17 files changed, 157 insertions, 55 deletions

diff --git a/Makefile.in b/Makefile.in
index 561dea897..e60fde529 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -145,6 +145,7 @@ realinstall:
         install -c -m 0644 .etc/hedgewars.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 .etc/vivaldi.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 .etc/vivaldi-beta.profile $(DESTDIR)/$(sysconfdir)/firejail/.
+        install -c -m 0644 .etc/atril.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
         rm -fr .etc
         # man pages
diff --git a/README b/README
index 53ab416e7..466f526cd 100644
--- a/README
+++ b/README
@@ -19,7 +19,7 @@ Firejail Authors:
 
 netblue30 (netblue30@yahoo.com)
 Fred-Barclay (https://github.com/Fred-Barclay)
-        - added Vivaldi profiles
+        - added Vivaldi, Atril profiles
 yumkam (https://github.com/yumkam)
         - add compile-time option to restrict --net= to root only
         - man page fixes
diff --git a/RELNOTES b/RELNOTES
index 475f58c16..7cec3d893 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -7,7 +7,7 @@ firejail (0.9.39) baseline; urgency=low
   * --version also prints compile options
   * added compile-time option to restrict --net= to root only
   * build rpm packages using "make rpms"
-  * new profiles: lxterminal, Epiphany, cherrytree, Polari, Vivaldi
+  * new profiles: lxterminal, Epiphany, cherrytree, Polari, Vivaldi, Atril
   * bugfixes
  -- netblue30 <netblue30@yahoo.com>  Wed, 3 Mar 2016 08:00:00 -0500
 
diff --git a/etc/chromium.profile b/etc/chromium.profile
index 78cee3920..b58931b8d 100644
--- a/etc/chromium.profile
+++ b/etc/chromium.profile
@@ -1,5 +1,7 @@
 # Chromium browser profile
-noblacklist ${HOME}/.config/chromium
+noblacklist ~/.config/chromium
+noblacklist ~/.cache/chromium
+noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
@@ -10,6 +12,7 @@ include /etc/firejail/disable-terminals.inc
 #
 
 netfilter
+
 whitelist ${DOWNLOADS}
 mkdir ~/.config
 mkdir ~/.config/chromium
@@ -19,4 +22,12 @@ mkdir ~/.cache/chromium
 whitelist ~/.cache/chromium
 mkdir ~/.pki
 whitelist ~/.pki
+
+# lastpass, keepassx
+whitelist ~/.keepassx
+whitelist ~/.config/keepassx
+whitelist ~/keepassx.kdbx
+whitelist ~/.lastpass
+whitelist ~/.config/lastpass
+
 include /etc/firejail/whitelist-common.inc
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index d97740860..88ce42976 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -1,3 +1,6 @@
+# various programs
+blacklist  ${HOME}/.config/vlc
+
 # History files in $HOME
 blacklist-nolog ${HOME}/.history
 blacklist-nolog ${HOME}/.*_history
@@ -5,17 +8,20 @@ blacklist-nolog ${HOME}/.*_history
 # HTTP / FTP / Mail
 blacklist-nolog ${HOME}/.adobe
 blacklist-nolog ${HOME}/.macromedia
-blacklist ${HOME}/.mozilla
 blacklist ${HOME}/.icedove
 blacklist ${HOME}/.thunderbird
 blacklist ${HOME}/.sylpheed-2.0
 blacklist ${HOME}/.config/midori
-blacklist ${HOME}/.config/opera
-blacklist ${HOME}/.config/opera-beta
+
+blacklist ${HOME}/.mozilla
 blacklist ${HOME}/.config/chromium
 blacklist ${HOME}/.config/google-chrome
 blacklist ${HOME}/.config/google-chrome-beta
 blacklist ${HOME}/.config/google-chrome-unstable
+blacklist ${HOME}/.config/opera
+blacklist ${HOME}/.config/opera-beta
+blacklist ~/.config/vivaldi
+
 blacklist ${HOME}/.filezilla
 blacklist ${HOME}/.config/filezilla
 blacklist ${HOME}/.local/share/systemd
@@ -125,3 +131,12 @@ read-only ${HOME}/.xscreensaver
 # The user ~/bin directory can override commands such as ls
 read-only ${HOME}/bin
 
+# cache
+blacklist ~/.cache/mozilla
+blacklist ~/.cache/chromium
+blacklist ~/.cache/google-chrome
+blacklist ~/.cache/google-chrome-beta
+blacklist ~/.cache/google-chrome-unstable
+blacklist ~/.cache/opera
+blacklist ~/.cache/opera-beta
+blacklist ~/.cache/vivaldi
diff --git a/etc/firefox.profile b/etc/firefox.profile
index 0b082f216..b06dfa6da 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -1,16 +1,21 @@
 # Firejail profile for Mozilla Firefox (Iceweasel in Debian)
-noblacklist ${HOME}/.mozilla
+
+noblacklist ~/.mozilla
+noblacklist ~/.cache/mozilla
+noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
+
 caps.drop all
 seccomp
 protocol unix,inet,inet6,netlink
 netfilter
 tracelog
 noroot
+
 whitelist ${DOWNLOADS}
 mkdir ~/.mozilla
 whitelist ~/.mozilla
@@ -20,7 +25,6 @@ mkdir ~/.cache/mozilla/firefox
 whitelist ~/.cache/mozilla/firefox
 whitelist ~/dwhelper
 whitelist ~/.zotero
-whitelist ~/.lastpass
 whitelist ~/.vimperatorrc
 whitelist ~/.vimperator
 whitelist ~/.pentadactylrc
@@ -29,6 +33,21 @@ whitelist ~/.keysnail.js
 whitelist ~/.config/gnome-mplayer
 whitelist ~/.cache/gnome-mplayer/plugin
 whitelist ~/.pki
+
+# lastpass, keepassx
+whitelist ~/.keepassx
+whitelist ~/.config/keepassx
+whitelist ~/keepassx.kdbx
+whitelist ~/.lastpass
+whitelist ~/.config/lastpass
+
+
+#silverlight
+whitelist ~/.wine-pipelight 
+whitelist ~/.wine-pipelight64 
+whitelist ~/.config/pipelight-widevine 
+whitelist ~/.config/pipelight-silverlight5.1
+
 include /etc/firejail/whitelist-common.inc
 
 # experimental features
diff --git a/etc/google-chrome-beta.profile b/etc/google-chrome-beta.profile
index d57728139..3396585eb 100644
--- a/etc/google-chrome-beta.profile
+++ b/etc/google-chrome-beta.profile
@@ -1,5 +1,7 @@
 # Google Chrome beta browser profile
-noblacklist ${HOME}/.config/google-chrome-beta
+noblacklist ~/.config/google-chrome-beta
+noblacklist ~/.cache/google-chrome-beta
+noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
@@ -10,6 +12,7 @@ include /etc/firejail/disable-terminals.inc
 #
 
 netfilter
+
 whitelist ${DOWNLOADS}
 mkdir ~/.config
 mkdir ~/.config/google-chrome-beta
@@ -21,3 +24,9 @@ mkdir ~/.pki
 whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
 
+# lastpass, keepassx
+whitelist ~/.keepassx
+whitelist ~/.config/keepassx
+whitelist ~/keepassx.kdbx
+whitelist ~/.lastpass
+whitelist ~/.config/lastpass
diff --git a/etc/google-chrome-unstable.profile b/etc/google-chrome-unstable.profile
index 36a1fb456..ed4332862 100644
--- a/etc/google-chrome-unstable.profile
+++ b/etc/google-chrome-unstable.profile
@@ -1,5 +1,7 @@
 # Google Chrome unstable browser profile
-noblacklist ${HOME}/.config/google-chrome-unstable
+noblacklist ~/.config/google-chrome-unstable
+noblacklist ~/.cache/google-chrome-unstable
+noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
@@ -10,6 +12,7 @@ include /etc/firejail/disable-terminals.inc
 #
 
 netfilter
+
 whitelist ${DOWNLOADS}
 mkdir ~/.config
 mkdir ~/.config/google-chrome-unstable
@@ -21,3 +24,9 @@ mkdir ~/.pki
 whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
 
+# lastpass, keepassx
+whitelist ~/.keepassx
+whitelist ~/.config/keepassx
+whitelist ~/keepassx.kdbx
+whitelist ~/.lastpass
+whitelist ~/.config/lastpass
diff --git a/etc/google-chrome.profile b/etc/google-chrome.profile
index 3b73738a6..985af38eb 100644
--- a/etc/google-chrome.profile
+++ b/etc/google-chrome.profile
@@ -1,5 +1,7 @@
 # Google Chrome browser profile
-noblacklist ${HOME}/.config/google-chrome
+noblacklist ~/.config/google-chrome
+noblacklist ~/.cache/google-chrome
+noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
@@ -10,6 +12,7 @@ include /etc/firejail/disable-terminals.inc
 #
 
 netfilter
+
 whitelist ${DOWNLOADS}
 mkdir ~/.config
 mkdir ~/.config/google-chrome
@@ -20,3 +23,11 @@ whitelist ~/.cache/google-chrome
 mkdir ~/.pki
 whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
+
+# lastpass, keepassx
+whitelist ~/.keepassx
+whitelist ~/.config/keepassx
+whitelist ~/keepassx.kdbx
+whitelist ~/.lastpass
+whitelist ~/.config/lastpass
+
diff --git a/etc/opera-beta.profile b/etc/opera-beta.profile
index a65c7cef1..91eb10787 100644
--- a/etc/opera-beta.profile
+++ b/etc/opera-beta.profile
@@ -1,15 +1,19 @@
 # Opera-beta browser profile
-noblacklist ${HOME}/.config/opera-beta
+noblacklist ~/.config/opera-beta
+noblacklist ~/.cache/opera-beta
+noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
+
 netfilter
+
+whitelist ${DOWNLOADS}
 mkdir ~/.config
 mkdir ~/.config/opera-beta
 whitelist ~/.config/opera-beta
-whitelist ${DOWNLOADS}
 mkdir ~/.cache
 mkdir ~/.cache/opera-beta
 whitelist ~/.cache/opera-beta
@@ -17,4 +21,10 @@ mkdir ~/.pki
 whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
 
+# lastpass, keepassx
+whitelist ~/.keepassx
+whitelist ~/.config/keepassx
+whitelist ~/keepassx.kdbx
+whitelist ~/.lastpass
+whitelist ~/.config/lastpass
 
diff --git a/etc/opera.profile b/etc/opera.profile
index 032b3ece7..08bbd5a06 100644
--- a/etc/opera.profile
+++ b/etc/opera.profile
@@ -1,15 +1,19 @@
 # Opera browser profile
-noblacklist ${HOME}/.config/opera
+noblacklist ~/.config/opera
+noblacklist ~/.cache/opera
+noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
+
 netfilter
+
+whitelist ${DOWNLOADS}
 mkdir ~/.config
 mkdir ~/.config/opera
 whitelist ~/.config/opera
-whitelist ${DOWNLOADS}
 mkdir ~/.cache
 mkdir ~/.cache/opera
 whitelist ~/.cache/opera
@@ -17,4 +21,10 @@ mkdir ~/.pki
 whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
 
+# lastpass, keepassx
+whitelist ~/.keepassx
+whitelist ~/.config/keepassx
+whitelist ~/keepassx.kdbx
+whitelist ~/.lastpass
+whitelist ~/.config/lastpass
 
diff --git a/etc/seamonkey-bin.profile b/etc/seamonkey-bin.profile
index 74b9b591b..fff8c1258 100644
--- a/etc/seamonkey-bin.profile
+++ b/etc/seamonkey-bin.profile
@@ -1,38 +1,3 @@
-# Firejail profile for Seamoneky based off Mozilla Firefox
-noblacklist ${HOME}/.mozilla
-include /etc/firejail/disable-mgmt.inc
-include /etc/firejail/disable-secret.inc
-include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-devel.inc
-include /etc/firejail/disable-terminals.inc
-caps.drop all
-seccomp
-protocol unix,inet,inet6,netlink
-netfilter
-tracelog
-noroot
-whitelist ${DOWNLOADS}
-mkdir ~/.mozilla
-mkdir ~/.mozilla/seamonkey
-whitelist ~/.mozilla/seamonkey
-mkdir ~/.cache
-mkdir ~/.cache/mozilla
-mkdir ~/.cache/mozilla/seamonkey
-whitelist ~/.cache/mozilla/seamonkey
-whitelist ~/dwhelper
-whitelist ~/.zotero
-whitelist ~/.lastpass
-whitelist ~/.vimperatorrc
-whitelist ~/.vimperator
-whitelist ~/.pentadactylrc
-whitelist ~/.pentadactyl
-whitelist ~/.keysnail.js
-whitelist ~/.config/gnome-mplayer
-whitelist ~/.cache/gnome-mplayer/plugin
-mkdir ~/.pki
-whitelist ~/.pki
-include /etc/firejail/whitelist-common.inc
-
-# experimental features
-#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse
+# Firejail profile for Seamonkey based off Mozilla Firefox
+include /etc/firejail/seamonkey.profile
 
diff --git a/etc/seamonkey.profile b/etc/seamonkey.profile
index d585c719b..b896af97a 100644
--- a/etc/seamonkey.profile
+++ b/etc/seamonkey.profile
@@ -1,18 +1,27 @@
 # Firejail profile for Seamoneky based off Mozilla Firefox
-noblacklist ${HOME}/.mozilla
+noblacklist ~/.mozilla
+noblacklist ~/.cache/mozilla
+noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-terminals.inc
+
 caps.drop all
 seccomp
 protocol unix,inet,inet6,netlink
 netfilter
 tracelog
 noroot
+
 whitelist ${DOWNLOADS}
+mkdir ~/.mozilla
+mkdir ~/.mozilla/seamonkey
 whitelist ~/.mozilla/seamonkey
+mkdir ~/.cache
+mkdir ~/.cache/mozilla
+mkdir ~/.cache/mozilla/seamonkey
 whitelist ~/.cache/mozilla/seamonkey
 whitelist ~/dwhelper
 whitelist ~/.zotero
@@ -27,6 +36,21 @@ whitelist ~/.cache/gnome-mplayer/plugin
 whitelist ~/.pki
 include /etc/firejail/whitelist-common.inc
 
+# lastpass, keepassx
+whitelist ~/.keepassx
+whitelist ~/.config/keepassx
+whitelist ~/keepassx.kdbx
+whitelist ~/.lastpass
+whitelist ~/.config/lastpass
+
+#silverlight
+whitelist ~/.wine-pipelight 
+whitelist ~/.wine-pipelight64 
+whitelist ~/.config/pipelight-widevine 
+whitelist ~/.config/pipelight-silverlight5.1
+
+
+
 # experimental features
 #private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse
 
diff --git a/etc/vivaldi.profile b/etc/vivaldi.profile
index b8263629a..408a1898c 100644
--- a/etc/vivaldi.profile
+++ b/etc/vivaldi.profile
@@ -1,14 +1,29 @@
 # Vivaldi browser profile
-noblacklist ${HOME}/.config/vivaldi
+noblacklist ~/.config/vivaldi
+noblacklist ~/.cache/vivaldi
+noblacklist ~/keepassx.kdbx
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-terminals.inc
 
 netfilter
-whitelist ~/.config/vivaldi
+tracelog
+
 whitelist ${DOWNLOADS}
+mkdir ~/.config
+mkdir ~/.config/vivaldi
+whitelist ~/.config/vivaldi
+mkdir ~/.cache
+mkdir ~/.cache/vivaldi
 whitelist ~/.cache/vivaldi
 include /etc/firejail/whitelist-common.inc
 
+# lastpass, keepassx
+whitelist ~/.keepassx
+whitelist ~/.config/keepassx
+whitelist ~/keepassx.kdbx
+whitelist ~/.lastpass
+whitelist ~/.config/lastpass
 
diff --git a/etc/vlc.profile b/etc/vlc.profile
index 028de0ad1..dd0a70353 100644
--- a/etc/vlc.profile
+++ b/etc/vlc.profile
@@ -1,4 +1,5 @@
 # VLC profile
+noblacklist ${HOME}/.config/vlc
 include /etc/firejail/disable-mgmt.inc
 include /etc/firejail/disable-secret.inc
 include /etc/firejail/disable-common.inc
diff --git a/etc/whitelist-common.inc b/etc/whitelist-common.inc
index 54e549e1a..9d5ef3d96 100644
--- a/etc/whitelist-common.inc
+++ b/etc/whitelist-common.inc
@@ -5,6 +5,7 @@ whitelist ~/.icons
 whitelist ~/.config/user-dirs.dirs
 read-only ~/.config/user-dirs.dirs
 whitelist ~/.asoundrc
+whitelist ~/.config/Trolltech.conf
 
 # fonts
 whitelist ~/.fonts
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index 7c5cba882..5240d87a6 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -71,3 +71,4 @@
 /etc/firejail/hedgewars.profile
 /etc/firejail/vivaldi.profile
 /etc/firejail/vivaldi-beta.profile
+/etc/firejail/atril.profile