aboutsummaryrefslogtreecommitdiffstats
path: root/etc/fdns.profile
diff options
context:
space:
mode:
Diffstat (limited to 'etc/fdns.profile')
-rw-r--r--etc/fdns.profile14
1 files changed, 6 insertions, 8 deletions
diff --git a/etc/fdns.profile b/etc/fdns.profile
index 4b266f7f8..179540806 100644
--- a/etc/fdns.profile
+++ b/etc/fdns.profile
@@ -1,14 +1,10 @@
1# Firejail profile for server 1# Firejail profile for server
2# This file is overwritten after every install/update 2# This file is overwritten after every install/update
3# Persistent local customizations 3# Persistent local customizations
4include server.local 4include fdns.local
5# Persistent global definitions 5# Persistent global definitions
6include globals.local 6include globals.local
7 7
8# generic server profile
9# it allows /sbin and /usr/sbin directories - this is where servers are installed
10# depending on your usage, you can enable some of the commands below:
11#
12noblacklist /sbin 8noblacklist /sbin
13noblacklist /usr/sbin 9noblacklist /usr/sbin
14 10
@@ -23,8 +19,10 @@ include disable-passwdmgr.inc
23include disable-programs.inc 19include disable-programs.inc
24include disable-xdg.inc 20include disable-xdg.inc
25 21
26caps.keep chown,kill,net_admin,net_bind_service,setgid,setuid,sys_admin,sys_chroot,syslog 22#include whitelist-usr-share-common.inc
23#include whitelist-var-common.inc
27 24
25caps.keep kill,net_bind_service,setgid,setuid,sys_admin,sys_chroot
28ipc-namespace 26ipc-namespace
29# netfilter /etc/firejail/webserver.net 27# netfilter /etc/firejail/webserver.net
30no3d 28no3d
@@ -36,6 +34,7 @@ nosound
36notv 34notv
37nou2f 35nou2f
38novideo 36novideo
37protocol unix,inet,inet6
39#seccomp 38#seccomp
40#shell none 39#shell none
41 40
@@ -44,9 +43,8 @@ private
44private-bin bash,fdns,sh 43private-bin bash,fdns,sh
45# private-cache 44# private-cache
46private-dev 45private-dev
47# private-etc alternatives 46private-etc ca-certificates,crypto-policies,fdns,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pki,ssl
48# private-lib 47# private-lib
49private-tmp 48private-tmp
50 49
51protocol unix,inet,inet6
52memory-deny-write-execute 50memory-deny-write-execute