7 files changed, 104 insertions, 41 deletions

diff --git a/README.md b/README.md
index c6b1b0933..67beef83b 100644
--- a/README.md
+++ b/README.md
@@ -66,12 +66,69 @@ Use this issue to request new profiles: https://github.com/netblue30/firejail/is
 `````
 
 `````
+## Desktop integration
+
+All --fix functionality is done by default in firecfg, --fix option was removed. Clicking on a program
+in desktop manager menu should start the program automatically in a sandbox, if a profile
+is available in /etc/firejail. We cover about 270 different applications in this moment on all major desktop managers.
+
+Thunar (XFCE) and PCManFM (LXDE) file managers symlinks are installed in /usr/local/bin by firecfg. 
+File managers are usually started by default at login time, and will be sandboxed.
+Clicking on a file in the file manager will start the corresponding program in the same sandbox as the file manager.
+For example, clicking on a video file will start a sandboxed VLC running the video.
+We support in this moment XFCE and LXDE, MATE will come next, followed by KDE and Gnome.
+
 ## AppImage
 
 Added AppImage type 2 support, and support for passing command line arguments to appimages.
 `````
 
 `````
+## X11 sandboxing support
+In this release we add support for Xvfb (X virtual framebuffer), an in-memory X display server.
+Xvfb allows the user to run graphical applications without a display (e.g., browser tests on a CI server)
+while also having the ability to take screenshots.
+
+
+       --x11=xvfb
+              Start  Xvfb  X11  server  and attach the sandbox to this server.
+              Xvfb, short for X virtual framebuffer,  performs  all  graphical
+              operations  in memory without showing any screen output. Xvfb is
+              mainly used for remote access and software testing  on  headless
+              servers.
+
+              On Debian platforms Xvfb is installed with the command sudo apt-
+              get install xvfb.  This feature is not available when running as
+              root.
+
+              Example: remote VNC access
+
+              On  the  server we start a sandbox using Xvfb and openbox window
+              manager. The default size of Xvfb screen is 800x600 - it can  be
+              changed  in  /etc/firejail/firejail.config  (xvfb-screen).  Some
+              sort of networking (--net) is required in order to  isolate  the
+              abstract sockets used by other X servers.
+
+              $ firejail --net=none --x11=xvfb openbox
+
+              *** Attaching to Xvfb display 792 ***
+
+              Reading profile /etc/firejail/openbox.profile
+              Reading profile /etc/firejail/disable-common.inc
+              Reading profile /etc/firejail/disable-common.local
+              Parent pid 5400, child pid 5401
+
+              On  the  server  we also start a VNC server and attach it to the
+              display handled by our Xvfb server (792).
+
+              $ x11vnc -display :792
+
+              On the client machine we start a VNC viewer and use it  to  con‐
+              nect to our server:
+
+              $ vncviewer
+
+
 ## New command line options
 `````
       --private-opt=file,directory
@@ -145,43 +202,6 @@ Added AppImage type 2 support, and support for passing command line arguments to
 
               $ firejail --git-uninstall
 
-       --x11=xvfb
-              Start  Xvfb  X11  server  and attach the sandbox to this server.
-              Xvfb, short for X virtual framebuffer,  performs  all  graphical
-              operations  in memory without showing any screen output. Xvfb is
-              mainly used for remote access and software testing  on  headless
-              servers.
-
-              On Debian platforms Xvfb is installed with the command sudo apt-
-              get install xvfb.  This feature is not available when running as
-              root.
-
-              Example: remote VNC access
-
-              On  the  server we start a sandbox using Xvfb and openbox window
-              manager. The default size of Xvfb screen is 800x600 - it can  be
-              changed  in  /etc/firejail/firejail.config  (xvfb-screen).  Some
-              sort of networking (--net) is required in order to  isolate  the
-              abstract sockets used by other X servers.
-
-              $ firejail --net=none --x11=xvfb openbox
-
-              *** Attaching to Xvfb display 792 ***
-
-              Reading profile /etc/firejail/openbox.profile
-              Reading profile /etc/firejail/disable-common.inc
-              Reading profile /etc/firejail/disable-common.local
-              Parent pid 5400, child pid 5401
-
-              On  the  server  we also start a VNC server and attach it to the
-              display handled by our Xvfb server (792).
-
-              $ x11vnc -display :792
-
-              On the client machine we start a VNC viewer and use it  to  con‐
-              nect to our server:
-
-              $ vncviewer
 
        --nowhitelist=dirname_or_filename
               Disable whitelist for this directory or file.
@@ -196,5 +216,5 @@ simple-scan, skanlite, ssh-agent, tracker, transmission-cli, transmission-show,
 xed, pluma, Cryptocat, Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5,
 PDFSam, Pithos, Xonotic, wireshark, keepassx2, QupZilla, FossaMail, Uzbl browser, xmms, iridium browser,
 Kino, Thunar, Geeqie, Engrampa, Scribus, mousepad, gpicview, keepassxc, cvlc, MediathekView, baloo_file,
-Nylas, dino, BibleTime, viewnior, Kodi, viking, youtube-dl, meld, Arduino, akregator, kcalc, ktorrent,
-Orage Globaltime, Orage Clendar, xfce4-notes, xfce4-dict, Ristretto
+Nylas, dino, BibleTime, viewnior, Kodi, viking, youtube-dl, meld, Arduino, Akregator, KCalc, KTorrent,
+Orage Globaltime, Orage Clendar, xfce4-notes, xfce4-dict, Ristretto, PCManFM
diff --git a/RELNOTES b/RELNOTES
index f71859cf4..a4615b240 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -37,7 +37,9 @@ firejail (0.9.46-rc1) baseline; urgency=low
   * new profiles: Uzbl browser, iridium browser, Thunar, Geeqie, Engrampa,
   * new profiles: Scribus, mousepad, gpicview, keepassxc, cvlc, MediathekView,
   * new profiles: baloo_file, Nylas, dino, BibleTime, viewnior, Kodi, viking,
-  * new profiles: youtube-dl, meld, Arduino
+  * new profiles: youtube-dl, meld, Arduino, Akregator, KCalc, KTorrent,
+  * new profiles: Orage Globaltime, Orage Clendar, xfce4-notes, xfce4-dict,
+  * new profiles: Ristretto, PCManFM
   * bugfixes
  -- netblue30 <netblue30@yahoo.com>  Fri, 7 Apr 2017 08:00:00 -0500
 
diff --git a/etc/Thunar.profile b/etc/Thunar.profile
index 5a27177e0..f1b75b1f3 100644
--- a/etc/Thunar.profile
+++ b/etc/Thunar.profile
@@ -7,7 +7,7 @@ noblacklist ~/.config/Thunar
 noblacklist ~/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml
 
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
+#include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
@@ -21,3 +21,11 @@ protocol unix
 seccomp
 shell none
 tracelog
+
+#
+# depending on you usage, you can enable some of the commands below: 
+#
+# private-bin program
+# private-etc none
+# private-dev
+# private-tmp
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 9b84f5e8a..18b644987 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -107,6 +107,7 @@ blacklist ${HOME}/.config/opera
 blacklist ${HOME}/.config/opera-beta
 blacklist ${HOME}/.config/orage
 blacklist ${HOME}/.config/org.kde.gwenviewrc
+blacklist ${HOME}/.config/pcmanfm
 blacklist ${HOME}/.config/pix
 blacklist ${HOME}/.config/pluma
 blacklist ${HOME}/.config/psi+
diff --git a/etc/pcmanfm.profile b/etc/pcmanfm.profile
new file mode 100644
index 000000000..e51c5e3b8
--- /dev/null
+++ b/etc/pcmanfm.profile
@@ -0,0 +1,30 @@
+# This file is overwritten during software install.
+# Persistent customizations should go in a .local file.
+include /etc/firejail/pcmanfm.local
+
+noblacklist ~/.config/pcmanfm
+noblacklist ~/.config/libfm
+include /etc/firejail/disable-common.inc
+#include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+
+caps.drop all
+netfilter
+nogroups
+nonewprivs
+noroot
+nosound
+protocol unix
+seccomp
+shell none
+tracelog
+
+#
+# depending on you usage, you can enable some of the commands below: 
+#
+# private-bin program
+# private-etc none
+# private-dev
+# private-tmp
+
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index 355faf44f..2f0da51ce 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -276,3 +276,4 @@
 /etc/firejail/ristretto.profile
 /etc/firejail/xfce4-dict.profile
 /etc/firejail/xfce4-notes.profile
+/etc/firejail/pcmanfm.profile
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index c44d83e7b..93744f671 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -148,6 +148,7 @@ opera-beta
 orage
 palemoon
 parole
+pcmanfm
 pdfsam
 pdftotext
 pidgin