24 files changed, 271 insertions, 26 deletions

diff --git a/.github/workflows/check-c.yml b/.github/workflows/check-c.yml
index 49c9b38a7..3fd8a3051 100644
--- a/.github/workflows/check-c.yml
+++ b/.github/workflows/check-c.yml
@@ -161,7 +161,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@47b3d888fe66b639e431abf22ebca059152f1eea
+      uses: github/codeql-action/init@8a470fddafa5cbb6266ee11b37ef4d8aae19c571
       with:
         languages: cpp
 
@@ -172,4 +172,4 @@ jobs:
       run: make -j "$(nproc)"
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@47b3d888fe66b639e431abf22ebca059152f1eea
+      uses: github/codeql-action/analyze@8a470fddafa5cbb6266ee11b37ef4d8aae19c571
diff --git a/.github/workflows/check-python.yml b/.github/workflows/check-python.yml
index 85b75a126..54145e49a 100644
--- a/.github/workflows/check-python.yml
+++ b/.github/workflows/check-python.yml
@@ -51,9 +51,9 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@47b3d888fe66b639e431abf22ebca059152f1eea
+      uses: github/codeql-action/init@8a470fddafa5cbb6266ee11b37ef4d8aae19c571
       with:
         languages: python
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@47b3d888fe66b639e431abf22ebca059152f1eea
+      uses: github/codeql-action/analyze@8a470fddafa5cbb6266ee11b37ef4d8aae19c571
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index aa83691eb..047c8441d 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -482,6 +482,7 @@ blacklist ${HOME}/.config/google-chrome-beta
 blacklist ${HOME}/.config/google-chrome-unstable
 blacklist ${HOME}/.config/gpicview
 blacklist ${HOME}/.config/gramps
+blacklist ${HOME}/.config/green-recorder
 blacklist ${HOME}/.config/gthumb
 blacklist ${HOME}/.config/gummi
 blacklist ${HOME}/.config/guvcview2
@@ -1239,6 +1240,7 @@ blacklist ${RUNUSER}/qutebrowser
 blacklist /etc/ssmtp
 blacklist /tmp/.wine-*
 blacklist /tmp/akonadi-*
+blacklist /tmp/lwjgl_*
 blacklist /var/games/nethack
 blacklist /var/games/slashem
 blacklist /var/games/vulturesclaw
diff --git a/etc/inc/landlock-common.inc b/etc/inc/landlock-common.inc
index e147963a6..7ff6448e2 100644
--- a/etc/inc/landlock-common.inc
+++ b/etc/inc/landlock-common.inc
@@ -16,17 +16,9 @@ landlock.fs.write /tmp
 
 # exec access
 ## misc
+landlock.fs.execute ${PATH}
 landlock.fs.execute /opt
 landlock.fs.execute /run/firejail # appimage and various firejail features
-## bin
-landlock.fs.execute /bin
-landlock.fs.execute /sbin
-landlock.fs.execute /usr/bin
-landlock.fs.execute /usr/sbin
-landlock.fs.execute /usr/games
-landlock.fs.execute /usr/local/bin
-landlock.fs.execute /usr/local/sbin
-landlock.fs.execute /usr/local/games
 ## lib
 landlock.fs.execute /lib
 landlock.fs.execute /lib32
diff --git a/etc/profile-a-l/archiver-common.profile b/etc/profile-a-l/archiver-common.profile
index 487e0c5f8..deaf5df4c 100644
--- a/etc/profile-a-l/archiver-common.profile
+++ b/etc/profile-a-l/archiver-common.profile
@@ -43,7 +43,7 @@ x11 none
 
 private-cache
 private-dev
-private-etc
+private-etc mkinitcpio*
 
 dbus-user none
 dbus-system none
diff --git a/etc/profile-a-l/atool.profile b/etc/profile-a-l/atool.profile
index 672286087..091a2f59f 100644
--- a/etc/profile-a-l/atool.profile
+++ b/etc/profile-a-l/atool.profile
@@ -12,8 +12,6 @@ include allow-perl.inc
 
 noroot
 
-# without login.defs atool complains and uses UID/GID 1000 by default
-private-etc
 private-tmp
 
 # Redirect
diff --git a/etc/profile-a-l/bsdtar.profile b/etc/profile-a-l/bsdtar.profile
index c5c2e33eb..f78d4bdff 100644
--- a/etc/profile-a-l/bsdtar.profile
+++ b/etc/profile-a-l/bsdtar.profile
@@ -6,7 +6,5 @@ include bsdtar.local
 # Persistent global definitions
 include globals.local
 
-private-etc
-
 # Redirect
 include archiver-common.profile
diff --git a/etc/profile-a-l/enchant-2.profile b/etc/profile-a-l/enchant-2.profile
index 32cc0e691..c87dbd948 100644
--- a/etc/profile-a-l/enchant-2.profile
+++ b/etc/profile-a-l/enchant-2.profile
@@ -1,5 +1,6 @@
 # Firejail profile for enchant-2
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include enchant-2.local
 # Persistent global definitions
diff --git a/etc/profile-a-l/gnome-boxes.profile b/etc/profile-a-l/gnome-boxes.profile
index b16ffa142..d026fec88 100644
--- a/etc/profile-a-l/gnome-boxes.profile
+++ b/etc/profile-a-l/gnome-boxes.profile
@@ -6,6 +6,8 @@ include gnome-boxes.local
 # Persistent global definitions
 include globals.local
 
+blacklist /usr/libexec
+
 noblacklist ${HOME}/.cache/gnome-boxes
 noblacklist ${HOME}/.config/gnome-boxes
 noblacklist ${HOME}/.local/share/gnome-boxes
diff --git a/etc/profile-a-l/green-recoder.profile b/etc/profile-a-l/green-recoder.profile
new file mode 100644
index 000000000..77c980daa
--- /dev/null
+++ b/etc/profile-a-l/green-recoder.profile
@@ -0,0 +1,72 @@
+# Firejail profile for green-recorder
+# Description: A simple screen recorder for Linux desktop (supports Wayland & Xorg)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include green-recorder.local
+# Persistent global definitions
+include globals.local
+
+blacklist /usr/libexec
+
+noblacklist ${HOME}/.config/green-recorder
+
+# Allow python 3 (blacklisted by disable-interpreters.inc)
+include allow-python3.inc
+
+# Allow /bin/sh (blacklisted by disable-shell.inc)
+include allow-bin-sh.inc
+
+noblacklist ${VIDEOS}
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-programs.inc
+include disable-shell.inc
+include disable-xdg.inc
+
+mkdir ${HOME}/.config/green-recorder
+whitelist ${HOME}/.config/green-recorder
+whitelist ${DOWNLOADS}
+whitelist ${VIDEOS}
+whitelist /usr/share/ffmpeg
+whitelist /usr/share/green-recorder
+include whitelist-common.inc
+include whitelist-run-common.inc
+include whitelist-runuser-common.inc
+include whitelist-usr-share-common.inc
+include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+net none
+nodvd
+nogroups
+noinput
+nonewprivs
+noprinters
+noroot
+notv
+nou2f
+novideo
+protocol unix
+# allow set_mempolicy, which is required to encode using libx265
+seccomp !set_mempolicy
+seccomp.block-secondary
+tracelog
+
+disable-mnt
+private-bin awk,bash,convert,ffmpeg,green-recorder,grep,mv,pactl,ps,python*,sh,sleep,xdg-open,xdpyinfo,xwininfo
+private-cache
+private-dev
+private-etc @x11
+private-tmp
+
+dbus-user filter
+dbus-user.talk org.freedesktop.Notifications
+dbus-user.talk org.gnome.Shell.*
+?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
+dbus-system none
+
+restrict-namespaces
diff --git a/etc/profile-a-l/iagno.profile b/etc/profile-a-l/iagno.profile
index 47c341333..7129c70bb 100644
--- a/etc/profile-a-l/iagno.profile
+++ b/etc/profile-a-l/iagno.profile
@@ -14,11 +14,10 @@ include disable-programs.inc
 include disable-shell.inc
 
 whitelist ${HOME}/.local/share/glib-2.0/schemas
+whitelist /usr/share/gdm
+whitelist /usr/share/iagno
 include whitelist-common.inc
-
 include whitelist-runuser-common.inc
-whitelist /usr/share/iagno
-whitelist /usr/share/gdm
 include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
diff --git a/etc/profile-a-l/lz4.profile b/etc/profile-a-l/lz4.profile
new file mode 100644
index 000000000..5e4e416f1
--- /dev/null
+++ b/etc/profile-a-l/lz4.profile
@@ -0,0 +1,11 @@
+# Firejail profile for lz4
+# Description: Compress or decompress .lz4 files
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include lz4.local
+# Persistent global definitions
+include globals.local
+
+# Redirect
+include archiver-common.profile
diff --git a/etc/profile-a-l/lz4c.profile b/etc/profile-a-l/lz4c.profile
new file mode 100644
index 000000000..b05a81de1
--- /dev/null
+++ b/etc/profile-a-l/lz4c.profile
@@ -0,0 +1,11 @@
+# Firejail profile for lz4c
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include lz4c.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+# Redirect
+include lz4.profile
diff --git a/etc/profile-a-l/lz4cat.profile b/etc/profile-a-l/lz4cat.profile
new file mode 100644
index 000000000..90e056b1b
--- /dev/null
+++ b/etc/profile-a-l/lz4cat.profile
@@ -0,0 +1,11 @@
+# Firejail profile for lz4cat
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include lz4cat.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+# Redirect
+include lz4.profile
diff --git a/etc/profile-m-z/makepkg.profile b/etc/profile-m-z/makepkg.profile
index b6afbad59..49e84dedb 100644
--- a/etc/profile-m-z/makepkg.profile
+++ b/etc/profile-m-z/makepkg.profile
@@ -35,8 +35,8 @@ include disable-exec.inc
 include disable-programs.inc
 
 caps.drop all
-machine-id
 ipc-namespace
+machine-id
 netfilter
 no3d
 nodvd
diff --git a/etc/profile-m-z/qt5ct.profile b/etc/profile-m-z/qt5ct.profile
new file mode 100644
index 000000000..83d22c2cd
--- /dev/null
+++ b/etc/profile-m-z/qt5ct.profile
@@ -0,0 +1,65 @@
+# Firejail profile for qt5ct
+# Description: Qt5 Configuration Utility
+# This file is overwritten after every install/update
+# Persistent local customizations
+include qt5ct.local
+# Persistent global definitions
+include globals.local
+
+blacklist /usr/libexec
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-proc.inc
+include disable-programs.inc
+include disable-shell.inc
+include disable-xdg.inc
+
+mkdir ${HOME}/.config/qt5ct
+mkdir ${HOME}/.local/share/qt5ct
+whitelist ${HOME}/.config/qt5ct
+whitelist ${HOME}/.local/share/qt5ct
+
+include whitelist-common.inc
+include whitelist-run-common.inc
+include whitelist-runuser-common.inc
+include whitelist-usr-share-common.inc
+include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+machine-id
+net none
+no3d
+nodvd
+nogroups
+noinput
+nonewprivs
+noprinters
+noroot
+nosound
+notv
+nou2f
+novideo
+protocol unix
+seccomp
+seccomp.block-secondary
+tracelog
+
+disable-mnt
+private-bin qt5ct
+private-cache
+private-dev
+private-etc dbus-1,machine-id
+private-tmp
+
+dbus-user none
+dbus-system none
+
+memory-deny-write-execute
+read-only ${HOME}
+read-write ${HOME}/.config/qt5ct
+read-write ${HOME}/.local/share/qt5ct
+restrict-namespaces
diff --git a/etc/profile-m-z/qt6ct.profile b/etc/profile-m-z/qt6ct.profile
new file mode 100644
index 000000000..5667c98a3
--- /dev/null
+++ b/etc/profile-m-z/qt6ct.profile
@@ -0,0 +1,65 @@
+# Firejail profile for qt6ct
+# Description: Qt6 Configuration Utility
+# This file is overwritten after every install/update
+# Persistent local customizations
+include qt6ct.local
+# Persistent global definitions
+include globals.local
+
+blacklist /usr/libexec
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-proc.inc
+include disable-programs.inc
+include disable-shell.inc
+include disable-xdg.inc
+
+mkdir ${HOME}/.config/qt6ct
+mkdir ${HOME}/.local/share/qt6ct
+whitelist ${HOME}/.config/qt6ct
+whitelist ${HOME}/.local/share/qt6ct
+
+include whitelist-common.inc
+include whitelist-run-common.inc
+include whitelist-runuser-common.inc
+include whitelist-usr-share-common.inc
+include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+machine-id
+net none
+no3d
+nodvd
+nogroups
+noinput
+nonewprivs
+noprinters
+noroot
+nosound
+notv
+nou2f
+novideo
+protocol unix
+seccomp
+seccomp.block-secondary
+tracelog
+
+disable-mnt
+private-bin qt6ct
+private-cache
+private-dev
+private-etc dbus-1,machine-id
+private-tmp
+
+dbus-user none
+dbus-system none
+
+memory-deny-write-execute
+read-only ${HOME}
+read-write ${HOME}/.config/qt6ct
+read-write ${HOME}/.local/share/qt6ct
+restrict-namespaces
diff --git a/etc/profile-m-z/ssh.profile b/etc/profile-m-z/ssh.profile
index fde85be64..62efa28db 100644
--- a/etc/profile-m-z/ssh.profile
+++ b/etc/profile-m-z/ssh.profile
@@ -18,6 +18,7 @@ include disable-common.inc
 include disable-exec.inc
 include disable-programs.inc
 
+whitelist ${RUNUSER}/gcr/ssh
 whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh
 whitelist ${RUNUSER}/keyring/ssh
 include whitelist-usr-share-common.inc
diff --git a/etc/profile-m-z/tar.profile b/etc/profile-m-z/tar.profile
index da3b4f782..ca1234db0 100644
--- a/etc/profile-m-z/tar.profile
+++ b/etc/profile-m-z/tar.profile
@@ -17,7 +17,6 @@ ignore include disable-shell.inc
 # all capabilities this is automatically read-only.
 noblacklist /var/lib/pacman
 
-private-etc
 #private-lib libfakeroot,liblzma.so.*,libreadline.so.*
 # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic)
 writable-var
diff --git a/etc/profile-m-z/unlz4.profile b/etc/profile-m-z/unlz4.profile
new file mode 100644
index 000000000..00e7496e4
--- /dev/null
+++ b/etc/profile-m-z/unlz4.profile
@@ -0,0 +1,11 @@
+# Firejail profile for unlz4
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include unlz4.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+# Redirect
+include lz4.profile
diff --git a/etc/profile-m-z/unrar.profile b/etc/profile-m-z/unrar.profile
index 43d5dae5e..ed2acb12d 100644
--- a/etc/profile-m-z/unrar.profile
+++ b/etc/profile-m-z/unrar.profile
@@ -8,7 +8,6 @@ include unrar.local
 include globals.local
 
 private-bin unrar
-private-etc
 private-tmp
 
 # Redirect
diff --git a/etc/profile-m-z/unzip.profile b/etc/profile-m-z/unzip.profile
index 9fefe6ad3..88341a3ad 100644
--- a/etc/profile-m-z/unzip.profile
+++ b/etc/profile-m-z/unzip.profile
@@ -10,7 +10,5 @@ include globals.local
 # GNOME Shell integration (chrome-gnome-shell)
 noblacklist ${HOME}/.local/share/gnome-shell
 
-private-etc
-
 # Redirect
 include archiver-common.profile
diff --git a/etc/profile-m-z/virt-manager.profile b/etc/profile-m-z/virt-manager.profile
index 86fe63ef9..a93d873a8 100644
--- a/etc/profile-m-z/virt-manager.profile
+++ b/etc/profile-m-z/virt-manager.profile
@@ -6,6 +6,8 @@ include virt-manager.local
 # Persistent global definitions
 include globals.local
 
+blacklist /usr/libexec
+
 noblacklist ${HOME}/.cache/virt-manager
 noblacklist ${RUNUSER}/libvirt
 
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index abaec3036..78f41e0a6 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -274,6 +274,7 @@ fix-qdf
 flacsplt
 flameshot
 flashpeak-slimjet
+floorp
 flowblade
 fluffychat
 font-manager
@@ -391,6 +392,7 @@ gpredict
 gradio
 gramps
 gravity-beams-and-evaporating-stars
+green-recorder
 gthumb
 gtk-lbry-viewer
 gtk-pipe-viewer
@@ -522,6 +524,9 @@ lximage-qt
 lxmusic
 lynx
 lyx
+#lz4 # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
+#lz4c # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
+#lz4cat # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 macrofusion
 magicor
 man
@@ -724,6 +729,8 @@ qpdf
 qpdfview
 qq
 qt-faststart
+qt5ct
+qt6ct
 qtox
 quadrapassel
 quassel
@@ -903,6 +910,7 @@ uget-gtk
 unbound
 unf
 unknown-horizons
+#unlz4 # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 #unzstd # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 url-eater
 utox