10 files changed, 45 insertions, 28 deletions

diff --git a/README b/README
index f00e7b377..9d1732108 100644
--- a/README
+++ b/README
@@ -55,6 +55,7 @@ Fred-Barclay (https://github.com/Fred-Barclay)
         - added audacity profile
         - fixed Telegram and qtox profiles
         - added Atom Beta and Atom profiles
+        - tightened 0ad, atril, evince, gthumb, pix, qtox, and xreader profiles.
 Jaykishan Mutkawoa (https://github.com/jmutkawoa)
         - cpio profile
 Paupiah Yash (https://github.com/CaffeinatedStud)
diff --git a/README.md b/README.md
index 877d2b556..d71b27c61 100644
--- a/README.md
+++ b/README.md
@@ -98,7 +98,9 @@ File transfer: filezilla
 
 Media: vlc, mpv, gnome-mplayer
 
-Office: evince, gthumb, fbreader, pix
+Office: evince, gthumb, fbreader, pix, atril, xreader
+
+Chat/messaging: qtox
 
 ## New security profiles
 
diff --git a/etc/0ad.profile b/etc/0ad.profile
index 3797ae5cd..11fb45463 100644
--- a/etc/0ad.profile
+++ b/etc/0ad.profile
@@ -1,21 +1,13 @@
 # Firejail profile for 0ad.
+noblacklist ~/.cache/0ad
 noblacklist ~/.config/0ad
+noblacklist ~/.local/share/0ad
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
-# Call these options
-caps.drop all
-netfilter
-noroot
-nonewprivs
-protocol unix,inet,inet6,netlink
-seccomp
-tracelog
-
 # Whitelists
-noblacklist ~/.cache/0ad
 mkdir ~/.cache
 mkdir ~/.cache/0ad
 whitelist ~/.cache/0ad
@@ -24,8 +16,20 @@ mkdir ~/.config
 mkdir ~/.config/0ad
 whitelist ~/.config/0ad
 
-noblacklist ~/.local/share/0ad
 mkdir ~/.local
 mkdir ~/.local/share
 mkdir ~/.local/share/0ad
 whitelist ~/.local/share/0ad
+
+caps.drop all
+netfilter
+nonewprivs
+nogroups
+noroot
+protocol unix,inet,inet6
+seccomp
+shell none
+tracelog
+
+private-dev
+
diff --git a/etc/atril.profile b/etc/atril.profile
index 8ee7da173..bfe731bec 100644
--- a/etc/atril.profile
+++ b/etc/atril.profile
@@ -7,10 +7,14 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-netfilter
 nonewprivs
+nogroups
 noroot
 nosound
-protocol unix,inet,inet6
+protocol unix
 seccomp
+shell none
 tracelog
+
+private-bin atril, atril-previewer, atril-thumbnailer
+private-dev
diff --git a/etc/evince.profile b/etc/evince.profile
index 9899da84d..530ce959a 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -6,9 +6,10 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 nonewprivs
+nogroups
 noroot
 nosound
-protocol unix,inet,inet6
+protocol unix
 seccomp
 
 shell none
diff --git a/etc/gthumb.profile b/etc/gthumb.profile
index c673a1297..3c02576aa 100644
--- a/etc/gthumb.profile
+++ b/etc/gthumb.profile
@@ -7,14 +7,15 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-netfilter
 nonewprivs
+nogroups
 noroot
-protocol unix,inet,inet6
+nosound
+protocol unix
 seccomp
-
 shell none
+tracelog
+
 private-bin gthumb
 whitelist /tmp/.X11-unix
 private-dev
-nosound
diff --git a/etc/pix.profile b/etc/pix.profile
index 81ab7486f..80c05fd09 100644
--- a/etc/pix.profile
+++ b/etc/pix.profile
@@ -8,15 +8,16 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-netfilter
 nonewprivs
+nogroups
 noroot
-protocol unix,inet,inet6
+nosound
+protocol unix
 seccomp
-
 shell none
+tracelog
+
 private-bin pix
 whitelist /tmp/.X11-unix
 private-dev
-nosound
 
diff --git a/etc/qtox.profile b/etc/qtox.profile
index 39f900748..0cac18573 100644
--- a/etc/qtox.profile
+++ b/etc/qtox.profile
@@ -8,14 +8,15 @@ include /etc/firejail/disable-passwdmgr.inc
 mkdir ${HOME}/.config/tox
 whitelist ${HOME}/.config/tox
 whitelist ${DOWNLOADS}
-include /etc/firejail/whitelist-common.inc
 
 caps.drop all
 netfilter
 nonewprivs
+nogroups
 noroot
 protocol unix,inet,inet6
 seccomp
 shell none
 tracelog
 
+private-bin qtox
diff --git a/etc/xreader.profile b/etc/xreader.profile
index 2cf109f09..fed9d4db5 100644
--- a/etc/xreader.profile
+++ b/etc/xreader.profile
@@ -9,10 +9,14 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-netfilter
 nonewprivs
+nogroups
 noroot
 nosound
-protocol unix,inet,inet6
+protocol unix
 seccomp
+shell none
 tracelog
+
+private-bin xreader, xreader-previewer, xreader-thumbnailer
+private-dev
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index 3ae366541..ae495ec6d 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -1,5 +1,3 @@
-# Do not have a new/empty line on the end of this file or dpkg-deb will warn
-# that "conffile '' is not a plain file." 
 /etc/firejail/evince.profile
 /etc/firejail/chromium.profile
 /etc/firejail/chromium-browser.profile