9 files changed, 161 insertions, 8 deletions

diff --git a/etc/profile-a-l/b2sum.profile b/etc/profile-a-l/b2sum.profile
new file mode 100644
index 000000000..48cb9619b
--- /dev/null
+++ b/etc/profile-a-l/b2sum.profile
@@ -0,0 +1,13 @@
+# Firejail profile for b2sum
+# Description: compute and check BLAKE2 message digest
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include b2sum.local
+# Persistent global definitions
+include globals.local
+
+private-bin b2sum
+
+# Redirect
+include hasher-common.profile
diff --git a/etc/profile-a-l/bcompare.profile b/etc/profile-a-l/bcompare.profile
new file mode 100644
index 000000000..178e2dc9f
--- /dev/null
+++ b/etc/profile-a-l/bcompare.profile
@@ -0,0 +1,62 @@
+# Firejail profile for Beyond Compare by Scooter Software
+# Description: directory and file compare utility
+# Disables the network, which only impacts checking for updates.
+# This file is overwritten after every install/update
+# Persistent local customizations
+include bcompare.local
+# Persistent global definitions
+include globals.local
+
+noblacklist ${HOME}/.config/bcompare
+# In case the user decides to include disable-programs.inc, still allow
+# KDE's Gwenview to view images via right click -> Open With -> Associated Application
+noblacklist ${HOME}/.config/gwenviewrc
+
+# Uncomment the next line (or put it into your bcompare.local) if you don't need to compare files in disable-common.inc
+#include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+# Uncomment the next line (or put it into your bcompare.local) if you don't need to compare files in disable-programs.inc
+#include disable-programs.inc
+# Uncommenting this breaks launch
+# include disable-shell.inc
+include disable-write-mnt.inc
+# Don't disable ${DOCUMENTS}, ${MUSIC}, ${PICTURES}, ${VIDEOS}
+# include disable-xdg.inc
+
+# include whitelist-common.inc
+# include whitelist-runuser-common.inc
+# include whitelist-usr-share-common.inc
+# include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+# Uncommenting might break Pulse Audio
+#machine-id
+net none
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+# Allow applications launched on sound files to play them
+#nosound
+notv
+nou2f
+novideo
+protocol unix
+seccomp
+shell none
+tracelog
+
+private-cache
+private-dev
+# see /usr/share/doc/firejail/profile.template for more common private-etc paths.
+# private-etc alternatives,fonts,machine-id
+# Necessary because of the `include disable-exec.inc` line. Prevents error "Error fstat: fs.c:504 fs_remount_simple: Transport endpoint is not connected ... cannot sync with peer: unexpected EOF Peer [...] unexpectedly exited with status 1"
+private-tmp
+
+dbus-user none
+dbus-system none
diff --git a/etc/profile-a-l/cksum.profile b/etc/profile-a-l/cksum.profile
new file mode 100644
index 000000000..2baeed2ed
--- /dev/null
+++ b/etc/profile-a-l/cksum.profile
@@ -0,0 +1,13 @@
+# Firejail profile for cksum
+# Description: checksum and count the bytes in a file
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include cksum.local
+# Persistent global definitions
+include globals.local
+
+private-bin cksum
+
+# Redirect
+include hasher-common.profile
diff --git a/etc/profile-a-l/clawsker.profile b/etc/profile-a-l/clawsker.profile
index ac74d25c9..f71b35c26 100644
--- a/etc/profile-a-l/clawsker.profile
+++ b/etc/profile-a-l/clawsker.profile
@@ -45,7 +45,7 @@ private-bin bash,clawsker,perl,sh,which
 private-cache
 private-dev
 private-etc alternatives,fonts
-private-lib girepository-1.*,libdbus-glib-1.so.*,libetpan.so.*,libgirepository-1.*,libgtk-x11-2.0.so.*,libstartup-notification-1.so.*,perl*
+private-lib girepository-1.*,libdbus-glib-1.so.*,libetpan.so.*,libgirepository-1.*,libgtk-3.so.*,libgtk-x11-2.0.so.*,libstartup-notification-1.so.*,perl*
 private-tmp
 
 dbus-user none
diff --git a/etc/profile-a-l/engrampa.profile b/etc/profile-a-l/engrampa.profile
index 54fe6a0f9..7ec611293 100644
--- a/etc/profile-a-l/engrampa.profile
+++ b/etc/profile-a-l/engrampa.profile
@@ -17,6 +17,7 @@ include whitelist-var-common.inc
 
 apparmor
 caps.drop all
+net none
 no3d
 nodvd
 nogroups
@@ -35,4 +36,6 @@ tracelog
 private-dev
 # private-tmp
 
+dbus-user filter
+dbus-user.talk ca.desrt.dconf
 dbus-system none
diff --git a/etc/profile-a-l/firefox.profile b/etc/profile-a-l/firefox.profile
index 20bd9824c..68dd350ca 100644
--- a/etc/profile-a-l/firefox.profile
+++ b/etc/profile-a-l/firefox.profile
@@ -14,6 +14,11 @@ mkdir ${HOME}/.mozilla
 whitelist ${HOME}/.cache/mozilla/firefox
 whitelist ${HOME}/.mozilla
 
+# Uncomment or put in your firefox.local one of the following whitelist to enable KeePassXC Plugin
+# NOTE: start KeePassXC before Firefox and keep it open to allow communication between them
+#whitelist ${RUNUSER}/kpxc_server
+#whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer
+
 whitelist /usr/share/doc
 whitelist /usr/share/firefox
 whitelist /usr/share/gnome-shell/search-providers/firefox-search-provider.ini
diff --git a/etc/profile-a-l/gnome-logs.profile b/etc/profile-a-l/gnome-logs.profile
index 41218d3f7..d29c7609e 100644
--- a/etc/profile-a-l/gnome-logs.profile
+++ b/etc/profile-a-l/gnome-logs.profile
@@ -26,12 +26,7 @@ ipc-namespace
 net none
 no3d
 nodvd
-# When using 'volatile' storage (https://www.freedesktop.org/software/systemd/man/journald.conf.html),
-# comment both 'nogroups' and 'noroot'
-# or put 'ignore nogroups' and 'ignore noroot' in your gnome-logs.local.
-nogroups
 nonewprivs
-noroot
 nosound
 notv
 nou2f
@@ -50,7 +45,9 @@ private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.s
 private-tmp
 writable-var-log
 
-dbus-user none
+dbus-user filter
+dbus-user.own org.gnome.Logs
+dbus-user.talk ca.desrt.dconf
 dbus-system none
 
 # comment this if you export logs to a file in your ${HOME}
diff --git a/etc/profile-a-l/hasher-common.profile b/etc/profile-a-l/hasher-common.profile
new file mode 100644
index 000000000..2f684349d
--- /dev/null
+++ b/etc/profile-a-l/hasher-common.profile
@@ -0,0 +1,60 @@
+# This file is overwritten during software install.
+# Persistent customizations should go in a .local file.
+include hasher-common.local
+
+# common profile for hasher/checksum tools
+
+blacklist ${RUNUSER}
+
+# WARNING:
+# Users can (un)restrict file access for **all** hashers by commenting/uncommenting the needed
+# include file(s) here or by putting those into hasher-common.local.
+# Another option is to do this **per hasher** in the relevant <hasher>.local.
+# Just beware that things tend to break when overtightening profiles. For example, because you only
+# need to hash/check files in ${DOWNLOADS}, other applications may need access to ${HOME}/.local/share.
+
+# Uncomment the next line (or put it into your hasher-common.local) if you don't need to hash files in disable-common.inc.
+#include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+# Uncomment the next line (or put it into your hasher-common.local) if you don't need to hash files in disable-programs.inc.
+#include disable-programs.inc
+include disable-shell.inc
+include disable-write-mnt.inc
+# Uncomment the next line (or put it into your hasher-common.local) if you don't need to hash files in disable-xdg.inc.
+#include disable-xdg.inc
+
+apparmor
+caps.drop all
+ipc-namespace
+machine-id
+net none
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+nou2f
+novideo
+protocol unix
+seccomp
+seccomp.block-secondary
+shell none
+tracelog
+x11 none
+
+# Uncomment the next line (or put it into your hasher-common.local) if you don't need to hash files in /tmp.
+#private-cache
+private-dev
+# Uncomment the next line (or put it into your hasher-common.local) if you don't need to hash files in /tmp.
+#private-tmp
+
+dbus-user none
+dbus-system none
+
+memory-deny-write-execute
+read-only ${HOME}
diff --git a/etc/profile-a-l/k3b.profile b/etc/profile-a-l/k3b.profile
index 86292744c..3e686a454 100644
--- a/etc/profile-a-l/k3b.profile
+++ b/etc/profile-a-l/k3b.profile
@@ -21,7 +21,7 @@ include disable-xdg.inc
 
 include whitelist-var-common.inc
 
-caps.keep ipc_lock,sys_nice,sys_rawio,sys_resource
+caps.keep chown,dac_override,ipc_lock,net_bind_service,sys_admin,sys_nice,sys_rawio,sys_resource
 # net none
 netfilter
 no3d