aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--CONTRIBUTING.md21
-rw-r--r--README2
-rw-r--r--README.md12
-rw-r--r--RELNOTES5
-rw-r--r--etc/abrowser.profile37
-rw-r--r--etc/akregator.profile1
-rw-r--r--etc/audacity.profile2
-rw-r--r--etc/bnox.profile23
-rw-r--r--etc/brave.profile27
-rw-r--r--etc/chromium-common.profile32
-rw-r--r--etc/chromium.profile24
-rw-r--r--etc/clementine.profile1
-rw-r--r--etc/cliqz.profile79
-rw-r--r--etc/cyberfox.profile60
-rw-r--r--etc/disable-common.inc25
-rw-r--r--etc/disable-programs.inc29
-rw-r--r--etc/dnox.profile23
-rw-r--r--etc/dolphin.profile3
-rw-r--r--etc/dragon.profile1
-rw-r--r--etc/firefox-common-addons.inc55
-rw-r--r--etc/firefox-common.profile44
-rw-r--r--etc/firefox.profile83
-rw-r--r--etc/firejail-default22
-rw-r--r--etc/flashpeak-slimjet.profile26
-rw-r--r--etc/google-chrome-beta.profile23
-rw-r--r--etc/google-chrome-unstable.profile23
-rw-r--r--etc/google-chrome.profile25
-rw-r--r--etc/gwenview.profile2
-rw-r--r--etc/hexchat.profile1
-rw-r--r--etc/icecat.profile40
-rw-r--r--etc/iceweasel.profile2
-rw-r--r--etc/inox.profile23
-rw-r--r--etc/iridium.profile24
-rw-r--r--etc/kaffeine.profile37
-rw-r--r--etc/kdenlive.profile5
-rw-r--r--etc/kget.profile2
-rw-r--r--etc/kmail.profile4
-rw-r--r--etc/krita.profile1
-rw-r--r--etc/krunner.profile8
-rw-r--r--etc/kwin_x11.profile3
-rw-r--r--etc/libreoffice.profile2
-rw-r--r--etc/okular.profile3
-rw-r--r--etc/opera-beta.profile17
-rw-r--r--etc/opera.profile16
-rw-r--r--etc/palemoon.profile50
-rwxr-xr-xetc/pdfchain.profile39
-rw-r--r--etc/qbittorrent.profile1
-rw-r--r--etc/qtox.profile2
-rw-r--r--etc/remmina.profile2
-rw-r--r--etc/scribus.profile1
-rw-r--r--etc/soundconverter.profile2
-rw-r--r--etc/spotify.profile2
-rw-r--r--etc/thunderbird.profile8
-rw-r--r--etc/tilp.profile34
-rw-r--r--etc/torbrowser-launcher.profile2
-rw-r--r--etc/unbound.profile4
-rw-r--r--etc/vivaldi.profile22
-rw-r--r--etc/waterfox.profile71
-rw-r--r--etc/whitelist-common.inc6
-rw-r--r--etc/yandex-browser.profile24
-rw-r--r--src/firecfg/firecfg.config3
-rw-r--r--src/firejail/appimage.c2
-rw-r--r--src/firejail/firejail.h2
-rw-r--r--src/firejail/fs.c5
-rw-r--r--src/firejail/main.c27
-rw-r--r--src/firejail/profile.c12
-rw-r--r--src/firejail/util.c46
67 files changed, 547 insertions, 718 deletions
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 000000000..0951d753e
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,21 @@
1Welcome to firejail, and thank you for your interest in contributing!
2
3# Opening an issue:
4We welcome issues, whether to ask a question, provide information, request a new profile or
5feature, or to report a suspected bug or problem.
6
7If you want to request a program profile that we don't already have, please add a comment in
8our dedicated issue, #1139.
9
10When submitting a bug report, please provide the following information so that
11we can handle the report more easily:
12 - firejail version. If you're not sure, open a terminal and type `firejail --version`.
13 - Linux distribution (so that we can try to reproduce it, if necessary).
14 - If you know that the problem did not exist in an earlier version of firejail, please mention it.
15 - If you are reporting that a program does not work with firejail, please also run firejail with
16 the `--noprofile` argument.
17 For example, if `firejail firefox` does not work, please also run `firejail --noprofile firefox` and
18 let us know if it runs correctly or not.
19
20We take security bugs very seriously. If you believe you have found one, please report it by
21emailing us at netblue30@yahoo.com
diff --git a/README b/README
index ac70b1631..cf9ef47e4 100644
--- a/README
+++ b/README
@@ -597,6 +597,8 @@ Vasya Novikov (https://github.com/vn971)
597 - seccomp syscall list update for glibc 2.26-10 597 - seccomp syscall list update for glibc 2.26-10
598Veeti Paananen (https://github.com/veeti) 598Veeti Paananen (https://github.com/veeti)
599 - fixed Spotify profile 599 - fixed Spotify profile
600Vincent43 (https://github.com/Vincent43)
601 - apparmor enhancements
600vismir2 (https://github.com/vismir2) 602vismir2 (https://github.com/vismir2)
601 - feh, ranger, 7z, keepass, keepassx and zathura profiles 603 - feh, ranger, 7z, keepass, keepassx and zathura profiles
602 - claws-mail, mutt, git, emacs, vim profiles 604 - claws-mail, mutt, git, emacs, vim profiles
diff --git a/README.md b/README.md
index 7bd691ba8..eebe91d10 100644
--- a/README.md
+++ b/README.md
@@ -98,7 +98,17 @@ Use this issue to request new profiles: [#1139](https://github.com/netblue30/fir
98````` 98`````
99# Current development version: 0.9.53 99# Current development version: 0.9.53
100 100
101## Browser profile unification
102
103All Chromium and Firefox browsers have been unified to instead extend
104chromium-common.profile and firefox-common.profile respectively.
105This allows for reduced maintenance and ease of adding new browsers.
106NOTE: All users of Firefox-based browsers who use addons and plugins
107that read/write from ${HOME} will need to uncomment the includes for
108firefox-common-addons.inc in firefox-common.profile.
109
101## New profiles 110## New profiles
102 111
103Basilisk browser, Tor Browser language packs, PlayOnLinux, sylpheed, discord-canary, 112Basilisk browser, Tor Browser language packs, PlayOnLinux, sylpheed, discord-canary,
104pycharm-community, pycharm-professional, Pitivi, OnionShare, Fritzing 113pycharm-community, pycharm-professional, Pitivi, OnionShare, Fritzing, Kaffeine, pdfchain,
114tilp
diff --git a/RELNOTES b/RELNOTES
index fe871134b..b0a873e38 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -5,8 +5,9 @@ firejail (0.9.53) baseline; urgency=low
5 * whitelist support for overlay and chroot sandboxes 5 * whitelist support for overlay and chroot sandboxes
6 * private-dev support for overlay and chroot sandboxes 6 * private-dev support for overlay and chroot sandboxes
7 * private-tmp support for overlay and chroot sandboxes 7 * private-tmp support for overlay and chroot sandboxes
8 * new profiles: basilisk, Tor Browser language packs, PlayOnLinux, sylpheed, discord-canary 8 * new profiles: basilisk, Tor Browser language packs, PlayOnLinux, sylpheed,
9 * new profiles: pycharm-community, pycharm-professional 9 * new profiles: discord-canary, pycharm-community, pycharm-professional, kaffeine,
10 * new profiles: pdfchain, tilp
10 -- netblue30 <netblue30@yahoo.com> Tue, 12 Dec 2017 08:00:00 -0500 11 -- netblue30 <netblue30@yahoo.com> Tue, 12 Dec 2017 08:00:00 -0500
11 12
12firejail (0.9.52) baseline; urgency=low 13firejail (0.9.52) baseline; urgency=low
diff --git a/etc/abrowser.profile b/etc/abrowser.profile
index 5c964bad1..d757d6f49 100644
--- a/etc/abrowser.profile
+++ b/etc/abrowser.profile
@@ -7,42 +7,15 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/mozilla 8noblacklist ${HOME}/.cache/mozilla
9noblacklist ${HOME}/.mozilla 9noblacklist ${HOME}/.mozilla
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-programs.inc
15 10
16mkdir ${HOME}/.cache/mozilla/abrowser 11mkdir ${HOME}/.cache/mozilla/abrowser
17mkdir ${HOME}/.mozilla 12mkdir ${HOME}/.mozilla
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.cache/gnome-mplayer/plugin
20whitelist ${HOME}/.cache/mozilla/abrowser 13whitelist ${HOME}/.cache/mozilla/abrowser
21whitelist ${HOME}/.config/gnome-mplayer
22whitelist ${HOME}/.config/pipelight-silverlight5.1
23whitelist ${HOME}/.config/pipelight-widevine
24whitelist ${HOME}/.keysnail.js
25whitelist ${HOME}/.lastpass
26whitelist ${HOME}/.mozilla 14whitelist ${HOME}/.mozilla
27whitelist ${HOME}/.pentadactyl
28whitelist ${HOME}/.pentadactylrc
29whitelist ${HOME}/.pki
30whitelist ${HOME}/.vimperator
31whitelist ${HOME}/.vimperatorrc
32whitelist ${HOME}/.wine-pipelight
33whitelist ${HOME}/.wine-pipelight64
34whitelist ${HOME}/.zotero
35whitelist ${HOME}/dwhelper
36include /etc/firejail/whitelist-common.inc
37 15
38caps.drop all 16# private-etc must first be enabled in firefox-common.profile
39netfilter 17#private-etc abrowser
40nodvd 18
41nonewprivs
42noroot
43notv
44protocol unix,inet,inet6,netlink
45seccomp
46tracelog
47 19
48# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse 20# Redirect
21include /etc/firejail/firefox-common.profile
diff --git a/etc/akregator.profile b/etc/akregator.profile
index f2e5ea341..2c49ef9f0 100644
--- a/etc/akregator.profile
+++ b/etc/akregator.profile
@@ -17,6 +17,7 @@ mkfile ${HOME}/.config/akregatorrc
17mkdir ${HOME}/.local/share/akregator 17mkdir ${HOME}/.local/share/akregator
18whitelist ${HOME}/.config/akregatorrc 18whitelist ${HOME}/.config/akregatorrc
19whitelist ${HOME}/.local/share/akregator 19whitelist ${HOME}/.local/share/akregator
20whitelist ${HOME}/.local/share/kssl
20include /etc/firejail/whitelist-common.inc 21include /etc/firejail/whitelist-common.inc
21 22
22include /etc/firejail/whitelist-var-common.inc 23include /etc/firejail/whitelist-var-common.inc
diff --git a/etc/audacity.profile b/etc/audacity.profile
index e173fa65a..ea1d38132 100644
--- a/etc/audacity.profile
+++ b/etc/audacity.profile
@@ -17,7 +17,7 @@ include /etc/firejail/disable-programs.inc
17include /etc/firejail/whitelist-var-common.inc 17include /etc/firejail/whitelist-var-common.inc
18 18
19caps.drop all 19caps.drop all
20net none 20#net none
21no3d 21no3d
22nodvd 22nodvd
23nogroups 23nogroups
diff --git a/etc/bnox.profile b/etc/bnox.profile
index 4270755c8..3207a2923 100644
--- a/etc/bnox.profile
+++ b/etc/bnox.profile
@@ -7,30 +7,11 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/bnox 8noblacklist ${HOME}/.cache/bnox
9noblacklist ${HOME}/.config/bnox 9noblacklist ${HOME}/.config/bnox
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-programs.inc
14 10
15mkdir ${HOME}/.cache/bnox 11mkdir ${HOME}/.cache/bnox
16mkdir ${HOME}/.config/bnox 12mkdir ${HOME}/.config/bnox
17mkdir ${HOME}/.pki
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.cache/bnox 13whitelist ${HOME}/.cache/bnox
20whitelist ${HOME}/.config/bnox 14whitelist ${HOME}/.config/bnox
21whitelist ${HOME}/.pki
22include /etc/firejail/whitelist-common.inc
23include /etc/firejail/whitelist-var-common.inc
24
25caps.keep sys_chroot,sys_admin
26netfilter
27nodvd
28nogroups
29notv
30shell none
31
32private-dev
33# private-tmp - problems with multiple browser sessions
34 15
35noexec ${HOME} 16# Redirect
36noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/brave.profile b/etc/brave.profile
index 668e8a244..f37ac2a05 100644
--- a/etc/brave.profile
+++ b/etc/brave.profile
@@ -8,31 +8,10 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.config/brave 8noblacklist ${HOME}/.config/brave
9# brave uses gpg for built-in password manager 9# brave uses gpg for built-in password manager
10noblacklist ${HOME}/.gnupg 10noblacklist ${HOME}/.gnupg
11noblacklist ${HOME}/.pki
12
13include /etc/firejail/disable-common.inc
14include /etc/firejail/disable-devel.inc
15include /etc/firejail/disable-programs.inc
16 11
17mkdir ${HOME}/.config/brave 12mkdir ${HOME}/.config/brave
18mkdir ${HOME}/.pki
19whitelist ${DOWNLOADS}
20whitelist ${HOME}/.config/KeePass
21whitelist ${HOME}/.config/brave 13whitelist ${HOME}/.config/brave
22whitelist ${HOME}/.config/keepass 14whitelist ${HOME}/.gnupg
23whitelist ${HOME}/.config/lastpass
24whitelist ${HOME}/.keepass
25whitelist ${HOME}/.lastpass
26whitelist ${HOME}/.pki
27include /etc/firejail/whitelist-common.inc
28
29# caps.drop all
30netfilter
31# nonewprivs
32# noroot
33nodvd
34notv
35# protocol unix,inet,inet6,netlink
36# seccomp
37 15
38disable-mnt 16# Redirect
17include /etc/firejail/chromium-common.profile
diff --git a/etc/chromium-common.profile b/etc/chromium-common.profile
new file mode 100644
index 000000000..5c5215309
--- /dev/null
+++ b/etc/chromium-common.profile
@@ -0,0 +1,32 @@
1# Firejail profile for chromium-common
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/chromium-common.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8noblacklist ${HOME}/.pki
9
10include /etc/firejail/disable-common.inc
11include /etc/firejail/disable-devel.inc
12include /etc/firejail/disable-programs.inc
13
14mkdir ${HOME}/.pki
15whitelist ${DOWNLOADS}
16whitelist ${HOME}/.pki
17include /etc/firejail/whitelist-common.inc
18include /etc/firejail/whitelist-var-common.inc
19
20caps.keep sys_chroot,sys_admin
21netfilter
22nodvd
23nogroups
24notv
25shell none
26
27disable-mnt
28private-dev
29# private-tmp - problems with multiple browser sessions
30
31noexec ${HOME}
32noexec /tmp
diff --git a/etc/chromium.profile b/etc/chromium.profile
index 64d790121..ad9f9af33 100644
--- a/etc/chromium.profile
+++ b/etc/chromium.profile
@@ -8,34 +8,14 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.cache/chromium 8noblacklist ${HOME}/.cache/chromium
9noblacklist ${HOME}/.config/chromium 9noblacklist ${HOME}/.config/chromium
10noblacklist ${HOME}/.config/chromium-flags.conf 10noblacklist ${HOME}/.config/chromium-flags.conf
11noblacklist ${HOME}/.pki
12
13include /etc/firejail/disable-common.inc
14include /etc/firejail/disable-devel.inc
15include /etc/firejail/disable-programs.inc
16 11
17mkdir ${HOME}/.cache/chromium 12mkdir ${HOME}/.cache/chromium
18mkdir ${HOME}/.config/chromium 13mkdir ${HOME}/.config/chromium
19mkdir ${HOME}/.pki
20whitelist ${DOWNLOADS}
21whitelist ${HOME}/.cache/chromium 14whitelist ${HOME}/.cache/chromium
22whitelist ${HOME}/.config/chromium 15whitelist ${HOME}/.config/chromium
23whitelist ${HOME}/.config/chromium-flags.conf 16whitelist ${HOME}/.config/chromium-flags.conf
24whitelist ${HOME}/.pki
25include /etc/firejail/whitelist-common.inc
26include /etc/firejail/whitelist-var-common.inc
27
28caps.keep sys_chroot,sys_admin
29netfilter
30nodvd
31nogroups
32notv
33shell none
34 17
35disable-mnt
36# private-bin chromium,chromium-browser,chromedriver 18# private-bin chromium,chromium-browser,chromedriver
37private-dev
38# private-tmp - problems with multiple browser sessions
39 19
40noexec ${HOME} 20# Redirect
41noexec /tmp 21include /etc/firejail/chromium-common.profile
diff --git a/etc/clementine.profile b/etc/clementine.profile
index a736f7bf9..ccf6f9c97 100644
--- a/etc/clementine.profile
+++ b/etc/clementine.profile
@@ -5,6 +5,7 @@ include /etc/firejail/clementine.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/Clementine
8noblacklist ${HOME}/.config/Clementine 9noblacklist ${HOME}/.config/Clementine
9 10
10include /etc/firejail/disable-common.inc 11include /etc/firejail/disable-common.inc
diff --git a/etc/cliqz.profile b/etc/cliqz.profile
index 086dfa233..4ff96311d 100644
--- a/etc/cliqz.profile
+++ b/etc/cliqz.profile
@@ -7,77 +7,14 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/cliqz 8noblacklist ${HOME}/.cache/cliqz
9noblacklist ${HOME}/.config/cliqz 9noblacklist ${HOME}/.config/cliqz
10noblacklist ${HOME}/.config/okularpartrc
11noblacklist ${HOME}/.config/okularrc
12noblacklist ${HOME}/.config/qpdfview
13noblacklist ${HOME}/.kde/share/apps/okular
14noblacklist ${HOME}/.kde/share/config/okularpartrc
15noblacklist ${HOME}/.kde/share/config/okularrc
16noblacklist ${HOME}/.kde4/share/apps/okular
17noblacklist ${HOME}/.kde4/share/config/okularpartrc
18noblacklist ${HOME}/.kde4/share/config/okularrc
19# noblacklist ${HOME}/.local/share/gnome-shell/extensions
20noblacklist ${HOME}/.local/share/okular
21noblacklist ${HOME}/.local/share/qpdfview
22 10
23noblacklist ${HOME}/.pki 11mkdir ${HOME}/.cache/cliqz
12mkdir ${HOME}/.config/cliqz
13whitelist ${HOME}/.cache/cliqz
14whitelist ${HOME}/.config/cliqz
24 15
25include /etc/firejail/disable-common.inc 16# private-etc must first be enabled in firefox-common.profile
26include /etc/firejail/disable-devel.inc 17#private-etc cliqz
27include /etc/firejail/disable-programs.inc
28 18
29mkdir ${HOME}/.cache/mozilla/firefox 19# Redirect
30mkdir ${HOME}/.mozilla 20include /etc/firejail/firefox-common.profile
31mkdir ${HOME}/.pki
32whitelist ${DOWNLOADS}
33whitelist ${HOME}/.cache/gnome-mplayer/plugin
34whitelist ${HOME}/.cache/mozilla/firefox
35whitelist ${HOME}/.config/gnome-mplayer
36whitelist ${HOME}/.config/okularpartrc
37whitelist ${HOME}/.config/okularrc
38whitelist ${HOME}/.config/pipelight-silverlight5.1
39whitelist ${HOME}/.config/pipelight-widevine
40whitelist ${HOME}/.config/qpdfview
41whitelist ${HOME}/.kde/share/apps/okular
42whitelist ${HOME}/.kde/share/config/okularpartrc
43whitelist ${HOME}/.kde/share/config/okularrc
44whitelist ${HOME}/.kde4/share/apps/okular
45whitelist ${HOME}/.kde4/share/config/okularpartrc
46whitelist ${HOME}/.kde4/share/config/okularrc
47whitelist ${HOME}/.keysnail.js
48whitelist ${HOME}/.lastpass
49whitelist ${HOME}/.local/share/gnome-shell/extensions
50whitelist ${HOME}/.local/share/okular
51whitelist ${HOME}/.local/share/qpdfview
52whitelist ${HOME}/.mozilla
53whitelist ${HOME}/.pentadactyl
54whitelist ${HOME}/.pentadactylrc
55whitelist ${HOME}/.pki
56whitelist ${HOME}/.vimperator
57whitelist ${HOME}/.vimperatorrc
58whitelist ${HOME}/.wine-pipelight
59whitelist ${HOME}/.wine-pipelight64
60whitelist ${HOME}/.zotero
61whitelist ${HOME}/dwhelper
62include /etc/firejail/whitelist-common.inc
63include /etc/firejail/whitelist-var-common.inc
64
65caps.drop all
66netfilter
67nodvd
68nogroups
69nonewprivs
70noroot
71notv
72protocol unix,inet,inet6,netlink
73seccomp
74shell none
75tracelog
76
77# private-bin firefox,which,sh,dbus-launch,dbus-send,env
78private-dev
79# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
80private-tmp
81
82noexec ${HOME}
83noexec /tmp
diff --git a/etc/cyberfox.profile b/etc/cyberfox.profile
index 66cd27461..ce51906ba 100644
--- a/etc/cyberfox.profile
+++ b/etc/cyberfox.profile
@@ -7,67 +7,15 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.8pecxstudios 8noblacklist ${HOME}/.8pecxstudios
9noblacklist ${HOME}/.cache/8pecxstudios 9noblacklist ${HOME}/.cache/8pecxstudios
10noblacklist ${HOME}/.config/okularpartrc
11noblacklist ${HOME}/.config/okularrc
12noblacklist ${HOME}/.config/qpdfview
13noblacklist ${HOME}/.kde/share/apps/okular
14noblacklist ${HOME}/.kde4/share/apps/okular
15noblacklist ${HOME}/.local/share/okular
16noblacklist ${HOME}/.local/share/qpdfview
17noblacklist ${HOME}/.pki
18
19include /etc/firejail/disable-common.inc
20include /etc/firejail/disable-devel.inc
21include /etc/firejail/disable-programs.inc
22 10
23mkdir ${HOME}/.8pecxstudios 11mkdir ${HOME}/.8pecxstudios
24mkdir ${HOME}/.cache/8pecxstudios 12mkdir ${HOME}/.cache/8pecxstudios
25mkdir ${HOME}/.pki
26whitelist ${DOWNLOADS}
27whitelist ${HOME}/.8pecxstudios 13whitelist ${HOME}/.8pecxstudios
28whitelist ${HOME}/.cache/8pecxstudios 14whitelist ${HOME}/.cache/8pecxstudios
29whitelist ${HOME}/.cache/gnome-mplayer/plugin
30whitelist ${HOME}/.config/gnome-mplayer
31whitelist ${HOME}/.config/okularpartrc
32whitelist ${HOME}/.config/okularrc
33whitelist ${HOME}/.config/pipelight-silverlight5.1
34whitelist ${HOME}/.config/pipelight-widevine
35whitelist ${HOME}/.config/qpdfview
36whitelist ${HOME}/.kde/share/apps/okular
37whitelist ${HOME}/.kde4/share/apps/okular
38whitelist ${HOME}/.keysnail.js
39whitelist ${HOME}/.lastpass
40whitelist ${HOME}/.local/share/okular
41whitelist ${HOME}/.local/share/qpdfview
42whitelist ${HOME}/.pentadactyl
43whitelist ${HOME}/.pentadactylrc
44whitelist ${HOME}/.pki
45whitelist ${HOME}/.vimperator
46whitelist ${HOME}/.vimperatorrc
47whitelist ${HOME}/.wine-pipelight
48whitelist ${HOME}/.wine-pipelight64
49whitelist ${HOME}/.zotero
50whitelist ${HOME}/dwhelper
51include /etc/firejail/whitelist-common.inc
52
53caps.drop all
54netfilter
55nodvd
56nogroups
57nonewprivs
58noroot
59notv
60protocol unix,inet,inet6,netlink
61seccomp
62shell none
63tracelog
64 15
65disable-mnt
66# private-bin cyberfox,which,sh,dbus-launch,dbus-send,env 16# private-bin cyberfox,which,sh,dbus-launch,dbus-send,env
67private-dev 17# private-etc must first be enabled in firefox-common.profile
68private-dev 18#private-etc cyberfox
69# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,cyberfox,mime.types,mailcap,asound.conf,pulse
70private-tmp
71 19
72noexec ${HOME} 20# Redirect
73noexec /tmp 21include /etc/firejail/firefox-common.profile
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index 91c554f2e..54a292bc2 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -7,7 +7,10 @@ blacklist-nolog ${HOME}/.*_history
7blacklist-nolog ${HOME}/.adobe 7blacklist-nolog ${HOME}/.adobe
8blacklist-nolog ${HOME}/.cache/greenclip* 8blacklist-nolog ${HOME}/.cache/greenclip*
9blacklist-nolog ${HOME}/.history 9blacklist-nolog ${HOME}/.history
10blacklist-nolog ${HOME}/.kde/share/apps/klipper
11blacklist-nolog ${HOME}/.kde4/share/apps/klipper
10blacklist-nolog ${HOME}/.local/share/fish/fish_history 12blacklist-nolog ${HOME}/.local/share/fish/fish_history
13blacklist-nolog ${HOME}/.local/share/klipper
11blacklist-nolog ${HOME}/.macromedia 14blacklist-nolog ${HOME}/.macromedia
12blacklist-nolog /tmp/clipmenu* 15blacklist-nolog /tmp/clipmenu*
13 16
@@ -42,20 +45,21 @@ blacklist /etc/X11/Xsession.d
42blacklist /etc/xdg/autostart 45blacklist /etc/xdg/autostart
43 46
44# KDE config 47# KDE config
45blacklist ${HOME}/.config/*.notifyrc
46blacklist ${HOME}/.config/khotkeysrc 48blacklist ${HOME}/.config/khotkeysrc
47blacklist ${HOME}/.config/krunnerrc 49blacklist ${HOME}/.config/krunnerrc
50blacklist ${HOME}/.config/ksslcertificatemanager
48blacklist ${HOME}/.config/kwinrc 51blacklist ${HOME}/.config/kwinrc
49blacklist ${HOME}/.config/kwinrulesrc 52blacklist ${HOME}/.config/kwinrulesrc
50blacklist ${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc 53blacklist ${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc
54blacklist ${HOME}/.config/plasmashellrc
51blacklist ${HOME}/.config/plasmavaultrc 55blacklist ${HOME}/.config/plasmavaultrc
52blacklist ${HOME}/.kde/share/apps/konsole 56blacklist ${HOME}/.kde/share/apps/konsole
53blacklist ${HOME}/.kde/share/apps/kwin 57blacklist ${HOME}/.kde/share/apps/kwin
54blacklist ${HOME}/.kde/share/apps/plasma 58blacklist ${HOME}/.kde/share/apps/plasma
55blacklist ${HOME}/.kde/share/apps/solid 59blacklist ${HOME}/.kde/share/apps/solid
56blacklist ${HOME}/.kde/share/config/*.notifyrc
57blacklist ${HOME}/.kde/share/config/khotkeysrc 60blacklist ${HOME}/.kde/share/config/khotkeysrc
58blacklist ${HOME}/.kde/share/config/krunnerrc 61blacklist ${HOME}/.kde/share/config/krunnerrc
62blacklist ${HOME}/.kde/share/config/ksslcertificatemanager
59blacklist ${HOME}/.kde/share/config/kwinrc 63blacklist ${HOME}/.kde/share/config/kwinrc
60blacklist ${HOME}/.kde/share/config/kwinrulesrc 64blacklist ${HOME}/.kde/share/config/kwinrulesrc
61blacklist ${HOME}/.kde/share/config/plasma-desktop-appletsrc 65blacklist ${HOME}/.kde/share/config/plasma-desktop-appletsrc
@@ -63,9 +67,9 @@ blacklist ${HOME}/.kde4/share/apps/konsole
63blacklist ${HOME}/.kde4/share/apps/kwin 67blacklist ${HOME}/.kde4/share/apps/kwin
64blacklist ${HOME}/.kde4/share/apps/plasma 68blacklist ${HOME}/.kde4/share/apps/plasma
65blacklist ${HOME}/.kde4/share/apps/solid 69blacklist ${HOME}/.kde4/share/apps/solid
66blacklist ${HOME}/.kde4/share/config/*.notifyrc
67blacklist ${HOME}/.kde4/share/config/khotkeysrc 70blacklist ${HOME}/.kde4/share/config/khotkeysrc
68blacklist ${HOME}/.kde4/share/config/krunnerrc 71blacklist ${HOME}/.kde4/share/config/krunnerrc
72blacklist ${HOME}/.kde4/share/config/ksslcertificatemanager
69blacklist ${HOME}/.kde4/share/config/kwinrc 73blacklist ${HOME}/.kde4/share/config/kwinrc
70blacklist ${HOME}/.kde4/share/config/kwinrulesrc 74blacklist ${HOME}/.kde4/share/config/kwinrulesrc
71blacklist ${HOME}/.kde4/share/config/plasma-desktop-appletsrc 75blacklist ${HOME}/.kde4/share/config/plasma-desktop-appletsrc
@@ -74,15 +78,29 @@ blacklist ${HOME}/.local/share/konsole
74blacklist ${HOME}/.local/share/kwin 78blacklist ${HOME}/.local/share/kwin
75blacklist ${HOME}/.local/share/plasma 79blacklist ${HOME}/.local/share/plasma
76blacklist ${HOME}/.local/share/solid 80blacklist ${HOME}/.local/share/solid
81read-only ${HOME}/.cache/ksycoca5_*
82read-only ${HOME}/.config/*notifyrc
77read-only ${HOME}/.config/kdeglobals 83read-only ${HOME}/.config/kdeglobals
84read-only ${HOME}/.config/kio_httprc
85read-only ${HOME}/.config/kiorc
78read-only ${HOME}/.config/kioslaverc 86read-only ${HOME}/.config/kioslaverc
87read-only ${HOME}/.config/ksslcablacklist
88read-only ${HOME}/.kde/share/apps/kssl
89read-only ${HOME}/.kde/share/config/*notifyrc
79read-only ${HOME}/.kde/share/config/kdeglobals 90read-only ${HOME}/.kde/share/config/kdeglobals
91read-only ${HOME}/.kde/share/config/kio_httprc
80read-only ${HOME}/.kde/share/config/kioslaverc 92read-only ${HOME}/.kde/share/config/kioslaverc
93read-only ${HOME}/.kde/share/config/ksslcablacklist
81read-only ${HOME}/.kde/share/kde4/services 94read-only ${HOME}/.kde/share/kde4/services
95read-only ${HOME}/.kde4/share/apps/kssl
96read-only ${HOME}/.kde4/share/config/*notifyrc
82read-only ${HOME}/.kde4/share/config/kdeglobals 97read-only ${HOME}/.kde4/share/config/kdeglobals
98read-only ${HOME}/.kde4/share/config/kio_httprc
83read-only ${HOME}/.kde4/share/config/kioslaverc 99read-only ${HOME}/.kde4/share/config/kioslaverc
100read-only ${HOME}/.kde4/share/config/ksslcablacklist
84read-only ${HOME}/.kde4/share/kde4/services 101read-only ${HOME}/.kde4/share/kde4/services
85read-only ${HOME}/.local/share/kservices5 102read-only ${HOME}/.local/share/kservices5
103read-only ${HOME}/.local/share/kssl
86 104
87# kdeinit socket 105# kdeinit socket
88blacklist /run/user/*/kdeinit5__* 106blacklist /run/user/*/kdeinit5__*
@@ -236,6 +254,7 @@ read-only ${HOME}/bin
236blacklist ${HOME}/.local/share/Trash 254blacklist ${HOME}/.local/share/Trash
237 255
238# Write-protection for desktop entries 256# Write-protection for desktop entries
257read-only ${HOME}/.config/menus
239read-only ${HOME}/.local/share/applications 258read-only ${HOME}/.local/share/applications
240 259
241# top secret 260# top secret
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 4d9c4d85f..8e72dc47e 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -129,11 +129,15 @@ blacklist ${HOME}/.config/iridium
129blacklist ${HOME}/.config/itch 129blacklist ${HOME}/.config/itch
130blacklist ${HOME}/.config/jd-gui.cfg 130blacklist ${HOME}/.config/jd-gui.cfg
131blacklist ${HOME}/.config/k3brc 131blacklist ${HOME}/.config/k3brc
132blacklist ${HOME}/.config/kaffeinerc
132blacklist ${HOME}/.config/katepartrc 133blacklist ${HOME}/.config/katepartrc
133blacklist ${HOME}/.config/katerc 134blacklist ${HOME}/.config/katerc
134blacklist ${HOME}/.config/kateschemarc 135blacklist ${HOME}/.config/kateschemarc
135blacklist ${HOME}/.config/katesyntaxhighlightingrc 136blacklist ${HOME}/.config/katesyntaxhighlightingrc
136blacklist ${HOME}/.config/katevirc 137blacklist ${HOME}/.config/katevirc
138blacklist ${HOME}/.config/kdenliverc
139blacklist ${HOME}/.config/kgetrc
140blacklist ${HOME}/.config/klipperrc
137blacklist ${HOME}/.config/kritarc 141blacklist ${HOME}/.config/kritarc
138blacklist ${HOME}/.config/kwriterc 142blacklist ${HOME}/.config/kwriterc
139blacklist ${HOME}/.config/kdeconnect 143blacklist ${HOME}/.config/kdeconnect
@@ -258,6 +262,7 @@ blacklist ${HOME}/.java
258blacklist ${HOME}/.jitsi 262blacklist ${HOME}/.jitsi
259blacklist ${HOME}/.kde/share/apps/digikam 263blacklist ${HOME}/.kde/share/apps/digikam
260blacklist ${HOME}/.kde/share/apps/gwenview 264blacklist ${HOME}/.kde/share/apps/gwenview
265blacklist ${HOME}/.kde/share/apps/kaffeine
261blacklist ${HOME}/.kde/share/apps/kcookiejar 266blacklist ${HOME}/.kde/share/apps/kcookiejar
262blacklist ${HOME}/.kde/share/apps/kget 267blacklist ${HOME}/.kde/share/apps/kget
263blacklist ${HOME}/.kde/share/apps/khtml 268blacklist ${HOME}/.kde/share/apps/khtml
@@ -272,9 +277,11 @@ blacklist ${HOME}/.kde/share/config/baloorc
272blacklist ${HOME}/.kde/share/config/digikam 277blacklist ${HOME}/.kde/share/config/digikam
273blacklist ${HOME}/.kde/share/config/gwenviewrc 278blacklist ${HOME}/.kde/share/config/gwenviewrc
274blacklist ${HOME}/.kde/share/config/k3brc 279blacklist ${HOME}/.kde/share/config/k3brc
280blacklist ${HOME}/.kde/share/config/kaffeinerc
275blacklist ${HOME}/.kde/share/config/kcookiejarrc 281blacklist ${HOME}/.kde/share/config/kcookiejarrc
276blacklist ${HOME}/.kde/share/config/kgetrc 282blacklist ${HOME}/.kde/share/config/kgetrc
277blacklist ${HOME}/.kde/share/config/khtmlrc 283blacklist ${HOME}/.kde/share/config/khtmlrc
284blacklist ${HOME}/.kde/share/config/klipperrc
278blacklist ${HOME}/.kde/share/config/konq_history 285blacklist ${HOME}/.kde/share/config/konq_history
279blacklist ${HOME}/.kde/share/config/konqsidebartngrc 286blacklist ${HOME}/.kde/share/config/konqsidebartngrc
280blacklist ${HOME}/.kde/share/config/konquerorrc 287blacklist ${HOME}/.kde/share/config/konquerorrc
@@ -285,6 +292,7 @@ blacklist ${HOME}/.kde/share/config/okularpartrc
285blacklist ${HOME}/.kde/share/config/okularrc 292blacklist ${HOME}/.kde/share/config/okularrc
286blacklist ${HOME}/.kde4/share/apps/digikam 293blacklist ${HOME}/.kde4/share/apps/digikam
287blacklist ${HOME}/.kde4/share/apps/gwenview 294blacklist ${HOME}/.kde4/share/apps/gwenview
295blacklist ${HOME}/.kde4/share/apps/kaffeine
288blacklist ${HOME}/.kde4/share/apps/kcookiejar 296blacklist ${HOME}/.kde4/share/apps/kcookiejar
289blacklist ${HOME}/.kde4/share/apps/kget 297blacklist ${HOME}/.kde4/share/apps/kget
290blacklist ${HOME}/.kde4/share/apps/khtml 298blacklist ${HOME}/.kde4/share/apps/khtml
@@ -298,9 +306,11 @@ blacklist ${HOME}/.kde4/share/config/baloofilerc
298blacklist ${HOME}/.kde4/share/config/digikam 306blacklist ${HOME}/.kde4/share/config/digikam
299blacklist ${HOME}/.kde4/share/config/gwenviewrc 307blacklist ${HOME}/.kde4/share/config/gwenviewrc
300blacklist ${HOME}/.kde4/share/config/k3brc 308blacklist ${HOME}/.kde4/share/config/k3brc
309blacklist ${HOME}/.kde4/share/config/kaffeinerc
301blacklist ${HOME}/.kde4/share/config/kcookiejarrc 310blacklist ${HOME}/.kde4/share/config/kcookiejarrc
302blacklist ${HOME}/.kde4/share/config/kgetrc 311blacklist ${HOME}/.kde4/share/config/kgetrc
303blacklist ${HOME}/.kde4/share/config/khtmlrc 312blacklist ${HOME}/.kde4/share/config/khtmlrc
313blacklist ${HOME}/.kde4/share/config/klipperrc
304blacklist ${HOME}/.kde4/share/config/konq_history 314blacklist ${HOME}/.kde4/share/config/konq_history
305blacklist ${HOME}/.kde4/share/config/konqsidebartngrc 315blacklist ${HOME}/.kde4/share/config/konqsidebartngrc
306blacklist ${HOME}/.kde4/share/config/konquerorrc 316blacklist ${HOME}/.kde4/share/config/konquerorrc
@@ -338,6 +348,7 @@ blacklist ${HOME}/.local/share/clipit
338blacklist ${HOME}/.local/share/data/Mumble 348blacklist ${HOME}/.local/share/data/Mumble
339blacklist ${HOME}/.local/share/data/MusE 349blacklist ${HOME}/.local/share/data/MusE
340blacklist ${HOME}/.local/share/data/MuseScore 350blacklist ${HOME}/.local/share/data/MuseScore
351blacklist ${HOME}/.local/share/data/qBittorrent
341blacklist ${HOME}/.local/share/dino 352blacklist ${HOME}/.local/share/dino
342blacklist ${HOME}/.local/share/dolphin 353blacklist ${HOME}/.local/share/dolphin
343blacklist ${HOME}/.local/share/epiphany 354blacklist ${HOME}/.local/share/epiphany
@@ -354,7 +365,11 @@ blacklist ${HOME}/.local/share/gnome-photos
354blacklist ${HOME}/.local/share/gnome-ring 365blacklist ${HOME}/.local/share/gnome-ring
355blacklist ${HOME}/.local/share/gnome-twitch 366blacklist ${HOME}/.local/share/gnome-twitch
356blacklist ${HOME}/.local/share/gwenview 367blacklist ${HOME}/.local/share/gwenview
368blacklist ${HOME}/.local/share/kaffeine
357blacklist ${HOME}/.local/share/kate 369blacklist ${HOME}/.local/share/kate
370blacklist ${HOME}/.local/share/kdenlive
371blacklist ${HOME}/.local/share/kget
372blacklist ${HOME}/.local/share/krita
358blacklist ${HOME}/.local/share/ktorrentrc 373blacklist ${HOME}/.local/share/ktorrentrc
359blacklist ${HOME}/.local/share/ktorrent 374blacklist ${HOME}/.local/share/ktorrent
360blacklist ${HOME}/.local/share/kwrite 375blacklist ${HOME}/.local/share/kwrite
@@ -436,6 +451,7 @@ blacklist ${HOME}/.sylpheed-2.0
436blacklist ${HOME}/.synfig 451blacklist ${HOME}/.synfig
437blacklist ${HOME}/.tconn 452blacklist ${HOME}/.tconn
438blacklist ${HOME}/.thunderbird 453blacklist ${HOME}/.thunderbird
454blacklist ${HOME}/.tilp
439blacklist ${HOME}/.tooling 455blacklist ${HOME}/.tooling
440blacklist ${HOME}/.tor-browser-* 456blacklist ${HOME}/.tor-browser-*
441blacklist ${HOME}/.ts3client 457blacklist ${HOME}/.ts3client
@@ -465,6 +481,7 @@ blacklist /tmp/ssh-*
465# ~/.cache directory 481# ~/.cache directory
466blacklist ${HOME}/.cache/0ad 482blacklist ${HOME}/.cache/0ad
467blacklist ${HOME}/.cache/8pecxstudios 483blacklist ${HOME}/.cache/8pecxstudios
484blacklist ${HOME}/.cache/Clementine
468blacklist ${HOME}/.cache/Franz 485blacklist ${HOME}/.cache/Franz
469blacklist ${HOME}/.cache/INRIA 486blacklist ${HOME}/.cache/INRIA
470blacklist ${HOME}/.cache/MusicBrainz 487blacklist ${HOME}/.cache/MusicBrainz
@@ -477,6 +494,8 @@ blacklist ${HOME}/.cache/chromium
477blacklist ${HOME}/.cache/chromium-dev 494blacklist ${HOME}/.cache/chromium-dev
478blacklist ${HOME}/.cache/cliqz 495blacklist ${HOME}/.cache/cliqz
479blacklist ${HOME}/.cache/darktable 496blacklist ${HOME}/.cache/darktable
497blacklist ${HOME}/.cache/discover
498blacklist ${HOME}/.cache/dolphin
480blacklist ${HOME}/.cache/epiphany 499blacklist ${HOME}/.cache/epiphany
481blacklist ${HOME}/.cache/evolution 500blacklist ${HOME}/.cache/evolution
482blacklist ${HOME}/.cache/fossamail 501blacklist ${HOME}/.cache/fossamail
@@ -490,6 +509,13 @@ blacklist ${HOME}/.cache/icedove
490blacklist ${HOME}/.cache/INRIA/Natron 509blacklist ${HOME}/.cache/INRIA/Natron
491blacklist ${HOME}/.cache/inox 510blacklist ${HOME}/.cache/inox
492blacklist ${HOME}/.cache/iridium 511blacklist ${HOME}/.cache/iridium
512blacklist ${HOME}/.cache/kdenlive
513blacklist ${HOME}/.cache/kinfocenter
514blacklist ${HOME}/.cache/krunner
515blacklist ${HOME}/.cache/kscreenlocker_greet
516blacklist ${HOME}/.cache/ksmserver-logout-greeter
517blacklist ${HOME}/.cache/ksplashqml
518blacklist ${HOME}/.cache/kwin
493blacklist ${HOME}/.cache/libgweather 519blacklist ${HOME}/.cache/libgweather
494blacklist ${HOME}/.cache/liferea 520blacklist ${HOME}/.cache/liferea
495blacklist ${HOME}/.cache/midori 521blacklist ${HOME}/.cache/midori
@@ -498,17 +524,20 @@ blacklist ${HOME}/.cache/mozilla
498blacklist ${HOME}/.cache/mutt 524blacklist ${HOME}/.cache/mutt
499blacklist ${HOME}/.cache/nheko/nheko 525blacklist ${HOME}/.cache/nheko/nheko
500blacklist ${HOME}/.cache/netsurf 526blacklist ${HOME}/.cache/netsurf
527blacklist ${HOME}/.cache/okular
501blacklist ${HOME}/.cache/opera 528blacklist ${HOME}/.cache/opera
502blacklist ${HOME}/.cache/opera-beta 529blacklist ${HOME}/.cache/opera-beta
503blacklist ${HOME}/.cache/org.gnome.Books 530blacklist ${HOME}/.cache/org.gnome.Books
504blacklist ${HOME}/.cache/pdfmod 531blacklist ${HOME}/.cache/pdfmod
505blacklist ${HOME}/.cache/peek 532blacklist ${HOME}/.cache/peek
533blacklist ${HOME}/.cache/plasmashell
506blacklist ${HOME}/.cache/qBittorrent 534blacklist ${HOME}/.cache/qBittorrent
507blacklist ${HOME}/.cache/qupzilla 535blacklist ${HOME}/.cache/qupzilla
508blacklist ${HOME}/.cache/qutebrowser 536blacklist ${HOME}/.cache/qutebrowser
509blacklist ${HOME}/.cache/simple-scan 537blacklist ${HOME}/.cache/simple-scan
510blacklist ${HOME}/.cache/slimjet 538blacklist ${HOME}/.cache/slimjet
511blacklist ${HOME}/.cache/spotify 539blacklist ${HOME}/.cache/spotify
540blacklist ${HOME}/.cache/systemsettings
512blacklist ${HOME}/.cache/telepathy 541blacklist ${HOME}/.cache/telepathy
513blacklist ${HOME}/.cache/thunderbird 542blacklist ${HOME}/.cache/thunderbird
514blacklist ${HOME}/.cache/torbrowser 543blacklist ${HOME}/.cache/torbrowser
diff --git a/etc/dnox.profile b/etc/dnox.profile
index d6626c048..505884ca6 100644
--- a/etc/dnox.profile
+++ b/etc/dnox.profile
@@ -7,30 +7,11 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/dnox 8noblacklist ${HOME}/.cache/dnox
9noblacklist ${HOME}/.config/dnox 9noblacklist ${HOME}/.config/dnox
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-programs.inc
14 10
15mkdir ${HOME}/.cache/dnox 11mkdir ${HOME}/.cache/dnox
16mkdir ${HOME}/.config/dnox 12mkdir ${HOME}/.config/dnox
17mkdir ${HOME}/.pki
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.cache/dnox 13whitelist ${HOME}/.cache/dnox
20whitelist ${HOME}/.config/dnox 14whitelist ${HOME}/.config/dnox
21whitelist ${HOME}/.pki
22include /etc/firejail/whitelist-common.inc
23include /etc/firejail/whitelist-var-common.inc
24
25caps.keep sys_chroot,sys_admin
26netfilter
27nodvd
28nogroups
29notv
30shell none
31
32private-dev
33# private-tmp - problems with multiple browser sessions
34 15
35noexec ${HOME} 16# Redirect
36noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/dolphin.profile b/etc/dolphin.profile
index c1604826e..ce167b7a7 100644
--- a/etc/dolphin.profile
+++ b/etc/dolphin.profile
@@ -8,7 +8,8 @@ include /etc/firejail/globals.local
8# warning: firejail is currently not effectively constraining dolphin since used services are started by kdeinit5 8# warning: firejail is currently not effectively constraining dolphin since used services are started by kdeinit5
9 9
10noblacklist ${HOME}/.local/share/Trash 10noblacklist ${HOME}/.local/share/Trash
11# noblacklist ${HOME}/.config/dolphinrc - diable-programs.inc is disabled, see below 11# noblacklist ${HOME}/.cache/dolphin - disable-programs.inc is disabled, see below
12# noblacklist ${HOME}/.config/dolphinrc
12# noblacklist ${HOME}/.local/share/dolphin 13# noblacklist ${HOME}/.local/share/dolphin
13 14
14include /etc/firejail/disable-common.inc 15include /etc/firejail/disable-common.inc
diff --git a/etc/dragon.profile b/etc/dragon.profile
index 76544010f..6fa6ec65e 100644
--- a/etc/dragon.profile
+++ b/etc/dragon.profile
@@ -16,7 +16,6 @@ include /etc/firejail/whitelist-var-common.inc
16 16
17caps.drop all 17caps.drop all
18netfilter 18netfilter
19nodvd
20nogroups 19nogroups
21nonewprivs 20nonewprivs
22noroot 21noroot
diff --git a/etc/firefox-common-addons.inc b/etc/firefox-common-addons.inc
new file mode 100644
index 000000000..b237c3c05
--- /dev/null
+++ b/etc/firefox-common-addons.inc
@@ -0,0 +1,55 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include /etc/firejail/firefox-common-addons.local
4
5noblacklist ${HOME}/.config/kgetrc
6noblacklist ${HOME}/.config/okularpartrc
7noblacklist ${HOME}/.config/okularrc
8noblacklist ${HOME}/.config/qpdfview
9noblacklist ${HOME}/.kde/share/apps/kget
10noblacklist ${HOME}/.kde/share/apps/okular
11noblacklist ${HOME}/.kde/share/config/kgetrc
12noblacklist ${HOME}/.kde/share/config/okularpartrc
13noblacklist ${HOME}/.kde/share/config/okularrc
14noblacklist ${HOME}/.kde4/share/apps/kget
15noblacklist ${HOME}/.kde4/share/apps/okular
16noblacklist ${HOME}/.kde4/share/config/kgetrc
17noblacklist ${HOME}/.kde4/share/config/okularpartrc
18noblacklist ${HOME}/.kde4/share/config/okularrc
19# noblacklist ${HOME}/.local/share/gnome-shell/extensions
20noblacklist ${HOME}/.local/share/kget
21noblacklist ${HOME}/.local/share/okular
22noblacklist ${HOME}/.local/share/qpdfview
23
24whitelist ${HOME}/.cache/gnome-mplayer/plugin
25whitelist ${HOME}/.config/gnome-mplayer
26whitelist ${HOME}/.config/kgetrc
27whitelist ${HOME}/.config/okularpartrc
28whitelist ${HOME}/.config/okularrc
29whitelist ${HOME}/.config/pipelight-silverlight5.1
30whitelist ${HOME}/.config/pipelight-widevine
31whitelist ${HOME}/.config/qpdfview
32whitelist ${HOME}/.kde/share/apps/kget
33whitelist ${HOME}/.kde/share/apps/okular
34whitelist ${HOME}/.kde/share/config/kgetrc
35whitelist ${HOME}/.kde/share/config/okularpartrc
36whitelist ${HOME}/.kde/share/config/okularrc
37whitelist ${HOME}/.kde4/share/apps/kget
38whitelist ${HOME}/.kde4/share/apps/okular
39whitelist ${HOME}/.kde4/share/config/kgetrc
40whitelist ${HOME}/.kde4/share/config/okularpartrc
41whitelist ${HOME}/.kde4/share/config/okularrc
42whitelist ${HOME}/.keysnail.js
43whitelist ${HOME}/.lastpass
44whitelist ${HOME}/.local/share/gnome-shell/extensions
45whitelist ${HOME}/.local/share/kget
46whitelist ${HOME}/.local/share/okular
47whitelist ${HOME}/.local/share/qpdfview
48whitelist ${HOME}/.pentadactyl
49whitelist ${HOME}/.pentadactylrc
50whitelist ${HOME}/.vimperator
51whitelist ${HOME}/.vimperatorrc
52whitelist ${HOME}/.wine-pipelight
53whitelist ${HOME}/.wine-pipelight64
54whitelist ${HOME}/.zotero
55whitelist ${HOME}/dwhelper
diff --git a/etc/firefox-common.profile b/etc/firefox-common.profile
new file mode 100644
index 000000000..0c4271edc
--- /dev/null
+++ b/etc/firefox-common.profile
@@ -0,0 +1,44 @@
1# Firejail profile for firefox-common
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/firefox-common.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8# uncomment the following line to allow access to common programs/addons/plugins
9#include /etc/firejail/firefox-common-addons.inc
10
11noblacklist ${HOME}/.pki
12
13include /etc/firejail/disable-common.inc
14include /etc/firejail/disable-devel.inc
15include /etc/firejail/disable-programs.inc
16
17mkdir ${HOME}/.pki
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.pki
20include /etc/firejail/whitelist-common.inc
21include /etc/firejail/whitelist-var-common.inc
22
23caps.drop all
24# machine-id breaks pulse audio; it should work fine in setups where sound is not required
25#machine-id
26netfilter
27nodvd
28nogroups
29nonewprivs
30noroot
31notv
32protocol unix,inet,inet6,netlink
33seccomp
34shell none
35tracelog
36
37disable-mnt
38private-dev
39# private-etc below works fine on most distributions. There are some problems on CentOS.
40#private-etc ca-certificates,ssl,machine-id,dconf,selinux,passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,mime.types,mailcap,asound.conf,pulse,pki,crypto-policies
41private-tmp
42
43noexec ${HOME}
44noexec /tmp
diff --git a/etc/firefox.profile b/etc/firefox.profile
index 079cb1536..0ab6a6141 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -6,90 +6,17 @@ include /etc/firejail/firefox.local
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/mozilla 8noblacklist ${HOME}/.cache/mozilla
9noblacklist ${HOME}/.config/okularpartrc
10noblacklist ${HOME}/.config/okularrc
11noblacklist ${HOME}/.config/qpdfview
12noblacklist ${HOME}/.kde/share/apps/kget
13noblacklist ${HOME}/.kde/share/apps/okular
14noblacklist ${HOME}/.kde/share/config/kgetrc
15noblacklist ${HOME}/.kde/share/config/okularpartrc
16noblacklist ${HOME}/.kde/share/config/okularrc
17noblacklist ${HOME}/.kde4/share/apps/kget
18noblacklist ${HOME}/.kde4/share/apps/okular
19noblacklist ${HOME}/.kde4/share/config/kgetrc
20noblacklist ${HOME}/.kde4/share/config/okularpartrc
21noblacklist ${HOME}/.kde4/share/config/okularrc
22# noblacklist ${HOME}/.local/share/gnome-shell/extensions
23noblacklist ${HOME}/.local/share/okular
24noblacklist ${HOME}/.local/share/qpdfview
25noblacklist ${HOME}/.mozilla 9noblacklist ${HOME}/.mozilla
26noblacklist ${HOME}/.pki
27
28include /etc/firejail/disable-common.inc
29include /etc/firejail/disable-devel.inc
30include /etc/firejail/disable-programs.inc
31 10
32mkdir ${HOME}/.cache/mozilla/firefox 11mkdir ${HOME}/.cache/mozilla/firefox
33mkdir ${HOME}/.mozilla 12mkdir ${HOME}/.mozilla
34mkdir ${HOME}/.pki
35whitelist ${DOWNLOADS}
36whitelist ${HOME}/.cache/gnome-mplayer/plugin
37whitelist ${HOME}/.cache/mozilla/firefox 13whitelist ${HOME}/.cache/mozilla/firefox
38whitelist ${HOME}/.config/gnome-mplayer
39whitelist ${HOME}/.config/okularpartrc
40whitelist ${HOME}/.config/okularrc
41whitelist ${HOME}/.config/pipelight-silverlight5.1
42whitelist ${HOME}/.config/pipelight-widevine
43whitelist ${HOME}/.config/qpdfview
44whitelist ${HOME}/.kde/share/apps/kget
45whitelist ${HOME}/.kde/share/apps/okular
46whitelist ${HOME}/.kde/share/config/kgetrc
47whitelist ${HOME}/.kde/share/config/okularpartrc
48whitelist ${HOME}/.kde/share/config/okularrc
49whitelist ${HOME}/.kde4/share/apps/kget
50whitelist ${HOME}/.kde4/share/apps/okular
51whitelist ${HOME}/.kde4/share/config/kgetrc
52whitelist ${HOME}/.kde4/share/config/okularpartrc
53whitelist ${HOME}/.kde4/share/config/okularrc
54whitelist ${HOME}/.keysnail.js
55whitelist ${HOME}/.lastpass
56whitelist ${HOME}/.local/share/gnome-shell/extensions
57whitelist ${HOME}/.local/share/okular
58whitelist ${HOME}/.local/share/qpdfview
59whitelist ${HOME}/.mozilla 14whitelist ${HOME}/.mozilla
60whitelist ${HOME}/.pentadactyl
61whitelist ${HOME}/.pentadactylrc
62whitelist ${HOME}/.pki
63whitelist ${HOME}/.vimperator
64whitelist ${HOME}/.vimperatorrc
65whitelist ${HOME}/.wine-pipelight
66whitelist ${HOME}/.wine-pipelight64
67whitelist ${HOME}/.zotero
68whitelist ${HOME}/dwhelper
69include /etc/firejail/whitelist-common.inc
70include /etc/firejail/whitelist-var-common.inc
71
72caps.drop all
73# machine-id breaks pulse audio; it should work fine in setups where sound is not required
74#machine-id
75netfilter
76nodvd
77nogroups
78nonewprivs
79noroot
80notv
81protocol unix,inet,inet6,netlink
82seccomp
83shell none
84tracelog
85 15
86disable-mnt
87# firefox requires a shell to launch on Arch. 16# firefox requires a shell to launch on Arch.
88# private-bin firefox,which,sh,dbus-launch,dbus-send,env,bash 17#private-bin firefox,which,sh,dbus-launch,dbus-send,env,bash
89private-dev 18# private-etc must first be enabled in firefox-common.profile
90# private-etc below works fine on most distributions. There are some problems on CentOS. 19#private-etc firefox
91# private-etc iceweasel,ca-certificates,ssl,machine-id,dconf,selinux,passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse,pki,crypto-policies
92private-tmp
93 20
94noexec ${HOME} 21# Redirect
95noexec /tmp 22include /etc/firejail/firefox-common.profile
diff --git a/etc/firejail-default b/etc/firejail-default
index e532af430..859f8683a 100644
--- a/etc/firejail-default
+++ b/etc/firejail-default
@@ -8,14 +8,16 @@
8# We don't know if this definition is available outside Debian and Ubuntu, so 8# We don't know if this definition is available outside Debian and Ubuntu, so
9# we declare our own here. 9# we declare our own here.
10########## 10##########
11@{PID}={[1-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9]} 11@{PID}={[1-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9]}
12 12
13profile firejail-default flags=(attach_disconnected,mediate_deleted) { 13profile firejail-default flags=(attach_disconnected,mediate_deleted) {
14 14
15########## 15##########
16# D-Bus is a huge security hole. Uncomment this line if you need D-Bus 16# D-Bus is a huge security hole. Uncomment those lines if you need D-Bus
17# functionality. 17# functionality.
18########## 18##########
19##include <abstractions/dbus-strict>
20##include <abstractions/dbus-session-strict>
19#dbus, 21#dbus,
20 22
21########## 23##########
@@ -59,6 +61,9 @@ owner /{run,dev}/shm/** rmwk,
59/run/firejail/mnt/oroot/{run,dev}/shm/ r, 61/run/firejail/mnt/oroot/{run,dev}/shm/ r,
60owner /run/firejail/mnt/oroot/{run,dev}/shm/** rmwk, 62owner /run/firejail/mnt/oroot/{run,dev}/shm/** rmwk,
61 63
64# Needed for wine
65/{,var/}run/firejail/profile/@{PID} w,
66
62########## 67##########
63# Mask /proc and /sys information leakage. The configuration here is barely 68# Mask /proc and /sys information leakage. The configuration here is barely
64# enough to run "top" or "ps aux". 69# enough to run "top" or "ps aux".
@@ -72,6 +77,7 @@ owner /run/firejail/mnt/oroot/{run,dev}/shm/** rmwk,
72/proc/stat r, 77/proc/stat r,
73/proc/sys/kernel/pid_max r, 78/proc/sys/kernel/pid_max r,
74/proc/sys/kernel/shmmax r, 79/proc/sys/kernel/shmmax r,
80/proc/sys/kernel/yama/ptrace_scope r,
75/proc/sys/vm/overcommit_memory r, 81/proc/sys/vm/overcommit_memory r,
76/proc/sys/vm/overcommit_ratio r, 82/proc/sys/vm/overcommit_ratio r,
77/proc/sys/kernel/random/uuid r, 83/proc/sys/kernel/random/uuid r,
@@ -93,15 +99,22 @@ owner /run/firejail/mnt/oroot/{run,dev}/shm/** rmwk,
93/proc/@{PID}/statm r, 99/proc/@{PID}/statm r,
94/proc/@{PID}/status r, 100/proc/@{PID}/status r,
95/proc/@{PID}/task/@{PID}/stat r, 101/proc/@{PID}/task/@{PID}/stat r,
102/proc/@{PID}/task/@{PID}/status r,
96/proc/@{PID}/maps r, 103/proc/@{PID}/maps r,
104/proc/@{PID}/mem r,
97/proc/@{PID}/mounts r, 105/proc/@{PID}/mounts r,
98/proc/@{PID}/mountinfo r, 106/proc/@{PID}/mountinfo r,
107deny /proc/@{PID}/oom_adj w,
99/proc/@{PID}/oom_score_adj r, 108/proc/@{PID}/oom_score_adj r,
109deny /proc/@{PID}/oom_score_adj w,
100/proc/@{PID}/auxv r, 110/proc/@{PID}/auxv r,
101/proc/@{PID}/net/dev r, 111/proc/@{PID}/net/dev r,
102/proc/@{PID}/loginuid r, 112/proc/@{PID}/loginuid r,
103/proc/@{PID}/environ r, 113/proc/@{PID}/environ r,
104 114
115# Needed by chromium crash handler. Uncomment if you need it.
116#ptrace (trace tracedby),
117
105########## 118##########
106# Allow running programs only from well-known system directories. If you need 119# Allow running programs only from well-known system directories. If you need
107# to run programs from your home directory, uncomment /home line. 120# to run programs from your home directory, uncomment /home line.
@@ -133,6 +146,11 @@ owner /run/firejail/mnt/oroot/{run,dev}/shm/** rmwk,
133/run/firejail/mnt/oroot/opt/** ix, 146/run/firejail/mnt/oroot/opt/** ix,
134 147
135########## 148##########
149# Allow acces to cups printing socket
150##########
151/run/cups/cups.sock w,
152
153##########
136# Allow all networking functionality, and control it from Firejail. 154# Allow all networking functionality, and control it from Firejail.
137########## 155##########
138network inet, 156network inet,
diff --git a/etc/flashpeak-slimjet.profile b/etc/flashpeak-slimjet.profile
index d9be8b9c5..63f9d19a9 100644
--- a/etc/flashpeak-slimjet.profile
+++ b/etc/flashpeak-slimjet.profile
@@ -5,35 +5,13 @@ include /etc/firejail/flashpeak-slimjet.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8# This is a whitelisted profile, the internal browser sandbox
9# is disabled because it requires sudo password. The command
10# to run it is as follows:
11# firejail flashpeak-slimjet --no-sandbox
12
13noblacklist ${HOME}/.cache/slimjet 8noblacklist ${HOME}/.cache/slimjet
14noblacklist ${HOME}/.config/slimjet 9noblacklist ${HOME}/.config/slimjet
15noblacklist ${HOME}/.pki
16
17include /etc/firejail/disable-common.inc
18include /etc/firejail/disable-devel.inc
19include /etc/firejail/disable-programs.inc
20 10
21mkdir ${HOME}/.cache/slimjet 11mkdir ${HOME}/.cache/slimjet
22mkdir ${HOME}/.config/slimjet 12mkdir ${HOME}/.config/slimjet
23mkdir ${HOME}/.pki
24whitelist ${DOWNLOADS}
25whitelist ${HOME}/.cache/slimjet 13whitelist ${HOME}/.cache/slimjet
26whitelist ${HOME}/.config/slimjet 14whitelist ${HOME}/.config/slimjet
27whitelist ${HOME}/.pki
28include /etc/firejail/whitelist-common.inc
29
30caps.drop all
31netfilter
32nodvd
33nonewprivs
34noroot
35notv
36protocol unix,inet,inet6,netlink
37seccomp
38 15
39disable-mnt 16# Redirect
17include /etc/firejail/chromium-common.profile
diff --git a/etc/google-chrome-beta.profile b/etc/google-chrome-beta.profile
index 9c7306b85..ab16558ea 100644
--- a/etc/google-chrome-beta.profile
+++ b/etc/google-chrome-beta.profile
@@ -7,30 +7,11 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/google-chrome-beta 8noblacklist ${HOME}/.cache/google-chrome-beta
9noblacklist ${HOME}/.config/google-chrome-beta 9noblacklist ${HOME}/.config/google-chrome-beta
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-programs.inc
15 10
16mkdir ${HOME}/.cache/google-chrome-beta 11mkdir ${HOME}/.cache/google-chrome-beta
17mkdir ${HOME}/.config/google-chrome-beta 12mkdir ${HOME}/.config/google-chrome-beta
18mkdir ${HOME}/.pki
19whitelist ${DOWNLOADS}
20whitelist ${HOME}/.cache/google-chrome-beta 13whitelist ${HOME}/.cache/google-chrome-beta
21whitelist ${HOME}/.config/google-chrome-beta 14whitelist ${HOME}/.config/google-chrome-beta
22whitelist ${HOME}/.pki
23include /etc/firejail/whitelist-common.inc
24
25caps.keep sys_chroot,sys_admin
26netfilter
27nodvd
28nogroups
29notv
30shell none
31
32private-dev
33# private-tmp - problems with multiple browser sessions
34 15
35noexec ${HOME} 16# Redirect
36noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/google-chrome-unstable.profile b/etc/google-chrome-unstable.profile
index bb05b3e99..b7d0eccf3 100644
--- a/etc/google-chrome-unstable.profile
+++ b/etc/google-chrome-unstable.profile
@@ -7,30 +7,11 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/google-chrome-unstable 8noblacklist ${HOME}/.cache/google-chrome-unstable
9noblacklist ${HOME}/.config/google-chrome-unstable 9noblacklist ${HOME}/.config/google-chrome-unstable
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-programs.inc
15 10
16mkdir ${HOME}/.cache/google-chrome-unstable 11mkdir ${HOME}/.cache/google-chrome-unstable
17mkdir ${HOME}/.config/google-chrome-unstable 12mkdir ${HOME}/.config/google-chrome-unstable
18mkdir ${HOME}/.pki
19whitelist ${DOWNLOADS}
20whitelist ${HOME}/.cache/google-chrome-unstable 13whitelist ${HOME}/.cache/google-chrome-unstable
21whitelist ${HOME}/.config/google-chrome-unstable 14whitelist ${HOME}/.config/google-chrome-unstable
22whitelist ${HOME}/.pki
23include /etc/firejail/whitelist-common.inc
24
25caps.keep sys_chroot,sys_admin
26netfilter
27nodvd
28nogroups
29notv
30shell none
31
32private-dev
33# private-tmp - problems with multiple browser sessions
34 15
35noexec ${HOME} 16# Redirect
36noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/google-chrome.profile b/etc/google-chrome.profile
index 19ebfa974..6e44190ae 100644
--- a/etc/google-chrome.profile
+++ b/etc/google-chrome.profile
@@ -7,32 +7,11 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/google-chrome 8noblacklist ${HOME}/.cache/google-chrome
9noblacklist ${HOME}/.config/google-chrome 9noblacklist ${HOME}/.config/google-chrome
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-programs.inc
15 10
16mkdir ${HOME}/.cache/google-chrome 11mkdir ${HOME}/.cache/google-chrome
17mkdir ${HOME}/.config/google-chrome 12mkdir ${HOME}/.config/google-chrome
18mkdir ${HOME}/.pki
19whitelist ${DOWNLOADS}
20whitelist ${HOME}/.cache/google-chrome 13whitelist ${HOME}/.cache/google-chrome
21whitelist ${HOME}/.config/google-chrome 14whitelist ${HOME}/.config/google-chrome
22whitelist ${HOME}/.pki
23include /etc/firejail/whitelist-common.inc
24include /etc/firejail/whitelist-var-common.inc
25
26caps.keep sys_chroot,sys_admin
27netfilter
28nodvd
29nogroups
30notv
31shell none
32
33disable-mnt
34private-dev
35# private-tmp - problems with multiple browser sessions
36 15
37noexec ${HOME} 16# Redirect
38noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/gwenview.profile b/etc/gwenview.profile
index 8ad3ac5f3..58e059087 100644
--- a/etc/gwenview.profile
+++ b/etc/gwenview.profile
@@ -39,7 +39,7 @@ tracelog
39 39
40private-bin gwenview,gimp*,kbuildsycoca4,kdeinit4 40private-bin gwenview,gimp*,kbuildsycoca4,kdeinit4
41private-dev 41private-dev
42# private-etc X11 42private-etc fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,machine-id,xdg
43 43
44# memory-deny-write-execute 44# memory-deny-write-execute
45noexec ${HOME} 45noexec ${HOME}
diff --git a/etc/hexchat.profile b/etc/hexchat.profile
index 634ced575..02f8e9eeb 100644
--- a/etc/hexchat.profile
+++ b/etc/hexchat.profile
@@ -6,6 +6,7 @@ include /etc/firejail/hexchat.local
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.config/hexchat 8noblacklist ${HOME}/.config/hexchat
9noblacklist /usr/share/perl*
9# noblacklist /usr/lib/python2* 10# noblacklist /usr/lib/python2*
10# noblacklist /usr/lib/python3* 11# noblacklist /usr/lib/python3*
11 12
diff --git a/etc/icecat.profile b/etc/icecat.profile
index 9e5526c95..42e762c21 100644
--- a/etc/icecat.profile
+++ b/etc/icecat.profile
@@ -7,46 +7,14 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/mozilla 8noblacklist ${HOME}/.cache/mozilla
9noblacklist ${HOME}/.mozilla 9noblacklist ${HOME}/.mozilla
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-programs.inc
15 10
16mkdir ${HOME}/.cache/mozilla/icecat 11mkdir ${HOME}/.cache/mozilla/icecat
17mkdir ${HOME}/.mozilla 12mkdir ${HOME}/.mozilla
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.cache/gnome-mplayer/plugin
20whitelist ${HOME}/.cache/mozilla/icecat 13whitelist ${HOME}/.cache/mozilla/icecat
21whitelist ${HOME}/.config/gnome-mplayer
22whitelist ${HOME}/.config/pipelight-silverlight5.1
23whitelist ${HOME}/.config/pipelight-widevine
24whitelist ${HOME}/.keysnail.js
25whitelist ${HOME}/.lastpass
26whitelist ${HOME}/.mozilla 14whitelist ${HOME}/.mozilla
27whitelist ${HOME}/.pentadactyl
28whitelist ${HOME}/.pentadactylrc
29whitelist ${HOME}/.pki
30whitelist ${HOME}/.vimperator
31whitelist ${HOME}/.vimperatorrc
32whitelist ${HOME}/.wine-pipelight
33whitelist ${HOME}/.wine-pipelight64
34whitelist ${HOME}/.zotero
35whitelist ${HOME}/dwhelper
36include /etc/firejail/whitelist-common.inc
37
38caps.drop all
39netfilter
40nodvd
41nonewprivs
42noroot
43notv
44protocol unix,inet,inet6,netlink
45seccomp
46tracelog
47 15
48disable-mnt 16# private-etc must first be enabled in firefox-common.profile
49# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse 17#private-etc icecat
50 18
51noexec ${HOME} 19# Redirect
52noexec /tmp 20include /etc/firejail/firefox-common.profile
diff --git a/etc/iceweasel.profile b/etc/iceweasel.profile
index f6b57dde0..51f15aa1b 100644
--- a/etc/iceweasel.profile
+++ b/etc/iceweasel.profile
@@ -5,6 +5,8 @@ include /etc/firejail/iceweasel.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8# private-etc must first be enabled in firefox-common.profile
9#private-etc iceweasel
8 10
9# Redirect 11# Redirect
10include /etc/firejail/firefox.profile 12include /etc/firejail/firefox.profile
diff --git a/etc/inox.profile b/etc/inox.profile
index fbc654434..652761c54 100644
--- a/etc/inox.profile
+++ b/etc/inox.profile
@@ -7,30 +7,11 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/inox 8noblacklist ${HOME}/.cache/inox
9noblacklist ${HOME}/.config/inox 9noblacklist ${HOME}/.config/inox
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-programs.inc
14 10
15mkdir ${HOME}/.cache/inox 11mkdir ${HOME}/.cache/inox
16mkdir ${HOME}/.config/inox 12mkdir ${HOME}/.config/inox
17mkdir ${HOME}/.pki
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.cache/inox 13whitelist ${HOME}/.cache/inox
20whitelist ${HOME}/.config/inox 14whitelist ${HOME}/.config/inox
21whitelist ${HOME}/.pki
22include /etc/firejail/whitelist-common.inc
23include /etc/firejail/whitelist-var-common.inc
24
25caps.keep sys_chroot,sys_admin
26netfilter
27nodvd
28nogroups
29notv
30shell none
31
32private-dev
33# private-tmp - problems with multiple browser sessions
34 15
35noexec ${HOME} 16# Redirect
36noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/iridium.profile b/etc/iridium.profile
index 76026722f..2869c3070 100644
--- a/etc/iridium.profile
+++ b/etc/iridium.profile
@@ -8,30 +8,10 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.cache/iridium 8noblacklist ${HOME}/.cache/iridium
9noblacklist ${HOME}/.config/iridium 9noblacklist ${HOME}/.config/iridium
10 10
11include /etc/firejail/disable-common.inc
12# chromium/iridium is distributed with a perl script on Arch
13# include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-programs.inc
15
16mkdir ${HOME}/.cache/iridium 11mkdir ${HOME}/.cache/iridium
17mkdir ${HOME}/.config/iridium 12mkdir ${HOME}/.config/iridium
18mkdir ${HOME}/.pki
19whitelist ${DOWNLOADS}
20whitelist ${HOME}/.cache/iridium 13whitelist ${HOME}/.cache/iridium
21whitelist ${HOME}/.config/iridium 14whitelist ${HOME}/.config/iridium
22whitelist ${HOME}/.pki
23include /etc/firejail/whitelist-common.inc
24include /etc/firejail/whitelist-var-common.inc
25
26caps.keep sys_chroot,sys_admin
27netfilter
28nodvd
29nogroups
30notv
31shell none
32
33private-dev
34# private-tmp - problems with multiple browser sessions
35 15
36noexec ${HOME} 16# Redirect
37noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/kaffeine.profile b/etc/kaffeine.profile
new file mode 100644
index 000000000..07280ab6d
--- /dev/null
+++ b/etc/kaffeine.profile
@@ -0,0 +1,37 @@
1# Firejail profile for kaffeine
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/kaffeine.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8noblacklist ${HOME}/.config/kaffeinerc
9noblacklist ${HOME}/.kde/share/apps/kaffeine
10noblacklist ${HOME}/.kde/share/config/kaffeinerc
11noblacklist ${HOME}/.kde4/share/apps/kaffeine
12noblacklist ${HOME}/.kde4/share/config/kaffeinerc
13noblacklist ${HOME}/.local/share/kaffeine
14
15include /etc/firejail/disable-common.inc
16include /etc/firejail/disable-devel.inc
17include /etc/firejail/disable-passwdmgr.inc
18include /etc/firejail/disable-programs.inc
19
20include /etc/firejail/whitelist-var-common.inc
21
22caps.drop all
23netfilter
24nogroups
25nonewprivs
26noroot
27novideo
28protocol unix,inet,inet6
29seccomp
30shell none
31
32# private-bin kaffeine
33private-dev
34private-tmp
35
36noexec ${HOME}
37noexec /tmp
diff --git a/etc/kdenlive.profile b/etc/kdenlive.profile
index 871706b02..b6d48356d 100644
--- a/etc/kdenlive.profile
+++ b/etc/kdenlive.profile
@@ -6,6 +6,9 @@ include /etc/firejail/kdenlive.local
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8# blacklist /run/user/*/bus 8# blacklist /run/user/*/bus
9noblacklist ${HOME}/.cache/kdenlive
10noblacklist ${HOME}/.config/kdenliverc
11noblacklist ${HOME}/.local/share/kdenlive
9 12
10include /etc/firejail/disable-common.inc 13include /etc/firejail/disable-common.inc
11include /etc/firejail/disable-devel.inc 14include /etc/firejail/disable-devel.inc
@@ -25,7 +28,7 @@ shell none
25 28
26private-bin kdenlive,kdenlive_render,dbus-launch,melt,ffmpeg,ffplay,ffprobe,dvdauthor,genisoimage,vlc,xine,kdeinit5,kshell5,kdeinit5_shutdown,kdeinit5_wrapper,kdeinit4,kshell4,kdeinit4_shutdown,kdeinit4_wrapper 29private-bin kdenlive,kdenlive_render,dbus-launch,melt,ffmpeg,ffplay,ffprobe,dvdauthor,genisoimage,vlc,xine,kdeinit5,kshell5,kdeinit5_shutdown,kdeinit5_wrapper,kdeinit4,kshell4,kdeinit4_shutdown,kdeinit4_wrapper
27private-dev 30private-dev
28# private-etc fonts,alternatives,X11,pulse,passwd 31# private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,xdg,X11
29 32
30# noexec ${HOME} 33# noexec ${HOME}
31noexec /tmp 34noexec /tmp
diff --git a/etc/kget.profile b/etc/kget.profile
index 25c66e044..c4e073c2b 100644
--- a/etc/kget.profile
+++ b/etc/kget.profile
@@ -5,10 +5,12 @@ include /etc/firejail/kget.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.config/kgetrc
8noblacklist ${HOME}/.kde/share/apps/kget 9noblacklist ${HOME}/.kde/share/apps/kget
9noblacklist ${HOME}/.kde/share/config/kgetrc 10noblacklist ${HOME}/.kde/share/config/kgetrc
10noblacklist ${HOME}/.kde4/share/apps/kget 11noblacklist ${HOME}/.kde4/share/apps/kget
11noblacklist ${HOME}/.kde4/share/config/kgetrc 12noblacklist ${HOME}/.kde4/share/config/kgetrc
13noblacklist ${HOME}/.local/share/kget
12 14
13include /etc/firejail/disable-common.inc 15include /etc/firejail/disable-common.inc
14include /etc/firejail/disable-devel.inc 16include /etc/firejail/disable-devel.inc
diff --git a/etc/kmail.profile b/etc/kmail.profile
index 7aad57987..ca774f4ec 100644
--- a/etc/kmail.profile
+++ b/etc/kmail.profile
@@ -25,6 +25,8 @@ protocol unix,inet,inet6,netlink
25# blacklisting of chroot system calls breaks kmail 25# blacklisting of chroot system calls breaks kmail
26seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice 26seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
27# tracelog 27# tracelog
28# writable-run-user is needed for signing and encrypting emails
29writable-run-user
28 30
29private-dev 31private-dev
30# private-tmp 32# private-tmp - breaks akonadi and opening of email attachments
diff --git a/etc/krita.profile b/etc/krita.profile
index 0d2b62c5d..c621e2c72 100644
--- a/etc/krita.profile
+++ b/etc/krita.profile
@@ -7,6 +7,7 @@ include /etc/firejail/globals.local
7 7
8# blacklist /run/user/*/bus 8# blacklist /run/user/*/bus
9noblacklist ${HOME}/.config/kritarc 9noblacklist ${HOME}/.config/kritarc
10noblacklist ${HOME}/.local/share/krita
10 11
11include /etc/firejail/disable-common.inc 12include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc 13include /etc/firejail/disable-devel.inc
diff --git a/etc/krunner.profile b/etc/krunner.profile
index 606b67677..1e97f4290 100644
--- a/etc/krunner.profile
+++ b/etc/krunner.profile
@@ -5,12 +5,15 @@ include /etc/firejail/krunner.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8# start a program in krunner: program will run with this generic profile 8# - programs started in krunner run with this generic profile.
9# open a file in krunner: file viewer will run with its own profile (if firejailed automatically) 9# - when a file is opened in krunner, the file viewer runs in its own sandbox
10# with its own profile, if it is sandboxed automatically.
10 11
12# noblacklist ${HOME}/.cache/krunner
11noblacklist ${HOME}/.config/krunnerrc 13noblacklist ${HOME}/.config/krunnerrc
12noblacklist ${HOME}/.kde/share/config/krunnerrc 14noblacklist ${HOME}/.kde/share/config/krunnerrc
13noblacklist ${HOME}/.kde4/share/config/krunnerrc 15noblacklist ${HOME}/.kde4/share/config/krunnerrc
16# noblacklist ${HOME}/.local/share/baloo
14 17
15include /etc/firejail/disable-common.inc 18include /etc/firejail/disable-common.inc
16# include /etc/firejail/disable-devel.inc 19# include /etc/firejail/disable-devel.inc
@@ -21,6 +24,7 @@ include /etc/firejail/whitelist-var-common.inc
21 24
22caps.drop all 25caps.drop all
23netfilter 26netfilter
27nogroups
24nonewprivs 28nonewprivs
25noroot 29noroot
26protocol unix,inet,inet6 30protocol unix,inet,inet6
diff --git a/etc/kwin_x11.profile b/etc/kwin_x11.profile
index 91bb62efc..534e7cd51 100644
--- a/etc/kwin_x11.profile
+++ b/etc/kwin_x11.profile
@@ -5,6 +5,7 @@ include /etc/firejail/kwin_x11.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/kwin
8noblacklist ${HOME}/.config/kwinrc 9noblacklist ${HOME}/.config/kwinrc
9noblacklist ${HOME}/.config/kwinrulesrc 10noblacklist ${HOME}/.config/kwinrulesrc
10noblacklist ${HOME}/.local/share/kwin 11noblacklist ${HOME}/.local/share/kwin
@@ -33,7 +34,7 @@ tracelog
33disable-mnt 34disable-mnt
34private-bin kwin_x11 35private-bin kwin_x11
35private-dev 36private-dev
36private-etc drirc,fonts,ld.so.cache,machine-id,xdg 37private-etc drirc,fonts,kde5rc,ld.so.cache,machine-id,xdg
37private-tmp 38private-tmp
38 39
39noexec ${HOME} 40noexec ${HOME}
diff --git a/etc/libreoffice.profile b/etc/libreoffice.profile
index 3548a75ad..220e0f02c 100644
--- a/etc/libreoffice.profile
+++ b/etc/libreoffice.profile
@@ -34,3 +34,5 @@ private-tmp
34 34
35noexec ${HOME} 35noexec ${HOME}
36noexec /tmp 36noexec /tmp
37
38join-or-start libreoffice
diff --git a/etc/okular.profile b/etc/okular.profile
index 31b773852..d98d4792f 100644
--- a/etc/okular.profile
+++ b/etc/okular.profile
@@ -7,6 +7,7 @@ include /etc/firejail/globals.local
7 7
8# blacklist /run/user/*/bus 8# blacklist /run/user/*/bus
9 9
10noblacklist ${HOME}/.cache/okular
10noblacklist ${HOME}/.config/okularpartrc 11noblacklist ${HOME}/.config/okularpartrc
11noblacklist ${HOME}/.config/okularrc 12noblacklist ${HOME}/.config/okularrc
12noblacklist ${HOME}/.kde/share/apps/okular 13noblacklist ${HOME}/.kde/share/apps/okular
@@ -42,7 +43,7 @@ tracelog
42 43
43private-bin okular,kbuildsycoca4,kdeinit4,lpr 44private-bin okular,kbuildsycoca4,kdeinit4,lpr
44private-dev 45private-dev
45private-etc alternatives,cups,fonts,ld.so.cache,machine-id 46private-etc alternatives,cups,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg
46# private-tmp - on KDE we need access to the real /tmp for data exchange with email clients 47# private-tmp - on KDE we need access to the real /tmp for data exchange with email clients
47 48
48# memory-deny-write-execute 49# memory-deny-write-execute
diff --git a/etc/opera-beta.profile b/etc/opera-beta.profile
index 3fe86d26c..38a3152d2 100644
--- a/etc/opera-beta.profile
+++ b/etc/opera-beta.profile
@@ -5,24 +5,13 @@ include /etc/firejail/opera-beta.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/opera
8noblacklist ${HOME}/.config/opera-beta 9noblacklist ${HOME}/.config/opera-beta
9noblacklist ${HOME}/.pki
10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-programs.inc
14 10
15mkdir ${HOME}/.cache/opera 11mkdir ${HOME}/.cache/opera
16mkdir ${HOME}/.config/opera-beta 12mkdir ${HOME}/.config/opera-beta
17mkdir ${HOME}/.pki
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.cache/opera 13whitelist ${HOME}/.cache/opera
20whitelist ${HOME}/.config/opera-beta 14whitelist ${HOME}/.config/opera-beta
21whitelist ${HOME}/.pki
22include /etc/firejail/whitelist-common.inc
23
24netfilter
25nodvd
26notv
27 15
28disable-mnt 16# Redirect
17include /etc/firejail/chromium-common.profile
diff --git a/etc/opera.profile b/etc/opera.profile
index fed7564b2..c0138c555 100644
--- a/etc/opera.profile
+++ b/etc/opera.profile
@@ -8,25 +8,13 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.cache/opera 8noblacklist ${HOME}/.cache/opera
9noblacklist ${HOME}/.config/opera 9noblacklist ${HOME}/.config/opera
10noblacklist ${HOME}/.opera 10noblacklist ${HOME}/.opera
11noblacklist ${HOME}/.pki
12
13include /etc/firejail/disable-common.inc
14include /etc/firejail/disable-devel.inc
15include /etc/firejail/disable-programs.inc
16 11
17mkdir ${HOME}/.cache/opera 12mkdir ${HOME}/.cache/opera
18mkdir ${HOME}/.config/opera 13mkdir ${HOME}/.config/opera
19mkdir ${HOME}/.opera 14mkdir ${HOME}/.opera
20mkdir ${HOME}/.pki
21whitelist ${DOWNLOADS}
22whitelist ${HOME}/.cache/opera 15whitelist ${HOME}/.cache/opera
23whitelist ${HOME}/.config/opera 16whitelist ${HOME}/.config/opera
24whitelist ${HOME}/.opera 17whitelist ${HOME}/.opera
25whitelist ${HOME}/.pki
26include /etc/firejail/whitelist-common.inc
27
28netfilter
29nodvd
30notv
31 18
32disable-mnt 19# Redirect
20include /etc/firejail/chromium-common.profile
diff --git a/etc/palemoon.profile b/etc/palemoon.profile
index 1112a9bb7..ff7087e55 100644
--- a/etc/palemoon.profile
+++ b/etc/palemoon.profile
@@ -8,53 +8,15 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.cache/moonchild productions/pale moon 8noblacklist ${HOME}/.cache/moonchild productions/pale moon
9noblacklist ${HOME}/.moonchild productions/pale moon 9noblacklist ${HOME}/.moonchild productions/pale moon
10 10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-programs.inc
14
15# These are uncommented in the Firefox profile. If you run into trouble you may
16# want to uncomment (some of) them.
17#whitelist ${HOME}/dwhelper
18#whitelist ${HOME}/.zotero
19#whitelist ${HOME}/.vimperatorrc
20#whitelist ${HOME}/.vimperator
21#whitelist ${HOME}/.pentadactylrc
22#whitelist ${HOME}/.pentadactyl
23#whitelist ${HOME}/.keysnail.js
24#whitelist ${HOME}/.config/gnome-mplayer
25#whitelist ${HOME}/.cache/gnome-mplayer/plugin
26#whitelist ${HOME}/.pki
27#whitelist ${HOME}/.lastpass
28
29# For silverlight
30#whitelist ${HOME}/.wine-pipelight
31#whitelist ${HOME}/.wine-pipelight64
32#whitelist ${HOME}/.config/pipelight-widevine
33#whitelist ${HOME}/.config/pipelight-silverlight5.1
34
35mkdir ${HOME}/.cache/moonchild productions/pale moon 11mkdir ${HOME}/.cache/moonchild productions/pale moon
36mkdir ${HOME}/.moonchild productions 12mkdir ${HOME}/.moonchild productions
37whitelist ${DOWNLOADS}
38whitelist ${HOME}/.cache/moonchild productions/pale moon 13whitelist ${HOME}/.cache/moonchild productions/pale moon
39whitelist ${HOME}/.moonchild productions 14whitelist ${HOME}/.moonchild productions
40include /etc/firejail/whitelist-common.inc
41
42caps.drop all
43netfilter
44nodvd
45nogroups
46nonewprivs
47noroot
48notv
49protocol unix,inet,inet6,netlink
50seccomp
51shell none
52tracelog
53 15
54# private-bin palemoon 16#private-bin palemoon
55# private-dev (disabled for now as it will interfere with webcam use in palemoon) 17# private-etc must first be enabled in firefox-common.profile
56# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse 18#private-etc palemoon
57# private-opt palemoon 19#private-opt palemoon
58private-tmp
59 20
60disable-mnt 21# Redirect
22include /etc/firejail/firefox-common.profile
diff --git a/etc/pdfchain.profile b/etc/pdfchain.profile
new file mode 100755
index 000000000..d43c0911e
--- /dev/null
+++ b/etc/pdfchain.profile
@@ -0,0 +1,39 @@
1# Firejail profile for pdfchain
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/pdfchain.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8
9blacklist /run/user/*/bus
10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-programs.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-passwdmgr.inc
15
16include /etc/firejail/whitelist-var-common.inc
17
18caps.drop all
19ipc-namespace
20net none
21no3d
22nogroups
23nonewprivs
24noroot
25nosound
26notv
27novideo
28protocol unix
29seccomp
30shell none
31
32private-bin pdfchain,pdftk,sh
33private-dev
34private-etc dconf,fonts,gtk-3.0,xdg
35private-tmp
36
37memory-deny-write-execute
38noexec ${HOME}
39noexec /tmp
diff --git a/etc/qbittorrent.profile b/etc/qbittorrent.profile
index a01b1e9a8..da870ab76 100644
--- a/etc/qbittorrent.profile
+++ b/etc/qbittorrent.profile
@@ -8,6 +8,7 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.cache/qBittorrent 8noblacklist ${HOME}/.cache/qBittorrent
9noblacklist ${HOME}/.config/qBittorrent 9noblacklist ${HOME}/.config/qBittorrent
10noblacklist ${HOME}/.config/qBittorrentrc 10noblacklist ${HOME}/.config/qBittorrentrc
11noblacklist ${HOME}/.local/share/data/qBittorrent
11 12
12include /etc/firejail/disable-common.inc 13include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc 14include /etc/firejail/disable-devel.inc
diff --git a/etc/qtox.profile b/etc/qtox.profile
index a8d980a18..648282db4 100644
--- a/etc/qtox.profile
+++ b/etc/qtox.profile
@@ -33,7 +33,7 @@ tracelog
33 33
34disable-mnt 34disable-mnt
35private-bin qtox 35private-bin qtox
36private-etc fonts,resolv.conf,ld.so.cache 36private-etc fonts,resolv.conf,ld.so.cache,localtime
37private-dev 37private-dev
38private-tmp 38private-tmp
39 39
diff --git a/etc/remmina.profile b/etc/remmina.profile
index 3bb6aa0b1..cc209b84a 100644
--- a/etc/remmina.profile
+++ b/etc/remmina.profile
@@ -5,6 +5,7 @@ include /etc/firejail/remmina.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.remmina
8noblacklist ${HOME}/.config/remmina 9noblacklist ${HOME}/.config/remmina
9noblacklist ${HOME}/.local/share/remmina 10noblacklist ${HOME}/.local/share/remmina
10noblacklist ${HOME}/.ssh 11noblacklist ${HOME}/.ssh
@@ -23,6 +24,7 @@ notv
23novideo 24novideo
24protocol unix,inet,inet6 25protocol unix,inet,inet6
25seccomp 26seccomp
27# seccomp.keep access,arch_prctl,brk,chmod,clock_getres,clock_gettime,clone,close,connect,dup3,eventfd2,execve,fadvise64,fallocate,fcntl,flock,fstat,fstatfs,fsync,ftruncate,futex,getdents,getegid,geteuid,getgid,getpeername,getpid,getrandom,getresgid,getresuid,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init1,inotify_rm_watch,ioctl,lseek,lstat,madvise,memfd_create,mmap,mprotect,mremap,munmap,nanosleep,open,openat,pipe,pipe2,poll,prctl,prlimit64,pwrite64,read,readlink,recvfrom,recvmsg,rename,rt_sigaction,rt_sigprocmask,sendmmsg,sendmsg,sendto,set_robust_list,setsockopt,set_tid_address,shmat,shmctl,shmdt,shmget,shutdown,socket,stat,statfs,sysinfo,tgkill,uname,utimensat,write,writev
26shell none 28shell none
27 29
28private-dev 30private-dev
diff --git a/etc/scribus.profile b/etc/scribus.profile
index 001b91387..8ce63fbf0 100644
--- a/etc/scribus.profile
+++ b/etc/scribus.profile
@@ -8,6 +8,7 @@ include /etc/firejail/globals.local
8blacklist /run/user/*/bus 8blacklist /run/user/*/bus
9 9
10# Support for PDF readers comes with Scribus 1.5 and higher 10# Support for PDF readers comes with Scribus 1.5 and higher
11noblacklist ${HOME}/.cache/okular
11noblacklist ${HOME}/.config/okularpartrc 12noblacklist ${HOME}/.config/okularpartrc
12noblacklist ${HOME}/.config/okularrc 13noblacklist ${HOME}/.config/okularrc
13noblacklist ${HOME}/.config/scribus 14noblacklist ${HOME}/.config/scribus
diff --git a/etc/soundconverter.profile b/etc/soundconverter.profile
index c27fb3819..1f64567ef 100644
--- a/etc/soundconverter.profile
+++ b/etc/soundconverter.profile
@@ -5,8 +5,6 @@ include /etc/firejail/soundconverter.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8blacklist /run/user/*/bus
9
10include /etc/firejail/disable-common.inc 8include /etc/firejail/disable-common.inc
11include /etc/firejail/disable-devel.inc 9include /etc/firejail/disable-devel.inc
12include /etc/firejail/disable-passwdmgr.inc 10include /etc/firejail/disable-passwdmgr.inc
diff --git a/etc/spotify.profile b/etc/spotify.profile
index 736bd3520..fcd0ab92e 100644
--- a/etc/spotify.profile
+++ b/etc/spotify.profile
@@ -42,7 +42,7 @@ shell none
42tracelog 42tracelog
43 43
44disable-mnt 44disable-mnt
45private-bin spotify,bash,sh 45private-bin spotify,bash,sh,zenity
46private-dev 46private-dev
47private-etc fonts,machine-id,pulse,resolv.conf 47private-etc fonts,machine-id,pulse,resolv.conf
48private-opt spotify 48private-opt spotify
diff --git a/etc/thunderbird.profile b/etc/thunderbird.profile
index 226781332..6045d6d17 100644
--- a/etc/thunderbird.profile
+++ b/etc/thunderbird.profile
@@ -21,14 +21,14 @@ whitelist ${HOME}/.cache/thunderbird
21whitelist ${HOME}/.gnupg 21whitelist ${HOME}/.gnupg
22# whitelist ${HOME}/.icedove 22# whitelist ${HOME}/.icedove
23whitelist ${HOME}/.thunderbird 23whitelist ${HOME}/.thunderbird
24include /etc/firejail/whitelist-common.inc
25include /etc/firejail/whitelist-var-common.inc
26 24
27# We need the real /tmp for data exchange when xdg-open handles email attachments on KDE 25# We need the real /tmp for data exchange when xdg-open handles email attachments on KDE
28ignore private-tmp 26ignore private-tmp
29# machine-id breaks pulse audio; it should work fine in setups where sound is not required 27# machine-id breaks audio in browsers; enable it when sound is not required
30#machine-id 28# machine-id
31read-only ${HOME}/.config/mimeapps.list 29read-only ${HOME}/.config/mimeapps.list
30# writable-run-user is needed for signing and encrypting emails
31writable-run-user
32 32
33# allow browsers 33# allow browsers
34# Redirect 34# Redirect
diff --git a/etc/tilp.profile b/etc/tilp.profile
new file mode 100644
index 000000000..a6165fbfe
--- /dev/null
+++ b/etc/tilp.profile
@@ -0,0 +1,34 @@
1# Firejail profile for tilp
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/tilp.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8noblacklist ${HOME}/.tilp
9
10include /etc/firejail/disable-common.inc
11include /etc/firejail/disable-devel.inc
12include /etc/firejail/disable-passwdmgr.inc
13include /etc/firejail/disable-programs.inc
14
15caps.drop all
16net none
17nodvd
18nogroups
19nonewprivs
20noroot
21notv
22novideo
23protocol unix,netlink
24seccomp
25shell none
26tracelog
27
28disable-mnt
29private-bin tilp
30private-etc fonts
31private-tmp
32
33noexec ${HOME}
34noexec /tmp
diff --git a/etc/torbrowser-launcher.profile b/etc/torbrowser-launcher.profile
index e97ce6740..02ef57cce 100644
--- a/etc/torbrowser-launcher.profile
+++ b/etc/torbrowser-launcher.profile
@@ -13,6 +13,8 @@ include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-passwdmgr.inc 13include /etc/firejail/disable-passwdmgr.inc
14include /etc/firejail/disable-programs.inc 14include /etc/firejail/disable-programs.inc
15 15
16mkdir ${HOME}/.config/torbrowser
17mkdir ${HOME}/.local/share/torbrowser
16whitelist ${HOME}/.config/torbrowser 18whitelist ${HOME}/.config/torbrowser
17whitelist ${HOME}/.local/share/torbrowser 19whitelist ${HOME}/.local/share/torbrowser
18include /etc/firejail/whitelist-common.inc 20include /etc/firejail/whitelist-common.inc
diff --git a/etc/unbound.profile b/etc/unbound.profile
index c03a25752..233e7464f 100644
--- a/etc/unbound.profile
+++ b/etc/unbound.profile
@@ -15,6 +15,9 @@ include /etc/firejail/disable-devel.inc
15include /etc/firejail/disable-passwdmgr.inc 15include /etc/firejail/disable-passwdmgr.inc
16include /etc/firejail/disable-programs.inc 16include /etc/firejail/disable-programs.inc
17 17
18whitelist /var/lib/unbound
19whitelist /var/run
20
18caps.keep net_bind_service,setgid,setuid,sys_chroot,sys_resource 21caps.keep net_bind_service,setgid,setuid,sys_chroot,sys_resource
19no3d 22no3d
20nodvd 23nodvd
@@ -23,6 +26,7 @@ nosound
23notv 26notv
24novideo 27novideo
25seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open 28seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open
29writable-var
26 30
27disable-mnt 31disable-mnt
28private 32private
diff --git a/etc/vivaldi.profile b/etc/vivaldi.profile
index 3a1f72f23..aeef58292 100644
--- a/etc/vivaldi.profile
+++ b/etc/vivaldi.profile
@@ -8,28 +8,10 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.cache/vivaldi 8noblacklist ${HOME}/.cache/vivaldi
9noblacklist ${HOME}/.config/vivaldi 9noblacklist ${HOME}/.config/vivaldi
10 10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-programs.inc
14
15mkdir ${HOME}/.cache/vivaldi 11mkdir ${HOME}/.cache/vivaldi
16mkdir ${HOME}/.config/vivaldi 12mkdir ${HOME}/.config/vivaldi
17whitelist ${DOWNLOADS}
18whitelist ${HOME}/.cache/vivaldi 13whitelist ${HOME}/.cache/vivaldi
19whitelist ${HOME}/.config/vivaldi 14whitelist ${HOME}/.config/vivaldi
20include /etc/firejail/whitelist-common.inc
21include /etc/firejail/whitelist-var-common.inc
22
23caps.keep sys_chroot,sys_admin
24netfilter
25nodvd
26nogroups
27notv
28shell none
29
30disable-mnt
31private-dev
32# private-tmp - problems with multiple browser sessions
33 15
34noexec ${HOME} 16# Redirect
35noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/waterfox.profile b/etc/waterfox.profile
index b2abb3a5f..fdd299bbf 100644
--- a/etc/waterfox.profile
+++ b/etc/waterfox.profile
@@ -7,83 +7,22 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/mozilla 8noblacklist ${HOME}/.cache/mozilla
9noblacklist ${HOME}/.cache/waterfox 9noblacklist ${HOME}/.cache/waterfox
10noblacklist ${HOME}/.config/okularpartrc
11noblacklist ${HOME}/.config/okularrc
12noblacklist ${HOME}/.config/qpdfview
13noblacklist ${HOME}/.kde/share/apps/okular
14noblacklist ${HOME}/.kde/share/config/okularpartrc
15noblacklist ${HOME}/.kde/share/config/okularrc
16noblacklist ${HOME}/.kde4/share/apps/okular
17noblacklist ${HOME}/.kde4/share/config/okularpartrc
18noblacklist ${HOME}/.kde4/share/config/okularrc
19# noblacklist ${HOME}/.local/share/gnome-shell/extensions
20noblacklist ${HOME}/.local/share/okular
21noblacklist ${HOME}/.local/share/qpdfview
22noblacklist ${HOME}/.mozilla 10noblacklist ${HOME}/.mozilla
23noblacklist ${HOME}/.waterfox 11noblacklist ${HOME}/.waterfox
24noblacklist ${HOME}/.pki
25
26include /etc/firejail/disable-common.inc
27include /etc/firejail/disable-devel.inc
28include /etc/firejail/disable-programs.inc
29 12
30mkdir ${HOME}/.cache/mozilla/firefox 13mkdir ${HOME}/.cache/mozilla/firefox
31mkdir ${HOME}/.mozilla 14mkdir ${HOME}/.mozilla
32mkdir ${HOME}/.cache/waterfox 15mkdir ${HOME}/.cache/waterfox
33mkdir ${HOME}/.waterfox 16mkdir ${HOME}/.waterfox
34mkdir ${HOME}/.pki
35whitelist ${DOWNLOADS}
36whitelist ${HOME}/.cache/gnome-mplayer/plugin
37whitelist ${HOME}/.cache/mozilla/firefox 17whitelist ${HOME}/.cache/mozilla/firefox
38whitelist ${HOME}/.cache/waterfox 18whitelist ${HOME}/.cache/waterfox
39whitelist ${HOME}/.config/gnome-mplayer
40whitelist ${HOME}/.config/okularpartrc
41whitelist ${HOME}/.config/okularrc
42whitelist ${HOME}/.config/pipelight-silverlight5.1
43whitelist ${HOME}/.config/pipelight-widevine
44whitelist ${HOME}/.config/qpdfview
45whitelist ${HOME}/.kde/share/apps/okular
46whitelist ${HOME}/.kde/share/config/okularpartrc
47whitelist ${HOME}/.kde/share/config/okularrc
48whitelist ${HOME}/.kde4/share/apps/okular
49whitelist ${HOME}/.kde4/share/config/okularpartrc
50whitelist ${HOME}/.kde4/share/config/okularrc
51whitelist ${HOME}/.keysnail.js
52whitelist ${HOME}/.lastpass
53whitelist ${HOME}/.local/share/gnome-shell/extensions
54whitelist ${HOME}/.local/share/okular
55whitelist ${HOME}/.local/share/qpdfview
56whitelist ${HOME}/.mozilla 19whitelist ${HOME}/.mozilla
57whitelist ${HOME}/.waterfox 20whitelist ${HOME}/.waterfox
58whitelist ${HOME}/.pentadactyl
59whitelist ${HOME}/.pentadactylrc
60whitelist ${HOME}/.pki
61whitelist ${HOME}/.vimperator
62whitelist ${HOME}/.vimperatorrc
63whitelist ${HOME}/.wine-pipelight
64whitelist ${HOME}/.wine-pipelight64
65whitelist ${HOME}/.zotero
66whitelist ${HOME}/dwhelper
67include /etc/firejail/whitelist-common.inc
68include /etc/firejail/whitelist-var-common.inc
69
70caps.drop all
71netfilter
72nodvd
73nogroups
74nonewprivs
75noroot
76notv
77protocol unix,inet,inet6,netlink
78seccomp
79shell none
80tracelog
81 21
82# waterfox requires a shell to launch on Arch. We can possibly remove sh though. 22# waterfox requires a shell to launch on Arch. We can possibly remove sh though.
83# private-bin waterfox,which,sh,dbus-launch,dbus-send,env,bash 23#private-bin waterfox,which,sh,dbus-launch,dbus-send,env,bash
84private-dev 24# private-etc must first be enabled in firefox-common.profile
85# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,waterfox,mime.types,mailcap,asound.conf,pulse 25#private-etc waterfox
86private-tmp
87 26
88noexec ${HOME} 27# Redirect
89noexec /tmp 28include /etc/firejail/firefox-common.profile
diff --git a/etc/whitelist-common.inc b/etc/whitelist-common.inc
index 3beb11bfb..c664d5a53 100644
--- a/etc/whitelist-common.inc
+++ b/etc/whitelist-common.inc
@@ -55,14 +55,20 @@ whitelist ${HOME}/.config/dconf
55whitelist ${HOME}/.config/Kvantum 55whitelist ${HOME}/.config/Kvantum
56whitelist ${HOME}/.config/Trolltech.conf 56whitelist ${HOME}/.config/Trolltech.conf
57whitelist ${HOME}/.config/kdeglobals 57whitelist ${HOME}/.config/kdeglobals
58whitelist ${HOME}/.config/kio_httprc
58whitelist ${HOME}/.config/kioslaverc 59whitelist ${HOME}/.config/kioslaverc
60whitelist ${HOME}/.config/ksslcablacklist
59whitelist ${HOME}/.config/qt5ct 61whitelist ${HOME}/.config/qt5ct
60whitelist ${HOME}/.kde/share/config/kdeglobals 62whitelist ${HOME}/.kde/share/config/kdeglobals
63whitelist ${HOME}/.kde/share/config/kio_httprc
61whitelist ${HOME}/.kde/share/config/kioslaverc 64whitelist ${HOME}/.kde/share/config/kioslaverc
65whitelist ${HOME}/.kde/share/config/ksslcablacklist
62whitelist ${HOME}/.kde/share/config/oxygenrc 66whitelist ${HOME}/.kde/share/config/oxygenrc
63whitelist ${HOME}/.kde/share/icons 67whitelist ${HOME}/.kde/share/icons
64whitelist ${HOME}/.kde4/share/config/kdeglobals 68whitelist ${HOME}/.kde4/share/config/kdeglobals
69whitelist ${HOME}/.kde4/share/config/kio_httprc
65whitelist ${HOME}/.kde4/share/config/kioslaverc 70whitelist ${HOME}/.kde4/share/config/kioslaverc
71whitelist ${HOME}/.kde4/share/config/ksslcablacklist
66whitelist ${HOME}/.kde4/share/config/oxygenrc 72whitelist ${HOME}/.kde4/share/config/oxygenrc
67whitelist ${HOME}/.kde4/share/icons 73whitelist ${HOME}/.kde4/share/icons
68whitelist ${HOME}/.local/share/qt5ct 74whitelist ${HOME}/.local/share/qt5ct
diff --git a/etc/yandex-browser.profile b/etc/yandex-browser.profile
index 1c7769727..fdb7694a5 100644
--- a/etc/yandex-browser.profile
+++ b/etc/yandex-browser.profile
@@ -9,35 +9,15 @@ noblacklist ${HOME}/.cache/yandex-browser
9noblacklist ${HOME}/.cache/yandex-browser-beta 9noblacklist ${HOME}/.cache/yandex-browser-beta
10noblacklist ${HOME}/.config/yandex-browser 10noblacklist ${HOME}/.config/yandex-browser
11noblacklist ${HOME}/.config/yandex-browser-beta 11noblacklist ${HOME}/.config/yandex-browser-beta
12noblacklist ${HOME}/.pki
13
14include /etc/firejail/disable-common.inc
15include /etc/firejail/disable-devel.inc
16include /etc/firejail/disable-programs.inc
17 12
18mkdir ${HOME}/.cache/yandex-browser 13mkdir ${HOME}/.cache/yandex-browser
19mkdir ${HOME}/.cache/yandex-browser-beta 14mkdir ${HOME}/.cache/yandex-browser-beta
20mkdir ${HOME}/.config/yandex-browser 15mkdir ${HOME}/.config/yandex-browser
21mkdir ${HOME}/.config/yandex-browser-beta 16mkdir ${HOME}/.config/yandex-browser-beta
22mkdir ${HOME}/.pki
23whitelist ${DOWNLOADS}
24whitelist ${HOME}/.cache/yandex-browser 17whitelist ${HOME}/.cache/yandex-browser
25whitelist ${HOME}/.cache/yandex-browser-beta 18whitelist ${HOME}/.cache/yandex-browser-beta
26whitelist ${HOME}/.config/yandex-browser 19whitelist ${HOME}/.config/yandex-browser
27whitelist ${HOME}/.config/yandex-browser-beta 20whitelist ${HOME}/.config/yandex-browser-beta
28whitelist ${HOME}/.pki
29include /etc/firejail/whitelist-common.inc
30
31caps.keep sys_chroot,sys_admin
32netfilter
33nodvd
34nogroups
35notv
36shell none
37
38disable-mnt
39private-dev
40# private-tmp - problems with multiple browser sessions
41 21
42noexec ${HOME} 22# Redirect
43noexec /tmp 23include /etc/firejail/chromium-common.profile
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index e9e1db287..9bd60171b 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -185,6 +185,7 @@ iridium-browser
185jd-gui 185jd-gui
186jitsi 186jitsi
187k3b 187k3b
188kaffeine
188karbon 189karbon
189kate 190kate
190kcalc 191kcalc
@@ -265,6 +266,7 @@ opera-beta
265orage 266orage
266palemoon 267palemoon
267parole 268parole
269pdfchain
268pdfmod 270pdfmod
269pdfsam 271pdfsam
270pdftotext 272pdftotext
@@ -336,6 +338,7 @@ telegram
336telegram-desktop 338telegram-desktop
337terasology 339terasology
338thunderbird 340thunderbird
341tilp
339tor-browser-ar 342tor-browser-ar
340tor-browser-en 343tor-browser-en
341tor-browser-en-us 344tor-browser-en-us
diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c
index 7436b7755..631276c0b 100644
--- a/src/firejail/appimage.c
+++ b/src/firejail/appimage.c
@@ -109,10 +109,12 @@ void appimage_set(const char *appimage) {
109 EUID_ROOT(); 109 EUID_ROOT();
110 110
111 if (size == 0) { 111 if (size == 0) {
112 fmessage("Mounting appimage type 1\n");
112 if (mount(devloop, mntdir, "iso9660",MS_MGC_VAL|MS_RDONLY, mode) < 0) 113 if (mount(devloop, mntdir, "iso9660",MS_MGC_VAL|MS_RDONLY, mode) < 0)
113 errExit("mounting appimage"); 114 errExit("mounting appimage");
114 } 115 }
115 else { 116 else {
117 fmessage("Mounting appimage type 2\n");
116 if (mount(devloop, mntdir, "squashfs",MS_MGC_VAL|MS_RDONLY, mode) < 0) 118 if (mount(devloop, mntdir, "squashfs",MS_MGC_VAL|MS_RDONLY, mode) < 0)
117 errExit("mounting appimage"); 119 errExit("mounting appimage");
118 } 120 }
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 97e740e6b..e8dc390d4 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -513,7 +513,7 @@ const char *gnu_basename(const char *path);
513uid_t pid_get_uid(pid_t pid); 513uid_t pid_get_uid(pid_t pid);
514void invalid_filename(const char *fname, int globbing); 514void invalid_filename(const char *fname, int globbing);
515uid_t get_group_id(const char *group); 515uid_t get_group_id(const char *group);
516int remove_directory(const char *path); 516int remove_overlay_directory(void);
517void flush_stdin(void); 517void flush_stdin(void);
518void create_empty_dir_as_root(const char *dir, mode_t mode); 518void create_empty_dir_as_root(const char *dir, mode_t mode);
519void create_empty_file_as_root(const char *dir, mode_t mode); 519void create_empty_file_as_root(const char *dir, mode_t mode);
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index ab2958593..25b52f5ce 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -725,7 +725,7 @@ char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
725 errExit("asprintf"); 725 errExit("asprintf");
726 726
727 if (is_link(dirname)) { 727 if (is_link(dirname)) {
728 fprintf(stderr, "Error: invalid ~/.firejail directory\n"); 728 fprintf(stderr, "Error: ~/.firejail directory is a symbolic link\n");
729 exit(1); 729 exit(1);
730 } 730 }
731 if (stat(dirname, &s) == -1) { 731 if (stat(dirname, &s) == -1) {
@@ -753,7 +753,7 @@ char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
753 } 753 }
754 } 754 }
755 else if (s.st_uid != getuid()) { 755 else if (s.st_uid != getuid()) {
756 fprintf(stderr, "Error: invalid ~/.firejail directory\n"); 756 fprintf(stderr, "Error: ~/.firejail directory is not owned by the current user\n");
757 exit(1); 757 exit(1);
758 } 758 }
759 free(dirname); 759 free(dirname);
@@ -837,6 +837,7 @@ void fs_overlayfs(void) {
837 if (arg_overlay_keep) { 837 if (arg_overlay_keep) {
838 // set base for working and diff directories 838 // set base for working and diff directories
839 basedir = cfg.overlay_dir; 839 basedir = cfg.overlay_dir;
840 assert(basedir);
840 841
841 // does the overlay exist? 842 // does the overlay exist?
842 if (stat(basedir, &s) == 0) { 843 if (stat(basedir, &s) == 0) {
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 00e3729d0..7543c5f4b 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -314,16 +314,10 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
314#ifdef HAVE_OVERLAYFS 314#ifdef HAVE_OVERLAYFS
315 else if (strcmp(argv[i], "--overlay-clean") == 0) { 315 else if (strcmp(argv[i], "--overlay-clean") == 0) {
316 if (checkcfg(CFG_OVERLAYFS)) { 316 if (checkcfg(CFG_OVERLAYFS)) {
317 char *path; 317 if (remove_overlay_directory()) {
318 if (asprintf(&path, "%s/.firejail", cfg.homedir) == -1) 318 fprintf(stderr, "Error: cannot remove overlay directory\n");
319 errExit("asprintf"); 319 exit(1);
320 EUID_ROOT(); 320 }
321 if (setreuid(0, 0) < 0 ||
322 setregid(0, 0) < 0)
323 errExit("setreuid/setregid");
324 errno = 0;
325 if (remove_directory(path))
326 errExit("remove_directory");
327 } 321 }
328 else 322 else
329 exit_err_feature("overlayfs"); 323 exit_err_feature("overlayfs");
@@ -1429,6 +1423,11 @@ int main(int argc, char **argv) {
1429#ifdef HAVE_OVERLAYFS 1423#ifdef HAVE_OVERLAYFS
1430 else if (strcmp(argv[i], "--overlay") == 0) { 1424 else if (strcmp(argv[i], "--overlay") == 0) {
1431 if (checkcfg(CFG_OVERLAYFS)) { 1425 if (checkcfg(CFG_OVERLAYFS)) {
1426 if (arg_overlay) {
1427 fprintf(stderr, "Error: only one overlay command is allowed\n");
1428 exit(1);
1429 }
1430
1432 if (cfg.chrootdir) { 1431 if (cfg.chrootdir) {
1433 fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n"); 1432 fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n");
1434 exit(1); 1433 exit(1);
@@ -1453,6 +1452,10 @@ int main(int argc, char **argv) {
1453 } 1452 }
1454 else if (strncmp(argv[i], "--overlay-named=", 16) == 0) { 1453 else if (strncmp(argv[i], "--overlay-named=", 16) == 0) {
1455 if (checkcfg(CFG_OVERLAYFS)) { 1454 if (checkcfg(CFG_OVERLAYFS)) {
1455 if (arg_overlay) {
1456 fprintf(stderr, "Error: only one overlay command is allowed\n");
1457 exit(1);
1458 }
1456 if (cfg.chrootdir) { 1459 if (cfg.chrootdir) {
1457 fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n"); 1460 fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n");
1458 exit(1); 1461 exit(1);
@@ -1485,6 +1488,10 @@ int main(int argc, char **argv) {
1485 } 1488 }
1486 else if (strcmp(argv[i], "--overlay-tmpfs") == 0) { 1489 else if (strcmp(argv[i], "--overlay-tmpfs") == 0) {
1487 if (checkcfg(CFG_OVERLAYFS)) { 1490 if (checkcfg(CFG_OVERLAYFS)) {
1491 if (arg_overlay) {
1492 fprintf(stderr, "Error: only one overlay command is allowed\n");
1493 exit(1);
1494 }
1488 if (cfg.chrootdir) { 1495 if (cfg.chrootdir) {
1489 fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n"); 1496 fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n");
1490 exit(1); 1497 exit(1);
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index d0c43d13e..77308b7ac 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -920,6 +920,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
920#ifdef HAVE_OVERLAYFS 920#ifdef HAVE_OVERLAYFS
921 if (strncmp(ptr, "overlay-named ", 14) == 0) { 921 if (strncmp(ptr, "overlay-named ", 14) == 0) {
922 if (checkcfg(CFG_OVERLAYFS)) { 922 if (checkcfg(CFG_OVERLAYFS)) {
923 if (arg_overlay) {
924 fprintf(stderr, "Error: only one overlay command is allowed\n");
925 exit(1);
926 }
923 if (cfg.chrootdir) { 927 if (cfg.chrootdir) {
924 fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n"); 928 fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n");
925 exit(1); 929 exit(1);
@@ -951,6 +955,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
951 return 0; 955 return 0;
952 } else if (strcmp(ptr, "overlay-tmpfs") == 0) { 956 } else if (strcmp(ptr, "overlay-tmpfs") == 0) {
953 if (checkcfg(CFG_OVERLAYFS)) { 957 if (checkcfg(CFG_OVERLAYFS)) {
958 if (arg_overlay) {
959 fprintf(stderr, "Error: only one overlay command is allowed\n");
960 exit(1);
961 }
954 if (cfg.chrootdir) { 962 if (cfg.chrootdir) {
955 fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n"); 963 fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n");
956 exit(1); 964 exit(1);
@@ -966,6 +974,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
966 } 974 }
967 } else if (strcmp(ptr, "overlay") == 0) { 975 } else if (strcmp(ptr, "overlay") == 0) {
968 if (checkcfg(CFG_OVERLAYFS)) { 976 if (checkcfg(CFG_OVERLAYFS)) {
977 if (arg_overlay) {
978 fprintf(stderr, "Error: only one overlay command is allowed\n");
979 exit(1);
980 }
969 if (cfg.chrootdir) { 981 if (cfg.chrootdir) {
970 fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n"); 982 fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n");
971 exit(1); 983 exit(1);
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 5a9f3a6e0..0adca5e33 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -800,21 +800,55 @@ uid_t get_group_id(const char *group) {
800 return gid; 800 return gid;
801} 801}
802 802
803 803static int len_homedir = 0;
804static int remove_callback(const char *fpath, const struct stat *sb, int typeflag, struct FTW *ftwbuf) { 804static int remove_callback(const char *fpath, const struct stat *sb, int typeflag, struct FTW *ftwbuf) {
805 (void) sb; 805 (void) sb;
806 (void) typeflag; 806 (void) typeflag;
807 (void) ftwbuf; 807 (void) ftwbuf;
808 assert(fpath);
808 809
809 int rv = remove(fpath); 810 if (len_homedir == 0)
810 if (rv) 811 len_homedir = strlen(cfg.homedir);
811 perror(fpath);
812 812
813 return rv; 813 char *rp = realpath(fpath, NULL); // this should never fail!
814 if (!rp)
815 return 1;
816 if (strncmp(rp, cfg.homedir, len_homedir) != 0)
817 return 1;
818 free(rp);
819
820 if (remove(fpath)) { // removes the link not the actual file
821 fprintf(stderr, "Error: cannot remove file %s\n", fpath);
822 exit(1);
823 }
824
825 return 0;
814} 826}
815 827
816 828
817int remove_directory(const char *path) { 829int remove_overlay_directory(void) {
830 sleep(1);
831
832 char *path;
833 if (asprintf(&path, "%s/.firejail", cfg.homedir) == -1)
834 errExit("asprintf");
835
836 // deal with obvious problems such as symlinks and root ownership
837 if (is_link(path)) {
838 fprintf(stderr, "Error: cannot follow symbolic link\n");
839 exit(1);
840 }
841 if (access(path, R_OK | W_OK | X_OK) == -1) {
842 fprintf(stderr, "Error: cannot access ~/.firejail directory\n");
843 exit(1);
844 }
845
846 EUID_ROOT();
847 if (setreuid(0, 0) < 0 ||
848 setregid(0, 0) < 0)
849 errExit("setreuid/setregid");
850 errno = 0;
851
818 // FTW_PHYS - do not follow symbolic links 852 // FTW_PHYS - do not follow symbolic links
819 return nftw(path, remove_callback, 64, FTW_DEPTH | FTW_PHYS); 853 return nftw(path, remove_callback, 64, FTW_DEPTH | FTW_PHYS);
820} 854}
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-03 09:32:45 +0000