189 files changed, 425 insertions, 503 deletions
diff --git a/README b/README
index 6bb17d4f3..a06ffe535 100644
--- a/README
+++ b/README
@@ -38,10 +38,12 @@ Committers
 - glitsj16 (https://github.com/glitsj16)
 - Fred-Barclay (https://github.com/Fred-Barclay)
 - Reiner Herrmann (https://github.com/reinerh - Debian/Ubuntu maintainer)
+- rusty-snake (https://github.com/rusty-snake)
 - smithsohu (https://github.com/smitsohu)
 - SkewedZeppelin (https://github.com/SkewedZeppelin)
 - startx2017 (https://github.com/startx2017) - LTS and *bugfixes branches maintainer)
 - Topi Miettinen (https://github.com/topimiettinen)
+- veloute (https://github.com/veloute)
 - Vincent43 (https://github.com/Vincent43)
 - netblue30 (netblue30@yahoo.com)
@@ -542,14 +544,16 @@ rusty-snake (https://github.com/rusty-snake)
        - added profiles: thunderbird-wayland, supertuxkart, ghostwriter
        - added profiles: klavaro, mypaint, mypaint-ora-thumbnailer, nano
        - added profiles: gajim-history-manager, freemind, nomacs, kid3
-        - added profiles: kid3-qt, kid3-cli, anki
+        - added profiles: kid3-qt, kid3-cli, anki, utox
        - fixed profiles: kdenlive, bibletime, rhythmbox, gajim, seahorse
        - fixed profiles: libreoffice, gnome-maps, wget, seahorse-tool
        - fixed profiles: gnome-logs, atom, brackets, gnome-builder, geany
-        - fixed profiles: vim, emacs, pycharm-community, gedit
+        - fixed profiles: vim, emacs, pycharm-community, gedit, klavaro
+  - fixed profiles: default
        - hardened profiles: disable-common.inc, disable-programs.inc
        - hardened profiles: gajim, evince, ffmpeg, feh-network.inc, qtox
        - hardened profiles: gnome-clocks, meld, minetest, youtube-dl
+        - hardened profiles: bibletime, whois, etr, display, feh
        - gnome-mpv was renamed to celluloid
 Salvo 'LtWorf' Tomaselli (https://github.com/ltworf)
        - fixed ktorrent profile
diff --git a/README.md b/README.md
index 8509bf44d..846e9d374 100644
--- a/README.md
+++ b/README.md
@@ -102,4 +102,4 @@ We also keep a list of profile fixes for previous released versions in [etc-fixe
 ## Current development version: 0.9.59
 ## New profiles:
-anki, assogiate, autokey-gtk, autokey-qt, autokey-run, autokey-shell, bzflag, celluoid, code-oss, crawl, crawl-tiles, crow, d-feet, dconf, dconf-editor, devhelp, exfalso, font-manager, freeciv, freecol, freemind, gconf-editor, geekbench, gnome-keyring, gnome-nettool, gnome-system-log, gsettings, kid3, kid3-cli, kid3-qt, klavaro, lincity-ng, lugaru, Maelstrom, manaplus, megaglest, mpdris2, mypaint, nano, netactview, nomacs, nyx, opencity, openclonk, openttd, ostrichriders, pavucontrol, pioneer, pragha, redshift, regextester, seahorse, seahorse-tool, scorched3d, secret-tool, simplescreenrecorder, slashem, subdownloader, sysprof, sysprof-cli, teeworlds, torcs, tremulous, transgui, vulturesclaw, vultureseye, warsow, widelands, xfce4-mixer, cheese
+anki, assogiate, autokey-gtk, autokey-qt, autokey-run, autokey-shell, bzflag, celluoid, cheese, code-oss, crawl, crawl-tiles, crow, d-feet, dconf, dconf-editor, devhelp, exfalso, font-manager, freeciv, freecol, freemind, gconf-editor, geekbench, gnome-keyring, gnome-nettool, gnome-system-log, gsettings, kid3, kid3-cli, kid3-qt, klavaro, lincity-ng, lugaru, Maelstrom, manaplus, megaglest, mpdris2, mypaint, nano, netactview, nomacs, nyx, opencity, openclonk, openttd, ostrichriders, pavucontrol, pioneer, pragha, redshift, regextester, seahorse, seahorse-tool, scorched3d, secret-tool, simplescreenrecorder, slashem, subdownloader, sysprof, sysprof-cli, teeworlds, torcs, tremulous, transgui, utox, vulturesclaw, vultureseye, warsow, widelands, xfce4-mixer
diff --git a/RELNOTES b/RELNOTES
index 2238ee57d..4ced2cde6 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -11,7 +11,7 @@ firejail (0.9.59) baseline; urgency=low
  * new profiles: teeworlds, torcs, tremulous, warsow, lugaru, manaplus
  * new profiles: pioneer, scorched3d, widelands, freemind, kid3, kid3-qt
  * new profiles: kid3-cli, nomacs, freecol, opencity, openclonk, slashem
-  * new profiles: vultureseye, vulturesclaw, anki, cheese
+  * new profiles: vultureseye, vulturesclaw, anki, cheese, utox
  * new profiles: autokey-gtk, autokey-qt, autokey-run, autokey-shell
  * memory-deny-write-execute now also blocks memfd_create
  * drop support for flatpak/snap packages
diff --git a/etc/Documents.profile b/etc/Documents.profile
new file mode 100644
index 000000000..c965c55a8
--- /dev/null
+++ b/etc/Documents.profile
@@ -0,0 +1,7 @@
+# Firejail profile for gnome-documents
+# This file is overwritten after every install/update
+# Temporary fix for https://github.com/netblue30/firejail/issues/2624
+# Redirect
+include gnome-documents.profile
diff --git a/etc/Fritzing.profile b/etc/Fritzing.profile
index 55fb7bae7..d318da885 100644
--- a/etc/Fritzing.profile
+++ b/etc/Fritzing.profile
@@ -11,6 +11,7 @@ noblacklist ${DOCUMENTS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -36,5 +37,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/JDownloader.profile b/etc/JDownloader.profile
index 2803ebe07..d1bd5c9b2 100644
--- a/etc/JDownloader.profile
+++ b/etc/JDownloader.profile
@@ -16,6 +16,7 @@ noblacklist /usr/share/java
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -48,5 +49,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/QMediathekView.profile b/etc/QMediathekView.profile
index 69dfbecfe..7cc50da15 100644
--- a/etc/QMediathekView.profile
+++ b/etc/QMediathekView.profile
@@ -21,6 +21,7 @@ noblacklist ${VIDEOS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -52,5 +53,3 @@ private-dev
 private-tmp
 # memory-deny-write-execute - breaks on Arch
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/QOwnNotes.profile b/etc/QOwnNotes.profile
index 090845259..27ba00857 100644
--- a/etc/QOwnNotes.profile
+++ b/etc/QOwnNotes.profile
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.local/share/PBE
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -51,5 +52,3 @@ private-dev
 private-etc alternatives,fonts,ld.so.cache,pulse,resolv.conf,hosts,nsswitch.conf,host.conf,ca-certificates,ssl,pki,crypto-policies
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/Viber.profile b/etc/Viber.profile
index 01bb49a99..3f3ee8590 100644
--- a/etc/Viber.profile
+++ b/etc/Viber.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.ViberPC
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,7 +36,5 @@ private-bin sh,bash,dig,awk,Viber
 private-etc hosts,fonts,mailcap,resolv.conf,X11,pulse,alternatives,localtime,nsswitch.conf,ssl,proxychains.conf,pki,ca-certificates,crypto-policies,machine-id,asound.conf
 private-tmp
-noexec ${HOME}
-noexec /tmp
 env QTWEBENGINE_DISABLE_SANDBOX=1
diff --git a/etc/XMind.profile b/etc/XMind.profile
index 6b767555c..a5b0a864e 100644
--- a/etc/XMind.profile
+++ b/etc/XMind.profile
@@ -9,6 +9,7 @@ noblacklist ${HOME}/.xmind
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,5 +36,3 @@ private-bin XMind,sh,cp
 private-tmp
 private-dev
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/akregator.profile b/etc/akregator.profile
index e7d0b74b9..2f35c55c0 100644
--- a/etc/akregator.profile
+++ b/etc/akregator.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.local/share/akregator
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -43,5 +44,3 @@ private-bin akregator,akregatorstorageexporter,dbus-launch,kdeinit5,kshell5,kdei
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/amule.profile b/etc/amule.profile
index e969bb1df..7cb2130bb 100644
--- a/etc/amule.profile
+++ b/etc/amule.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.aMule
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -39,5 +40,3 @@ private-bin amule
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/apktool.profile b/etc/apktool.profile
index bad0c9346..acddf010b 100644
--- a/etc/apktool.profile
+++ b/etc/apktool.profile
@@ -8,6 +8,7 @@ include apktool.local
 include globals.local
 include disable-common.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
@@ -33,6 +34,3 @@ shell none
 private-bin apktool,bash,java,dirname,basename,expr,sh
 private-cache
 private-dev
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/archaudit-report.profile b/etc/archaudit-report.profile
index 1b029d1ac..2f1715da1 100644
--- a/etc/archaudit-report.profile
+++ b/etc/archaudit-report.profile
@@ -11,6 +11,7 @@ noblacklist /var/lib/pacman
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -40,5 +41,3 @@ private-bin archaudit-report,arch-audit,bash,cat,comm,cut,date,fold,grep,pacman,
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/ardour5.profile b/etc/ardour5.profile
index 377ce0a2c..211a32e22 100644
--- a/etc/ardour5.profile
+++ b/etc/ardour5.profile
@@ -14,6 +14,7 @@ noblacklist ${MUSIC}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -39,5 +40,3 @@ private-dev
 #private-etc alternatives,pulse,X11,alternatives,ardour4,ardour5,fonts,machine-id,asound.conf
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/arduino.profile b/etc/arduino.profile
index ce4609340..2ea8445fe 100644
--- a/etc/arduino.profile
+++ b/etc/arduino.profile
@@ -19,6 +19,7 @@ noblacklist /usr/share/java
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -41,5 +42,3 @@ shell none
 private-cache
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/aria2c.profile b/etc/aria2c.profile
index 6e5a87dab..68c83e573 100644
--- a/etc/aria2c.profile
+++ b/etc/aria2c.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.aria2
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -41,5 +42,3 @@ private-lib libreadline.so.*
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/arm.profile b/etc/arm.profile
index d31b962ca..ae93e9665 100644
--- a/etc/arm.profile
+++ b/etc/arm.profile
@@ -18,6 +18,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -49,5 +50,3 @@ private-dev
 private-etc alternatives,tor,passwd,ca-certificates,ssl,pki,crypto-policies
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/atom.profile b/etc/atom.profile
index 1c0afb277..e4ca96eaa 100644
--- a/etc/atom.profile
+++ b/etc/atom.profile
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.cargo/registry
 noblacklist ${HOME}/.gitconfig
 include disable-common.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,6 +36,3 @@ shell none
 private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/baobab.profile b/etc/baobab.profile
index c223b138e..fc4e7f268 100644
--- a/etc/baobab.profile
+++ b/etc/baobab.profile
@@ -8,6 +8,7 @@ include globals.local
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 # include disable-programs.inc
@@ -33,5 +34,3 @@ private-dev
 private-tmp
 #memory-deny-write-execute  - breaks on Arch
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/bibletime.profile b/etc/bibletime.profile
index 6e40054f7..c41aafd47 100644
--- a/etc/bibletime.profile
+++ b/etc/bibletime.profile
@@ -14,6 +14,7 @@ noblacklist ${HOME}/.local/share/bibletime
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -25,7 +26,9 @@ whitelist ${HOME}/.bibletime
 whitelist ${HOME}/.sword
 whitelist ${HOME}/.local/share/bibletime
 include whitelist-common.inc
+include whitelist-var-common.inc
+apparmor
 caps.drop all
 machine-id
 netfilter
@@ -42,7 +45,9 @@ protocol unix,inet,inet6,netlink
 seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
 shell none
+disable-mnt
 # private-bin bibletime,qt5ct
+private-cache
 private-dev
-private-etc alternatives,fonts,resolv.conf,sword,sword.conf,passwd,machine-id,ca-certificates,ssl,pki,crypto-policies
+private-etc alternatives,ca-certificates,crypto-policies,fonts,login.defs,machine-id,passwd,pki,resolv.conf,ssl,sword,sword.conf
 private-tmp
diff --git a/etc/bitcoin-qt.profile b/etc/bitcoin-qt.profile
index 74123ee51..8aae5d668 100644
--- a/etc/bitcoin-qt.profile
+++ b/etc/bitcoin-qt.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.config/Bitcoin
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -46,5 +47,3 @@ private-dev
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/bleachbit.profile b/etc/bleachbit.profile
index fae7d8133..cbc8c25d6 100644
--- a/etc/bleachbit.profile
+++ b/etc/bleachbit.profile
@@ -16,6 +16,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 # include disable-programs.inc
@@ -41,5 +42,3 @@ private-dev
 # memory-deny-write-execute breaks some systems, see issue #1850
 # memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/blender.profile b/etc/blender.profile
index d23fe0810..bfe906408 100644
--- a/etc/blender.profile
+++ b/etc/blender.profile
@@ -18,6 +18,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -42,5 +43,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/bless.profile b/etc/bless.profile
index 8315f4563..d4ac80db1 100644
--- a/etc/bless.profile
+++ b/etc/bless.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/bless
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -38,5 +39,3 @@ private-dev
 private-etc alternatives,fonts,mono
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/bluefish.profile b/etc/bluefish.profile
index ce47cb9ab..412088ba9 100644
--- a/etc/bluefish.profile
+++ b/etc/bluefish.profile
@@ -8,6 +8,7 @@ include globals.local
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,5 +36,3 @@ private-bin bluefish
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/brasero.profile b/etc/brasero.profile
index 5021db254..aa838380a 100644
--- a/etc/brasero.profile
+++ b/etc/brasero.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/brasero
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -34,5 +35,3 @@ private-cache
 # private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/cin.profile b/etc/cin.profile
index 02511c478..efeb9cd14 100644
--- a/etc/cin.profile
+++ b/etc/cin.profile
@@ -9,6 +9,7 @@ noblacklist ${HOME}/.bcast5
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -33,5 +34,3 @@ shell none
 private-cache
 private-dev
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/conky.profile b/etc/conky.profile
index 846868be2..d5949ecfd 100644
--- a/etc/conky.profile
+++ b/etc/conky.profile
@@ -10,6 +10,7 @@ noblacklist ${PICTURES}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -37,5 +38,3 @@ private-dev
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/corebird.profile b/etc/corebird.profile
index bf2e97356..dbb043c17 100644
--- a/etc/corebird.profile
+++ b/etc/corebird.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/corebird
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -34,5 +35,3 @@ private-bin corebird
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/cower.profile b/etc/cower.profile
index ebd83b326..bc1eeedc0 100644
--- a/etc/cower.profile
+++ b/etc/cower.profile
@@ -19,6 +19,7 @@ noblacklist /var/lib/pacman
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -45,5 +46,3 @@ private-dev
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/crow.profile b/etc/crow.profile
index 93f71cef8..8aa70a09c 100644
--- a/etc/crow.profile
+++ b/etc/crow.profile
@@ -13,6 +13,7 @@ whitelist ${HOME}/.cache/gstreamer-1.0
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -42,5 +43,3 @@ private-opt none
 private-tmp
 private-srv none
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/curl.profile b/etc/curl.profile
index 1783f1337..2703c6fe8 100644
--- a/etc/curl.profile
+++ b/etc/curl.profile
@@ -12,6 +12,7 @@ blacklist /tmp/.X11-unix
 noblacklist ${HOME}/.curlrc
 include disable-common.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,6 +36,3 @@ private-cache
 private-dev
 # private-etc alternatives,resolv.conf,ca-certificates,ssl,pki,crypto-policies
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/darktable.profile b/etc/darktable.profile
index af834f90b..2a71ad11c 100644
--- a/etc/darktable.profile
+++ b/etc/darktable.profile
@@ -12,6 +12,7 @@ noblacklist ${PICTURES}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,5 +36,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/deadbeef.profile b/etc/deadbeef.profile
index f751b7bb0..8e67d9daa 100644
--- a/etc/deadbeef.profile
+++ b/etc/deadbeef.profile
@@ -11,6 +11,7 @@ noblacklist ${MUSIC}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -32,5 +33,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/default.profile b/etc/default.profile
index 3eacf9546..95a6e8095 100644
--- a/etc/default.profile
+++ b/etc/default.profile
@@ -19,6 +19,8 @@ include disable-programs.inc
 # apparmor
 caps.drop all
 # ipc-namespace
+# machine-id
+# net none
 netfilter
 # no3d
 # nodbus
@@ -33,6 +35,7 @@ noroot
 protocol unix,inet,inet6
 seccomp
 # shell none
+# tracelog
 # disable-mnt
 # private
diff --git a/etc/dex2jar.profile b/etc/dex2jar.profile
index b0226f1e9..06a6be3aa 100644
--- a/etc/dex2jar.profile
+++ b/etc/dex2jar.profile
@@ -14,6 +14,7 @@ noblacklist /usr/share/java
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -41,5 +42,3 @@ private-bin dex2jar,java,sh,bash,expr,dirname,ls,uname,grep
 private-cache
 private-dev
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/dia.profile b/etc/dia.profile
index a0075acaf..921adaad5 100644
--- a/etc/dia.profile
+++ b/etc/dia.profile
@@ -11,6 +11,7 @@ noblacklist ${DOCUMENTS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -38,5 +39,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/dino.profile b/etc/dino.profile
index e76499f8f..2db395e02 100644
--- a/etc/dino.profile
+++ b/etc/dino.profile
@@ -9,6 +9,7 @@ noblacklist ${HOME}/.local/share/dino
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -39,5 +40,3 @@ private-dev
 # private-etc alternatives,fonts,ca-certificates,ssl,pki,crypto-policies # breaks server connection
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/discord-common.profile b/etc/discord-common.profile
index 44b42aefa..a791c7a06 100644
--- a/etc/discord-common.profile
+++ b/etc/discord-common.profile
@@ -29,7 +29,7 @@ seccomp
 private-bin sh,xdg-mime,tr,sed,echo,head,cut,xdg-open,grep,egrep,bash,zsh
 private-dev
-private-etc alternatives,fonts,machine-id,localtime,ld.so.cache,ca-certificates,ssl,pki,crypto-policies,resolv.conf
+private-etc alternatives,ca-certificates,crypto-policies,fonts,group,machine-id,ld.so.cache,localtime,login.defs,password,pki,resolv.conf,ssl
 private-tmp
 noexec /tmp
diff --git a/etc/display.profile b/etc/display.profile
index e66fa3ae9..0bab32db1 100644
--- a/etc/display.profile
+++ b/etc/display.profile
@@ -17,6 +17,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
diff --git a/etc/dooble.profile b/etc/dooble.profile
index bc4a4c348..80bcce463 100644
--- a/etc/dooble.profile
+++ b/etc/dooble.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.dooble
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -37,5 +38,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/dragon.profile b/etc/dragon.profile
index cdf941acd..fb8aaaf96 100644
--- a/etc/dragon.profile
+++ b/etc/dragon.profile
@@ -12,6 +12,7 @@ noblacklist ${VIDEOS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,5 +36,3 @@ private-bin dragon
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/electrum.profile b/etc/electrum.profile
index 9d5cf7fab..88d27e47e 100644
--- a/etc/electrum.profile
+++ b/etc/electrum.profile
@@ -18,6 +18,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -52,5 +53,3 @@ private-dev
 private-etc alternatives,fonts,dconf,ca-certificates,ssl,pki,crypto-policies,machine-id
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/enpass.profile b/etc/enpass.profile
index 5e461bc43..284b9259d 100644
--- a/etc/enpass.profile
+++ b/etc/enpass.profile
@@ -11,6 +11,7 @@ noblacklist ${DOCUMENTS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -41,5 +42,3 @@ private-opt Enpass
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/etr.profile b/etc/etr.profile
index cf13a42de..d93d3de63 100644
--- a/etc/etr.profile
+++ b/etc/etr.profile
@@ -8,14 +8,18 @@ include globals.local
 noblacklist ${HOME}/.etr
 include disable-common.inc
+include disable-exec.inc
+include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
+include disable-xdg.inc
 mkdir ${HOME}/.etr
 whitelist ${HOME}/.etr
 include whitelist-common.inc
 include whitelist-var-common.inc
+apparmor
 caps.drop all
 net none
 nodbus
@@ -28,8 +32,11 @@ nou2f
 protocol unix,netlink
 seccomp
 shell none
+tracelog
-# private-bin etr
+disable-mnt
+private-bin etr
+private-cache
 private-dev
-# private-etc alternatives
+# private-etc alternatives,drirc,machine-id,openal
 private-tmp
diff --git a/etc/evolution.profile b/etc/evolution.profile
index 9b6387538..71a7a5600 100644
--- a/etc/evolution.profile
+++ b/etc/evolution.profile
@@ -18,6 +18,7 @@ noblacklist ${HOME}/.local/share/pki
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -41,5 +42,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/exfalso.profile b/etc/exfalso.profile
index b4d275d22..6146a8952 100644
--- a/etc/exfalso.profile
+++ b/etc/exfalso.profile
@@ -19,6 +19,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -49,5 +50,3 @@ private-lib libatk-1.0.so.*,libgdk-3.so.*,libgdk_pixbuf-2.0.so.*,libgirepository
 private-tmp
 # memory-deny-write-execute - Breaks on Arch
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/falkon.profile b/etc/falkon.profile
index 9fd446fe1..af6aaa1a7 100644
--- a/etc/falkon.profile
+++ b/etc/falkon.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.config/falkon
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -37,5 +38,3 @@ seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@res
 private-dev
 # private-tmp - interferes with the opening of downloaded files
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/feedreader.profile b/etc/feedreader.profile
index 44ed475bc..e453cc611 100644
--- a/etc/feedreader.profile
+++ b/etc/feedreader.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.local/share/feedreader
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -41,5 +42,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/feh.profile b/etc/feh.profile
index f020bace5..6a8071c28 100644
--- a/etc/feh.profile
+++ b/etc/feh.profile
@@ -8,6 +8,7 @@ include globals.local
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
diff --git a/etc/filezilla.profile b/etc/filezilla.profile
index fb96d9d87..d1bebafb5 100644
--- a/etc/filezilla.profile
+++ b/etc/filezilla.profile
@@ -36,6 +36,7 @@ protocol unix,inet,inet6
 seccomp
 shell none
-private-bin filezilla,uname,sh,bash,python*,lsb_release,fzputtygen,fzsftp
+# private-bin breaks --join if the user has zsh set as $SHELL - adding zsh on private-bin
+private-bin filezilla,uname,sh,bash,zsh,python*,lsb_release,fzputtygen,fzsftp
 private-dev
 private-tmp
diff --git a/etc/flameshot.profile b/etc/flameshot.profile
index 39a23c813..cd3e07455 100644
--- a/etc/flameshot.profile
+++ b/etc/flameshot.profile
@@ -11,6 +11,7 @@ noblacklist ${PICTURES}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -40,5 +41,3 @@ private-etc alternatives,fonts,ld.so.conf,resolv.conf,ca-certificates,ssl,pki,cr
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/flowblade.profile b/etc/flowblade.profile
index b57c27936..1e84d4ca6 100644
--- a/etc/flowblade.profile
+++ b/etc/flowblade.profile
@@ -19,6 +19,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -39,5 +40,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/fontforge.profile b/etc/fontforge.profile
index dc4e43b09..f98ad9983 100644
--- a/etc/fontforge.profile
+++ b/etc/fontforge.profile
@@ -19,6 +19,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -42,5 +43,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/freecad.profile b/etc/freecad.profile
index 11fe3245c..079c85fb1 100644
--- a/etc/freecad.profile
+++ b/etc/freecad.profile
@@ -11,6 +11,7 @@ noblacklist ${DOCUMENTS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -37,5 +38,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gajim.profile b/etc/gajim.profile
index bdb40d7e1..36121c4b9 100644
--- a/etc/gajim.profile
+++ b/etc/gajim.profile
@@ -20,6 +20,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -52,7 +53,5 @@ private-dev
 private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,hostname,hosts,ld.so.cache,ld.so.conf,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl
 private-tmp
-noexec ${HOME}
-noexec /tmp
 join-or-start gajim
diff --git a/etc/gitg.profile b/etc/gitg.profile
index f6d78cc54..a40d8791c 100644
--- a/etc/gitg.profile
+++ b/etc/gitg.profile
@@ -12,6 +12,7 @@ noblacklist ${HOME}/.ssh
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -39,5 +40,3 @@ private-tmp
 # mdwe breaks diff in older versions
 #memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/github-desktop.profile b/etc/github-desktop.profile
index 934ac7c40..cddb5fcbf 100644
--- a/etc/github-desktop.profile
+++ b/etc/github-desktop.profile
@@ -13,6 +13,7 @@ include disable-common.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 caps.drop all
@@ -44,5 +45,3 @@ private-dev
 private-tmp
 # memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gitter.profile b/etc/gitter.profile
index ab333d1fb..7d0831bc4 100644
--- a/etc/gitter.profile
+++ b/etc/gitter.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/Gitter
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -41,5 +42,3 @@ private-opt Gitter
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/globaltime.profile b/etc/globaltime.profile
index c007fb0cc..bb78a608e 100644
--- a/etc/globaltime.profile
+++ b/etc/globaltime.profile
@@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/globaltime
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -34,5 +35,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-2048.profile b/etc/gnome-2048.profile
index ce83fbb66..9eb4c147d 100644
--- a/etc/gnome-2048.profile
+++ b/etc/gnome-2048.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.local/share/gnome-2048
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,5 +36,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-books.profile b/etc/gnome-books.profile
index b880980bc..184751132 100644
--- a/etc/gnome-books.profile
+++ b/etc/gnome-books.profile
@@ -12,6 +12,7 @@ noblacklist ${DOCUMENTS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -40,5 +41,3 @@ private-dev
 # private-etc alternatives,fonts
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-documents.profile b/etc/gnome-documents.profile
index 36b69ce90..078e8c34e 100644
--- a/etc/gnome-documents.profile
+++ b/etc/gnome-documents.profile
@@ -13,6 +13,7 @@ noblacklist ${DOCUMENTS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -38,5 +39,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-font-viewer.profile b/etc/gnome-font-viewer.profile
index c616b7381..468ef0401 100644
--- a/etc/gnome-font-viewer.profile
+++ b/etc/gnome-font-viewer.profile
@@ -9,6 +9,7 @@ include globals.local
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -33,5 +34,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-mplayer.profile b/etc/gnome-mplayer.profile
index 3dd623ea9..12bee6448 100644
--- a/etc/gnome-mplayer.profile
+++ b/etc/gnome-mplayer.profile
@@ -12,6 +12,7 @@ noblacklist ${VIDEOS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -31,5 +32,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-music.profile b/etc/gnome-music.profile
index f31b8af2c..6bebeb526 100644
--- a/etc/gnome-music.profile
+++ b/etc/gnome-music.profile
@@ -19,6 +19,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -45,5 +46,3 @@ private-dev
 private-etc alternatives,fonts,machine-id,pulse,asound.conf
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-nettool.profile b/etc/gnome-nettool.profile
index dd58f12d5..a763917d1 100644
--- a/etc/gnome-nettool.profile
+++ b/etc/gnome-nettool.profile
@@ -8,6 +8,7 @@ include globals.local
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -41,5 +42,3 @@ private-dev
 private-lib libbind9.so.*,libcrypto.so.*,libdns.so.*,libirs.so.*,liblua.so.*,libssh2.so.*,libssl.so.*
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-photos.profile b/etc/gnome-photos.profile
index c48ca50a5..4e5a3b109 100644
--- a/etc/gnome-photos.profile
+++ b/etc/gnome-photos.profile
@@ -12,6 +12,7 @@ noblacklist ${HOME}/.local/share/gnome-photos
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -37,5 +38,3 @@ private-dev
 # private-etc alternatives,fonts
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-pie.profile b/etc/gnome-pie.profile
index e542181fa..c1d2dae35 100644
--- a/etc/gnome-pie.profile
+++ b/etc/gnome-pie.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/gnome-pie
 #include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 #include disable-interpreters.inc
 include disable-passwdmgr.inc
 #include disable-programs.inc
@@ -38,5 +39,3 @@ private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.s
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-recipes.profile b/etc/gnome-recipes.profile
index 24d3cbd87..1a897a5d8 100644
--- a/etc/gnome-recipes.profile
+++ b/etc/gnome-recipes.profile
@@ -12,6 +12,7 @@ noblacklist ${HOME}/.local/share/gnome-recipes
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -46,5 +47,3 @@ private-etc alternatives,ca-certificates,fonts,ssl,crypto-policies,pki
 private-lib gdk-pixbuf-2.0,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,libgnutls.so.*,libjpeg.so.*,libp11-kit.so.*,libproxy.so.*,librsvg-2.so.*
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-ring.profile b/etc/gnome-ring.profile
index f660df690..78ceb9c4f 100644
--- a/etc/gnome-ring.profile
+++ b/etc/gnome-ring.profile
@@ -9,6 +9,7 @@ noblacklist ${HOME}/.local/share/gnome-ring
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -31,5 +32,3 @@ disable-mnt
 # private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-twitch.profile b/etc/gnome-twitch.profile
index 4b54d9627..5e8153035 100644
--- a/etc/gnome-twitch.profile
+++ b/etc/gnome-twitch.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.local/share/gnome-twitch
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -37,5 +38,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-weather.profile b/etc/gnome-weather.profile
index baa5d39fd..ef7255130 100644
--- a/etc/gnome-weather.profile
+++ b/etc/gnome-weather.profile
@@ -12,6 +12,7 @@ noblacklist ${HOME}/.cache/libgweather
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -41,5 +42,3 @@ private-dev
 # private-etc alternatives,fonts,ca-certificates,ssl,pki,crypto-policies
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/google-earth.profile b/etc/google-earth.profile
index e075bfe9a..a29e0d563 100644
--- a/etc/google-earth.profile
+++ b/etc/google-earth.profile
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.googleearth/myplaces.kml
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -48,5 +49,3 @@ private-bin google-earth,sh,bash,grep,sed,ls,dirname
 private-dev
 private-opt google
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gpredict.profile b/etc/gpredict.profile
index 38897f184..be3742fe3 100644
--- a/etc/gpredict.profile
+++ b/etc/gpredict.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/Gpredict
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -36,5 +37,3 @@ private-dev
 private-etc alternatives,fonts,resolv.conf,ca-certificates,ssl,pki,crypto-policies
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gradio.profile b/etc/gradio.profile
index eec7376b4..75c793f61 100644
--- a/etc/gradio.profile
+++ b/etc/gradio.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.local/share/gradio
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -37,5 +38,3 @@ shell none
 private-etc alternatives,asound.conf,ca-certificates,fonts,host.conf,hostname,hosts,pulse,resolv.conf,ssl,pki,crypto-policies,gtk-3.0,xdg,machine-id
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/guayadeque.profile b/etc/guayadeque.profile
index 22457c547..8ffd7ff58 100644
--- a/etc/guayadeque.profile
+++ b/etc/guayadeque.profile
@@ -10,6 +10,7 @@ noblacklist ${MUSIC}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -31,5 +32,3 @@ private-bin guayadeque
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/hashcat.profile b/etc/hashcat.profile
index bf4836c45..4ed099fae 100644
--- a/etc/hashcat.profile
+++ b/etc/hashcat.profile
@@ -13,6 +13,7 @@ noblacklist ${DOCUMENTS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -39,5 +40,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/hugin.profile b/etc/hugin.profile
index 1e235f381..3d8921120 100644
--- a/etc/hugin.profile
+++ b/etc/hugin.profile
@@ -12,6 +12,7 @@ noblacklist ${PICTURES}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -37,5 +38,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/imagej.profile b/etc/imagej.profile
index 9ff0f9203..9d0ab43a0 100644
--- a/etc/imagej.profile
+++ b/etc/imagej.profile
@@ -16,6 +16,7 @@ noblacklist /usr/share/java
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -40,5 +41,3 @@ private-bin imagej,bash,grep,sort,tail,tr,cut,whoami,hostname,uname,mkdir,ls,tou
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/jd-gui.profile b/etc/jd-gui.profile
index 443e6b550..dce44e5d4 100644
--- a/etc/jd-gui.profile
+++ b/etc/jd-gui.profile
@@ -16,6 +16,7 @@ noblacklist /usr/share/java
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -44,5 +45,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/kaffeine.profile b/etc/kaffeine.profile
index 85870da36..c7f811939 100644
--- a/etc/kaffeine.profile
+++ b/etc/kaffeine.profile
@@ -17,6 +17,7 @@ noblacklist ${VIDEOS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -39,5 +40,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/kdeinit4.profile b/etc/kdeinit4.profile
index cd7c4cae3..f786c78d5 100644
--- a/etc/kdeinit4.profile
+++ b/etc/kdeinit4.profile
@@ -9,6 +9,7 @@ include globals.local
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -33,5 +34,3 @@ private-bin kdeinit4,kbuildsycoca4,kded4,knotify4
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/keepass.profile b/etc/keepass.profile
index 788561a14..57a24d821 100644
--- a/etc/keepass.profile
+++ b/etc/keepass.profile
@@ -17,6 +17,7 @@ noblacklist ${DOCUMENTS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -41,5 +42,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/kino.profile b/etc/kino.profile
index ead42f9ca..9e8d61391 100644
--- a/etc/kino.profile
+++ b/etc/kino.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.kinorc
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -31,5 +32,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/klavaro.profile b/etc/klavaro.profile
index 5ad5e2699..b6b538557 100644
--- a/etc/klavaro.profile
+++ b/etc/klavaro.profile
@@ -43,12 +43,10 @@ shell none
 tracelog
 disable-mnt
-private-bin klavaro,tclsh,tclsh*,bash
+private-bin bash,klavaro,sh,tclsh,tclsh*
 private-cache
 private-dev
 private-etc alternatives,fonts
 private-tmp
 private-opt none
 private-srv none
-memory-deny-write-execute
diff --git a/etc/kopete.profile b/etc/kopete.profile
index fef415f6e..5e931ddac 100644
--- a/etc/kopete.profile
+++ b/etc/kopete.profile
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.kde4/share/config/kopeterc
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,5 +36,3 @@ writable-var
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/less.profile b/etc/less.profile
index 16940853c..5ad7cb959 100644
--- a/etc/less.profile
+++ b/etc/less.profile
@@ -9,6 +9,7 @@ include less.local
 #include globals.local
 blacklist /tmp/.X11-unix
+include disable-exec.inc
 ignore noroot
 apparmor
@@ -34,7 +35,5 @@ private-cache
 private-dev
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
 include default.profile
diff --git a/etc/liferea.profile b/etc/liferea.profile
index 5927747b8..e778d7b55 100644
--- a/etc/liferea.profile
+++ b/etc/liferea.profile
@@ -20,6 +20,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -52,5 +53,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/linphone.profile b/etc/linphone.profile
index cd35dc2bf..dc156b298 100644
--- a/etc/linphone.profile
+++ b/etc/linphone.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.linphonerc
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -40,5 +41,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/lmms.profile b/etc/lmms.profile
index 6c81b9172..98ddd03e5 100644
--- a/etc/lmms.profile
+++ b/etc/lmms.profile
@@ -12,6 +12,7 @@ noblacklist ${MUSIC}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -36,5 +37,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/lollypop.profile b/etc/lollypop.profile
index c4717965a..76b8ed75c 100644
--- a/etc/lollypop.profile
+++ b/etc/lollypop.profile
@@ -19,6 +19,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -43,5 +44,3 @@ private-dev
 private-etc alternatives,asound.conf,ca-certificates,fonts,host.conf,hostname,hosts,pulse,resolv.conf,ssl,pki,crypto-policies,gtk-3.0,xdg,machine-id
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/luminance-hdr.profile b/etc/luminance-hdr.profile
index 38f2ab10c..2b0feaa17 100644
--- a/etc/luminance-hdr.profile
+++ b/etc/luminance-hdr.profile
@@ -11,6 +11,7 @@ noblacklist ${PICTURES}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -36,5 +37,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/lximage-qt.profile b/etc/lximage-qt.profile
index c275a69c8..74adb7a67 100644
--- a/etc/lximage-qt.profile
+++ b/etc/lximage-qt.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/lximage-qt
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -33,5 +34,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/lxmusic.profile b/etc/lxmusic.profile
index e0c03db50..e1a37343e 100644
--- a/etc/lxmusic.profile
+++ b/etc/lxmusic.profile
@@ -12,6 +12,7 @@ noblacklist ${MUSIC}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -36,5 +37,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/macrofusion.profile b/etc/macrofusion.profile
index 793cd59bb..7d42f2bfe 100644
--- a/etc/macrofusion.profile
+++ b/etc/macrofusion.profile
@@ -18,6 +18,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -44,5 +45,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/makepkg.profile b/etc/makepkg.profile
index 317a3dd78..55bea9c5e 100644
--- a/etc/makepkg.profile
+++ b/etc/makepkg.profile
@@ -31,6 +31,7 @@ blacklist ${HOME}/.gnupg/openpgp-revocs.d
 noblacklist /var/lib/pacman
 include disable-common.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -54,5 +55,3 @@ disable-mnt
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/mate-calc.profile b/etc/mate-calc.profile
index 1d3c21e3f..ac5577b4c 100644
--- a/etc/mate-calc.profile
+++ b/etc/mate-calc.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/mate-calc
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -45,5 +46,3 @@ private-opt none
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/mate-color-select.profile b/etc/mate-color-select.profile
index a344f70e1..bd3631445 100644
--- a/etc/mate-color-select.profile
+++ b/etc/mate-color-select.profile
@@ -8,6 +8,7 @@ include globals.local
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -40,5 +41,3 @@ private-lib
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/mate-dictionary.profile b/etc/mate-dictionary.profile
index 196f5b2c3..1217910a0 100644
--- a/etc/mate-dictionary.profile
+++ b/etc/mate-dictionary.profile
@@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/mate/mate-dictionary
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -42,5 +43,3 @@ private-dev
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/mediathekview.profile b/etc/mediathekview.profile
index a438634f3..497014dab 100644
--- a/etc/mediathekview.profile
+++ b/etc/mediathekview.profile
@@ -26,6 +26,7 @@ noblacklist /usr/share/java
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -50,5 +51,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/mendeleydesktop.profile b/etc/mendeleydesktop.profile
index a3d6092f1..d54371371 100644
--- a/etc/mendeleydesktop.profile
+++ b/etc/mendeleydesktop.profile
@@ -24,6 +24,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -50,5 +51,3 @@ private-bin mendeleydesktop,python*,env,gconftool-2,which,sh,ln,cat,update-deskt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/midori.profile b/etc/midori.profile
index 4e9a6c63d..d59a6a16b 100644
--- a/etc/midori.profile
+++ b/etc/midori.profile
@@ -13,8 +13,12 @@ noblacklist ${HOME}/.local/share/midori
 noblacklist ${HOME}/.pki
 noblacklist ${HOME}/.local/share/pki
+# noexec ${HOME} breaks DRM binaries.
+ignore noexec ${HOME}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-programs.inc
diff --git a/etc/min.profile b/etc/min.profile
index eb1163175..eec81677d 100644
--- a/etc/min.profile
+++ b/etc/min.profile
@@ -11,8 +11,12 @@ noblacklist ${HOME}/.config/Min
 noblacklist ${HOME}/.pki
 noblacklist ${HOME}/.local/share/pki
+# noexec ${HOME} breaks DRM binaries.
+ignore noexec ${HOME}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-programs.inc
@@ -48,5 +52,3 @@ private-etc alternatives,ca-certificates,ssl,machine-id,dconf,selinux,passwd,gro
 private-tmp
 # memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/mpDris2.profile b/etc/mpDris2.profile
index b179ecfaf..81bf88b8b 100644
--- a/etc/mpDris2.profile
+++ b/etc/mpDris2.profile
@@ -18,6 +18,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -47,7 +48,5 @@ private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotif
 private-tmp
 # memory-deny-write-execute - Breaks on Arch
-noexec ${HOME}
-noexec /tmp
 read-only ${HOME}
diff --git a/etc/mpd.profile b/etc/mpd.profile
index e06b83aa9..0a98de7c4 100644
--- a/etc/mpd.profile
+++ b/etc/mpd.profile
@@ -13,6 +13,7 @@ noblacklist ${MUSIC}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -38,5 +39,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/mplayer.profile b/etc/mplayer.profile
index 8c0b50eca..877b92564 100644
--- a/etc/mplayer.profile
+++ b/etc/mplayer.profile
@@ -12,6 +12,7 @@ noblacklist ${VIDEOS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -33,5 +34,3 @@ private-bin mplayer
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/ms-office.profile b/etc/ms-office.profile
index f23617f8d..f8e75379e 100644
--- a/etc/ms-office.profile
+++ b/etc/ms-office.profile
@@ -18,6 +18,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -43,5 +44,3 @@ private-etc alternatives,resolv.conf,ca-certificates,ssl,pki,crypto-policies
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/multimc5.profile b/etc/multimc5.profile
index 75e6e2804..b6407c4f9 100644
--- a/etc/multimc5.profile
+++ b/etc/multimc5.profile
@@ -18,6 +18,7 @@ noblacklist /usr/share/java
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -47,5 +48,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/mumble.profile b/etc/mumble.profile
index 276e77c68..04bb1b5f0 100644
--- a/etc/mumble.profile
+++ b/etc/mumble.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.local/share/data/Mumble
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -40,5 +41,3 @@ private-bin mumble
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/musixmatch.profile b/etc/musixmatch.profile
index 54d9fb16e..727269a61 100644
--- a/etc/musixmatch.profile
+++ b/etc/musixmatch.profile
@@ -9,6 +9,7 @@ noblacklist ${MUSIC}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
@@ -33,5 +34,3 @@ disable-mnt
 private-dev
 private-etc alternatives,machine-id,pulse,asound.conf,ca-certificates,ssl,pki,crypto-policies
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/natron.profile b/etc/natron.profile
index 85e23c759..3f997a7a0 100644
--- a/etc/natron.profile
+++ b/etc/natron.profile
@@ -20,6 +20,7 @@ noblacklist /opt/natron
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -38,5 +39,3 @@ shell none
 private-bin natron,Natron,NatronRenderer
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/ncdu.profile b/etc/ncdu.profile
index ac0fd19b2..c18e1c4bf 100644
--- a/etc/ncdu.profile
+++ b/etc/ncdu.profile
@@ -6,6 +6,8 @@ include ncdu.local
 # Persistent global definitions
 include globals.local
+include disable-exec.inc
 caps.drop all
 ipc-namespace
 nodbus
@@ -27,5 +29,3 @@ private-dev
 # private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/nemo.profile b/etc/nemo.profile
index 2364ea4a7..a23ba1700 100644
--- a/etc/nemo.profile
+++ b/etc/nemo.profile
@@ -21,6 +21,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
@@ -38,5 +39,3 @@ protocol unix,inet,inet6
 seccomp
 shell none
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/nethack-vultures.profile b/etc/nethack-vultures.profile
index 771430337..2c23a4868 100644
--- a/etc/nethack-vultures.profile
+++ b/etc/nethack-vultures.profile
@@ -12,6 +12,7 @@ noblacklist /var/log
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -43,5 +44,3 @@ private-dev
 private-tmp
 writable-var
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/nethack.profile b/etc/nethack.profile
index 8f63a133a..5375d2f4f 100644
--- a/etc/nethack.profile
+++ b/etc/nethack.profile
@@ -11,6 +11,7 @@ noblacklist /var/games/nethack
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -43,5 +44,3 @@ private-tmp
 writable-var
 #memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/neverball.profile b/etc/neverball.profile
index 34493485a..84c634549 100644
--- a/etc/neverball.profile
+++ b/etc/neverball.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.neverball
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -36,5 +37,3 @@ private-bin neverball
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/nheko.profile b/etc/nheko.profile
index ea99b2f5a..2dfddf872 100644
--- a/etc/nheko.profile
+++ b/etc/nheko.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.cache/nheko/nheko
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -40,5 +41,3 @@ disable-mnt
 private-bin nheko
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/nitroshare.profile b/etc/nitroshare.profile
index 4d2c5bdf2..7aba69490 100644
--- a/etc/nitroshare.profile
+++ b/etc/nitroshare.profile
@@ -19,6 +19,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -48,5 +49,3 @@ private-etc alternatives,ca-certificates,dconf,fonts,hostname,hosts,ld.so.cache,
 private-tmp
 # memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/nomacs.profile b/etc/nomacs.profile
index 4bda5cbce..fd154b1c4 100644
--- a/etc/nomacs.profile
+++ b/etc/nomacs.profile
@@ -13,6 +13,7 @@ noblacklist ${PICTURES}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -44,5 +45,3 @@ private-etc alternatives,hosts,ca-certificates,ssl,pki,crypto-policies,resolv.co
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/nyx.profile b/etc/nyx.profile
index 2a078ef0f..ed39283b2 100644
--- a/etc/nyx.profile
+++ b/etc/nyx.profile
@@ -17,6 +17,7 @@ whitelist ${HOME}/.nyx
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -47,5 +48,3 @@ private-opt none
 private-srv none
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/obs.profile b/etc/obs.profile
index 5e3ce092a..1f02efc7f 100644
--- a/etc/obs.profile
+++ b/etc/obs.profile
@@ -20,6 +20,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -44,5 +45,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/onionshare-gui.profile b/etc/onionshare-gui.profile
index 75f6194a6..3ee78c59d 100644
--- a/etc/onionshare-gui.profile
+++ b/etc/onionshare-gui.profile
@@ -14,6 +14,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -40,5 +41,3 @@ private-dev
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/orage.profile b/etc/orage.profile
index 29b8ef749..2c55ab909 100644
--- a/etc/orage.profile
+++ b/etc/orage.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.local/share/orage
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -36,5 +37,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/pdfmod.profile b/etc/pdfmod.profile
index 3b6116c85..177070e83 100644
--- a/etc/pdfmod.profile
+++ b/etc/pdfmod.profile
@@ -12,6 +12,7 @@ noblacklist ${DOCUMENTS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -40,5 +41,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/pdfsam.profile b/etc/pdfsam.profile
index 4eed98e88..98dcce0b7 100644
--- a/etc/pdfsam.profile
+++ b/etc/pdfsam.profile
@@ -17,6 +17,7 @@ noblacklist /usr/share/java
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -44,5 +45,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/peek.profile b/etc/peek.profile
index 06e7b3e62..fd836560e 100644
--- a/etc/peek.profile
+++ b/etc/peek.profile
@@ -11,6 +11,7 @@ noblacklist ${VIDEOS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -38,5 +39,3 @@ private-dev
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/picard.profile b/etc/picard.profile
index 26002e14d..b756ed629 100644
--- a/etc/picard.profile
+++ b/etc/picard.profile
@@ -20,6 +20,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -44,5 +45,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/pithos.profile b/etc/pithos.profile
index 6492ace7b..d6a0a7822 100644
--- a/etc/pithos.profile
+++ b/etc/pithos.profile
@@ -16,6 +16,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -43,5 +44,3 @@ private-bin pithos,env,python*
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/pitivi.profile b/etc/pitivi.profile
index ac7922833..83f5ccbb9 100644
--- a/etc/pitivi.profile
+++ b/etc/pitivi.profile
@@ -19,6 +19,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -42,5 +43,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/polari.profile b/etc/polari.profile
index 5fa717cb3..b9f81eece 100644
--- a/etc/polari.profile
+++ b/etc/polari.profile
@@ -9,6 +9,7 @@ include globals.local
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-programs.inc
@@ -45,5 +46,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/ppsspp.profile b/etc/ppsspp.profile
index 0c8bfa770..480a03e49 100644
--- a/etc/ppsspp.profile
+++ b/etc/ppsspp.profile
@@ -13,6 +13,7 @@ noblacklist /usr/lib/llvm*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -41,5 +42,3 @@ private-etc alternatives,asound.conf,ca-certificates,drirc,fonts,group,host.conf
 private-opt ppsspp
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/pragha.profile b/etc/pragha.profile
index a595caee9..4e6840636 100644
--- a/etc/pragha.profile
+++ b/etc/pragha.profile
@@ -11,6 +11,7 @@ noblacklist ${MUSIC}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,5 +36,3 @@ private-dev
 private-etc alternatives,asound.conf,ca-certificates,fonts,host.conf,hostname,hosts,pulse,resolv.conf,ssl,pki,crypto-policies,gtk-3.0,xdg,machine-id
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/psi-plus.profile b/etc/psi-plus.profile
index 7ec789440..087f90966 100644
--- a/etc/psi-plus.profile
+++ b/etc/psi-plus.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.local/share/psi+
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -42,5 +43,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/pybitmessage.profile b/etc/pybitmessage.profile
index 63ae156a1..28ab8caa6 100644
--- a/etc/pybitmessage.profile
+++ b/etc/pybitmessage.profile
@@ -19,6 +19,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-interpreters.inc
@@ -47,5 +48,3 @@ private-dev
 private-etc alternatives,PyBitmessage,PyBitmessage.conf,Trolltech.conf,fonts,gtk-2.0,hosts,ld.so.cache,ld.so.preload,localtime,pki,resolv.conf,selinux,sni-qt.conf,system-fips,xdg,ca-certificates,ssl,pki,crypto-policies
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/qlipper.profile b/etc/qlipper.profile
index ec0b6c64d..fb9dca48f 100644
--- a/etc/qlipper.profile
+++ b/etc/qlipper.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/Qlipper
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,5 +36,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/qmmp.profile b/etc/qmmp.profile
index 66c27a585..f786e73b7 100644
--- a/etc/qmmp.profile
+++ b/etc/qmmp.profile
@@ -11,6 +11,7 @@ noblacklist ${MUSIC}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
@@ -34,5 +35,3 @@ private-bin qmmp,tar,unzip,bzip2,gzip
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/quiterss.profile b/etc/quiterss.profile
index e6c441e27..41c84425b 100644
--- a/etc/quiterss.profile
+++ b/etc/quiterss.profile
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.local/share/QuiteRss
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -49,5 +50,3 @@ private-bin quiterss
 private-dev
 # private-etc alternatives,X11,ssl,pki,ca-certificates,crypto-policies
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/qupzilla.profile b/etc/qupzilla.profile
index eef0c8fa6..1b23b2baf 100644
--- a/etc/qupzilla.profile
+++ b/etc/qupzilla.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/qupzilla
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -37,5 +38,3 @@ private-dev
 # private-etc alternatives,passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,adobe,mime.types,mailcap,asound.conf,pulse,machine-id,ca-certificates,ssl,pki,crypto-policies
 # private-tmp - interferes with the opening of downloaded files
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/redeclipse.profile b/etc/redeclipse.profile
index 278514538..bb1ad56d3 100644
--- a/etc/redeclipse.profile
+++ b/etc/redeclipse.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.redeclipse
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -36,5 +37,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/remmina.profile b/etc/remmina.profile
index 888f3819f..a77f2d8aa 100644
--- a/etc/remmina.profile
+++ b/etc/remmina.profile
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.ssh
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -37,5 +38,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/ricochet.profile b/etc/ricochet.profile
index a67d6b7ca..3cb30c459 100644
--- a/etc/ricochet.profile
+++ b/etc/ricochet.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.local/share/Ricochet
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -38,5 +39,3 @@ private-bin ricochet,tor
 private-dev
 #private-etc alternatives,fonts,tor,X11,alternatives,ca-certificates,ssl,pki,crypto-policies
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/ristretto.profile b/etc/ristretto.profile
index e6b22b914..8fcbb203c 100644
--- a/etc/ristretto.profile
+++ b/etc/ristretto.profile
@@ -12,6 +12,7 @@ noblacklist ${HOME}/.steam
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,5 +36,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/sayonara.profile b/etc/sayonara.profile
index ce86c80f9..8f0544f33 100644
--- a/etc/sayonara.profile
+++ b/etc/sayonara.profile
@@ -10,6 +10,7 @@ noblacklist ${MUSIC}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
@@ -32,5 +33,3 @@ private-bin sayonara
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/scallion.profile b/etc/scallion.profile
index b4d0ef240..232ec4346 100644
--- a/etc/scallion.profile
+++ b/etc/scallion.profile
@@ -13,6 +13,7 @@ noblacklist ${PATH}/openssl-1.0
 noblacklist ${DOCUMENTS}
 include disable-common.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -40,6 +41,3 @@ disable-mnt
 private
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/scribus.profile b/etc/scribus.profile
index 5bec43d85..d8dc7b0e0 100644
--- a/etc/scribus.profile
+++ b/etc/scribus.profile
@@ -36,6 +36,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -63,5 +64,3 @@ tracelog
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/sdat2img.profile b/etc/sdat2img.profile
index d78b51766..485326fcc 100644
--- a/etc/sdat2img.profile
+++ b/etc/sdat2img.profile
@@ -16,6 +16,7 @@ noblacklist /usr/local/lib/python3*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -43,5 +44,3 @@ private-bin sdat2img,env,python*
 private-cache
 private-dev
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/shellcheck.profile b/etc/shellcheck.profile
index 429633a6d..b8974e416 100644
--- a/etc/shellcheck.profile
+++ b/etc/shellcheck.profile
@@ -11,6 +11,7 @@ noblacklist ${DOCUMENTS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -39,5 +40,3 @@ private-dev
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/silentarmy.profile b/etc/silentarmy.profile
index 5ef96a4ea..7aeb2909b 100644
--- a/etc/silentarmy.profile
+++ b/etc/silentarmy.profile
@@ -8,6 +8,7 @@ include globals.local
 include disable-common.inc
 # include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -36,5 +37,3 @@ private-dev
 private-opt none
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/skype.profile b/etc/skype.profile
index 09b9baa11..55057c546 100644
--- a/etc/skype.profile
+++ b/etc/skype.profile
@@ -9,8 +9,10 @@ noblacklist ${HOME}/.Skype
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-programs.inc
 caps.drop all
@@ -31,5 +33,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/slashem.profile b/etc/slashem.profile
index 0a372ce5f..011698e1f 100644
--- a/etc/slashem.profile
+++ b/etc/slashem.profile
@@ -11,6 +11,7 @@ noblacklist /var/games/slashem
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -43,5 +44,3 @@ private-tmp
 writable-var
 #memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/smtube.profile b/etc/smtube.profile
index 24f3db40a..1c7c6c0d2 100644
--- a/etc/smtube.profile
+++ b/etc/smtube.profile
@@ -17,6 +17,7 @@ noblacklist ${VIDEOS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -41,5 +42,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/spectre-meltdown-checker.profile b/etc/spectre-meltdown-checker.profile
index b43047401..74582dd2f 100644
--- a/etc/spectre-meltdown-checker.profile
+++ b/etc/spectre-meltdown-checker.profile
@@ -20,6 +20,7 @@ noblacklist /usr/share/perl*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -49,5 +50,3 @@ private-cache
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/spotify.profile b/etc/spotify.profile
index 60d15735d..6f7f6ec85 100644
--- a/etc/spotify.profile
+++ b/etc/spotify.profile
@@ -16,6 +16,7 @@ noblacklist ${HOME}/.local/share/spotify
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -50,5 +51,3 @@ private-etc alternatives,fonts,group,ld.so.cache,machine-id,pulse,resolv.conf,ho
 private-opt spotify
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/stellarium.profile b/etc/stellarium.profile
index 7d0000fb3..d6df2e0ad 100644
--- a/etc/stellarium.profile
+++ b/etc/stellarium.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.stellarium
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -42,5 +43,3 @@ private-bin stellarium
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/surf.profile b/etc/surf.profile
index 4fad4a81d..0504b5fe5 100644
--- a/etc/surf.profile
+++ b/etc/surf.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.surf
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,5 +36,3 @@ private-dev
 private-etc alternatives,passwd,group,hosts,resolv.conf,fonts,ssl,pki,ca-certificates,crypto-policies
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/synfigstudio.profile b/etc/synfigstudio.profile
index 9ce1bb183..33086a99d 100644
--- a/etc/synfigstudio.profile
+++ b/etc/synfigstudio.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.synfig
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,5 +36,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/teamspeak3.profile b/etc/teamspeak3.profile
index 25928882b..8d5917148 100644
--- a/etc/teamspeak3.profile
+++ b/etc/teamspeak3.profile
@@ -11,6 +11,7 @@ noblacklist ${PATH}/openssl
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -39,5 +40,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/telegram.profile b/etc/telegram.profile
index fb2c06a27..e3af5600a 100644
--- a/etc/telegram.profile
+++ b/etc/telegram.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.local/share/TelegramDesktop
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-programs.inc
@@ -26,5 +27,3 @@ disable-mnt
 private-cache
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/tilp.profile b/etc/tilp.profile
index 2643c9a84..4d38d5184 100644
--- a/etc/tilp.profile
+++ b/etc/tilp.profile
@@ -9,6 +9,7 @@ noblacklist ${HOME}/.tilp
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -32,5 +33,3 @@ private-cache
 private-etc alternatives,fonts
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/tor.profile b/etc/tor.profile
index 418352639..e80fbadb0 100644
--- a/etc/tor.profile
+++ b/etc/tor.profile
@@ -19,6 +19,7 @@ include globals.local
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -49,5 +50,3 @@ private-dev
 private-etc alternatives,tor,passwd,ca-certificates,ssl,pki,crypto-policies
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/transmission-remote.profile b/etc/transmission-remote.profile
index d9ba7be71..ddeb9adf9 100644
--- a/etc/transmission-remote.profile
+++ b/etc/transmission-remote.profile
@@ -20,7 +20,7 @@ include disable-programs.inc
 apparmor
 caps.drop all
 machine-id
-net none
+netfilter
 nodbus
 nodvd
 nonewprivs
@@ -29,14 +29,14 @@ nosound
 notv
 nou2f
 novideo
-protocol unix
+protocol inet,inet6
 seccomp
 shell none
 tracelog
 # private-bin transmission-remote
 private-dev
-private-etc alternatives
+private-etc alternatives,hosts,nsswitch.conf
 private-lib
 private-tmp
diff --git a/etc/transmission-show.profile b/etc/transmission-show.profile
index 58f7af47c..779606f04 100644
--- a/etc/transmission-show.profile
+++ b/etc/transmission-show.profile
@@ -19,7 +19,7 @@ include disable-programs.inc
 apparmor
 caps.drop all
 machine-id
-net none
+netfilter
 nodbus
 nodvd
 nonewprivs
@@ -28,13 +28,13 @@ nosound
 notv
 nou2f
 novideo
-protocol unix
+protocol inet,inet6
 seccomp
 shell none
 tracelog
 private-dev
-private-etc alternatives
+private-etc alternatives,hosts,nsswitch.conf
 private-lib
 private-tmp
diff --git a/etc/truecraft.profile b/etc/truecraft.profile
index ae1d85473..e76d52219 100644
--- a/etc/truecraft.profile
+++ b/etc/truecraft.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/truecraft
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -36,5 +37,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/uefitool.profile b/etc/uefitool.profile
index 218b41e15..8ab0e9a26 100644
--- a/etc/uefitool.profile
+++ b/etc/uefitool.profile
@@ -9,6 +9,7 @@ noblacklist ${DOCUMENTS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,5 +36,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/utox.profile b/etc/utox.profile
new file mode 100644
index 000000000..9216a6a05
--- /dev/null
+++ b/etc/utox.profile
@@ -0,0 +1,47 @@
+# Firejail profile for utox
+# Description: Lightweight Tox client
+# This file is overwritten after every install/update
+# Persistent local customizations
+include utox.local
+# Persistent global definitions
+include globals.local
+noblacklist ${HOME}/.config/tox
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include disable-xdg.inc
+mkdir ${HOME}/.config/tox
+whitelist ${DOWNLOADS}
+whitelist ${HOME}/.config/tox
+include whitelist-common.inc
+include whitelist-var-common.inc
+apparmor
+caps.drop all
+ipc-namespace
+netfilter
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+nou2f
+protocol unix,inet,inet6
+seccomp
+shell none
+tracelog
+disable-mnt
+private-bin utox
+private-cache
+private-dev
+private-etc alternatives,fonts,resolv.conf,ld.so.cache,localtime,ca-certificates,ssl,pki,crypto-policies,machine-id,pulse,openal
+private-tmp
+memory-deny-write-execute
diff --git a/etc/viking.profile b/etc/viking.profile
index baf268691..5b6228a94 100644
--- a/etc/viking.profile
+++ b/etc/viking.profile
@@ -12,6 +12,7 @@ noblacklist ${DOCUMENTS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -34,5 +35,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/vym.profile b/etc/vym.profile
index bb3f6ac56..fbb53943c 100644
--- a/etc/vym.profile
+++ b/etc/vym.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/InSilmaril
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -33,5 +34,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/webui-aria2.profile b/etc/webui-aria2.profile
index 5bc9c122b..0cd1e05ab 100644
--- a/etc/webui-aria2.profile
+++ b/etc/webui-aria2.profile
@@ -10,6 +10,7 @@ noblacklist ${PATH}/node
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -34,5 +35,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/whois.profile b/etc/whois.profile
index 0e9eb05a5..cc2494f95 100644
--- a/etc/whois.profile
+++ b/etc/whois.profile
@@ -9,6 +9,7 @@ include globals.local
 include disable-common.inc
 # include disable-devel.inc
+include disable-exec.inc
 # include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -43,5 +44,3 @@ private-lib
 private-tmp
 memory-deny-write-execute
-# noexec ${HOME}
-# noexec /tmp
diff --git a/etc/xfce4-dict.profile b/etc/xfce4-dict.profile
index 0dc021ef3..bc499bd30 100644
--- a/etc/xfce4-dict.profile
+++ b/etc/xfce4-dict.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/xfce4-dict
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -34,5 +35,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/xfce4-notes.profile b/etc/xfce4-notes.profile
index df1b575b2..4dad1bf7a 100644
--- a/etc/xfce4-notes.profile
+++ b/etc/xfce4-notes.profile
@@ -12,6 +12,7 @@ noblacklist ${HOME}/.local/share/notes
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -36,5 +37,3 @@ private-cache
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/xmr-stak.profile b/etc/xmr-stak.profile
index 99c9676b8..3fbdf66ab 100644
--- a/etc/xmr-stak.profile
+++ b/etc/xmr-stak.profile
@@ -10,6 +10,7 @@ noblacklist /usr/lib/llvm*
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -43,5 +44,3 @@ private-opt cuda
 private-tmp
 memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/xonotic.profile b/etc/xonotic.profile
index 9d422a01e..09c0639f8 100644
--- a/etc/xonotic.profile
+++ b/etc/xonotic.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.xonotic
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -39,5 +40,3 @@ private-dev
 private-etc alternatives,asound.conf,ca-certificates,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pulse,resolv.conf,ssl,pki,crypto-policies,machine-id
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/xpdf.profile b/etc/xpdf.profile
index 4a82942ad..8c405ba1d 100644
--- a/etc/xpdf.profile
+++ b/etc/xpdf.profile
@@ -11,6 +11,7 @@ noblacklist ${DOCUMENTS}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -38,5 +39,3 @@ shell none
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/zaproxy.profile b/etc/zaproxy.profile
index cc572cbfe..dc3164da1 100644
--- a/etc/zaproxy.profile
+++ b/etc/zaproxy.profile
@@ -17,6 +17,7 @@ noblacklist /usr/share/java
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -47,5 +48,3 @@ disable-mnt
 private-dev
 private-tmp
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/zart.profile b/etc/zart.profile
index 32df94841..f380e93f0 100644
--- a/etc/zart.profile
+++ b/etc/zart.profile
@@ -11,6 +11,7 @@ noblacklist ${PICTURES}
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -33,5 +34,3 @@ shell none
 private-bin zart,ffmpeg,melt,ffprobe,ffplay
 private-dev
-noexec ${HOME}
-noexec /tmp
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 5125d0cca..7aec0f82a 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -9,6 +9,7 @@ Cryptocat
 Cyberfox
 Discord
 DiscordCanary
+Documents
 FossaMail
 Fritzing
 Gitter
@@ -565,6 +566,7 @@ uefitool
 uget-gtk
 unbound
 unknown-horizons
+utox
 uudeview
 uzbl-browser
 viewnior
diff --git a/src/firejail/Makefile.in b/src/firejail/Makefile.in
index d0f43041c..8cb994aca 100644
--- a/src/firejail/Makefile.in
+++ b/src/firejail/Makefile.in
@@ -2,7 +2,7 @@ all: firejail
 include ../common.mk
-%.o : %.c $(H_FILE_LIST) ../include/common.h ../include/ldd_utils.h ../include/euid_common.h ../include/pid.h ../include/seccomp.h ../include/syscall.h ../include/firejail_user.h
+%.o : %.c $(H_FILE_LIST) ../include/rundefs.h ../include/common.h ../include/ldd_utils.h ../include/euid_common.h ../include/pid.h ../include/seccomp.h ../include/syscall.h ../include/firejail_user.h
        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 firejail: $(OBJS) ../lib/libnetlink.o ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 4cb10c875..b2c18d79f 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -21,90 +21,13 @@
 #define FIREJAIL_H
 #include "../include/common.h"
 #include "../include/euid_common.h"
+#include "../include/rundefs.h"
 #include <stdarg.h>
 #include <sys/stat.h>
 // debug restricted shell
 //#define DEBUG_RESTRICTED_SHELL
-// filesystem
-#define RUN_FIREJAIL_BASEDIR    "/run"
-#define RUN_FIREJAIL_DIR        "/run/firejail"
-#define RUN_FIREJAIL_APPIMAGE_DIR       "/run/firejail/appimage"
-#define RUN_FIREJAIL_NAME_DIR   "/run/firejail/name" // also used in src/lib/pid.c - todo: move it in a common place
-#define RUN_FIREJAIL_LIB_DIR            "/run/firejail/lib"
-#define RUN_FIREJAIL_X11_DIR    "/run/firejail/x11"
-#define RUN_FIREJAIL_NETWORK_DIR        "/run/firejail/network"
-#define RUN_FIREJAIL_BANDWIDTH_DIR      "/run/firejail/bandwidth"
-#define RUN_FIREJAIL_PROFILE_DIR                "/run/firejail/profile"
-#define RUN_NETWORK_LOCK_FILE   "/run/firejail/firejail-network.lock"
-#define RUN_DIRECTORY_LOCK_FILE "/run/firejail/firejail-run.lock"
-#define RUN_RO_DIR      "/run/firejail/firejail.ro.dir"
-#define RUN_RO_FILE     "/run/firejail/firejail.ro.file"
-#define RUN_MNT_DIR     "/run/firejail/mnt"     // a tmpfs is mounted on this directory before any of the files below are created
-#define RUN_CGROUP_CFG  "/run/firejail/mnt/cgroup"
-#define RUN_CPU_CFG     "/run/firejail/mnt/cpu"
-#define RUN_GROUPS_CFG  "/run/firejail/mnt/groups"
-#define RUN_PROTOCOL_CFG        "/run/firejail/mnt/protocol"
-#define RUN_NONEWPRIVS_CFG      "/run/firejail/mnt/nonewprivs"
-#define RUN_HOME_DIR    "/run/firejail/mnt/home"
-#define RUN_ETC_DIR     "/run/firejail/mnt/etc"
-#define RUN_OPT_DIR     "/run/firejail/mnt/opt"
-#define RUN_SRV_DIR     "/run/firejail/mnt/srv"
-#define RUN_BIN_DIR     "/run/firejail/mnt/bin"
-#define RUN_PULSE_DIR   "/run/firejail/mnt/pulse"
-#define RUN_LIB_DIR     "/run/firejail/mnt/lib"
-#define RUN_LIB_FILE    "/run/firejail/mnt/libfiles"
-#define RUN_DNS_ETC     "/run/firejail/mnt/dns-etc"
-#define RUN_SECCOMP_DIR "/run/firejail/mnt/seccomp"
-#define RUN_SECCOMP_LIST        "/run/firejail/mnt/seccomp/seccomp.list"        // list of seccomp files installed
-#define RUN_SECCOMP_PROTOCOL    "/run/firejail/mnt/seccomp/seccomp.protocol"    // protocol filter
-#define RUN_SECCOMP_CFG "/run/firejail/mnt/seccomp/seccomp"                     // configured filter
-#define RUN_SECCOMP_32          "/run/firejail/mnt/seccomp/seccomp.32"          // 32bit arch filter installed on 64bit architectures
-#define RUN_SECCOMP_MDWX        "/run/firejail/mnt/seccomp/seccomp.mdwx"                // filter for memory-deny-write-execute
-#define RUN_SECCOMP_BLOCK_SECONDARY     "/run/firejail/mnt/seccomp/seccomp.block_secondary"     // secondary arch blocking filter
-#define RUN_SECCOMP_POSTEXEC    "/run/firejail/mnt/seccomp/seccomp.postexec"            // filter for post-exec library
-#define PATH_SECCOMP_DEFAULT (LIBDIR "/firejail/seccomp")                       // default filter built during make
-#define PATH_SECCOMP_DEFAULT_DEBUG (LIBDIR "/firejail/seccomp.debug")   // default filter built during make
-#define PATH_SECCOMP_32 (LIBDIR "/firejail/seccomp.32")                 // 32bit arch filter built during make
-#define PATH_SECCOMP_MDWX (LIBDIR "/firejail/seccomp.mdwx")             // filter for memory-deny-write-execute built during make
-#define PATH_SECCOMP_BLOCK_SECONDARY (LIBDIR "/firejail/seccomp.block_secondary")       // secondary arch blocking filter built during make
-#define RUN_DEV_DIR             "/run/firejail/mnt/dev"
-#define RUN_DEVLOG_FILE "/run/firejail/mnt/devlog"
-#define RUN_WHITELIST_X11_DIR   "/run/firejail/mnt/orig-x11"
-#define RUN_WHITELIST_HOME_DIR  "/run/firejail/mnt/orig-home"   // default home directory masking
-#define RUN_WHITELIST_RUN_DIR   "/run/firejail/mnt/orig-run"    // default run directory masking
-#define RUN_WHITELIST_HOME_USER_DIR     "/run/firejail/mnt/orig-home-user"      // home directory whitelisting
-#define RUN_WHITELIST_RUN_USER_DIR      "/run/firejail/mnt/orig-run-user"       // run directory whitelisting
-#define RUN_WHITELIST_TMP_DIR   "/run/firejail/mnt/orig-tmp"
-#define RUN_WHITELIST_MEDIA_DIR "/run/firejail/mnt/orig-media"
-#define RUN_WHITELIST_MNT_DIR   "/run/firejail/mnt/orig-mnt"
-#define RUN_WHITELIST_VAR_DIR   "/run/firejail/mnt/orig-var"
-#define RUN_WHITELIST_DEV_DIR   "/run/firejail/mnt/orig-dev"
-#define RUN_WHITELIST_OPT_DIR   "/run/firejail/mnt/orig-opt"
-#define RUN_WHITELIST_SRV_DIR   "/run/firejail/mnt/orig-srv"
-#define RUN_WHITELIST_ETC_DIR   "/run/firejail/mnt/orig-etc"
-#define RUN_WHITELIST_SHARE_DIR   "/run/firejail/mnt/orig-share"
-#define RUN_WHITELIST_MODULE_DIR   "/run/firejail/mnt/orig-module"
-#define RUN_XAUTHORITY_FILE     "/run/firejail/mnt/.Xauthority"
-#define RUN_XAUTHORITY_SEC_FILE "/run/firejail/mnt/sec.Xauthority"
-#define RUN_ASOUNDRC_FILE       "/run/firejail/mnt/.asoundrc"
-#define RUN_HOSTNAME_FILE       "/run/firejail/mnt/hostname"
-#define RUN_HOSTS_FILE  "/run/firejail/mnt/hosts"
-#define RUN_MACHINEID   "/run/firejail/mnt/machine-id"
-#define RUN_LDPRELOAD_FILE      "/run/firejail/mnt/ld.so.preload"
-#define RUN_UTMP_FILE           "/run/firejail/mnt/utmp"
-#define RUN_PASSWD_FILE         "/run/firejail/mnt/passwd"
-#define RUN_GROUP_FILE          "/run/firejail/mnt/group"
-#define RUN_FSLOGGER_FILE               "/run/firejail/mnt/fslogger"
-#define RUN_UMASK_FILE          "/run/firejail/mnt/umask"
-#define RUN_OVERLAY_ROOT        "/run/firejail/mnt/oroot"
-#define RUN_READY_FOR_JOIN      "/run/firejail/mnt/ready-for-join"
 // profiles
diff --git a/src/include/rundefs.h b/src/include/rundefs.h
new file mode 100644
index 000000000..67d7cfa4f
--- /dev/null
+++ b/src/include/rundefs.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2014-2019 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#ifndef RUNDEFS_H
+#define RUNDEFS_H
+// filesystem
+#define RUN_FIREJAIL_BASEDIR    "/run"
+#define RUN_FIREJAIL_DIR        "/run/firejail"
+#define RUN_FIREJAIL_APPIMAGE_DIR       "/run/firejail/appimage"
+#define RUN_FIREJAIL_NAME_DIR   "/run/firejail/name" // also used in src/lib/pid.c - todo: move it in a common place
+#define RUN_FIREJAIL_LIB_DIR            "/run/firejail/lib"
+#define RUN_FIREJAIL_X11_DIR    "/run/firejail/x11"
+#define RUN_FIREJAIL_NETWORK_DIR        "/run/firejail/network"
+#define RUN_FIREJAIL_BANDWIDTH_DIR      "/run/firejail/bandwidth"
+#define RUN_FIREJAIL_PROFILE_DIR                "/run/firejail/profile"
+#define RUN_NETWORK_LOCK_FILE   "/run/firejail/firejail-network.lock"
+#define RUN_DIRECTORY_LOCK_FILE "/run/firejail/firejail-run.lock"
+#define RUN_RO_DIR      "/run/firejail/firejail.ro.dir"
+#define RUN_RO_FILE     "/run/firejail/firejail.ro.file"
+#define RUN_MNT_DIR     "/run/firejail/mnt"     // a tmpfs is mounted on this directory before any of the files below are created
+#define RUN_CGROUP_CFG  "/run/firejail/mnt/cgroup"
+#define RUN_CPU_CFG     "/run/firejail/mnt/cpu"
+#define RUN_GROUPS_CFG  "/run/firejail/mnt/groups"
+#define RUN_PROTOCOL_CFG        "/run/firejail/mnt/protocol"
+#define RUN_NONEWPRIVS_CFG      "/run/firejail/mnt/nonewprivs"
+#define RUN_HOME_DIR    "/run/firejail/mnt/home"
+#define RUN_ETC_DIR     "/run/firejail/mnt/etc"
+#define RUN_OPT_DIR     "/run/firejail/mnt/opt"
+#define RUN_SRV_DIR     "/run/firejail/mnt/srv"
+#define RUN_BIN_DIR     "/run/firejail/mnt/bin"
+#define RUN_PULSE_DIR   "/run/firejail/mnt/pulse"
+#define RUN_LIB_DIR     "/run/firejail/mnt/lib"
+#define RUN_LIB_FILE    "/run/firejail/mnt/libfiles"
+#define RUN_DNS_ETC     "/run/firejail/mnt/dns-etc"
+#define RUN_SECCOMP_DIR "/run/firejail/mnt/seccomp"
+#define RUN_SECCOMP_LIST        "/run/firejail/mnt/seccomp/seccomp.list"        // list of seccomp files installed
+#define RUN_SECCOMP_PROTOCOL    "/run/firejail/mnt/seccomp/seccomp.protocol"    // protocol filter
+#define RUN_SECCOMP_CFG "/run/firejail/mnt/seccomp/seccomp"                     // configured filter
+#define RUN_SECCOMP_32          "/run/firejail/mnt/seccomp/seccomp.32"          // 32bit arch filter installed on 64bit architectures
+#define RUN_SECCOMP_MDWX        "/run/firejail/mnt/seccomp/seccomp.mdwx"                // filter for memory-deny-write-execute
+#define RUN_SECCOMP_BLOCK_SECONDARY     "/run/firejail/mnt/seccomp/seccomp.block_secondary"     // secondary arch blocking filter
+#define RUN_SECCOMP_POSTEXEC    "/run/firejail/mnt/seccomp/seccomp.postexec"            // filter for post-exec library
+#define PATH_SECCOMP_DEFAULT (LIBDIR "/firejail/seccomp")                       // default filter built during make
+#define PATH_SECCOMP_DEFAULT_DEBUG (LIBDIR "/firejail/seccomp.debug")   // default filter built during make
+#define PATH_SECCOMP_32 (LIBDIR "/firejail/seccomp.32")                 // 32bit arch filter built during make
+#define PATH_SECCOMP_MDWX (LIBDIR "/firejail/seccomp.mdwx")             // filter for memory-deny-write-execute built during make
+#define PATH_SECCOMP_BLOCK_SECONDARY (LIBDIR "/firejail/seccomp.block_secondary")       // secondary arch blocking filter built during make
+#define RUN_DEV_DIR             "/run/firejail/mnt/dev"
+#define RUN_DEVLOG_FILE "/run/firejail/mnt/devlog"
+#define RUN_WHITELIST_X11_DIR   "/run/firejail/mnt/orig-x11"
+#define RUN_WHITELIST_HOME_DIR  "/run/firejail/mnt/orig-home"   // default home directory masking
+#define RUN_WHITELIST_RUN_DIR   "/run/firejail/mnt/orig-run"    // default run directory masking
+#define RUN_WHITELIST_HOME_USER_DIR     "/run/firejail/mnt/orig-home-user"      // home directory whitelisting
+#define RUN_WHITELIST_RUN_USER_DIR      "/run/firejail/mnt/orig-run-user"       // run directory whitelisting
+#define RUN_WHITELIST_TMP_DIR   "/run/firejail/mnt/orig-tmp"
+#define RUN_WHITELIST_MEDIA_DIR "/run/firejail/mnt/orig-media"
+#define RUN_WHITELIST_MNT_DIR   "/run/firejail/mnt/orig-mnt"
+#define RUN_WHITELIST_VAR_DIR   "/run/firejail/mnt/orig-var"
+#define RUN_WHITELIST_DEV_DIR   "/run/firejail/mnt/orig-dev"
+#define RUN_WHITELIST_OPT_DIR   "/run/firejail/mnt/orig-opt"
+#define RUN_WHITELIST_SRV_DIR   "/run/firejail/mnt/orig-srv"
+#define RUN_WHITELIST_ETC_DIR   "/run/firejail/mnt/orig-etc"
+#define RUN_WHITELIST_SHARE_DIR   "/run/firejail/mnt/orig-share"
+#define RUN_WHITELIST_MODULE_DIR   "/run/firejail/mnt/orig-module"
+#define RUN_XAUTHORITY_FILE     "/run/firejail/mnt/.Xauthority"
+#define RUN_XAUTHORITY_SEC_FILE "/run/firejail/mnt/sec.Xauthority"
+#define RUN_ASOUNDRC_FILE       "/run/firejail/mnt/.asoundrc"
+#define RUN_HOSTNAME_FILE       "/run/firejail/mnt/hostname"
+#define RUN_HOSTS_FILE  "/run/firejail/mnt/hosts"
+#define RUN_MACHINEID   "/run/firejail/mnt/machine-id"
+#define RUN_LDPRELOAD_FILE      "/run/firejail/mnt/ld.so.preload"
+#define RUN_UTMP_FILE           "/run/firejail/mnt/utmp"
+#define RUN_PASSWD_FILE         "/run/firejail/mnt/passwd"
+#define RUN_GROUP_FILE          "/run/firejail/mnt/group"
+#define RUN_FSLOGGER_FILE               "/run/firejail/mnt/fslogger"
+#define RUN_UMASK_FILE          "/run/firejail/mnt/umask"
+#define RUN_OVERLAY_ROOT        "/run/firejail/mnt/oroot"
+#define RUN_READY_FOR_JOIN      "/run/firejail/mnt/ready-for-join"
+#endif
diff --git a/src/libpostexecseccomp/Makefile.in b/src/libpostexecseccomp/Makefile.in
index 92803342c..8d6dde4e0 100644
--- a/src/libpostexecseccomp/Makefile.in
+++ b/src/libpostexecseccomp/Makefile.in
@@ -13,13 +13,12 @@ LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now
 all: libpostexecseccomp.so
-%.o : %.c $(H_FILE_LIST)
+%.o : %.c $(H_FILE_LIST) ../include/seccomp.h ../include/rundefs.h
        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
 libpostexecseccomp.so: $(OBJS)
        $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl
 clean:; rm -f $(OBJS) libpostexecseccomp.so
 distclean: clean
diff --git a/src/libpostexecseccomp/libpostexecseccomp.c b/src/libpostexecseccomp/libpostexecseccomp.c
index e51445de4..3983510ec 100644
--- a/src/libpostexecseccomp/libpostexecseccomp.c
+++ b/src/libpostexecseccomp/libpostexecseccomp.c
@@ -17,19 +17,22 @@
 * with this program; if not, write to the Free Software Foundation, Inc.,
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
-#include "libpostexecseccomp.h"
 #include "../include/seccomp.h"
+#include "../include/rundefs.h"
 #include <fcntl.h>
 #include <linux/filter.h>
 #include <sys/mman.h>
 #include <sys/prctl.h>
 #include <unistd.h>
+#include <stdio.h>
 __attribute__((constructor))
 static void load_seccomp(void) {
        int fd = open(RUN_SECCOMP_POSTEXEC, O_RDONLY);
-        if (fd == -1)
+        if (fd == -1) {
+                fprintf(stderr, "Error: cannot open seccomp postexec filter file %s\n", RUN_SECCOMP_POSTEXEC);
                return;
+        }
        off_t size = lseek(fd, 0, SEEK_END);
        if (size <= 0) {
@@ -40,11 +43,12 @@ static void load_seccomp(void) {
        struct sock_filter *filter = MAP_FAILED;
        if (size != 0)
                filter = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);
        close(fd);
-        if (filter == MAP_FAILED)
+        if (filter == MAP_FAILED) {
+                fprintf(stderr, "Error: cannot map seccomp postexec filter data\n");
                return;
+        }
        // install filter
        struct sock_fprog prog = {
diff --git a/src/libpostexecseccomp/libpostexecseccomp.h b/src/libpostexecseccomp/libpostexecseccomp.h
deleted file mode 100644
index 908364d43..000000000
--- a/src/libpostexecseccomp/libpostexecseccomp.h
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright (C) 2014-2019 Firejail Authors
- *
- * This file is part of firejail project
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-#ifndef LIBPOSTEXECSECCOMP_H
-#define LIBPOSTEXECSECCOMP_H
-#define RUN_SECCOMP_POSTEXEC    "/run/firejail/mnt/seccomp.postexec"
-#endif
diff --git a/src/libtracelog/Makefile.in b/src/libtracelog/Makefile.in
index 3927c762a..5c27f3cb3 100644
--- a/src/libtracelog/Makefile.in
+++ b/src/libtracelog/Makefile.in
@@ -13,7 +13,7 @@ LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now
 all: libtracelog.so
-%.o : %.c $(H_FILE_LIST)
+%.o : %.c $(H_FILE_LIST) ../include/rundefs.h
        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
 libtracelog.so: $(OBJS)
diff --git a/src/libtracelog/libtracelog.c b/src/libtracelog/libtracelog.c
index 420c9370c..3641a81af 100644
--- a/src/libtracelog/libtracelog.c
+++ b/src/libtracelog/libtracelog.c
@@ -32,6 +32,7 @@
 #include <syslog.h>
 #include <dirent.h>
 #include <limits.h>
+#include "../include/rundefs.h"
 //#define DEBUG
@@ -163,7 +164,6 @@ static char *storage_find(const char *str) {
 //
 // load blacklist form /run/firejail/mnt/fslogger
 //
-#define RUN_FSLOGGER_FILE               "/run/firejail/mnt/fslogger"
 #define MAXBUF 4096
 static int blacklist_loaded = 0;
 static char *sandbox_pid_str = NULL;
diff --git a/test/filters/seccomp-debug.exp b/test/filters/seccomp-debug.exp
index 39f836ed0..dc4bf34f2 100755
--- a/test/filters/seccomp-debug.exp
+++ b/test/filters/seccomp-debug.exp
@@ -13,7 +13,7 @@ after 100
 send --  "firejail --debug sleep 1; echo done\r"
 expect {
        timeout {puts "TESTING ERROR 0\n";exit}
-        "seccomp entries in /run/firejail/mnt/seccomp"
+        "seccomp entries in /run/firejail/mnt/seccomp/seccomp"
 }
 expect {
        timeout {puts "TESTING ERROR 2\n";exit}
@@ -38,15 +38,15 @@ expect {
 }
 expect {
        timeout {puts "TESTING ERROR 6\n";exit}
-        "Installing /run/firejail/mnt/seccomp seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 7\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 8\n";exit}
-        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 9\n";exit}
@@ -58,15 +58,15 @@ after 100
 send --  "firejail --debug --ignore=seccomp sleep 1; echo done\r"
 expect {
        timeout {puts "TESTING ERROR 10\n";exit}
-        "Installing /run/firejail/mnt/seccomp seccomp filter" {puts "TESTING ERROR 11\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp seccomp filter" {puts "TESTING ERROR 11\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter" {puts "TESTING ERROR 12\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter" {puts "TESTING ERROR 12\n";exit}
        "Child process initialized"
 }
 expect {
        timeout {puts "TESTING ERROR 13\n";exit}
-        "Installing /run/firejail/mnt/seccomp seccomp filter" {puts "TESTING ERROR 14\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp seccomp filter" {puts "TESTING ERROR 14\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter" {puts "TESTING ERROR 15\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter" {puts "TESTING ERROR 15\n";exit}
-        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 16\n";exit}
@@ -78,18 +78,18 @@ after 100
 send --  "firejail --debug --ignore=protocol sleep 1; echo done\r"
 expect {
        timeout {puts "TESTING ERROR 17\n";exit}
-        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter" {puts "TESTING ERROR 18\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter" {puts "TESTING ERROR 18\n";exit}
        "Child process initialized"
 }
 expect {
        timeout {puts "TESTING ERROR 19\n";exit}
-        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter" {puts "TESTING ERROR 20\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter" {puts "TESTING ERROR 20\n";exit}
-        "Installing /run/firejail/mnt/seccomp seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 21\n";exit}
-        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter" {puts "TESTING ERROR 22\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter" {puts "TESTING ERROR 22\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 23\n";exit}
@@ -105,7 +105,7 @@ expect {
 }
 expect {
        timeout {puts "TESTING ERROR 25\n";exit}
-        "Installing /run/firejail/mnt/seccomp.mdwx seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.mdwx seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 26\n";exit}
@@ -117,18 +117,18 @@ expect {
 send --  "firejail --debug --seccomp.block-secondary sleep 1; echo done\r"
 expect {
        timeout {puts "TESTING ERROR 27\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter" {puts "TESTING ERROR 28\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter" {puts "TESTING ERROR 28\n";exit}
        "Child process initialized"
 }
 expect {
        timeout {puts "TESTING ERROR 29\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter" {puts "TESTING ERROR 30\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter" {puts "TESTING ERROR 30\n";exit}
-        "Installing /run/firejail/mnt/seccomp seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 31\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter" {puts "TESTING ERROR 32\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter" {puts "TESTING ERROR 32\n";exit}
-        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 33\n";exit}
@@ -140,13 +140,13 @@ after 100
 send --  "firejail --debug --profile=block-secondary.profile sleep 1; echo done\r"
 expect {
        timeout {puts "TESTING ERROR 33\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter" {puts "TESTING ERROR 34\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter" {puts "TESTING ERROR 34\n";exit}
        "Child process initialized"
 }
 expect {
        timeout {puts "TESTING ERROR 35\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter" {puts "TESTING ERROR 35\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter" {puts "TESTING ERROR 35\n";exit}
-        "Installing /run/firejail/mnt/seccomp seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 37\n";exit}
diff --git a/test/filters/seccomp-join.exp b/test/filters/seccomp-join.exp
index f9201f926..f1d57238b 100755
--- a/test/filters/seccomp-join.exp
+++ b/test/filters/seccomp-join.exp
@@ -20,15 +20,15 @@ set spawn_id $id1
 send --  "firejail --name=jointesting --debug\r"
 expect {
        timeout {puts "TESTING ERROR 0\n";exit}
-        "Installing /run/firejail/mnt/seccomp seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 1\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 2\n";exit}
-        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter"
 }
 sleep 1
@@ -37,15 +37,15 @@ set spawn_id $id2
 send --  "firejail --debug --join=jointesting\r"
 expect {
        timeout {puts "TESTING ERROR 3\n";exit}
-        "Installing /run/firejail/mnt/seccomp seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 4\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 5\n";exit}
-        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter"
 }
 sleep 1
@@ -64,16 +64,16 @@ set spawn_id $id1
 send --  "firejail --name=jointesting --seccomp.block-secondary --debug\r"
 expect {
        timeout {puts "TESTING ERROR 10\n";exit}
-        "Installing /run/firejail/mnt/seccomp seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 11\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter" {puts "TESTING ERROR 12\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter" {puts "TESTING ERROR 12\n";exit}
-        "Installing /run/firejail/mnt/seccomp.block_secondary seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.block_secondary seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 13\n";exit}
-        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter"
 }
 sleep 1
@@ -81,15 +81,15 @@ set spawn_id $id2
 send --  "firejail --debug --join=jointesting\r"
 expect {
        timeout {puts "TESTING ERROR 14\n";exit}
-        "Installing /run/firejail/mnt/seccomp seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 15\n";exit}
-        "Installing /run/firejail/mnt/seccomp.block_secondary seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.block_secondary seccomp filter"
 }
 expect {
        timeout {puts "TESTING ERROR 16\n";exit}
-        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter"
 }
 sleep 1
@@ -106,7 +106,7 @@ set spawn_id $id1
 send --  "firejail --name=jointesting --noprofile --protocol=inet --debug\r"
 expect {
        timeout {puts "TESTING ERROR 22\n";exit}
-        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter"
 }
 sleep 1
@@ -115,9 +115,9 @@ set spawn_id $id2
 send --  "firejail --debug --join=jointesting\r"
 expect {
        timeout {puts "TESTING ERROR 23\n";exit}
-        "Installing /run/firejail/mnt/seccomp seccomp filter" {puts "TESTING ERROR 24\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp seccomp filter" {puts "TESTING ERROR 24\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter" {puts "TESTING ERROR 25\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter" {puts "TESTING ERROR 25\n";exit}
-        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter"
 }
 sleep 1
@@ -134,7 +134,7 @@ set spawn_id $id1
 send --  "firejail --name=jointesting --noprofile --memory-deny-write-execute --debug\r"
 expect {
        timeout {puts "TESTING ERROR 32\n";exit}
-        "Installing /run/firejail/mnt/seccomp.mdwx seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.mdwx seccomp filter"
 }
 sleep 1
@@ -143,10 +143,10 @@ set spawn_id $id2
 send --  "firejail --debug --join=jointesting\r"
 expect {
        timeout {puts "TESTING ERROR 33\n";exit}
-        "Installing /run/firejail/mnt/seccomp seccomp filter" {puts "TESTING ERROR 34\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp seccomp filter" {puts "TESTING ERROR 34\n";exit}
-        "Installing /run/firejail/mnt/seccomp.32 seccomp filter" {puts "TESTING ERROR 35\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter" {puts "TESTING ERROR 35\n";exit}
-        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter" {puts "TESTING ERROR 36\n";exit}
+        "Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter" {puts "TESTING ERROR 36\n";exit}
-        "Installing /run/firejail/mnt/seccomp.mdwx seccomp filter"
+        "Installing /run/firejail/mnt/seccomp/seccomp.mdwx seccomp filter"
 }
 sleep 1