aboutsummaryrefslogtreecommitdiffstats
path: root/etc/profile-a-l
diff options
context:
space:
mode:
Diffstat (limited to 'etc/profile-a-l')
-rw-r--r--etc/profile-a-l/balsa.profile78
-rw-r--r--etc/profile-a-l/celluloid.profile6
-rw-r--r--etc/profile-a-l/chromium-freeworld.profile5
-rw-r--r--etc/profile-a-l/cola.profile10
-rw-r--r--etc/profile-a-l/dbus-send.profile59
-rw-r--r--etc/profile-a-l/default.profile1
-rw-r--r--etc/profile-a-l/electron-mail.profile8
-rw-r--r--etc/profile-a-l/eo-common.profile1
-rw-r--r--etc/profile-a-l/eog.profile9
-rw-r--r--etc/profile-a-l/equalx.profile63
-rw-r--r--etc/profile-a-l/fdns.profile8
-rw-r--r--etc/profile-a-l/firefox.profile2
-rw-r--r--etc/profile-a-l/flameshot.profile5
-rw-r--r--etc/profile-a-l/fractal.profile54
-rw-r--r--etc/profile-a-l/geary.profile12
-rw-r--r--etc/profile-a-l/git-cola.profile29
-rw-r--r--etc/profile-a-l/gnome-builder.profile4
-rw-r--r--etc/profile-a-l/gnome-passwordsafe.profile5
-rw-r--r--etc/profile-a-l/hedgewars.profile2
-rw-r--r--etc/profile-a-l/kazam.profile54
-rw-r--r--etc/profile-a-l/kube.profile81
21 files changed, 467 insertions, 29 deletions
diff --git a/etc/profile-a-l/balsa.profile b/etc/profile-a-l/balsa.profile
new file mode 100644
index 000000000..a401ac592
--- /dev/null
+++ b/etc/profile-a-l/balsa.profile
@@ -0,0 +1,78 @@
1# Firejail profile for balsa
2# Description: GNOME mail client
3# This file is overwritten after every install/update
4# Persistent local customizations
5include balsa.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.balsa
10noblacklist ${HOME}/.gnupg
11noblacklist ${HOME}/.mozilla
12noblacklist ${HOME}/mail
13noblacklist /var/mail
14noblacklist /var/spool/mail
15
16include disable-common.inc
17include disable-devel.inc
18include disable-exec.inc
19include disable-interpreters.inc
20include disable-passwdmgr.inc
21include disable-programs.inc
22include disable-shell.inc
23include disable-xdg.inc
24
25mkdir ${HOME}/.balsa
26mkdir ${HOME}/.gnupg
27mkdir ${HOME}/mail
28whitelist ${HOME}/.balsa
29whitelist ${HOME}/.gnupg
30whitelist ${HOME}/.mozilla/firefox/profiles.ini
31whitelist ${HOME}/mail
32whitelist ${RUNUSER}/gnupg
33whitelist /usr/share/balsa
34whitelist /usr/share/gnupg
35whitelist /usr/share/gnupg2
36whitelist /var/mail
37whitelist /var/spool/mail
38include whitelist-common.inc
39include whitelist-runuser-common.inc
40include whitelist-usr-share-common.inc
41include whitelist-var-common.inc
42
43apparmor
44caps.drop all
45netfilter
46no3d
47nodvd
48nogroups
49nonewprivs
50noroot
51nosound
52notv
53nou2f
54novideo
55protocol unix,inet,inet6
56seccomp
57shell none
58tracelog
59
60# disable-mnt
61# Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg
62# Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile.
63private-bin balsa,balsa-ab
64private-cache
65private-dev
66private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,mailname,passwd,pki,resolv.conf,selinux,ssl,xdg
67private-tmp
68writable-run-user
69writable-var
70
71dbus-user filter
72dbus-user.own org.desktop.Balsa
73dbus-user.talk ca.desrt.dconf
74dbus-user.talk org.freedesktop.secrets
75dbus-user.talk org.freedesktop.Notifications
76dbus-system none
77
78read-only ${HOME}/.mozilla/firefox/profiles.ini
diff --git a/etc/profile-a-l/celluloid.profile b/etc/profile-a-l/celluloid.profile
index 54d3f742f..888367899 100644
--- a/etc/profile-a-l/celluloid.profile
+++ b/etc/profile-a-l/celluloid.profile
@@ -28,12 +28,8 @@ mkdir ${HOME}/.config/youtube-dl
28whitelist ${HOME}/.config/celluloid 28whitelist ${HOME}/.config/celluloid
29whitelist ${HOME}/.config/gnome-mpv 29whitelist ${HOME}/.config/gnome-mpv
30whitelist ${HOME}/.config/youtube-dl 30whitelist ${HOME}/.config/youtube-dl
31whitelist ${DESKTOP}
32whitelist ${DOWNLOADS}
33whitelist ${MUSIC}
34whitelist ${PICTURES}
35whitelist ${VIDEOS}
36include whitelist-common.inc 31include whitelist-common.inc
32include whitelist-players.inc
37include whitelist-runuser-common.inc 33include whitelist-runuser-common.inc
38include whitelist-usr-share-common.inc 34include whitelist-usr-share-common.inc
39include whitelist-var-common.inc 35include whitelist-var-common.inc
diff --git a/etc/profile-a-l/chromium-freeworld.profile b/etc/profile-a-l/chromium-freeworld.profile
new file mode 100644
index 000000000..a1de85afa
--- /dev/null
+++ b/etc/profile-a-l/chromium-freeworld.profile
@@ -0,0 +1,5 @@
1# Firejail profile for chromium-freeworld
2# This file is overwritten after every install/update
3
4# Redirect
5include chromium.profile
diff --git a/etc/profile-a-l/cola.profile b/etc/profile-a-l/cola.profile
new file mode 100644
index 000000000..e5debfd82
--- /dev/null
+++ b/etc/profile-a-l/cola.profile
@@ -0,0 +1,10 @@
1# Firejail profile for cola
2# Description: Linux native frontend for Git,alternative call for git-cola
3# This file is overwritten after every install/update
4# Persistent local customizations
5include cola.local
6# Persistent global definitions
7include globals.local
8
9# Redirect
10include git-cola.profile \ No newline at end of file
diff --git a/etc/profile-a-l/dbus-send.profile b/etc/profile-a-l/dbus-send.profile
new file mode 100644
index 000000000..76a14d99b
--- /dev/null
+++ b/etc/profile-a-l/dbus-send.profile
@@ -0,0 +1,59 @@
1# Firejail profile for dbus-send
2# Description: Send a message to a message bus
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include dbus-send.local
7# Persistent global definitions
8include globals.local
9
10blacklist /tmp/.X11-unix
11blacklist ${RUNUSER}/wayland-*
12
13include disable-common.inc
14include disable-devel.inc
15include disable-exec.inc
16include disable-interpreters.inc
17include disable-passwdmgr.inc
18include disable-programs.inc
19include disable-shell.inc
20include disable-write-mnt.inc
21include disable-xdg.inc
22
23include whitelist-common.inc
24include whitelist-runuser-common.inc
25include whitelist-usr-share-common.inc
26include whitelist-var-common.inc
27
28apparmor
29caps.drop all
30ipc-namespace
31machine-id
32# Breaks abstract sockets
33#net none
34netfilter
35no3d
36nodvd
37nogroups
38nonewprivs
39noroot
40nosound
41notv
42nou2f
43novideo
44protocol unix
45seccomp
46shell none
47tracelog
48
49disable-mnt
50private
51private-bin dbus-send
52private-cache
53private-dev
54private-etc alternatives,dbus-1
55private-lib libpcre2-8.so.0
56private-tmp
57
58memory-deny-write-execute
59read-only ${HOME}
diff --git a/etc/profile-a-l/default.profile b/etc/profile-a-l/default.profile
index 74314cf92..7eb7660dd 100644
--- a/etc/profile-a-l/default.profile
+++ b/etc/profile-a-l/default.profile
@@ -14,6 +14,7 @@ include disable-common.inc
14# include disable-interpreters.inc 14# include disable-interpreters.inc
15include disable-passwdmgr.inc 15include disable-passwdmgr.inc
16include disable-programs.inc 16include disable-programs.inc
17# include disable-write-mnt.inc
17# include disable-xdg.inc 18# include disable-xdg.inc
18 19
19# include whitelist-common.inc 20# include whitelist-common.inc
diff --git a/etc/profile-a-l/electron-mail.profile b/etc/profile-a-l/electron-mail.profile
index 39366470f..5957d4316 100644
--- a/etc/profile-a-l/electron-mail.profile
+++ b/etc/profile-a-l/electron-mail.profile
@@ -8,8 +8,6 @@ include globals.local
8 8
9noblacklist ${HOME}/.config/electron-mail 9noblacklist ${HOME}/.config/electron-mail
10 10
11whitelist ${DOWNLOADS}
12
13include disable-common.inc 11include disable-common.inc
14include disable-devel.inc 12include disable-devel.inc
15include disable-exec.inc 13include disable-exec.inc
@@ -21,8 +19,10 @@ include disable-xdg.inc
21 19
22mkdir ${HOME}/.config/electron-mail 20mkdir ${HOME}/.config/electron-mail
23whitelist ${HOME}/.config/electron-mail 21whitelist ${HOME}/.config/electron-mail
22whitelist ${DOWNLOADS}
24 23
25include whitelist-common.inc 24include whitelist-common.inc
25include whitelist-runuser-common.inc
26include whitelist-usr-share-common.inc 26include whitelist-usr-share-common.inc
27include whitelist-var-common.inc 27include whitelist-var-common.inc
28 28
@@ -45,12 +45,12 @@ shell none
45private-bin electron-mail 45private-bin electron-mail
46private-cache 46private-cache
47private-dev 47private-dev
48private-etc alternatives,fonts 48private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,nsswitch.conf,pki,resolv.conf,selinux,ssl,xdg
49private-opt ElectronMail 49private-opt ElectronMail
50private-tmp 50private-tmp
51 51
52# breaks tray functionality 52# breaks tray functionality
53# dbus-user none 53# dbus-user none
54# dbus-system none 54dbus-system none
55 55
56# memory-deny-write-execute - breaks on Arch 56# memory-deny-write-execute - breaks on Arch
diff --git a/etc/profile-a-l/eo-common.profile b/etc/profile-a-l/eo-common.profile
index 80c704c6b..e8b49a395 100644
--- a/etc/profile-a-l/eo-common.profile
+++ b/etc/profile-a-l/eo-common.profile
@@ -17,6 +17,7 @@ include disable-exec.inc
17include disable-interpreters.inc 17include disable-interpreters.inc
18include disable-passwdmgr.inc 18include disable-passwdmgr.inc
19include disable-programs.inc 19include disable-programs.inc
20include disable-write-mnt.inc
20 21
21include whitelist-runuser-common.inc 22include whitelist-runuser-common.inc
22include whitelist-usr-share-common.inc 23include whitelist-usr-share-common.inc
diff --git a/etc/profile-a-l/eog.profile b/etc/profile-a-l/eog.profile
index 0d0153fc2..aabef65fc 100644
--- a/etc/profile-a-l/eog.profile
+++ b/etc/profile-a-l/eog.profile
@@ -15,9 +15,12 @@ whitelist /usr/share/eog
15# or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eog.local 15# or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eog.local
16private-bin eog 16private-bin eog
17 17
18dbus-user filter 18
19dbus-user.own org.gnome.eog 19# broken on Debian 10 (buster) running LXDE got the folowing error:
20dbus-user.talk ca.desrt.dconf 20# Failed to register: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: org.freedesktop.DBus.Error.ServiceUnknown
21#dbus-user filter
22#dbus-user.own org.gnome.eog
23#dbus-user.talk ca.desrt.dconf
21dbus-system none 24dbus-system none
22 25
23# Redirect 26# Redirect
diff --git a/etc/profile-a-l/equalx.profile b/etc/profile-a-l/equalx.profile
new file mode 100644
index 000000000..58b053041
--- /dev/null
+++ b/etc/profile-a-l/equalx.profile
@@ -0,0 +1,63 @@
1# Firejail profile for equalx
2# Description: A graphical editor for writing LaTeX equations
3# This file is overwritten after every install/update
4# Persistent local customizations
5include equalx.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.config/equalx
10noblacklist ${HOME}/.equalx
11
12include disable-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18include disable-shell.inc
19include disable-xdg.inc
20
21mkdir ${HOME}/.config/equalx
22mkdir ${HOME}/.equalx
23whitelist ${HOME}/.config/equalx
24whitelist ${HOME}/.equalx
25whitelist /usr/share/poppler
26whitelist /usr/share/ghostscript
27whitelist /usr/share/texlive
28whitelist /usr/share/equalx
29whitelist /var/lib/texmf
30include whitelist-common.inc
31include whitelist-runuser-common.inc
32include whitelist-usr-share-common.inc
33include whitelist-var-common.inc
34
35apparmor
36caps.drop all
37machine-id
38net none
39no3d
40nodvd
41nogroups
42nonewprivs
43noroot
44nosound
45notv
46nou2f
47novideo
48protocol unix
49seccomp
50shell none
51tracelog
52
53disable-mnt
54private-bin equalx,gs,pdflatex,pdftocairo
55private-cache
56private-dev
57private-etc equalx,equalx.conf,fonts,gtk-2.0,latexmk.conf,machine-id,papersize,passwd,texlive,Trolltech.conf
58private-tmp
59
60dbus-user none
61dbus-system none
62
63memory-deny-write-execute
diff --git a/etc/profile-a-l/fdns.profile b/etc/profile-a-l/fdns.profile
index 179540806..31cb1776c 100644
--- a/etc/profile-a-l/fdns.profile
+++ b/etc/profile-a-l/fdns.profile
@@ -29,20 +29,20 @@ no3d
29nodvd 29nodvd
30nogroups 30nogroups
31nonewprivs 31nonewprivs
32# noroot 32noroot
33nosound 33nosound
34notv 34notv
35nou2f 35nou2f
36novideo 36novideo
37protocol unix,inet,inet6 37protocol unix,inet,inet6,netlink
38#seccomp 38#seccomp
39#shell none 39#shell none
40 40
41disable-mnt 41disable-mnt
42private 42private
43private-bin bash,fdns,sh 43private-bin bash,fdns,sh
44# private-cache 44private-cache
45private-dev 45#private-dev
46private-etc ca-certificates,crypto-policies,fdns,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pki,ssl 46private-etc ca-certificates,crypto-policies,fdns,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pki,ssl
47# private-lib 47# private-lib
48private-tmp 48private-tmp
diff --git a/etc/profile-a-l/firefox.profile b/etc/profile-a-l/firefox.profile
index 337311ed8..ce2013c57 100644
--- a/etc/profile-a-l/firefox.profile
+++ b/etc/profile-a-l/firefox.profile
@@ -24,7 +24,7 @@ include whitelist-usr-share-common.inc
24# firefox requires a shell to launch on Arch. 24# firefox requires a shell to launch on Arch.
25#private-bin bash,dbus-launch,dbus-send,env,firefox,sh,which 25#private-bin bash,dbus-launch,dbus-send,env,firefox,sh,which
26# Fedora use shell scripts to launch firefox, at least this is required 26# Fedora use shell scripts to launch firefox, at least this is required
27#private-bin basename,bash,cat,dirname,expr,false,firefox,firefox-wayland,ln,mkdir,pidof,rm,rmdir,sed,sh,tclsh,true,uname 27#private-bin basename,bash,cat,dirname,expr,false,firefox,firefox-wayland,getenforce,ln,mkdir,pidof,restorecon,rm,rmdir,sed,sh,tclsh,true,uname
28# private-etc must first be enabled in firefox-common.profile 28# private-etc must first be enabled in firefox-common.profile
29#private-etc firefox 29#private-etc firefox
30 30
diff --git a/etc/profile-a-l/flameshot.profile b/etc/profile-a-l/flameshot.profile
index 7c41417ec..357354e70 100644
--- a/etc/profile-a-l/flameshot.profile
+++ b/etc/profile-a-l/flameshot.profile
@@ -9,6 +9,7 @@ include globals.local
9 9
10noblacklist ${PICTURES} 10noblacklist ${PICTURES}
11noblacklist ${HOME}/.config/Dharkael 11noblacklist ${HOME}/.config/Dharkael
12noblacklist ${HOME}/.config/flameshot
12 13
13include disable-common.inc 14include disable-common.inc
14include disable-devel.inc 15include disable-devel.inc
@@ -19,8 +20,11 @@ include disable-programs.inc
19include disable-shell.inc 20include disable-shell.inc
20include disable-xdg.inc 21include disable-xdg.inc
21 22
23#mkdir ${HOME}/.config/Dharkael
24#mkdir ${HOME}/.config/flameshot
22#whitelist ${PICTURES} 25#whitelist ${PICTURES}
23#whitelist ${HOME}/.config/Dharkael 26#whitelist ${HOME}/.config/Dharkael
27#whitelist ${HOME}/.config/flameshot
24whitelist /usr/share/flameshot 28whitelist /usr/share/flameshot
25#include whitelist-common.inc 29#include whitelist-common.inc
26include whitelist-runuser-common.inc 30include whitelist-runuser-common.inc
@@ -53,4 +57,5 @@ private-tmp
53 57
54dbus-user filter 58dbus-user filter
55dbus-user.own org.dharkael.Flameshot 59dbus-user.own org.dharkael.Flameshot
60dbus-user.own org.flameshot.Flameshot
56dbus-system none 61dbus-system none
diff --git a/etc/profile-a-l/fractal.profile b/etc/profile-a-l/fractal.profile
new file mode 100644
index 000000000..ab907eb0d
--- /dev/null
+++ b/etc/profile-a-l/fractal.profile
@@ -0,0 +1,54 @@
1# Firejail profile for fractal
2# Description: Desktop client for Matrix
3# This file is overwritten after every install/update
4# Persistent local customizations
5include fractal.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.cache/fractal
10
11include disable-common.inc
12include disable-devel.inc
13include disable-exec.inc
14include disable-interpreters.inc
15include disable-passwdmgr.inc
16include disable-programs.inc
17include disable-shell.inc
18include disable-xdg.inc
19
20mkdir ${HOME}/.cache/fractal
21whitelist ${HOME}/.cache/fractal
22whitelist ${DOWNLOADS}
23include whitelist-common.inc
24include whitelist-runuser-common.inc
25include whitelist-usr-share-common.inc
26include whitelist-var-common.inc
27
28apparmor
29caps.drop all
30netfilter
31nodvd
32nogroups
33nonewprivs
34noroot
35notv
36nou2f
37protocol unix,inet,inet6
38seccomp
39shell none
40tracelog
41
42disable-mnt
43private-bin fractal
44private-cache
45private-dev
46private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg
47private-tmp
48
49dbus-user filter
50dbus-user.own org.gnome.Fractal
51dbus-user.talk ca.desrt.dconf
52dbus-user.talk org.freedesktop.secrets
53dbus-user.talk org.freedesktop.Notifications
54dbus-system none
diff --git a/etc/profile-a-l/geary.profile b/etc/profile-a-l/geary.profile
index fa01d04b7..118ed62ca 100644
--- a/etc/profile-a-l/geary.profile
+++ b/etc/profile-a-l/geary.profile
@@ -10,24 +10,24 @@ include geary.local
10# Users have Geary set to open a browser by clicking a link in an email 10# Users have Geary set to open a browser by clicking a link in an email
11# We are not allowed to blacklist browser-specific directories 11# We are not allowed to blacklist browser-specific directories
12 12
13ignore dbus-user none 13ignore dbus-user filter
14ignore dbus-system none 14ignore dbus-system none
15ignore private-tmp 15ignore private-tmp
16 16
17noblacklist ${HOME}/.gnupg 17noblacklist ${HOME}/.cache/geary
18noblacklist ${HOME}/.config/geary
18noblacklist ${HOME}/.local/share/geary 19noblacklist ${HOME}/.local/share/geary
19 20
20mkdir ${HOME}/.gnupg 21mkdir ${HOME}/.cache/geary
21mkdir ${HOME}/.config/geary 22mkdir ${HOME}/.config/geary
22mkdir ${HOME}/.local/share/geary 23mkdir ${HOME}/.local/share/geary
23whitelist ${HOME}/.gnupg 24whitelist ${HOME}/.cache/geary
24whitelist ${HOME}/.config/geary 25whitelist ${HOME}/.config/geary
25whitelist ${HOME}/.local/share/geary 26whitelist ${HOME}/.local/share/geary
27whitelist /usr/share/geary
26 28
27read-only ${HOME}/.config/mimeapps.list 29read-only ${HOME}/.config/mimeapps.list
28 30
29whitelist /usr/share/geary
30
31# allow Mozilla browsers 31# allow Mozilla browsers
32# Redirect 32# Redirect
33include firefox.profile 33include firefox.profile
diff --git a/etc/profile-a-l/git-cola.profile b/etc/profile-a-l/git-cola.profile
index 30e80f519..4708078dd 100644
--- a/etc/profile-a-l/git-cola.profile
+++ b/etc/profile-a-l/git-cola.profile
@@ -12,6 +12,7 @@ noblacklist ${HOME}/.gitconfig
12noblacklist ${HOME}/.git-credentials 12noblacklist ${HOME}/.git-credentials
13noblacklist ${HOME}/.gnupg 13noblacklist ${HOME}/.gnupg
14noblacklist ${HOME}/.ssh 14noblacklist ${HOME}/.ssh
15noblacklist ${HOME}/.subversion
15noblacklist ${HOME}/.config/git 16noblacklist ${HOME}/.config/git
16noblacklist ${HOME}/.config/git-cola 17noblacklist ${HOME}/.config/git-cola
17# Put your editor,diff viewer config path below and uncomment to load settings 18# Put your editor,diff viewer config path below and uncomment to load settings
@@ -28,7 +29,19 @@ include disable-passwdmgr.inc
28include disable-programs.inc 29include disable-programs.inc
29include disable-xdg.inc 30include disable-xdg.inc
30 31
32whitelist ${RUNUSER}/gnupg
33whitelist ${RUNUSER}/keyring
34# Whitelist your editor, diff viewer, gnupg path below in /usr/share/
35whitelist /usr/share/git
36whitelist /usr/share/git-cola
37whitelist /usr/share/git-core
38whitelist /usr/share/git-gui
39whitelist /usr/share/gitk
40whitelist /usr/share/gitweb
41whitelist /usr/share/gnupg
42whitelist /usr/share/gnupg2
31include whitelist-runuser-common.inc 43include whitelist-runuser-common.inc
44include whitelist-usr-share-common.inc
32include whitelist-var-common.inc 45include whitelist-var-common.inc
33 46
34apparmor 47apparmor
@@ -49,18 +62,22 @@ seccomp
49shell none 62shell none
50tracelog 63tracelog
51 64
52# private-bin atom,bash,colordiff,emacs,fldiff,geany,gedit,git,git gui,git-cola,git-dag,gitk,gpg,gvim,leafpad,meld,mousepad,nano,notepadqq,python*,sh,ssh,vim,vimdiff,which,xed 65# Add your own diff viewer,editor,pinentry program
66# pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg
67private-bin basename,bash,cola,envsubst,gettext,git,git-cola,git-dag,git-gui,gitk,gpg,gpg-agent,nano,ps,python*,sh,ssh,ssh-agent,tclsh,tr,wc,which,xed
53private-cache 68private-cache
54private-dev 69private-dev
55# Comment if you sign commits with GPG 70private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gitconfig,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,localtime,login.defs,machine-id,mime.types,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssh,ssl,X11,xdg
56private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,localtime,login.defs,machine-id,mime.types,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,X11,xdg
57private-tmp 71private-tmp
72writable-run-user
58 73
59dbus-user filter 74# Breaks meld as diff viewer
75# dbus-user filter
60# Uncomment if you need keyring access 76# Uncomment if you need keyring access
61# dbus-user.talk org.freedesktop.secrets 77# dbus-user.talk org.freedesktop.secrets
62dbus-system none 78dbus-system none
63 79
64read-only ${HOME}/.ssh
65read-only ${HOME}/.gnupg
66read-only ${HOME}/.git-credentials 80read-only ${HOME}/.git-credentials
81
82# Comment if you need to allow hosts
83read-only ${HOME}/.ssh
diff --git a/etc/profile-a-l/gnome-builder.profile b/etc/profile-a-l/gnome-builder.profile
index 7a684dd59..8f637902c 100644
--- a/etc/profile-a-l/gnome-builder.profile
+++ b/etc/profile-a-l/gnome-builder.profile
@@ -6,6 +6,8 @@ include gnome-builder.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9noblacklist ${HOME}/.bash_history
10
9noblacklist ${HOME}/.cache/gnome-builder 11noblacklist ${HOME}/.cache/gnome-builder
10noblacklist ${HOME}/.config/gnome-builder 12noblacklist ${HOME}/.config/gnome-builder
11noblacklist ${HOME}/.local/share/gnome-builder 13noblacklist ${HOME}/.local/share/gnome-builder
@@ -34,3 +36,5 @@ seccomp
34shell none 36shell none
35 37
36private-dev 38private-dev
39
40read-write ${HOME}/.bash_history
diff --git a/etc/profile-a-l/gnome-passwordsafe.profile b/etc/profile-a-l/gnome-passwordsafe.profile
index 615be7873..ed430b654 100644
--- a/etc/profile-a-l/gnome-passwordsafe.profile
+++ b/etc/profile-a-l/gnome-passwordsafe.profile
@@ -52,3 +52,8 @@ private-cache
52private-dev 52private-dev
53private-etc dconf,fonts,gtk-3.0,passwd 53private-etc dconf,fonts,gtk-3.0,passwd
54private-tmp 54private-tmp
55
56dbus-user filter
57dbus-user.own org.gnome.PasswordSafe
58dbus-user.talk ca.desrt.dconf
59dbus-system none
diff --git a/etc/profile-a-l/hedgewars.profile b/etc/profile-a-l/hedgewars.profile
index 898a07a5f..8ac07d3da 100644
--- a/etc/profile-a-l/hedgewars.profile
+++ b/etc/profile-a-l/hedgewars.profile
@@ -8,6 +8,8 @@ include globals.local
8 8
9noblacklist ${HOME}/.hedgewars 9noblacklist ${HOME}/.hedgewars
10 10
11include allow-lua.inc
12
11include disable-common.inc 13include disable-common.inc
12include disable-devel.inc 14include disable-devel.inc
13include disable-interpreters.inc 15include disable-interpreters.inc
diff --git a/etc/profile-a-l/kazam.profile b/etc/profile-a-l/kazam.profile
new file mode 100644
index 000000000..9899ff195
--- /dev/null
+++ b/etc/profile-a-l/kazam.profile
@@ -0,0 +1,54 @@
1# Firejail profile for kazam
2# Description: Screen capture tool
3# This file is overwritten after every install/update
4# Persistent local customizations
5include kazam.local
6# Persistent global definitions
7include globals.local
8
9ignore noexec ${HOME}
10
11noblacklist ${PICTURES}
12noblacklist ${VIDEOS}
13noblacklist ${HOME}/.config/kazam
14
15include allow-python2.inc
16include allow-python3.inc
17
18include disable-common.inc
19include disable-devel.inc
20include disable-exec.inc
21include disable-interpreters.inc
22include disable-programs.inc
23include disable-passwdmgr.inc
24include disable-shell.inc
25include disable-xdg.inc
26
27whitelist /usr/share/kazam
28include whitelist-runuser-common.inc
29include whitelist-usr-share-common.inc
30include whitelist-var-common.inc
31
32apparmor
33caps.drop all
34net none
35nodvd
36nogroups
37nonewprivs
38noroot
39notv
40nou2f
41novideo
42protocol unix
43seccomp
44shell none
45tracelog
46
47disable-mnt
48# private-bin kazam,python*
49private-cache
50private-dev
51private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,machine-id,pulse,selinux,X11,xdg
52private-tmp
53
54dbus-system none
diff --git a/etc/profile-a-l/kube.profile b/etc/profile-a-l/kube.profile
new file mode 100644
index 000000000..cf3a69fd7
--- /dev/null
+++ b/etc/profile-a-l/kube.profile
@@ -0,0 +1,81 @@
1# Firejail profile for kube
2# Description: Qt mail client
3# This file is overwritten after every install/update
4# Persistent local customizations
5include kube.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.gnupg
10noblacklist ${HOME}/.mozilla
11noblacklist ${HOME}/.cache/kube
12noblacklist ${HOME}/.config/kube
13noblacklist ${HOME}/.config/sink
14noblacklist ${HOME}/.local/share/kube
15noblacklist ${HOME}/.local/share/sink
16
17include disable-common.inc
18include disable-devel.inc
19include disable-exec.inc
20include disable-interpreters.inc
21include disable-passwdmgr.inc
22include disable-programs.inc
23include disable-shell.inc
24include disable-xdg.inc
25
26mkdir ${HOME}/.gnupg
27mkdir ${HOME}/.cache/kube
28mkdir ${HOME}/.config/kube
29mkdir ${HOME}/.config/sink
30mkdir ${HOME}/.local/share/kube
31mkdir ${HOME}/.local/share/sink
32whitelist ${HOME}/.gnupg
33whitelist ${HOME}/.mozilla/firefox/profiles.ini
34whitelist ${HOME}/.cache/kube
35whitelist ${HOME}/.config/kube
36whitelist ${HOME}/.config/sink
37whitelist ${HOME}/.local/share/kube
38whitelist ${HOME}/.local/share/sink
39whitelist ${RUNUSER}/gnupg
40whitelist /usr/share/kube
41whitelist /usr/share/gnupg
42whitelist /usr/share/gnupg2
43include whitelist-common.inc
44include whitelist-runuser-common.inc
45include whitelist-usr-share-common.inc
46include whitelist-var-common.inc
47
48apparmor
49caps.drop all
50netfilter
51no3d
52nodvd
53nogroups
54nonewprivs
55noroot
56nosound
57notv
58nou2f
59novideo
60protocol unix,inet,inet6
61seccomp
62shell none
63tracelog
64
65# disable-mnt
66# Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg
67# Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile.
68private-bin kube,sink_synchronizer
69private-cache
70private-dev
71private-etc alternatives,ca-certificates,crypto-policies,fonts,gcrypt,gtk-2.0,gtk-3.0,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg
72private-tmp
73writable-run-user
74
75dbus-user filter
76dbus-user.talk ca.desrt.dconf
77dbus-user.talk org.freedesktop.secrets
78dbus-user.talk org.freedesktop.Notifications
79dbus-system none
80
81read-only ${HOME}/.mozilla/firefox/profiles.ini
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-19 07:19:20 +0000