8 files changed, 41 insertions, 21 deletions

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 98b713e9e..e1d972d04 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -47,7 +47,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@f5d822707ee6e8fb81b04a5c0040b736da22e587
+      uses: github/codeql-action/init@883476649888a9e8e219d5b2e6b789dc024f690c
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -58,7 +58,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@f5d822707ee6e8fb81b04a5c0040b736da22e587
+      uses: github/codeql-action/autobuild@883476649888a9e8e219d5b2e6b789dc024f690c
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -72,4 +72,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@f5d822707ee6e8fb81b04a5c0040b736da22e587
+      uses: github/codeql-action/analyze@883476649888a9e8e219d5b2e6b789dc024f690c
diff --git a/etc/inc/allow-common-devel.inc b/etc/inc/allow-common-devel.inc
index 4e460fc10..9576239f3 100644
--- a/etc/inc/allow-common-devel.inc
+++ b/etc/inc/allow-common-devel.inc
@@ -8,8 +8,13 @@ noblacklist ${HOME}/.gitconfig
 noblacklist ${HOME}/.git-credentials
 
 # Java
+noblacklist ${HOME}/.ammonite
+noblacklist ${HOME}/.config/jgit
+noblacklist ${HOME}/.g8
 noblacklist ${HOME}/.gradle
+noblacklist ${HOME}/.ivy2
 noblacklist ${HOME}/.java
+noblacklist ${HOME}/.sbt
 
 # Node.js
 noblacklist ${HOME}/.node-gyp
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index fcd385cae..efe1b2572 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -175,6 +175,7 @@ blacklist ${HOME}/.cache/mypaint
 blacklist ${HOME}/.cache/netsurf
 blacklist ${HOME}/.cache/nheko
 blacklist ${HOME}/.cache/nvim
+blacklist ${HOME}/.cache/ocenaudio
 blacklist ${HOME}/.cache/okular
 blacklist ${HOME}/.cache/opera
 blacklist ${HOME}/.cache/opera-beta
diff --git a/etc/profile-a-l/cmake.profile b/etc/profile-a-l/cmake.profile
index 26cc2a00a..acc03e93f 100644
--- a/etc/profile-a-l/cmake.profile
+++ b/etc/profile-a-l/cmake.profile
@@ -1,12 +1,15 @@
-# Firejail profile for cargo
-# Description: The Rust package manager
+# Firejail profile for cmake
+# Description: A cross-platform open-source make system
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
-include cargo.local
+include cmake.local
 # Persistent global definitions
 include globals.local
 
+whitelist /usr/share/cmake
+whitelist /usr/share/cmake-*
+
 memory-deny-write-execute
 
 # Redirect
diff --git a/etc/profile-m-z/ocenaudio.profile b/etc/profile-m-z/ocenaudio.profile
index 0bfb35333..080b4c92b 100644
--- a/etc/profile-m-z/ocenaudio.profile
+++ b/etc/profile-m-z/ocenaudio.profile
@@ -6,8 +6,9 @@ include ocenaudio.local
 # Persistent global definitions
 include globals.local
 
+noblacklist ${HOME}/.cache/ocenaudio
 noblacklist ${HOME}/.local/share/ocenaudio
-noblacklist ${DOCUMENTS}
+
 noblacklist ${MUSIC}
 
 include disable-common.inc
@@ -18,38 +19,44 @@ include disable-programs.inc
 include disable-shell.inc
 include disable-xdg.inc
 
+mkdir ${HOME}/.cache/ocenaudio
+mkdir ${HOME}/.local/share/ocenaudio
+whitelist ${HOME}/.cache/ocenaudio
+whitelist ${HOME}/.local/share/ocenaudio
+whitelist ${DOWNLOADS}
+whitelist ${MUSIC}
+include whitelist-common.inc
+include whitelist-run-common.inc
+include whitelist-runuser-common.inc
 include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
 caps.drop all
-ipc-namespace
-# net none - breaks update functionality and AppArmor on Ubuntu systems
-# Add 'net none' to your ocenaudio.local when you want that functionality.
-#net none
+#ipc-namespace
 netfilter
 no3d
 nodvd
 nogroups
 noinput
 nonewprivs
+noprinters
 noroot
 notv
 nou2f
 novideo
-protocol unix
+# Add `protocol unix\nignore protocol` to your ocenaudio.local to disable networking.
+protocol unix,inet,inet6
 seccomp
 shell none
 tracelog
 
-private-bin ocenaudio
+private-bin ocenaudio,ocenvst
 private-cache
 private-dev
-private-etc alternatives,asound.conf,fonts,ld.so.cache,ld.so.preload,pulse
+private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg
+private-opt ocenaudio
 private-tmp
 
-# breaks preferences
-# dbus-user none
-# dbus-system none
-
-#memory-deny-write-execute - breaks on Arch (see issue #1803)
+dbus-user none
+dbus-system none
diff --git a/etc/profile-m-z/pip.profile b/etc/profile-m-z/pip.profile
index a0926371f..560957d47 100644
--- a/etc/profile-m-z/pip.profile
+++ b/etc/profile-m-z/pip.profile
@@ -3,7 +3,7 @@
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
-include meson.local
+include pip.local
 # Persistent global definitions
 include globals.local
 
@@ -12,6 +12,9 @@ ignore read-only ${HOME}/.local/lib
 # Allow python3 (blacklisted by disable-interpreters.inc)
 include allow-python3.inc
 
+noblacklist ${HOME}/.cache/pip
+
+#whitelist ${HOME}/.cache/pip
 #whitelist ${HOME}/.local/lib/python*
 
 # Redirect
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 7d8fe273a..3dd339d94 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -517,7 +517,7 @@ There is no root account (uid 0) defined in the namespace.
 Enable protocol filter. The filter is based on seccomp and checks the
 first argument to socket system call. Recognized values: \fBunix\fR,
 \fBinet\fR, \fBinet6\fR, \fBnetlink\fR, \fBpacket\fR, and \fBbluetooth\fR.
-Multiple protocol commands are allowed.
+Multiple protocol commands are allowed and they accumulate.
 .TP
 \fBseccomp
 Enable seccomp filter and blacklist the syscalls in the default list. See man 1 firejail for more details.
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index af71fe5cc..41171a4e7 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -2182,6 +2182,7 @@ $ firejail \-\-profile.print=browser
 \fB\-\-protocol=protocol,protocol,protocol
 Enable protocol filter. The filter is based on seccomp and checks the first argument to socket system call.
 Recognized values: unix, inet, inet6, netlink, packet, and bluetooth. This option is not supported for i386 architecture.
+Multiple protocol commands are allowed and they accumulate.
 .br
 
 .br