1 files changed, 30 insertions, 32 deletions

diff --git a/etc/palemoon.profile b/etc/palemoon.profile
index b3b57f931..e3e498195 100644
--- a/etc/palemoon.profile
+++ b/etc/palemoon.profile
@@ -1,37 +1,16 @@
-# Persistent global definitions go here
-include /etc/firejail/globals.local
-
-# This file is overwritten during software install.
-# Persistent customizations should go in a .local file.
+# Firejail profile for palemoon
+# This file is overwritten after every install/update
+# Persistent local customizations
 include /etc/firejail/palemoon.local
+# Persistent global definitions
+include /etc/firejail/globals.local
 
-# Firejail profile for Pale Moon
-noblacklist ~/.moonchild productions/pale moon
 noblacklist ~/.cache/moonchild productions/pale moon
+noblacklist ~/.moonchild productions/pale moon
+
 include /etc/firejail/disable-common.inc
-include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
-include /etc/firejail/whitelist-common.inc
-
-whitelist ${DOWNLOADS}
-mkdir ~/.moonchild productions
-whitelist ~/.moonchild productions
-mkdir ~/.cache/moonchild productions/pale moon
-whitelist ~/.cache/moonchild productions/pale moon
-
-caps.drop all
-netfilter
-nogroups
-nonewprivs
-noroot
-protocol unix,inet,inet6,netlink
-seccomp
-shell none
-tracelog
-
-#private-bin palemoon
-#private-opt palemoon
-private-tmp
+include /etc/firejail/disable-programs.inc
 
 # These are uncommented in the Firefox profile. If you run into trouble you may
 # want to uncomment (some of) them.
@@ -53,6 +32,25 @@ private-tmp
 #whitelist ~/.config/pipelight-widevine
 #whitelist ~/.config/pipelight-silverlight5.1
 
-# experimental features
-#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse
-#private-dev (disabled for now as it will interfere with webcam use in palemoon)
+mkdir ~/.cache/moonchild productions/pale moon
+mkdir ~/.moonchild productions
+whitelist ${DOWNLOADS}
+whitelist ~/.cache/moonchild productions/pale moon
+whitelist ~/.moonchild productions
+include /etc/firejail/whitelist-common.inc
+
+caps.drop all
+netfilter
+nogroups
+nonewprivs
+noroot
+protocol unix,inet,inet6,netlink
+seccomp
+shell none
+tracelog
+
+# private-bin palemoon
+# private-dev (disabled for now as it will interfere with webcam use in palemoon)
+# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse
+# private-opt palemoon
+private-tmp