33 files changed, 127 insertions, 0 deletions

diff --git a/etc/0ad.profile b/etc/0ad.profile
index 565d42567..8b5820d5e 100644
--- a/etc/0ad.profile
+++ b/etc/0ad.profile
@@ -23,7 +23,9 @@ mkdir ${HOME}/.local/share/0ad
 whitelist ${HOME}/.cache/0ad
 whitelist ${HOME}/.config/0ad
 whitelist ${HOME}/.local/share/0ad
+whitelist /usr/share/0ad
 include whitelist-common.inc
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 caps.drop all
diff --git a/etc/ark.profile b/etc/ark.profile
index 7f74a4d49..2fe546b55 100644
--- a/etc/ark.profile
+++ b/etc/ark.profile
@@ -15,6 +15,8 @@ include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
+whitelist /usr/share/ark
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/bibletime.profile b/etc/bibletime.profile
index 0de3bc480..b76bc8367 100644
--- a/etc/bibletime.profile
+++ b/etc/bibletime.profile
@@ -25,7 +25,10 @@ mkdir ${HOME}/.local/share/bibletime
 whitelist ${HOME}/.bibletime
 whitelist ${HOME}/.sword
 whitelist ${HOME}/.local/share/bibletime
+whitelist /usr/share/bibletime
+whitelist /usr/share/sword
 include whitelist-common.inc
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/dconf-editor.profile b/etc/dconf-editor.profile
index 29f676535..f9300268f 100644
--- a/etc/dconf-editor.profile
+++ b/etc/dconf-editor.profile
@@ -16,6 +16,7 @@ include disable-xdg.inc
 
 whitelist ${HOME}/.local/share/glib-2.0
 include whitelist-common.inc
+include whitelist-usr-share-common.inc
 
 apparmor
 caps.drop all
diff --git a/etc/dragon.profile b/etc/dragon.profile
index fb8aaaf96..df839cc47 100644
--- a/etc/dragon.profile
+++ b/etc/dragon.profile
@@ -18,6 +18,8 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist /usr/share/dragonplayer
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 caps.drop all
diff --git a/etc/eog.profile b/etc/eog.profile
index 8e3aa42fe..4a68053ea 100644
--- a/etc/eog.profile
+++ b/etc/eog.profile
@@ -8,6 +8,9 @@ include globals.local
 
 noblacklist ${HOME}/.config/eog
 
+whitelist /usr/share/eog
+include whitelist-usr-share-common.inc
+
 # private-bin, private-etc and private-lib break 'Open With' / 'Open in file manager'
 # comment those if you need that functionality
 # or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eog.local
diff --git a/etc/evince.profile b/etc/evince.profile
index af1b934c5..0ace1dc3e 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -17,6 +17,10 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist /usr/share/evince
+whitelist /usr/share/poppler
+whitelist /usr/share/tracker
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 caps.drop all
diff --git a/etc/feedreader.profile b/etc/feedreader.profile
index e381b12d6..c12ab2399 100644
--- a/etc/feedreader.profile
+++ b/etc/feedreader.profile
@@ -21,7 +21,9 @@ mkdir ${HOME}/.cache/feedreader
 mkdir ${HOME}/.local/share/feedreader
 whitelist ${HOME}/.cache/feedreader
 whitelist ${HOME}/.local/share/feedreader
+whitelist /usr/share/feedreader
 include whitelist-common.inc
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 caps.drop all
diff --git a/etc/file-roller.profile b/etc/file-roller.profile
index 496152540..5251ecd46 100644
--- a/etc/file-roller.profile
+++ b/etc/file-roller.profile
@@ -13,6 +13,8 @@ include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
+whitelist /usr/share/file-roller
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/firefox.profile b/etc/firefox.profile
index 8d90a0917..b05321ece 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -14,6 +14,9 @@ mkdir ${HOME}/.mozilla
 whitelist ${HOME}/.cache/mozilla/firefox
 whitelist ${HOME}/.mozilla
 
+whitelist /usr/share/mozilla
+include whitelist-usr-share-common.inc
+
 # firefox requires a shell to launch on Arch.
 #private-bin bash,dbus-launch,dbus-send,env,firefox,sh,which
 # Fedora use shell scripts to launch firefox, at least this is required
diff --git a/etc/ghostwriter.profile b/etc/ghostwriter.profile
index b09d28b21..8a9ccabc2 100644
--- a/etc/ghostwriter.profile
+++ b/etc/ghostwriter.profile
@@ -19,6 +19,13 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist /usr/share/ghostwriter
+whitelist /usr/share/mozilla-dicts
+whitelist /usr/share/texlive
+whitelist /usr/share/pandoc
+whitelist /usr/share/pandoc-*
+include whitelist-usr-share-common.inc
+
 apparmor
 caps.drop all
 machine-id
diff --git a/etc/gimp.profile b/etc/gimp.profile
index e68d49274..ea73d1b0a 100644
--- a/etc/gimp.profile
+++ b/etc/gimp.profile
@@ -23,6 +23,9 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist /usr/share/gimp
+whitelist /usr/share/mypaint-data
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/gitg.profile b/etc/gitg.profile
index 08c1c94b6..9ac1076ed 100644
--- a/etc/gitg.profile
+++ b/etc/gitg.profile
@@ -19,6 +19,8 @@ include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
+whitelist /usr/share/gitg
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 caps.drop all
diff --git a/etc/gnome-characters.profile b/etc/gnome-characters.profile
index 828c6324e..c3e9466d7 100644
--- a/etc/gnome-characters.profile
+++ b/etc/gnome-characters.profile
@@ -14,7 +14,9 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist /usr/share/org.gnome.Characters
 include whitelist-common.inc
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 caps.drop all
diff --git a/etc/gnome-clocks.profile b/etc/gnome-clocks.profile
index 2beee83e0..025335a23 100644
--- a/etc/gnome-clocks.profile
+++ b/etc/gnome-clocks.profile
@@ -14,7 +14,10 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist /usr/share/gnome-clocks
+whitelist /usr/share/libgweather
 include whitelist-common.inc
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/gnome-latex.profile b/etc/gnome-latex.profile
index 9cef9072c..1bf48c6ab 100644
--- a/etc/gnome-latex.profile
+++ b/etc/gnome-latex.profile
@@ -19,6 +19,10 @@ include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
+whitelist /usr/share/gnome-latex
+whitelist /usr/share/perl5
+whitelist /usr/share/texlive
+include whitelist-usr-share-common.inc
 # May cause issues.
 #include whitelist-var-common.inc
 
diff --git a/etc/gnome-logs.profile b/etc/gnome-logs.profile
index 67256852c..75ad21608 100644
--- a/etc/gnome-logs.profile
+++ b/etc/gnome-logs.profile
@@ -15,6 +15,7 @@ include disable-programs.inc
 include disable-xdg.inc
 
 whitelist /var/log/journal
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/gnome-maps.profile b/etc/gnome-maps.profile
index be8e809ce..6f7f13c56 100644
--- a/etc/gnome-maps.profile
+++ b/etc/gnome-maps.profile
@@ -26,7 +26,9 @@ whitelist ${HOME}/.cache/champlain
 whitelist ${HOME}/.local/share/maps-places.json
 whitelist ${DOWNLOADS}
 whitelist ${PICTURES}
+whitelist /usr/share/gnome-maps
 include whitelist-common.inc
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/gucharmap.profile b/etc/gucharmap.profile
index c8fe9e8c9..b3aa58d29 100644
--- a/etc/gucharmap.profile
+++ b/etc/gucharmap.profile
@@ -15,6 +15,7 @@ include disable-programs.inc
 include disable-xdg.inc
 
 include whitelist-common.inc
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/keepassxc.profile b/etc/keepassxc.profile
index 96718fcde..a48165140 100644
--- a/etc/keepassxc.profile
+++ b/etc/keepassxc.profile
@@ -22,6 +22,8 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist /usr/share/keepassxc
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 caps.drop all
diff --git a/etc/meld.profile b/etc/meld.profile
index 70de7c27b..8e3668d57 100644
--- a/etc/meld.profile
+++ b/etc/meld.profile
@@ -37,6 +37,10 @@ include disable-passwdmgr.inc
 # Uncomment the next line (or put it into your meld.local) if you don't need to compare files in /var.
 #include whitelist-var-common.inc
 
+# Uncomment the next lines (or put it into your meld.local) if you don't need to compare files in /usr/share.
+#whitelist /usr/share/meld
+#include whitelist-usr-share-common.inc
+
 apparmor
 caps.drop all
 ipc-namespace
diff --git a/etc/mpv.profile b/etc/mpv.profile
index 289a3cd5d..ab295a30d 100644
--- a/etc/mpv.profile
+++ b/etc/mpv.profile
@@ -27,6 +27,7 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/okular.profile b/etc/okular.profile
index 56fd21fc8..1dc8c9482 100644
--- a/etc/okular.profile
+++ b/etc/okular.profile
@@ -26,6 +26,9 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist /usr/share/poppler
+whitelist /usr/share/okular
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/rhythmbox.profile b/etc/rhythmbox.profile
index 9bcbdb561..b5f9941e3 100644
--- a/etc/rhythmbox.profile
+++ b/etc/rhythmbox.profile
@@ -21,6 +21,10 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist /usr/share/rhythmbox
+whitelist /usr/share/lua
+whitelist /usr/share/libquvi-scripts
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 # apparmor - makes settings immutable
diff --git a/etc/sqlitebrowser.profile b/etc/sqlitebrowser.profile
index d423bb65c..94bb4d3f2 100644
--- a/etc/sqlitebrowser.profile
+++ b/etc/sqlitebrowser.profile
@@ -17,6 +17,7 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/supertuxkart.profile b/etc/supertuxkart.profile
index 8a48eeac8..2975a61ed 100644
--- a/etc/supertuxkart.profile
+++ b/etc/supertuxkart.profile
@@ -24,7 +24,9 @@ mkdir ${HOME}/.local/share/supertuxkart
 whitelist ${HOME}/.config/supertuxkart
 whitelist ${HOME}/.cache/supertuxkart
 whitelist ${HOME}/.local/share/supertuxkart
+whitelist /usr/share/supertuxkart
 include whitelist-common.inc
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/templates/profile.template b/etc/templates/profile.template
index 10b5ee2ae..dcf6dd201 100644
--- a/etc/templates/profile.template
+++ b/etc/templates/profile.template
@@ -107,6 +107,7 @@ include globals.local
 ##mkfile PATH
 #whitelist PATH
 #include whitelist-common.inc
+#include whitelist-usr-share-common.inc
 #include whitelist-var-common.inc
 
 ##allusers
diff --git a/etc/thunderbird.profile b/etc/thunderbird.profile
index 9e60050e6..ea6e3855d 100644
--- a/etc/thunderbird.profile
+++ b/etc/thunderbird.profile
@@ -34,6 +34,9 @@ whitelist ${HOME}/.gnupg
 # whitelist ${HOME}/.icedove
 whitelist ${HOME}/.thunderbird
 
+#whitelist /usr/share/mozilla
+#include whitelist-usr-share-common.inc
+
 # We need the real /tmp for data exchange when xdg-open handles email attachments on KDE
 ignore private-tmp
 # machine-id breaks audio in browsers; enable it when sound is not required
diff --git a/etc/transmission-gtk.profile b/etc/transmission-gtk.profile
index 01bdeb4ef..de8da003b 100644
--- a/etc/transmission-gtk.profile
+++ b/etc/transmission-gtk.profile
@@ -7,6 +7,8 @@ include transmission-gtk.local
 # Persistent global definitions
 include globals.local
 
+include whitelist-usr-share-common.inc
+
 private-bin transmission-gtk
 
 ignore memory-deny-write-execute
diff --git a/etc/wget.profile b/etc/wget.profile
index 83ff0bb64..4bf354652 100644
--- a/etc/wget.profile
+++ b/etc/wget.profile
@@ -15,6 +15,7 @@ include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 caps.drop all
diff --git a/etc/whitelist-usr-share-common.inc b/etc/whitelist-usr-share-common.inc
new file mode 100644
index 000000000..61c69b2f8
--- /dev/null
+++ b/etc/whitelist-usr-share-common.inc
@@ -0,0 +1,49 @@
+# Local customizations come here
+include whitelist-usr-share-common.local
+
+# common /usr/share whitelist for all profiles
+
+whitelist /usr/share/alsa
+whitelist /usr/share/applications
+whitelist /usr/share/crypto-policies
+whitelist /usr/share/cursors
+whitelist /usr/share/dconf
+whitelist /usr/share/distro-info
+whitelist /usr/share/drirc.d
+whitelist /usr/share/enchant
+whitelist /usr/share/enchant-2
+whitelist /usr/share/fontconfig
+whitelist /usr/share/fonts
+whitelist /usr/share/gjs-1.0
+whitelist /usr/share/glib-2.0
+whitelist /usr/share/glvnd
+whitelist /usr/share/gtk-2.0
+whitelist /usr/share/gtk-3.0
+whitelist /usr/share/gtksourceview-3.0
+whitelist /usr/share/gtksourceview-4
+whitelist /usr/share/hunspell
+whitelist /usr/share/hwdata
+whitelist /usr/share/icons
+whitelist /usr/share/knotifications5
+whitelist /usr/share/kservices5
+whitelist /usr/share/Kvantum
+whitelist /usr/share/kxmlgui5
+whitelist /usr/share/libthai
+whitelist /usr/share/locale
+whitelist /usr/share/mime
+whitelist /usr/share/misc
+whitelist /usr/share/Modules
+whitelist /usr/share/myspell
+whitelist /usr/share/p11-kit
+whitelist /usr/share/pixmaps
+whitelist /usr/share/pki
+whitelist /usr/share/plasma
+whitelist /usr/share/qt5
+whitelist /usr/share/sounds
+whitelist /usr/share/tcl8.6
+whitelist /usr/share/terminfo
+whitelist /usr/share/themes
+whitelist /usr/share/thumbnail.so
+whitelist /usr/share/X11
+whitelist /usr/share/xml
+whitelist /usr/share/zoneinfo
diff --git a/etc/yelp.profile b/etc/yelp.profile
index 66f094e1d..41138cd17 100644
--- a/etc/yelp.profile
+++ b/etc/yelp.profile
@@ -18,7 +18,11 @@ include disable-xdg.inc
 
 mkdir ${HOME}/.config/yelp
 whitelist ${HOME}/.config/yelp
+whitelist /usr/share/help
+whitelist /usr/share/yelp
+whitelist /usr/share/yelp-xsl
 include whitelist-common.inc
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/youtube-dl.profile b/etc/youtube-dl.profile
index f8ac1e16d..74c07d96b 100644
--- a/etc/youtube-dl.profile
+++ b/etc/youtube-dl.profile
@@ -30,6 +30,7 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor