3 files changed, 19 insertions, 0 deletions

diff --git a/Makefile.in b/Makefile.in
index 59fe34f60..8c1a21e9a 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -127,6 +127,7 @@ realinstall:
         install -c -m 0644 .etc/weechat-curses.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 .etc/hexchat.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         install -c -m 0644 .etc/rtorrent.profile $(DESTDIR)/$(sysconfdir)/firejail/.
+        install -c -m 0644 .etc/parole.profile $(DESTDIR)/$(sysconfdir)/firejail/.
         bash -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
         rm -fr .etc
         # man pages
diff --git a/etc/parole.profile b/etc/parole.profile
new file mode 100644
index 000000000..24181c8d6
--- /dev/null
+++ b/etc/parole.profile
@@ -0,0 +1,17 @@
+# Profile for Parole, the default XFCE4 media player
+include /etc/firejail/disable-mgmt.inc
+include /etc/firejail/disable-secret.inc
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+private-etc passwd,group,fonts
+private-bin parole,dbus-launch
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+caps.drop all
+seccomp
+protocol unix,inet,inet6
+netfilter
+noroot
+shell none
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index bda064f60..47b84d207 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -53,3 +53,4 @@
 /etc/firejail/weechat-curses.profile
 /etc/firejail/hexchat.profile
 /etc/firejail/rtorrent.profile
+/etc/firejail/parole.profile