 0)
-                errExit("disable /dev/snd");
-
+                errExit("disable run dev directory");
 
         // create /dev/shm
         if (arg_debug)
@@ -186,7 +206,7 @@ void fs_private_dev(void){
         mkdir_attr("/dev/shm", 01777, 0, 0);
         fs_logger("mkdir /dev/shm");
 
-        // create devices
+        // create default devices
         create_char_dev("/dev/zero", 0666, 1, 5); // mknod -m 666 /dev/zero c 1 5
         fs_logger("mknod /dev/zero");
         create_char_dev("/dev/null", 0666, 1, 3); // mknod -m 666 /dev/null c 1 3
@@ -234,6 +254,14 @@ void fs_private_dev(void){
         create_link("/proc/self/fd/1", "/dev/stdout");
         create_link("/proc/self/fd/2", "/dev/stderr");
 #endif
+
+        // symlinks for DVD/CD players
+        if (stat("/dev/sr0", &s) == 0) {
+                create_link("/dev/sr0", "/dev/cdrom");
+                create_link("/dev/sr0", "/dev/cdrw");
+                create_link("/dev/sr0", "/dev/dvd");
+                create_link("/dev/sr0", "/dev/dvdrw");
+        }
 }
 
 
@@ -294,7 +322,7 @@ static void disable_file_or_dir(const char *fname) {
 void fs_dev_disable_sound(void) {
         int i = 0;
         while (dev[i].dev_fname != NULL) {
-                if (dev[i].sound)
+                if (dev[i].type == DEV_SOUND)
                         disable_file_or_dir(dev[i].dev_fname);
                 i++;
         }
@@ -303,7 +331,7 @@ void fs_dev_disable_sound(void) {
 void fs_dev_disable_video(void) {
         int i = 0;
         while (dev[i].dev_fname != NULL) {
-                if (dev[i].video)
+                if (dev[i].type == DEV_VIDEO)
                         disable_file_or_dir(dev[i].dev_fname);
                 i++;
         }
@@ -312,7 +340,25 @@ void fs_dev_disable_video(void) {
 void fs_dev_disable_3d(void) {
         int i = 0;
         while (dev[i].dev_fname != NULL) {
-                if (dev[i].hw3d)
+                if (dev[i].type == DEV_3D)
+                        disable_file_or_dir(dev[i].dev_fname);
+                i++;
+        }
+}
+
+void fs_dev_disable_tv(void) {
+        int i = 0;
+        while (dev[i].dev_fname != NULL) {
+                if (dev[i].type == DEV_TV)
+                        disable_file_or_dir(dev[i].dev_fname);
+                i++;
+        }
+}
+
+void fs_dev_disable_dvd(void) {
+        int i = 0;
+        while (dev[i].dev_fname != NULL) {
+                if (dev[i].type == DEV_DVD)
                         disable_file_or_dir(dev[i].dev_fname);
                 i++;
         }
diff --git a/src/firejail/fs_trace.c b/src/firejail/fs_trace.c
index df76f4fe1..c87d29b5c 100644
--- a/src/firejail/fs_trace.c
+++ b/src/firejail/fs_trace.c
@@ -63,6 +63,11 @@ void fs_trace(void) {
                 if (!arg_quiet)
                         printf("Blacklist violations are logged to syslog\n");
         }
+        if (arg_seccomp_postexec) {
+                fprintf(fp, "%s/libpostexecseccomp.so\n", prefix);
+                if (!arg_quiet)
+                        printf("Post-exec seccomp protector enabled\n");
+        }
 
         SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
         fclose(fp);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 9cff080a0..9726c0b8a 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -56,6 +56,7 @@ int arg_overlay_keep = 0;			// place overlay diff in a known directory
 int arg_overlay_reuse = 0;                      // allow the reuse of overlays
 
 int arg_seccomp = 0;                            // enable default seccomp filter
+int arg_seccomp_postexec = 0;                   // need postexec ld.preload library?
 
 int arg_caps_default_filter = 0;                        // enable default capabilities filter
 int arg_caps_drop = 0;                          // drop list
@@ -112,7 +113,8 @@ int arg_writable_var_log = 0;		// writable /var/log
 int arg_disable_mnt = 0;                        // disable /mnt and /media
 int arg_noprofile = 0; // use default.profile if none other found/specified
 int arg_memory_deny_write_execute = 0;          // block writable and executable memory
-
+int arg_notv = 0;       // --notv
+int arg_nodvd = 0; // --nodvd
 int login_shell = 0;
 
 
@@ -1021,7 +1023,7 @@ int main(int argc, char **argv) {
         }
         else {
                 // check --output option and execute it;
-                check_output(argc, argv); // the function will not return if --output option was found
+                check_output(argc, argv); // the function will not return if --output or --output-stderr option was found
         }
 
 
@@ -1676,22 +1678,22 @@ int main(int argc, char **argv) {
                                 exit_err_feature("noroot");
                 }
 #endif
-                else if (strcmp(argv[i], "--nonewprivs") == 0) {
+                else if (strcmp(argv[i], "--nonewprivs") == 0)
                         arg_nonewprivs = 1;
-                }
                 else if (strncmp(argv[i], "--env=", 6) == 0)
                         env_store(argv[i] + 6, SETENV);
                 else if (strncmp(argv[i], "--rmenv=", 8) == 0)
                         env_store(argv[i] + 8, RMENV);
-                else if (strcmp(argv[i], "--nosound") == 0) {
+                else if (strcmp(argv[i], "--nosound") == 0)
                         arg_nosound = 1;
-                }
-                else if (strcmp(argv[i], "--novideo") == 0) {
+                else if (strcmp(argv[i], "--novideo") == 0)
                         arg_novideo = 1;
-                }
-                else if (strcmp(argv[i], "--no3d") == 0) {
+                else if (strcmp(argv[i], "--no3d") == 0)
                         arg_no3d = 1;
-                }
+                else if (strcmp(argv[i], "--notv") == 0)
+                        arg_notv = 1;
+                else if (strcmp(argv[i], "--nodvd") == 0)
+                        arg_nodvd = 1;
 
                 //*************************************
                 // network
diff --git a/src/firejail/output.c b/src/firejail/output.c
index 9fb4ad6b1..abdfa4d3b 100644
--- a/src/firejail/output.c
+++ b/src/firejail/output.c
@@ -27,12 +27,18 @@ void check_output(int argc, char **argv) {
 
         int i;
         int outindex = 0;
-
+        int enable_stderr = 0;
+        
         for (i = 1; i < argc; i++) {
                 if (strncmp(argv[i], "--output=", 9) == 0) {
                         outindex = i;
                         break;
                 }
+                if (strncmp(argv[i], "--output-stderr=", 16) == 0) {
+                        outindex = i;
+                        enable_stderr = 1;
+                        break;
+                }
         }
         if (!outindex)
                 return;
@@ -40,9 +46,9 @@ void check_output(int argc, char **argv) {
 
         // check filename
         drop_privs(0);
-        char *outfile = NULL;
-        invalid_filename(argv[outindex] + 9);
-        outfile = argv[outindex] + 9;
+        char *outfile = argv[outindex];
+        outfile += (enable_stderr)? 16:9;
+        invalid_filename(outfile);
 
         // do not accept directories, links, and files with ".."
         if (strstr(outfile, "..") || is_link(outfile) || is_dir(outfile)) {
@@ -80,9 +86,15 @@ void check_output(int argc, char **argv) {
         for (i = 0; i < argc; i++) {
                 if (strncmp(argv[i], "--output=", 9) == 0)
                         continue;
+                if (strncmp(argv[i], "--output-stderr=", 16) == 0)
+                        continue;
                 ptr += sprintf(ptr, "%s ", argv[i]);
         }
-        sprintf(ptr, "2>&1 | %s/firejail/ftee %s", LIBDIR, outfile);
+        
+        if (enable_stderr)
+                sprintf(ptr, "2>&1 | %s/firejail/ftee %s", LIBDIR, outfile);
+        else
+                sprintf(ptr, " | %s/firejail/ftee %s", LIBDIR, outfile);
 
         // run command
         char *a[4];
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c
index 9c474415d..583cc4610 100644
--- a/src/firejail/preproc.c
+++ b/src/firejail/preproc.c
@@ -85,9 +85,12 @@ void preproc_mount_mnt_dir(void) {
 
                 if (arg_memory_deny_write_execute)
                         copy_file(PATH_SECCOMP_MDWX, RUN_SECCOMP_MDWX, getuid(), getgid(), 0644); // root needed
-                // as root, create an empty RUN_SECCOMP_PROTOCOL file
+                // as root, create empty RUN_SECCOMP_PROTOCOL and RUN_SECCOMP_POSTEXEC files
                 create_empty_file_as_root(RUN_SECCOMP_PROTOCOL, 0644);
                 if (set_perms(RUN_SECCOMP_PROTOCOL, getuid(), getgid(), 0644))
                         errExit("set_perms");
+                create_empty_file_as_root(RUN_SECCOMP_POSTEXEC, 0644);
+                if (set_perms(RUN_SECCOMP_POSTEXEC, getuid(), getgid(), 0644))
+                        errExit("set_perms");
         }
 }
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 708251b0b..7753ee3b2 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -225,6 +225,14 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 arg_nosound = 1;
                 return 0;
         }
+        else if (strcmp(ptr, "notv") == 0) {
+                arg_notv = 1;
+                return 0;
+        }
+        else if (strcmp(ptr, "nodvd") == 0) {
+                arg_nodvd = 1;
+                return 0;
+        }
         else if (strcmp(ptr, "novideo") == 0) {
                 arg_novideo = 1;
                 return 0;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 6c0fdebe3..568549cbf 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -664,10 +664,15 @@ int sandbox(void* sandbox_arg) {
                 if (rv)
                         exit(rv);
         }
+        if (arg_seccomp && (cfg.seccomp_list || cfg.seccomp_list_drop || cfg.seccomp_list_keep))
+                arg_seccomp_postexec = 1;
 #endif
 
+        // need ld.so.preload if tracing or seccomp with any non-default lists
+        bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec;
+
         // trace pre-install
-        if (arg_trace || arg_tracelog)
+        if (need_preload)
                 fs_trace_preload();
 
         // store hosts file
@@ -704,7 +709,7 @@ int sandbox(void* sandbox_arg) {
                 //****************************
                 // trace pre-install, this time inside chroot
                 //****************************
-                if (arg_trace || arg_tracelog)
+                if (need_preload)
                         fs_trace_preload();
         }
         else
@@ -767,7 +772,7 @@ int sandbox(void* sandbox_arg) {
                 else {
                         fs_private_dir_list("/etc", RUN_ETC_DIR, cfg.etc_private_keep);
                         // create /etc/ld.so.preload file again
-                        if (arg_trace || arg_tracelog)
+                        if (need_preload)
                                 fs_trace_preload();
                 }
         }
@@ -876,7 +881,7 @@ int sandbox(void* sandbox_arg) {
         fs_blacklist(); // mkdir and mkfile are processed all over again
 
         //****************************
-        // nosound/no3d and fix for pulseaudio 7.0
+        // nosound/no3d/notv/novideo and fix for pulseaudio 7.0
         //****************************
         if (arg_nosound) {
                 // disable pulseaudio
@@ -891,18 +896,19 @@ int sandbox(void* sandbox_arg) {
         if (arg_no3d)
                 fs_dev_disable_3d();
 
-        //****************************
-        // novideo
-        //****************************
-        if (arg_novideo) {
-                // disable /dev/video*
+        if (arg_notv)
+                fs_dev_disable_tv();
+
+        if (arg_nodvd)
+                fs_dev_disable_dvd();
+
+        if (arg_novideo)
                 fs_dev_disable_video();
-        }
 
         //****************************
         // install trace
         //****************************
-        if (arg_trace || arg_tracelog)
+        if (need_preload)
                 fs_trace();
 
         //****************************
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 13d8d44fa..516c97fa0 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -41,7 +41,7 @@ char *seccomp_check_list(const char *str) {
         const char *ptr1 = str;
         char *ptr2 = rv;
         while (*ptr1 != '\0') {
-                if (isalnum(*ptr1) || *ptr1 == '_' || *ptr1 == ',' || *ptr1 == ':')
+                if (isalnum(*ptr1) || *ptr1 == '_' || *ptr1 == ',' || *ptr1 == ':' || *ptr1 == '@' || *ptr1 == '-')
                         *ptr2++ = *ptr1++;
                 else {
                         fprintf(stderr, "Error: invalid syscall list\n");
@@ -145,11 +145,11 @@ int seccomp_filter_drop(int enforce_seccomp) {
                         // build the seccomp filter as a regular user
                         int rv;
                         if (arg_allow_debuggers)
-                                rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 6,
-                                        PATH_FSECCOMP, "default", "drop", RUN_SECCOMP_CFG, cfg.seccomp_list, "allow-debuggers");
+                                rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 7,
+                                              PATH_FSECCOMP, "default", "drop", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list, "allow-debuggers");
                         else
-                                rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 5,
-                                        PATH_FSECCOMP, "default", "drop", RUN_SECCOMP_CFG, cfg.seccomp_list);
+                                rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 6,
+                                              PATH_FSECCOMP, "default", "drop", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list);
                         if (rv)
                                 exit(rv);
                 }
@@ -163,11 +163,11 @@ int seccomp_filter_drop(int enforce_seccomp) {
                 // build the seccomp filter as a regular user
                 int rv;
                 if (arg_allow_debuggers)
-                        rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 5,
-                                PATH_FSECCOMP, "drop", RUN_SECCOMP_CFG, cfg.seccomp_list_drop,  "allow-debuggers");
+                        rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 6,
+                                      PATH_FSECCOMP, "drop", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list_drop,  "allow-debuggers");
                 else
-                        rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4,
-                                PATH_FSECCOMP, "drop", RUN_SECCOMP_CFG, cfg.seccomp_list_drop);
+                        rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 5,
+                                PATH_FSECCOMP, "drop", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list_drop);
 
                 if (rv)
                         exit(rv);
@@ -183,9 +183,14 @@ int seccomp_filter_drop(int enforce_seccomp) {
                 exit(1);
         }
 
-        if (arg_debug && access(PATH_FSECCOMP, X_OK) == 0)
+        if (arg_debug && access(PATH_FSECCOMP, X_OK) == 0) {
                 sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3,
                         PATH_FSECCOMP, "print", RUN_SECCOMP_CFG);
+                struct stat st;
+                if (stat(RUN_SECCOMP_POSTEXEC, &st) != -1 && st.st_size != 0)
+                    sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3,
+                             PATH_FSECCOMP, "print", RUN_SECCOMP_POSTEXEC);
+        }
 
         return 0;
 }
@@ -196,14 +201,19 @@ int seccomp_filter_keep(void) {
                 printf("Build drop seccomp filter\n");
 
         // build the seccomp filter as a regular user
-        sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4,
-                PATH_FSECCOMP, "keep", RUN_SECCOMP_CFG, cfg.seccomp_list_keep);
+        sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 5,
+                 PATH_FSECCOMP, "keep", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list_keep);
         if (arg_debug)
                 printf("seccomp filter configured\n");
 
 
-        if (arg_debug && access(PATH_FSECCOMP, X_OK) == 0)
+        if (arg_debug && access(PATH_FSECCOMP, X_OK) == 0) {
                 sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FSECCOMP, "print", RUN_SECCOMP_CFG);
+                struct stat st;
+                if (stat(RUN_SECCOMP_POSTEXEC, &st) != -1 && st.st_size != 0)
+                    sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FSECCOMP, "print", RUN_SECCOMP_POSTEXEC);
+        }
+
         return seccomp_load(RUN_SECCOMP_CFG);
 }
 
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 71bb6f24e..b9ab00eae 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -134,11 +134,12 @@ void usage(void) {
         printf("    --novideo - disable video devices.\n");
         printf("    --nowhitelist=filename - disable whitelist for file or directory .\n");
         printf("    --output=logfile - stdout logging and log rotation.\n");
+        printf("    --output-stderr=logfile - stdout and stderr logging and log rotation.\n");
         printf("    --overlay - mount a filesystem overlay on top of the current filesystem.\n");
         printf("    --overlay-named=name - mount a filesystem overlay on top of the current\n");
         printf("\tfilesystem, and store it in name directory.\n");
-        printf("    --overlay-tmpfs - mount a temporary filesystem overlay on top of the current\n");
-        printf("\tfilesystem.\n");
+        printf("    --overlay-tmpfs - mount a temporary filesystem overlay on top of the\n");
+        printf("\tcurrent filesystem.\n");
         printf("    --overlay-clean - clean all overlays stored in $HOME/.firejail directory.\n");
         printf("    --private - temporary home directory.\n");
         printf("    --private=directory - use directory as user home.\n");
diff --git a/src/fseccomp/fseccomp.h b/src/fseccomp/fseccomp.h
index 0db670380..144b612ae 100644
--- a/src/fseccomp/fseccomp.h
+++ b/src/fseccomp/fseccomp.h
@@ -30,8 +30,9 @@ extern int arg_quiet;
 
 // syscall.c
 void syscall_print(void);
-int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, int arg), int fd, int arg);
+int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, int arg, void *ptrarg), int fd, int arg, void *ptrarg);
 const char *syscall_find_nr(int nr);
+void syscalls_in_list(const char *list, const char *slist, int fd, char **prelist, char **postlist);
 
 // errno.c
 void errno_print(void);
@@ -49,9 +50,9 @@ void seccomp_secondary_32(const char *fname);
 // seccomp_file.c
 void write_to_file(int fd, const void *data, int size);
 void filter_init(int fd);
-void filter_add_whitelist(int fd, int syscall, int arg);
-void filter_add_blacklist(int fd, int syscall, int arg);
-void filter_add_errno(int fd, int syscall, int arg);
+void filter_add_whitelist(int fd, int syscall, int arg, void *ptrarg);
+void filter_add_blacklist(int fd, int syscall, int arg, void *ptrarg);
+void filter_add_errno(int fd, int syscall, int arg, void *ptrarg);
 void filter_end_blacklist(int fd);
 void filter_end_whitelist(int fd);
 
@@ -59,11 +60,11 @@ void filter_end_whitelist(int fd);
 // default list
 void seccomp_default(const char *fname, int allow_debuggers);
 // drop list
-void seccomp_drop(const char *fname, char *list, int allow_debuggers);
+void seccomp_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers);
 // default+drop list
-void seccomp_default_drop(const char *fname, char *list, int allow_debuggers);
+void seccomp_default_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers);
 // whitelisted filter
-void seccomp_keep(const char *fname, char *list);
+void seccomp_keep(const char *fname1, const char *fname2, char *list);
 // block writable and executable memory
 void memory_deny_write_execute(const char *fname);
 
diff --git a/src/fseccomp/main.c b/src/fseccomp/main.c
index 3d95d5bb2..3bf7de0fa 100644
--- a/src/fseccomp/main.c
+++ b/src/fseccomp/main.c
@@ -30,11 +30,11 @@ static void usage(void) {
         printf("\tfseccomp secondary 32 file\n");
         printf("\tfseccomp default file\n");
         printf("\tfseccomp default file allow-debuggers\n");
-        printf("\tfseccomp drop file list\n");
-        printf("\tfseccomp drop file list allow-debuggers\n");
-        printf("\tfseccomp default drop file list\n");
-        printf("\tfseccomp default drop file list allow-debuggers\n");
-        printf("\tfseccomp keep file list\n");
+        printf("\tfseccomp drop file1 file2 list\n");
+        printf("\tfseccomp drop file1 file2 list allow-debuggers\n");
+        printf("\tfseccomp default drop file1 file2 list\n");
+        printf("\tfseccomp default drop file1 file2 list allow-debuggers\n");
+        printf("\tfseccomp keep file1 file2 list\n");
         printf("\tfseccomp memory-deny-write-execute file\n");
         printf("\tfseccomp print file\n");
 }
@@ -78,16 +78,16 @@ printf("\n");
                 seccomp_default(argv[2], 0);
         else if (argc == 4 && strcmp(argv[1], "default") == 0 && strcmp(argv[3], "allow-debuggers") == 0)
                 seccomp_default(argv[2], 1);
-        else if (argc == 4 && strcmp(argv[1], "drop") == 0)
-                seccomp_drop(argv[2], argv[3], 0);
-        else if (argc == 5 && strcmp(argv[1], "drop") == 0 && strcmp(argv[4], "allow-debuggers") == 0)
-                seccomp_drop(argv[2], argv[3], 1);
-        else if (argc == 5 && strcmp(argv[1], "default") == 0 && strcmp(argv[2], "drop") == 0)
-                seccomp_default_drop(argv[3], argv[4], 0);
-        else if (argc == 6 && strcmp(argv[1], "default") == 0 && strcmp(argv[2], "drop") == 0 && strcmp(argv[5], "allow-debuggers") == 0)
-                seccomp_default_drop(argv[3], argv[4], 1);
-        else if (argc == 4 && strcmp(argv[1], "keep") == 0)
-                seccomp_keep(argv[2], argv[3]);
+        else if (argc == 5 && strcmp(argv[1], "drop") == 0)
+                seccomp_drop(argv[2], argv[3], argv[4], 0);
+        else if (argc == 6 && strcmp(argv[1], "drop") == 0 && strcmp(argv[5], "allow-debuggers") == 0)
+                seccomp_drop(argv[2], argv[3], argv[4], 1);
+        else if (argc == 6 && strcmp(argv[1], "default") == 0 && strcmp(argv[2], "drop") == 0)
+                seccomp_default_drop(argv[3], argv[4], argv[5], 0);
+        else if (argc == 7 && strcmp(argv[1], "default") == 0 && strcmp(argv[2], "drop") == 0 && strcmp(argv[6], "allow-debuggers") == 0)
+                seccomp_default_drop(argv[3], argv[4], argv[5], 1);
+        else if (argc == 5 && strcmp(argv[1], "keep") == 0)
+                seccomp_keep(argv[2], argv[3], argv[4]);
         else if (argc == 3 && strcmp(argv[1], "memory-deny-write-execute") == 0)
                 memory_deny_write_execute(argv[2]);
         else if (argc == 3 && strcmp(argv[1], "print") == 0)
diff --git a/src/fseccomp/seccomp.c b/src/fseccomp/seccomp.c
index a3db46aad..c49681476 100644
--- a/src/fseccomp/seccomp.c
+++ b/src/fseccomp/seccomp.c
@@ -27,9 +27,9 @@
 static void add_default_list(int fd, int allow_debuggers) {
         int r;
         if (!allow_debuggers)
-                r = syscall_check_list("@default-nodebuggers", filter_add_blacklist, fd, 0);
+                r = syscall_check_list("@default-nodebuggers", filter_add_blacklist, fd, 0, NULL);
         else
-                r = syscall_check_list("@default", filter_add_blacklist, fd, 0);
+                r = syscall_check_list("@default", filter_add_blacklist, fd, 0, NULL);
 
         assert(r == 0);
 //#ifdef SYS_mknod - emoved in 0.9.29 - it breaks Zotero extension
@@ -56,7 +56,7 @@ void seccomp_default(const char *fname, int allow_debuggers) {
                 exit(1);
         }
 
-        // build filter
+        // build filter (no post-exec filter needed because default list is fine for us)
         filter_init(fd);
         add_default_list(fd, allow_debuggers);
         filter_end_blacklist(fd);
@@ -66,20 +66,44 @@ void seccomp_default(const char *fname, int allow_debuggers) {
 }
 
 // drop list
-void seccomp_drop(const char *fname, char *list, int allow_debuggers) {
-        assert(fname);
+void seccomp_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers) {
+        assert(fname1);
+        assert(fname2);
         (void) allow_debuggers; // todo: to implemnet it
 
-        // open file
-        int fd = open(fname, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+        // open file for pre-exec filter
+        int fd = open(fname1, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
         if (fd < 0) {
-                fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname);
+                fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname1);
                 exit(1);
         }
 
-        // build filter
+        // build pre-exec filter: don't blacklist any syscalls in @default-keep
         filter_init(fd);
-        if (syscall_check_list(list, filter_add_blacklist, fd, 0)) {
+        char *prelist, *postlist;
+        syscalls_in_list(list, "@default-keep", fd, &prelist, &postlist);
+        if (prelist)
+                if (syscall_check_list(prelist, filter_add_blacklist, fd, 0, NULL)) {
+                        fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n");
+                        exit(1);
+                }
+        filter_end_blacklist(fd);
+        // close file
+        close(fd);
+
+        if (!postlist)
+                return;
+
+        // open file for post-exec filter
+        fd = open(fname2, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+        if (fd < 0) {
+                fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname2);
+                exit(1);
+        }
+
+        // build post-exec filter: blacklist remaining syscalls
+        filter_init(fd);
+        if (syscall_check_list(postlist, filter_add_blacklist, fd, 0, NULL)) {
                 fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n");
                 exit(1);
         }
@@ -90,20 +114,46 @@ void seccomp_drop(const char *fname, char *list, int allow_debuggers) {
 }
 
 // default+drop
-void seccomp_default_drop(const char *fname, char *list, int allow_debuggers) {
-        assert(fname);
+void seccomp_default_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers) {
+        assert(fname1);
+        assert(fname2);
 
         // open file
-        int fd = open(fname, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+        int fd = open(fname1, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
         if (fd < 0) {
-                fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname);
+                fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname1);
                 exit(1);
         }
 
-        // build filter
+        // build pre-exec filter: blacklist @default, don't blacklist
+        // any listed syscalls in @default-keep
         filter_init(fd);
         add_default_list(fd, allow_debuggers);
-        if (syscall_check_list(list, filter_add_blacklist, fd, 0)) {
+        char *prelist, *postlist;
+        syscalls_in_list(list, "@default-keep", fd, &prelist, &postlist);
+        if (prelist)
+                if (syscall_check_list(prelist, filter_add_blacklist, fd, 0, NULL)) {
+                        fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n");
+                        exit(1);
+                }
+        filter_end_blacklist(fd);
+
+        // close file
+        close(fd);
+
+        if (!postlist)
+                return;
+
+        // open file for post-exec filter
+        fd = open(fname2, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+        if (fd < 0) {
+                fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname2);
+                exit(1);
+        }
+
+        // build post-exec filter: blacklist remaining syscalls
+        filter_init(fd);
+        if (syscall_check_list(postlist, filter_add_blacklist, fd, 0, NULL)) {
                 fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n");
                 exit(1);
         }
@@ -113,22 +163,42 @@ void seccomp_default_drop(const char *fname, char *list, int allow_debuggers) {
         close(fd);
 }
 
-void seccomp_keep(const char *fname, char *list) {
-        // open file
-        int fd = open(fname, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+void seccomp_keep(const char *fname1, const char *fname2, char *list) {
+        // open file for pre-exec filter
+        int fd = open(fname1, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
         if (fd < 0) {
-                fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname);
+                fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname1);
                 exit(1);
         }
 
-        // build filter
+        // build pre-exec filter: whitelist also @default-keep
         filter_init(fd);
         // these syscalls are used by firejail after the seccomp filter is initialized
         int r;
-        r = syscall_check_list("@default-keep", filter_add_whitelist, fd, 0);
+        r = syscall_check_list("@default-keep", filter_add_whitelist, fd, 0, NULL);
         assert(r == 0);
 
-        if (syscall_check_list(list, filter_add_whitelist, fd, 0)) {
+        if (syscall_check_list(list, filter_add_whitelist, fd, 0, NULL)) {
+                fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n");
+                exit(1);
+        }
+
+        filter_end_whitelist(fd);
+
+        // close file
+        close(fd);
+
+        // open file for post-exec filter
+        fd = open(fname2, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+        if (fd < 0) {
+                fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname2);
+                exit(1);
+        }
+
+        // build post-exec filter: whitelist without @default-keep
+        filter_init(fd);
+
+        if (syscall_check_list(list, filter_add_whitelist, fd, 0, NULL)) {
                 fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n");
                 exit(1);
         }
diff --git a/src/fseccomp/seccomp_file.c b/src/fseccomp/seccomp_file.c
index 16ffd5302..2d5ee115d 100644
--- a/src/fseccomp/seccomp_file.c
+++ b/src/fseccomp/seccomp_file.c
@@ -60,8 +60,9 @@ void filter_init(int fd) {
         write_to_file(fd, filter, sizeof(filter));
 }
 
-void filter_add_whitelist(int fd, int syscall, int arg) {
+void filter_add_whitelist(int fd, int syscall, int arg, void *ptrarg) {
         (void) arg;
+        (void) ptrarg;
 
         struct sock_filter filter[] = {
                 WHITELIST(syscall)
@@ -69,8 +70,9 @@ void filter_add_whitelist(int fd, int syscall, int arg) {
         write_to_file(fd, filter, sizeof(filter));
 }
 
-void filter_add_blacklist(int fd, int syscall, int arg) {
+void filter_add_blacklist(int fd, int syscall, int arg, void *ptrarg) {
         (void) arg;
+        (void) ptrarg;
 
         struct sock_filter filter[] = {
                 BLACKLIST(syscall)
@@ -78,7 +80,8 @@ void filter_add_blacklist(int fd, int syscall, int arg) {
         write_to_file(fd, filter, sizeof(filter));
 }
 
-void filter_add_errno(int fd, int syscall, int arg) {
+void filter_add_errno(int fd, int syscall, int arg, void *ptrarg) {
+        (void) ptrarg;
         struct sock_filter filter[] = {
                 BLACKLIST_ERRNO(syscall, arg)
         };
diff --git a/src/fseccomp/syscall.c b/src/fseccomp/syscall.c
index 5893a2ea8..b9e6d995b 100644
--- a/src/fseccomp/syscall.c
+++ b/src/fseccomp/syscall.c
@@ -17,7 +17,9 @@
  * with this program; if not, write to the Free Software Foundation, Inc.,
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
+#define _GNU_SOURCE
 #include "fseccomp.h"
+#include <stdio.h>
 #include <sys/syscall.h>
 
 typedef struct {
@@ -30,6 +32,13 @@ typedef struct {
         const char * const list;
 } SyscallGroupList;
 
+typedef struct {
+        const char *slist;
+        char *prelist, *postlist;
+        bool found;
+        int syscall;
+} SyscallCheckList;
+
 static const SyscallEntry syslist[] = {
 //
 // code generated using tools/extract-syscall
@@ -174,6 +183,7 @@ static const SyscallGroupList sysgroups[] = {
         },
         { .name = "@default-keep", .list =
           "dup,"
+          "execve,"
           "prctl,"
           "setgid,"
           "setgroups,"
@@ -449,7 +459,7 @@ error:
 }
 
 // return 1 if error, 0 if OK
-int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, int arg), int fd, int arg) {
+int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, int arg, void *ptrarg), int fd, int arg, void *ptrarg) {
         // don't allow empty lists
         if (slist == NULL || *slist == '\0') {
                 fprintf(stderr, "Error fseccomp: empty syscall lists are not allowed\n");
@@ -477,7 +487,7 @@ int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall,
                                 fprintf(stderr, "Error fseccomp: unknown syscall group %s\n", ptr);
                                 exit(1);
                         }
-                        syscall_check_list(new_list, callback, fd, arg);
+                        syscall_check_list(new_list, callback, fd, arg, ptrarg);
                 }
                 else {
                         syscall_process_name(ptr, &syscall_nr, &error_nr);
@@ -487,9 +497,9 @@ int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall,
                         }
                         else if (callback != NULL) {
                                 if (error_nr != -1)
-                                        filter_add_errno(fd, syscall_nr, error_nr);
+                                        filter_add_errno(fd, syscall_nr, error_nr, ptrarg);
                                 else
-                                        callback(fd, syscall_nr, arg);
+                                        callback(fd, syscall_nr, arg, ptrarg);
                         }
                 }
                 ptr = strtok_r(NULL, ",", &saveptr);
@@ -498,3 +508,49 @@ int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall,
         free(str);
         return 0;
 }
+
+static void find_syscall(int fd, int syscall, int arg, void *ptrarg) {
+        (void)fd;
+        SyscallCheckList *ptr = ptrarg;
+        if (syscall == ptr->syscall)
+                ptr->found = true;
+}
+
+// go through list2 and find matches for problem syscall
+static void syscall_in_list(int fd, int syscall, int arg, void *ptrarg) {
+        (void)arg;
+        SyscallCheckList *ptr = ptrarg;
+        SyscallCheckList sl;
+        sl.found = false;
+        sl.syscall = syscall;
+        syscall_check_list(ptr->slist, find_syscall, fd, 0, &sl);
+        // if found in the problem list, add to post-exec list
+        if (sl.found)
+                if (ptr->postlist) {
+                        if (asprintf(&ptr->postlist, "%s,%s", ptr->postlist, syscall_find_nr(syscall)) == -1)
+                                errExit("asprintf");
+                }
+                else
+                        ptr->postlist = strdup(syscall_find_nr(syscall));
+        else // no problem, add to pre-exec list
+                if (ptr->prelist) {
+                        if (asprintf(&ptr->prelist, "%s,%s", ptr->prelist, syscall_find_nr(syscall)) == -1)
+                                errExit("asprintf");
+                }
+                else
+                        ptr->prelist = strdup(syscall_find_nr(syscall));
+}
+
+// go through list and find matches for syscalls in list @default-keep
+void syscalls_in_list(const char *list, const char *slist, int fd, char **prelist, char **postlist) {
+        SyscallCheckList sl;
+        // these syscalls are used by firejail after the seccomp filter is initialized
+        sl.slist = slist;
+        sl.prelist = NULL;
+        sl.postlist = NULL;
+        syscall_check_list(list, syscall_in_list, 0, 0, &sl);
+        if (!arg_quiet)
+                printf("list in: %s, check list: %s prelist: %s, postlist: %s\n", list, sl.slist, sl.prelist, sl.postlist);
+        *prelist = sl.prelist;
+        *postlist = sl.postlist;
+}
diff --git a/src/libpostexecseccomp/Makefile.in b/src/libpostexecseccomp/Makefile.in
new file mode 100644
index 000000000..92803342c
--- /dev/null
+++ b/src/libpostexecseccomp/Makefile.in
@@ -0,0 +1,26 @@
+CC=@CC@
+PREFIX=@prefix@
+VERSION=@PACKAGE_VERSION@
+NAME=@PACKAGE_NAME@
+HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
+
+H_FILE_LIST       = $(sort $(wildcard *.[h]))
+C_FILE_LIST       = $(sort $(wildcard *.c))
+OBJS = $(C_FILE_LIST:.c=.o)
+BINOBJS =  $(foreach file, $(OBJS), $file)
+CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIC -Wformat -Wformat-security
+LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now
+
+all: libpostexecseccomp.so
+
+%.o : %.c $(H_FILE_LIST)
+        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+
+libpostexecseccomp.so: $(OBJS)
+        $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl
+
+
+clean:; rm -f $(OBJS) libpostexecseccomp.so
+
+distclean: clean
+        rm -fr Makefile
diff --git a/src/libpostexecseccomp/libpostexecseccomp.c b/src/libpostexecseccomp/libpostexecseccomp.c
new file mode 100644
index 000000000..2c9d02c84
--- /dev/null
+++ b/src/libpostexecseccomp/libpostexecseccomp.c
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2017 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include "libpostexecseccomp.h"
+#include "../include/seccomp.h"
+#include <fcntl.h>
+#include <linux/filter.h>
+#include <sys/mman.h>
+#include <sys/prctl.h>
+#include <unistd.h>
+
+__attribute__((constructor))
+static void load_seccomp(void) {
+        int fd = open(RUN_SECCOMP_POSTEXEC, O_RDONLY);
+        if (fd == -1)
+                return;
+
+        int size = lseek(fd, 0, SEEK_END);
+        unsigned short entries = (unsigned short) size / (unsigned short) sizeof(struct sock_filter);
+        struct sock_filter *filter = MAP_FAILED;
+        if (size != 0)
+                filter = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);
+
+        close(fd);
+
+        if (size == 0 || filter == MAP_FAILED)
+                return;
+
+        // install filter
+        struct sock_fprog prog = {
+                .len = entries,
+                .filter = filter,
+        };
+
+        prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+        prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
+        munmap(filter, size);
+}
diff --git a/src/libpostexecseccomp/libpostexecseccomp.h b/src/libpostexecseccomp/libpostexecseccomp.h
new file mode 100644
index 000000000..c4aca540a
--- /dev/null
+++ b/src/libpostexecseccomp/libpostexecseccomp.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2017 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#ifndef LIBPOSTEXECSECCOMP_H
+#define LIBPOSTEXECSECCOMP_H
+
+#define RUN_SECCOMP_POSTEXEC    "/run/firejail/mnt/seccomp.postexec"
+
+#endif
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index f446f37b8..5bd4f6ef8 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -411,6 +411,9 @@ env LD_LIBRARY_PATH=/opt/test/lib
 env CFLAGS="-W -Wall -Werror"
 
 .TP
+\fBnodvd
+Disable DVD and audio CD devices.
+.TP
 \fBnogroups
 Disable supplementary user groups
 .TP
@@ -423,6 +426,9 @@ Enable IPC namespace.
 \fBnosound
 Disable sound system.
 .TP
+\fBnotv
+Disable DVB (Digital Video Broadcasting) TV devices.
+.TP
 \fBnovideo
 Disable video devices.
 .TP
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index bf18167b2..be73429bc 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -974,6 +974,15 @@ $ nc dict.org 2628
 220 pan.alephnull.com dictd 1.12.1/rf on Linux 3.14-1-amd64
 .br
 .TP
+\fB\-\-nodvd
+Disable DVD and audio CD devices.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-nodvd
+.TP
 \fB\-\-noexec=dirname_or_filename
 Remount directory or file noexec, nodev and nosuid.
 .br
@@ -1084,6 +1093,16 @@ Example:
 $ firejail \-\-nosound firefox
 
 .TP
+\fB\-\-notv
+Disable DVB (Digital Video Broadcasting) TV devices.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-notv vlc
+
+.TP
 \fB\-\-novideo
 Disable video devices.
 .br
@@ -1120,6 +1139,10 @@ $ ls -l sandboxlog*
 -rw-r--r-- 1 netblue netblue 511488 Jun  2 07:48 sandboxlog.5
 
 .TP
+\fB\-\-output-stderr=logfile
+Similar to \-\-output, but stderr is also stored.
+
+.TP
 \fB\-\-overlay
 Mount a filesystem overlay on top of the current filesystem.  Unlike the regular filesystem container,
 the system directories are mounted read-write. All filesystem modifications go into the overlay.
@@ -1555,6 +1578,32 @@ $ rm testfile
 rm: cannot remove `testfile': Operation not permitted
 .br
 
+.br
+If the blocked system calls would also block Firejail from operating,
+they are handled by adding a preloaded library which performs seccomp
+system calls later.
+.br
+
+.br
+Example:
+.br
+
+.br
+$ firejail \-\-noprofile \-\-shell=none \-\-seccomp=execve bash
+.br
+Parent pid 32751, child pid 32752
+.br
+Post-exec seccomp protector enabled
+.br
+list in: execve, check list: @default-keep prelist: (null), postlist: execve
+.br
+Child process initialized in 46.44 ms
+.br
+$ ls
+.br
+Bad system call
+.br
+
 .TP
 \fB\-\-seccomp.drop=syscall,syscall,syscall
 Enable seccomp filter, and blacklist the syscalls specified by the command.