aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--README.md5
-rw-r--r--RELNOTES3
-rw-r--r--etc/inc/disable-programs.inc6
-rw-r--r--etc/profile-a-l/bcompare.profile62
-rw-r--r--etc/profile-a-l/dolphin-emu.profile1
-rw-r--r--etc/profile-a-l/jami-gnome.profile42
-rw-r--r--etc/profile-m-z/PCSX2.profile57
-rw-r--r--etc/profile-m-z/PPSSPPSDL.profile9
-rw-r--r--etc/profile-m-z/man.profile2
-rw-r--r--etc/profile-m-z/nodejs-common.profile4
-rw-r--r--etc/profile-m-z/openmw-launcher.profile7
-rw-r--r--etc/profile-m-z/openmw.profile61
-rw-r--r--etc/profile-m-z/pcsxr.profile57
-rw-r--r--etc/profile-m-z/ppsspp.profile14
-rw-r--r--src/firecfg/firecfg.config6
-rw-r--r--src/firejail/sandbox.c10
-rw-r--r--src/man/firejail-profile.txt2
17 files changed, 335 insertions, 13 deletions
diff --git a/README.md b/README.md
index 71167c3b8..175ba70b6 100644
--- a/README.md
+++ b/README.md
@@ -330,5 +330,6 @@ Stats:
330 330
331### New profiles: 331### New profiles:
332 332
333vmware-view, display-im6.q16, ipcalc, ipcalc-ng, ebook-convert, ebook-edit, ebook-meta, ebook-polish, lzop. 333vmware-view, display-im6.q16, ipcalc, ipcalc-ng, ebook-convert, ebook-edit, ebook-meta, ebook-polish, lzop,
334avidemux, calligragemini, vmware-player, vmware-workstation, gget, com.github.phase1geo.minder, nextcloud-desktop 334avidemux, calligragemini, vmware-player, vmware-workstation, gget, com.github.phase1geo.minder, nextcloud-desktop,
335pcsxr, PPSSPPSDL, openmw, openmw-launcher, jami-gnome, PCSX2
diff --git a/RELNOTES b/RELNOTES
index 57b19d8d5..3b74ebd5a 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -15,7 +15,8 @@ firejail (0.9.65) baseline; urgency=low
15 * new profiles: vmware-view, display-im6.q16, ipcalc, ipcalc-ng 15 * new profiles: vmware-view, display-im6.q16, ipcalc, ipcalc-ng
16 * ebook-convert, ebook-edit, ebook-meta, ebook-polish, lzop, 16 * ebook-convert, ebook-edit, ebook-meta, ebook-polish, lzop,
17 * avidemux, calligragemini, vmware-player, vmware-workstation 17 * avidemux, calligragemini, vmware-player, vmware-workstation
18 * gget, com.github.phase1geo.minder, nextcloud-desktop 18 * gget, com.github.phase1geo.minder, nextcloud-desktop, pcsxr
19 * PPSSPPSDL, openmw, openmw-launcher, jami-gnome, PCSX2
19 -- netblue30 <netblue30@yahoo.com> Tue, 9 Feb 2021 09:00:00 -0500 20 -- netblue30 <netblue30@yahoo.com> Tue, 9 Feb 2021 09:00:00 -0500
20 21
21firejail (0.9.64.4) baseline; urgency=low 22firejail (0.9.64.4) baseline; urgency=low
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index 84eb51b9f..9dffa750a 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -167,6 +167,7 @@ blacklist ${HOME}/.config/aweather
167blacklist ${HOME}/.config/backintime 167blacklist ${HOME}/.config/backintime
168blacklist ${HOME}/.config/baloofilerc 168blacklist ${HOME}/.config/baloofilerc
169blacklist ${HOME}/.config/baloorc 169blacklist ${HOME}/.config/baloorc
170blacklist ${HOME}/.config/bcompare
170blacklist ${HOME}/.config/blender 171blacklist ${HOME}/.config/blender
171blacklist ${HOME}/.config/bless 172blacklist ${HOME}/.config/bless
172blacklist ${HOME}/.config/bnox 173blacklist ${HOME}/.config/bnox
@@ -268,6 +269,7 @@ blacklist ${HOME}/.config/inkscape
268blacklist ${HOME}/.config/inox 269blacklist ${HOME}/.config/inox
269blacklist ${HOME}/.config/iridium 270blacklist ${HOME}/.config/iridium
270blacklist ${HOME}/.config/itch 271blacklist ${HOME}/.config/itch
272blacklist ${HOME}/.config/jami
271blacklist ${HOME}/.config/jd-gui.cfg 273blacklist ${HOME}/.config/jd-gui.cfg
272blacklist ${HOME}/.config/k3brc 274blacklist ${HOME}/.config/k3brc
273blacklist ${HOME}/.config/kaffeinerc 275blacklist ${HOME}/.config/kaffeinerc
@@ -348,6 +350,7 @@ blacklist ${HOME}/.config/okularrc
348blacklist ${HOME}/.config/onboard 350blacklist ${HOME}/.config/onboard
349blacklist ${HOME}/.config/onionshare 351blacklist ${HOME}/.config/onionshare
350blacklist ${HOME}/.config/onlyoffice 352blacklist ${HOME}/.config/onlyoffice
353blacklist ${HOME}/.config/openmw
351blacklist ${HOME}/.config/opera 354blacklist ${HOME}/.config/opera
352blacklist ${HOME}/.config/opera-beta 355blacklist ${HOME}/.config/opera-beta
353blacklist ${HOME}/.config/orage 356blacklist ${HOME}/.config/orage
@@ -666,6 +669,7 @@ blacklist ${HOME}/.local/share/gradio
666blacklist ${HOME}/.local/share/gwenview 669blacklist ${HOME}/.local/share/gwenview
667blacklist ${HOME}/.local/share/i2p 670blacklist ${HOME}/.local/share/i2p
668blacklist ${HOME}/.local/share/IntoTheBreach 671blacklist ${HOME}/.local/share/IntoTheBreach
672blacklist ${HOME}/.local/share/jami
669blacklist ${HOME}/.local/share/kaffeine 673blacklist ${HOME}/.local/share/kaffeine
670blacklist ${HOME}/.local/share/kalgebra 674blacklist ${HOME}/.local/share/kalgebra
671blacklist ${HOME}/.local/share/kate 675blacklist ${HOME}/.local/share/kate
@@ -716,6 +720,7 @@ blacklist ${HOME}/.local/share/notes
716blacklist ${HOME}/.local/share/ocenaudio 720blacklist ${HOME}/.local/share/ocenaudio
717blacklist ${HOME}/.local/share/okular 721blacklist ${HOME}/.local/share/okular
718blacklist ${HOME}/.local/share/onlyoffice 722blacklist ${HOME}/.local/share/onlyoffice
723blacklist ${HOME}/.local/share/openmw
719blacklist ${HOME}/.local/share/orage 724blacklist ${HOME}/.local/share/orage
720blacklist ${HOME}/.local/share/org.kde.gwenview 725blacklist ${HOME}/.local/share/org.kde.gwenview
721blacklist ${HOME}/.local/share/Paradox Interactive 726blacklist ${HOME}/.local/share/Paradox Interactive
@@ -799,6 +804,7 @@ blacklist ${HOME}/.opera-beta
799blacklist ${HOME}/.ostrichriders 804blacklist ${HOME}/.ostrichriders
800blacklist ${HOME}/.paradoxinteractive 805blacklist ${HOME}/.paradoxinteractive
801blacklist ${HOME}/.parallelrealities/blobwars 806blacklist ${HOME}/.parallelrealities/blobwars
807blacklist ${HOME}/.pcsxr
802blacklist ${HOME}/.penguin-command 808blacklist ${HOME}/.penguin-command
803blacklist ${HOME}/.pingus 809blacklist ${HOME}/.pingus
804blacklist ${HOME}/.pioneer 810blacklist ${HOME}/.pioneer
diff --git a/etc/profile-a-l/bcompare.profile b/etc/profile-a-l/bcompare.profile
new file mode 100644
index 000000000..178e2dc9f
--- /dev/null
+++ b/etc/profile-a-l/bcompare.profile
@@ -0,0 +1,62 @@
1# Firejail profile for Beyond Compare by Scooter Software
2# Description: directory and file compare utility
3# Disables the network, which only impacts checking for updates.
4# This file is overwritten after every install/update
5# Persistent local customizations
6include bcompare.local
7# Persistent global definitions
8include globals.local
9
10noblacklist ${HOME}/.config/bcompare
11# In case the user decides to include disable-programs.inc, still allow
12# KDE's Gwenview to view images via right click -> Open With -> Associated Application
13noblacklist ${HOME}/.config/gwenviewrc
14
15# Uncomment the next line (or put it into your bcompare.local) if you don't need to compare files in disable-common.inc
16#include disable-common.inc
17include disable-devel.inc
18include disable-exec.inc
19include disable-interpreters.inc
20include disable-passwdmgr.inc
21# Uncomment the next line (or put it into your bcompare.local) if you don't need to compare files in disable-programs.inc
22#include disable-programs.inc
23# Uncommenting this breaks launch
24# include disable-shell.inc
25include disable-write-mnt.inc
26# Don't disable ${DOCUMENTS}, ${MUSIC}, ${PICTURES}, ${VIDEOS}
27# include disable-xdg.inc
28
29# include whitelist-common.inc
30# include whitelist-runuser-common.inc
31# include whitelist-usr-share-common.inc
32# include whitelist-var-common.inc
33
34apparmor
35caps.drop all
36# Uncommenting might break Pulse Audio
37#machine-id
38net none
39no3d
40nodvd
41nogroups
42nonewprivs
43noroot
44# Allow applications launched on sound files to play them
45#nosound
46notv
47nou2f
48novideo
49protocol unix
50seccomp
51shell none
52tracelog
53
54private-cache
55private-dev
56# see /usr/share/doc/firejail/profile.template for more common private-etc paths.
57# private-etc alternatives,fonts,machine-id
58# Necessary because of the `include disable-exec.inc` line. Prevents error "Error fstat: fs.c:504 fs_remount_simple: Transport endpoint is not connected ... cannot sync with peer: unexpected EOF Peer [...] unexpectedly exited with status 1"
59private-tmp
60
61dbus-user none
62dbus-system none
diff --git a/etc/profile-a-l/dolphin-emu.profile b/etc/profile-a-l/dolphin-emu.profile
index 13d830b55..fc920a065 100644
--- a/etc/profile-a-l/dolphin-emu.profile
+++ b/etc/profile-a-l/dolphin-emu.profile
@@ -18,6 +18,7 @@ include disable-exec.inc
18include disable-interpreters.inc 18include disable-interpreters.inc
19include disable-passwdmgr.inc 19include disable-passwdmgr.inc
20include disable-programs.inc 20include disable-programs.inc
21include disable-write-mnt.inc
21include disable-xdg.inc 22include disable-xdg.inc
22 23
23mkdir ${HOME}/.cache/dolphin-emu 24mkdir ${HOME}/.cache/dolphin-emu
diff --git a/etc/profile-a-l/jami-gnome.profile b/etc/profile-a-l/jami-gnome.profile
new file mode 100644
index 000000000..226bb0008
--- /dev/null
+++ b/etc/profile-a-l/jami-gnome.profile
@@ -0,0 +1,42 @@
1# Firejail profile for jami-gnome
2# Description: An encrypted peer-to-peer messenger
3# This file is overwritten after every install/update
4# Persistent local customizations
5include jami-gnome.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.config/jami
10noblacklist ${HOME}/.local/share/jami
11
12include disable-common.inc
13include disable-devel.inc
14include disable-exec.inc
15#include disable-interpreters.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18
19mkdir ${HOME}/.config/jami
20mkdir ${HOME}/.local/share/jami
21whitelist ${HOME}/.config/jami
22whitelist ${HOME}/.local/share/jami
23include whitelist-common.inc
24include whitelist-var-common.inc
25
26caps.drop all
27ipc-namespace
28netfilter
29nodvd
30nogroups
31nonewprivs
32noroot
33notv
34protocol unix,inet,inet6,netlink
35seccomp
36shell none
37
38disable-mnt
39private-dev
40private-tmp
41
42env QT_QPA_PLATFORM=xcb
diff --git a/etc/profile-m-z/PCSX2.profile b/etc/profile-m-z/PCSX2.profile
new file mode 100644
index 000000000..b2687ba3c
--- /dev/null
+++ b/etc/profile-m-z/PCSX2.profile
@@ -0,0 +1,57 @@
1# Firejail profile for PCSX2
2# Description: A PlayStation 2 emulator
3# This file is overwritten after every install/update
4# Persistent local customizations
5include PCSX2.local
6# Persistent global definitions
7include globals.local
8
9# Note: you must whitelist your games folder in a PCSX2.local
10
11noblacklist ${HOME}/.config/PCSX2
12
13include disable-common.inc
14include disable-devel.inc
15include disable-exec.inc
16include disable-interpreters.inc
17include disable-passwdmgr.inc
18include disable-programs.inc
19include disable-shell.inc
20include disable-write-mnt.inc
21include disable-xdg.inc
22
23mkdir ${HOME}/.config/PCSX2
24whitelist ${HOME}/.config/PCSX2
25include whitelist-common.inc
26include whitelist-runuser-common.inc
27include whitelist-usr-share-common.inc
28include whitelist-var-common.inc
29
30apparmor
31caps.drop all
32ipc-namespace
33net none
34netfilter
35# Uncomment the following line if not loading games from disc
36#nodvd
37nogroups
38nonewprivs
39noroot
40notv
41nou2f
42novideo
43protocol unix,netlink
44#seccomp - breaks loading with no logs
45shell none
46#tracelog - 32/64 bit incompatibility
47
48private-bin PCSX2
49private-cache
50# uncomment the following line if you do not need controller support
51#private-dev
52private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dconf,drirc,fonts,gconf,glvnd,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,nvidia,pango,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg
53private-opt none
54private-tmp
55
56dbus-user none
57dbus-system none
diff --git a/etc/profile-m-z/PPSSPPSDL.profile b/etc/profile-m-z/PPSSPPSDL.profile
new file mode 100644
index 000000000..deb00a436
--- /dev/null
+++ b/etc/profile-m-z/PPSSPPSDL.profile
@@ -0,0 +1,9 @@
1# Firejail profile for PPSSPPSDL
2# This file is overwritten after every install/update
3# Persistent local customizations
4include PPSSPPSDL.local
5# added by included profile
6#include globals.local
7
8# Redirect
9include ppsspp.profile
diff --git a/etc/profile-m-z/man.profile b/etc/profile-m-z/man.profile
index c6c50cf47..965750bf0 100644
--- a/etc/profile-m-z/man.profile
+++ b/etc/profile-m-z/man.profile
@@ -57,7 +57,7 @@ disable-mnt
57#private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim 57#private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim
58private-cache 58private-cache
59private-dev 59private-dev
60private-etc alternatives,fonts,locale,locale.alias,locale.conf,man_db.conf,manpath.config,selinux,sysless,xdg 60private-etc alternatives,fonts,groff,locale,locale.alias,locale.conf,man_db.conf,manpath.config,selinux,sysless,xdg
61private-tmp 61private-tmp
62 62
63dbus-user none 63dbus-user none
diff --git a/etc/profile-m-z/nodejs-common.profile b/etc/profile-m-z/nodejs-common.profile
index c12fc9a78..202905631 100644
--- a/etc/profile-m-z/nodejs-common.profile
+++ b/etc/profile-m-z/nodejs-common.profile
@@ -1,5 +1,5 @@
1# Firejail profile for Node.js 1# Firejail profile for Node.js
2# Description: Common profile for npm/yarn 2# Description: Asynchronous event-driven JavaScript runtime
3# This file is overwritten after every install/update 3# This file is overwritten after every install/update
4# Persistent local customizations 4# Persistent local customizations
5include nodejs-common.local 5include nodejs-common.local
@@ -45,7 +45,9 @@ shell none
45 45
46disable-mnt 46disable-mnt
47private-dev 47private-dev
48# May need to add `passwd` to `private-etc` below to enable debugging with some IDEs
48private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,xdg 49private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,xdg
50# May need to be commented out in order to enable debugging with some IDEs
49private-tmp 51private-tmp
50 52
51dbus-user none 53dbus-user none
diff --git a/etc/profile-m-z/openmw-launcher.profile b/etc/profile-m-z/openmw-launcher.profile
new file mode 100644
index 000000000..c9cc144e4
--- /dev/null
+++ b/etc/profile-m-z/openmw-launcher.profile
@@ -0,0 +1,7 @@
1# Firejail profile for openmw-launcher
2# This file is overwritten after every install/update
3# Persistent local customizations
4include openmw-launcher.local
5
6# Redirect
7include openmw.profile
diff --git a/etc/profile-m-z/openmw.profile b/etc/profile-m-z/openmw.profile
new file mode 100644
index 000000000..270d64c1e
--- /dev/null
+++ b/etc/profile-m-z/openmw.profile
@@ -0,0 +1,61 @@
1# Firejail profile for openmw
2# Description: Open source engine re-implementation for Morrowind
3# This file is overwritten after every install/update
4# Persistent local customizations
5include openmw.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.config/openmw
10noblacklist ${HOME}/.local/share/openmw
11
12include disable-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18include disable-shell.inc
19include disable-write-mnt.inc
20include disable-xdg.inc
21
22mkdir ${HOME}/.config/openmw
23mkdir ${HOME}/.local/share/openmw
24whitelist ${HOME}/.config/openmw
25# Copy Morrowind data files into the following directory or load it from /mnt
26# or whitelist it in a openmw.local
27whitelist ${HOME}/.local/share/openmw
28whitelist /usr/share/openmw
29include whitelist-common.inc
30include whitelist-runuser-common.inc
31include whitelist-usr-share-common.inc
32include whitelist-var-common.inc
33
34apparmor
35caps.drop all
36ipc-namespace
37net none
38netfilter
39# Uncomment the following line if installing from disc
40nodvd
41nogroups
42nonewprivs
43noroot
44notv
45nou2f
46novideo
47protocol unix,netlink
48seccomp
49seccomp.block-secondary
50shell none
51tracelog
52
53private-bin bsatool,esmtool,niftest,openmw,openmw-cs,openmw-essimporter,openmw-iniimporter,openmw-launcher,openmw-wizard
54private-cache
55private-dev
56private-etc alsa,alternatives,asound.conf,bumblebee,drirc,fonts,glvnd,group,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nvidia,openmw,pango,passwd,pulse,Trolltech.conf,X11,xdg
57private-opt none
58private-tmp
59
60dbus-user none
61dbus-system none
diff --git a/etc/profile-m-z/pcsxr.profile b/etc/profile-m-z/pcsxr.profile
new file mode 100644
index 000000000..c25c4ae66
--- /dev/null
+++ b/etc/profile-m-z/pcsxr.profile
@@ -0,0 +1,57 @@
1# Firejail profile for pcsxr
2# Description: A PlayStation emulator
3# This file is overwritten after every install/update
4# Persistent local customizations
5include pcsxr.local
6# Persistent global definitions
7include globals.local
8
9# Note: you must whitelist your games folder in a pcsxr.local
10
11noblacklist ${HOME}/.pcsxr
12
13include disable-common.inc
14include disable-devel.inc
15include disable-exec.inc
16include disable-interpreters.inc
17include disable-passwdmgr.inc
18include disable-programs.inc
19include disable-shell.inc
20include disable-write-mnt.inc
21include disable-xdg.inc
22
23mkdir ${HOME}/.pcsxr
24whitelist ${HOME}/.pcsxr
25include whitelist-common.inc
26include whitelist-runuser-common.inc
27include whitelist-usr-share-common.inc
28include whitelist-var-common.inc
29
30apparmor
31caps.drop all
32ipc-namespace
33net none
34netfilter
35# Uncomment the following line if not loading games from disc
36#nodvd
37nogroups
38nonewprivs
39noroot
40notv
41nou2f
42novideo
43protocol unix,netlink
44seccomp
45shell none
46tracelog
47
48private-bin pcsxr
49private-cache
50# uncomment the following line if you do not need controller support
51#private-dev
52private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dconf,drirc,fonts,gconf,glvnd,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,nvidia,pango,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg
53private-opt none
54private-tmp
55
56dbus-user none
57dbus-system none
diff --git a/etc/profile-m-z/ppsspp.profile b/etc/profile-m-z/ppsspp.profile
index c71553bcd..263d99c83 100644
--- a/etc/profile-m-z/ppsspp.profile
+++ b/etc/profile-m-z/ppsspp.profile
@@ -1,13 +1,14 @@
1# Firejail profile for ppsspp 1# Firejail profile for ppsspp
2# Description: A PSP emulator written in C++ 2# Description: A PSP emulator
3# This file is overwritten after every install/update 3# This file is overwritten after every install/update
4# Persistent local customizations 4# Persistent local customizations
5include ppsspp.local 5include ppsspp.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9# Note: you must whitelist your games folder in a ppsspp.local
10
9noblacklist ${HOME}/.config/ppsspp 11noblacklist ${HOME}/.config/ppsspp
10noblacklist ${DOCUMENTS}
11 12
12include disable-common.inc 13include disable-common.inc
13include disable-devel.inc 14include disable-devel.inc
@@ -15,8 +16,15 @@ include disable-exec.inc
15include disable-interpreters.inc 16include disable-interpreters.inc
16include disable-passwdmgr.inc 17include disable-passwdmgr.inc
17include disable-programs.inc 18include disable-programs.inc
19include disable-write-mnt.inc
18include disable-xdg.inc 20include disable-xdg.inc
19 21
22mkdir ${HOME}/.config/ppsspp
23whitelist ${HOME}/.config/ppsspp
24whitelist /usr/share/ppsspp
25include whitelist-common.inc
26include whitelist-runuser-common.inc
27include whitelist-usr-share-common.inc
20include whitelist-var-common.inc 28include whitelist-var-common.inc
21 29
22caps.drop all 30caps.drop all
@@ -27,11 +35,13 @@ nogroups
27nonewprivs 35nonewprivs
28noroot 36noroot
29notv 37notv
38nou2f
30novideo 39novideo
31protocol unix,netlink 40protocol unix,netlink
32seccomp 41seccomp
33shell none 42shell none
34 43
44private-bin ppsspp,PPSSPP,PPSSPPQt,PPSSPPSDL
35# uncomment the following line if you do not need controller support 45# uncomment the following line if you do not need controller support
36#private-dev 46#private-dev
37private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl 47private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 3da415b70..6cef32249 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -20,7 +20,9 @@ Maelstrom
20Maps 20Maps
21Mathematica 21Mathematica
22Natron 22Natron
23PCSX2
23PPSSPPQt 24PPSSPPQt
25PPSSPPSDL
24QMediathekView 26QMediathekView
25QOwnNotes 27QOwnNotes
26Screenshot 28Screenshot
@@ -77,6 +79,7 @@ balsa
77baobab 79baobab
78barrier 80barrier
79basilisk 81basilisk
82bcompare
80beaker 83beaker
81bibletime 84bibletime
82bijiben 85bijiben
@@ -582,6 +585,8 @@ openarena
582openarena_ded 585openarena_ded
583opencity 586opencity
584openclonk 587openclonk
588openmw
589openmw-launcher
585openoffice.org 590openoffice.org
586openshot 591openshot
587openshot-qt 592openshot-qt
@@ -598,6 +603,7 @@ parole
598patch 603patch
599pavucontrol 604pavucontrol
600pavucontrol-qt 605pavucontrol-qt
606pcsxr
601pdfchain 607pdfchain
602pdfmod 608pdfmod
603pdfsam 609pdfsam
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 60c097cf2..743d84b43 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -630,8 +630,6 @@ int sandbox(void* sandbox_arg) {
630 errExit("mounting " RUN_FIREJAIL_LIB_DIR); 630 errExit("mounting " RUN_FIREJAIL_LIB_DIR);
631 // keep a copy of dhclient executable before the filesystem is modified 631 // keep a copy of dhclient executable before the filesystem is modified
632 dhcp_store_exec(); 632 dhcp_store_exec();
633 // mount appimage before the filesystem is modified
634 appimage_mount();
635 633
636 //**************************** 634 //****************************
637 // log sandbox data 635 // log sandbox data
@@ -827,6 +825,11 @@ int sandbox(void* sandbox_arg) {
827 fs_basic_fs(); 825 fs_basic_fs();
828 826
829 //**************************** 827 //****************************
828 // appimage
829 //****************************
830 appimage_mount();
831
832 //****************************
830 // private mode 833 // private mode
831 //**************************** 834 //****************************
832 if (arg_private) { 835 if (arg_private) {
@@ -1155,14 +1158,12 @@ int sandbox(void* sandbox_arg) {
1155 //**************************** 1158 //****************************
1156 // continue security filters 1159 // continue security filters
1157 //**************************** 1160 //****************************
1158
1159 // set capabilities 1161 // set capabilities
1160 set_caps(); 1162 set_caps();
1161 1163
1162 //**************************************** 1164 //****************************************
1163 // relay status information to join option 1165 // relay status information to join option
1164 //**************************************** 1166 //****************************************
1165
1166 char *set_sandbox_status = create_join_file(); 1167 char *set_sandbox_status = create_join_file();
1167 1168
1168 //**************************************** 1169 //****************************************
@@ -1223,7 +1224,6 @@ int sandbox(void* sandbox_arg) {
1223 //**************************************** 1224 //****************************************
1224 // set cpu affinity 1225 // set cpu affinity
1225 //**************************************** 1226 //****************************************
1226
1227 if (cfg.cpus) 1227 if (cfg.cpus)
1228 set_cpu_affinity(); 1228 set_cpu_affinity();
1229 1229
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index b0b390507..ee685da73 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -666,7 +666,7 @@ Disable DVB (Digital Video Broadcasting) TV devices.
666Disable U2F devices. 666Disable U2F devices.
667.TP 667.TP
668\fBnovideo 668\fBnovideo
669Disable video devices. 669Disable video capture devices.
670.TP 670.TP
671\fBshell none 671\fBshell none
672Run the program directly, without a shell. 672Run the program directly, without a shell.
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-12 08:36:06 +0000