aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--etc/inc/archiver-common.inc44
-rw-r--r--etc/profile-a-l/7z.profile39
-rw-r--r--etc/profile-a-l/ar.profile38
-rw-r--r--etc/profile-a-l/atool.profile38
-rw-r--r--etc/profile-a-l/bsdtar.profile39
-rw-r--r--etc/profile-a-l/cpio.profile38
-rw-r--r--etc/profile-a-l/gzip.profile39
-rw-r--r--etc/profile-m-z/tar.profile38
-rw-r--r--etc/profile-m-z/unrar.profile36
-rw-r--r--etc/profile-m-z/unzip.profile34
-rw-r--r--etc/profile-m-z/xzdec.profile35
-rw-r--r--etc/profile-m-z/zstd.profile36
12 files changed, 72 insertions, 382 deletions
diff --git a/etc/inc/archiver-common.inc b/etc/inc/archiver-common.inc
new file mode 100644
index 000000000..2c5e4d8bf
--- /dev/null
+++ b/etc/inc/archiver-common.inc
@@ -0,0 +1,44 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include archiver-common.local
4
5# common profile for archiver/compression tools
6
7blacklist ${RUNUSER}
8
9include disable-common.inc
10include disable-devel.inc
11include disable-exec.inc
12include disable-interpreters.inc
13include disable-passwdmgr.inc
14include disable-programs.inc
15include disable-shell.inc
16
17apparmor
18caps.drop all
19hostname archiver
20ipc-namespace
21machine-id
22net none
23no3d
24nodvd
25nogroups
26nonewprivs
27#noroot
28nosound
29notv
30nou2f
31novideo
32protocol unix
33seccomp
34shell none
35tracelog
36x11 none
37
38private-cache
39private-dev
40
41dbus-user none
42dbus-system none
43
44memory-deny-write-execute
diff --git a/etc/profile-a-l/7z.profile b/etc/profile-a-l/7z.profile
index 02a2e7ea0..c7bed93ce 100644
--- a/etc/profile-a-l/7z.profile
+++ b/etc/profile-a-l/7z.profile
@@ -7,41 +7,8 @@ include 7z.local
7# Persistent global definitions 7# Persistent global definitions
8include globals.local 8include globals.local
9 9
10blacklist ${RUNUSER}/wayland-* 10ignore include disable-shell.inc
11 11ignore nogroups
12include disable-common.inc 12include archiver-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18
19apparmor
20caps.drop all
21hostname 7z
22ipc-namespace
23machine-id
24net none
25no3d
26nodvd
27#nogroups
28nonewprivs
29#noroot
30nosound
31notv
32nou2f
33novideo
34protocol unix
35seccomp
36shell none
37tracelog
38x11 none
39 13
40#private-bin 7z,7z*,p7zip 14#private-bin 7z,7z*,p7zip
41private-cache
42private-dev
43
44dbus-user none
45dbus-system none
46
47memory-deny-write-execute
diff --git a/etc/profile-a-l/ar.profile b/etc/profile-a-l/ar.profile
index 183587ff8..a600eddef 100644
--- a/etc/profile-a-l/ar.profile
+++ b/etc/profile-a-l/ar.profile
@@ -7,42 +7,6 @@ include ar.local
7# Persistent global definitions 7# Persistent global definitions
8include globals.local 8include globals.local
9 9
10blacklist ${RUNUSER}/wayland-* 10include archiver-common.inc
11
12include disable-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18include disable-shell.inc
19
20apparmor
21caps.drop all
22hostname ar
23ipc-namespace
24machine-id
25net none
26no3d
27nodvd
28nogroups
29nonewprivs
30#noroot
31nosound
32notv
33nou2f
34novideo
35protocol unix
36seccomp
37shell none
38tracelog
39x11 none
40 11
41private-bin ar 12private-bin ar
42private-cache
43private-dev
44
45dbus-user none
46dbus-system none
47
48memory-deny-write-execute
diff --git a/etc/profile-a-l/atool.profile b/etc/profile-a-l/atool.profile
index e501e956c..d8b6bbaaf 100644
--- a/etc/profile-a-l/atool.profile
+++ b/etc/profile-a-l/atool.profile
@@ -7,47 +7,15 @@ include atool.local
7# Persistent global definitions 7# Persistent global definitions
8include globals.local 8include globals.local
9 9
10blacklist ${RUNUSER}/wayland-*
11
12# Allow perl (blacklisted by disable-interpreters.inc) 10# Allow perl (blacklisted by disable-interpreters.inc)
13include allow-perl.inc 11include allow-perl.inc
12ignore include disable-devel.inc
13ignore include disable-shell.inc
14include archiver-common.inc
14 15
15include disable-common.inc
16# include disable-devel.inc
17include disable-exec.inc
18include disable-interpreters.inc
19include disable-passwdmgr.inc
20include disable-programs.inc
21
22apparmor
23caps.drop all
24hostname atool
25ipc-namespace
26machine-id
27net none
28no3d
29nodvd
30nogroups
31nonewprivs
32noroot 16noroot
33nosound
34notv
35nou2f
36novideo
37protocol unix
38seccomp
39shell none
40tracelog
41x11 none
42 17
43# private-bin atool,perl 18# private-bin atool,perl
44private-cache
45private-dev
46# without login.defs atool complains and uses UID/GID 1000 by default 19# without login.defs atool complains and uses UID/GID 1000 by default
47private-etc alternatives,group,login.defs,passwd 20private-etc alternatives,group,login.defs,passwd
48private-tmp 21private-tmp
49
50dbus-user none
51dbus-system none
52
53memory-deny-write-execute
diff --git a/etc/profile-a-l/bsdtar.profile b/etc/profile-a-l/bsdtar.profile
index 08e51f3c1..75e13e7e8 100644
--- a/etc/profile-a-l/bsdtar.profile
+++ b/etc/profile-a-l/bsdtar.profile
@@ -6,43 +6,10 @@ include bsdtar.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9blacklist ${RUNUSER}/wayland-* 9ignore include disable-devel.inc
10 10ignore include disable-shell.inc
11include disable-common.inc 11include archiver-common.inc
12# include disable-devel.inc
13include disable-exec.inc
14include disable-interpreters.inc
15include disable-passwdmgr.inc
16include disable-programs.inc
17
18apparmor
19caps.drop all
20hostname bsdtar
21ipc-namespace
22machine-id
23net none
24no3d
25nodvd
26nogroups
27nonewprivs
28# noroot
29nosound
30notv
31nou2f
32novideo
33protocol unix
34seccomp
35shell none
36tracelog
37x11 none
38 12
39# support compressed archives 13# support compressed archives
40private-bin bash,bsdcat,bsdcpio,bsdtar,bzip2,compress,gtar,gzip,lbzip2,libarchive,lz4,lzip,lzma,lzop,sh,xz 14private-bin bash,bsdcat,bsdcpio,bsdtar,bzip2,compress,gtar,gzip,lbzip2,libarchive,lz4,lzip,lzma,lzop,sh,xz
41private-cache
42private-dev
43private-etc alternatives,group,localtime,passwd 15private-etc alternatives,group,localtime,passwd
44
45dbus-user none
46dbus-system none
47
48memory-deny-write-execute
diff --git a/etc/profile-a-l/cpio.profile b/etc/profile-a-l/cpio.profile
index 087a5b2bb..5e01952b4 100644
--- a/etc/profile-a-l/cpio.profile
+++ b/etc/profile-a-l/cpio.profile
@@ -7,40 +7,10 @@ include cpio.local
7# Persistent global definitions 7# Persistent global definitions
8include globals.local 8include globals.local
9 9
10blacklist ${RUNUSER}/wayland-*
11
12noblacklist /sbin 10noblacklist /sbin
13noblacklist /usr/sbin 11noblacklist /usr/sbin
14 12
15include disable-common.inc 13ignore include disable-devel.inc
16# include disable-devel.inc 14ignore include disable-interpreters.inc
17include disable-exec.inc 15ignore include disable-shell.inc
18include disable-passwdmgr.inc 16include archiver-common.inc
19include disable-programs.inc
20
21apparmor
22caps.drop all
23hostname cpio
24ipc-namespace
25machine-id
26net none
27no3d
28nodvd
29nogroups
30nonewprivs
31nosound
32notv
33nou2f
34novideo
35seccomp
36shell none
37tracelog
38x11 none
39
40private-cache
41private-dev
42
43dbus-user none
44dbus-system none
45
46memory-deny-write-execute
diff --git a/etc/profile-a-l/gzip.profile b/etc/profile-a-l/gzip.profile
index 8ec39d8ca..96c1743e3 100644
--- a/etc/profile-a-l/gzip.profile
+++ b/etc/profile-a-l/gzip.profile
@@ -7,43 +7,8 @@ include gzip.local
7# Persistent global definitions 7# Persistent global definitions
8include globals.local 8include globals.local
9 9
10blacklist ${RUNUSER}/wayland-*
11
12# Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only. 10# Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only.
13noblacklist /var/lib/pacman 11noblacklist /var/lib/pacman
14 12
15include disable-common.inc 13ignore include disable-shell.inc
16include disable-devel.inc 14include archiver-common.inc
17include disable-exec.inc
18include disable-interpreters.inc
19include disable-passwdmgr.inc
20include disable-programs.inc
21
22apparmor
23caps.drop all
24hostname gzip
25ipc-namespace
26machine-id
27net none
28no3d
29nodvd
30nogroups
31nonewprivs
32#noroot
33nosound
34notv
35nou2f
36novideo
37protocol unix
38seccomp
39shell none
40tracelog
41x11 none
42
43private-cache
44private-dev
45
46dbus-user none
47dbus-system none
48
49memory-deny-write-execute
diff --git a/etc/profile-m-z/tar.profile b/etc/profile-m-z/tar.profile
index 3a7405305..2ddc82dbb 100644
--- a/etc/profile-m-z/tar.profile
+++ b/etc/profile-m-z/tar.profile
@@ -7,49 +7,15 @@ include tar.local
7# Persistent global definitions 7# Persistent global definitions
8include globals.local 8include globals.local
9 9
10blacklist ${RUNUSER}/wayland-*
11
12# Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only. 10# Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only.
13noblacklist /var/lib/pacman 11noblacklist /var/lib/pacman
14 12
15include disable-common.inc 13ignore include disable-shell.inc
16include disable-devel.inc 14include archiver-common.inc
17include disable-exec.inc
18include disable-interpreters.inc
19include disable-passwdmgr.inc
20include disable-programs.inc
21
22apparmor
23caps.drop all
24hostname tar
25ipc-namespace
26machine-id
27net none
28no3d
29nodvd
30nogroups
31nonewprivs
32#noroot
33nosound
34notv
35nou2f
36novideo
37protocol unix
38seccomp
39shell none
40tracelog
41x11 none
42 15
43# support compressed archives 16# support compressed archives
44private-bin awk,bash,bzip2,compress,firejail,grep,gtar,gzip,lbzip2,lzip,lzma,lzop,sh,tar,xz 17private-bin awk,bash,bzip2,compress,firejail,grep,gtar,gzip,lbzip2,lzip,lzma,lzop,sh,tar,xz
45private-cache
46private-dev
47private-etc alternatives,group,localtime,login.defs,passwd 18private-etc alternatives,group,localtime,login.defs,passwd
48private-lib libfakeroot 19private-lib libfakeroot
49# Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) 20# Debian based distributions need this for 'dpkg --unpack' (incl. synaptic)
50writable-var 21writable-var
51
52dbus-user none
53dbus-system none
54
55memory-deny-write-execute
diff --git a/etc/profile-m-z/unrar.profile b/etc/profile-m-z/unrar.profile
index e07a6fc93..cbf0e8679 100644
--- a/etc/profile-m-z/unrar.profile
+++ b/etc/profile-m-z/unrar.profile
@@ -7,40 +7,10 @@ include unrar.local
7# Persistent global definitions 7# Persistent global definitions
8include globals.local 8include globals.local
9 9
10blacklist ${RUNUSER}/wayland-* 10ignore nogroups
11 11ignore private-cache
12include disable-common.inc 12include archiver-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18include disable-shell.inc
19
20caps.drop all
21hostname unrar
22ipc-namespace
23machine-id
24net none
25no3d
26nodvd
27#nogroups
28nonewprivs
29#noroot
30nosound
31notv
32nou2f
33novideo
34protocol unix
35seccomp
36shell none
37tracelog
38x11 none
39 13
40private-bin unrar 14private-bin unrar
41private-dev
42private-etc alternatives,group,localtime,passwd 15private-etc alternatives,group,localtime,passwd
43private-tmp 16private-tmp
44
45dbus-user none
46dbus-system none
diff --git a/etc/profile-m-z/unzip.profile b/etc/profile-m-z/unzip.profile
index e08511c12..30ee3ec12 100644
--- a/etc/profile-m-z/unzip.profile
+++ b/etc/profile-m-z/unzip.profile
@@ -7,42 +7,12 @@ include unzip.local
7# Persistent global definitions 7# Persistent global definitions
8include globals.local 8include globals.local
9 9
10blacklist ${RUNUSER}/wayland-*
11
12# GNOME Shell integration (chrome-gnome-shell) 10# GNOME Shell integration (chrome-gnome-shell)
13noblacklist ${HOME}/.local/share/gnome-shell 11noblacklist ${HOME}/.local/share/gnome-shell
14 12
15include disable-common.inc 13ignore nogroups
16include disable-devel.inc
17include disable-exec.inc
18include disable-interpreters.inc
19include disable-passwdmgr.inc
20include disable-programs.inc
21include disable-shell.inc
22
23caps.drop all
24hostname unzip
25ipc-namespace
26machine-id
27net none
28no3d
29nodvd
30#nogroups
31nonewprivs
32noroot 14noroot
33nosound 15include archiver-common.inc
34notv
35nou2f
36novideo
37protocol unix
38seccomp
39shell none
40tracelog
41x11 none
42 16
43private-bin unzip 17private-bin unzip
44private-dev
45private-etc alternatives,group,localtime,passwd 18private-etc alternatives,group,localtime,passwd
46
47dbus-user none
48dbus-system none
diff --git a/etc/profile-m-z/xzdec.profile b/etc/profile-m-z/xzdec.profile
index 542363b57..c21fe16cf 100644
--- a/etc/profile-m-z/xzdec.profile
+++ b/etc/profile-m-z/xzdec.profile
@@ -7,35 +7,6 @@ include xzdec.local
7# Persistent global definitions 7# Persistent global definitions
8include globals.local 8include globals.local
9 9
10blacklist ${RUNUSER}/wayland-* 10ignore include disable-shell.inc
11 11ignore nogroups
12include disable-common.inc 12include archiver-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18
19caps.drop all
20ipc-namespace
21machine-id
22net none
23no3d
24nodvd
25#nogroups
26nonewprivs
27#noroot
28nosound
29notv
30nou2f
31novideo
32protocol unix
33seccomp
34shell none
35tracelog
36x11 none
37
38private-dev
39
40dbus-user none
41dbus-system none
diff --git a/etc/profile-m-z/zstd.profile b/etc/profile-m-z/zstd.profile
index be27c10e1..5ae38e633 100644
--- a/etc/profile-m-z/zstd.profile
+++ b/etc/profile-m-z/zstd.profile
@@ -7,37 +7,5 @@ include zstd.local
7# Persistent global definitions 7# Persistent global definitions
8include globals.local 8include globals.local
9 9
10blacklist ${RUNUSER}/wayland-* 10ignore include disable-shell.inc
11 11include archiver-common.inc
12include disable-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18
19apparmor
20caps.drop all
21hostname zstd
22ipc-namespace
23machine-id
24net none
25no3d
26nodvd
27nogroups
28nonewprivs
29#noroot
30nosound
31notv
32nou2f
33novideo
34protocol unix
35seccomp
36shell none
37tracelog
38x11 none
39
40private-cache
41private-dev
42
43memory-deny-write-execute
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-05 12:49:20 +0000