332 files changed, 896 insertions, 508 deletions

diff --git a/etc/0ad.profile b/etc/0ad.profile
index 238dbbce2..f5c3491ff 100644
--- a/etc/0ad.profile
+++ b/etc/0ad.profile
@@ -1,4 +1,5 @@
 # Firejail profile for 0ad
+# Description: Real-time strategy game of ancient warfare
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/0ad.local
diff --git a/etc/2048-qt.profile b/etc/2048-qt.profile
index 1e7472bd9..56b38f5a2 100644
--- a/etc/2048-qt.profile
+++ b/etc/2048-qt.profile
@@ -1,4 +1,5 @@
 # Firejail profile for 2048-qt
+# Description: Mathematics based puzzle game
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/2048-qt.local
diff --git a/etc/Fritzing.profile b/etc/Fritzing.profile
index 1eb103b47..2e4d235b6 100644
--- a/etc/Fritzing.profile
+++ b/etc/Fritzing.profile
@@ -1,4 +1,5 @@
 # Firejail profile for fritzing
+# Description: Easy-to-use electronic design software
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/Fritzing.local
diff --git a/etc/Thunar.profile b/etc/Thunar.profile
index fbd475ca6..6de6cfb30 100644
--- a/etc/Thunar.profile
+++ b/etc/Thunar.profile
@@ -1,4 +1,5 @@
 # Firejail profile for Thunar
+# Description: File Manager for Xfce
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/Thunar.local
diff --git a/etc/VirtualBox.profile b/etc/VirtualBox.profile
index dedf448ae..c84b8a4ad 100644
--- a/etc/VirtualBox.profile
+++ b/etc/VirtualBox.profile
@@ -1,4 +1,5 @@
 # Firejail profile alias for virtualbox
+# Description: x86 virtualization solution
 # This file is overwritten after every install/update
 
 
diff --git a/etc/Xvfb.profile b/etc/Xvfb.profile
index 7921e0d06..4ae2d20d2 100644
--- a/etc/Xvfb.profile
+++ b/etc/Xvfb.profile
@@ -1,4 +1,5 @@
 # Firejail profile for Xvfb
+# Description: Virtual Framebuffer 'fake' X server
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/Xvfb.local
diff --git a/etc/akregator.profile b/etc/akregator.profile
index 1b8807757..af8dd2a3e 100644
--- a/etc/akregator.profile
+++ b/etc/akregator.profile
@@ -1,4 +1,5 @@
 # Firejail profile for akregator
+# Description: RSS/Atom feed aggregator
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/akregator.local
diff --git a/etc/amarok.profile b/etc/amarok.profile
index c728ce4ab..3ee50a20b 100644
--- a/etc/amarok.profile
+++ b/etc/amarok.profile
@@ -1,4 +1,5 @@
 # Firejail profile for amarok
+# Description: Easy to use media player based on the KDE Platform
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/amarok.local
diff --git a/etc/amule.profile b/etc/amule.profile
index 0d71f8f3b..f052a312f 100644
--- a/etc/amule.profile
+++ b/etc/amule.profile
@@ -1,4 +1,5 @@
 # Firejail profile for amule
+# Description: Client for the eD2k and Kad networks, like eMule
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/amule.local
diff --git a/etc/apktool.profile b/etc/apktool.profile
index 2203d7b8c..2043cf5af 100644
--- a/etc/apktool.profile
+++ b/etc/apktool.profile
@@ -1,4 +1,5 @@
 # Firejail profile for apktool
+# Description: Tool for reverse engineering Android apk files
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/arch-audit.profile b/etc/arch-audit.profile
index 956f0d63a..9cd200ef2 100644
--- a/etc/arch-audit.profile
+++ b/etc/arch-audit.profile
@@ -1,4 +1,5 @@
 # Firejail profile for arch-audit
+# Description: A utility like pkg-audit based on Arch CVE Monitoring Team data
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/arduino.profile b/etc/arduino.profile
index 0ff242450..9f28cada4 100644
--- a/etc/arduino.profile
+++ b/etc/arduino.profile
@@ -1,4 +1,5 @@
 # Firejail profile for arduino
+# Description: AVR development board IDE and built-in libraries
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/arduino.local
diff --git a/etc/ark.profile b/etc/ark.profile
index 12675b30b..d5a7f45f4 100644
--- a/etc/ark.profile
+++ b/etc/ark.profile
@@ -1,4 +1,5 @@
 # Firejail profile for ark
+# Description: Archive utility
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/ark.local
diff --git a/etc/arm.profile b/etc/arm.profile
index bebf05366..da9b45928 100644
--- a/etc/arm.profile
+++ b/etc/arm.profile
@@ -1,4 +1,5 @@
 # Firejail profile for arm
+# Description: Terminal status monitor for Tor relays
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/arm.local
diff --git a/etc/asunder.profile b/etc/asunder.profile
index 4cd340bf8..9c059ed0a 100644
--- a/etc/asunder.profile
+++ b/etc/asunder.profile
@@ -1,4 +1,5 @@
 # Firejail profile for asounder
+# Description: Graphical audio CD ripper and encoder
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/asunder.local
diff --git a/etc/atom.profile b/etc/atom.profile
index f7e30aeb4..1ff4e162d 100644
--- a/etc/atom.profile
+++ b/etc/atom.profile
@@ -1,4 +1,5 @@
 # Firejail profile for atom
+# Description: A hackable text editor for the 21st Century
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/atom.local
diff --git a/etc/atool.profile b/etc/atool.profile
index 06eace7d2..c672ed11d 100644
--- a/etc/atool.profile
+++ b/etc/atool.profile
@@ -1,4 +1,5 @@
 # Firejail profile for atool
+# Description: Tool for managing file archives of various types
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/atool.local
diff --git a/etc/atril.profile b/etc/atril.profile
index 48902ec4a..6e5286e5f 100644
--- a/etc/atril.profile
+++ b/etc/atril.profile
@@ -1,4 +1,5 @@
 # Firejail profile for atril
+# Description: MATE document viewer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/atril.local
diff --git a/etc/audacious.profile b/etc/audacious.profile
index cbbe15c46..627c1a72d 100644
--- a/etc/audacious.profile
+++ b/etc/audacious.profile
@@ -1,4 +1,5 @@
 # Firejail profile for audacious
+# Description: Small and fast audio player which supports lots of formats
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/audacious.local
diff --git a/etc/audacity.profile b/etc/audacity.profile
index d3c9ee4ac..685319f7f 100644
--- a/etc/audacity.profile
+++ b/etc/audacity.profile
@@ -1,4 +1,5 @@
 # Firejail profile for audacity
+# Description: Fast, cross-platform audio editor
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/audacity.local
diff --git a/etc/aweather.profile b/etc/aweather.profile
index 57b8fb61a..823b07c8c 100644
--- a/etc/aweather.profile
+++ b/etc/aweather.profile
@@ -1,4 +1,5 @@
 # Firejail profile for aweather
+# Description: Advanced Weather Monitoring Program
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/aweather.local
diff --git a/etc/baobab.profile b/etc/baobab.profile
index 8ff282151..d0c3f2712 100644
--- a/etc/baobab.profile
+++ b/etc/baobab.profile
@@ -1,4 +1,5 @@
 # Firejail profile for baobab
+# Description: GNOME disk usage analyzer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/baobab.local
diff --git a/etc/bibletime.profile b/etc/bibletime.profile
index fef7474a9..57595e8e2 100644
--- a/etc/bibletime.profile
+++ b/etc/bibletime.profile
@@ -1,4 +1,5 @@
 # Firejail profile for bibletime
+# Description: Bible study tool
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/bibletime.local
diff --git a/etc/bitcoin-qt.profile b/etc/bitcoin-qt.profile
index efc11cc9c..9b6affe24 100644
--- a/etc/bitcoin-qt.profile
+++ b/etc/bitcoin-qt.profile
@@ -1,4 +1,5 @@
 # Firejail profile for bitcoin-qt
+# Description: Bitcoin is a peer-to-peer network based digital currency
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/bitcoin-qt.local
diff --git a/etc/bitlbee.profile b/etc/bitlbee.profile
index 10ef34d07..e663d7799 100644
--- a/etc/bitlbee.profile
+++ b/etc/bitlbee.profile
@@ -1,4 +1,5 @@
 # Firejail profile for bitlbee
+# Description: IRC to other chat networks gateway
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/bitlbee.local
diff --git a/etc/bleachbit.profile b/etc/bleachbit.profile
index 8060d5275..49d058ab4 100644
--- a/etc/bleachbit.profile
+++ b/etc/bleachbit.profile
@@ -1,4 +1,5 @@
 # Firejail profile for bleachbit
+# Description: Delete unnecessary files from the system
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/bleachbit.local
diff --git a/etc/blender.profile b/etc/blender.profile
index 6becce712..43a8622f7 100644
--- a/etc/blender.profile
+++ b/etc/blender.profile
@@ -1,4 +1,5 @@
 # Firejail profile for blender
+# Description: Very fast and versatile 3D modeller/renderer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/blender.local
diff --git a/etc/bless.profile b/etc/bless.profile
index 1dd756153..01f75b00d 100644
--- a/etc/bless.profile
+++ b/etc/bless.profile
@@ -1,4 +1,5 @@
 # Firejail profile for bless
+# Description: A full featured hexadecimal editor
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/bless.local
diff --git a/etc/bluefish.profile b/etc/bluefish.profile
index 3931819f1..23ba34d42 100644
--- a/etc/bluefish.profile
+++ b/etc/bluefish.profile
@@ -1,4 +1,5 @@
 # Firejail profile for bluefish
+# Description: Advanced Gtk+ text editor for web and software development
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/bluefish.local
diff --git a/etc/brasero.profile b/etc/brasero.profile
index a012d4715..1c0b5f843 100644
--- a/etc/brasero.profile
+++ b/etc/brasero.profile
@@ -1,4 +1,5 @@
 # Firejail profile for brasero
+# Description: CD/DVD burning application for GNOME
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/brasero.local
diff --git a/etc/bsdtar.profile b/etc/bsdtar.profile
index d3bc76ba5..d8ace6aaf 100644
--- a/etc/bsdtar.profile
+++ b/etc/bsdtar.profile
@@ -37,6 +37,3 @@ tracelog
 private-bin sh,bash,bsdtar,gtar,compress,gzip,lzma,xz,bzip2,lbzip2,lzip,lzop,lz4,libarchive
 private-dev
 private-etc passwd,group,localtime
-
-
-
diff --git a/etc/caja.profile b/etc/caja.profile
index 2d292e614..20e690a14 100644
--- a/etc/caja.profile
+++ b/etc/caja.profile
@@ -1,4 +1,5 @@
 # Firejail profile for caja
+# Description: File manager for the MATE desktop
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/caja.local
diff --git a/etc/calibre.profile b/etc/calibre.profile
index 09839161e..7a5d798c5 100644
--- a/etc/calibre.profile
+++ b/etc/calibre.profile
@@ -1,4 +1,5 @@
 # Firejail profile for calibre
+# Description: Powerful and easy to use e-book manager
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/calibre.local
diff --git a/etc/calligra.profile b/etc/calligra.profile
index bc041a718..ab2845db4 100644
--- a/etc/calligra.profile
+++ b/etc/calligra.profile
@@ -1,4 +1,5 @@
 # Firejail profile for calligra
+# Description: Extensive productivity and creative suite
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/calligra.local
diff --git a/etc/catfish.profile b/etc/catfish.profile
index 02c5db969..422dc93e5 100644
--- a/etc/catfish.profile
+++ b/etc/catfish.profile
@@ -1,4 +1,5 @@
 # Firejail profile for catfish
+# Description: File searching tool
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/catfish.local
diff --git a/etc/cherrytree.profile b/etc/cherrytree.profile
index 8397da00c..0159bddae 100644
--- a/etc/cherrytree.profile
+++ b/etc/cherrytree.profile
@@ -1,4 +1,5 @@
 # Firejail profile for cherrytree
+# Description: Hierarchical note taking application
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/cherrytree.local
diff --git a/etc/chromium.profile b/etc/chromium.profile
index ad9f9af33..a1488e3e9 100644
--- a/etc/chromium.profile
+++ b/etc/chromium.profile
@@ -1,4 +1,5 @@
 # Firejail profile for chromium
+# Description: A web browser built for speed, simplicity, and security
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/chromium.local
diff --git a/etc/clamav.profile b/etc/clamav.profile
index 41bd3b679..cf46b8582 100644
--- a/etc/clamav.profile
+++ b/etc/clamav.profile
@@ -1,4 +1,5 @@
 # Firejail profile for clamav
+# Description: Anti-virus utility for Unix
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/clamtk.profile b/etc/clamtk.profile
new file mode 100644
index 000000000..d916381b2
--- /dev/null
+++ b/etc/clamtk.profile
@@ -0,0 +1,28 @@
+# Firejail profile for clamtk
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/clamtk.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+caps.drop all
+ipc-namespace
+net none
+no3d
+nodbus
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix
+seccomp
+shell none
+
+private-dev
+
+memory-deny-write-execute
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/claws-mail.profile b/etc/claws-mail.profile
index 343f8bed8..cb8ae6a80 100644
--- a/etc/claws-mail.profile
+++ b/etc/claws-mail.profile
@@ -1,4 +1,5 @@
 # Firejail profile for claws-mail
+# Description: Fast, lightweight and user-friendly GTK+2 based email client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/claws-mail.local
@@ -30,3 +31,8 @@ shell none
 
 private-dev
 private-tmp
+
+# If you want to read local mail stored in /var/mail, add the following to claws-mail.local:
+# noblacklist /var/mail
+# noblacklist /var/spool/mail
+# writable-var
diff --git a/etc/clementine.profile b/etc/clementine.profile
index e13fd3f66..a72bc39cf 100644
--- a/etc/clementine.profile
+++ b/etc/clementine.profile
@@ -1,4 +1,5 @@
 # Firejail profile for clementine
+# Description: Modern music player and library organizer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/clementine.local
diff --git a/etc/clipit.profile b/etc/clipit.profile
index 866108aee..fd6fbd61b 100644
--- a/etc/clipit.profile
+++ b/etc/clipit.profile
@@ -1,4 +1,5 @@
 # Firejail profile for clipit
+# Description: Lightweight GTK+ clipboard manager
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/clipit.local
diff --git a/etc/cmus.profile b/etc/cmus.profile
index a9f76ec80..5744d462b 100644
--- a/etc/cmus.profile
+++ b/etc/cmus.profile
@@ -1,4 +1,5 @@
 # Firejail profile for cmus
+# Description: Lightweight ncurses audio player
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/cmus.local
diff --git a/etc/conky.profile b/etc/conky.profile
index 4d2bcfa38..f6d07d6de 100644
--- a/etc/conky.profile
+++ b/etc/conky.profile
@@ -1,4 +1,5 @@
 # Firejail profile for conky
+# Description: Highly configurable system monitor
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/conky.local
diff --git a/etc/corebird.profile b/etc/corebird.profile
index da1869f65..c7f8a8874 100644
--- a/etc/corebird.profile
+++ b/etc/corebird.profile
@@ -1,4 +1,5 @@
 # Firejail profile for corebird
+# Description: Native Gtk+ Twitter client for the Linux desktop
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/corebird.local
diff --git a/etc/cpio.profile b/etc/cpio.profile
index 445e1cec7..3c7d0748c 100644
--- a/etc/cpio.profile
+++ b/etc/cpio.profile
@@ -1,4 +1,5 @@
 # Firejail profile for cpio
+# Description: A program to manage archives of files
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/curl.profile b/etc/curl.profile
index d1a682e60..e77b8bf4f 100644
--- a/etc/curl.profile
+++ b/etc/curl.profile
@@ -1,4 +1,5 @@
 # Firejail profile for curl
+# Description: Command line tool for transferring data with URL syntax
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/darktable.profile b/etc/darktable.profile
index 607a587a1..74144e68e 100644
--- a/etc/darktable.profile
+++ b/etc/darktable.profile
@@ -1,4 +1,5 @@
 # Firejail profile for darktable
+# Description: Virtual lighttable and darkroom for photographers
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/darktable.local
diff --git a/etc/deadbeef.profile b/etc/deadbeef.profile
index 8eb5776e7..8f5961647 100644
--- a/etc/deadbeef.profile
+++ b/etc/deadbeef.profile
@@ -1,4 +1,5 @@
 # Firejail profile for deadbeef
+# Description: A GTK+ audio player for GNU/Linux
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/deadbeef.local
diff --git a/etc/deluge.profile b/etc/deluge.profile
index da7e0dcdc..27ca036ca 100644
--- a/etc/deluge.profile
+++ b/etc/deluge.profile
@@ -1,4 +1,5 @@
 # Firejail profile for deluge
+# Description: BitTorrent client written in Python/PyGTK
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/deluge.local
diff --git a/etc/dia.profile b/etc/dia.profile
index fed5107aa..fdc40980f 100644
--- a/etc/dia.profile
+++ b/etc/dia.profile
@@ -1,4 +1,5 @@
 # Firejail profile for dia
+# Description: Diagram editor
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/dia.local
diff --git a/etc/digikam.profile b/etc/digikam.profile
index b3b0de1bc..470f60779 100644
--- a/etc/digikam.profile
+++ b/etc/digikam.profile
@@ -1,4 +1,5 @@
 # Firejail profile for digikam
+# Description: Digital photo management application for KDE
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/digikam.local
diff --git a/etc/dillo.profile b/etc/dillo.profile
index 05413fe56..8c3da1b3e 100644
--- a/etc/dillo.profile
+++ b/etc/dillo.profile
@@ -1,4 +1,5 @@
 # Firejail profile for dillo
+# Description: Small and fast web browser
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/dillo.local
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index f0f48d456..0c295ae6d 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -209,6 +209,7 @@ read-only ${HOME}/.forward
 read-only ${HOME}/.local/share/fish
 read-only ${HOME}/.login
 read-only ${HOME}/.logout
+read-only ${HOME}/.oh-my-zsh
 read-only ${HOME}/.pam_environment
 read-only ${HOME}/.pgpkey
 read-only ${HOME}/.plan
diff --git a/etc/dnscrypt-proxy.profile b/etc/dnscrypt-proxy.profile
index f8f593c83..ce73d7e72 100644
--- a/etc/dnscrypt-proxy.profile
+++ b/etc/dnscrypt-proxy.profile
@@ -1,4 +1,5 @@
 # Firejail profile for dnscrypt-proxy
+# Description: Tool for securing communications between a client and a DNS resolver
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/dnscrypt-proxy.local
diff --git a/etc/dnsmasq.profile b/etc/dnsmasq.profile
index 6d3bb920d..d68806945 100644
--- a/etc/dnsmasq.profile
+++ b/etc/dnsmasq.profile
@@ -1,4 +1,5 @@
 # Firejail profile for dnsmasq
+# Description: Small caching DNS proxy and DHCP/TFTP server
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/dnsmasq.local
diff --git a/etc/dolphin.profile b/etc/dolphin.profile
index f9fa977a9..819998edf 100644
--- a/etc/dolphin.profile
+++ b/etc/dolphin.profile
@@ -1,4 +1,5 @@
 # Firejail profile for dolphin
+# Description: File manager
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/dolphin.local
diff --git a/etc/dosbox.profile b/etc/dosbox.profile
index efc0b2d35..319daf407 100644
--- a/etc/dosbox.profile
+++ b/etc/dosbox.profile
@@ -1,4 +1,5 @@
 # Firejail profile for dosbox
+# Description: x86 emulator with Tandy/Herc/CGA/EGA/VGA/SVGA graphics, sound and DOS
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/dosbox.local
diff --git a/etc/dragon.profile b/etc/dragon.profile
index 9d7bb5748..9f41bf87a 100644
--- a/etc/dragon.profile
+++ b/etc/dragon.profile
@@ -1,4 +1,5 @@
 # Firejail profile for dragon
+# Description: A multimedia player where the focus is on simplicity, instead of features
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/dragon.local
diff --git a/etc/electron.profile b/etc/electron.profile
index 52d45b3f8..ccfde78bb 100644
--- a/etc/electron.profile
+++ b/etc/electron.profile
@@ -1,4 +1,5 @@
 # Firejail profile for electron
+# Description: Build cross platform desktop apps with web technologies
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/electron.local
diff --git a/etc/electrum.profile b/etc/electrum.profile
index d611f3e61..b3e1ab36f 100644
--- a/etc/electrum.profile
+++ b/etc/electrum.profile
@@ -1,4 +1,5 @@
 # Firejail profile for electrum
+# Description: Lightweight Bitcoin wallet
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/electrum.local
diff --git a/etc/elinks.profile b/etc/elinks.profile
index 1da0360c7..bafc19e1a 100644
--- a/etc/elinks.profile
+++ b/etc/elinks.profile
@@ -1,4 +1,5 @@
 # Firejail profile for elinks
+# Description: Advanced text-mode WWW browser
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/elinks.local
diff --git a/etc/emacs.profile b/etc/emacs.profile
index 8700bc8e6..90b25bfcf 100644
--- a/etc/emacs.profile
+++ b/etc/emacs.profile
@@ -1,4 +1,5 @@
 # Firejail profile for emacs
+# Description: GNU Emacs editor
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/emacs.local
diff --git a/etc/empathy.profile b/etc/empathy.profile
index 9d70afcb8..007b51c35 100644
--- a/etc/empathy.profile
+++ b/etc/empathy.profile
@@ -1,4 +1,5 @@
 # Firejail profile for empathy
+# Description: GNOME multi-protocol chat and call client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/empathy.local
diff --git a/etc/enchant.profile b/etc/enchant.profile
index 5a4050102..cf7d76b4c 100644
--- a/etc/enchant.profile
+++ b/etc/enchant.profile
@@ -1,4 +1,5 @@
 # Firejail profile for enchant
+# Description: Wrapper for various spell checker engines
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/enchant.local
diff --git a/etc/engrampa.profile b/etc/engrampa.profile
index 70ec7615e..eaf246d3c 100644
--- a/etc/engrampa.profile
+++ b/etc/engrampa.profile
@@ -1,4 +1,5 @@
 # Firejail profile for engrampa
+# Description: Archive manager for MATE
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/engrampa.local
diff --git a/etc/eog.profile b/etc/eog.profile
index 5b9ed9bd6..017fe5c75 100644
--- a/etc/eog.profile
+++ b/etc/eog.profile
@@ -1,4 +1,5 @@
 # Firejail profile for eog
+# Description: Eye of GNOME graphics viewer program
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/eog.local
diff --git a/etc/eom.profile b/etc/eom.profile
index 86ce01d1b..a0ce712c8 100644
--- a/etc/eom.profile
+++ b/etc/eom.profile
@@ -1,4 +1,5 @@
 # Firejail profile for eom
+# Description: Eye of MATE graphics viewer program
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/eom.local
diff --git a/etc/epiphany.profile b/etc/epiphany.profile
index e579fb4f6..b04cf72b4 100644
--- a/etc/epiphany.profile
+++ b/etc/epiphany.profile
@@ -1,4 +1,5 @@
 # Firejail profile for epiphany
+# Description: Clone of Boulder Dash game
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/epiphany.local
diff --git a/etc/evince.profile b/etc/evince.profile
index d4074d0aa..94f706440 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -1,4 +1,5 @@
 # Firejail profile for evince
+# Description: Document (PostScript, PDF) viewer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/evince.local
diff --git a/etc/evolution.profile b/etc/evolution.profile
index 0584b2744..f691b3c3d 100644
--- a/etc/evolution.profile
+++ b/etc/evolution.profile
@@ -1,4 +1,5 @@
 # Firejail profile for evolution
+# Description: Groupware suite with mail client and organizer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/evolution.local
diff --git a/etc/falkon.profile b/etc/falkon.profile
index 2f6168e99..41e1386dd 100644
--- a/etc/falkon.profile
+++ b/etc/falkon.profile
@@ -1,4 +1,5 @@
 # Firejail profile for falkon
+# Description: Lightweight web browser based on Qt WebEngine
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/falkon.local
diff --git a/etc/fbreader.profile b/etc/fbreader.profile
index a5ddd3bf1..c5afde9ec 100644
--- a/etc/fbreader.profile
+++ b/etc/fbreader.profile
@@ -1,4 +1,5 @@
 # Firejail profile for fbreader
+# Description: E-book reader
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/fbreader.local
diff --git a/etc/feh.profile b/etc/feh.profile
index c79e98d1c..197581ae7 100644
--- a/etc/feh.profile
+++ b/etc/feh.profile
@@ -1,4 +1,5 @@
 # Firejail profile for feh
+# Description: imlib2 based image viewer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/feh.local
diff --git a/etc/fetchmail.profile b/etc/fetchmail.profile
index 12175295f..d9b347d70 100644
--- a/etc/fetchmail.profile
+++ b/etc/fetchmail.profile
@@ -1,4 +1,5 @@
 # Firejail profile for fetchmail
+# Description: SSL enabled POP3, APOP, IMAP mail gatherer/forwarder
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/fetchmail.local
diff --git a/etc/ffmpeg.profile b/etc/ffmpeg.profile
index 4e55039cf..09574ffb7 100644
--- a/etc/ffmpeg.profile
+++ b/etc/ffmpeg.profile
@@ -1,4 +1,5 @@
 # Firejail profile for ffmpeg
+# Description: Tools for transcoding, streaming and playing of multimedia files
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/file-roller.profile b/etc/file-roller.profile
index 69b9c18da..11883f03e 100644
--- a/etc/file-roller.profile
+++ b/etc/file-roller.profile
@@ -1,4 +1,5 @@
 # Firejail profile for file-roller
+# Description: Archive manager for GNOME
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/file-roller.local
diff --git a/etc/file.profile b/etc/file.profile
index 2bdbaaaa8..5d1227520 100644
--- a/etc/file.profile
+++ b/etc/file.profile
@@ -1,4 +1,5 @@
 # Firejail profile for file
+# Description: Recognize the type of data in a file using "magic" numbers
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/filezilla.profile b/etc/filezilla.profile
index 1bc78e5ef..7a5ad4301 100644
--- a/etc/filezilla.profile
+++ b/etc/filezilla.profile
@@ -1,4 +1,5 @@
 # Firejail profile for filezilla
+# Description: Full-featured graphical FTP/FTPS/SFTP client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/filezilla.local
diff --git a/etc/firefox-developer-edition.profile b/etc/firefox-developer-edition.profile
index 696f95b56..7458d9e10 100644
--- a/etc/firefox-developer-edition.profile
+++ b/etc/firefox-developer-edition.profile
@@ -1,4 +1,5 @@
 # Firejail profile for firefox-developer-edition
+# Description: Developer Edition of the popular Firefox web browser
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/firefox-developer-edition.local
diff --git a/etc/firefox.profile b/etc/firefox.profile
index 0ab6a6141..c968e964e 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -1,4 +1,5 @@
 # Firejail profile for firefox
+# Description: Safe and easy web browser from Mozilla
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/firefox.local
diff --git a/etc/firejail-default b/etc/firejail-default
index 28103a598..09dc896e6 100644
--- a/etc/firejail-default
+++ b/etc/firejail-default
@@ -98,9 +98,8 @@ deny /**/.snapshots/ rwx,
 /usr/sbin/** ix,
 /usr/local/** ix,
 /usr/lib/** ix,
+/usr/lib64/** ix,
 /usr/games/** ix,
-/opt/ r,
-/opt/** r,
 /opt/** ix,
 #/home/** ix,
 /run/firejail/mnt/oroot/lib/** ix,
@@ -111,9 +110,8 @@ deny /**/.snapshots/ rwx,
 /run/firejail/mnt/oroot/usr/sbin/** ix,
 /run/firejail/mnt/oroot/usr/local/** ix,
 /run/firejail/mnt/oroot/usr/lib/** ix,
+/run/firejail/mnt/oroot/usr/lib64/** ix,
 /run/firejail/mnt/oroot/usr/games/** ix,
-/run/firejail/mnt/oroot/opt/ r,
-/run/firejail/mnt/oroot/opt/** r,
 /run/firejail/mnt/oroot/opt/** ix,
 
 ##########
@@ -129,6 +127,8 @@ network inet6,
 network unix,
 network netlink,
 network raw,
+# needed for wireshark
+network packet,
 
 ##########
 # There is no equivalent in Firejail for filtering signals.
diff --git a/etc/flameshot.profile b/etc/flameshot.profile
index 8dbd74cc1..e4987280a 100644
--- a/etc/flameshot.profile
+++ b/etc/flameshot.profile
@@ -1,4 +1,5 @@
 # Firejail profile for flameshot
+# Description: Powerful yet simple-to-use screenshot software
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/flameshot.local
diff --git a/etc/flowblade.profile b/etc/flowblade.profile
index 9d399931d..bc95a2b51 100644
--- a/etc/flowblade.profile
+++ b/etc/flowblade.profile
@@ -1,4 +1,5 @@
 # Firejail profile for flowblade
+# Description: Non-linear video editor
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/flowblade.local
diff --git a/etc/fontforge.profile b/etc/fontforge.profile
index e4e763099..2ae80964d 100644
--- a/etc/fontforge.profile
+++ b/etc/fontforge.profile
@@ -1,4 +1,5 @@
 # Firejail profile for fontforge
+# Description: Font editor
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/fontforge.local
diff --git a/etc/freecad.profile b/etc/freecad.profile
index 8c714f37d..934f1d0fb 100644
--- a/etc/freecad.profile
+++ b/etc/freecad.profile
@@ -1,4 +1,5 @@
 # Firejail profile for freecad
+# Description: Extensible Open Source CAx program
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/freecad.local
diff --git a/etc/frozen-bubble.profile b/etc/frozen-bubble.profile
index 63b4d3330..279e5d403 100644
--- a/etc/frozen-bubble.profile
+++ b/etc/frozen-bubble.profile
@@ -1,4 +1,5 @@
 # Firejail profile for frozen-bubble
+# Description: Cool game where you pop out the bubbles
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/frozen-bubble.local
diff --git a/etc/gajim.profile b/etc/gajim.profile
index 80efb08c5..90ba59954 100644
--- a/etc/gajim.profile
+++ b/etc/gajim.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gajim
+# Description: GTK+-based Jabber client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gajim.local
diff --git a/etc/galculator.profile b/etc/galculator.profile
index 1a5112ef5..699fb7d78 100644
--- a/etc/galculator.profile
+++ b/etc/galculator.profile
@@ -1,4 +1,5 @@
 # Firejail profile for galculator
+# Description: Scientific calculator
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/galculator.local
diff --git a/etc/geany.profile b/etc/geany.profile
index 9db533e8c..d69bca1ad 100644
--- a/etc/geany.profile
+++ b/etc/geany.profile
@@ -1,4 +1,5 @@
 # Firejail profile for geany
+# Description: Fast and lightweight IDE
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/geany.local
diff --git a/etc/geary.profile b/etc/geary.profile
index 872d21fdd..735206da2 100644
--- a/etc/geary.profile
+++ b/etc/geary.profile
@@ -1,4 +1,5 @@
 # Firejail profile for geary
+# Description: Lightweight email client designed for the GNOME desktop
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/geary.local
diff --git a/etc/gedit.profile b/etc/gedit.profile
index 67ea43ca3..1a4d9634a 100644
--- a/etc/gedit.profile
+++ b/etc/gedit.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gedit
+# Description: Official text editor of the GNOME desktop environment
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gedit.local
diff --git a/etc/geeqie.profile b/etc/geeqie.profile
index 7512cbcd9..3fbe245d6 100644
--- a/etc/geeqie.profile
+++ b/etc/geeqie.profile
@@ -1,4 +1,5 @@
 # Firejail profile for geeqie
+# Description: Image viewer using GTK+
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/geeqie.local
diff --git a/etc/gimp.profile b/etc/gimp.profile
index b8a297e84..fa27d2cea 100644
--- a/etc/gimp.profile
+++ b/etc/gimp.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gimp
+# Description: GNU Image Manipulation Program
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gimp.local
diff --git a/etc/git.profile b/etc/git.profile
index 1bf9e8e4b..9c8d22fd3 100644
--- a/etc/git.profile
+++ b/etc/git.profile
@@ -1,4 +1,5 @@
 # Firejail profile for git
+# Description: Fast, scalable, distributed revision control system
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/gitg.profile b/etc/gitg.profile
index deee7c994..5a7349eb1 100644
--- a/etc/gitg.profile
+++ b/etc/gitg.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gitg
+# Description: Git repository viewer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gitg.local
diff --git a/etc/gjs.profile b/etc/gjs.profile
index 6110cb71e..a603ad695 100644
--- a/etc/gjs.profile
+++ b/etc/gjs.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gjs
+# Description: Mozilla-based javascript bindings for the GNOME platform
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gjs.local
diff --git a/etc/gnome-2048.profile b/etc/gnome-2048.profile
index 5ecb279e5..62b67b942 100644
--- a/etc/gnome-2048.profile
+++ b/etc/gnome-2048.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-2048
+# Description: Sliding tile puzzle game
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-2048.local
diff --git a/etc/gnome-builder.profile b/etc/gnome-builder.profile
index 4ddfc456a..3b7e3d53a 100644
--- a/etc/gnome-builder.profile
+++ b/etc/gnome-builder.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-builder
+# Description: IDE for GNOME
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-builder.local
diff --git a/etc/gnome-calculator.profile b/etc/gnome-calculator.profile
index 6ace0b3ec..315564ee5 100644
--- a/etc/gnome-calculator.profile
+++ b/etc/gnome-calculator.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-calculator
+# Description: GNOME desktop calculator
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/gnome-chess.profile b/etc/gnome-chess.profile
index 8422e1836..74194cb33 100644
--- a/etc/gnome-chess.profile
+++ b/etc/gnome-chess.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-chess
+# Description: Simple chess game
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-chess.local
diff --git a/etc/gnome-clocks.profile b/etc/gnome-clocks.profile
index b0a6cf80e..a914c302f 100644
--- a/etc/gnome-clocks.profile
+++ b/etc/gnome-clocks.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-clocks
+# Description: Simple GNOME app with stopwatch, timer, and world clock support
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-clocks.local
diff --git a/etc/gnome-contacts.profile b/etc/gnome-contacts.profile
index 0e6f70e04..91593c89b 100644
--- a/etc/gnome-contacts.profile
+++ b/etc/gnome-contacts.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-contacts
+# Description: Contacts manager for GNOME
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-contacts.local
diff --git a/etc/gnome-documents.profile b/etc/gnome-documents.profile
index a7ebb48c8..44886d562 100644
--- a/etc/gnome-documents.profile
+++ b/etc/gnome-documents.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-documents
+# Description: Document manager for GNOME
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-documents.local
diff --git a/etc/gnome-font-viewer.profile b/etc/gnome-font-viewer.profile
index 71cd06643..e11d6eb5d 100644
--- a/etc/gnome-font-viewer.profile
+++ b/etc/gnome-font-viewer.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-font-viewer
+# Description: Font viewer for GNOME
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-font-viewer.local
diff --git a/etc/gnome-logs.profile b/etc/gnome-logs.profile
index f08142113..edb895794 100644
--- a/etc/gnome-logs.profile
+++ b/etc/gnome-logs.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-logs
+# Description: Viewer for the systemd journal
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-logs.local
diff --git a/etc/gnome-maps.profile b/etc/gnome-maps.profile
index b747743fc..f8ff61d84 100644
--- a/etc/gnome-maps.profile
+++ b/etc/gnome-maps.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-maps
+# Description: Map application for GNOME
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-maps.local
diff --git a/etc/gnome-mplayer.profile b/etc/gnome-mplayer.profile
index e85b9dc06..9ba4969e5 100644
--- a/etc/gnome-mplayer.profile
+++ b/etc/gnome-mplayer.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-mplayer
+# Description: GTK/Gnome interface around MPlayer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-mplayer.local
diff --git a/etc/gnome-mpv.profile b/etc/gnome-mpv.profile
index f11ceacca..84a70c4c5 100644
--- a/etc/gnome-mpv.profile
+++ b/etc/gnome-mpv.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-mpv
+# Description: Simple GTK+ frontend for mpv
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-mpv.local
diff --git a/etc/gnome-music.profile b/etc/gnome-music.profile
index 15710b363..eaec627c6 100644
--- a/etc/gnome-music.profile
+++ b/etc/gnome-music.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-music
+# Description: GNOME music player
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-music.local
diff --git a/etc/gnome-photos.profile b/etc/gnome-photos.profile
index 132f3b6bd..5a3ac53d8 100644
--- a/etc/gnome-photos.profile
+++ b/etc/gnome-photos.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-photos
+# Description: Access, organize and share your photos with GNOME
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-photos.local
diff --git a/etc/gnome-recipes.profile b/etc/gnome-recipes.profile
index f1e062fd5..ed6d341eb 100644
--- a/etc/gnome-recipes.profile
+++ b/etc/gnome-recipes.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-recipes
+# Description: Recipe application for GNOME
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-recipes.local
diff --git a/etc/gnome-twitch.profile b/etc/gnome-twitch.profile
index c7fc04be3..e670ba22f 100644
--- a/etc/gnome-twitch.profile
+++ b/etc/gnome-twitch.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-twitch
+# Description: GNOME Twitch app for watching Twitch.tv streams without a browser or flash
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-twitch.local
diff --git a/etc/gnome-weather.profile b/etc/gnome-weather.profile
index f2c6acac5..4d28278b1 100644
--- a/etc/gnome-weather.profile
+++ b/etc/gnome-weather.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gnome-weather
+# Description: Access current conditions and forecasts
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gnome-weather.local
diff --git a/etc/goobox.profile b/etc/goobox.profile
index ca92b1540..ba949f1c9 100644
--- a/etc/goobox.profile
+++ b/etc/goobox.profile
@@ -1,4 +1,5 @@
 # Firejail profile for goobox
+# Description: CD player and ripper with GNOME 3 integration
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/goobox.local
diff --git a/etc/gpa.profile b/etc/gpa.profile
index 17791bb82..c890beb2e 100644
--- a/etc/gpa.profile
+++ b/etc/gpa.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gpa
+# Description: GNU Privacy Assistant (GPA)
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gpa.local
diff --git a/etc/gpg-agent.profile b/etc/gpg-agent.profile
index 85020fc2e..0cc17b366 100644
--- a/etc/gpg-agent.profile
+++ b/etc/gpg-agent.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gpg-agent
+# Description: GNU privacy guard - cryptographic agent
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gpg-agent.local
diff --git a/etc/gpg.profile b/etc/gpg.profile
index ab43152d8..259a95807 100644
--- a/etc/gpg.profile
+++ b/etc/gpg.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gpg
+# Description: GNU Privacy Guard -- minimalist public key operations
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gpg.local
diff --git a/etc/gpicview.profile b/etc/gpicview.profile
index 9644ac59d..04aecc782 100644
--- a/etc/gpicview.profile
+++ b/etc/gpicview.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gpicview
+# Description: Lightweight image viewer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gpicview.local
diff --git a/etc/gpredict.profile b/etc/gpredict.profile
index 58f79ac14..ea60e7287 100644
--- a/etc/gpredict.profile
+++ b/etc/gpredict.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gpredict
+# Description: Satellite tracking program
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gpredict.local
diff --git a/etc/gthumb.profile b/etc/gthumb.profile
index 77ce42b36..6c4de8bf0 100644
--- a/etc/gthumb.profile
+++ b/etc/gthumb.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gthumb
+# Description: Image viewer and browser
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gthumb.local
diff --git a/etc/gucharmap.profile b/etc/gucharmap.profile
index db2e69f8a..88e441b14 100644
--- a/etc/gucharmap.profile
+++ b/etc/gucharmap.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gucharmap
+# Description: Unicode character picker and font browser
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gucharmap.local
diff --git a/etc/gwenview.profile b/etc/gwenview.profile
index bad91f43e..cf9b27e0f 100644
--- a/etc/gwenview.profile
+++ b/etc/gwenview.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gwenview
+# Description: Image viewer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/gwenview.local
diff --git a/etc/gzip.profile b/etc/gzip.profile
index 33892e5c9..9157d398a 100644
--- a/etc/gzip.profile
+++ b/etc/gzip.profile
@@ -1,4 +1,5 @@
 # Firejail profile for gzip
+# Description: GNU compression utilities
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/handbrake.profile b/etc/handbrake.profile
index e467eaeb5..32da097ce 100644
--- a/etc/handbrake.profile
+++ b/etc/handbrake.profile
@@ -1,4 +1,5 @@
 # Firejail profile for handbrake
+# Description: Versatile DVD ripper and video transcoder (GTK+ GUI)
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/handbrake.local
diff --git a/etc/hashcat.profile b/etc/hashcat.profile
index 712a09697..8bc861dde 100644
--- a/etc/hashcat.profile
+++ b/etc/hashcat.profile
@@ -1,4 +1,5 @@
 # Firejail profile for hashcat
+# Description: World's fastest and most advanced password recovery utility
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/hedgewars.profile b/etc/hedgewars.profile
index d6b686be7..542771639 100644
--- a/etc/hedgewars.profile
+++ b/etc/hedgewars.profile
@@ -1,4 +1,5 @@
 # Firejail profile for hedgewars
+# Description: Funny turn-based artillery game, featuring fighting hedgehogs
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/hedgewars.local
diff --git a/etc/hexchat.profile b/etc/hexchat.profile
index 9b2eafcea..a2c163e6a 100644
--- a/etc/hexchat.profile
+++ b/etc/hexchat.profile
@@ -1,4 +1,5 @@
 # Firejail profile for hexchat
+# Description: IRC client for X based on X-Chat 2
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/hexchat.local
diff --git a/etc/highlight.profile b/etc/highlight.profile
index cd48df10c..d313f2769 100644
--- a/etc/highlight.profile
+++ b/etc/highlight.profile
@@ -1,4 +1,5 @@
 # Firejail profile for highlight
+# Description: Universal source code to formatted text converter
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/highlight.local
diff --git a/etc/hugin.profile b/etc/hugin.profile
index cacdaa794..35505c698 100644
--- a/etc/hugin.profile
+++ b/etc/hugin.profile
@@ -1,4 +1,5 @@
 # Firejail profile for hugin
+# Description: Panorama photo stitcher
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/hugin.local
diff --git a/etc/imagej.profile b/etc/imagej.profile
index bfd3444f0..4de064390 100644
--- a/etc/imagej.profile
+++ b/etc/imagej.profile
@@ -1,4 +1,5 @@
 # Firejail profile for imagej
+# Description: Image processing program with a focus on microscopy images
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/imagej.local
diff --git a/etc/inkscape.profile b/etc/inkscape.profile
index e709d488d..56fdfd081 100644
--- a/etc/inkscape.profile
+++ b/etc/inkscape.profile
@@ -1,4 +1,5 @@
 # Firejail profile for inkscape
+# Description: Vector-based drawing program
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/inkscape.local
diff --git a/etc/k3b.profile b/etc/k3b.profile
index 8474c490d..6b4c15560 100644
--- a/etc/k3b.profile
+++ b/etc/k3b.profile
@@ -1,4 +1,5 @@
 # Firejail profile for k3b
+# Description: Sophisticated CD/DVD burning application
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/k3b.local
diff --git a/etc/kaffeine.profile b/etc/kaffeine.profile
index 0d63069fe..204c20501 100644
--- a/etc/kaffeine.profile
+++ b/etc/kaffeine.profile
@@ -1,4 +1,5 @@
 # Firejail profile for kaffeine
+# Description: Versatile media player for KDE
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/kaffeine.local
diff --git a/etc/kate.profile b/etc/kate.profile
index 240bdb62a..8a53a56a8 100644
--- a/etc/kate.profile
+++ b/etc/kate.profile
@@ -1,4 +1,5 @@
 # Firejail profile for kate
+# Description: Powerful text editor
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/kate.local
diff --git a/etc/kcalc.profile b/etc/kcalc.profile
index 5afea9c1c..20ad8f23a 100644
--- a/etc/kcalc.profile
+++ b/etc/kcalc.profile
@@ -1,4 +1,5 @@
 # Firejail profile for kcalc
+# Description: Simple and scientific calculator
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/kcalc.local
diff --git a/etc/kdenlive.profile b/etc/kdenlive.profile
index 0fa9da497..4aca10995 100644
--- a/etc/kdenlive.profile
+++ b/etc/kdenlive.profile
@@ -1,4 +1,5 @@
 # Firejail profile for kdenlive
+# Description: Non-linear video editor
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/kdenlive.local
diff --git a/etc/keepass.profile b/etc/keepass.profile
index 7b0935030..e27248357 100644
--- a/etc/keepass.profile
+++ b/etc/keepass.profile
@@ -1,4 +1,5 @@
 # Firejail profile for keepass
+# Description: An easy-to-use password manager
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/keepass.local
diff --git a/etc/keepassx.profile b/etc/keepassx.profile
index e749a1dfc..94aaa5597 100644
--- a/etc/keepassx.profile
+++ b/etc/keepassx.profile
@@ -1,4 +1,5 @@
 # Firejail profile for keepassx
+# Description: Cross Platform Password Manager
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/keepassx.local
diff --git a/etc/keepassx2.profile b/etc/keepassx2.profile
index ba98df19d..4e74c2cea 100644
--- a/etc/keepassx2.profile
+++ b/etc/keepassx2.profile
@@ -1,4 +1,5 @@
 # Firejail profile for keepassx2
+# Description: Cross platform password manager
 # This file is overwritten after every install/update
 
 # Redirects
diff --git a/etc/keepassxc.profile b/etc/keepassxc.profile
index b7bcc7b87..a00d17878 100644
--- a/etc/keepassxc.profile
+++ b/etc/keepassxc.profile
@@ -1,4 +1,5 @@
 # Firejail profile for keepassxc
+# Description: Cross Platform Password Manager
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/keepassxc.local
@@ -47,3 +48,6 @@ private-tmp
 #memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
+
+# Mutex is stored in /tmp by default, which is broken by private-tmp
+join-or-start keepassxc
diff --git a/etc/kget.profile b/etc/kget.profile
index c45d8daba..a32b51626 100644
--- a/etc/kget.profile
+++ b/etc/kget.profile
@@ -1,4 +1,5 @@
 # Firejail profile for kget
+# Description: Download manager
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/kget.local
diff --git a/etc/kino.profile b/etc/kino.profile
index 5144ce448..cda86ddc6 100644
--- a/etc/kino.profile
+++ b/etc/kino.profile
@@ -1,4 +1,5 @@
 # Firejail profile for kino
+# Description: Non-linear editor for Digital Video data
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/kino.local
diff --git a/etc/kmail.profile b/etc/kmail.profile
index 202faeb16..308a981f7 100644
--- a/etc/kmail.profile
+++ b/etc/kmail.profile
@@ -1,4 +1,5 @@
 # Firejail profile for kmail
+# Description: Full featured graphical email client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/kmail.local
diff --git a/etc/knotes.profile b/etc/knotes.profile
index 4bbbd332d..147d2d831 100644
--- a/etc/knotes.profile
+++ b/etc/knotes.profile
@@ -1,4 +1,5 @@
 # Firejail profile for knotes
+# Description: Sticky notes application
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/knotes.local
diff --git a/etc/kodi.profile b/etc/kodi.profile
index 9726304cc..9dd7770ad 100644
--- a/etc/kodi.profile
+++ b/etc/kodi.profile
@@ -1,4 +1,5 @@
 # Firejail profile for kodi
+# Description: Open Source Home Theatre
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/kodi.local
diff --git a/etc/konversation.profile b/etc/konversation.profile
index 0acad236a..b66f40600 100644
--- a/etc/konversation.profile
+++ b/etc/konversation.profile
@@ -1,4 +1,5 @@
 # Firejail profile for konversation
+# Description: User friendly Internet Relay Chat (IRC) client for KDE
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/konversation.local
diff --git a/etc/kopete.profile b/etc/kopete.profile
index 0954b7dff..d7829113d 100644
--- a/etc/kopete.profile
+++ b/etc/kopete.profile
@@ -1,4 +1,5 @@
 # Firejail profile for kopete
+# Description: Instant messaging and chat application
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/kopete.local
diff --git a/etc/krita.profile b/etc/krita.profile
index 723a8623a..5a1f3d031 100644
--- a/etc/krita.profile
+++ b/etc/krita.profile
@@ -1,4 +1,5 @@
 # Firejail profile for krita
+# Description: Pixel-based image manipulation program
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/krita.local
diff --git a/etc/krunner.profile b/etc/krunner.profile
index 288327f9c..6b84e2c7c 100644
--- a/etc/krunner.profile
+++ b/etc/krunner.profile
@@ -1,4 +1,5 @@
 # Firejail profile for krunner
+# Description: Framework for providing different actions given a string query
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/krunner.local
diff --git a/etc/ktorrent.profile b/etc/ktorrent.profile
index cb5aadbbf..14ee3322c 100644
--- a/etc/ktorrent.profile
+++ b/etc/ktorrent.profile
@@ -1,4 +1,5 @@
 # Firejail profile for ktorrent
+# Description: BitTorrent client based on the KDE platform
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/ktorrent.local
diff --git a/etc/kwrite.profile b/etc/kwrite.profile
index 3297be3b6..f080b3ffc 100644
--- a/etc/kwrite.profile
+++ b/etc/kwrite.profile
@@ -1,4 +1,5 @@
 # Firejail profile for kwrite
+# Description: Simple text editor
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/kwrite.local
diff --git a/etc/leafpad.profile b/etc/leafpad.profile
index 0374d2e4a..d3335893f 100644
--- a/etc/leafpad.profile
+++ b/etc/leafpad.profile
@@ -1,4 +1,5 @@
 # Firejail profile for leafpad
+# Description: GTK+ based simple text editor
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/leafpad.local
diff --git a/etc/less.profile b/etc/less.profile
index 2b5449a7b..a08d2c547 100644
--- a/etc/less.profile
+++ b/etc/less.profile
@@ -1,4 +1,5 @@
 # Firejail profile for less
+# Description: Pager program similar to more
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/libreoffice.profile b/etc/libreoffice.profile
index 4aafd7c7a..905dd22b9 100644
--- a/etc/libreoffice.profile
+++ b/etc/libreoffice.profile
@@ -1,4 +1,5 @@
 # Firejail profile for libreoffice
+# Description: Office productivity suite
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/libreoffice.local
diff --git a/etc/liferea.profile b/etc/liferea.profile
index 4b7905cb7..673182c10 100644
--- a/etc/liferea.profile
+++ b/etc/liferea.profile
@@ -1,4 +1,5 @@
 # Firejail profile for liferea
+# Description: Feed/news/podcast client with plugin support
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/liferea.local
diff --git a/etc/linphone.profile b/etc/linphone.profile
index 9e54db3ca..b469b9711 100644
--- a/etc/linphone.profile
+++ b/etc/linphone.profile
@@ -1,4 +1,5 @@
 # Firejail profile for linphone
+# Description: SIP softphone - graphical client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/linphone.local
diff --git a/etc/lmms.profile b/etc/lmms.profile
index 3a312a2cf..d3ef1b40e 100644
--- a/etc/lmms.profile
+++ b/etc/lmms.profile
@@ -1,4 +1,5 @@
 # Firejail profile for lmms
+# Description: Linux Multimedia Studio
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/lmms.local
diff --git a/etc/lollypop.profile b/etc/lollypop.profile
index ed893f53e..0f8f49488 100644
--- a/etc/lollypop.profile
+++ b/etc/lollypop.profile
@@ -1,4 +1,5 @@
 # Firejail profile for lollypop
+# Description: Music player for GNOME
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/lollypop.local
diff --git a/etc/luminance-hdr.profile b/etc/luminance-hdr.profile
index 05a1c2bb5..a4ccefb6d 100644
--- a/etc/luminance-hdr.profile
+++ b/etc/luminance-hdr.profile
@@ -1,4 +1,5 @@
 # Firejail profile for luminance-hdr
+# Description: Graphical user interface providing a workflow for HDR imaging
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/luminance-hdr.local
diff --git a/etc/lximage-qt.profile b/etc/lximage-qt.profile
index e50455532..4b3c457f6 100644
--- a/etc/lximage-qt.profile
+++ b/etc/lximage-qt.profile
@@ -1,4 +1,5 @@
 # Firejail profile for lximage-qt
+# Description: Image viewer for LXQt
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/lximage-qt.local
diff --git a/etc/lxmusic.profile b/etc/lxmusic.profile
index 44aa0537b..7c3334075 100644
--- a/etc/lxmusic.profile
+++ b/etc/lxmusic.profile
@@ -1,4 +1,5 @@
 # Firejail profile for lxmusic
+# Description: LXDE music player
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/lxmusic.local
diff --git a/etc/lynx.profile b/etc/lynx.profile
index 3c70800be..f5ec44fda 100644
--- a/etc/lynx.profile
+++ b/etc/lynx.profile
@@ -1,4 +1,5 @@
 # Firejail profile for lynx
+# Description: Classic non-graphical (text-mode) web browser
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/lynx.local
diff --git a/etc/mate-calc.profile b/etc/mate-calc.profile
index 6185b013f..874fcf8cb 100644
--- a/etc/mate-calc.profile
+++ b/etc/mate-calc.profile
@@ -1,4 +1,5 @@
 # Firejail profile for mate-calc
+# Description: MATE desktop calculator
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/mate-calc.local
diff --git a/etc/mcabber.profile b/etc/mcabber.profile
index aee153110..0ed8952e5 100644
--- a/etc/mcabber.profile
+++ b/etc/mcabber.profile
@@ -1,4 +1,5 @@
 # Firejail profile for mcabber
+# Description: Small Jabber (XMPP) console client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/mcabber.local
diff --git a/etc/mediainfo.profile b/etc/mediainfo.profile
index 48db03c27..7556098a7 100644
--- a/etc/mediainfo.profile
+++ b/etc/mediainfo.profile
@@ -1,4 +1,5 @@
 # Firejail profile for mediainfo
+# Description: Command-line utility for reading information from audio/video files
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/mediainfo.local
diff --git a/etc/mediathekview.profile b/etc/mediathekview.profile
index 12956bab6..e53ced860 100644
--- a/etc/mediathekview.profile
+++ b/etc/mediathekview.profile
@@ -1,4 +1,5 @@
 # Firejail profile for mediathekview
+# Description: View streams from German public television stations
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/mediathekview.local
diff --git a/etc/meld.profile b/etc/meld.profile
index 1e85343df..00d5c6caa 100644
--- a/etc/meld.profile
+++ b/etc/meld.profile
@@ -1,4 +1,5 @@
 # Firejail profile for meld
+# Description: Graphical tool to diff and merge files
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/meld.local
diff --git a/etc/midori.profile b/etc/midori.profile
index 2f7e238cb..7c56910a7 100644
--- a/etc/midori.profile
+++ b/etc/midori.profile
@@ -1,4 +1,5 @@
 # Firejail profile for midori
+# Description: Lightweight web browser
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/midori.local
diff --git a/etc/minetest.profile b/etc/minetest.profile
index 6497fa9ba..7de546791 100644
--- a/etc/minetest.profile
+++ b/etc/minetest.profile
@@ -1,4 +1,5 @@
 # Firejail profile for minetest
+# Description: Multiplayer infinite-world block sandbox
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/minetest.local
diff --git a/etc/mousepad.profile b/etc/mousepad.profile
index a4a1ad599..421637509 100644
--- a/etc/mousepad.profile
+++ b/etc/mousepad.profile
@@ -1,4 +1,5 @@
 # Firejail profile for mousepad
+# Description: Simple Xfce oriented text editor
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/mousepad.local
diff --git a/etc/mpd.profile b/etc/mpd.profile
index 50ef915ce..709f2ef89 100644
--- a/etc/mpd.profile
+++ b/etc/mpd.profile
@@ -1,4 +1,5 @@
 # Firejail profile for mpd
+# Description: Music Player Daemon
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/mpd.local
diff --git a/etc/mplayer.profile b/etc/mplayer.profile
index ddcc8b7bf..29ef21b9d 100644
--- a/etc/mplayer.profile
+++ b/etc/mplayer.profile
@@ -1,4 +1,5 @@
 # Firejail profile for mplayer
+# Description: Movie player for Unix-like systems
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/mplayer.local
diff --git a/etc/mpv.profile b/etc/mpv.profile
index 6761c9bd1..5747cd3fa 100644
--- a/etc/mpv.profile
+++ b/etc/mpv.profile
@@ -1,4 +1,5 @@
 # Firejail profile for mpv
+# Description: Video player based on MPlayer/mplayer2
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/mpv.local
diff --git a/etc/mumble.profile b/etc/mumble.profile
index f8a49eb13..f894acb57 100644
--- a/etc/mumble.profile
+++ b/etc/mumble.profile
@@ -1,4 +1,5 @@
 # Firejail profile for mumble
+# Description: Low latency encrypted VoIP client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/mumble.local
diff --git a/etc/mupdf.profile b/etc/mupdf.profile
index 632e3c66a..b49597e00 100644
--- a/etc/mupdf.profile
+++ b/etc/mupdf.profile
@@ -1,4 +1,5 @@
 # Firejail profile for mupdf
+# Description: Lightweight PDF viewer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/mupdf.local
diff --git a/etc/mupen64plus.profile b/etc/mupen64plus.profile
index a91b6753c..a235c44c8 100644
--- a/etc/mupen64plus.profile
+++ b/etc/mupen64plus.profile
@@ -1,4 +1,5 @@
 # Firejail profile for mupen64plus
+# Description: Nintendo64 Emulator
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/mupen64plus.local
diff --git a/etc/musescore.profile b/etc/musescore.profile
index 4e28051a4..3eb929bd1 100644
--- a/etc/musescore.profile
+++ b/etc/musescore.profile
@@ -1,4 +1,5 @@
 # Firejail profile for musescore
+# Description: Free music composition and notation software
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/musescore.local
diff --git a/etc/mutt.profile b/etc/mutt.profile
index bc257f156..6cb09ec78 100644
--- a/etc/mutt.profile
+++ b/etc/mutt.profile
@@ -1,4 +1,5 @@
 # Firejail profile for mutt
+# Description: Text-based mailreader supporting MIME, GPG, PGP and threading
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/mutt.local
diff --git a/etc/nautilus.profile b/etc/nautilus.profile
index f1f565515..1809a6b3c 100644
--- a/etc/nautilus.profile
+++ b/etc/nautilus.profile
@@ -1,4 +1,5 @@
 # Firejail profile for nautilus
+# Description: File manager and graphical shell for GNOME
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/nautilus.local
diff --git a/etc/ncdu.profile b/etc/ncdu.profile
index ab79a325e..fa566b9fd 100644
--- a/etc/ncdu.profile
+++ b/etc/ncdu.profile
@@ -1,4 +1,5 @@
 # Firejail profile for ncdu
+# Description: Ncurses disk usage viewer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/ncdu.local
diff --git a/etc/nemo.profile b/etc/nemo.profile
index 962549a04..98e4ba1bd 100644
--- a/etc/nemo.profile
+++ b/etc/nemo.profile
@@ -1,4 +1,5 @@
 # Firejail profile for nemo
+# Description: File manager and graphical shell for Cinnamon
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/nemo.local
diff --git a/etc/netsurf.profile b/etc/netsurf.profile
index 847e81999..cb38d9de0 100644
--- a/etc/netsurf.profile
+++ b/etc/netsurf.profile
@@ -1,4 +1,5 @@
 # Firejail profile for netsurf
+# Description: Lightweight and fast web browser
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/netsurf.local
diff --git a/etc/neverball.profile b/etc/neverball.profile
index de8bb5d9d..5e6032ae5 100644
--- a/etc/neverball.profile
+++ b/etc/neverball.profile
@@ -1,4 +1,5 @@
 # Firejail profile for neverball
+# Description: 3D floor-tilting game
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/neverball.local
diff --git a/etc/nheko.profile b/etc/nheko.profile
index fa9ce2e8b..f216a9fa5 100644
--- a/etc/nheko.profile
+++ b/etc/nheko.profile
@@ -1,4 +1,5 @@
 # Firejail profile for nheko
+# Description: Desktop IM client for the Matrix protocol
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/nheko.local
diff --git a/etc/obs.profile b/etc/obs.profile
index 6d638e6e6..611ecdd67 100644
--- a/etc/obs.profile
+++ b/etc/obs.profile
@@ -10,6 +10,12 @@ noblacklist ${MUSIC}
 noblacklist ${PICTURES}
 noblacklist ${VIDEOS}
 
+# Allow python (blacklisted by disable-interpreters.inc)
+noblacklist ${PATH}/python2*
+noblacklist ${PATH}/python3*
+noblacklist /usr/lib/python2*
+noblacklist /usr/lib/python3*
+
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-interpreters.inc
@@ -17,6 +23,8 @@ include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-xdg.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 nodvd
 nogroups
@@ -28,7 +36,7 @@ seccomp
 shell none
 tracelog
 
-private-bin obs
+private-bin obs,python*
 private-cache
 private-dev
 private-tmp
diff --git a/etc/odt2txt.profile b/etc/odt2txt.profile
index ea49c1a4d..59470f3bb 100644
--- a/etc/odt2txt.profile
+++ b/etc/odt2txt.profile
@@ -1,4 +1,5 @@
 # Firejail profile for odt2txt
+# Description: Simple converter from OpenDocument Text to plain text
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/odt2txt.local
diff --git a/etc/okular.profile b/etc/okular.profile
index 8fe3b9354..0f15500af 100644
--- a/etc/okular.profile
+++ b/etc/okular.profile
@@ -1,4 +1,5 @@
 # Firejail profile for okular
+# Description: Universal document viewer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/okular.local
diff --git a/etc/open-invaders.profile b/etc/open-invaders.profile
index 5d331423e..1cd9e9537 100644
--- a/etc/open-invaders.profile
+++ b/etc/open-invaders.profile
@@ -1,4 +1,5 @@
 # Firejail profile for open-invaders
+# Description: Space Invaders clone
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/open-invaders.local
diff --git a/etc/openbox.profile b/etc/openbox.profile
index ec4b47c29..1540b71bd 100644
--- a/etc/openbox.profile
+++ b/etc/openbox.profile
@@ -1,4 +1,5 @@
 # Firejail profile for openbox
+# Description: Standards-compliant, fast, light-weight and extensible window manager
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/openbox.local
diff --git a/etc/openshot.profile b/etc/openshot.profile
index 832008564..242511243 100644
--- a/etc/openshot.profile
+++ b/etc/openshot.profile
@@ -1,4 +1,5 @@
 # Firejail profile for openshot
+# Description: Create and edit videos and movies
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/openshot.local
diff --git a/etc/opera.profile b/etc/opera.profile
index c0138c555..294041c24 100644
--- a/etc/opera.profile
+++ b/etc/opera.profile
@@ -1,4 +1,5 @@
 # Firejail profile for opera
+# Description: A fast and secure web browser
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/opera.local
diff --git a/etc/orage.profile b/etc/orage.profile
index 89720ce34..8fc6330d9 100644
--- a/etc/orage.profile
+++ b/etc/orage.profile
@@ -1,4 +1,5 @@
 # Firejail profile for orage
+# Description: Calendar for Xfce Desktop Environment
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/orage.local
diff --git a/etc/p7zip.profile b/etc/p7zip.profile
index b813bfda5..f8b2d6f1a 100644
--- a/etc/p7zip.profile
+++ b/etc/p7zip.profile
@@ -1,4 +1,5 @@
 # Firejail profile for p7zip
+# Description: 7zr file archiver with high compression ratio
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/p7zip.local
diff --git a/etc/parole.profile b/etc/parole.profile
index df8f8e194..00e1466b4 100644
--- a/etc/parole.profile
+++ b/etc/parole.profile
@@ -1,4 +1,5 @@
 # Firejail profile for parole
+# Description: Media player based on GStreamer framework
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/parole.local
diff --git a/etc/patch.profile b/etc/patch.profile
index 3e8045bd4..d4058d6e7 100644
--- a/etc/patch.profile
+++ b/etc/patch.profile
@@ -1,4 +1,5 @@
 # Firejail profile for patch
+# Description: Apply a diff file to an original
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/pcmanfm.profile b/etc/pcmanfm.profile
index 83c1864e9..c7e449166 100644
--- a/etc/pcmanfm.profile
+++ b/etc/pcmanfm.profile
@@ -1,4 +1,5 @@
 # Firejail profile for pcmanfm
+# Description: Extremely fast and lightweight file manager
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/pcmanfm.local
diff --git a/etc/pdfmod.profile b/etc/pdfmod.profile
index 2e3573121..34cf5e44f 100644
--- a/etc/pdfmod.profile
+++ b/etc/pdfmod.profile
@@ -1,4 +1,5 @@
 # Firejail profile for pdfmod
+# Description: Simple tool for modifying PDF documents
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/pdfmod.local
diff --git a/etc/pdfsam.profile b/etc/pdfsam.profile
index daae31338..a09ab0a8a 100644
--- a/etc/pdfsam.profile
+++ b/etc/pdfsam.profile
@@ -1,4 +1,5 @@
 # Firejail profile for pdfsam
+# Description: PDF Split and Merge
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/pdfsam.local
diff --git a/etc/picard.profile b/etc/picard.profile
index 4031d51f5..2cc0b5c68 100644
--- a/etc/picard.profile
+++ b/etc/picard.profile
@@ -1,4 +1,5 @@
 # Firejail profile for picard
+# Description: Next-Generation MusicBrainz audio files tagger
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/picard.local
diff --git a/etc/pidgin.profile b/etc/pidgin.profile
index e0fd270af..e891f5fd8 100644
--- a/etc/pidgin.profile
+++ b/etc/pidgin.profile
@@ -1,4 +1,5 @@
 # Firejail profile for pidgin
+# Description: Graphical multi-protocol instant messaging client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/pidgin.local
diff --git a/etc/pingus.profile b/etc/pingus.profile
index 89247f847..4ce584d1e 100644
--- a/etc/pingus.profile
+++ b/etc/pingus.profile
@@ -1,4 +1,5 @@
 # Firejail profile for pingus
+# Description: Free Lemmings(TM) clone
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/pingus.local
diff --git a/etc/pinta.profile b/etc/pinta.profile
index 335659430..506918b92 100644
--- a/etc/pinta.profile
+++ b/etc/pinta.profile
@@ -1,4 +1,5 @@
 # Firejail profile for pinta
+# Description: Simple drawing/painting program
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/pinta.local
diff --git a/etc/pithos.profile b/etc/pithos.profile
index 7f0ba56b8..e5af9c973 100644
--- a/etc/pithos.profile
+++ b/etc/pithos.profile
@@ -1,4 +1,5 @@
 # Firejail profile for pithos
+# Description: Pandora Radio client for the GNOME desktop
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/pithos.local
diff --git a/etc/pitivi.profile b/etc/pitivi.profile
index 1d7c4f721..6f6aed117 100644
--- a/etc/pitivi.profile
+++ b/etc/pitivi.profile
@@ -1,4 +1,5 @@
 # Firejail profile for pitivi
+# Description: Non-linear audio/video editor using GStreamer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/pitivi.local
diff --git a/etc/playonlinux.profile b/etc/playonlinux.profile
index 1179a7a01..119baf6b5 100644
--- a/etc/playonlinux.profile
+++ b/etc/playonlinux.profile
@@ -1,4 +1,5 @@
 # Firejail profile for playonlinux
+# Description: Front-end for Wine
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/playonlinux.local
diff --git a/etc/pluma.profile b/etc/pluma.profile
index 7a70c88ab..832e7a3f4 100644
--- a/etc/pluma.profile
+++ b/etc/pluma.profile
@@ -1,4 +1,5 @@
 # Firejail profile for pluma
+# Description: Official text editor of the MATE desktop environment
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/pluma.local
diff --git a/etc/polari.profile b/etc/polari.profile
index aba5ea57e..cb6b0f73c 100644
--- a/etc/polari.profile
+++ b/etc/polari.profile
@@ -1,4 +1,5 @@
 # Firejail profile for polari
+# Description: Internet Relay Chat (IRC) client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/polari.local
diff --git a/etc/ppsspp.profile b/etc/ppsspp.profile
index 3a40b6260..8fcc19e65 100644
--- a/etc/ppsspp.profile
+++ b/etc/ppsspp.profile
@@ -1,4 +1,5 @@
 # Firejail profile for ppsspp
+# Description: A PSP emulator written in C++
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/ppsspp.local
diff --git a/etc/psi-plus.profile b/etc/psi-plus.profile
index 6d7050b7a..d2612c95c 100644
--- a/etc/psi-plus.profile
+++ b/etc/psi-plus.profile
@@ -1,4 +1,5 @@
 # Firejail profile for psi-plus
+# Description: Qt-based XMPP/Jabber client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/psi-plus.local
diff --git a/etc/pybitmessage.profile b/etc/pybitmessage.profile
new file mode 100644
index 000000000..02c35b104
--- /dev/null
+++ b/etc/pybitmessage.profile
@@ -0,0 +1,49 @@
+# Firejail profile for pybitmessage
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/pybitmessage.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+noblacklist /sbin
+noblacklist /usr/local/sbin
+noblacklist /usr/sbin
+
+# Allow python (blacklisted by disable-interpreters.inc)
+noblacklist ${PATH}/python2*
+noblacklist ${PATH}/python3*
+noblacklist /usr/lib/python2*
+noblacklist /usr/lib/python3*
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-interpreters.inc
+
+include /etc/firejail/whitelist-var-common.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix,inet,inet6,netlink
+seccomp
+shell none
+
+disable-mnt
+private-bin pybitmessage,python*,sh,ldconfig,env,bash,stat
+private-dev
+private-etc PyBitmessage,PyBitmessage.conf,Trolltech.conf,fonts,gtk-2.0,hosts,ld.so.cache,ld.so.preload,localtime,pki,resolv.conf,selinux,sni-qt.conf,system-fips,xdg,ca-certificates,ssl,pki,crypto-policies
+private-tmp
+
+memory-deny-write-execute
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/qbittorrent.profile b/etc/qbittorrent.profile
index eb15ff445..4ba5d3871 100644
--- a/etc/qbittorrent.profile
+++ b/etc/qbittorrent.profile
@@ -1,4 +1,5 @@
 # Firejail profile for qbittorrent
+# Description: BitTorrent client based on libtorrent-rasterbar with a Qt5 GUI
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/qbittorrent.local
diff --git a/etc/qlipper.profile b/etc/qlipper.profile
index a99825a0c..1293fa30d 100644
--- a/etc/qlipper.profile
+++ b/etc/qlipper.profile
@@ -1,4 +1,5 @@
 # Firejail profile for qlipper
+# Description: Lightweight and cross-platform clipboard history applet
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/qlipper.local
diff --git a/etc/qmmp.profile b/etc/qmmp.profile
index 5c3873b7f..9d127731f 100644
--- a/etc/qmmp.profile
+++ b/etc/qmmp.profile
@@ -1,4 +1,5 @@
 # Firejail profile for qmmp
+# Description: Feature-rich audio player with support of many formats
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/qmmp.local
diff --git a/etc/qpdfview.profile b/etc/qpdfview.profile
index 6057bf4f1..3063010cc 100644
--- a/etc/qpdfview.profile
+++ b/etc/qpdfview.profile
@@ -1,4 +1,5 @@
 # Firejail profile for qpdfview
+# Description: Tabbed document viewer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/qpdfview.local
diff --git a/etc/qtox.profile b/etc/qtox.profile
index 92a8bbf28..3c1697085 100644
--- a/etc/qtox.profile
+++ b/etc/qtox.profile
@@ -1,4 +1,5 @@
 # Firejail profile for qtox
+# Description: Powerful Tox client written in C++/Qt that follows the Tox design guidelines
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/qtox.local
diff --git a/etc/quassel.profile b/etc/quassel.profile
index 9c5bbe1d3..69c6aa61b 100644
--- a/etc/quassel.profile
+++ b/etc/quassel.profile
@@ -1,4 +1,5 @@
 # Firejail profile for quassel
+# Description: Distributed IRC client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/quassel.local
diff --git a/etc/quiterss.profile b/etc/quiterss.profile
index c9e7f9089..368a3d996 100644
--- a/etc/quiterss.profile
+++ b/etc/quiterss.profile
@@ -1,4 +1,5 @@
 # Firejail profile for quiterss
+# Description: RSS/Atom news feeds reader
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/quiterss.local
diff --git a/etc/qutebrowser.profile b/etc/qutebrowser.profile
index 8849cc7b8..d4d8e3b97 100644
--- a/etc/qutebrowser.profile
+++ b/etc/qutebrowser.profile
@@ -1,4 +1,5 @@
 # Firejail profile for qutebrowser
+# Description: Keyboard-driven, vim-like browser based on PyQt5
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/qutebrowser.local
@@ -15,6 +16,9 @@ noblacklist ${PATH}/python3*
 noblacklist /usr/lib/python2*
 noblacklist /usr/lib/python3*
 
+# with >=llvm-4 mesa drivers need llvm stuff
+noblacklist /usr/lib/llvm*
+
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-interpreters.inc
diff --git a/etc/ranger.profile b/etc/ranger.profile
index ff65a057b..fe4131e88 100644
--- a/etc/ranger.profile
+++ b/etc/ranger.profile
@@ -1,4 +1,5 @@
 # Firejail profile for ranger
+# Description: File manager with an ncurses frontend written in Python
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/ranger.local
diff --git a/etc/redeclipse.profile b/etc/redeclipse.profile
index 536c7073c..7271ac2f4 100644
--- a/etc/redeclipse.profile
+++ b/etc/redeclipse.profile
@@ -1,4 +1,5 @@
 # Firejail profile for redeclipse
+# Description: Free, casual arena shooter
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/redeclipse.local
diff --git a/etc/remmina.profile b/etc/remmina.profile
index 71f4bb94f..5078000bb 100644
--- a/etc/remmina.profile
+++ b/etc/remmina.profile
@@ -1,4 +1,5 @@
 # Firejail profile for remmina
+# Description: GTK+ Remote Desktop Client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/remmina.local
diff --git a/etc/rhythmbox.profile b/etc/rhythmbox.profile
index ca06845a5..7dc6470f9 100644
--- a/etc/rhythmbox.profile
+++ b/etc/rhythmbox.profile
@@ -1,4 +1,5 @@
 # Firejail profile for rhythmbox
+# Description: Music player and organizer for GNOME
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/rhythmbox.local
diff --git a/etc/riot-desktop.profile b/etc/riot-desktop.profile
index d38ab6876..cc8b68ebb 100644
--- a/etc/riot-desktop.profile
+++ b/etc/riot-desktop.profile
@@ -1,4 +1,5 @@
 # Firejail profile for riot-desktop
+# Description: A glossy Matrix collaboration client for the desktop
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/riot-desktop.local
diff --git a/etc/riot-web.profile b/etc/riot-web.profile
index 1779d0b7c..5379223c5 100644
--- a/etc/riot-web.profile
+++ b/etc/riot-web.profile
@@ -1,4 +1,5 @@
 # Firejail profile for riot-web
+# Description: A glossy Matrix collaboration client for the web
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/riot-web.local
diff --git a/etc/ristretto.profile b/etc/ristretto.profile
index 08c9dbf2d..bb2a7e95b 100644
--- a/etc/ristretto.profile
+++ b/etc/ristretto.profile
@@ -1,4 +1,5 @@
 # Firejail profile for ristretto
+# Description: Lightweight picture-viewer for the Xfce desktop environment
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/ristretto.local
diff --git a/etc/rtorrent.profile b/etc/rtorrent.profile
index b4a2921ff..bdc5b9232 100644
--- a/etc/rtorrent.profile
+++ b/etc/rtorrent.profile
@@ -1,4 +1,5 @@
 # Firejail profile for rtorrent
+# Description: Ncurses BitTorrent client based on LibTorrent from rakshasa
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/rtorrent.local
diff --git a/etc/scribus.profile b/etc/scribus.profile
index f08c57c1b..375983667 100644
--- a/etc/scribus.profile
+++ b/etc/scribus.profile
@@ -1,4 +1,5 @@
 # Firejail profile for scribus
+# Description: Open Source Desktop Page Layout
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/scribus.local
diff --git a/etc/seamonkey.profile b/etc/seamonkey.profile
index 365fd3a53..b702d8b23 100644
--- a/etc/seamonkey.profile
+++ b/etc/seamonkey.profile
@@ -1,4 +1,5 @@
 # Firejail profile for seamonkey
+# Description: SeaMonkey internet suite
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/seamonkey.local
diff --git a/etc/shellcheck.profile b/etc/shellcheck.profile
index 6827b0baf..f6c154183 100644
--- a/etc/shellcheck.profile
+++ b/etc/shellcheck.profile
@@ -1,4 +1,5 @@
 # Firejail profile for shellcheck
+# Description: Lint tool for shell scripts
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/simple-scan.profile b/etc/simple-scan.profile
index a15576478..30d2203de 100644
--- a/etc/simple-scan.profile
+++ b/etc/simple-scan.profile
@@ -1,4 +1,5 @@
 # Firejail profile for simple-scan
+# Description: Simple Scanning Utility
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/simple-scan.local
diff --git a/etc/simutrans.profile b/etc/simutrans.profile
index 41832011e..3722d9414 100644
--- a/etc/simutrans.profile
+++ b/etc/simutrans.profile
@@ -1,4 +1,5 @@
 # Firejail profile for simutrans
+# Description: Transportation simulator
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/simutrans.local
diff --git a/etc/skanlite.profile b/etc/skanlite.profile
index 5bac0a90d..f8bca415d 100644
--- a/etc/skanlite.profile
+++ b/etc/skanlite.profile
@@ -1,4 +1,5 @@
 # Firejail profile for skanlite
+# Description: Image scanner based on the KSane backend
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/skanlite.local
diff --git a/etc/slack.profile b/etc/slack.profile
index 91bf0a722..ba77a16b9 100644
--- a/etc/slack.profile
+++ b/etc/slack.profile
@@ -5,8 +5,6 @@ include /etc/firejail/slack.local
 # Persistent global definitions
 include /etc/firejail/globals.local
 
-blacklist /var
-
 noblacklist ${HOME}/.config/Slack
 noblacklist ${HOME}/Downloads
 
@@ -21,6 +19,7 @@ mkdir ${HOME}/.config/Slack
 whitelist ${HOME}/.config/Slack
 whitelist ${HOME}/Downloads
 include /etc/firejail/whitelist-common.inc
+include /etc/firejail/whitelist-var-common.inc
 
 caps.drop all
 name slack
diff --git a/etc/smplayer.profile b/etc/smplayer.profile
index 2e792d891..6d8355e6f 100644
--- a/etc/smplayer.profile
+++ b/etc/smplayer.profile
@@ -1,4 +1,5 @@
 # Firejail profile for smplayer
+# Description: Complete front-end for MPlayer and mpv
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/smplayer.local
diff --git a/etc/smtube.profile b/etc/smtube.profile
index 41be2714a..430b4e5cf 100644
--- a/etc/smtube.profile
+++ b/etc/smtube.profile
@@ -1,4 +1,5 @@
 # Firejail profile for smtube
+# Description: YouTube videos browser
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/smtube.local
diff --git a/etc/snap.profile b/etc/snap.profile
index 345525c9a..bcfdc8911 100644
--- a/etc/snap.profile
+++ b/etc/snap.profile
@@ -1,4 +1,5 @@
 # Firejail profile for snap
+# Description: Location of genes from DNA sequence with hidden markov model
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/snap.local
diff --git a/etc/soundconverter.profile b/etc/soundconverter.profile
index a7c8dfce6..ee4d90265 100644
--- a/etc/soundconverter.profile
+++ b/etc/soundconverter.profile
@@ -1,4 +1,5 @@
 # Firejail profile for soundconverter
+# Description: GNOME application to convert audio files into other formats
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/soundconverter.local
diff --git a/etc/spotify.profile b/etc/spotify.profile
index 7f40d4399..4e2718c95 100644
--- a/etc/spotify.profile
+++ b/etc/spotify.profile
@@ -9,7 +9,6 @@ blacklist ${HOME}/.bashrc
 blacklist /lost+found
 blacklist /sbin
 blacklist /srv
-blacklist /sys
 
 noblacklist ${HOME}/.cache/spotify
 noblacklist ${HOME}/.config/spotify
diff --git a/etc/sqlitebrowser.profile b/etc/sqlitebrowser.profile
index 5fee722bf..75e8ed5c0 100644
--- a/etc/sqlitebrowser.profile
+++ b/etc/sqlitebrowser.profile
@@ -1,4 +1,5 @@
 # Firejail profile for sqlitebrowser
+# Description: GUI editor for SQLite databases
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/sqlitebrowser.local
diff --git a/etc/ssh.profile b/etc/ssh.profile
index dfaeb9688..584294f05 100644
--- a/etc/ssh.profile
+++ b/etc/ssh.profile
@@ -1,4 +1,5 @@
 # Firejail profile for ssh
+# Description: Secure shell client and server
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
@@ -37,4 +38,3 @@ memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
 writable-run-user
-
diff --git a/etc/start-tor-browser.profile b/etc/start-tor-browser.profile
index fe9760ad4..6069c5174 100644
--- a/etc/start-tor-browser.profile
+++ b/etc/start-tor-browser.profile
@@ -17,6 +17,7 @@ include /etc/firejail/whitelist-var-common.inc
 
 caps.drop all
 netfilter
+nodbus
 nodvd
 nogroups
 nonewprivs
@@ -24,8 +25,9 @@ noroot
 notv
 novideo
 protocol unix,inet,inet6
-seccomp
+seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
 shell none
+# tracelog may cause issues, see github issue #1930
 tracelog
 
 disable-mnt
diff --git a/etc/steam.profile b/etc/steam.profile
index 3c39915e7..6b985f4e8 100644
--- a/etc/steam.profile
+++ b/etc/steam.profile
@@ -1,4 +1,5 @@
 # Firejail profile for steam
+# Description: Valve's Steam digital software delivery system
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/steam.local
@@ -30,6 +31,12 @@ noblacklist /usr/lib/java
 noblacklist /etc/java
 noblacklist /usr/share/java
 
+# Allow python (blacklisted by disable-interpreters.inc)
+noblacklist ${PATH}/python2*
+noblacklist ${PATH}/python3*
+noblacklist /usr/lib/python2*
+noblacklist /usr/lib/python3*
+
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-interpreters.inc
@@ -57,14 +64,14 @@ shell none
 #tracelog
 
 # private-bin is disabled while in testing, but has been tested working with multiple games
-#private-bin awk,basename,bash,bsdtar,bzip2,cat,chmod,cksum,cmp,comm,compress,cp,curl,cut,date,dbus-launch,dbus-send,desktop-file-edit,desktop-file-install,desktop-file-validate,dirname,echo,env,expr,file,find,getopt,grep,gtar,gzip,head,hostname,id,lbzip2,ldconfig,ldd,ln,ls,lsb_release,lspci,lsof,lz4,lzip,lzma,lzop,md5sum,mkdir,mktemp,mv,netstat,ps,pulseaudio,readlink,realpath,rm,sed,sh,sha1sum,sha256sum,sha512sum,sleep,sort,steam,steamdeps,steam-native,steam-runtime,sum,tail,tar,test,touch,tr,umask,uname,update-desktop-database,wc,wget,which,whoami,xterm,xz,zenity
+#private-bin awk,basename,bash,bsdtar,bzip2,cat,chmod,cksum,cmp,comm,compress,cp,curl,cut,date,dbus-launch,dbus-send,desktop-file-edit,desktop-file-install,desktop-file-validate,dirname,echo,env,expr,file,find,getopt,grep,gtar,gzip,head,hostname,id,lbzip2,ldconfig,ldd,ln,ls,lsb_release,lspci,lsof,lz4,lzip,lzma,lzop,md5sum,mkdir,mktemp,mv,netstat,ps,pulseaudio,python*,readlink,realpath,rm,sed,sh,sha1sum,sha256sum,sha512sum,sleep,sort,steam,steamdeps,steam-native,steam-runtime,sum,tail,tar,test,touch,tr,umask,uname,update-desktop-database,wc,wget,which,whoami,xterm,xz,zenity
 # extra programs are available which might be needed for select games
-#private-bin java,java-config,mono,python*
+#private-bin java,java-config,mono
 # picture viewers are needed for viewing screenshots
 #private-bin eog,eom,gthumb,pix,viewnior,xviewer
 
 # private-dev should be commented for controllers
 private-dev
 # private-etc breaks a small selection of games on some systems, comment to support those
-private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,ld.so.conf,ld.so.conf.d,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl,pki,services,crypto-policies,alternatives
+private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,ld.so.conf,ld.so.conf.d,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl,pki,services,crypto-policies,alternatives,bumblebee,nvidia,os-release
 private-tmp
diff --git a/etc/stellarium.profile b/etc/stellarium.profile
index a174dcd42..cddbd99d6 100644
--- a/etc/stellarium.profile
+++ b/etc/stellarium.profile
@@ -1,4 +1,5 @@
 # Firejail profile for stellarium
+# Description: Real-time photo-realistic sky generator
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/stellarium.local
diff --git a/etc/surf.profile b/etc/surf.profile
index 46c4a363c..3d40ea49b 100644
--- a/etc/surf.profile
+++ b/etc/surf.profile
@@ -1,4 +1,5 @@
 # Firejail profile for surf
+# Description: Simple web browser by suckless community
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/surf.local
diff --git a/etc/sylpheed.profile b/etc/sylpheed.profile
index 54edbd20d..5f30c95ba 100644
--- a/etc/sylpheed.profile
+++ b/etc/sylpheed.profile
@@ -1,4 +1,5 @@
 # Firejail profile for sylpheed
+# Description: Light weight e-mail client with GTK+
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/sylpheed.local
diff --git a/etc/synfigstudio.profile b/etc/synfigstudio.profile
index dcfd730ee..0fc59fd17 100644
--- a/etc/synfigstudio.profile
+++ b/etc/synfigstudio.profile
@@ -1,4 +1,5 @@
 # Firejail profile for synfigstudio
+# Description: Vector-based 2D animation package
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/synfigstudio.local
diff --git a/etc/tar.profile b/etc/tar.profile
index 35dbb3378..7409393c6 100644
--- a/etc/tar.profile
+++ b/etc/tar.profile
@@ -1,4 +1,5 @@
 # Firejail profile for tar
+# Description: GNU version of the tar archiving utility
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/teamspeak3.profile b/etc/teamspeak3.profile
index ad7564bb6..55a95157d 100644
--- a/etc/teamspeak3.profile
+++ b/etc/teamspeak3.profile
@@ -1,4 +1,5 @@
 # Firejail profile for teamspeak3
+# Description: TeamSpeak is software for quality voice communication via the Internet
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/teamspeak3.local
diff --git a/etc/telegram-desktop.profile b/etc/telegram-desktop.profile
index df6557a90..9e4855247 100644
--- a/etc/telegram-desktop.profile
+++ b/etc/telegram-desktop.profile
@@ -1,4 +1,5 @@
 # Firejail profile alias for telegram
+# Description: Official Telegram Desktop client
 # This file is overwritten after every install/update
 
 
diff --git a/etc/thunar.profile b/etc/thunar.profile
index 1545e8c7e..37d10ae0d 100644
--- a/etc/thunar.profile
+++ b/etc/thunar.profile
@@ -1,4 +1,5 @@
 # Firejail profile alias for Thunar
+# Description: Modern file manager for Xfce
 # This file is overwritten after every install/update
 
 
diff --git a/etc/thunderbird.profile b/etc/thunderbird.profile
index 6045d6d17..86671d1be 100644
--- a/etc/thunderbird.profile
+++ b/etc/thunderbird.profile
@@ -1,4 +1,5 @@
 # Firejail profile for thunderbird
+# Description: Email, RSS and newsgroup client with integrated spam filter
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/thunderbird.local
@@ -30,6 +31,11 @@ read-only ${HOME}/.config/mimeapps.list
 # writable-run-user is needed for signing and encrypting emails
 writable-run-user
 
+# If you want to read local mail stored in /var/mail, add the following to thunderbird.local:
+# noblacklist /var/mail
+# noblacklist /var/spool/mail
+# writable-var
+
 # allow browsers
 # Redirect
 include /etc/firejail/firefox.profile
diff --git a/etc/tor.profile b/etc/tor.profile
index 6bfc1c9a6..ddaa9806c 100644
--- a/etc/tor.profile
+++ b/etc/tor.profile
@@ -1,4 +1,5 @@
 # Firejail profile for tor
+# Description: Anonymizing overlay network for TCP
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/tor.local
diff --git a/etc/torbrowser-launcher.profile b/etc/torbrowser-launcher.profile
index 9e3e0ef49..f175b6590 100644
--- a/etc/torbrowser-launcher.profile
+++ b/etc/torbrowser-launcher.profile
@@ -1,4 +1,5 @@
 # Firejail profile for torbrowser-launcher
+# Description: Helps download and run the Tor Browser Bundle
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/torbrowser-launcher.local
@@ -19,9 +20,11 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-interpreters.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-xdg.inc
 
 mkdir ${HOME}/.config/torbrowser
 mkdir ${HOME}/.local/share/torbrowser
+whitelist ${DOWNLOADS}
 whitelist ${HOME}/.config/torbrowser
 whitelist ${HOME}/.local/share/torbrowser
 include /etc/firejail/whitelist-common.inc
@@ -29,6 +32,7 @@ include /etc/firejail/whitelist-var-common.inc
 
 caps.drop all
 netfilter
+nodbus
 nodvd
 nogroups
 nonewprivs
@@ -36,8 +40,9 @@ noroot
 notv
 novideo
 protocol unix,inet,inet6
-seccomp
+seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
 shell none
+# tracelog may cause issues, see github issue #1930
 tracelog
 
 disable-mnt
diff --git a/etc/totem.profile b/etc/totem.profile
index 0acbc5127..bfa5883e2 100644
--- a/etc/totem.profile
+++ b/etc/totem.profile
@@ -1,4 +1,5 @@
 # Firejail profile for totem
+# Description: Simple media player for the GNOME desktop based on GStreamer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/totem.local
diff --git a/etc/tracker.profile b/etc/tracker.profile
index fc58fc479..142089c34 100644
--- a/etc/tracker.profile
+++ b/etc/tracker.profile
@@ -1,4 +1,5 @@
 # Firejail profile for tracker
+# Description: Metadata database, indexer and search tool
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/tracker.local
diff --git a/etc/transmission-cli.profile b/etc/transmission-cli.profile
index 849f9ed49..1a22a713c 100644
--- a/etc/transmission-cli.profile
+++ b/etc/transmission-cli.profile
@@ -1,4 +1,5 @@
 # Firejail profile for transmission-cli
+# Description: Lightweight BitTorrent client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/transmission-cli.local
diff --git a/etc/transmission-gtk.profile b/etc/transmission-gtk.profile
index 6366aa89d..758205ccf 100644
--- a/etc/transmission-gtk.profile
+++ b/etc/transmission-gtk.profile
@@ -1,4 +1,5 @@
 # Firejail profile for transmission-gtk
+# Description: Lightweight BitTorrent client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/transmission-gtk.local
diff --git a/etc/transmission-qt.profile b/etc/transmission-qt.profile
index added7067..c8eb9e326 100644
--- a/etc/transmission-qt.profile
+++ b/etc/transmission-qt.profile
@@ -1,4 +1,5 @@
 # Firejail profile for transmission-qt
+# Description: Lightweight BitTorrent client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/transmission-qt.local
diff --git a/etc/tuxguitar.profile b/etc/tuxguitar.profile
index 1f0d2705e..d467e1a83 100644
--- a/etc/tuxguitar.profile
+++ b/etc/tuxguitar.profile
@@ -1,4 +1,5 @@
 # Firejail profile for tuxguitar
+# Description: Multitrack guitar tablature editor and player (gp3 to gp5)
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/tuxguitar.local
diff --git a/etc/unbound.profile b/etc/unbound.profile
index 3d7ca7285..5bc350e8d 100644
--- a/etc/unbound.profile
+++ b/etc/unbound.profile
@@ -1,4 +1,5 @@
 # Firejail profile for unbound
+# Description: Validating, recursive, caching DNS resolver
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/unbound.local
diff --git a/etc/unknown-horizons.profile b/etc/unknown-horizons.profile
index 985998382..5b2944a88 100644
--- a/etc/unknown-horizons.profile
+++ b/etc/unknown-horizons.profile
@@ -1,4 +1,5 @@
 # Firejail profile for unknown-horizons
+# Description: 2D realtime strategy simulation
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/unknown-horizons.local
diff --git a/etc/unrar.profile b/etc/unrar.profile
index 40ee277e0..c8c72f1f3 100644
--- a/etc/unrar.profile
+++ b/etc/unrar.profile
@@ -1,4 +1,5 @@
 # Firejail profile for unrar
+# Description: Unarchiver for .rar files
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/unzip.profile b/etc/unzip.profile
index 1a1142fe8..0b8b0cc50 100644
--- a/etc/unzip.profile
+++ b/etc/unzip.profile
@@ -1,4 +1,5 @@
 # Firejail profile for unzip
+# Description: De-archiver for .zip files
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/uudeview.profile b/etc/uudeview.profile
index f71f0150d..d1130960d 100644
--- a/etc/uudeview.profile
+++ b/etc/uudeview.profile
@@ -1,4 +1,5 @@
 # Firejail profile for uudeview
+# Description: Smart multi-file multi-part decoder
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/viewnior.profile b/etc/viewnior.profile
index ce4983337..08f9fd309 100644
--- a/etc/viewnior.profile
+++ b/etc/viewnior.profile
@@ -1,4 +1,5 @@
 # Firejail profile for viewnior
+# Description: Simple, fast and elegant image viewer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/viewnior.local
diff --git a/etc/viking.profile b/etc/viking.profile
index a5a01f544..624cb962b 100644
--- a/etc/viking.profile
+++ b/etc/viking.profile
@@ -1,4 +1,5 @@
 # Firejail profile for viking
+# Description: GPS data editor, analyzer and viewer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/viking.local
diff --git a/etc/vim.profile b/etc/vim.profile
index 7fe16e628..1f98a018a 100644
--- a/etc/vim.profile
+++ b/etc/vim.profile
@@ -1,4 +1,5 @@
 # Firejail profile for vim
+# Description: Vi IMproved - enhanced vi editor
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/vim.local
diff --git a/etc/vimpager.profile b/etc/vimpager.profile
index 8bc7cc26a..9c59cb82f 100644
--- a/etc/vimpager.profile
+++ b/etc/vimpager.profile
@@ -1,4 +1,5 @@
 # Firejail profile for vimpager
+# Description: A vim-based script to use as a PAGER
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/vimpager.local
diff --git a/etc/virtualbox.profile b/etc/virtualbox.profile
index 61177698a..c634348c7 100644
--- a/etc/virtualbox.profile
+++ b/etc/virtualbox.profile
@@ -1,4 +1,5 @@
 # Firejail profile for virtualbox
+# Description: x86 virtualization solution
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/virtualbox.local
diff --git a/etc/vlc.profile b/etc/vlc.profile
index 41f482d49..20dafba25 100644
--- a/etc/vlc.profile
+++ b/etc/vlc.profile
@@ -1,4 +1,5 @@
 # Firejail profile for vlc
+# Description: Multimedia player and streamer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/vlc.local
diff --git a/etc/vym.profile b/etc/vym.profile
index f926bf1f4..bb044069d 100644
--- a/etc/vym.profile
+++ b/etc/vym.profile
@@ -1,4 +1,5 @@
 # Firejail profile for vym
+# Description: Mindmapping tool
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/vym.local
diff --git a/etc/w3m.profile b/etc/w3m.profile
index 22843ca54..858b30a5f 100644
--- a/etc/w3m.profile
+++ b/etc/w3m.profile
@@ -1,4 +1,5 @@
 # Firejail profile for w3m
+# Description: WWW browsable pager with excellent tables/frames support
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/w3m.local
diff --git a/etc/warzone2100.profile b/etc/warzone2100.profile
index e339b4100..632a56074 100644
--- a/etc/warzone2100.profile
+++ b/etc/warzone2100.profile
@@ -1,4 +1,5 @@
 # Firejail profile for warzone2100
+# Description: 3D real time strategy game
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/warzone2100.local
diff --git a/etc/weechat.profile b/etc/weechat.profile
index b0971ae19..213271367 100644
--- a/etc/weechat.profile
+++ b/etc/weechat.profile
@@ -1,4 +1,5 @@
 # Firejail profile for weechat
+# Description: Fast, light and extensible chat client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/weechat.local
diff --git a/etc/wesnoth.profile b/etc/wesnoth.profile
index 732b37df0..215d2e72d 100644
--- a/etc/wesnoth.profile
+++ b/etc/wesnoth.profile
@@ -1,4 +1,5 @@
 # Firejail profile for wesnoth
+# Description: Fantasy turn-based strategy game
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/wesnoth.local
diff --git a/etc/wget.profile b/etc/wget.profile
index c509faecc..abe2436d7 100644
--- a/etc/wget.profile
+++ b/etc/wget.profile
@@ -1,4 +1,5 @@
 # Firejail profile for wget
+# Description: Retrieves files from the web
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/wine.profile b/etc/wine.profile
index 914a2225f..88cdd2ffc 100644
--- a/etc/wine.profile
+++ b/etc/wine.profile
@@ -1,4 +1,5 @@
 # Firejail profile for wine
+# Description: A compatibility layer for running Windows programs
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/wine.local
diff --git a/etc/wireshark-gtk.profile b/etc/wireshark-gtk.profile
index 38599b85e..26747379a 100644
--- a/etc/wireshark-gtk.profile
+++ b/etc/wireshark-gtk.profile
@@ -1,4 +1,5 @@
 # Firejail profile alias for wireshark
+# Description: Network protocol analyzer
 # This file is overwritten after every install/update
 
 
diff --git a/etc/wireshark-qt.profile b/etc/wireshark-qt.profile
index 38599b85e..26747379a 100644
--- a/etc/wireshark-qt.profile
+++ b/etc/wireshark-qt.profile
@@ -1,4 +1,5 @@
 # Firejail profile alias for wireshark
+# Description: Network protocol analyzer
 # This file is overwritten after every install/update
 
 
diff --git a/etc/wireshark.profile b/etc/wireshark.profile
index d45198f6a..330f0140e 100644
--- a/etc/wireshark.profile
+++ b/etc/wireshark.profile
@@ -1,4 +1,5 @@
 # Firejail profile for wireshark
+# Description: Network traffic analyzer
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/wireshark.local
@@ -24,6 +25,7 @@ include /etc/firejail/disable-xdg.inc
 
 include /etc/firejail/whitelist-var-common.inc
 
+apparmor
 # caps.drop all
 caps.keep dac_override,net_admin,net_raw
 netfilter
diff --git a/etc/xchat.profile b/etc/xchat.profile
index bab108c0a..af6da1ac5 100644
--- a/etc/xchat.profile
+++ b/etc/xchat.profile
@@ -1,4 +1,5 @@
 # Firejail profile for xchat
+# Description: IRC client for X similar to AmIRC
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/xchat.local
diff --git a/etc/xfburn.profile b/etc/xfburn.profile
index b63e430f6..207e62232 100644
--- a/etc/xfburn.profile
+++ b/etc/xfburn.profile
@@ -1,4 +1,5 @@
 # Firejail profile for xfburn
+# Description: CD-burner application for Xfce Desktop Environment
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/xfburn.local
diff --git a/etc/xfce4-dict.profile b/etc/xfce4-dict.profile
index fc5294d5b..e84c78b24 100644
--- a/etc/xfce4-dict.profile
+++ b/etc/xfce4-dict.profile
@@ -1,4 +1,5 @@
 # Firejail profile for xfce4-dict
+# Description: Dictionary plugin for Xfce4 panel
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/xfce4-dict.local
diff --git a/etc/xfce4-notes.profile b/etc/xfce4-notes.profile
index 5749b7832..99aeebb7f 100644
--- a/etc/xfce4-notes.profile
+++ b/etc/xfce4-notes.profile
@@ -1,4 +1,5 @@
 # Firejail profile for xfce4-notes
+# Description: Notes application for the Xfce4 desktop
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/xfce4-notes.local
diff --git a/etc/xiphos.profile b/etc/xiphos.profile
index 14aced0d9..703579562 100644
--- a/etc/xiphos.profile
+++ b/etc/xiphos.profile
@@ -1,4 +1,5 @@
 # Firejail profile for xiphos
+# Description: Environment for Bible reading, study, and research
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/xiphos.local
diff --git a/etc/xonotic.profile b/etc/xonotic.profile
index a5cfa7513..29b2bb382 100644
--- a/etc/xonotic.profile
+++ b/etc/xonotic.profile
@@ -1,4 +1,5 @@
 # Firejail profile for xonotic
+# Description: A free, fast-paced crossplatform first-person shooter
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/xonotic.local
diff --git a/etc/xpdf.profile b/etc/xpdf.profile
index b689ccb25..c12a3437c 100644
--- a/etc/xpdf.profile
+++ b/etc/xpdf.profile
@@ -1,4 +1,5 @@
 # Firejail profile for xpdf
+# Description: Portable Document Format (PDF) reader
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/xpdf.local
diff --git a/etc/xpra.profile b/etc/xpra.profile
index 0535d85a5..960c493b9 100644
--- a/etc/xpra.profile
+++ b/etc/xpra.profile
@@ -1,4 +1,5 @@
 # Firejail profile for xpra
+# Description: Tool to detach/reattach running X programs
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/xpra.local
diff --git a/etc/xreader.profile b/etc/xreader.profile
index 6da8957f4..25e790fe0 100644
--- a/etc/xreader.profile
+++ b/etc/xreader.profile
@@ -1,4 +1,5 @@
 # Firejail profile for xreader
+# Description: Document viewer for files like PDF and Postscript. X-Apps Project.
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/xreader.local
diff --git a/etc/xxd.profile b/etc/xxd.profile
index 59dac5a91..baee905b7 100644
--- a/etc/xxd.profile
+++ b/etc/xxd.profile
@@ -1,4 +1,5 @@
 # Firejail profile for xxd
+# Description: Tool to make (or reverse) a hex dump
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/xxd.local
diff --git a/etc/xz.profile b/etc/xz.profile
index d77fc85b4..cd79eebc6 100644
--- a/etc/xz.profile
+++ b/etc/xz.profile
@@ -1,4 +1,5 @@
 # Firejail profile alias for cpio
+# Description: Library and command line tools for XZ and LZMA compressed files
 # This file is overwritten after every install/update
 
 
diff --git a/etc/xzdec.profile b/etc/xzdec.profile
index 93b6d5093..796c1d642 100644
--- a/etc/xzdec.profile
+++ b/etc/xzdec.profile
@@ -1,4 +1,5 @@
 # Firejail profile for xzdec
+# Description: XZ-format compression utilities - tiny decompressors
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/youtube-dl.profile b/etc/youtube-dl.profile
index fcb0a8a52..75d4514b6 100644
--- a/etc/youtube-dl.profile
+++ b/etc/youtube-dl.profile
@@ -1,4 +1,5 @@
 # Firejail profile for youtube-dl
+# Description: Downloader of videos from YouTube and other sites
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
diff --git a/etc/zaproxy.profile b/etc/zaproxy.profile
index 66f91250d..872719ebc 100644
--- a/etc/zaproxy.profile
+++ b/etc/zaproxy.profile
@@ -1,4 +1,5 @@
 # Firejail profile for zaproxy
+# Description: Integrated penetration testing tool for finding vulnerabilities in web applications
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/zaproxy.local
diff --git a/etc/zart.profile b/etc/zart.profile
index 885fa5021..a4b22ed5d 100644
--- a/etc/zart.profile
+++ b/etc/zart.profile
@@ -1,4 +1,5 @@
 # Firejail profile for zart
+# Description: A GUI for G'MIC real-time manipulations on the output of a webcam
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/zart.local
diff --git a/etc/zathura.profile b/etc/zathura.profile
index baeca8d19..c1785e332 100644
--- a/etc/zathura.profile
+++ b/etc/zathura.profile
@@ -1,4 +1,5 @@
 # Firejail profile for zathura
+# Description: Document viewer with a minimalistic interface
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/zathura.local
diff --git a/platform/snap/snap.sh b/platform/snap/snap.sh
deleted file mode 100755
index d7f924293..000000000
--- a/platform/snap/snap.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/bash
-
-rm -fr faudit-snap
-rm -f faudit_*.snap
-mkdir faudit-snap
-cd faudit-snap
-snapcraft init
-cp ../snapcraft.yaml .
-#snapcraft stage
-mkdir -p stage/usr/lib/firejail
-cp ../../../src/faudit/faudit stage/usr/lib/firejail/.
-find stage
-snapcraft stage
-snapcraft snap
-cd ..
-mv faudit-snap/faudit_*.snap ../../.
-rm -fr faudit-snap
-
-
-
diff --git a/platform/snap/snapcraft.yaml b/platform/snap/snapcraft.yaml
deleted file mode 100644
index d3755de96..000000000
--- a/platform/snap/snapcraft.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: faudit  # the name of the snap
-version: 0  # the version of the snap
-summary: Fireajail audit snap edition  # 79 char long summary
-description: faudit program extracted from Firejail and packaged as a snap  # a longer description for the snap
-confinement: strict  # use "strict" to enforce system access only via declared interfaces
-
-apps:
-    faudit:
-        command: /usr/lib/firejail/faudit
-
-parts:
-    faudit:  # Replace with a part name of your liking
-        # Get more information about plugins by running
-        # snapcraft help plugins
-        # and more information about the available plugins
-        # by running
-        # snapcraft list-plugins
-        plugin: nil
-        snap:
-        - usr/lib/firejail/faudit
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index a33aaeb49..0bbafb343 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -77,6 +77,7 @@ cinelerra
 clamdscan
 clamdtop
 clamscan
+clamtk
 claws-mail
 clementine
 clipit
@@ -328,6 +329,7 @@ pluma
 polari
 ppsspp
 psi-plus
+pybitmessage
 # pycharm-community - FB note: may enable later
 # pycharm-professional
 qbittorrent
diff --git a/src/firecfg/main.c b/src/firecfg/main.c
index 6fe220d35..298314d4f 100644
--- a/src/firecfg/main.c
+++ b/src/firecfg/main.c
@@ -21,6 +21,7 @@
 #include "firecfg.h"
 #include "../include/firejail_user.h"
 int arg_debug = 0;
+char *arg_bindir = "/usr/local/bin";
 
 static char *usage_str =
         "Firecfg is the desktop configuration utility for Firejail software. The utility\n"
@@ -31,6 +32,7 @@ static char *usage_str =
         "DESKTOP INTEGRATION section in man 1 firejail.\n\n"
         "Usage: firecfg [OPTIONS]\n\n"
         "   --add-users user [user] - add the users to Firejail user access database.\n\n"
+        "   --bindir=directory - install in directory instead of /usr/local/bin.\n\n"
         "   --clean - remove all firejail symbolic links.\n\n"
         "   --debug - print debug messages.\n\n"
         "   --fix - fix .desktop files.\n\n"
@@ -62,9 +64,9 @@ static void usage(void) {
 
 
 static void list(void) {
-        DIR *dir = opendir("/usr/local/bin");
+        DIR *dir = opendir(arg_bindir);
         if (!dir) {
-                fprintf(stderr, "Error: cannot open /usr/local/bin directory\n");
+                fprintf(stderr, "Error: cannot open %s directory\n", arg_bindir);
                 exit(1);
         }
 
@@ -78,7 +80,7 @@ static void list(void) {
                         continue;
 
                 char *fullname;
-                if (asprintf(&fullname, "/usr/local/bin/%s", entry->d_name) == -1)
+                if (asprintf(&fullname, "%s/%s", arg_bindir, entry->d_name) == -1)
                         errExit("asprintf");
 
                 if (is_link(fullname)) {
@@ -98,14 +100,10 @@ static void list(void) {
 
 static void clean(void) {
         printf("Removing all firejail symlinks:\n");
-        if (getuid() != 0) {
-                fprintf(stderr, "Error: you need to be root to run this command\n");
-                exit(1);
-        }
 
-        DIR *dir = opendir("/usr/local/bin");
+        DIR *dir = opendir(arg_bindir);
         if (!dir) {
-                fprintf(stderr, "Error: cannot open /usr/local/bin directory\n");
+                fprintf(stderr, "Error: cannot open %s directory\n", arg_bindir);
                 exit(1);
         }
 
@@ -119,7 +117,7 @@ static void clean(void) {
                         continue;
 
                 char *fullname;
-                if (asprintf(&fullname, "/usr/local/bin/%s", entry->d_name) == -1)
+                if (asprintf(&fullname, "%s/%s", arg_bindir, entry->d_name) == -1)
                         errExit("asprintf");
 
                 if (is_link(fullname)) {
@@ -129,8 +127,11 @@ static void clean(void) {
                                         char *ptr = strrchr(fullname, '/');
                                         assert(ptr);
                                         ptr++;
-                                        unlink(fullname);
-                                        printf("   %s removed\n", ptr);
+                                        int rv = unlink(fullname);
+                                        if (rv)
+                                                fprintf(stderr, "Warning: cannot remove %s\n", fullname);
+                                        else
+                                                printf("   %s removed\n", ptr);
                                 }
                                 free(fname);
                         }
@@ -148,7 +149,7 @@ static void set_file(const char *name, const char *firejail_exec) {
                 return;
 
         char *fname;
-        if (asprintf(&fname, "/usr/local/bin/%s", name) == -1)
+        if (asprintf(&fname, "%s/%s", arg_bindir, name) == -1)
                 errExit("asprintf");
 
         struct stat s;
@@ -161,6 +162,9 @@ static void set_file(const char *name, const char *firejail_exec) {
                 else
                         printf("   %s created\n", name);
         }
+        else {
+          fprintf(stderr, "Warning: cannot create %s - already exists! Skipping...\n", fname);
+        }
 
         free(fname);
 }
@@ -181,7 +185,7 @@ static void set_links_firecfg(void) {
                 fprintf(stderr, "Error: cannot open %s\n", cfgfile);
                 exit(1);
         }
-        printf("Configuring symlinks in /usr/local/bin based on firecfg.config\n");
+        printf("Configuring symlinks in %s based on firecfg.config\n", arg_bindir);
 
         char buf[MAX_BUF];
         int lineno = 0;
@@ -239,7 +243,7 @@ static void set_links_homedir(const char *homedir) {
                 errExit("asprintf");
 
         // parse ~/.config/firejail/ directory
-        printf("\nConfiguring symlinks in /usr/local/bin based on local firejail config directory\n");
+        printf("\nConfiguring symlinks in %s based on local firejail config directory\n", arg_bindir);
 
         DIR *dir = opendir(dirname);
         if (!dir) {
@@ -275,9 +279,68 @@ static void set_links_homedir(const char *homedir) {
         free(firejail_exec);
 }
 
+static char *get_user(void) {
+        char *user = getlogin();
+        if (!user) {
+                user = getenv("SUDO_USER");
+                if (!user) {
+                        fprintf(stderr, "Error: cannot detect login user\n");
+                        exit(1);
+                }
+        }
+
+        return user;
+}
+
+static char *get_homedir(const char *user, uid_t *uid, gid_t *gid) {
+        // find home directory
+        struct passwd *pw = getpwnam(user);
+        if (!pw)
+                goto errexit;
+
+        char *home = pw->pw_dir;
+        if (!home)
+                goto errexit;
+
+        *uid = pw->pw_uid;
+        *gid = pw->pw_gid;
+
+        return home;
+
+errexit:
+        fprintf(stderr, "Error: cannot find home directory for user %s\n", user);
+        exit(1);
+}
 
 int main(int argc, char **argv) {
         int i;
+        int bindir_set = 0;
+
+        // user setup
+        char *user = get_user();
+        uid_t uid;
+        gid_t gid;
+        char *home = get_homedir(user, &uid, &gid);
+
+
+        // check for --bindir
+        for (i = i; i < argc; i++) {
+                if (strncmp(argv[i], "--bindir=", 9) == 0) {
+                        if (strncmp(argv[i] + 9, "~/", 2) == 0) {
+                                if (asprintf(&arg_bindir, "%s/%s", home, argv[i] + 11) == -1)
+                                        errExit("asprintf");
+                        }
+                        else
+                                arg_bindir = argv[i] + 9;
+                        bindir_set = 1;
+
+                        // exit if the directory does not exist, or if we don't have access to it
+                        if (access(arg_bindir, R_OK | W_OK | X_OK)) {
+                                fprintf(stderr, "Error: directory %s not found\n", arg_bindir);
+                                exit(1);
+                        }
+                }
+        }
 
         for (i = 1; i < argc; i++) {
                 // default options
@@ -297,15 +360,6 @@ int main(int argc, char **argv) {
                         return 0;
                 }
                 else if (strcmp(argv[i], "--fix") == 0) {
-                        // find home directory
-                        struct passwd *pw = getpwuid(getuid());
-                        if (!pw) {
-                                goto errexit;
-                        }
-                        char *home = pw->pw_dir;
-                        if (!home) {
-                                goto errexit;
-                        }
                         fix_desktop_files(home);
                         return 0;
                 }
@@ -331,19 +385,24 @@ int main(int argc, char **argv) {
                         return 0;
                 }
                 else {
-                        fprintf(stderr, "Error: invalid command line option\n");
-                        usage();
-                        return 1;
+                        if (strncmp(argv[i], "--bindir=", 9) != 0) { // already handled
+                                fprintf(stderr, "Error: invalid command line option\n");
+                                usage();
+                                return 1;
+                        }
                 }
         }
 
+        if (arg_debug)
+                printf("%s %d %d %d %d\n", user, getuid(), getgid(), geteuid(), getegid());
+
         // set symlinks in /usr/local/bin
-        if (getuid() != 0) {
-                fprintf(stderr, "Error: cannot set the symbolic links in /usr/local/bin\n");
+        if (bindir_set == 0 && getuid() != 0) {
+                fprintf(stderr, "Error: cannot set the symbolic links in %s\n", arg_bindir);
                 fprintf(stderr, "The proper way to run this command is \"sudo firecfg\".\n");
                 return 1;
         }
-        else {
+        else if (bindir_set == 0) {
                 // create /usr/local directory if it doesn't exist (Solus distro)
                 struct stat s;
                 if (stat("/usr/local", &s) != 0) {
@@ -354,66 +413,46 @@ int main(int argc, char **argv) {
                                 return 1;
                         }
                 }
-                if (stat("/usr/local/bin", &s) != 0) {
+                if (stat(arg_bindir, &s) != 0) {
                         printf("Creating /usr/local directory\n");
-                        int rv = mkdir("/usr/local/bin", 0755);
+                        int rv = mkdir(arg_bindir, 0755);
                         if (rv != 0) {
-                                fprintf(stderr, "Error: cannot create /usr/local/bin directory\n");
+                                fprintf(stderr, "Error: cannot create %s directory\n", arg_bindir);
                                 return 1;
                         }
                 }
         }
-        clean();
-        set_links_firecfg();
-
 
+        // clear all symlinks
+        clean();
 
-        // user setup
-        char *user = getlogin();
-        if (!user) {
-                user = getenv("SUDO_USER");
-                if (!user) {
-                        goto errexit;
-                }
-        }
+        // set new symlinks based on /usr/lib/firejail/firecfg.cfg
+        set_links_firecfg();
 
-        // add user to firejail access database
-        if (user) {
+        // add user to firejail access database - only for root
+        if (user && getuid() == 0) {
                 printf("\nAdding user %s to Firejail access database in %s/firejail.users\n", user, SYSCONFDIR);
                 firejail_user_add(user);
         }
 
-        // switch to the local user, and fix desktop files
-        if (user) {
-                // find home directory
-                struct passwd *pw = getpwnam(user);
-                if (!pw) {
-                        goto errexit;
-                }
-                char *home = pw->pw_dir;
-                if (!home) {
-                        goto errexit;
-                }
-
-                // running as root
-                set_links_homedir(home);
+        // set new symlinks based on ~/.config/firejail directory
+        set_links_homedir(home);
 
-                // drop permissions
+        // drop permissions
+        if (getuid() == 0) {
                 if (setgroups(0, NULL) < 0)
                         errExit("setgroups");
-                // set uid/gid
-                if (setgid(pw->pw_gid) < 0)
+                if (setgid(gid) < 0)
                         errExit("setgid");
-                if (setuid(pw->pw_uid) < 0)
+                if (setuid(uid) < 0)
                         errExit("setuid");
-                if (arg_debug)
-                        printf("%s %d %d %d %d\n", user, getuid(), getgid(), geteuid(), getegid());
-                fix_desktop_files(home);
         }
 
-        return 0;
+        if (arg_debug)
+                printf("%s %d %d %d %d\n", user, getuid(), getgid(), geteuid(), getegid());
 
-errexit:
-        fprintf(stderr, "Error: cannot detect login user in order to set desktop files in ~/.local/share/applications\n");
-        return 1;
+        // fix .desktop files in ~/.local/share/applications directory
+        fix_desktop_files(home);
+
+        return 0;
 }
diff --git a/src/firejail/arg-checking.txt b/src/firejail/arg-checking.txt
deleted file mode 100644
index cfed454f8..000000000
--- a/src/firejail/arg-checking.txt
+++ /dev/null
@@ -1,84 +0,0 @@
-arg checking:
-
-1. --output=filename
-        - not supported in profiles
-        - checking no "..",
-        - checking no link,
-        - checking no dir,
-        - checking same permissions,
-        - checking no hard links
-        - unit test
-
-2. --chroot=dirname
-        - not supported in profiles
-        - expand "~"
-        - checking no "..",
-        - checking is dir,
-        - checking no link
-        - checking directory structure
-        - unit test
-
-3. --bind=dirname1,dirname2, --bind=filename1,filenam2
-        - supported in profiles
-        - accepted only when running as root
-        - checking string chars
-        - checking no ".."
-        - unit test non root
-
-4. --tmpfs=dirname
-        - supported in profiles
-        - checking string chars
-        - checking no ".."
-        - unit test
-
-5. --blacklist=filename, --blacklist=dirname
-        - supported in profiles
-        - checking string chars
-        - checking no ".."
-        - unit test
-
-6. --read-only=filename, --read-only=dirname
-        - supported in profiles
-        - checking string chars
-        - checking no ".."
-        - unit test
-
-7. --profile=filename
-        - check access as real GID/UID
-        - checking no dir
-        - checking no link
-        - checking no ".."
-        - unit test
-
-8. --private=dirname
-        - supported in profiles
-        - expand "~"
-        - check is dir
-        - check no link
-        - checking no ".."
-        - check same owner
-        - unit test
-
-9. --private-home=filelist
-        - supported in profiles
-        - checking no ".."
-        - checking file found
-        - checking same owner
-        - checking no link
-        - unit test
-
-10. --netfilter=filename
-        - supported in profiles
-        - check access as real GID/UID
-        - checking no dir
-        - checking no link
-        - checking no ".."
-        - unit test
-
-11. --shell=filename
-        - not supported in profiles
-        - check access as real GID/UID
-        - checking no dir
-        - checking no link
-        - checking no ".."
-        - unit test
diff --git a/src/firejail/bandwidth.c b/src/firejail/bandwidth.c
index 0045b444f..d7764682a 100644
--- a/src/firejail/bandwidth.c
+++ b/src/firejail/bandwidth.c
@@ -328,7 +328,12 @@ void bandwidth_pid(pid_t pid, const char *command, const char *dev, int down, in
         // join the network namespace
         //************************
         pid_t child;
-        if (find_child(pid, &child) == -1) {
+        if (find_child(pid, &child) == 1) {
+                fprintf(stderr, "Error: cannot join the network namespace\n");
+                exit(1);
+        }
+
+        if (invalid_sandbox(child)) {
                 fprintf(stderr, "Error: cannot join the network namespace\n");
                 exit(1);
         }
diff --git a/src/firejail/caps.c b/src/firejail/caps.c
index dae45d9df..bd3b5e229 100644
--- a/src/firejail/caps.c
+++ b/src/firejail/caps.c
@@ -401,18 +401,13 @@ errexit:
 void caps_print_filter(pid_t pid) {
         EUID_ASSERT();
 
-        // if the pid is that of a firejail  process, use the pid of the first child process
-        EUID_ROOT();    // grsecurity
-        char *comm = pid_proc_comm(pid);
-        EUID_USER();    // grsecurity
-        if (comm) {
-                if (strcmp(comm, "firejail") == 0) {
-                        pid_t child;
-                        if (find_child(pid, &child) == 0) {
-                                pid = child;
-                        }
-                }
-                free(comm);
+        // in case the pid is that of a firejail process, use the pid of the first child process
+        pid = switch_to_child(pid);
+
+        // now check if the pid belongs to a firejail sandbox
+        if (invalid_sandbox(pid)) {
+                fprintf(stderr, "Error: no valid sandbox\n");
+                exit(1);
         }
 
         // check privileges for non-root users
diff --git a/src/firejail/cpu.c b/src/firejail/cpu.c
index 8f72fb69e..a92562e67 100644
--- a/src/firejail/cpu.c
+++ b/src/firejail/cpu.c
@@ -165,18 +165,13 @@ static void print_cpu(int pid) {
 void cpu_print_filter(pid_t pid) {
         EUID_ASSERT();
 
-        // if the pid is that of a firejail  process, use the pid of the first child process
-        EUID_ROOT();    // grsecurity
-        char *comm = pid_proc_comm(pid);
-        EUID_USER();    // grsecurity
-        if (comm) {
-                if (strcmp(comm, "firejail") == 0) {
-                        pid_t child;
-                        if (find_child(pid, &child) == 0) {
-                                pid = child;
-                        }
-                }
-                free(comm);
+        // in case the pid is that of a firejail process, use the pid of the first child process
+        pid = switch_to_child(pid);
+
+        // now check if the pid belongs to a firejail sandbox
+        if (invalid_sandbox(pid)) {
+                fprintf(stderr, "Error: no valid sandbox\n");
+                exit(1);
         }
 
         // check privileges for non-root users
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index f31d6a2bc..051456539 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -100,6 +100,7 @@
 #define RUN_FSLOGGER_FILE               "/run/firejail/mnt/fslogger"
 #define RUN_UMASK_FILE          "/run/firejail/mnt/umask"
 #define RUN_OVERLAY_ROOT        "/run/firejail/mnt/oroot"
+#define RUN_READY_FOR_JOIN      "/run/firejail/mnt/ready-for-join"
 
 
 // profiles
@@ -405,7 +406,7 @@ char *guess_shell(void);
 
 // sandbox.c
 int sandbox(void* sandbox_arg);
-void start_application(int no_sandbox);
+void start_application(int no_sandbox, FILE *fp);
 
 // network_main.c
 void net_configure_sandbox_ip(Bridge *br);
@@ -477,6 +478,7 @@ void usage(void);
 
 // join.c
 void join(pid_t pid, int argc, char **argv, int index);
+pid_t switch_to_child(pid_t pid);
 
 // shutdown.c
 void shut(pid_t pid);
@@ -512,9 +514,10 @@ void logerr(const char *msg);
 int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode);
 void copy_file_as_user(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode);
 void copy_file_from_user_to_root(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode);
-void touch_file_as_user(const char *fname, uid_t uid, gid_t gid, mode_t mode);
+void touch_file_as_user(const char *fname, mode_t mode);
 int is_dir(const char *fname);
 int is_link(const char *fname);
+void trim_trailing_slash_or_dot(char *path);
 char *line_remove_spaces(const char *buf);
 char *split_comma(char *str);
 void check_unsigned(const char *str, const char *msg);
@@ -536,6 +539,7 @@ unsigned extract_timeout(const char *str);
 void disable_file_or_dir(const char *fname);
 void disable_file_path(const char *path, const char *file);
 int safe_fd(const char *path, int flags);
+int invalid_sandbox(const pid_t pid);
 
 // Get info regarding the last kernel mount operation from /proc/self/mountinfo
 // The return value points to a static area, and will be overwritten by subsequent calls.
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index ba2f8e284..d28ff534f 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -641,8 +641,26 @@ void fs_proc_sys_dev_boot(void) {
                         char *fnamegpg;
                         if (asprintf(&fnamegpg, "/run/user/%d/gnupg", getuid()) == -1)
                                 errExit("asprintf");
-                        if (stat(fnamegpg, &s) == -1)
-                            mkdir_attr(fnamegpg, 0700, getuid(), getgid());
+                        if (stat(fnamegpg, &s) == -1) {
+                                pid_t child = fork();
+                                if (child < 0)
+                                        errExit("fork");
+                                if (child == 0) {
+                                        // drop privileges
+                                        drop_privs(0);
+                                        if (mkdir(fnamegpg, 0700) == 0) {
+                                                if (chmod(fnamegpg, 0700) == -1)
+                                                        {;} // do nothing
+                                        }
+#ifdef HAVE_GCOV
+                                        __gcov_flush();
+#endif
+                                        _exit(0);
+                                }
+                                // wait for the child to finish
+                                waitpid(child, NULL, 0);
+                                fs_logger2("create", fnamegpg);
+                        }
                         if (stat(fnamegpg, &s) == 0)
                                 disable_file(BLACKLIST_FILE, fnamegpg);
                         free(fnamegpg);
@@ -651,8 +669,26 @@ void fs_proc_sys_dev_boot(void) {
                         char *fnamesysd;
                         if (asprintf(&fnamesysd, "/run/user/%d/systemd", getuid()) == -1)
                                 errExit("asprintf");
-                        if (stat(fnamesysd, &s) == -1)
-                                mkdir_attr(fnamesysd, 0755, getuid(), getgid());
+                        if (stat(fnamesysd, &s) == -1) {
+                                pid_t child = fork();
+                                if (child < 0)
+                                        errExit("fork");
+                                if (child == 0) {
+                                        // drop privileges
+                                        drop_privs(0);
+                                        if (mkdir(fnamesysd, 0755) == 0) {
+                                                if (chmod(fnamesysd, 0755) == -1)
+                                                        {;} // do nothing
+                                        }
+#ifdef HAVE_GCOV
+                                        __gcov_flush();
+#endif
+                                        _exit(0);
+                                }
+                                // wait for the child to finish
+                                waitpid(child, NULL, 0);
+                                fs_logger2("create", fnamesysd);
+                        }
                         if (stat(fnamesysd, &s) == 0)
                                 disable_file(BLACKLIST_FILE, fnamesysd);
                         free(fnamesysd);
@@ -1347,14 +1383,17 @@ void fs_private_cache(void) {
         struct stat s;
         if (is_link(cache)) {
                 fwarning("user .cache is a symbolic link, tmpfs not mounted\n");
+                free(cache);
                 return;
         }
         if (stat(cache, &s) == -1 || !S_ISDIR(s.st_mode)) {
                 fwarning("no user .cache directory found, tmpfs not mounted\n");
+                free(cache);
                 return;
         }
         if (s.st_uid != getuid()) {
                 fwarning("user .cache is not owned by current user, tmpfs not mounted\n");
+                free(cache);
                 return;
         }
 
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c
index 01350aa0e..8e8739436 100644
--- a/src/firejail/fs_etc.c
+++ b/src/firejail/fs_etc.c
@@ -100,7 +100,9 @@ errexit:
 }
 
 static void duplicate(const char *fname, const char *private_dir, const char *private_run_dir) {
-        if (*fname == '~' || *fname == '/' || strstr(fname, "..")) {
+        assert(fname);
+
+        if (*fname == '~' || strchr(fname, '/') || strcmp(fname, "..") == 0) {
                 fprintf(stderr, "Error: \"%s\" is an invalid filename\n", fname);
                 exit(1);
         }
@@ -163,6 +165,10 @@ void fs_private_dir_list(const char *private_dir, const char *private_run_dir, c
 
 
                 char *ptr = strtok(dlist, ",");
+                if (!ptr) {
+                        fprintf(stderr, "Error: invalid private %s argument\n", private_dir);
+                        exit(1);
+                }
                 duplicate(ptr, private_dir, private_run_dir);
 
                 while ((ptr = strtok(NULL, ",")) != NULL)
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index 3a332f7ff..866b750b0 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -53,7 +53,7 @@ static void skel(const char *homedir, uid_t u, gid_t g) {
                         fs_logger2("clone", fname);
                 }
                 else {
-                        touch_file_as_user(fname, u, g, 0644);
+                        touch_file_as_user(fname, 0644);
                         fs_logger2("touch", fname);
                 }
                 free(fname);
@@ -78,7 +78,7 @@ static void skel(const char *homedir, uid_t u, gid_t g) {
                         fs_logger2("clone", fname);
                 }
                 else {
-                        touch_file_as_user(fname, u, g, 0644);
+                        touch_file_as_user(fname, 0644);
                         fs_logger2("touch", fname);
                 }
                 free(fname);
@@ -235,8 +235,29 @@ void fs_private_homedir(void) {
         // mount bind private_homedir on top of homedir
         if (arg_debug)
                 printf("Mount-bind %s on top of %s\n", private_homedir, homedir);
-        if (mount(private_homedir, homedir, NULL, MS_NOSUID | MS_NODEV | MS_BIND | MS_REC, NULL) < 0)
+        // get a file descriptor for private_homedir, fails if there is any symlink
+        int fd = safe_fd(private_homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        if (fd == -1)
+                errExit("safe_fd");
+        // check if new home directory is owned by the user
+        struct stat s;
+        if (fstat(fd, &s) == -1)
+                errExit("fstat");
+        if (s.st_uid != getuid()) {
+                fprintf(stderr, "Error: private directory is not owned by the current user\n");
+                exit(1);
+        }
+        if ((S_IRWXU & s.st_mode) != S_IRWXU)
+                fwarning("no full permissions for private directory\n");
+        // mount via the link in /proc/self/fd
+        char *proc;
+        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
+                errExit("asprintf");
+        if (mount(proc, homedir, NULL, MS_NOSUID | MS_NODEV | MS_BIND | MS_REC, NULL) < 0)
                 errExit("mount bind");
+        free(proc);
+        close(fd);
+
         fs_logger3("mount-bind", private_homedir, cfg.homedir);
         fs_logger2("whitelist", cfg.homedir);
 // preserve mode and ownership
@@ -339,37 +360,16 @@ void fs_check_private_dir(void) {
         free(tmp);
 
         if (!cfg.home_private
-         || !is_dir(cfg.home_private)
-         || is_link(cfg.home_private)
-         || strstr(cfg.home_private, "..")) {
+         || !is_dir(cfg.home_private)) {
                 fprintf(stderr, "Error: invalid private directory\n");
                 exit(1);
         }
-
-        // check home directory and chroot home directory have the same owner
-        struct stat s2;
-        int rv = stat(cfg.home_private, &s2);
-        if (rv < 0) {
-                fprintf(stderr, "Error: cannot find %s directory\n", cfg.home_private);
-                exit(1);
-        }
-
-        struct stat s1;
-        rv = stat(cfg.homedir, &s1);
-        if (rv < 0) {
-                fprintf(stderr, "Error: cannot find %s directory, full path name required\n", cfg.homedir);
-                exit(1);
-        }
-        if (s1.st_uid != s2.st_uid) {
-                printf("Error: --private directory should be owned by the current user\n");
-                exit(1);
-        }
 }
 
-#ifndef LTS
 //***********************************************************************************
 // --private-home
 //***********************************************************************************
+#ifndef LTS
 static char *check_dir_or_file(const char *name) {
         assert(name);
 
@@ -401,34 +401,33 @@ static char *check_dir_or_file(const char *name) {
                         }
                         return fname;
                 }
-                else {
-                        fprintf(stderr, "Error: invalid file %s\n", name);
-                        exit(1);
-                }
+                else // dangling link
+                        goto errexit;
         }
         else {
                 // check the file is in user home directory, a full home directory is not allowed
                 char *rname = realpath(fname, NULL);
                 if (!rname ||
                     strncmp(rname, cfg.homedir, strlen(cfg.homedir)) != 0 ||
-                    strcmp(rname, cfg.homedir) == 0) {
-                        fprintf(stderr, "Error: invalid file %s\n", name);
-                        exit(1);
-                }
+                    strcmp(rname, cfg.homedir) == 0)
+                        goto errexit;
 
                 // only top files and directories in user home are allowed
                 char *ptr = rname + strlen(cfg.homedir);
-                assert(*ptr != '\0');
+                if (*ptr != '/')
+                        goto errexit;
                 ptr = strchr(++ptr, '/');
                 if (ptr) {
-                        if (*ptr != '\0') {
-                                fprintf(stderr, "Error: only top files and directories in user home are allowed\n");
-                                exit(1);
-                        }
+                        fprintf(stderr, "Error: only top files and directories in user home are allowed\n");
+                        exit(1);
                 }
                 free(fname);
                 return rname;
         }
+
+errexit:
+        fprintf(stderr, "Error: invalid file %s\n", name);
+        exit(1);
 }
 
 static void duplicate(char *name) {
@@ -495,6 +494,10 @@ void fs_private_home_list(void) {
                 errExit("strdup");
 
         char *ptr = strtok(dlist, ",");
+        if (!ptr) {
+                fprintf(stderr, "Error: invalid private-home argument\n");
+                exit(1);
+        }
         duplicate(ptr);
         while ((ptr = strtok(NULL, ",")) != NULL)
                 duplicate(ptr);
diff --git a/src/firejail/fs_logger.c b/src/firejail/fs_logger.c
index 93f28a26b..02e2ba5d7 100644
--- a/src/firejail/fs_logger.c
+++ b/src/firejail/fs_logger.c
@@ -120,19 +120,8 @@ void fs_logger_change_owner(void) {
 void fs_logger_print_log(pid_t pid) {
         EUID_ASSERT();
 
-        // if the pid is that of a firejail  process, use the pid of the first child process
-        EUID_ROOT();
-        char *comm = pid_proc_comm(pid);
-        EUID_USER();
-        if (comm) {
-                if (strcmp(comm, "firejail") == 0) {
-                        pid_t child;
-                        if (find_child(pid, &child) == 0) {
-                                pid = child;
-                        }
-                }
-                free(comm);
-        }
+        // in case the pid is that of a firejail process, use the pid of the first child process
+        pid = switch_to_child(pid);
 
         // check privileges for non-root users
         uid_t uid = getuid();
@@ -151,7 +140,7 @@ void fs_logger_print_log(pid_t pid) {
 
         EUID_ROOT();
         struct stat s;
-        if (stat(fname, &s) == -1) {
+        if (stat(fname, &s) == -1 || s.st_uid != 0) {
                 fprintf(stderr, "Error: Cannot access filesystem log\n");
                 exit(1);
         }
diff --git a/src/firejail/fs_mkdir.c b/src/firejail/fs_mkdir.c
index 9d22093ee..b66068a95 100644
--- a/src/firejail/fs_mkdir.c
+++ b/src/firejail/fs_mkdir.c
@@ -114,7 +114,7 @@ void fs_mkfile(const char *name) {
         }
 
         // create file
-        touch_file_as_user(expanded, getuid(), getgid(), 0600);
+        touch_file_as_user(expanded, 0600);
 
 doexit:
         free(expanded);
diff --git a/src/firejail/fs_var.c b/src/firejail/fs_var.c
index 9fbbdfa8f..8c53e6161 100644
--- a/src/firejail/fs_var.c
+++ b/src/firejail/fs_var.c
@@ -255,23 +255,8 @@ void fs_var_lock(void) {
                 fs_logger("tmpfs /var/lock");
         }
         else {
-                char *lnk = realpath("/var/lock", NULL);
-                if (lnk) {
-                        if (!is_dir(lnk)) {
-                                // create directory
-                                mkdir_attr(lnk, S_IRWXU|S_IRWXG|S_IRWXO, 0, 0);
-                        }
-                        if (arg_debug)
-                                printf("Mounting tmpfs on %s on behalf of /var/lock\n", lnk);
-                        if (mount("tmpfs", lnk, "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=1777,gid=0") < 0)
-                                errExit("mounting /var/lock");
-                        free(lnk);
-                        fs_logger("tmpfs /var/lock");
-                }
-                else {
-                        fwarning("/var/lock not mounted\n");
-                        dbg_test_dir("/var/lock");
-                }
+                fwarning("/var/lock not mounted\n");
+                dbg_test_dir("/var/lock");
         }
 }
 
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index c3d34e259..602985b4e 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -395,19 +395,8 @@ void fs_whitelist(void) {
                 new_name = expand_home(dataptr, cfg.homedir);
                 assert(new_name);
 
-                // trim trailing slashes or dots
-                char *end = strchr(new_name, '\0');
-                assert(end);
-                if ((end - new_name) > 1) {
-                        end--;
-                        while (*end == '/' ||
-                              (*end == '.' && *(end - 1) == '/')) {
-                                *end = '\0';
-                                end--;
-                                if (end == new_name)
-                                        break;
-                        }
-                }
+                // remove trailing slashes and single dots
+                trim_trailing_slash_or_dot(new_name);
 
                 if (arg_debug || arg_debug_whitelists)
                         fprintf(stderr, "Debug %d: new_name #%s#, %s\n", __LINE__, new_name, (nowhitelist_flag)? "nowhitelist": "whitelist");
diff --git a/src/firejail/join.c b/src/firejail/join.c
index 729c7f797..cdd95b6a8 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -212,8 +212,10 @@ static void extract_umask(pid_t pid) {
 
         FILE *fp = fopen(fname, "re");
         free(fname);
-        if (!fp)
-                return;
+        if (!fp) {
+                fprintf(stderr, "Error: cannot open umask file\n");
+                exit(1);
+        }
         if (fscanf(fp, "%3o", &orig_umask) < 1) {
                 fprintf(stderr, "Error: cannot read umask\n");
                 exit(1);
@@ -221,6 +223,36 @@ static void extract_umask(pid_t pid) {
         fclose(fp);
 }
 
+pid_t switch_to_child(pid_t pid) {
+        EUID_ROOT();
+        errno = 0;
+        char *comm = pid_proc_comm(pid);
+        if (!comm) {
+                if (errno == ENOENT) {
+                        fprintf(stderr, "Error: cannot find process with id %d\n", pid);
+                        exit(1);
+                }
+                else {
+                        fprintf(stderr, "Error: cannot read /proc file\n");
+                        exit(1);
+                }
+        }
+        EUID_USER();
+        if (strcmp(comm, "firejail") == 0) {
+                pid_t child;
+                if (find_child(pid, &child) == 1) {
+                        fprintf(stderr, "Error: no valid sandbox\n");
+                        exit(1);
+                }
+                fmessage("Switching to pid %u, the first child process inside the sandbox\n", (unsigned) child);
+                pid = child;
+        }
+        free(comm);
+        return pid;
+}
+
+
+
 void join(pid_t pid, int argc, char **argv, int index) {
         EUID_ASSERT();
         char *homedir = cfg.homedir;
@@ -229,19 +261,13 @@ void join(pid_t pid, int argc, char **argv, int index) {
         extract_command(argc, argv, index);
         signal (SIGTERM, signal_handler);
 
-        // if the pid is that of a firejail  process, use the pid of the first child process
-        EUID_ROOT();
-        char *comm = pid_proc_comm(pid);
-        EUID_USER();
-        if (comm) {
-                if (strcmp(comm, "firejail") == 0) {
-                        pid_t child;
-                        if (find_child(pid, &child) == 0) {
-                                pid = child;
-                                fmessage("Switching to pid %u, the first child process inside the sandbox\n", (unsigned) pid);
-                        }
-                }
-                free(comm);
+        // in case the pid is that of a firejail process, use the pid of the first child process
+        pid = switch_to_child(pid);
+
+        // now check if the pid belongs to a firejail sandbox
+        if (invalid_sandbox(pid)) {
+                fprintf(stderr, "Error: no valid sandbox\n");
+                exit(1);
         }
 
         // check privileges for non-root users
@@ -406,7 +432,7 @@ void join(pid_t pid, int argc, char **argv, int index) {
                 }
 
                 drop_privs(arg_nogroups);
-                start_application(0);
+                start_application(0, NULL);
 
                 // it will never get here!!!
         }
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 4212edd9b..b3664ee2e 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1652,7 +1652,7 @@ int main(int argc, char **argv) {
                 else if (strncmp(argv[i], "--private-srv=", 14) == 0) {
                         // extract private srv list
                         if (*(argv[i] + 14) == '\0') {
-                                fprintf(stderr, "Error: invalid private-etc option\n");
+                                fprintf(stderr, "Error: invalid private-srv option\n");
                                 exit(1);
                         }
                         if (cfg.srv_private_keep) {
diff --git a/src/firejail/netfilter.c b/src/firejail/netfilter.c
index de446d032..8fbd11bba 100644
--- a/src/firejail/netfilter.c
+++ b/src/firejail/netfilter.c
@@ -170,7 +170,12 @@ void netfilter_print(pid_t pid, int ipv6) {
 
         // join the network namespace
         pid_t child;
-        if (find_child(pid, &child) == -1) {
+        if (find_child(pid, &child) == 1) {
+                fprintf(stderr, "Error: cannot join the network namespace\n");
+                exit(1);
+        }
+
+        if (invalid_sandbox(child)) {
                 fprintf(stderr, "Error: cannot join the network namespace\n");
                 exit(1);
         }
diff --git a/src/firejail/network.txt b/src/firejail/network.txt
deleted file mode 100644
index 75bdc346d..000000000
--- a/src/firejail/network.txt
+++ /dev/null
@@ -1,95 +0,0 @@
-struct Bridge {
-        char *dev;              // bridge device name
-        uint32_t ip;            // bridge device IP address
-        uint32_t mask;          // bridge device mask
-        uint32_t ipsandbox      // sandbox interface IP address
-}
-
-net_configure_bridge(br, device) {
-        br->dev  = devname;
-        br->ip = extracted from kernel device - using net_get_if_addr() in network.c
-        br->mask = extracted from kernel device - using net_get_if_addr() in network.c
-        check available network range; /31 networks are not supported
-}
-
-net_configure_sandbox_ip(br) {
-        if br->ip_sandbox
-                check br->ipsandbox inside the bridge network
-                arp_check(br->ipsandbox)        // send an arp req to check if anybody else is using this address
-        else
-                br->ipsandbox = arp_assign();
-}
-
-net_configure_veth_pair {
-        create a veth pair
-        place one interface end in the bridge
-        place the other end in the namespace of the child process
-}
-
-net_bridge_wait_ip {
-        arp_check br->ipsandbox address to come up
-        wait for not more than 5 seconds
-}
-
-main() {
-
-        foreach argv[i] {
-                if --net
-                        br = next bridge available
-                        net_configure_bridge(br, device name from argv[i]);
-                else if --ip
-                        br = last bridge configured
-                        br->ipsandbox = ip address extracted from argv[i]
-                else if --defaultgw
-                        cfg.defaultgw = ip address extracted from argv[i]
-        }
-
-        net_check_cfg(); // check the validity of network configuration so far
-
-        if (any bridge configured) {
-                lock /var/lock/firejail.lock file
-                for each bridge
-                        net_configure_sandbox_ip(br)
-        }
-
-        clone (new network namespace if any bridge configured or --net=none)
-
-        if (any bridge configured) {
-                for each bridge
-                        net_configure_veth_pair
-        }
-
-        notify child init is done
-
-        if (any bridge configured) {
-                for each bridge
-                        net_bridge_wait_ip
-                unlock /var/lock/firejail.lock file
-        }
-
-        wait on child
-        exit
-}
-
-
-******************************************************
-* macvlan notes
-******************************************************
-Configure a macvlan interface
-
-# ip link add virtual0 link eth0 type macvlan mode bridge
-(you can configure it with # ifconfig virtual0 192.168.1.52/24 up)
-
-Create a new network namespace and move the interface in the new network namespace
-
-# ip netns add dummy0
-# ip link set virtual0 netns dummy0
-
-Join the namespace and configure the interfaces
-
-# ip netns exec dummy0 bash
-# ifconfig lo up
-# ifconfig virtual0 192.168.1.52/24
-
-Investigate ipvlan interface - added to linux kernel 3.19
-https://github.com/torvalds/linux/blob/master/Documentation/networking/ipvlan.txt
diff --git a/src/firejail/network_main.c b/src/firejail/network_main.c
index e30d07229..e3c750767 100644
--- a/src/firejail/network_main.c
+++ b/src/firejail/network_main.c
@@ -269,18 +269,23 @@ void net_dns_print(pid_t pid) {
         EUID_ASSERT();
         // drop privileges - will not be able to read /etc/resolv.conf for --noroot option
 
-        // if the pid is that of a firejail  process, use the pid of the first child process
-        EUID_ROOT();
-        char *comm = pid_proc_comm(pid);
-        EUID_USER();
-        if (comm) {
-                if (strcmp(comm, "firejail") == 0) {
-                        pid_t child;
-                        if (find_child(pid, &child) == 0) {
-                                pid = child;
-                        }
+        // in case the pid is that of a firejail process, use the pid of the first child process
+        pid = switch_to_child(pid);
+
+        // now check if the pid belongs to a firejail sandbox
+        if (invalid_sandbox(pid)) {
+                fprintf(stderr, "Error: no valid sandbox\n");
+                exit(1);
+        }
+
+        // check privileges for non-root users
+        uid_t uid = getuid();
+        if (uid != 0) {
+                uid_t sandbox_uid = pid_get_uid(pid);
+                if (uid != sandbox_uid) {
+                        fprintf(stderr, "Error: permission denied.\n");
+                        exit(1);
                 }
-                free(comm);
         }
 
         EUID_ROOT();
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c
index 5bd3f7e09..7c5cc1df9 100644
--- a/src/firejail/no_sandbox.c
+++ b/src/firejail/no_sandbox.c
@@ -233,5 +233,5 @@ void run_no_sandbox(int argc, char **argv) {
 
         arg_quiet = 1;
 
-        start_application(1);
+        start_application(1, NULL);
 }
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 79fc36fb5..ea069de76 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -1050,7 +1050,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // filesystem bind
         if (strncmp(ptr, "bind ", 5) == 0) {
-#ifdef HAVE_BIND
                 if (checkcfg(CFG_BIND)) {
                         if (getuid() != 0) {
                                 fprintf(stderr, "Error: --bind option is available only if running as root\n");
@@ -1083,7 +1082,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 }
                 else
                         warning_feature_disabled("bind");
-#endif
                 return 0;
         }
 
diff --git a/src/firejail/protocol.c b/src/firejail/protocol.c
index eb3763253..9989ddb68 100644
--- a/src/firejail/protocol.c
+++ b/src/firejail/protocol.c
@@ -64,18 +64,13 @@ void protocol_print_filter(pid_t pid) {
 
         (void) pid;
 #ifdef SYS_socket
-        // if the pid is that of a firejail  process, use the pid of the first child process
-        EUID_ROOT();
-        char *comm = pid_proc_comm(pid);
-        EUID_USER();
-        if (comm) {
-                if (strcmp(comm, "firejail") == 0) {
-                        pid_t child;
-                        if (find_child(pid, &child) == 0) {
-                                pid = child;
-                        }
-                }
-                free(comm);
+        // in case the pid is that of a firejail process, use the pid of the first child process
+        pid = switch_to_child(pid);
+
+        // now check if the pid belongs to a firejail sandbox
+        if (invalid_sandbox(pid)) {
+                fprintf(stderr, "Error: no valid sandbox\n");
+                exit(1);
         }
 
         // check privileges for non-root users
diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index 521f144e8..e6696ecb4 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -117,7 +117,7 @@ void pulseaudio_init(void) {
 
                         int rv = mkdir(dir1, 0755);
                         if (rv == 0) {
-                                if (set_perms(dir1, getuid(), getgid(), 0755))
+                                if (chmod(dir1, 0755))
                                         {;} // do nothing
                         }
 #ifdef HAVE_GCOV
@@ -153,7 +153,7 @@ void pulseaudio_init(void) {
 
                         int rv = mkdir(dir1, 0700);
                         if (rv == 0) {
-                                if (set_perms(dir1, getuid(), getgid(), 0700))
+                                if (chmod(dir1, 0700))
                                         {;} // do nothing
                         }
 #ifdef HAVE_GCOV
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index b0a792277..919a2b84e 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -139,6 +139,18 @@ void save_umask(void) {
         }
 }
 
+static FILE *create_ready_for_join_file(void) {
+        FILE *fp = fopen(RUN_READY_FOR_JOIN, "wxe");
+        if (fp) {
+                ASSERT_PERMS_STREAM(fp, 0, 0, 0644);
+                return fp;
+        }
+        else {
+                fprintf(stderr, "Error: cannot create %s\n", RUN_READY_FOR_JOIN);
+                exit(1);
+        }
+}
+
 static void sandbox_if_up(Bridge *br) {
         assert(br);
         if (!br->configured)
@@ -374,7 +386,7 @@ static int ok_to_run(const char *program) {
         return 0;
 }
 
-void start_application(int no_sandbox) {
+void start_application(int no_sandbox, FILE *fp) {
         // set environment
         if (no_sandbox == 0) {
                 env_defaults();
@@ -394,6 +406,11 @@ void start_application(int no_sandbox) {
 #ifndef LTS
         if (arg_audit) {
                 assert(arg_audit_prog);
+
+                if (fp) {
+                        fprintf(fp, "ready\n");
+                        fclose(fp);
+                }
 #ifdef HAVE_GCOV
                 __gcov_dump();
 #endif
@@ -426,6 +443,11 @@ void start_application(int no_sandbox) {
                         print_time();
 
                 int rv = ok_to_run(cfg.original_argv[cfg.original_program_index]);
+
+                if (fp) {
+                        fprintf(fp, "ready\n");
+                        fclose(fp);
+                }
 #ifdef HAVE_GCOV
                 __gcov_dump();
 #endif
@@ -482,6 +504,11 @@ void start_application(int no_sandbox) {
 
                 if (!arg_command && !arg_quiet)
                         print_time();
+
+                if (fp) {
+                        fprintf(fp, "ready\n");
+                        fclose(fp);
+                }
 #ifdef HAVE_GCOV
                 __gcov_dump();
 #endif
@@ -1080,6 +1107,13 @@ int sandbox(void* sandbox_arg) {
 #endif
 
         //****************************************
+        // communicate progress of sandbox set up
+        // to --join
+        //****************************************
+
+        FILE *fp = create_ready_for_join_file();
+
+        //****************************************
         // create a new user namespace
         //     - too early to drop privileges
         //****************************************
@@ -1144,9 +1178,11 @@ int sandbox(void* sandbox_arg) {
 #endif
 
                 prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); // kill the child in case the parent died
-                start_application(0);   // start app
+                start_application(0, fp);       // start app
         }
 
+        fclose(fp);
+
         int status = monitor_application(app_pid);      // monitor application
         flush_stdin();
 
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 3da0206e1..7be7b3950 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -295,18 +295,13 @@ int seccomp_filter_keep(void) {
 void seccomp_print_filter(pid_t pid) {
         EUID_ASSERT();
 
-        // if the pid is that of a firejail  process, use the pid of the first child process
-        EUID_ROOT();
-        char *comm = pid_proc_comm(pid);
-        EUID_USER();
-        if (comm) {
-                if (strcmp(comm, "firejail") == 0) {
-                        pid_t child;
-                        if (find_child(pid, &child) == 0) {
-                                pid = child;
-                        }
-                }
-                free(comm);
+        // in case the pid is that of a firejail process, use the pid of the first child process
+        pid = switch_to_child(pid);
+
+        // now check if the pid belongs to a firejail sandbox
+        if (invalid_sandbox(pid)) {
+                fprintf(stderr, "Error: no valid sandbox\n");
+                exit(1);
         }
 
         // check privileges for non-root users
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 78cd30926..c8866da3a 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -37,10 +37,8 @@ static char *usage_str =
 #ifdef HAVE_NETWORK
         "    --bandwidth=name|pid - set bandwidth limits.\n"
 #endif
-#ifdef HAVE_BIND
         "    --bind=dirname1,dirname2 - mount-bind dirname1 on top of dirname2.\n"
         "    --bind=filename1,filename2 - mount-bind filename1 on top of filename2.\n"
-#endif
         "    --blacklist=filename - blacklist directory or file.\n"
         "    --build - build a whitelisted profile for the application.\n"
         "    --build=filename - build a whitelisted profile for the application.\n"
@@ -153,6 +151,7 @@ static char *usage_str =
         "    --overlay-clean - clean all overlays stored in $HOME/.firejail directory.\n"
         "    --private - temporary home directory.\n"
         "    --private=directory - use directory as user home.\n"
+        "    --private-cache - temporary ~/.cache directory.\n"
         "    --private-home=file,directory - build a new user home in a temporary\n"
         "\tfilesystem, and copy the files and directories in the list in\n"
         "\tthe new home.\n"
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 329ae141b..050f7534a 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -156,7 +156,6 @@ int mkpath_as_root(const char* path) {
                 *p='\0';
                 if (mkdir(file_path, 0755)==-1) {
                         if (errno != EEXIST) {
-                                *p='/';
                                 free(file_path);
                                 return -1;
                         }
@@ -365,7 +364,7 @@ void copy_file_from_user_to_root(const char *srcname, const char *destname, uid_
 }
 
 // return -1 if error, 0 if no error
-void touch_file_as_user(const char *fname, uid_t uid, gid_t gid, mode_t mode) {
+void touch_file_as_user(const char *fname, mode_t mode) {
         pid_t child = fork();
         if (child < 0)
                 errExit("fork");
@@ -373,10 +372,10 @@ void touch_file_as_user(const char *fname, uid_t uid, gid_t gid, mode_t mode) {
                 // drop privileges
                 drop_privs(0);
 
-                FILE *fp = fopen(fname, "w");
+                FILE *fp = fopen(fname, "wx");
                 if (fp) {
                         fprintf(fp, "\n");
-                        SET_PERMS_STREAM(fp, uid, gid, mode);
+                        SET_PERMS_STREAM(fp, -1, -1, mode);
                         fclose(fp);
                 }
 #ifdef HAVE_GCOV
@@ -425,15 +424,48 @@ int is_link(const char *fname) {
         if (*fname == '\0')
                 return 0;
 
+        char *dup = NULL;
         struct stat s;
         if (lstat(fname, &s) == 0) {
                 if (S_ISLNK(s.st_mode))
                         return 1;
+                if (S_ISDIR(s.st_mode)) {
+                        // remove trailing slashes and single dots and try again
+                        dup = strdup(fname);
+                        if (!dup)
+                                errExit("strdup");
+                        trim_trailing_slash_or_dot(dup);
+                        if (lstat(dup, &s) == 0) {
+                                if (S_ISLNK(s.st_mode)) {
+                                        free(dup);
+                                        return 1;
+                                }
+                        }
+                }
         }
 
+        free(dup);
         return 0;
 }
 
+// remove all slashes and single dots from the end of a path
+// for example /foo/bar///././. -> /foo/bar
+void trim_trailing_slash_or_dot(char *path) {
+        assert(path);
+
+        char *end = strchr(path, '\0');
+        assert(end);
+        if ((end - path) > 1) {
+                end--;
+                while (*end == '/' ||
+                      (*end == '.' && *(end - 1) == '/')) {
+                        *end = '\0';
+                        end--;
+                        if (end == path)
+                                break;
+                }
+        }
+}
 
 // remove multiple spaces and return allocated memory
 char *line_remove_spaces(const char *buf) {
@@ -762,12 +794,14 @@ uid_t pid_get_uid(pid_t pid) {
         char buf[PIDS_BUFLEN];
         while (fgets(buf, PIDS_BUFLEN - 1, fp)) {
                 if (strncmp(buf, "Uid:", 4) == 0) {
-                        char *ptr = buf + 5;
+                        char *ptr = buf + 4;
                         while (*ptr != '\0' && (*ptr == ' ' || *ptr == '\t')) {
                                 ptr++;
                         }
-                        if (*ptr == '\0')
-                                break;
+                        if (*ptr == '\0') {
+                                fprintf(stderr, "Error: cannot read /proc file\n");
+                                exit(1);
+                        }
 
                         rv = atoi(ptr);
                         break;                    // break regardless!
@@ -778,10 +812,6 @@ uid_t pid_get_uid(pid_t pid) {
         free(file);
         EUID_USER();                              // grsecurity fix
 
-        if (rv == 0) {
-                fprintf(stderr, "Error: cannot read /proc file\n");
-                exit(1);
-        }
         return rv;
 }
 
@@ -891,10 +921,8 @@ void create_empty_file_as_root(const char *fname, mode_t mode) {
                 FILE *fp = fopen(fname, "w");
                 if (!fp)
                         errExit("fopen");
-                SET_PERMS_STREAM(fp, 0, 0, S_IRUSR);
+                SET_PERMS_STREAM(fp, 0, 0, mode);
                 fclose(fp);
-                if (chmod(fname, mode) == -1)
-                        errExit("chmod");
         }
 }
 
@@ -1022,7 +1050,7 @@ int safe_fd(const char *path, int flags) {
                 errExit("open");
 
         // traverse the path and return -1 if a symlink is encountered
-        int entered = 0;
+        int weird_pathname = 1;
         int fd = -1;
         char *tok = strtok(dup, "/");
         while (tok) {
@@ -1031,7 +1059,7 @@ int safe_fd(const char *path, int flags) {
                         tok = strtok(NULL, "/");
                         continue;
                 }
-                entered = 1;
+                weird_pathname = 0;
 
                 // open the directory
                 fd = openat(parentfd, tok, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
@@ -1046,7 +1074,7 @@ int safe_fd(const char *path, int flags) {
         }
         if (p != dup) {
                 // consistent flags for top level directories (////foo, /.///foo)
-                if (!entered)
+                if (weird_pathname)
                         flags = O_PATH|O_DIRECTORY|O_CLOEXEC;
                 // open last path segment
                 fd = openat(parentfd, p + 1, flags|O_NOFOLLOW);
@@ -1059,3 +1087,66 @@ errexit:
         fprintf(stderr, "Error: cannot open \"%s\", invalid filename\n", path);
         exit(1);
 }
+
+
+// return 1 if the sandbox identified by pid is not fully set up yet or if
+// it is no firejail sandbox at all, return 0 if the sandbox is complete
+int invalid_sandbox(const pid_t pid) {
+        // check if a file "ready-for-join" exists
+        char *fname;
+        if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_READY_FOR_JOIN) == -1)
+                errExit("asprintf");
+        EUID_ROOT();
+        FILE *fp = fopen(fname, "re");
+        EUID_USER();
+        free(fname);
+        if (!fp)
+                return 1;
+        // regular file owned by root
+        int fd = fileno(fp);
+        if (fd == -1)
+                errExit("fileno");
+        struct stat s;
+        if (fstat(fd, &s) == -1)
+                errExit("fstat");
+        if (!S_ISREG(s.st_mode) || s.st_uid != 0) {
+                fclose(fp);
+                return 1;
+        }
+        // check if it is non-empty
+        char buf[BUFLEN];
+        if (fgets(buf, BUFLEN, fp) == NULL) {
+                fclose(fp);
+                return 1;
+        }
+        fclose(fp);
+        // confirm "ready" string was written
+        if (strncmp(buf, "ready\n", 6) != 0)
+                return 1;
+
+        // walk down the process tree a few nodes, there should be no firejail leaf
+#define MAXNODES 5
+        pid_t current = pid, next;
+        int i;
+        for (i = 0; i < MAXNODES; i++) {
+                if (find_child(current, &next) == 1) {
+                        // found a leaf
+                        EUID_ROOT();
+                        char *comm = pid_proc_comm(current);
+                        EUID_USER();
+                        if (!comm) {
+                                fprintf(stderr, "Error: cannot read /proc file\n");
+                                exit(1);
+                        }
+                        if (strcmp(comm, "firejail") == 0) {
+                                free(comm);
+                                return 1;
+                        }
+                        free(comm);
+                        break;
+                }
+                current = next;
+        }
+
+        return 0;
+}
diff --git a/src/lib/common.c b/src/lib/common.c
index fa988446b..d6dd43c4b 100644
--- a/src/lib/common.c
+++ b/src/lib/common.c
@@ -129,7 +129,7 @@ char *pid_proc_comm(const pid_t pid) {
         // open /proc/pid/cmdline file
         char *fname;
         int fd;
-        if (asprintf(&fname, "/proc/%d//comm", pid) == -1)
+        if (asprintf(&fname, "/proc/%d/comm", pid) == -1)
                 return NULL;
         if ((fd = open(fname, O_RDONLY)) < 0) {
                 free(fname);
@@ -154,6 +154,8 @@ char *pid_proc_comm(const pid_t pid) {
 
         // return a malloc copy of the command line
         char *rv = strdup(buffer);
+        if (!rv)
+                return NULL;
         if (strlen(rv) == 0) {
                 free(rv);
                 return NULL;
@@ -192,6 +194,8 @@ char *pid_proc_cmdline(const pid_t pid) {
 
         // return a malloc copy of the command line
         char *rv = strdup((char *) buffer);
+        if (!rv)
+                return NULL;
         if (strlen(rv) == 0) {
                 free(rv);
                 return NULL;
diff --git a/src/lib/pid.c b/src/lib/pid.c
index 3c804716d..75576c787 100644
--- a/src/lib/pid.c
+++ b/src/lib/pid.c
@@ -149,7 +149,7 @@ uid_t pid_get_uid(pid_t pid) {
         char buf[PIDS_BUFLEN];
         while (fgets(buf, PIDS_BUFLEN - 1, fp)) {
                 if (strncmp(buf, "Uid:", 4) == 0) {
-                        char *ptr = buf + 5;
+                        char *ptr = buf + 4;
                         while (*ptr != '\0' && (*ptr == ' ' || *ptr == '\t')) {
                                 ptr++;
                         }
@@ -398,7 +398,7 @@ void pid_read(pid_t mon_pid) {
                                 pids[pid].parent = parent;
                         }
                         else if (strncmp(buf, "Uid:", 4) == 0) {
-                                char *ptr = buf + 5;
+                                char *ptr = buf + 4;
                                 while (*ptr != '\0' && (*ptr == ' ' || *ptr == '\t')) {
                                         ptr++;
                                 }
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index e29cf4f4b..17562c503 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -113,6 +113,8 @@ Example: "nowhitelist ~/.config"
 Ignore command.
 
 Example: "ignore seccomp"
+.br
+Example: "ignore net ehh0"
 
 .TP
 \fBquiet
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index f29d9cddf..7de1bff50 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -170,7 +170,7 @@ in order to allow strace to run. Chromium and Chromium-based browsers will not w
 .br
 Example:
 .br
-$ firejail --build=profile-file vlc ~/Videos/test.mp4
+$ firejail --build vlc ~/Videos/test.mp4
 .TP
 \fB\-\-build=profile-file
 The command builds a whitelisted profile, and saves it in profile-file. If /usr/bin/strace is installed on the system, it also
@@ -509,7 +509,8 @@ Ignore command in profile file.
 Example:
 .br
 $ firejail \-\-ignore=shell --ignore=seccomp firefox
-
+.br
+$ firejail \-\-ignore="net eth0" firefox
 .TP
 \fB\-\-interface=interface
 Move interface in a new network namespace. Up to four --interface options can be specified.
diff --git a/src/man/firemon.txt b/src/man/firemon.txt
index 9cae72b54..214fcac44 100644
--- a/src/man/firemon.txt
+++ b/src/man/firemon.txt
@@ -105,7 +105,7 @@ The owner of the sandbox.
 .SH LICENSE
 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
 .PP
-Homepage: http://firejail.wordpress.com
+Homepage: https://firejail.wordpress.com
 .SH SEE ALSO
 \&\flfirejail\fR\|(1),
 \&\flfirecfg\fR\|(1),
diff --git a/status b/status
index 44f9318f8..505a900bb 100644
--- a/status
+++ b/status
@@ -1,3 +1,5 @@
+Aug 26 - merge mainline
+
 Phase 2
 - Aug 21
 - remove --output --libtrace --libtracelog