diff options
Diffstat (limited to 'etc/profile-m-z')
349 files changed, 1584 insertions, 663 deletions
diff --git a/etc/profile-m-z/Maelstrom.profile b/etc/profile-m-z/Maelstrom.profile index 62d0a8b3a..3acb88e0e 100644 --- a/etc/profile-m-z/Maelstrom.profile +++ b/etc/profile-m-z/Maelstrom.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/Mathematica.profile b/etc/profile-m-z/Mathematica.profile index c2734b1c1..6286f066e 100644 --- a/etc/profile-m-z/Mathematica.profile +++ b/etc/profile-m-z/Mathematica.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${HOME}/.Wolfram Research | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | mkdir ${HOME}/.Mathematica | 16 | mkdir ${HOME}/.Mathematica |
diff --git a/etc/profile-m-z/PCSX2.profile b/etc/profile-m-z/PCSX2.profile index e678b7204..59150f4c4 100644 --- a/etc/profile-m-z/PCSX2.profile +++ b/etc/profile-m-z/PCSX2.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-write-mnt.inc | 19 | include disable-write-mnt.inc |
diff --git a/etc/profile-m-z/QMediathekView.profile b/etc/profile-m-z/QMediathekView.profile index 86120587b..17ea38073 100644 --- a/etc/profile-m-z/QMediathekView.profile +++ b/etc/profile-m-z/QMediathekView.profile | |||
@@ -23,7 +23,6 @@ include disable-common.inc | |||
23 | include disable-devel.inc | 23 | include disable-devel.inc |
24 | include disable-exec.inc | 24 | include disable-exec.inc |
25 | include disable-interpreters.inc | 25 | include disable-interpreters.inc |
26 | include disable-passwdmgr.inc | ||
27 | include disable-programs.inc | 26 | include disable-programs.inc |
28 | include disable-shell.inc | 27 | include disable-shell.inc |
29 | include disable-xdg.inc | 28 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/QOwnNotes.profile b/etc/profile-m-z/QOwnNotes.profile index 660378089..235640eeb 100644 --- a/etc/profile-m-z/QOwnNotes.profile +++ b/etc/profile-m-z/QOwnNotes.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -51,6 +50,6 @@ tracelog | |||
51 | disable-mnt | 50 | disable-mnt |
52 | private-bin gio,QOwnNotes | 51 | private-bin gio,QOwnNotes |
53 | private-dev | 52 | private-dev |
54 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hosts,ld.so.cache,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl | 53 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hosts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
diff --git a/etc/profile-m-z/Viber.profile b/etc/profile-m-z/Viber.profile index 3195e39fa..89ca53af6 100644 --- a/etc/profile-m-z/Viber.profile +++ b/etc/profile-m-z/Viber.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/.ViberPC | 17 | mkdir ${HOME}/.ViberPC |
@@ -34,5 +33,5 @@ shell none | |||
34 | 33 | ||
35 | disable-mnt | 34 | disable-mnt |
36 | private-bin awk,bash,dig,sh,Viber | 35 | private-bin awk,bash,dig,sh,Viber |
37 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hosts,localtime,machine-id,mailcap,nsswitch.conf,pki,proxychains.conf,pulse,resolv.conf,ssl,X11 | 36 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,mailcap,nsswitch.conf,pki,proxychains.conf,pulse,resolv.conf,ssl,X11 |
38 | private-tmp | 37 | private-tmp |
diff --git a/etc/profile-m-z/XMind.profile b/etc/profile-m-z/XMind.profile index d78e04595..9c797a3e5 100644 --- a/etc/profile-m-z/XMind.profile +++ b/etc/profile-m-z/XMind.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | mkdir ${HOME}/.xmind | 16 | mkdir ${HOME}/.xmind |
diff --git a/etc/profile-m-z/Xvfb.profile b/etc/profile-m-z/Xvfb.profile index 1acd43023..722e12d9c 100644 --- a/etc/profile-m-z/Xvfb.profile +++ b/etc/profile-m-z/Xvfb.profile | |||
@@ -43,5 +43,5 @@ private | |||
43 | # private-bin sh,xkbcomp,Xvfb | 43 | # private-bin sh,xkbcomp,Xvfb |
44 | # private-bin bash,cat,ls,sh,strace,xkbcomp,Xvfb | 44 | # private-bin bash,cat,ls,sh,strace,xkbcomp,Xvfb |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,nsswitch.conf,resolv.conf | 46 | private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.preload,nsswitch.conf,resolv.conf |
47 | private-tmp | 47 | private-tmp |
diff --git a/etc/profile-m-z/ZeGrapher.profile b/etc/profile-m-z/ZeGrapher.profile index 7686c3442..21482a161 100644 --- a/etc/profile-m-z/ZeGrapher.profile +++ b/etc/profile-m-z/ZeGrapher.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/macrofusion.profile b/etc/profile-m-z/macrofusion.profile index d1dcb6fe0..88b68d43f 100644 --- a/etc/profile-m-z/macrofusion.profile +++ b/etc/profile-m-z/macrofusion.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/magicor.profile b/etc/profile-m-z/magicor.profile index 8a27b2626..47165dd3d 100644 --- a/etc/profile-m-z/magicor.profile +++ b/etc/profile-m-z/magicor.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin magicor,python2* | 45 | private-bin magicor,python2* |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc machine-id | 48 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-m-z/make.profile b/etc/profile-m-z/make.profile new file mode 100644 index 000000000..7e9638fe4 --- /dev/null +++ b/etc/profile-m-z/make.profile | |||
@@ -0,0 +1,13 @@ | |||
1 | # Firejail profile for make | ||
2 | # Description: GNU make utility to maintain groups of programs | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include make.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | memory-deny-write-execute | ||
11 | |||
12 | # Redirect | ||
13 | include build-systems-common.profile | ||
diff --git a/etc/profile-m-z/makepkg.profile b/etc/profile-m-z/makepkg.profile index 513fcae55..3a68cce00 100644 --- a/etc/profile-m-z/makepkg.profile +++ b/etc/profile-m-z/makepkg.profile | |||
@@ -32,7 +32,6 @@ noblacklist /var/lib/pacman | |||
32 | 32 | ||
33 | include disable-common.inc | 33 | include disable-common.inc |
34 | include disable-exec.inc | 34 | include disable-exec.inc |
35 | include disable-passwdmgr.inc | ||
36 | include disable-programs.inc | 35 | include disable-programs.inc |
37 | 36 | ||
38 | caps.drop all | 37 | caps.drop all |
diff --git a/etc/profile-m-z/man.profile b/etc/profile-m-z/man.profile index bd510fcac..ed3dac10e 100644 --- a/etc/profile-m-z/man.profile +++ b/etc/profile-m-z/man.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
@@ -26,7 +25,6 @@ include disable-xdg.inc | |||
26 | whitelist /usr/share/groff | 25 | whitelist /usr/share/groff |
27 | whitelist /usr/share/info | 26 | whitelist /usr/share/info |
28 | whitelist /usr/share/lintian | 27 | whitelist /usr/share/lintian |
29 | whitelist /usr/share/locale | ||
30 | whitelist /usr/share/man | 28 | whitelist /usr/share/man |
31 | whitelist /var/cache/man | 29 | whitelist /var/cache/man |
32 | #include whitelist-common.inc | 30 | #include whitelist-common.inc |
@@ -59,7 +57,7 @@ disable-mnt | |||
59 | #private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim | 57 | #private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim |
60 | private-cache | 58 | private-cache |
61 | private-dev | 59 | private-dev |
62 | private-etc alternatives,fonts,groff,locale,locale.alias,locale.conf,man_db.conf,manpath.config,selinux,sysless,xdg | 60 | private-etc alternatives,fonts,groff,ld.so.cache,ld.so.preload,locale,locale.alias,locale.conf,man_db.conf,manpath.config,selinux,sysless,xdg |
63 | #private-tmp | 61 | #private-tmp |
64 | 62 | ||
65 | dbus-user none | 63 | dbus-user none |
@@ -67,4 +65,4 @@ dbus-system none | |||
67 | 65 | ||
68 | memory-deny-write-execute | 66 | memory-deny-write-execute |
69 | read-only ${HOME} | 67 | read-only ${HOME} |
70 | read-only /tmp | 68 | #read-only /tmp # breaks mandoc (see #4927) |
diff --git a/etc/profile-m-z/manaplus.profile b/etc/profile-m-z/manaplus.profile index f59a56ac6..28dc5d914 100644 --- a/etc/profile-m-z/manaplus.profile +++ b/etc/profile-m-z/manaplus.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/marker.profile b/etc/profile-m-z/marker.profile index 087c02964..746135ae5 100644 --- a/etc/profile-m-z/marker.profile +++ b/etc/profile-m-z/marker.profile | |||
@@ -20,11 +20,11 @@ include disable-common.inc | |||
20 | include disable-devel.inc | 20 | include disable-devel.inc |
21 | include disable-exec.inc | 21 | include disable-exec.inc |
22 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | 23 | include disable-programs.inc |
25 | include disable-shell.inc | 24 | include disable-shell.inc |
26 | include disable-xdg.inc | 25 | include disable-xdg.inc |
27 | 26 | ||
27 | whitelist /usr/libexec/webkit2gtk-4.0 | ||
28 | whitelist /usr/share/com.github.fabiocolacio.marker | 28 | whitelist /usr/share/com.github.fabiocolacio.marker |
29 | include whitelist-runuser-common.inc | 29 | include whitelist-runuser-common.inc |
30 | include whitelist-usr-share-common.inc | 30 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-m-z/masterpdfeditor.profile b/etc/profile-m-z/masterpdfeditor.profile index de1135071..764d040ab 100644 --- a/etc/profile-m-z/masterpdfeditor.profile +++ b/etc/profile-m-z/masterpdfeditor.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
@@ -37,6 +36,6 @@ tracelog | |||
37 | 36 | ||
38 | private-cache | 37 | private-cache |
39 | private-dev | 38 | private-dev |
40 | private-etc alternatives,fonts | 39 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
41 | private-tmp | 40 | private-tmp |
42 | 41 | ||
diff --git a/etc/profile-m-z/mate-calc.profile b/etc/profile-m-z/mate-calc.profile index 39ee7439d..2be6b9af1 100644 --- a/etc/profile-m-z/mate-calc.profile +++ b/etc/profile-m-z/mate-calc.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/.cache/mate-calc | 17 | mkdir ${HOME}/.cache/mate-calc |
@@ -43,7 +42,7 @@ shell none | |||
43 | 42 | ||
44 | disable-mnt | 43 | disable-mnt |
45 | private-bin mate-calc,mate-calculator | 44 | private-bin mate-calc,mate-calculator |
46 | private-etc alternatives,dconf,fonts,gtk-3.0 | 45 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload |
47 | private-dev | 46 | private-dev |
48 | private-opt none | 47 | private-opt none |
49 | private-tmp | 48 | private-tmp |
diff --git a/etc/profile-m-z/mate-color-select.profile b/etc/profile-m-z/mate-color-select.profile index 007bab30d..e16b0fc6c 100644 --- a/etc/profile-m-z/mate-color-select.profile +++ b/etc/profile-m-z/mate-color-select.profile | |||
@@ -9,7 +9,6 @@ include disable-common.inc | |||
9 | include disable-devel.inc | 9 | include disable-devel.inc |
10 | include disable-exec.inc | 10 | include disable-exec.inc |
11 | include disable-interpreters.inc | 11 | include disable-interpreters.inc |
12 | include disable-passwdmgr.inc | ||
13 | include disable-programs.inc | 12 | include disable-programs.inc |
14 | include disable-shell.inc | 13 | include disable-shell.inc |
15 | 14 | ||
@@ -34,7 +33,7 @@ shell none | |||
34 | 33 | ||
35 | disable-mnt | 34 | disable-mnt |
36 | private-bin mate-color-select | 35 | private-bin mate-color-select |
37 | private-etc alternatives,fonts | 36 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
38 | private-dev | 37 | private-dev |
39 | private-lib | 38 | private-lib |
40 | private-tmp | 39 | private-tmp |
diff --git a/etc/profile-m-z/mate-dictionary.profile b/etc/profile-m-z/mate-dictionary.profile index ae1fcbf62..469416304 100644 --- a/etc/profile-m-z/mate-dictionary.profile +++ b/etc/profile-m-z/mate-dictionary.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | 16 | ||
@@ -38,7 +37,7 @@ shell none | |||
38 | 37 | ||
39 | disable-mnt | 38 | disable-mnt |
40 | private-bin mate-dictionary | 39 | private-bin mate-dictionary |
41 | private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssl | 40 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl |
42 | private-opt mate-dictionary | 41 | private-opt mate-dictionary |
43 | private-dev | 42 | private-dev |
44 | private-tmp | 43 | private-tmp |
diff --git a/etc/profile-m-z/mcabber.profile b/etc/profile-m-z/mcabber.profile index 38d2d8d63..4c4a6aa76 100644 --- a/etc/profile-m-z/mcabber.profile +++ b/etc/profile-m-z/mcabber.profile | |||
@@ -12,7 +12,6 @@ noblacklist ${HOME}/.mcabberrc | |||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
@@ -32,4 +31,4 @@ shell none | |||
32 | 31 | ||
33 | private-bin mcabber | 32 | private-bin mcabber |
34 | private-dev | 33 | private-dev |
35 | private-etc alternatives,ca-certificates,crypto-policies,pki,ssl | 34 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,pki,ssl |
diff --git a/etc/profile-m-z/mcomix.profile b/etc/profile-m-z/mcomix.profile new file mode 100644 index 000000000..5c965f55c --- /dev/null +++ b/etc/profile-m-z/mcomix.profile | |||
@@ -0,0 +1,73 @@ | |||
1 | # Firejail profile for mcomix | ||
2 | # Description: A comic book and manga viewer in python | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include mcomix.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/mcomix | ||
10 | noblacklist ${HOME}/.local/share/mcomix | ||
11 | noblacklist ${DOCUMENTS} | ||
12 | |||
13 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
14 | include allow-bin-sh.inc | ||
15 | |||
16 | # Allow python (blacklisted by disable-interpreters.inc) | ||
17 | # mcomix <= 1.2 uses python2 | ||
18 | include allow-python2.inc | ||
19 | include allow-python3.inc | ||
20 | |||
21 | include disable-common.inc | ||
22 | include disable-devel.inc | ||
23 | include disable-exec.inc | ||
24 | include disable-interpreters.inc | ||
25 | include disable-programs.inc | ||
26 | include disable-shell.inc | ||
27 | include disable-write-mnt.inc | ||
28 | include disable-xdg.inc | ||
29 | |||
30 | mkdir ${HOME}/.config/mcomix | ||
31 | mkdir ${HOME}/.local/share/mcomix | ||
32 | whitelist /usr/share/mcomix | ||
33 | include whitelist-usr-share-common.inc | ||
34 | include whitelist-var-common.inc | ||
35 | include whitelist-runuser-common.inc | ||
36 | |||
37 | apparmor | ||
38 | caps.drop all | ||
39 | machine-id | ||
40 | net none | ||
41 | nodvd | ||
42 | nogroups | ||
43 | noinput | ||
44 | nonewprivs | ||
45 | noroot | ||
46 | nosound | ||
47 | notv | ||
48 | nou2f | ||
49 | novideo | ||
50 | protocol unix | ||
51 | seccomp | ||
52 | seccomp.block-secondary | ||
53 | shell none | ||
54 | tracelog | ||
55 | |||
56 | # mcomix <= 1.2 uses python2 | ||
57 | private-bin 7z,lha,mcomix,mutool,python*,rar,sh,unrar,unzip | ||
58 | private-cache | ||
59 | private-dev | ||
60 | # mcomix <= 1.2 uses gtk-2.0 | ||
61 | private-etc alternatives,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,pango,passwd,X11,xdg | ||
62 | private-tmp | ||
63 | |||
64 | dbus-user none | ||
65 | dbus-system none | ||
66 | |||
67 | read-only ${HOME} | ||
68 | read-write ${HOME}/.config/mcomix | ||
69 | read-write ${HOME}/.local/share/mcomix | ||
70 | #to allow ${HOME}/.local/share/recently-used.xbel | ||
71 | read-write ${HOME}/.local/share | ||
72 | # used by mcomix <= 1.2, tip, make a symbolic link to .cache/thumbnails | ||
73 | read-write ${HOME}/.thumbnails | ||
diff --git a/etc/profile-m-z/mdr.profile b/etc/profile-m-z/mdr.profile index 5d3f8dc41..bcfd59cbb 100644 --- a/etc/profile-m-z/mdr.profile +++ b/etc/profile-m-z/mdr.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin mdr | 45 | private-bin mdr |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc none | 48 | private-etc alternatives,ld.so.cache,ld.so.preload |
50 | private-lib | 49 | private-lib |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
diff --git a/etc/profile-m-z/mediainfo.profile b/etc/profile-m-z/mediainfo.profile index 17363624f..6a10edb9e 100644 --- a/etc/profile-m-z/mediainfo.profile +++ b/etc/profile-m-z/mediainfo.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for mediainfo | 1 | # Firejail profile for mediainfo |
2 | # Description: Command-line utility for reading information from audio/video files | 2 | # Description: Command-line utility for reading information from audio/video files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include mediainfo.local | 6 | include mediainfo.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
@@ -12,7 +13,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 13 | include disable-devel.inc |
13 | include disable-exec.inc | 14 | include disable-exec.inc |
14 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | 17 | include disable-shell.inc |
18 | 18 | ||
@@ -43,7 +43,7 @@ x11 none | |||
43 | private-bin mediainfo | 43 | private-bin mediainfo |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives | 46 | private-etc alternatives,ld.so.cache,ld.so.preload |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/mediathekview.profile b/etc/profile-m-z/mediathekview.profile index 0063badd8..f0ef7d010 100644 --- a/etc/profile-m-z/mediathekview.profile +++ b/etc/profile-m-z/mediathekview.profile | |||
@@ -17,6 +17,8 @@ noblacklist ${HOME}/.mediathek3 | |||
17 | noblacklist ${HOME}/.mplayer | 17 | noblacklist ${HOME}/.mplayer |
18 | noblacklist ${VIDEOS} | 18 | noblacklist ${VIDEOS} |
19 | 19 | ||
20 | ignore noexec /tmp | ||
21 | |||
20 | # Allow java (blacklisted by disable-devel.inc) | 22 | # Allow java (blacklisted by disable-devel.inc) |
21 | include allow-java.inc | 23 | include allow-java.inc |
22 | 24 | ||
@@ -24,10 +26,11 @@ include disable-common.inc | |||
24 | include disable-devel.inc | 26 | include disable-devel.inc |
25 | include disable-exec.inc | 27 | include disable-exec.inc |
26 | include disable-interpreters.inc | 28 | include disable-interpreters.inc |
27 | include disable-passwdmgr.inc | ||
28 | include disable-programs.inc | 29 | include disable-programs.inc |
29 | include disable-xdg.inc | 30 | include disable-xdg.inc |
30 | 31 | ||
32 | mkdir ${HOME}/.mediathek3 | ||
33 | whitelist ${HOME}/.mediathek3 | ||
31 | include whitelist-var-common.inc | 34 | include whitelist-var-common.inc |
32 | 35 | ||
33 | caps.drop all | 36 | caps.drop all |
diff --git a/etc/profile-m-z/megaglest.profile b/etc/profile-m-z/megaglest.profile index 972838729..d55745698 100644 --- a/etc/profile-m-z/megaglest.profile +++ b/etc/profile-m-z/megaglest.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -20,6 +19,7 @@ include disable-xdg.inc | |||
20 | mkdir ${HOME}/.megaglest | 19 | mkdir ${HOME}/.megaglest |
21 | whitelist ${HOME}/.megaglest | 20 | whitelist ${HOME}/.megaglest |
22 | whitelist /usr/share/megaglest | 21 | whitelist /usr/share/megaglest |
22 | whitelist /usr/share/games/megaglest # Debian version | ||
23 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | 24 | include whitelist-runuser-common.inc |
25 | include whitelist-usr-share-common.inc | 25 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-m-z/meld.profile b/etc/profile-m-z/meld.profile index 1225cc107..4aeca0f28 100644 --- a/etc/profile-m-z/meld.profile +++ b/etc/profile-m-z/meld.profile | |||
@@ -29,12 +29,13 @@ include allow-python3.inc | |||
29 | # Allow ssh (blacklisted by disable-common.inc) | 29 | # Allow ssh (blacklisted by disable-common.inc) |
30 | include allow-ssh.inc | 30 | include allow-ssh.inc |
31 | 31 | ||
32 | blacklist /usr/libexec | ||
33 | |||
32 | # Add the next line to your meld.local if you don't need to compare files in disable-common.inc. | 34 | # Add the next line to your meld.local if you don't need to compare files in disable-common.inc. |
33 | #include disable-common.inc | 35 | #include disable-common.inc |
34 | include disable-devel.inc | 36 | include disable-devel.inc |
35 | include disable-exec.inc | 37 | include disable-exec.inc |
36 | include disable-interpreters.inc | 38 | include disable-interpreters.inc |
37 | include disable-passwdmgr.inc | ||
38 | # Add the next line to your meld.local if you don't need to compare files in disable-programs.inc. | 39 | # Add the next line to your meld.local if you don't need to compare files in disable-programs.inc. |
39 | #include disable-programs.inc | 40 | #include disable-programs.inc |
40 | include disable-shell.inc | 41 | include disable-shell.inc |
diff --git a/etc/profile-m-z/mencoder.profile b/etc/profile-m-z/mencoder.profile index caf238785..3909e543e 100644 --- a/etc/profile-m-z/mencoder.profile +++ b/etc/profile-m-z/mencoder.profile | |||
@@ -11,7 +11,6 @@ include mencoder.local | |||
11 | #include disable-common.inc | 11 | #include disable-common.inc |
12 | #include disable-devel.inc | 12 | #include disable-devel.inc |
13 | #include disable-interpreters.inc | 13 | #include disable-interpreters.inc |
14 | #include disable-passwdmgr.inc | ||
15 | #include disable-programs.inc | 14 | #include disable-programs.inc |
16 | 15 | ||
17 | ipc-namespace | 16 | ipc-namespace |
diff --git a/etc/profile-m-z/mendeleydesktop.profile b/etc/profile-m-z/mendeleydesktop.profile index c0bdbb230..446109e9a 100644 --- a/etc/profile-m-z/mendeleydesktop.profile +++ b/etc/profile-m-z/mendeleydesktop.profile | |||
@@ -22,7 +22,6 @@ include disable-common.inc | |||
22 | include disable-devel.inc | 22 | include disable-devel.inc |
23 | include disable-exec.inc | 23 | include disable-exec.inc |
24 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
25 | include disable-passwdmgr.inc | ||
26 | include disable-programs.inc | 25 | include disable-programs.inc |
27 | 26 | ||
28 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/menulibre.profile b/etc/profile-m-z/menulibre.profile index 2081b8c96..ed0758a49 100644 --- a/etc/profile-m-z/menulibre.profile +++ b/etc/profile-m-z/menulibre.profile | |||
@@ -15,7 +15,6 @@ include disable-devel.inc | |||
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
21 | # Whitelist your system icon directory,varies by distro | 20 | # Whitelist your system icon directory,varies by distro |
@@ -53,7 +52,7 @@ tracelog | |||
53 | disable-mnt | 52 | disable-mnt |
54 | private-cache | 53 | private-cache |
55 | private-dev | 54 | private-dev |
56 | private-etc alternatives,dconf,fonts,gtk-3.0,locale.alias,locale.conf,mime.types,nsswitch.conf,passwd,pki,selinux,X11,xdg | 55 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,locale.alias,locale.conf,mime.types,nsswitch.conf,passwd,pki,selinux,X11,xdg |
57 | private-tmp | 56 | private-tmp |
58 | 57 | ||
59 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-m-z/meson.profile b/etc/profile-m-z/meson.profile new file mode 100644 index 000000000..b4909a9d8 --- /dev/null +++ b/etc/profile-m-z/meson.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for meson | ||
2 | # Description: A high productivity build system | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include meson.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | # Allow python3 (blacklisted by disable-interpreters.inc) | ||
11 | include allow-python3.inc | ||
12 | |||
13 | # Redirect | ||
14 | include build-systems-common.profile | ||
diff --git a/etc/profile-m-z/meteo-qt.profile b/etc/profile-m-z/meteo-qt.profile index 85ed7bc74..bdd36949b 100644 --- a/etc/profile-m-z/meteo-qt.profile +++ b/etc/profile-m-z/meteo-qt.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/microsoft-edge-beta.profile b/etc/profile-m-z/microsoft-edge-beta.profile new file mode 100644 index 000000000..095038f08 --- /dev/null +++ b/etc/profile-m-z/microsoft-edge-beta.profile | |||
@@ -0,0 +1,20 @@ | |||
1 | # Firejail profile for Microsoft Edge Beta | ||
2 | # Description: Web browser from Microsoft,beta channel | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include microsoft-edge-beta.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/microsoft-edge-beta | ||
10 | noblacklist ${HOME}/.config/microsoft-edge-beta | ||
11 | |||
12 | mkdir ${HOME}/.cache/microsoft-edge-beta | ||
13 | mkdir ${HOME}/.config/microsoft-edge-beta | ||
14 | whitelist ${HOME}/.cache/microsoft-edge-beta | ||
15 | whitelist ${HOME}/.config/microsoft-edge-beta | ||
16 | |||
17 | private-opt microsoft | ||
18 | |||
19 | # Redirect | ||
20 | include chromium-common.profile | ||
diff --git a/etc/profile-m-z/midori.profile b/etc/profile-m-z/midori.profile index e15259608..eb037f51b 100644 --- a/etc/profile-m-z/midori.profile +++ b/etc/profile-m-z/midori.profile | |||
@@ -12,10 +12,10 @@ include globals.local | |||
12 | noblacklist ${HOME}/.cache/midori | 12 | noblacklist ${HOME}/.cache/midori |
13 | noblacklist ${HOME}/.config/midori | 13 | noblacklist ${HOME}/.config/midori |
14 | noblacklist ${HOME}/.local/share/midori | 14 | noblacklist ${HOME}/.local/share/midori |
15 | noblacklist ${HOME}/.local/share/pki | ||
15 | # noblacklist ${HOME}/.local/share/webkit | 16 | # noblacklist ${HOME}/.local/share/webkit |
16 | # noblacklist ${HOME}/.local/share/webkitgtk | 17 | # noblacklist ${HOME}/.local/share/webkitgtk |
17 | noblacklist ${HOME}/.pki | 18 | noblacklist ${HOME}/.pki |
18 | noblacklist ${HOME}/.local/share/pki | ||
19 | 19 | ||
20 | noblacklist ${HOME}/.cache/gnome-mplayer | 20 | noblacklist ${HOME}/.cache/gnome-mplayer |
21 | noblacklist ${HOME}/.config/gnome-mplayer | 21 | noblacklist ${HOME}/.config/gnome-mplayer |
@@ -25,17 +25,16 @@ include disable-common.inc | |||
25 | include disable-devel.inc | 25 | include disable-devel.inc |
26 | include disable-exec.inc | 26 | include disable-exec.inc |
27 | include disable-interpreters.inc | 27 | include disable-interpreters.inc |
28 | #include disable-passwdmgr.inc | ||
29 | include disable-programs.inc | 28 | include disable-programs.inc |
30 | include disable-xdg.inc | 29 | include disable-xdg.inc |
31 | 30 | ||
32 | mkdir ${HOME}/.cache/midori | 31 | mkdir ${HOME}/.cache/midori |
33 | mkdir ${HOME}/.config/midori | 32 | mkdir ${HOME}/.config/midori |
34 | mkdir ${HOME}/.local/share/midori | 33 | mkdir ${HOME}/.local/share/midori |
34 | mkdir ${HOME}/.local/share/pki | ||
35 | mkdir ${HOME}/.local/share/webkit | 35 | mkdir ${HOME}/.local/share/webkit |
36 | mkdir ${HOME}/.local/share/webkitgtk | 36 | mkdir ${HOME}/.local/share/webkitgtk |
37 | mkdir ${HOME}/.pki | 37 | mkdir ${HOME}/.pki |
38 | mkdir ${HOME}/.local/share/pki | ||
39 | whitelist ${DOWNLOADS} | 38 | whitelist ${DOWNLOADS} |
40 | whitelist ${HOME}/.cache/gnome-mplayer/plugin | 39 | whitelist ${HOME}/.cache/gnome-mplayer/plugin |
41 | whitelist ${HOME}/.cache/midori | 40 | whitelist ${HOME}/.cache/midori |
@@ -43,10 +42,10 @@ whitelist ${HOME}/.config/gnome-mplayer | |||
43 | whitelist ${HOME}/.config/midori | 42 | whitelist ${HOME}/.config/midori |
44 | whitelist ${HOME}/.lastpass | 43 | whitelist ${HOME}/.lastpass |
45 | whitelist ${HOME}/.local/share/midori | 44 | whitelist ${HOME}/.local/share/midori |
45 | whitelist ${HOME}/.local/share/pki | ||
46 | whitelist ${HOME}/.local/share/webkit | 46 | whitelist ${HOME}/.local/share/webkit |
47 | whitelist ${HOME}/.local/share/webkitgtk | 47 | whitelist ${HOME}/.local/share/webkitgtk |
48 | whitelist ${HOME}/.pki | 48 | whitelist ${HOME}/.pki |
49 | whitelist ${HOME}/.local/share/pki | ||
50 | include whitelist-common.inc | 49 | include whitelist-common.inc |
51 | include whitelist-var-common.inc | 50 | include whitelist-var-common.inc |
52 | 51 | ||
diff --git a/etc/profile-m-z/mindless.profile b/etc/profile-m-z/mindless.profile index fbf6b58e8..16ace7ce4 100644 --- a/etc/profile-m-z/mindless.profile +++ b/etc/profile-m-z/mindless.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -43,7 +42,7 @@ private | |||
43 | private-bin mindless | 42 | private-bin mindless |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc fonts | 45 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-m-z/minecraft-launcher.profile b/etc/profile-m-z/minecraft-launcher.profile index cdea91b8f..d4f3e344e 100644 --- a/etc/profile-m-z/minecraft-launcher.profile +++ b/etc/profile-m-z/minecraft-launcher.profile | |||
@@ -6,7 +6,8 @@ include minecraft-launcher.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # On some distros executable may be in '/opt/minecraft-launcher/', if so, run 'firejail /opt/minecraft-launcher/minecraft-launcher' to start it. | 9 | # Some distros put the executable in /opt/minecraft-launcher. |
10 | # Run 'firejail /opt/minecraft-launcher/minecraft-launcher' to start it. | ||
10 | 11 | ||
11 | ignore noexec ${HOME} | 12 | ignore noexec ${HOME} |
12 | 13 | ||
@@ -18,7 +19,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 19 | include disable-devel.inc |
19 | include disable-exec.inc | 20 | include disable-exec.inc |
20 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-shell.inc | 23 | include disable-shell.inc |
24 | include disable-xdg.inc | 24 | include disable-xdg.inc |
@@ -30,7 +30,6 @@ include whitelist-runuser-common.inc | |||
30 | include whitelist-usr-share-common.inc | 30 | include whitelist-usr-share-common.inc |
31 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
32 | 32 | ||
33 | apparmor | ||
34 | caps.drop all | 33 | caps.drop all |
35 | netfilter | 34 | netfilter |
36 | nodvd | 35 | nodvd |
@@ -50,7 +49,8 @@ disable-mnt | |||
50 | private-bin java,java-config,minecraft-launcher | 49 | private-bin java,java-config,minecraft-launcher |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | # If multiplayer or realms break add your own java folder from /etc or comment the line below. | 52 | # If multiplayer or realms break, add 'private-etc <your-own-java-folder-from-/etc>' |
53 | # or 'ignore private-etc' to your minecraft-launcher.local. | ||
54 | private-etc alternatives,asound.conf,ati,ca-certificates,crypto-policies,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,java-10-openjdk,java-11-openjdk,java-12-openjdk,java-13-openjdk,java-14-openjdk,java-7-openjdk,java-8-openjdk,java-9-openjdk,java-openjdk,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,login.defs,machine-id,mime.types,nvidia,passwd,pki,pulse,resolv.conf,selinux,services,ssl,timezone,X11,xdg | 54 | private-etc alternatives,asound.conf,ati,ca-certificates,crypto-policies,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,java-10-openjdk,java-11-openjdk,java-12-openjdk,java-13-openjdk,java-14-openjdk,java-7-openjdk,java-8-openjdk,java-9-openjdk,java-openjdk,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,login.defs,machine-id,mime.types,nvidia,passwd,pki,pulse,resolv.conf,selinux,services,ssl,timezone,X11,xdg |
55 | private-opt minecraft-launcher | 55 | private-opt minecraft-launcher |
56 | private-tmp | 56 | private-tmp |
diff --git a/etc/profile-m-z/minetest.profile b/etc/profile-m-z/minetest.profile index cad1adbda..ec5de821a 100644 --- a/etc/profile-m-z/minetest.profile +++ b/etc/profile-m-z/minetest.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-shell.inc | 23 | include disable-shell.inc |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/minitube.profile b/etc/profile-m-z/minitube.profile index 3fe3428d0..581af9b81 100644 --- a/etc/profile-m-z/minitube.profile +++ b/etc/profile-m-z/minitube.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
@@ -47,7 +46,7 @@ notv | |||
47 | nou2f | 46 | nou2f |
48 | novideo | 47 | novideo |
49 | protocol unix,inet,inet6,netlink | 48 | protocol unix,inet,inet6,netlink |
50 | seccomp !kcmp | 49 | seccomp |
51 | shell none | 50 | shell none |
52 | tracelog | 51 | tracelog |
53 | 52 | ||
diff --git a/etc/profile-m-z/mirage.profile b/etc/profile-m-z/mirage.profile index 505009283..5a8544965 100644 --- a/etc/profile-m-z/mirage.profile +++ b/etc/profile-m-z/mirage.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-shell.inc | 23 | include disable-shell.inc |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/mirrormagic.profile b/etc/profile-m-z/mirrormagic.profile index 58dfd56f5..be846ce63 100644 --- a/etc/profile-m-z/mirrormagic.profile +++ b/etc/profile-m-z/mirrormagic.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -45,7 +44,7 @@ private | |||
45 | private-bin mirrormagic | 44 | private-bin mirrormagic |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc machine-id | 47 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-m-z/mocp.profile b/etc/profile-m-z/mocp.profile index e71ba4569..313d78030 100644 --- a/etc/profile-m-z/mocp.profile +++ b/etc/profile-m-z/mocp.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -43,7 +42,7 @@ tracelog | |||
43 | private-bin mocp | 42 | private-bin mocp |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,machine-id,pki,pulse,resolv.conf,ssl | 45 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-m-z/mousepad.profile b/etc/profile-m-z/mousepad.profile index 98063fa7c..2939d9bde 100644 --- a/etc/profile-m-z/mousepad.profile +++ b/etc/profile-m-z/mousepad.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/mp3splt-gtk.profile b/etc/profile-m-z/mp3splt-gtk.profile index 37ce60e04..fe3c78b55 100644 --- a/etc/profile-m-z/mp3splt-gtk.profile +++ b/etc/profile-m-z/mp3splt-gtk.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
@@ -38,7 +37,7 @@ tracelog | |||
38 | private-bin mp3splt-gtk | 37 | private-bin mp3splt-gtk |
39 | private-cache | 38 | private-cache |
40 | private-dev | 39 | private-dev |
41 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-3.0,machine-id,openal,pulse | 40 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,openal,pulse |
42 | private-tmp | 41 | private-tmp |
43 | 42 | ||
44 | dbus-user none | 43 | dbus-user none |
diff --git a/etc/profile-m-z/mp3splt.profile b/etc/profile-m-z/mp3splt.profile index 070de8451..c89c72ce4 100644 --- a/etc/profile-m-z/mp3splt.profile +++ b/etc/profile-m-z/mp3splt.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -45,7 +44,7 @@ disable-mnt | |||
45 | private-bin flacsplt,mp3splt,mp3wrap,oggsplt | 44 | private-bin flacsplt,mp3splt,mp3wrap,oggsplt |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc alternatives | 47 | private-etc alternatives,ld.so.cache,ld.so.preload |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | memory-deny-write-execute | 50 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/mpDris2.profile b/etc/profile-m-z/mpDris2.profile index 55a0b5897..18a839363 100644 --- a/etc/profile-m-z/mpDris2.profile +++ b/etc/profile-m-z/mpDris2.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ shell none | |||
50 | private-bin mpDris2,notify-send,python* | 49 | private-bin mpDris2,notify-send,python* |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc alternatives,hosts,nsswitch.conf | 52 | private-etc alternatives,hosts,ld.so.cache,ld.so.preload,nsswitch.conf |
54 | private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotify.so.*,libpython*,python2*,python3* | 53 | private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotify.so.*,libpython*,python2*,python3* |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
diff --git a/etc/profile-m-z/mpd.profile b/etc/profile-m-z/mpd.profile index b517d4ab2..761d5b041 100644 --- a/etc/profile-m-z/mpd.profile +++ b/etc/profile-m-z/mpd.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-m-z/mpg123.profile b/etc/profile-m-z/mpg123.profile index 25187e894..c3bff23bc 100644 --- a/etc/profile-m-z/mpg123.profile +++ b/etc/profile-m-z/mpg123.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/mplayer.profile b/etc/profile-m-z/mplayer.profile index 5d023b7f1..2d51d9884 100644 --- a/etc/profile-m-z/mplayer.profile +++ b/etc/profile-m-z/mplayer.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | read-only ${DESKTOP} | 17 | read-only ${DESKTOP} |
diff --git a/etc/profile-m-z/mpsyt.profile b/etc/profile-m-z/mpsyt.profile index bfe57a132..ffc7698c7 100644 --- a/etc/profile-m-z/mpsyt.profile +++ b/etc/profile-m-z/mpsyt.profile | |||
@@ -27,7 +27,6 @@ include disable-common.inc | |||
27 | include disable-devel.inc | 27 | include disable-devel.inc |
28 | include disable-exec.inc | 28 | include disable-exec.inc |
29 | include disable-interpreters.inc | 29 | include disable-interpreters.inc |
30 | include disable-passwdmgr.inc | ||
31 | include disable-programs.inc | 30 | include disable-programs.inc |
32 | include disable-shell.inc | 31 | include disable-shell.inc |
33 | include disable-xdg.inc | 32 | include disable-xdg.inc |
@@ -51,7 +50,6 @@ apparmor | |||
51 | caps.drop all | 50 | caps.drop all |
52 | netfilter | 51 | netfilter |
53 | nodvd | 52 | nodvd |
54 | # Seems to cause issues with Nvidia drivers sometimes | ||
55 | nogroups | 53 | nogroups |
56 | noinput | 54 | noinput |
57 | nonewprivs | 55 | nonewprivs |
diff --git a/etc/profile-m-z/mpv.profile b/etc/profile-m-z/mpv.profile index 310f36ea1..e58beec0c 100644 --- a/etc/profile-m-z/mpv.profile +++ b/etc/profile-m-z/mpv.profile | |||
@@ -11,7 +11,7 @@ include globals.local | |||
11 | # edit ~/.config/mpv/foobar.conf: | 11 | # edit ~/.config/mpv/foobar.conf: |
12 | # screenshot-directory=~/Pictures | 12 | # screenshot-directory=~/Pictures |
13 | 13 | ||
14 | # Mpv has a powerfull lua-API, some off these lua-scripts interact | 14 | # Mpv has a powerful lua-API, some off these lua-scripts interact |
15 | # with external resources which are blocked by firejail. In such cases | 15 | # with external resources which are blocked by firejail. In such cases |
16 | # you need to allow these resources by | 16 | # you need to allow these resources by |
17 | # - adding additional binaries to private-bin | 17 | # - adding additional binaries to private-bin |
@@ -26,7 +26,11 @@ include globals.local | |||
26 | 26 | ||
27 | noblacklist ${HOME}/.config/mpv | 27 | noblacklist ${HOME}/.config/mpv |
28 | noblacklist ${HOME}/.config/youtube-dl | 28 | noblacklist ${HOME}/.config/youtube-dl |
29 | noblacklist ${HOME}/.config/yt-dlp | ||
30 | noblacklist ${HOME}/.config/yt-dlp.conf | ||
29 | noblacklist ${HOME}/.netrc | 31 | noblacklist ${HOME}/.netrc |
32 | noblacklist ${HOME}/yt-dlp.conf | ||
33 | noblacklist ${HOME}/yt-dlp.conf.txt | ||
30 | 34 | ||
31 | # Allow lua (blacklisted by disable-interpreters.inc) | 35 | # Allow lua (blacklisted by disable-interpreters.inc) |
32 | include allow-lua.inc | 36 | include allow-lua.inc |
@@ -35,33 +39,36 @@ include allow-lua.inc | |||
35 | include allow-python2.inc | 39 | include allow-python2.inc |
36 | include allow-python3.inc | 40 | include allow-python3.inc |
37 | 41 | ||
42 | blacklist /usr/libexec | ||
43 | |||
38 | include disable-common.inc | 44 | include disable-common.inc |
39 | include disable-devel.inc | 45 | include disable-devel.inc |
40 | include disable-exec.inc | 46 | include disable-exec.inc |
41 | include disable-interpreters.inc | 47 | include disable-interpreters.inc |
42 | include disable-passwdmgr.inc | ||
43 | include disable-programs.inc | 48 | include disable-programs.inc |
44 | include disable-shell.inc | 49 | include disable-shell.inc |
45 | 50 | ||
46 | read-only ${DESKTOP} | 51 | read-only ${DESKTOP} |
47 | mkdir ${HOME}/.config/mpv | 52 | mkdir ${HOME}/.config/mpv |
48 | mkdir ${HOME}/.config/youtube-dl | ||
49 | mkfile ${HOME}/.netrc | 53 | mkfile ${HOME}/.netrc |
50 | whitelist ${HOME}/.config/mpv | 54 | whitelist ${HOME}/.config/mpv |
51 | whitelist ${HOME}/.config/youtube-dl | 55 | whitelist ${HOME}/.config/youtube-dl |
56 | whitelist ${HOME}/.config/yt-dlp | ||
57 | whitelist ${HOME}/.config/yt-dlp.conf | ||
52 | whitelist ${HOME}/.netrc | 58 | whitelist ${HOME}/.netrc |
53 | include whitelist-common.inc | 59 | whitelist ${HOME}/yt-dlp.conf |
54 | include whitelist-player-common.inc | 60 | whitelist ${HOME}/yt-dlp.conf.txt |
55 | whitelist /usr/share/lua | 61 | whitelist /usr/share/lua |
56 | whitelist /usr/share/lua* | 62 | whitelist /usr/share/lua* |
57 | whitelist /usr/share/vulkan | 63 | whitelist /usr/share/vulkan |
64 | include whitelist-common.inc | ||
65 | include whitelist-player-common.inc | ||
58 | include whitelist-usr-share-common.inc | 66 | include whitelist-usr-share-common.inc |
59 | include whitelist-var-common.inc | 67 | include whitelist-var-common.inc |
60 | 68 | ||
61 | apparmor | 69 | apparmor |
62 | caps.drop all | 70 | caps.drop all |
63 | netfilter | 71 | netfilter |
64 | # nogroups seems to cause issues with Nvidia drivers sometimes | ||
65 | nogroups | 72 | nogroups |
66 | noinput | 73 | noinput |
67 | nonewprivs | 74 | nonewprivs |
@@ -73,7 +80,7 @@ seccomp.block-secondary | |||
73 | shell none | 80 | shell none |
74 | tracelog | 81 | tracelog |
75 | 82 | ||
76 | private-bin env,mpv,python*,waf,youtube-dl | 83 | private-bin env,mpv,python*,waf,youtube-dl,yt-dlp |
77 | # private-cache causes slow OSD, see #2838 | 84 | # private-cache causes slow OSD, see #2838 |
78 | #private-cache | 85 | #private-cache |
79 | private-dev | 86 | private-dev |
diff --git a/etc/profile-m-z/mrrescue.profile b/etc/profile-m-z/mrrescue.profile index 035a7e625..3fe88ec7f 100644 --- a/etc/profile-m-z/mrrescue.profile +++ b/etc/profile-m-z/mrrescue.profile | |||
@@ -14,11 +14,12 @@ include allow-bin-sh.inc | |||
14 | # Allow lua (blacklisted by disable-interpreters.inc) | 14 | # Allow lua (blacklisted by disable-interpreters.inc) |
15 | include allow-lua.inc | 15 | include allow-lua.inc |
16 | 16 | ||
17 | blacklist /usr/libexec | ||
18 | |||
17 | include disable-common.inc | 19 | include disable-common.inc |
18 | include disable-devel.inc | 20 | include disable-devel.inc |
19 | include disable-exec.inc | 21 | include disable-exec.inc |
20 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 23 | include disable-programs.inc |
23 | include disable-shell.inc | 24 | include disable-shell.inc |
24 | include disable-xdg.inc | 25 | include disable-xdg.inc |
@@ -36,7 +37,6 @@ caps.drop all | |||
36 | net none | 37 | net none |
37 | nodvd | 38 | nodvd |
38 | nogroups | 39 | nogroups |
39 | noinput | ||
40 | nonewprivs | 40 | nonewprivs |
41 | noroot | 41 | noroot |
42 | notv | 42 | notv |
@@ -52,7 +52,7 @@ disable-mnt | |||
52 | private-bin love,mrrescue,sh | 52 | private-bin love,mrrescue,sh |
53 | private-cache | 53 | private-cache |
54 | private-dev | 54 | private-dev |
55 | private-etc machine-id | 55 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
56 | private-tmp | 56 | private-tmp |
57 | 57 | ||
58 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-m-z/ms-office.profile b/etc/profile-m-z/ms-office.profile index 38fc84ecc..e15b14db7 100644 --- a/etc/profile-m-z/ms-office.profile +++ b/etc/profile-m-z/ms-office.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | caps.drop all | 21 | caps.drop all |
@@ -36,7 +35,7 @@ tracelog | |||
36 | 35 | ||
37 | disable-mnt | 36 | disable-mnt |
38 | private-bin bash,env,fonts,jak,ms-office,python*,sh | 37 | private-bin bash,env,fonts,jak,ms-office,python*,sh |
39 | private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl | 38 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl |
40 | private-dev | 39 | private-dev |
41 | private-tmp | 40 | private-tmp |
42 | 41 | ||
diff --git a/etc/profile-m-z/mtpaint.profile b/etc/profile-m-z/mtpaint.profile index 85c3ee9f2..126336cb3 100644 --- a/etc/profile-m-z/mtpaint.profile +++ b/etc/profile-m-z/mtpaint.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/multimc5.profile b/etc/profile-m-z/multimc5.profile index 6df681df1..a61f9001d 100644 --- a/etc/profile-m-z/multimc5.profile +++ b/etc/profile-m-z/multimc5.profile | |||
@@ -9,6 +9,10 @@ noblacklist ${HOME}/.local/share/multimc | |||
9 | noblacklist ${HOME}/.local/share/multimc5 | 9 | noblacklist ${HOME}/.local/share/multimc5 |
10 | noblacklist ${HOME}/.multimc5 | 10 | noblacklist ${HOME}/.multimc5 |
11 | 11 | ||
12 | # Ignore noexec on ${HOME} as MultiMC installs LWJGL native | ||
13 | # libraries in ${HOME}/.local/share/multimc | ||
14 | ignore noexec ${HOME} | ||
15 | |||
12 | # Allow java (blacklisted by disable-devel.inc) | 16 | # Allow java (blacklisted by disable-devel.inc) |
13 | include allow-java.inc | 17 | include allow-java.inc |
14 | 18 | ||
@@ -16,7 +20,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 20 | include disable-devel.inc |
17 | include disable-exec.inc | 21 | include disable-exec.inc |
18 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 23 | include disable-programs.inc |
21 | 24 | ||
22 | mkdir ${HOME}/.local/share/multimc | 25 | mkdir ${HOME}/.local/share/multimc |
diff --git a/etc/profile-m-z/mumble.profile b/etc/profile-m-z/mumble.profile index c7f59c5ee..ad0920979 100644 --- a/etc/profile-m-z/mumble.profile +++ b/etc/profile-m-z/mumble.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/mupdf-x11-curl.profile b/etc/profile-m-z/mupdf-x11-curl.profile index a04d386a2..006f64ba8 100644 --- a/etc/profile-m-z/mupdf-x11-curl.profile +++ b/etc/profile-m-z/mupdf-x11-curl.profile | |||
@@ -12,7 +12,7 @@ ignore net none | |||
12 | netfilter | 12 | netfilter |
13 | protocol unix,inet,inet6 | 13 | protocol unix,inet,inet6 |
14 | 14 | ||
15 | private-etc ca-certificates,crypto-policies,hosts,nsswitch.conf,pki,resolv.conf,ssl | 15 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
16 | 16 | ||
17 | # Redirect | 17 | # Redirect |
18 | include mupdf.profile | 18 | include mupdf.profile |
diff --git a/etc/profile-m-z/mupdf.profile b/etc/profile-m-z/mupdf.profile index 9e4609c48..22cb83cc4 100644 --- a/etc/profile-m-z/mupdf.profile +++ b/etc/profile-m-z/mupdf.profile | |||
@@ -4,7 +4,7 @@ | |||
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include mupdf.local | 5 | include mupdf.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | #include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${DOCUMENTS} | 9 | noblacklist ${DOCUMENTS} |
10 | 10 | ||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/mupen64plus.profile b/etc/profile-m-z/mupen64plus.profile index 00983a8f3..093767c27 100644 --- a/etc/profile-m-z/mupen64plus.profile +++ b/etc/profile-m-z/mupen64plus.profile | |||
@@ -11,8 +11,6 @@ noblacklist ${HOME}/.local/share/mupen64plus | |||
11 | 11 | ||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 14 | include disable-programs.inc |
17 | 15 | ||
18 | # you'll need to manually whitelist ROM files | 16 | # you'll need to manually whitelist ROM files |
diff --git a/etc/profile-m-z/musescore.profile b/etc/profile-m-z/musescore.profile index 679e82ae8..12bb653a8 100644 --- a/etc/profile-m-z/musescore.profile +++ b/etc/profile-m-z/musescore.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-m-z/musictube.profile b/etc/profile-m-z/musictube.profile index 04500ac6a..226fb4810 100644 --- a/etc/profile-m-z/musictube.profile +++ b/etc/profile-m-z/musictube.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/musixmatch.profile b/etc/profile-m-z/musixmatch.profile index 74b3e9a5f..796d7fbb0 100644 --- a/etc/profile-m-z/musixmatch.profile +++ b/etc/profile-m-z/musixmatch.profile | |||
@@ -10,7 +10,6 @@ noblacklist ${MUSIC} | |||
10 | include disable-common.inc | 10 | include disable-common.inc |
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-xdg.inc | 14 | include disable-xdg.inc |
16 | 15 | ||
@@ -30,9 +29,9 @@ notv | |||
30 | nou2f | 29 | nou2f |
31 | novideo | 30 | novideo |
32 | protocol unix,inet,inet6,netlink | 31 | protocol unix,inet,inet6,netlink |
33 | seccomp | 32 | seccomp !chroot |
34 | 33 | ||
35 | disable-mnt | 34 | disable-mnt |
36 | private-dev | 35 | private-dev |
37 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,machine-id,pki,pulse,ssl | 36 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,machine-id,pki,pulse,ssl |
38 | 37 | ||
diff --git a/etc/profile-m-z/mutt.profile b/etc/profile-m-z/mutt.profile index debf81659..d10c55549 100644 --- a/etc/profile-m-z/mutt.profile +++ b/etc/profile-m-z/mutt.profile | |||
@@ -47,7 +47,6 @@ include disable-common.inc | |||
47 | include disable-devel.inc | 47 | include disable-devel.inc |
48 | include disable-exec.inc | 48 | include disable-exec.inc |
49 | include disable-interpreters.inc | 49 | include disable-interpreters.inc |
50 | include disable-passwdmgr.inc | ||
51 | include disable-programs.inc | 50 | include disable-programs.inc |
52 | include disable-xdg.inc | 51 | include disable-xdg.inc |
53 | 52 | ||
@@ -135,7 +134,7 @@ tracelog | |||
135 | # disable-mnt | 134 | # disable-mnt |
136 | private-cache | 135 | private-cache |
137 | private-dev | 136 | private-dev |
138 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gai.conf,gcrypt,gnupg,gnutls,hostname,hosts,hosts.conf,mail,mailname,Mutt,Muttrc,Muttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,terminfo,xdg | 137 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gai.conf,gcrypt,gnupg,gnutls,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,mail,mailname,Mutt,Muttrc,Muttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,terminfo,xdg |
139 | private-tmp | 138 | private-tmp |
140 | writable-run-user | 139 | writable-run-user |
141 | writable-var | 140 | writable-var |
diff --git a/etc/profile-m-z/mypaint.profile b/etc/profile-m-z/mypaint.profile index d8d487fe7..74301df06 100644 --- a/etc/profile-m-z/mypaint.profile +++ b/etc/profile-m-z/mypaint.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
25 | 24 | ||
@@ -44,7 +43,7 @@ tracelog | |||
44 | 43 | ||
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,dconf,fonts,gtk-3.0 | 46 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/nano.profile b/etc/profile-m-z/nano.profile index 45d5f59dd..f7c1f0ff7 100644 --- a/etc/profile-m-z/nano.profile +++ b/etc/profile-m-z/nano.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | whitelist /usr/share/nano | 21 | whitelist /usr/share/nano |
@@ -47,8 +46,12 @@ x11 none | |||
47 | private-bin nano,rnano | 46 | private-bin nano,rnano |
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | # Comment the next line if you want to edit files in /etc directly | 49 | # Add the next lines to your nano.local if you want to edit files in /etc directly. |
51 | private-etc alternatives,nanorc | 50 | #ignore private-etc |
51 | #writable-etc | ||
52 | private-etc alternatives,ld.so.cache,ld.so.preload,nanorc | ||
53 | # Add the next line to your nano.local if you want to edit files in /var directly. | ||
54 | #writable-var | ||
52 | 55 | ||
53 | dbus-user none | 56 | dbus-user none |
54 | dbus-system none | 57 | dbus-system none |
diff --git a/etc/profile-m-z/natron.profile b/etc/profile-m-z/natron.profile index 5bf152f84..2464844c4 100644 --- a/etc/profile-m-z/natron.profile +++ b/etc/profile-m-z/natron.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | 21 | ||
23 | caps.drop all | 22 | caps.drop all |
diff --git a/etc/profile-m-z/ncdu.profile b/etc/profile-m-z/ncdu.profile index 063e30366..5578cfc9c 100644 --- a/etc/profile-m-z/ncdu.profile +++ b/etc/profile-m-z/ncdu.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for ncdu | 1 | # Firejail profile for ncdu |
2 | # Description: Ncurses disk usage viewer | 2 | # Description: Ncurses disk usage viewer |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include ncdu.local | 6 | include ncdu.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
diff --git a/etc/profile-m-z/ncdu2.profile b/etc/profile-m-z/ncdu2.profile new file mode 100644 index 000000000..220692b3a --- /dev/null +++ b/etc/profile-m-z/ncdu2.profile | |||
@@ -0,0 +1,12 @@ | |||
1 | # Firejail profile for ncdu2 | ||
2 | # Description: Ncurses disk usage viewer (zig rewrite) | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include ncdu2.local | ||
7 | # Persistent global definitions | ||
8 | # added by included profile | ||
9 | #include globals.local | ||
10 | |||
11 | # Redirect | ||
12 | include ncdu.profile | ||
diff --git a/etc/profile-m-z/neochat.profile b/etc/profile-m-z/neochat.profile index 9f00448c8..0f55b674f 100644 --- a/etc/profile-m-z/neochat.profile +++ b/etc/profile-m-z/neochat.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-shell.inc | 21 | include disable-shell.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
@@ -61,6 +60,6 @@ private-tmp | |||
61 | dbus-user filter | 60 | dbus-user filter |
62 | dbus-user.own org.kde.neochat | 61 | dbus-user.own org.kde.neochat |
63 | dbus-user.talk org.freedesktop.Notifications | 62 | dbus-user.talk org.freedesktop.Notifications |
64 | dbus-user.talk org.kde.StatusNotifierWatcher | 63 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher |
65 | dbus-user.talk org.kde.kwalletd5 | 64 | dbus-user.talk org.kde.kwalletd5 |
66 | dbus-system none | 65 | dbus-system none |
diff --git a/etc/profile-m-z/neomutt.profile b/etc/profile-m-z/neomutt.profile index fafa129e4..f31cf9dcb 100644 --- a/etc/profile-m-z/neomutt.profile +++ b/etc/profile-m-z/neomutt.profile | |||
@@ -46,7 +46,6 @@ include disable-common.inc | |||
46 | include disable-devel.inc | 46 | include disable-devel.inc |
47 | include disable-exec.inc | 47 | include disable-exec.inc |
48 | include disable-interpreters.inc | 48 | include disable-interpreters.inc |
49 | include disable-passwdmgr.inc | ||
50 | include disable-programs.inc | 49 | include disable-programs.inc |
51 | include disable-xdg.inc | 50 | include disable-xdg.inc |
52 | 51 | ||
@@ -138,7 +137,7 @@ tracelog | |||
138 | # disable-mnt | 137 | # disable-mnt |
139 | private-cache | 138 | private-cache |
140 | private-dev | 139 | private-dev |
141 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,hostname,hosts,hosts.conf,mail,mailname,Mutt,Muttrc,Muttrc.d,neomuttrc,neomuttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,xdg | 140 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,mail,mailname,Mutt,Muttrc,Muttrc.d,neomuttrc,neomuttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,xdg |
142 | private-tmp | 141 | private-tmp |
143 | writable-run-user | 142 | writable-run-user |
144 | writable-var | 143 | writable-var |
diff --git a/etc/profile-m-z/netactview.profile b/etc/profile-m-z/netactview.profile index 5d45dd7bc..d6ac8d5bc 100644 --- a/etc/profile-m-z/netactview.profile +++ b/etc/profile-m-z/netactview.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin netactview,netactview_polkit | 45 | private-bin netactview,netactview_polkit |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
50 | private-lib | 49 | private-lib |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
diff --git a/etc/profile-m-z/nethack-vultures.profile b/etc/profile-m-z/nethack-vultures.profile index c9a537370..4da43a2d0 100644 --- a/etc/profile-m-z/nethack-vultures.profile +++ b/etc/profile-m-z/nethack-vultures.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/.vultures | 17 | mkdir ${HOME}/.vultures |
diff --git a/etc/profile-m-z/nethack.profile b/etc/profile-m-z/nethack.profile index b57abe260..5037133f2 100644 --- a/etc/profile-m-z/nethack.profile +++ b/etc/profile-m-z/nethack.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | whitelist /var/games/nethack | 17 | whitelist /var/games/nethack |
diff --git a/etc/profile-m-z/neverball.profile b/etc/profile-m-z/neverball.profile index ecfbb14e4..9b7826fd0 100644 --- a/etc/profile-m-z/neverball.profile +++ b/etc/profile-m-z/neverball.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/newsboat.profile b/etc/profile-m-z/newsboat.profile index 13bc3a615..cf72bf802 100644 --- a/etc/profile-m-z/newsboat.profile +++ b/etc/profile-m-z/newsboat.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
@@ -54,7 +53,7 @@ disable-mnt | |||
54 | private-bin gzip,lynx,newsboat,sh,w3m | 53 | private-bin gzip,lynx,newsboat,sh,w3m |
55 | private-cache | 54 | private-cache |
56 | private-dev | 55 | private-dev |
57 | private-etc alternatives,ca-certificates,crypto-policies,lynx.cfg,lynx.lss,pki,resolv.conf,ssl,terminfo | 56 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,lynx.cfg,lynx.lss,pki,resolv.conf,ssl,terminfo |
58 | private-tmp | 57 | private-tmp |
59 | 58 | ||
60 | dbus-user none | 59 | dbus-user none |
diff --git a/etc/profile-m-z/newsflash.profile b/etc/profile-m-z/newsflash.profile index 18d8c6ed4..9966a0e1b 100644 --- a/etc/profile-m-z/newsflash.profile +++ b/etc/profile-m-z/newsflash.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -52,7 +51,7 @@ disable-mnt | |||
52 | private-bin com.gitlab.newsflash,newsflash | 51 | private-bin com.gitlab.newsflash,newsflash |
53 | private-cache | 52 | private-cache |
54 | private-dev | 53 | private-dev |
55 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pango,pki,resolv.conf,ssl,X11 | 54 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pango,pki,resolv.conf,ssl,X11 |
56 | private-tmp | 55 | private-tmp |
57 | 56 | ||
58 | dbus-user none | 57 | dbus-user none |
diff --git a/etc/profile-m-z/nextcloud.profile b/etc/profile-m-z/nextcloud.profile index 9fd76fbe7..2e4a95125 100644 --- a/etc/profile-m-z/nextcloud.profile +++ b/etc/profile-m-z/nextcloud.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-shell.inc | 23 | include disable-shell.inc |
25 | include disable-xdg.inc | 24 | include disable-xdg.inc |
@@ -30,6 +29,7 @@ mkdir ${HOME}/.local/share/Nextcloud | |||
30 | whitelist ${HOME}/Nextcloud | 29 | whitelist ${HOME}/Nextcloud |
31 | whitelist ${HOME}/.config/Nextcloud | 30 | whitelist ${HOME}/.config/Nextcloud |
32 | whitelist ${HOME}/.local/share/Nextcloud | 31 | whitelist ${HOME}/.local/share/Nextcloud |
32 | whitelist /usr/share/nextcloud | ||
33 | # Add the next lines to your nextcloud.local to allow sync in more directories. | 33 | # Add the next lines to your nextcloud.local to allow sync in more directories. |
34 | #whitelist ${DOCUMENTS} | 34 | #whitelist ${DOCUMENTS} |
35 | #whitelist ${MUSIC} | 35 | #whitelist ${MUSIC} |
@@ -44,7 +44,6 @@ apparmor | |||
44 | caps.drop all | 44 | caps.drop all |
45 | machine-id | 45 | machine-id |
46 | netfilter | 46 | netfilter |
47 | no3d | ||
48 | nodvd | 47 | nodvd |
49 | nogroups | 48 | nogroups |
50 | noinput | 49 | noinput |
@@ -63,10 +62,11 @@ tracelog | |||
63 | disable-mnt | 62 | disable-mnt |
64 | private-bin nextcloud,nextcloud-desktop | 63 | private-bin nextcloud,nextcloud-desktop |
65 | private-cache | 64 | private-cache |
66 | private-etc alternatives,ca-certificates,crypto-policies,drirc,fonts,gcrypt,host.conf,hosts,ld.so.cache,machine-id,Nextcloud,nsswitch.conf,os-release,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg | 65 | private-etc alternatives,ca-certificates,crypto-policies,drirc,fonts,gcrypt,host.conf,hosts,ld.so.cache,ld.so.preload,machine-id,Nextcloud,nsswitch.conf,os-release,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg |
67 | private-dev | 66 | private-dev |
68 | private-tmp | 67 | private-tmp |
69 | 68 | ||
70 | dbus-user filter | 69 | dbus-user filter |
71 | dbus-user.talk org.freedesktop.secrets | 70 | dbus-user.talk org.freedesktop.secrets |
71 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher | ||
72 | dbus-system none | 72 | dbus-system none |
diff --git a/etc/profile-m-z/nheko.profile b/etc/profile-m-z/nheko.profile index f8062891c..89a146a09 100644 --- a/etc/profile-m-z/nheko.profile +++ b/etc/profile-m-z/nheko.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -52,11 +51,9 @@ private-dev | |||
52 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 51 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
55 | 54 | dbus-user filter | |
56 | # Add the next lines to your nheko.local to enable notification support. | 55 | dbus-user.talk org.freedesktop.secrets |
57 | #ignore dbus-user none | 56 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher |
58 | #dbus-user filter | 57 | # Add the next line to your nheko.local to enable notification support. |
59 | #dbus-user.talk org.freedesktop.Notifications | 58 | #dbus-user.talk org.freedesktop.Notifications |
60 | #dbus-user.talk org.kde.StatusNotifierWatcher | ||
61 | dbus-user none | ||
62 | dbus-system none | 59 | dbus-system none |
diff --git a/etc/profile-m-z/nicotine.profile b/etc/profile-m-z/nicotine.profile index 1c7dbc009..0b55a0d3a 100644 --- a/etc/profile-m-z/nicotine.profile +++ b/etc/profile-m-z/nicotine.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/nitroshare.profile b/etc/profile-m-z/nitroshare.profile index 8dba84f02..d6234cd04 100644 --- a/etc/profile-m-z/nitroshare.profile +++ b/etc/profile-m-z/nitroshare.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | 21 | ||
23 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
@@ -43,7 +42,7 @@ disable-mnt | |||
43 | private-bin awk,grep,nitroshare,nitroshare-cli,nitroshare-nmh,nitroshare-send,nitroshare-ui | 42 | private-bin awk,grep,nitroshare,nitroshare-cli,nitroshare-nmh,nitroshare-send,nitroshare-ui |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc alternatives,ca-certificates,dconf,fonts,hostname,hosts,ld.so.cache,machine-id,nsswitch.conf,ssl | 45 | private-etc alternatives,ca-certificates,dconf,fonts,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,ssl |
47 | # private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare | 46 | # private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
diff --git a/etc/profile-m-z/node.profile b/etc/profile-m-z/node.profile new file mode 100644 index 000000000..cd48ed3c7 --- /dev/null +++ b/etc/profile-m-z/node.profile | |||
@@ -0,0 +1,11 @@ | |||
1 | # Firejail profile for node | ||
2 | # Description: Evented I/O for V8 javascript | ||
3 | quiet | ||
4 | # This file is overwritten after every install/update | ||
5 | # Persistent local customizations | ||
6 | include node.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | # Redirect | ||
11 | include nodejs-common.profile | ||
diff --git a/etc/profile-m-z/nodejs-common.profile b/etc/profile-m-z/nodejs-common.profile index 4095337dd..ab69136f6 100644 --- a/etc/profile-m-z/nodejs-common.profile +++ b/etc/profile-m-z/nodejs-common.profile | |||
@@ -10,17 +10,56 @@ include nodejs-common.local | |||
10 | blacklist /tmp/.X11-unix | 10 | blacklist /tmp/.X11-unix |
11 | blacklist ${RUNUSER} | 11 | blacklist ${RUNUSER} |
12 | 12 | ||
13 | ignore read-only ${HOME}/.npm-packages | ||
14 | ignore read-only ${HOME}/.npmrc | ||
15 | ignore read-only ${HOME}/.nvm | ||
16 | ignore read-only ${HOME}/.yarnrc | ||
17 | |||
18 | noblacklist ${HOME}/.node-gyp | ||
19 | noblacklist ${HOME}/.npm | ||
20 | noblacklist ${HOME}/.npmrc | ||
21 | noblacklist ${HOME}/.nvm | ||
22 | noblacklist ${HOME}/.yarn | ||
23 | noblacklist ${HOME}/.yarn-config | ||
24 | noblacklist ${HOME}/.yarncache | ||
25 | noblacklist ${HOME}/.yarnrc | ||
26 | |||
13 | ignore noexec ${HOME} | 27 | ignore noexec ${HOME} |
14 | 28 | ||
15 | include allow-bin-sh.inc | 29 | include allow-bin-sh.inc |
16 | 30 | ||
17 | include disable-common.inc | 31 | include disable-common.inc |
18 | include disable-exec.inc | 32 | include disable-exec.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 33 | include disable-programs.inc |
21 | include disable-shell.inc | 34 | include disable-shell.inc |
22 | include disable-xdg.inc | 35 | include disable-xdg.inc |
23 | 36 | ||
37 | # If you want whitelisting, change ${HOME}/Projects below to your node projects directory | ||
38 | # and add the next lines to your nodejs-common.local. | ||
39 | #mkdir ${HOME}/.node-gyp | ||
40 | #mkdir ${HOME}/.npm | ||
41 | #mkdir ${HOME}/.npm-packages | ||
42 | #mkfile ${HOME}/.npmrc | ||
43 | #mkdir ${HOME}/.nvm | ||
44 | #mkdir ${HOME}/.yarn | ||
45 | #mkdir ${HOME}/.yarn-config | ||
46 | #mkdir ${HOME}/.yarncache | ||
47 | #mkfile ${HOME}/.yarnrc | ||
48 | #whitelist ${HOME}/.node-gyp | ||
49 | #whitelist ${HOME}/.npm | ||
50 | #whitelist ${HOME}/.npm-packages | ||
51 | #whitelist ${HOME}/.npmrc | ||
52 | #whitelist ${HOME}/.nvm | ||
53 | #whitelist ${HOME}/.yarn | ||
54 | #whitelist ${HOME}/.yarn-config | ||
55 | #whitelist ${HOME}/.yarncache | ||
56 | #whitelist ${HOME}/.yarnrc | ||
57 | #whitelist ${HOME}/Projects | ||
58 | #include whitelist-common.inc | ||
59 | |||
60 | whitelist /usr/share/doc/node | ||
61 | whitelist /usr/share/nvm | ||
62 | whitelist /usr/share/systemtap/tapset/node.stp | ||
24 | include whitelist-runuser-common.inc | 63 | include whitelist-runuser-common.inc |
25 | include whitelist-usr-share-common.inc | 64 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 65 | include whitelist-var-common.inc |
@@ -46,10 +85,11 @@ shell none | |||
46 | 85 | ||
47 | disable-mnt | 86 | disable-mnt |
48 | private-dev | 87 | private-dev |
49 | # May need to add `passwd` to `private-etc` below to enable debugging with some IDEs | 88 | private-etc alternatives,ca-certificates,crypto-policies,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,mime.types,nsswitch.conf,passwd,pki,protocols,resolv.conf,rpc,services,ssl,xdg |
50 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,xdg | 89 | #private-tmp |
51 | # May need to be commented out in order to enable debugging with some IDEs | ||
52 | private-tmp | ||
53 | 90 | ||
54 | dbus-user none | 91 | dbus-user none |
55 | dbus-system none | 92 | dbus-system none |
93 | |||
94 | # Add the next line to your nodejs-common.local if you prefer to disable gatsby telemetry. | ||
95 | #env GATSBY_TELEMETRY_DISABLED=1 | ||
diff --git a/etc/profile-m-z/nomacs.profile b/etc/profile-m-z/nomacs.profile index a36dee874..7ffb09e56 100644 --- a/etc/profile-m-z/nomacs.profile +++ b/etc/profile-m-z/nomacs.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
@@ -42,5 +41,5 @@ tracelog | |||
42 | #private-bin nomacs | 41 | #private-bin nomacs |
43 | private-cache | 42 | private-cache |
44 | private-dev | 43 | private-dev |
45 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,login.defs,machine-id,pki,resolv.conf,ssl | 44 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.preload,login.defs,machine-id,pki,resolv.conf,ssl |
46 | private-tmp | 45 | private-tmp |
diff --git a/etc/profile-m-z/noprofile.profile b/etc/profile-m-z/noprofile.profile new file mode 100644 index 000000000..db4113f94 --- /dev/null +++ b/etc/profile-m-z/noprofile.profile | |||
@@ -0,0 +1,29 @@ | |||
1 | # This is the weakest possible firejail profile. | ||
2 | # If a program still fail with this profile, it is incompatible with firejail. | ||
3 | # (from https://gist.github.com/rusty-snake/bb234cb3e50e1e4e7429f29a7931cc72) | ||
4 | # | ||
5 | # Usage: | ||
6 | # 1. download | ||
7 | # 2. firejail --profile=noprofile.profile /path/to/program | ||
8 | |||
9 | # Keep in mind that even with this profile some things are done | ||
10 | # which can break the program. | ||
11 | # - some env-vars are cleared | ||
12 | # - /etc/firejail/firejail.config can contain options such as 'force-nonewprivs yes' | ||
13 | # - a new private pid-namespace is created | ||
14 | # - a minimal hardcoded blacklist is applied | ||
15 | # - ... | ||
16 | |||
17 | noblacklist /sys/fs | ||
18 | noblacklist /sys/module | ||
19 | |||
20 | allow-debuggers | ||
21 | allusers | ||
22 | keep-config-pulse | ||
23 | keep-dev-shm | ||
24 | keep-fd all | ||
25 | keep-var-tmp | ||
26 | writable-etc | ||
27 | writable-run-user | ||
28 | writable-var | ||
29 | writable-var-log | ||
diff --git a/etc/profile-m-z/notable.profile b/etc/profile-m-z/notable.profile new file mode 100644 index 000000000..7c790539d --- /dev/null +++ b/etc/profile-m-z/notable.profile | |||
@@ -0,0 +1,37 @@ | |||
1 | # Firejail profile for notable | ||
2 | # Description: The Markdown-based note-taking app that doesn't suck | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include notable.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Note: On debian-based distributions the binary might be located in | ||
10 | # /opt/Notable/notable, and therefore not be in PATH. | ||
11 | # If that's the case you can start Notable with firejail via | ||
12 | # `firejail "/opt/Notable/notable"`. | ||
13 | |||
14 | noblacklist ${HOME}/.config/Notable | ||
15 | noblacklist ${HOME}/.notable | ||
16 | |||
17 | net none | ||
18 | nosound | ||
19 | |||
20 | ?HAS_APPIMAGE: ignore private-dev | ||
21 | private-opt Notable | ||
22 | |||
23 | dbus-user filter | ||
24 | dbus-user.talk ca.desrt.dconf | ||
25 | ignore dbus-user none | ||
26 | |||
27 | # Notable keeps claiming it is started for the first time when whitelisting - see #4812. | ||
28 | ignore whitelist ${DOWNLOADS} | ||
29 | ignore whitelist ${HOME}/.config/Electron | ||
30 | ignore whitelist ${HOME}/.config/electron-flag*.conf | ||
31 | ignore include whitelist-common.inc | ||
32 | ignore include whitelist-runuser-common.inc | ||
33 | ignore include whitelist-usr-share-common.inc | ||
34 | ignore include whitelist-var-common.inc | ||
35 | |||
36 | # Redirect | ||
37 | include electron.profile | ||
diff --git a/etc/profile-m-z/notify-send.profile b/etc/profile-m-z/notify-send.profile index 650118c98..9f23c099d 100644 --- a/etc/profile-m-z/notify-send.profile +++ b/etc/profile-m-z/notify-send.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-write-mnt.inc | 18 | include disable-write-mnt.inc |
@@ -50,7 +49,7 @@ private | |||
50 | private-bin notify-send | 49 | private-bin notify-send |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc none | 52 | private-etc alternatives,ld.so.cache,ld.so.preload |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
56 | dbus-user filter | 55 | dbus-user filter |
diff --git a/etc/profile-m-z/npm.profile b/etc/profile-m-z/npm.profile index f51d58782..4d8beea5a 100644 --- a/etc/profile-m-z/npm.profile +++ b/etc/profile-m-z/npm.profile | |||
@@ -7,23 +7,5 @@ include npm.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | ignore read-only ${HOME}/.npm-packages | ||
11 | ignore read-only ${HOME}/.npmrc | ||
12 | |||
13 | noblacklist ${HOME}/.node-gyp | ||
14 | noblacklist ${HOME}/.npm | ||
15 | noblacklist ${HOME}/.npmrc | ||
16 | |||
17 | # If you want whitelisting, change ${HOME}/Projects below to your npm projects directory | ||
18 | # and add the next lines to your npm.local. | ||
19 | #mkdir ${HOME}/.node-gyp | ||
20 | #mkdir ${HOME}/.npm | ||
21 | #mkfile ${HOME}/.npmrc | ||
22 | #whitelist ${HOME}/.node-gyp | ||
23 | #whitelist ${HOME}/.npm | ||
24 | #whitelist ${HOME}/.npmrc | ||
25 | #whitelist ${HOME}/Projects | ||
26 | #include whitelist-common.inc | ||
27 | |||
28 | # Redirect | 10 | # Redirect |
29 | include nodejs-common.profile | 11 | include nodejs-common.profile |
diff --git a/etc/profile-m-z/nslookup.profile b/etc/profile-m-z/nslookup.profile index c7a131a2c..baa8ddfeb 100644 --- a/etc/profile-m-z/nslookup.profile +++ b/etc/profile-m-z/nslookup.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-m-z/nuclear.profile b/etc/profile-m-z/nuclear.profile index 886403b9e..9f4a6ec46 100644 --- a/etc/profile-m-z/nuclear.profile +++ b/etc/profile-m-z/nuclear.profile | |||
@@ -18,7 +18,7 @@ whitelist ${HOME}/.config/nuclear | |||
18 | no3d | 18 | no3d |
19 | 19 | ||
20 | # private-bin nuclear | 20 | # private-bin nuclear |
21 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 21 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
22 | private-opt nuclear | 22 | private-opt nuclear |
23 | 23 | ||
24 | # Redirect | 24 | # Redirect |
diff --git a/etc/profile-m-z/nvim.profile b/etc/profile-m-z/nvim.profile new file mode 100644 index 000000000..27a0aec28 --- /dev/null +++ b/etc/profile-m-z/nvim.profile | |||
@@ -0,0 +1,52 @@ | |||
1 | # Firejail profile for neovim | ||
2 | # Description: Nvim is open source and freely distributable | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nvim.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.vim | ||
10 | noblacklist ${HOME}/.vimrc | ||
11 | noblacklist ${HOME}/.cache/nvim | ||
12 | noblacklist ${HOME}/.config/nvim | ||
13 | noblacklist ${HOME}/.local/share/nvim | ||
14 | |||
15 | include disable-common.inc | ||
16 | include disable-devel.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | blacklist ${RUNUSER} | ||
21 | |||
22 | include whitelist-runuser-common.inc | ||
23 | |||
24 | ipc-namespace | ||
25 | machine-id | ||
26 | net none | ||
27 | no3d | ||
28 | nodvd | ||
29 | nogroups | ||
30 | noinput | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix,inet,inet6 | ||
37 | seccomp | ||
38 | seccomp.block-secondary | ||
39 | shell none | ||
40 | tracelog | ||
41 | x11 none | ||
42 | |||
43 | private-dev | ||
44 | |||
45 | dbus-user none | ||
46 | dbus-system none | ||
47 | |||
48 | read-only ${HOME}/.config | ||
49 | read-write ${HOME}/.config/nvim | ||
50 | read-write ${HOME}/.local/share/nvim | ||
51 | read-write ${HOME}/.vim | ||
52 | read-write ${HOME}/.vimrc | ||
diff --git a/etc/profile-m-z/nvm.profile b/etc/profile-m-z/nvm.profile new file mode 100644 index 000000000..80da22834 --- /dev/null +++ b/etc/profile-m-z/nvm.profile | |||
@@ -0,0 +1,13 @@ | |||
1 | # Firejail profile for nvm | ||
2 | # Description: Node Version Manager - Simple bash script to manage multiple active node.js versions | ||
3 | quiet | ||
4 | # This file is overwritten after every install/update | ||
5 | # Persistent local customizations | ||
6 | include nvm.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | ignore noroot | ||
11 | |||
12 | # Redirect | ||
13 | include nodejs-common.profile | ||
diff --git a/etc/profile-m-z/nylas.profile b/etc/profile-m-z/nylas.profile index fe0c2116b..3474a075f 100644 --- a/etc/profile-m-z/nylas.profile +++ b/etc/profile-m-z/nylas.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${HOME}/.nylas-mail | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | mkdir ${HOME}/.config/Nylas Mail | 16 | mkdir ${HOME}/.config/Nylas Mail |
diff --git a/etc/profile-m-z/nyx.profile b/etc/profile-m-z/nyx.profile index d040d42af..653591482 100644 --- a/etc/profile-m-z/nyx.profile +++ b/etc/profile-m-z/nyx.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin nyx,python* | 45 | private-bin nyx,python* |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,fonts,passwd,tor | 48 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,passwd,tor |
50 | private-opt none | 49 | private-opt none |
51 | private-srv none | 50 | private-srv none |
52 | private-tmp | 51 | private-tmp |
diff --git a/etc/profile-m-z/obs.profile b/etc/profile-m-z/obs.profile index 9345cee4f..1ff9ad48a 100644 --- a/etc/profile-m-z/obs.profile +++ b/etc/profile-m-z/obs.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
24 | 23 | ||
diff --git a/etc/profile-m-z/ocenaudio.profile b/etc/profile-m-z/ocenaudio.profile index 7be68a201..0bfb35333 100644 --- a/etc/profile-m-z/ocenaudio.profile +++ b/etc/profile-m-z/ocenaudio.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ tracelog | |||
46 | private-bin ocenaudio | 45 | private-bin ocenaudio |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,asound.conf,fonts,ld.so.cache,pulse | 48 | private-etc alternatives,asound.conf,fonts,ld.so.cache,ld.so.preload,pulse |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | # breaks preferences | 51 | # breaks preferences |
diff --git a/etc/profile-m-z/odt2txt.profile b/etc/profile-m-z/odt2txt.profile index 6163d2e22..de62f4114 100644 --- a/etc/profile-m-z/odt2txt.profile +++ b/etc/profile-m-z/odt2txt.profile | |||
@@ -13,7 +13,6 @@ noblacklist ${DOCUMENTS} | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -39,7 +38,7 @@ x11 none | |||
39 | private-bin odt2txt | 38 | private-bin odt2txt |
40 | private-cache | 39 | private-cache |
41 | private-dev | 40 | private-dev |
42 | private-etc alternatives | 41 | private-etc alternatives,ld.so.cache,ld.so.preload |
43 | private-tmp | 42 | private-tmp |
44 | 43 | ||
45 | dbus-user none | 44 | dbus-user none |
diff --git a/etc/profile-m-z/okular.profile b/etc/profile-m-z/okular.profile index ab8ccf623..fb28ad89f 100644 --- a/etc/profile-m-z/okular.profile +++ b/etc/profile-m-z/okular.profile | |||
@@ -23,7 +23,6 @@ include disable-common.inc | |||
23 | include disable-devel.inc | 23 | include disable-devel.inc |
24 | include disable-exec.inc | 24 | include disable-exec.inc |
25 | include disable-interpreters.inc | 25 | include disable-interpreters.inc |
26 | include disable-passwdmgr.inc | ||
27 | include disable-programs.inc | 26 | include disable-programs.inc |
28 | include disable-shell.inc | 27 | include disable-shell.inc |
29 | include disable-xdg.inc | 28 | include disable-xdg.inc |
@@ -37,6 +36,7 @@ whitelist /usr/share/kconf_update/okular.upd | |||
37 | whitelist /usr/share/kxmlgui5/okular | 36 | whitelist /usr/share/kxmlgui5/okular |
38 | whitelist /usr/share/okular | 37 | whitelist /usr/share/okular |
39 | whitelist /usr/share/poppler | 38 | whitelist /usr/share/poppler |
39 | include whitelist-run-common.inc | ||
40 | include whitelist-runuser-common.inc | 40 | include whitelist-runuser-common.inc |
41 | include whitelist-usr-share-common.inc | 41 | include whitelist-usr-share-common.inc |
42 | include whitelist-var-common.inc | 42 | include whitelist-var-common.inc |
@@ -62,7 +62,7 @@ tracelog | |||
62 | 62 | ||
63 | private-bin kbuildsycoca4,kdeinit4,lpr,okular,unar,unrar | 63 | private-bin kbuildsycoca4,kdeinit4,lpr,okular,unar,unrar |
64 | private-dev | 64 | private-dev |
65 | private-etc alternatives,cups,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,xdg | 65 | private-etc alternatives,cups,fonts,kde4rc,kde5rc,ld.so.cache,ld.so.preload,machine-id,passwd,xdg |
66 | # private-tmp - on KDE we need access to the real /tmp for data exchange with email clients | 66 | # private-tmp - on KDE we need access to the real /tmp for data exchange with email clients |
67 | 67 | ||
68 | # dbus-user none | 68 | # dbus-user none |
diff --git a/etc/profile-m-z/onboard.profile b/etc/profile-m-z/onboard.profile index 5b367b639..e05e58cad 100644 --- a/etc/profile-m-z/onboard.profile +++ b/etc/profile-m-z/onboard.profile | |||
@@ -17,7 +17,6 @@ include disable-devel.inc | |||
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
@@ -51,7 +50,7 @@ disable-mnt | |||
51 | private-cache | 50 | private-cache |
52 | private-bin onboard,python*,tput | 51 | private-bin onboard,python*,tput |
53 | private-dev | 52 | private-dev |
54 | private-etc alternatives,dbus-1,dconf,fonts,gtk-2.0,gtk-3.0,locale,locale.alias,locale.conf,mime.types,selinux,X11,xdg | 53 | private-etc alternatives,dbus-1,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,locale,locale.alias,locale.conf,mime.types,selinux,X11,xdg |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
57 | dbus-system none | 56 | dbus-system none |
diff --git a/etc/profile-m-z/onionshare-cli.profile b/etc/profile-m-z/onionshare-cli.profile new file mode 100644 index 000000000..2e2331351 --- /dev/null +++ b/etc/profile-m-z/onionshare-cli.profile | |||
@@ -0,0 +1,12 @@ | |||
1 | # Firejail profile for onionshare-cli | ||
2 | # Description: Share a file over Tor Hidden Services anonymously and securely (CLI) | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include onionshare-cli.local | ||
7 | # Persistent global definitions | ||
8 | # added by included profile | ||
9 | #include globals.local | ||
10 | |||
11 | # Redirect | ||
12 | include onionshare-gui.profile | ||
diff --git a/etc/profile-m-z/onionshare-gui.profile b/etc/profile-m-z/onionshare-gui.profile index 960df9034..cf4d7db30 100644 --- a/etc/profile-m-z/onionshare-gui.profile +++ b/etc/profile-m-z/onionshare-gui.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/onionshare.profile b/etc/profile-m-z/onionshare.profile new file mode 100644 index 000000000..b0390d392 --- /dev/null +++ b/etc/profile-m-z/onionshare.profile | |||
@@ -0,0 +1,11 @@ | |||
1 | # Firejail profile for onionshare | ||
2 | # Description: Share a file over Tor Hidden Services anonymously and securely (GUI) | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include onionshare.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | # Redirect | ||
11 | include onionshare-gui.profile | ||
diff --git a/etc/profile-m-z/open-invaders.profile b/etc/profile-m-z/open-invaders.profile index 7a840d4a9..c2c22f42d 100644 --- a/etc/profile-m-z/open-invaders.profile +++ b/etc/profile-m-z/open-invaders.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
@@ -26,7 +25,6 @@ caps.drop all | |||
26 | net none | 25 | net none |
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | noinput | ||
30 | nonewprivs | 28 | nonewprivs |
31 | noroot | 29 | noroot |
32 | notv | 30 | notv |
diff --git a/etc/profile-m-z/openarena.profile b/etc/profile-m-z/openarena.profile index 36ce0316f..c3ac097a0 100644 --- a/etc/profile-m-z/openarena.profile +++ b/etc/profile-m-z/openarena.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin bash,cut,glxinfo,grep,head,openarena,openarena_ded,quake3,zenity | 43 | private-bin bash,cut,glxinfo,grep,head,openarena,openarena_ded,quake3,zenity |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc drirc,machine-id,openal,passwd,selinux,udev,xdg | 46 | private-etc alternatives,drirc,ld.so.cache,ld.so.preload,machine-id,openal,passwd,selinux,udev,xdg |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/opencity.profile b/etc/profile-m-z/opencity.profile index a3d371e15..560bc6cbc 100644 --- a/etc/profile-m-z/opencity.profile +++ b/etc/profile-m-z/opencity.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/openclonk.profile b/etc/profile-m-z/openclonk.profile index 32b40df42..68362cbc8 100644 --- a/etc/profile-m-z/openclonk.profile +++ b/etc/profile-m-z/openclonk.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -29,7 +28,6 @@ ipc-namespace | |||
29 | netfilter | 28 | netfilter |
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | noinput | ||
33 | nonewprivs | 31 | nonewprivs |
34 | noroot | 32 | noroot |
35 | notv | 33 | notv |
diff --git a/etc/profile-m-z/openmw.profile b/etc/profile-m-z/openmw.profile index d1fe67aed..ce3399ad6 100644 --- a/etc/profile-m-z/openmw.profile +++ b/etc/profile-m-z/openmw.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-write-mnt.inc | 18 | include disable-write-mnt.inc |
diff --git a/etc/profile-m-z/openshot.profile b/etc/profile-m-z/openshot.profile index 6118630c4..e2af2e714 100644 --- a/etc/profile-m-z/openshot.profile +++ b/etc/profile-m-z/openshot.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | whitelist /usr/share/blender | 21 | whitelist /usr/share/blender |
diff --git a/etc/profile-m-z/openstego.profile b/etc/profile-m-z/openstego.profile new file mode 100644 index 000000000..f6622b38d --- /dev/null +++ b/etc/profile-m-z/openstego.profile | |||
@@ -0,0 +1,58 @@ | |||
1 | # Firejail profile for OpenStego | ||
2 | # Description: Steganography application that provides data hiding and watermarking functionality | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include openstego.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/openstego.ini | ||
10 | |||
11 | # Allow java (blacklisted by disable-devel.inc) | ||
12 | include allow-java.inc | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-proc.inc | ||
19 | include disable-programs.inc | ||
20 | |||
21 | mkfile ${HOME}/openstego.ini | ||
22 | whitelist ${HOME}/openstego.ini | ||
23 | whitelist ${HOME}/.java | ||
24 | whitelist ${PICTURES} | ||
25 | whitelist ${DOCUMENTS} | ||
26 | whitelist ${DESKTOP} | ||
27 | whitelist /usr/share/java | ||
28 | include whitelist-common.inc | ||
29 | include whitelist-run-common.inc | ||
30 | include whitelist-runuser-common.inc | ||
31 | include whitelist-usr-share-common.inc | ||
32 | include whitelist-var-common.inc | ||
33 | |||
34 | caps.drop all | ||
35 | machine-id | ||
36 | net none | ||
37 | no3d | ||
38 | nogroups | ||
39 | noinput | ||
40 | nonewprivs | ||
41 | noroot | ||
42 | nosound | ||
43 | notv | ||
44 | nou2f | ||
45 | novideo | ||
46 | seccomp | ||
47 | seccomp.block-secondary | ||
48 | shell none | ||
49 | tracelog | ||
50 | |||
51 | disable-mnt | ||
52 | private-bin bash,dirname,openstego,readlink,sh | ||
53 | private-cache | ||
54 | private-dev | ||
55 | private-tmp | ||
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/profile-m-z/openttd.profile b/etc/profile-m-z/openttd.profile index 546958bb7..6c31ebf65 100644 --- a/etc/profile-m-z/openttd.profile +++ b/etc/profile-m-z/openttd.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/opera-beta.profile b/etc/profile-m-z/opera-beta.profile index 551f1aba4..becd3f86c 100644 --- a/etc/profile-m-z/opera-beta.profile +++ b/etc/profile-m-z/opera-beta.profile | |||
@@ -5,18 +5,16 @@ include opera-beta.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Disable for now, see https://www.tutorialspoint.com/difference-between-void-main-and-int-main-in-c-cplusplus | 8 | noblacklist ${HOME}/.cache/opera-beta |
9 | ignore whitelist /usr/share/chromium | ||
10 | ignore include whitelist-runuser-common.inc | ||
11 | ignore include whitelist-usr-share-common.inc | ||
12 | |||
13 | noblacklist ${HOME}/.cache/opera | ||
14 | noblacklist ${HOME}/.config/opera-beta | 9 | noblacklist ${HOME}/.config/opera-beta |
10 | noblacklist ${HOME}/.opera-beta | ||
15 | 11 | ||
16 | mkdir ${HOME}/.cache/opera | 12 | mkdir ${HOME}/.cache/opera-beta |
17 | mkdir ${HOME}/.config/opera-beta | 13 | mkdir ${HOME}/.config/opera-beta |
18 | whitelist ${HOME}/.cache/opera | 14 | mkdir ${HOME}/.opera-beta |
15 | whitelist ${HOME}/.cache/opera-beta | ||
19 | whitelist ${HOME}/.config/opera-beta | 16 | whitelist ${HOME}/.config/opera-beta |
17 | whitelist ${HOME}/.opera-beta | ||
20 | 18 | ||
21 | # Redirect | 19 | # Redirect |
22 | include chromium-common.profile | 20 | include chromium-common.profile |
diff --git a/etc/profile-m-z/opera-developer.profile b/etc/profile-m-z/opera-developer.profile new file mode 100644 index 000000000..52c850227 --- /dev/null +++ b/etc/profile-m-z/opera-developer.profile | |||
@@ -0,0 +1,20 @@ | |||
1 | # Firejail profile for opera-developer | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include opera-developer.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | noblacklist ${HOME}/.cache/opera-developer | ||
9 | noblacklist ${HOME}/.config/opera-developer | ||
10 | noblacklist ${HOME}/.opera-developer | ||
11 | |||
12 | mkdir ${HOME}/.cache/opera-developer | ||
13 | mkdir ${HOME}/.config/opera-developer | ||
14 | mkdir ${HOME}/.opera-developer | ||
15 | whitelist ${HOME}/.cache/opera-developer | ||
16 | whitelist ${HOME}/.config/opera-developer | ||
17 | whitelist ${HOME}/.opera-developer | ||
18 | |||
19 | # Redirect | ||
20 | include chromium-common.profile | ||
diff --git a/etc/profile-m-z/opera.profile b/etc/profile-m-z/opera.profile index 2c7c5fc35..b342b3961 100644 --- a/etc/profile-m-z/opera.profile +++ b/etc/profile-m-z/opera.profile | |||
@@ -6,11 +6,6 @@ include opera.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Disable for now, see https://www.tutorialspoint.com/difference-between-void-main-and-int-main-in-c-cplusplus | ||
10 | ignore whitelist /usr/share/chromium | ||
11 | ignore include whitelist-runuser-common.inc | ||
12 | ignore include whitelist-usr-share-common.inc | ||
13 | |||
14 | noblacklist ${HOME}/.cache/opera | 9 | noblacklist ${HOME}/.cache/opera |
15 | noblacklist ${HOME}/.config/opera | 10 | noblacklist ${HOME}/.config/opera |
16 | noblacklist ${HOME}/.opera | 11 | noblacklist ${HOME}/.opera |
diff --git a/etc/profile-m-z/orage.profile b/etc/profile-m-z/orage.profile index 4e4d8bea5..a3ec6a386 100644 --- a/etc/profile-m-z/orage.profile +++ b/etc/profile-m-z/orage.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/ostrichriders.profile b/etc/profile-m-z/ostrichriders.profile index e0be078a7..de6a6d3f5 100644 --- a/etc/profile-m-z/ostrichriders.profile +++ b/etc/profile-m-z/ostrichriders.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -29,6 +28,7 @@ ipc-namespace | |||
29 | net none | 28 | net none |
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
31 | # Add 'ignore noinput' to your ostrichriders.local if you need controller support. | ||
32 | noinput | 32 | noinput |
33 | nonewprivs | 33 | nonewprivs |
34 | noroot | 34 | noroot |
@@ -43,7 +43,6 @@ tracelog | |||
43 | disable-mnt | 43 | disable-mnt |
44 | private-bin ostrichriders | 44 | private-bin ostrichriders |
45 | private-cache | 45 | private-cache |
46 | # comment the following line if you need controller support | ||
47 | private-dev | 46 | private-dev |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
diff --git a/etc/profile-m-z/otter-browser.profile b/etc/profile-m-z/otter-browser.profile index aa26ddd4e..e2687bf6b 100644 --- a/etc/profile-m-z/otter-browser.profile +++ b/etc/profile-m-z/otter-browser.profile | |||
@@ -10,26 +10,25 @@ include globals.local | |||
10 | 10 | ||
11 | noblacklist ${HOME}/.cache/Otter | 11 | noblacklist ${HOME}/.cache/Otter |
12 | noblacklist ${HOME}/.config/otter | 12 | noblacklist ${HOME}/.config/otter |
13 | noblacklist ${HOME}/.pki | ||
14 | noblacklist ${HOME}/.local/share/pki | 13 | noblacklist ${HOME}/.local/share/pki |
14 | noblacklist ${HOME}/.pki | ||
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
24 | mkdir ${HOME}/.cache/Otter | 23 | mkdir ${HOME}/.cache/Otter |
25 | mkdir ${HOME}/.config/otter | 24 | mkdir ${HOME}/.config/otter |
26 | mkdir ${HOME}/.pki | ||
27 | mkdir ${HOME}/.local/share/pki | 25 | mkdir ${HOME}/.local/share/pki |
26 | mkdir ${HOME}/.pki | ||
28 | whitelist ${DOWNLOADS} | 27 | whitelist ${DOWNLOADS} |
29 | whitelist ${HOME}/.cache/Otter | 28 | whitelist ${HOME}/.cache/Otter |
30 | whitelist ${HOME}/.config/otter | 29 | whitelist ${HOME}/.config/otter |
31 | whitelist ${HOME}/.pki | ||
32 | whitelist ${HOME}/.local/share/pki | 30 | whitelist ${HOME}/.local/share/pki |
31 | whitelist ${HOME}/.pki | ||
33 | whitelist /usr/share/otter-browser | 32 | whitelist /usr/share/otter-browser |
34 | include whitelist-common.inc | 33 | include whitelist-common.inc |
35 | include whitelist-runuser-common.inc | 34 | include whitelist-runuser-common.inc |
@@ -41,6 +40,7 @@ caps.drop all | |||
41 | netfilter | 40 | netfilter |
42 | nodvd | 41 | nodvd |
43 | nogroups | 42 | nogroups |
43 | noinput | ||
44 | nonewprivs | 44 | nonewprivs |
45 | noroot | 45 | noroot |
46 | notv | 46 | notv |
diff --git a/etc/profile-m-z/pandoc.profile b/etc/profile-m-z/pandoc.profile index 513b4119e..c016b5103 100644 --- a/etc/profile-m-z/pandoc.profile +++ b/etc/profile-m-z/pandoc.profile | |||
@@ -11,15 +11,17 @@ blacklist ${RUNUSER} | |||
11 | 11 | ||
12 | noblacklist ${DOCUMENTS} | 12 | noblacklist ${DOCUMENTS} |
13 | 13 | ||
14 | include allow-bin-sh.inc | ||
15 | |||
14 | include disable-common.inc | 16 | include disable-common.inc |
15 | include disable-devel.inc | 17 | include disable-devel.inc |
16 | include disable-exec.inc | 18 | include disable-exec.inc |
17 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 20 | include disable-programs.inc |
20 | include disable-shell.inc | 21 | include disable-shell.inc |
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
24 | include whitelist-runuser-common.inc | ||
23 | # breaks pdf output | 25 | # breaks pdf output |
24 | #include whitelist-var-common.inc | 26 | #include whitelist-var-common.inc |
25 | 27 | ||
@@ -40,15 +42,15 @@ nou2f | |||
40 | novideo | 42 | novideo |
41 | protocol unix | 43 | protocol unix |
42 | seccomp | 44 | seccomp |
45 | seccomp.block-secondary | ||
43 | shell none | 46 | shell none |
44 | tracelog | 47 | tracelog |
45 | x11 none | 48 | x11 none |
46 | 49 | ||
47 | disable-mnt | 50 | disable-mnt |
48 | private-bin context,latex,mktexfmt,pandoc,pdflatex,pdfroff,prince,weasyprint,wkhtmltopdf | ||
49 | private-cache | 51 | private-cache |
50 | private-dev | 52 | private-dev |
51 | private-etc alternatives,texlive,texmf | 53 | private-etc alternatives,ld.so.cache,ld.so.preload,texlive,texmf |
52 | private-tmp | 54 | private-tmp |
53 | 55 | ||
54 | dbus-user none | 56 | dbus-user none |
diff --git a/etc/profile-m-z/parole.profile b/etc/profile-m-z/parole.profile index 0a4422a73..3d380542f 100644 --- a/etc/profile-m-z/parole.profile +++ b/etc/profile-m-z/parole.profile | |||
@@ -12,7 +12,6 @@ noblacklist ${VIDEOS} | |||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -28,4 +27,4 @@ shell none | |||
28 | 27 | ||
29 | private-bin dbus-launch,parole | 28 | private-bin dbus-launch,parole |
30 | private-cache | 29 | private-cache |
31 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,machine-id,passwd,pki,pulse,ssl | 30 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd,pki,pulse,ssl |
diff --git a/etc/profile-m-z/patch.profile b/etc/profile-m-z/patch.profile index 0de968185..3973c1b4a 100644 --- a/etc/profile-m-z/patch.profile +++ b/etc/profile-m-z/patch.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-m-z/pavucontrol.profile b/etc/profile-m-z/pavucontrol.profile index b46fb3026..d64aab200 100644 --- a/etc/profile-m-z/pavucontrol.profile +++ b/etc/profile-m-z/pavucontrol.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
@@ -46,7 +45,7 @@ disable-mnt | |||
46 | private-bin pavucontrol | 45 | private-bin pavucontrol |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,asound.conf,avahi,fonts,machine-id,pulse | 48 | private-etc alternatives,asound.conf,avahi,fonts,ld.so.cache,ld.so.preload,machine-id,pulse |
50 | private-lib | 49 | private-lib |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
diff --git a/etc/profile-m-z/pcsxr.profile b/etc/profile-m-z/pcsxr.profile index a6dab2a9a..e52a1c4a9 100644 --- a/etc/profile-m-z/pcsxr.profile +++ b/etc/profile-m-z/pcsxr.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-write-mnt.inc | 19 | include disable-write-mnt.inc |
diff --git a/etc/profile-m-z/pdfchain.profile b/etc/profile-m-z/pdfchain.profile index d72417914..41ec98a39 100644 --- a/etc/profile-m-z/pdfchain.profile +++ b/etc/profile-m-z/pdfchain.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
17 | 16 | ||
@@ -35,7 +34,7 @@ shell none | |||
35 | 34 | ||
36 | private-bin pdfchain,pdftk,sh | 35 | private-bin pdfchain,pdftk,sh |
37 | private-dev | 36 | private-dev |
38 | private-etc alternatives,dconf,fonts,gtk-3.0,xdg | 37 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,xdg |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
41 | dbus-user none | 40 | dbus-user none |
diff --git a/etc/profile-m-z/pdfmod.profile b/etc/profile-m-z/pdfmod.profile index a19826555..c8397a31e 100644 --- a/etc/profile-m-z/pdfmod.profile +++ b/etc/profile-m-z/pdfmod.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/pdfsam.profile b/etc/profile-m-z/pdfsam.profile index e2808d4d2..0c2ce0588 100644 --- a/etc/profile-m-z/pdfsam.profile +++ b/etc/profile-m-z/pdfsam.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-m-z/pdftotext.profile b/etc/profile-m-z/pdftotext.profile index d3902a51c..291d533a6 100644 --- a/etc/profile-m-z/pdftotext.profile +++ b/etc/profile-m-z/pdftotext.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for pdftotext | 1 | # Firejail profile for pdftotext |
2 | # Description: Portable Document Format (PDF) to text converter | 2 | # Description: Portable Document Format (PDF) to text converter |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include pdftotext.local | 6 | include pdftotext.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
@@ -14,7 +15,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 15 | include disable-devel.inc |
15 | include disable-exec.inc | 16 | include disable-exec.inc |
16 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | 19 | include disable-shell.inc |
20 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -49,7 +49,7 @@ x11 none | |||
49 | private-bin pdftotext | 49 | private-bin pdftotext |
50 | private-cache | 50 | private-cache |
51 | private-dev | 51 | private-dev |
52 | private-etc alternatives | 52 | private-etc alternatives,ld.so.cache,ld.so.preload |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | dbus-user none | 55 | dbus-user none |
diff --git a/etc/profile-m-z/peek.profile b/etc/profile-m-z/peek.profile index c33953687..f5c295b5d 100644 --- a/etc/profile-m-z/peek.profile +++ b/etc/profile-m-z/peek.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
@@ -49,7 +48,7 @@ tracelog | |||
49 | disable-mnt | 48 | disable-mnt |
50 | private-bin bash,convert,ffmpeg,firejail,fish,peek,sh,which,zsh | 49 | private-bin bash,convert,ffmpeg,firejail,fish,peek,sh,which,zsh |
51 | private-dev | 50 | private-dev |
52 | private-etc dconf,firejail,fonts,gtk-3.0,login.defs,pango,passwd,X11 | 51 | private-etc alternatives,dconf,firejail,fonts,gtk-3.0,ld.so.cache,ld.so.preload,login.defs,pango,passwd,X11 |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
55 | dbus-user filter | 54 | dbus-user filter |
diff --git a/etc/profile-m-z/penguin-command.profile b/etc/profile-m-z/penguin-command.profile index f5ad0321d..13e89616e 100644 --- a/etc/profile-m-z/penguin-command.profile +++ b/etc/profile-m-z/penguin-command.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/photoflare.profile b/etc/profile-m-z/photoflare.profile index 40068ff78..80efedec7 100644 --- a/etc/profile-m-z/photoflare.profile +++ b/etc/profile-m-z/photoflare.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin photoflare | 43 | private-bin photoflare |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,fonts,locale,locale.alias,locale.conf,mime.types,X11 | 46 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,locale,locale.alias,locale.conf,mime.types,X11 |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/picard.profile b/etc/profile-m-z/picard.profile index a5ea47088..dbbfc5275 100644 --- a/etc/profile-m-z/picard.profile +++ b/etc/profile-m-z/picard.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
24 | 23 | ||
diff --git a/etc/profile-m-z/pidgin.profile b/etc/profile-m-z/pidgin.profile index 26872e9a1..904c17e09 100644 --- a/etc/profile-m-z/pidgin.profile +++ b/etc/profile-m-z/pidgin.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
diff --git a/etc/profile-m-z/pinball.profile b/etc/profile-m-z/pinball.profile index ab433e729..3c76ad99c 100644 --- a/etc/profile-m-z/pinball.profile +++ b/etc/profile-m-z/pinball.profile | |||
@@ -12,14 +12,16 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
20 | mkdir ${HOME}/.config/emilia | 19 | mkdir ${HOME}/.config/emilia |
21 | whitelist ${HOME}/.config/emilia | 20 | whitelist ${HOME}/.config/emilia |
21 | |||
22 | whitelist /usr/share/pinball | 22 | whitelist /usr/share/pinball |
23 | # on debian games are stored under /usr/share/games | ||
24 | whitelist /usr/share/games/pinball | ||
23 | include whitelist-common.inc | 25 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | 26 | include whitelist-runuser-common.inc |
25 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-m-z/ping.profile b/etc/profile-m-z/ping.profile index e914007c0..b4923c38a 100644 --- a/etc/profile-m-z/ping.profile +++ b/etc/profile-m-z/ping.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/pingus.profile b/etc/profile-m-z/pingus.profile index 3889d87d2..69c78740d 100644 --- a/etc/profile-m-z/pingus.profile +++ b/etc/profile-m-z/pingus.profile | |||
@@ -11,11 +11,12 @@ noblacklist ${HOME}/.pingus | |||
11 | # Allow /bin/sh (blacklisted by disable-shell.inc) | 11 | # Allow /bin/sh (blacklisted by disable-shell.inc) |
12 | include allow-bin-sh.inc | 12 | include allow-bin-sh.inc |
13 | 13 | ||
14 | blacklist /usr/libexec | ||
15 | |||
14 | include disable-common.inc | 16 | include disable-common.inc |
15 | include disable-devel.inc | 17 | include disable-devel.inc |
16 | include disable-exec.inc | 18 | include disable-exec.inc |
17 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 20 | include disable-programs.inc |
20 | include disable-shell.inc | 21 | include disable-shell.inc |
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
@@ -49,7 +50,7 @@ disable-mnt | |||
49 | private-bin pingus,pingus.bin,sh | 50 | private-bin pingus,pingus.bin,sh |
50 | private-cache | 51 | private-cache |
51 | private-dev | 52 | private-dev |
52 | private-etc machine-id | 53 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
53 | private-tmp | 54 | private-tmp |
54 | 55 | ||
55 | dbus-user none | 56 | dbus-user none |
diff --git a/etc/profile-m-z/pinta.profile b/etc/profile-m-z/pinta.profile index 19406c399..f52803d50 100644 --- a/etc/profile-m-z/pinta.profile +++ b/etc/profile-m-z/pinta.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/pioneer.profile b/etc/profile-m-z/pioneer.profile index 721b3944a..7c9bb352b 100644 --- a/etc/profile-m-z/pioneer.profile +++ b/etc/profile-m-z/pioneer.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/pip.profile b/etc/profile-m-z/pip.profile new file mode 100644 index 000000000..a0926371f --- /dev/null +++ b/etc/profile-m-z/pip.profile | |||
@@ -0,0 +1,18 @@ | |||
1 | # Firejail profile for pip | ||
2 | # Description: package manager for Python packages | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include meson.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | ignore read-only ${HOME}/.local/lib | ||
11 | |||
12 | # Allow python3 (blacklisted by disable-interpreters.inc) | ||
13 | include allow-python3.inc | ||
14 | |||
15 | #whitelist ${HOME}/.local/lib/python* | ||
16 | |||
17 | # Redirect | ||
18 | include build-systems-common.profile | ||
diff --git a/etc/profile-m-z/pipe-viewer.profile b/etc/profile-m-z/pipe-viewer.profile new file mode 100644 index 000000000..3de064311 --- /dev/null +++ b/etc/profile-m-z/pipe-viewer.profile | |||
@@ -0,0 +1,21 @@ | |||
1 | # Firejail profile for pipe-viewer | ||
2 | # Description: Fork of youtube-viewer, scrapes youtube directly and with invidious | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include pipe-viewer.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.cache/pipe-viewer | ||
11 | noblacklist ${HOME}/.config/pipe-viewer | ||
12 | |||
13 | mkdir ${HOME}/.config/pipe-viewer | ||
14 | mkdir ${HOME}/.cache/pipe-viewer | ||
15 | whitelist ${HOME}/.cache/pipe-viewer | ||
16 | whitelist ${HOME}/.config/pipe-viewer | ||
17 | |||
18 | private-bin gtk-pipe-viewer,pipe-viewer | ||
19 | |||
20 | # Redirect | ||
21 | include youtube-viewers-common.profile | ||
diff --git a/etc/profile-m-z/pithos.profile b/etc/profile-m-z/pithos.profile index 18990f0b2..91814d8bb 100644 --- a/etc/profile-m-z/pithos.profile +++ b/etc/profile-m-z/pithos.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/pitivi.profile b/etc/profile-m-z/pitivi.profile index a2dd809c4..245ffae22 100644 --- a/etc/profile-m-z/pitivi.profile +++ b/etc/profile-m-z/pitivi.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | include whitelist-runuser-common.inc | 21 | include whitelist-runuser-common.inc |
diff --git a/etc/profile-m-z/pix.profile b/etc/profile-m-z/pix.profile index 81d3e9370..6bd1ad02e 100644 --- a/etc/profile-m-z/pix.profile +++ b/etc/profile-m-z/pix.profile | |||
@@ -13,7 +13,6 @@ noblacklist ${HOME}/.steam | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/pkglog.profile b/etc/profile-m-z/pkglog.profile index 4eb41b3bd..69b954f53 100644 --- a/etc/profile-m-z/pkglog.profile +++ b/etc/profile-m-z/pkglog.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
@@ -45,7 +44,7 @@ private | |||
45 | private-bin pkglog,python* | 44 | private-bin pkglog,python* |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc alternatives | 47 | private-etc alternatives,ld.so.cache,ld.so.preload |
49 | private-opt none | 48 | private-opt none |
50 | private-tmp | 49 | private-tmp |
51 | writable-var-log | 50 | writable-var-log |
diff --git a/etc/profile-m-z/pluma.profile b/etc/profile-m-z/pluma.profile index 10e12e5b1..567725be4 100644 --- a/etc/profile-m-z/pluma.profile +++ b/etc/profile-m-z/pluma.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | 21 | ||
diff --git a/etc/profile-m-z/plv.profile b/etc/profile-m-z/plv.profile index 5201fd853..38ccf72e8 100644 --- a/etc/profile-m-z/plv.profile +++ b/etc/profile-m-z/plv.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
@@ -47,7 +46,7 @@ disable-mnt | |||
47 | private-bin plv | 46 | private-bin plv |
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | private-etc alternatives,fonts | 49 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
51 | private-opt none | 50 | private-opt none |
52 | private-tmp | 51 | private-tmp |
53 | writable-var-log | 52 | writable-var-log |
diff --git a/etc/profile-m-z/pngquant.profile b/etc/profile-m-z/pngquant.profile index 8a181d5a8..6b989202f 100644 --- a/etc/profile-m-z/pngquant.profile +++ b/etc/profile-m-z/pngquant.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -39,9 +38,8 @@ nosound | |||
39 | notv | 38 | notv |
40 | nou2f | 39 | nou2f |
41 | novideo | 40 | novideo |
42 | # protocol can be empty, but this is not yet supported see #639 | 41 | # block the socket syscall to simulate an be empty protocol line, see #639 |
43 | protocol inet | 42 | seccomp socket |
44 | seccomp | ||
45 | shell none | 43 | shell none |
46 | tracelog | 44 | tracelog |
47 | x11 none | 45 | x11 none |
@@ -49,7 +47,7 @@ x11 none | |||
49 | private-bin pngquant | 47 | private-bin pngquant |
50 | private-cache | 48 | private-cache |
51 | private-dev | 49 | private-dev |
52 | private-etc alternatives | 50 | private-etc alternatives,ld.so.cache,ld.so.preload |
53 | private-tmp | 51 | private-tmp |
54 | 52 | ||
55 | dbus-user none | 53 | dbus-user none |
diff --git a/etc/profile-m-z/ppsspp.profile b/etc/profile-m-z/ppsspp.profile index 1f73c1d89..3e06cf300 100644 --- a/etc/profile-m-z/ppsspp.profile +++ b/etc/profile-m-z/ppsspp.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-write-mnt.inc | 18 | include disable-write-mnt.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/pragha.profile b/etc/profile-m-z/pragha.profile index f138d785e..fd595c27a 100644 --- a/etc/profile-m-z/pragha.profile +++ b/etc/profile-m-z/pragha.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
@@ -34,6 +33,6 @@ seccomp | |||
34 | shell none | 33 | shell none |
35 | 34 | ||
36 | private-dev | 35 | private-dev |
37 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,xdg | 36 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg |
38 | private-tmp | 37 | private-tmp |
39 | 38 | ||
diff --git a/etc/profile-m-z/profanity.profile b/etc/profile-m-z/profanity.profile index 743458725..25a248425 100644 --- a/etc/profile-m-z/profanity.profile +++ b/etc/profile-m-z/profanity.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
@@ -45,7 +44,7 @@ shell none | |||
45 | private-bin profanity | 44 | private-bin profanity |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc alternatives,ca-certificates,crypto-policies,localtime,mime.types,nsswitch.conf,pki,resolv.conf,ssl | 47 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,localtime,mime.types,nsswitch.conf,pki,resolv.conf,ssl |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-m-z/psi-plus.profile b/etc/profile-m-z/psi-plus.profile index 5ac58b0ac..5f598cec5 100644 --- a/etc/profile-m-z/psi-plus.profile +++ b/etc/profile-m-z/psi-plus.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.cache/psi+ | 18 | mkdir ${HOME}/.cache/psi+ |
diff --git a/etc/profile-m-z/psi.profile b/etc/profile-m-z/psi.profile index 7e0ef99fc..99a72adee 100644 --- a/etc/profile-m-z/psi.profile +++ b/etc/profile-m-z/psi.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
@@ -72,7 +71,7 @@ disable-mnt | |||
72 | private-bin getopt,psi | 71 | private-bin getopt,psi |
73 | private-cache | 72 | private-cache |
74 | private-dev | 73 | private-dev |
75 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,gcrypt,group,hostname,hosts,ld.so.cache,ld.so.conf,machine-id,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg | 74 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,gcrypt,group,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.preload,machine-id,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg |
76 | private-tmp | 75 | private-tmp |
77 | 76 | ||
78 | dbus-user none | 77 | dbus-user none |
diff --git a/etc/profile-m-z/pybitmessage.profile b/etc/profile-m-z/pybitmessage.profile index 60ae37930..8d8729d4a 100644 --- a/etc/profile-m-z/pybitmessage.profile +++ b/etc/profile-m-z/pybitmessage.profile | |||
@@ -16,7 +16,6 @@ include allow-python3.inc | |||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
22 | 21 | ||
diff --git a/etc/profile-m-z/pycharm-community.profile b/etc/profile-m-z/pycharm-community.profile index 00d7239ae..f3d40e7f3 100644 --- a/etc/profile-m-z/pycharm-community.profile +++ b/etc/profile-m-z/pycharm-community.profile | |||
@@ -15,7 +15,6 @@ include allow-common-devel.inc | |||
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/profile-m-z/qbittorrent.profile b/etc/profile-m-z/qbittorrent.profile index 506b738cc..ebe67c63b 100644 --- a/etc/profile-m-z/qbittorrent.profile +++ b/etc/profile-m-z/qbittorrent.profile | |||
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.cache/qBittorrent | |||
10 | noblacklist ${HOME}/.config/qBittorrent | 10 | noblacklist ${HOME}/.config/qBittorrent |
11 | noblacklist ${HOME}/.config/qBittorrentrc | 11 | noblacklist ${HOME}/.config/qBittorrentrc |
12 | noblacklist ${HOME}/.local/share/data/qBittorrent | 12 | noblacklist ${HOME}/.local/share/data/qBittorrent |
13 | noblacklist ${HOME}/.local/share/qBittorrent | ||
13 | 14 | ||
14 | # Allow python (blacklisted by disable-interpreters.inc) | 15 | # Allow python (blacklisted by disable-interpreters.inc) |
15 | include allow-python2.inc | 16 | include allow-python2.inc |
@@ -19,7 +20,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 20 | include disable-devel.inc |
20 | include disable-exec.inc | 21 | include disable-exec.inc |
21 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 23 | include disable-programs.inc |
24 | include disable-shell.inc | 24 | include disable-shell.inc |
25 | 25 | ||
@@ -27,11 +27,13 @@ mkdir ${HOME}/.cache/qBittorrent | |||
27 | mkdir ${HOME}/.config/qBittorrent | 27 | mkdir ${HOME}/.config/qBittorrent |
28 | mkfile ${HOME}/.config/qBittorrentrc | 28 | mkfile ${HOME}/.config/qBittorrentrc |
29 | mkdir ${HOME}/.local/share/data/qBittorrent | 29 | mkdir ${HOME}/.local/share/data/qBittorrent |
30 | mkdir ${HOME}/.local/share/qBittorrent | ||
30 | whitelist ${DOWNLOADS} | 31 | whitelist ${DOWNLOADS} |
31 | whitelist ${HOME}/.cache/qBittorrent | 32 | whitelist ${HOME}/.cache/qBittorrent |
32 | whitelist ${HOME}/.config/qBittorrent | 33 | whitelist ${HOME}/.config/qBittorrent |
33 | whitelist ${HOME}/.config/qBittorrentrc | 34 | whitelist ${HOME}/.config/qBittorrentrc |
34 | whitelist ${HOME}/.local/share/data/qBittorrent | 35 | whitelist ${HOME}/.local/share/data/qBittorrent |
36 | whitelist ${HOME}/.local/share/qBittorrent | ||
35 | include whitelist-common.inc | 37 | include whitelist-common.inc |
36 | include whitelist-var-common.inc | 38 | include whitelist-var-common.inc |
37 | 39 | ||
diff --git a/etc/profile-m-z/qcomicbook.profile b/etc/profile-m-z/qcomicbook.profile new file mode 100644 index 000000000..4d4d3694b --- /dev/null +++ b/etc/profile-m-z/qcomicbook.profile | |||
@@ -0,0 +1,67 @@ | |||
1 | # Firejail profile for qcomicbook | ||
2 | # Description: A comic book and manga viewer in QT | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include qcomicbook.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/PawelStolowski | ||
10 | noblacklist ${HOME}/.config/PawelStolowski | ||
11 | noblacklist ${HOME}/.local/share/PawelStolowski | ||
12 | noblacklist ${DOCUMENTS} | ||
13 | |||
14 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
15 | include allow-bin-sh.inc | ||
16 | |||
17 | include disable-common.inc | ||
18 | include disable-devel.inc | ||
19 | include disable-exec.inc | ||
20 | include disable-interpreters.inc | ||
21 | include disable-programs.inc | ||
22 | include disable-shell.inc | ||
23 | include disable-write-mnt.inc | ||
24 | include disable-xdg.inc | ||
25 | |||
26 | mkdir ${HOME}/.cache/PawelStolowski | ||
27 | mkdir ${HOME}/.config/PawelStolowski | ||
28 | mkdir ${HOME}/.local/share/PawelStolowski | ||
29 | whitelist /usr/share/qcomicbook | ||
30 | include whitelist-runuser-common.inc | ||
31 | include whitelist-usr-share-common.inc | ||
32 | include whitelist-var-common.inc | ||
33 | |||
34 | apparmor | ||
35 | caps.drop all | ||
36 | machine-id | ||
37 | net none | ||
38 | nodvd | ||
39 | nogroups | ||
40 | noinput | ||
41 | nonewprivs | ||
42 | noroot | ||
43 | nosound | ||
44 | notv | ||
45 | nou2f | ||
46 | novideo | ||
47 | protocol unix | ||
48 | seccomp | ||
49 | seccomp.block-secondary | ||
50 | shell none | ||
51 | tracelog | ||
52 | |||
53 | private-bin 7z,7zr,qcomicbook,rar,sh,tar,unace,unrar,unzip | ||
54 | private-cache | ||
55 | private-dev | ||
56 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,pango,passwd,Trolltech.conf,X11,xdg | ||
57 | private-tmp | ||
58 | |||
59 | dbus-user none | ||
60 | dbus-system none | ||
61 | |||
62 | read-only ${HOME} | ||
63 | read-write ${HOME}/.cache/PawelStolowski | ||
64 | read-write ${HOME}/.config/PawelStolowski | ||
65 | read-write ${HOME}/.local/share/PawelStolowski | ||
66 | #to allow ${HOME}/.local/share/recently-used.xbel | ||
67 | read-write ${HOME}/.local/share | ||
diff --git a/etc/profile-m-z/qemu-launcher.profile b/etc/profile-m-z/qemu-launcher.profile index ac60384fd..2aea715dc 100644 --- a/etc/profile-m-z/qemu-launcher.profile +++ b/etc/profile-m-z/qemu-launcher.profile | |||
@@ -8,7 +8,6 @@ include globals.local | |||
8 | noblacklist ${HOME}/.qemu-launcher | 8 | noblacklist ${HOME}/.qemu-launcher |
9 | 9 | ||
10 | include disable-common.inc | 10 | include disable-common.inc |
11 | include disable-passwdmgr.inc | ||
12 | include disable-programs.inc | 11 | include disable-programs.inc |
13 | 12 | ||
14 | caps.drop all | 13 | caps.drop all |
diff --git a/etc/profile-m-z/qemu-system-x86_64.profile b/etc/profile-m-z/qemu-system-x86_64.profile index d7d7905dd..2333e07d9 100644 --- a/etc/profile-m-z/qemu-system-x86_64.profile +++ b/etc/profile-m-z/qemu-system-x86_64.profile | |||
@@ -7,7 +7,6 @@ include qemu-system-x86_64.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | include disable-common.inc | 9 | include disable-common.inc |
10 | include disable-passwdmgr.inc | ||
11 | include disable-programs.inc | 10 | include disable-programs.inc |
12 | 11 | ||
13 | caps.drop all | 12 | caps.drop all |
diff --git a/etc/profile-m-z/qgis.profile b/etc/profile-m-z/qgis.profile index 2e97daea2..555e1e41b 100644 --- a/etc/profile-m-z/qgis.profile +++ b/etc/profile-m-z/qgis.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
24 | 23 | ||
@@ -53,7 +52,7 @@ tracelog | |||
53 | disable-mnt | 52 | disable-mnt |
54 | private-cache | 53 | private-cache |
55 | private-dev | 54 | private-dev |
56 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,QGIS,QGIS.conf,resolv.conf,ssl,Trolltech.conf | 55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,machine-id,pki,QGIS,QGIS.conf,resolv.conf,ssl,Trolltech.conf |
57 | private-tmp | 56 | private-tmp |
58 | 57 | ||
59 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-m-z/qlipper.profile b/etc/profile-m-z/qlipper.profile index 6e94d5845..7176d8a39 100644 --- a/etc/profile-m-z/qlipper.profile +++ b/etc/profile-m-z/qlipper.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/qmmp.profile b/etc/profile-m-z/qmmp.profile index c3d982c17..af85c95e7 100644 --- a/etc/profile-m-z/qmmp.profile +++ b/etc/profile-m-z/qmmp.profile | |||
@@ -12,7 +12,6 @@ noblacklist ${MUSIC} | |||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/qnapi.profile b/etc/profile-m-z/qnapi.profile index ca11df5be..4a3ce366e 100644 --- a/etc/profile-m-z/qnapi.profile +++ b/etc/profile-m-z/qnapi.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -48,7 +47,7 @@ tracelog | |||
48 | private-bin 7z,qnapi | 47 | private-bin 7z,qnapi |
49 | private-cache | 48 | private-cache |
50 | private-dev | 49 | private-dev |
51 | private-etc alternatives,fonts | 50 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
52 | private-opt none | 51 | private-opt none |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
diff --git a/etc/profile-m-z/qpdfview.profile b/etc/profile-m-z/qpdfview.profile index be690ffa4..3ad8a19c8 100644 --- a/etc/profile-m-z/qpdfview.profile +++ b/etc/profile-m-z/qpdfview.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/qrencode.profile b/etc/profile-m-z/qrencode.profile index 6cbf8519f..dd3f24875 100644 --- a/etc/profile-m-z/qrencode.profile +++ b/etc/profile-m-z/qrencode.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-write-mnt.inc | 18 | include disable-write-mnt.inc |
@@ -48,7 +47,7 @@ disable-mnt | |||
48 | private-bin qrencode | 47 | private-bin qrencode |
49 | private-cache | 48 | private-cache |
50 | private-dev | 49 | private-dev |
51 | private-etc none | 50 | private-etc alternatives,ld.so.cache,ld.so.preload |
52 | private-lib libpcre* | 51 | private-lib libpcre* |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
diff --git a/etc/profile-m-z/qtox.profile b/etc/profile-m-z/qtox.profile index 8ffe24d11..60e1539fa 100644 --- a/etc/profile-m-z/qtox.profile +++ b/etc/profile-m-z/qtox.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin qtox | 43 | private-bin qtox |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl | 46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,pulse,resolv.conf,ssl |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/quaternion.profile b/etc/profile-m-z/quaternion.profile index 1d146aa39..dfb46ddae 100644 --- a/etc/profile-m-z/quaternion.profile +++ b/etc/profile-m-z/quaternion.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/quiterss.profile b/etc/profile-m-z/quiterss.profile index 9490089b2..8f89931c7 100644 --- a/etc/profile-m-z/quiterss.profile +++ b/etc/profile-m-z/quiterss.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | 20 | ||
diff --git a/etc/profile-m-z/quodlibet.profile b/etc/profile-m-z/quodlibet.profile index 92b02b2bf..bc435653d 100644 --- a/etc/profile-m-z/quodlibet.profile +++ b/etc/profile-m-z/quodlibet.profile | |||
@@ -21,7 +21,6 @@ include disable-common.inc | |||
21 | include disable-devel.inc | 21 | include disable-devel.inc |
22 | include disable-exec.inc | 22 | include disable-exec.inc |
23 | include disable-interpreters.inc | 23 | include disable-interpreters.inc |
24 | include disable-passwdmgr.inc | ||
25 | include disable-programs.inc | 24 | include disable-programs.inc |
26 | include disable-shell.inc | 25 | include disable-shell.inc |
27 | include disable-xdg.inc | 26 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/qupzilla.profile b/etc/profile-m-z/qupzilla.profile index 7aa71c848..c29d87a73 100644 --- a/etc/profile-m-z/qupzilla.profile +++ b/etc/profile-m-z/qupzilla.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.cache/qupzilla | 18 | mkdir ${HOME}/.cache/qupzilla |
diff --git a/etc/profile-m-z/raincat.profile b/etc/profile-m-z/raincat.profile new file mode 100644 index 000000000..104577bdb --- /dev/null +++ b/etc/profile-m-z/raincat.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for raincat | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include raincat.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | include disable-devel.inc | ||
9 | include disable-exec.inc | ||
10 | include disable-interpreters.inc | ||
11 | include disable-programs.inc | ||
12 | include disable-shell.inc | ||
13 | include disable-xdg.inc | ||
14 | |||
15 | whitelist /usr/share/games | ||
16 | whitelist /usr/share/timidity | ||
17 | include whitelist-usr-share-common.inc | ||
18 | include whitelist-var-common.inc | ||
19 | |||
20 | apparmor | ||
21 | caps.drop all | ||
22 | ipc-namespace | ||
23 | netfilter | ||
24 | nodvd | ||
25 | nogroups | ||
26 | noinput | ||
27 | nonewprivs | ||
28 | noroot | ||
29 | notv | ||
30 | nou2f | ||
31 | novideo | ||
32 | protocol unix | ||
33 | net none | ||
34 | seccomp | ||
35 | shell none | ||
36 | tracelog | ||
37 | |||
38 | disable-mnt | ||
39 | private | ||
40 | private-bin raincat | ||
41 | private-cache | ||
42 | private-dev | ||
43 | private-etc alternatives,drirc,ld.so.cache,ld.so.preload,machine-id,passwd,pulse,timidity,timidity.cfg | ||
44 | #private-lib | ||
45 | private-tmp | ||
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
49 | |||
diff --git a/etc/profile-m-z/rambox.profile b/etc/profile-m-z/rambox.profile index ffa2022ee..a14d7862b 100644 --- a/etc/profile-m-z/rambox.profile +++ b/etc/profile-m-z/rambox.profile | |||
@@ -7,8 +7,8 @@ include rambox.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.config/Rambox | 9 | noblacklist ${HOME}/.config/Rambox |
10 | noblacklist ${HOME}/.pki | ||
11 | noblacklist ${HOME}/.local/share/pki | 10 | noblacklist ${HOME}/.local/share/pki |
11 | noblacklist ${HOME}/.pki | ||
12 | 12 | ||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
@@ -16,12 +16,12 @@ include disable-interpreters.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | 17 | ||
18 | mkdir ${HOME}/.config/Rambox | 18 | mkdir ${HOME}/.config/Rambox |
19 | mkdir ${HOME}/.pki | ||
20 | mkdir ${HOME}/.local/share/pki | 19 | mkdir ${HOME}/.local/share/pki |
20 | mkdir ${HOME}/.pki | ||
21 | whitelist ${DOWNLOADS} | 21 | whitelist ${DOWNLOADS} |
22 | whitelist ${HOME}/.config/Rambox | 22 | whitelist ${HOME}/.config/Rambox |
23 | whitelist ${HOME}/.pki | ||
24 | whitelist ${HOME}/.local/share/pki | 23 | whitelist ${HOME}/.local/share/pki |
24 | whitelist ${HOME}/.pki | ||
25 | include whitelist-common.inc | 25 | include whitelist-common.inc |
26 | 26 | ||
27 | caps.drop all | 27 | caps.drop all |
diff --git a/etc/profile-m-z/redeclipse.profile b/etc/profile-m-z/redeclipse.profile index 9bc196a16..436b98f29 100644 --- a/etc/profile-m-z/redeclipse.profile +++ b/etc/profile-m-z/redeclipse.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/rednotebook.profile b/etc/profile-m-z/rednotebook.profile new file mode 100644 index 000000000..d1dd365ab --- /dev/null +++ b/etc/profile-m-z/rednotebook.profile | |||
@@ -0,0 +1,66 @@ | |||
1 | # Firejail profile for rednotebook | ||
2 | # Description: Daily journal with calendar, templates and keyword searching | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include rednotebook.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/rednotebook | ||
10 | noblacklist ${HOME}/.rednotebook | ||
11 | |||
12 | # Allow python (blacklisted by disable-interpreters.inc) | ||
13 | include allow-python3.inc | ||
14 | |||
15 | include disable-common.inc | ||
16 | include disable-devel.inc | ||
17 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-shell.inc | ||
21 | |||
22 | mkdir ${HOME}/.cache/rednotebook | ||
23 | mkdir ${HOME}/.rednotebook | ||
24 | whitelist ${HOME}/.cache/rednotebook | ||
25 | whitelist ${HOME}/.rednotebook | ||
26 | whitelist ${DESKTOP} | ||
27 | whitelist ${DOCUMENTS} | ||
28 | whitelist ${DOWNLOADS} | ||
29 | whitelist ${MUSIC} | ||
30 | whitelist ${PICTURES} | ||
31 | whitelist ${VIDEOS} | ||
32 | whitelist /usr/libexec/webkit2gtk-4.0 | ||
33 | include whitelist-common.inc | ||
34 | include whitelist-runuser-common.inc | ||
35 | include whitelist-usr-share-common.inc | ||
36 | include whitelist-var-common.inc | ||
37 | |||
38 | apparmor | ||
39 | caps.drop all | ||
40 | machine-id | ||
41 | net none | ||
42 | no3d | ||
43 | nodvd | ||
44 | nogroups | ||
45 | noinput | ||
46 | nonewprivs | ||
47 | noroot | ||
48 | nosound | ||
49 | notv | ||
50 | nou2f | ||
51 | novideo | ||
52 | protocol unix | ||
53 | seccomp | ||
54 | seccomp.block-secondary | ||
55 | shell none | ||
56 | tracelog | ||
57 | |||
58 | disable-mnt | ||
59 | private-bin python3*,rednotebook | ||
60 | private-cache | ||
61 | private-dev | ||
62 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11 | ||
63 | private-tmp | ||
64 | |||
65 | dbus-user none | ||
66 | dbus-system none | ||
diff --git a/etc/profile-m-z/redshift.profile b/etc/profile-m-z/redshift.profile index f87c5f67c..06ae67ae1 100644 --- a/etc/profile-m-z/redshift.profile +++ b/etc/profile-m-z/redshift.profile | |||
@@ -13,7 +13,6 @@ noblacklist ${HOME}/.config/redshift.conf | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/regextester.profile b/etc/profile-m-z/regextester.profile index f5131c5d0..f1ce313e7 100644 --- a/etc/profile-m-z/regextester.profile +++ b/etc/profile-m-z/regextester.profile | |||
@@ -9,7 +9,6 @@ include globals.local | |||
9 | include disable-common.inc | 9 | include disable-common.inc |
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-passwdmgr.inc | ||
13 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin regextester | 43 | private-bin regextester |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,fonts | 46 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
48 | private-lib libgranite.so.* | 47 | private-lib libgranite.so.* |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
diff --git a/etc/profile-m-z/remmina.profile b/etc/profile-m-z/remmina.profile index aca22f187..16da40daf 100644 --- a/etc/profile-m-z/remmina.profile +++ b/etc/profile-m-z/remmina.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-m-z/retroarch.profile b/etc/profile-m-z/retroarch.profile new file mode 100644 index 000000000..1887a9b72 --- /dev/null +++ b/etc/profile-m-z/retroarch.profile | |||
@@ -0,0 +1,54 @@ | |||
1 | # Firejail profile for retroarch | ||
2 | # Description: retroarch is a frontend to libretro emulator cores. | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include retroarch.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | blacklist /usr/libexec | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-programs.inc | ||
16 | include disable-shell.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.config/retroarch | ||
20 | whitelist ${HOME}/.config/retroarch | ||
21 | whitelist /run/udev | ||
22 | whitelist /usr/share/retroarch | ||
23 | whitelist /usr/share/libretro | ||
24 | include whitelist-common.inc | ||
25 | include whitelist-run-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | netfilter | ||
33 | nodvd | ||
34 | nogroups | ||
35 | nonewprivs | ||
36 | noroot | ||
37 | notv | ||
38 | nou2f | ||
39 | # If you need access to cameras, add `ignore novideo` to retroarch.local | ||
40 | novideo | ||
41 | protocol unix,inet,inet6,netlink | ||
42 | seccomp | ||
43 | seccomp.block-secondary | ||
44 | shell none | ||
45 | tracelog | ||
46 | |||
47 | disable-mnt | ||
48 | private-bin retroarch | ||
49 | private-cache | ||
50 | private-dev | ||
51 | private-tmp | ||
52 | |||
53 | dbus-user none | ||
54 | dbus-system none | ||
diff --git a/etc/profile-m-z/rhythmbox.profile b/etc/profile-m-z/rhythmbox.profile index 970e8ffba..26b62e456 100644 --- a/etc/profile-m-z/rhythmbox.profile +++ b/etc/profile-m-z/rhythmbox.profile | |||
@@ -21,7 +21,6 @@ include disable-common.inc | |||
21 | include disable-devel.inc | 21 | include disable-devel.inc |
22 | include disable-exec.inc | 22 | include disable-exec.inc |
23 | include disable-interpreters.inc | 23 | include disable-interpreters.inc |
24 | include disable-passwdmgr.inc | ||
25 | include disable-programs.inc | 24 | include disable-programs.inc |
26 | include disable-shell.inc | 25 | include disable-shell.inc |
27 | include disable-xdg.inc | 26 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/ricochet.profile b/etc/profile-m-z/ricochet.profile index b664a2be3..705ca0045 100644 --- a/etc/profile-m-z/ricochet.profile +++ b/etc/profile-m-z/ricochet.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | 16 | ||
diff --git a/etc/profile-m-z/ripperx.profile b/etc/profile-m-z/ripperx.profile index be815e714..81aef5a65 100644 --- a/etc/profile-m-z/ripperx.profile +++ b/etc/profile-m-z/ripperx.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/ristretto.profile b/etc/profile-m-z/ristretto.profile index 5572cab5a..79f090d95 100644 --- a/etc/profile-m-z/ristretto.profile +++ b/etc/profile-m-z/ristretto.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/rpcs3.profile b/etc/profile-m-z/rpcs3.profile new file mode 100644 index 000000000..147afb236 --- /dev/null +++ b/etc/profile-m-z/rpcs3.profile | |||
@@ -0,0 +1,62 @@ | |||
1 | # Firejail profile for RPCS3 emulator | ||
2 | # Description: RPCS3 emulator | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include rpcs3.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/rpcs3 | ||
10 | noblacklist ${HOME}/.cache/rpcs3 | ||
11 | # Don't block access to /sbin and /usr/sbin to allow using ldconfig. Otherwise | ||
12 | # won't even start. | ||
13 | noblacklist /sbin | ||
14 | noblacklist /usr/sbin | ||
15 | |||
16 | blacklist /usr/libexec | ||
17 | |||
18 | include disable-common.inc | ||
19 | include disable-devel.inc | ||
20 | include disable-exec.inc | ||
21 | include disable-interpreters.inc | ||
22 | include disable-programs.inc # disable if PPU compilation crashes | ||
23 | include disable-shell.inc | ||
24 | include disable-xdg.inc | ||
25 | |||
26 | mkdir ${HOME}/.cache/rpcs3 | ||
27 | mkdir ${HOME}/.config/rpcs3 | ||
28 | whitelist ${HOME}/.cache/rpcs3 | ||
29 | whitelist ${HOME}/.config/rpcs3 | ||
30 | whitelist ${DOWNLOADS} | ||
31 | include whitelist-common.inc | ||
32 | include whitelist-run-common.inc | ||
33 | include whitelist-runuser-common.inc | ||
34 | include whitelist-usr-share-common.inc | ||
35 | include whitelist-var-common.inc | ||
36 | |||
37 | apparmor | ||
38 | caps.drop all | ||
39 | net none | ||
40 | netfilter | ||
41 | nodvd | ||
42 | nogroups | ||
43 | #noinput | ||
44 | nonewprivs | ||
45 | noroot | ||
46 | noprinters | ||
47 | notv | ||
48 | nou2f | ||
49 | novideo | ||
50 | protocol unix,netlink | ||
51 | seccomp | ||
52 | seccomp.block-secondary | ||
53 | shell none | ||
54 | tracelog | ||
55 | |||
56 | disable-mnt | ||
57 | #private-cache | ||
58 | #private-etc ca-certificates,crypto-policies,machine-id,pki,resolv.conf,ssl # seems to need awk | ||
59 | private-tmp | ||
60 | |||
61 | dbus-user none | ||
62 | dbus-system none | ||
diff --git a/etc/profile-m-z/rsync-download_only.profile b/etc/profile-m-z/rsync-download_only.profile index 690b44bb1..e44e55a12 100644 --- a/etc/profile-m-z/rsync-download_only.profile +++ b/etc/profile-m-z/rsync-download_only.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ disable-mnt | |||
50 | private-bin rsync | 49 | private-bin rsync |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | 52 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
56 | dbus-user none | 55 | dbus-user none |
diff --git a/etc/profile-m-z/rtin.profile b/etc/profile-m-z/rtin.profile new file mode 100644 index 000000000..cd84ce05e --- /dev/null +++ b/etc/profile-m-z/rtin.profile | |||
@@ -0,0 +1,8 @@ | |||
1 | # Firejail profile for rtin | ||
2 | # Description: ncurses-based Usenet newsreader | ||
3 | # symlink to tin, same as `tin -r` | ||
4 | # This file is overwritten after every install/update | ||
5 | # Persistent local customizations | ||
6 | include rtin.local | ||
7 | |||
8 | include tin.profile | ||
diff --git a/etc/profile-m-z/rtorrent.profile b/etc/profile-m-z/rtorrent.profile index 6ef51b7f1..757624938 100644 --- a/etc/profile-m-z/rtorrent.profile +++ b/etc/profile-m-z/rtorrent.profile | |||
@@ -10,7 +10,6 @@ include globals.local | |||
10 | include disable-common.inc | 10 | include disable-common.inc |
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | 15 | ||
diff --git a/etc/profile-m-z/rtv-addons.profile b/etc/profile-m-z/rtv-addons.profile index c9da0b628..cc6db5043 100644 --- a/etc/profile-m-z/rtv-addons.profile +++ b/etc/profile-m-z/rtv-addons.profile | |||
@@ -21,3 +21,8 @@ whitelist ${HOME}/.config/mpv | |||
21 | whitelist ${HOME}/.mailcap | 21 | whitelist ${HOME}/.mailcap |
22 | whitelist ${HOME}/.netrc | 22 | whitelist ${HOME}/.netrc |
23 | whitelist ${HOME}/.w3m | 23 | whitelist ${HOME}/.w3m |
24 | |||
25 | #private-bin w3m,mpv,youtube-dl | ||
26 | |||
27 | # tells rtv, which browser to use | ||
28 | #env RTV_BROWSER=w3m | ||
diff --git a/etc/profile-m-z/rtv.profile b/etc/profile-m-z/rtv.profile index f0b8d31e9..03d812270 100644 --- a/etc/profile-m-z/rtv.profile +++ b/etc/profile-m-z/rtv.profile | |||
@@ -12,6 +12,9 @@ blacklist ${RUNUSER}/wayland-* | |||
12 | noblacklist ${HOME}/.config/rtv | 12 | noblacklist ${HOME}/.config/rtv |
13 | noblacklist ${HOME}/.local/share/rtv | 13 | noblacklist ${HOME}/.local/share/rtv |
14 | 14 | ||
15 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
16 | include allow-bin-sh.inc | ||
17 | |||
15 | # Allow python (blacklisted by disable-interpreters.inc) | 18 | # Allow python (blacklisted by disable-interpreters.inc) |
16 | include allow-python2.inc | 19 | include allow-python2.inc |
17 | include allow-python3.inc | 20 | include allow-python3.inc |
@@ -24,7 +27,6 @@ include disable-common.inc | |||
24 | include disable-devel.inc | 27 | include disable-devel.inc |
25 | include disable-exec.inc | 28 | include disable-exec.inc |
26 | include disable-interpreters.inc | 29 | include disable-interpreters.inc |
27 | include disable-passwdmgr.inc | ||
28 | include disable-programs.inc | 30 | include disable-programs.inc |
29 | include disable-xdg.inc | 31 | include disable-xdg.inc |
30 | 32 | ||
@@ -54,10 +56,10 @@ shell none | |||
54 | tracelog | 56 | tracelog |
55 | 57 | ||
56 | disable-mnt | 58 | disable-mnt |
57 | private-bin python*,rtv,sh,xdg-settings | 59 | private-bin less,python*,rtv,sh,xdg-settings |
58 | private-cache | 60 | private-cache |
59 | private-dev | 61 | private-dev |
60 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,terminfo,xdg | 62 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mailcap,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,terminfo,xdg |
61 | 63 | ||
62 | dbus-user none | 64 | dbus-user none |
63 | dbus-system none | 65 | dbus-system none |
diff --git a/etc/profile-m-z/sayonara.profile b/etc/profile-m-z/sayonara.profile index de79913cc..d447be443 100644 --- a/etc/profile-m-z/sayonara.profile +++ b/etc/profile-m-z/sayonara.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${MUSIC} | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/scallion.profile b/etc/profile-m-z/scallion.profile index eb8468c3b..1fa45a747 100644 --- a/etc/profile-m-z/scallion.profile +++ b/etc/profile-m-z/scallion.profile | |||
@@ -14,7 +14,6 @@ noblacklist ${DOCUMENTS} | |||
14 | include disable-common.inc | 14 | include disable-common.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/scorched3d.profile b/etc/profile-m-z/scorched3d.profile index aac3e721f..77b3d8923 100644 --- a/etc/profile-m-z/scorched3d.profile +++ b/etc/profile-m-z/scorched3d.profile | |||
@@ -12,13 +12,13 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.scorched3d | 18 | mkdir ${HOME}/.scorched3d |
20 | whitelist ${HOME}/.scorched3d | 19 | whitelist ${HOME}/.scorched3d |
21 | whitelist /usr/share/scorched3d | 20 | whitelist /usr/share/scorched3d |
21 | whitelist /usr/share/games/scorched3d | ||
22 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | 23 | include whitelist-runuser-common.inc |
24 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-m-z/scorchwentbonkers.profile b/etc/profile-m-z/scorchwentbonkers.profile index 2cb1df6b5..70b5d844a 100644 --- a/etc/profile-m-z/scorchwentbonkers.profile +++ b/etc/profile-m-z/scorchwentbonkers.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin scorchwentbonkers | 43 | private-bin scorchwentbonkers |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alsa,asound.conf,machine-id,pulse | 46 | private-etc alsa,alternatives,asound.conf,ld.so.cache,ld.so.preload,machine-id,pulse |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/scribus.profile b/etc/profile-m-z/scribus.profile index 1fdeaa145..5cf60baea 100644 --- a/etc/profile-m-z/scribus.profile +++ b/etc/profile-m-z/scribus.profile | |||
@@ -34,7 +34,6 @@ include disable-common.inc | |||
34 | include disable-devel.inc | 34 | include disable-devel.inc |
35 | include disable-exec.inc | 35 | include disable-exec.inc |
36 | include disable-interpreters.inc | 36 | include disable-interpreters.inc |
37 | include disable-passwdmgr.inc | ||
38 | include disable-programs.inc | 37 | include disable-programs.inc |
39 | include disable-xdg.inc | 38 | include disable-xdg.inc |
40 | 39 | ||
diff --git a/etc/profile-m-z/sdat2img.profile b/etc/profile-m-z/sdat2img.profile index aa2fa9b1b..81a7dc929 100644 --- a/etc/profile-m-z/sdat2img.profile +++ b/etc/profile-m-z/sdat2img.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/seafile-applet.profile b/etc/profile-m-z/seafile-applet.profile new file mode 100644 index 000000000..79e072475 --- /dev/null +++ b/etc/profile-m-z/seafile-applet.profile | |||
@@ -0,0 +1,62 @@ | |||
1 | # Firejail profile for Seafile | ||
2 | # Description: Seafile desktop client. | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include seafile-applet.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/Seafile | ||
10 | noblacklist ${HOME}/Seafile/.seafile-data | ||
11 | |||
12 | blacklist /usr/libexec | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | mkdir ${HOME}/.ccnet | ||
22 | mkdir ${HOME}/.config/Seafile | ||
23 | mkdir ${HOME}/Seafile | ||
24 | whitelist ${HOME}/.ccnet | ||
25 | whitelist ${HOME}/.config/Seafile | ||
26 | whitelist ${HOME}/Seafile | ||
27 | |||
28 | include whitelist-common.inc | ||
29 | include whitelist-run-common.inc | ||
30 | include whitelist-runuser-common.inc | ||
31 | include whitelist-usr-share-common.inc | ||
32 | include whitelist-var-common.inc | ||
33 | |||
34 | apparmor | ||
35 | caps.drop all | ||
36 | netfilter | ||
37 | nodvd | ||
38 | nogroups | ||
39 | noinput | ||
40 | nonewprivs | ||
41 | noprinters | ||
42 | noroot | ||
43 | nosound | ||
44 | notv | ||
45 | nou2f | ||
46 | novideo | ||
47 | protocol unix,inet,inet6 | ||
48 | seccomp | ||
49 | seccomp.block-secondary | ||
50 | shell none | ||
51 | tracelog | ||
52 | |||
53 | disable-mnt | ||
54 | private-bin seaf-cli,seaf-daemon,seafile-applet | ||
55 | private-cache | ||
56 | private-dev | ||
57 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | ||
58 | #private-opt none | ||
59 | private-tmp | ||
60 | |||
61 | dbus-user none | ||
62 | dbus-system none | ||
diff --git a/etc/profile-m-z/seahorse-adventures.profile b/etc/profile-m-z/seahorse-adventures.profile index 131dcbb68..72d6d5cf7 100644 --- a/etc/profile-m-z/seahorse-adventures.profile +++ b/etc/profile-m-z/seahorse-adventures.profile | |||
@@ -6,6 +6,9 @@ include seahorse-adventures.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
10 | include allow-bin-sh.inc | ||
11 | |||
9 | # Allow python (blacklisted by disable-interpreters.inc) | 12 | # Allow python (blacklisted by disable-interpreters.inc) |
10 | include allow-python2.inc | 13 | include allow-python2.inc |
11 | include allow-python3.inc | 14 | include allow-python3.inc |
@@ -14,12 +17,12 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 17 | include disable-devel.inc |
15 | include disable-exec.inc | 18 | include disable-exec.inc |
16 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 20 | include disable-programs.inc |
19 | include disable-shell.inc | 21 | include disable-shell.inc |
20 | include disable-xdg.inc | 22 | include disable-xdg.inc |
21 | 23 | ||
22 | whitelist /usr/share/seahorse-adventures | 24 | whitelist /usr/share/seahorse-adventures |
25 | whitelist /usr/share/games/seahorse-adventures | ||
23 | include whitelist-common.inc | 26 | include whitelist-common.inc |
24 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
@@ -42,10 +45,10 @@ tracelog | |||
42 | 45 | ||
43 | disable-mnt | 46 | disable-mnt |
44 | private | 47 | private |
45 | private-bin python*,seahorse-adventures | 48 | private-bin bash,dash,python*,seahorse-adventures,sh |
46 | private-cache | 49 | private-cache |
47 | private-dev | 50 | private-dev |
48 | private-etc machine-id | 51 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
49 | private-tmp | 52 | private-tmp |
50 | 53 | ||
51 | dbus-user none | 54 | dbus-user none |
diff --git a/etc/profile-m-z/seahorse-tool.profile b/etc/profile-m-z/seahorse-tool.profile index 96ff74edf..9ef174606 100644 --- a/etc/profile-m-z/seahorse-tool.profile +++ b/etc/profile-m-z/seahorse-tool.profile | |||
@@ -8,7 +8,7 @@ include seahorse-tool.local | |||
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | # private-etc workaround for: #2877 | 10 | # private-etc workaround for: #2877 |
11 | private-etc firejail,login.defs,passwd | 11 | private-etc alternatives,firejail,ld.so.cache,ld.so.preload,login.defs,passwd |
12 | private-tmp | 12 | private-tmp |
13 | 13 | ||
14 | # Redirect | 14 | # Redirect |
diff --git a/etc/profile-m-z/seahorse.profile b/etc/profile-m-z/seahorse.profile index d3d8e453f..7382e4712 100644 --- a/etc/profile-m-z/seahorse.profile +++ b/etc/profile-m-z/seahorse.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
@@ -61,7 +60,7 @@ tracelog | |||
61 | disable-mnt | 60 | disable-mnt |
62 | private-cache | 61 | private-cache |
63 | private-dev | 62 | private-dev |
64 | private-etc ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssh,ssl,X11 | 63 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssh,ssl,X11 |
65 | writable-run-user | 64 | writable-run-user |
66 | 65 | ||
67 | dbus-user filter | 66 | dbus-user filter |
diff --git a/etc/profile-m-z/seamonkey.profile b/etc/profile-m-z/seamonkey.profile index 807effbeb..e67e51620 100644 --- a/etc/profile-m-z/seamonkey.profile +++ b/etc/profile-m-z/seamonkey.profile | |||
@@ -8,8 +8,8 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.cache/mozilla | 9 | noblacklist ${HOME}/.cache/mozilla |
10 | noblacklist ${HOME}/.mozilla | 10 | noblacklist ${HOME}/.mozilla |
11 | noblacklist ${HOME}/.pki | ||
12 | noblacklist ${HOME}/.local/share/pki | 11 | noblacklist ${HOME}/.local/share/pki |
12 | noblacklist ${HOME}/.pki | ||
13 | 13 | ||
14 | include disable-common.inc | 14 | include disable-common.inc |
15 | include disable-devel.inc | 15 | include disable-devel.inc |
@@ -18,8 +18,8 @@ include disable-programs.inc | |||
18 | 18 | ||
19 | mkdir ${HOME}/.cache/mozilla | 19 | mkdir ${HOME}/.cache/mozilla |
20 | mkdir ${HOME}/.mozilla | 20 | mkdir ${HOME}/.mozilla |
21 | mkdir ${HOME}/.pki | ||
22 | mkdir ${HOME}/.local/share/pki | 21 | mkdir ${HOME}/.local/share/pki |
22 | mkdir ${HOME}/.pki | ||
23 | whitelist ${DOWNLOADS} | 23 | whitelist ${DOWNLOADS} |
24 | whitelist ${HOME}/.cache/gnome-mplayer/plugin | 24 | whitelist ${HOME}/.cache/gnome-mplayer/plugin |
25 | whitelist ${HOME}/.cache/mozilla | 25 | whitelist ${HOME}/.cache/mozilla |
@@ -28,11 +28,11 @@ whitelist ${HOME}/.config/pipelight-silverlight5.1 | |||
28 | whitelist ${HOME}/.config/pipelight-widevine | 28 | whitelist ${HOME}/.config/pipelight-widevine |
29 | whitelist ${HOME}/.keysnail.js | 29 | whitelist ${HOME}/.keysnail.js |
30 | whitelist ${HOME}/.lastpass | 30 | whitelist ${HOME}/.lastpass |
31 | whitelist ${HOME}/.local/share/pki | ||
31 | whitelist ${HOME}/.mozilla | 32 | whitelist ${HOME}/.mozilla |
32 | whitelist ${HOME}/.pentadactyl | 33 | whitelist ${HOME}/.pentadactyl |
33 | whitelist ${HOME}/.pentadactylrc | 34 | whitelist ${HOME}/.pentadactylrc |
34 | whitelist ${HOME}/.pki | 35 | whitelist ${HOME}/.pki |
35 | whitelist ${HOME}/.local/share/pki | ||
36 | whitelist ${HOME}/.vimperator | 36 | whitelist ${HOME}/.vimperator |
37 | whitelist ${HOME}/.vimperatorrc | 37 | whitelist ${HOME}/.vimperatorrc |
38 | whitelist ${HOME}/.wine-pipelight | 38 | whitelist ${HOME}/.wine-pipelight |
diff --git a/etc/profile-m-z/server.profile b/etc/profile-m-z/server.profile index 7d56684db..9e40796a6 100644 --- a/etc/profile-m-z/server.profile +++ b/etc/profile-m-z/server.profile | |||
@@ -7,7 +7,6 @@ | |||
7 | # [sudo] password for netblue: | 7 | # [sudo] password for netblue: |
8 | # Reading profile /etc/firejail/server.profile | 8 | # Reading profile /etc/firejail/server.profile |
9 | # Reading profile /etc/firejail/disable-common.inc | 9 | # Reading profile /etc/firejail/disable-common.inc |
10 | # Reading profile /etc/firejail/disable-passwdmgr.inc | ||
11 | # Reading profile /etc/firejail/disable-programs.inc | 10 | # Reading profile /etc/firejail/disable-programs.inc |
12 | # | 11 | # |
13 | # ** Note: you can use --noprofile to disable server.profile ** | 12 | # ** Note: you can use --noprofile to disable server.profile ** |
@@ -43,7 +42,6 @@ include disable-common.inc | |||
43 | # include disable-devel.inc | 42 | # include disable-devel.inc |
44 | # include disable-exec.inc | 43 | # include disable-exec.inc |
45 | # include disable-interpreters.inc | 44 | # include disable-interpreters.inc |
46 | include disable-passwdmgr.inc | ||
47 | include disable-programs.inc | 45 | include disable-programs.inc |
48 | include disable-write-mnt.inc | 46 | include disable-write-mnt.inc |
49 | include disable-xdg.inc | 47 | include disable-xdg.inc |
@@ -85,6 +83,7 @@ private-tmp | |||
85 | dbus-user none | 83 | dbus-user none |
86 | # dbus-system none | 84 | # dbus-system none |
87 | 85 | ||
86 | # deterministic-shutdown | ||
88 | # memory-deny-write-execute | 87 | # memory-deny-write-execute |
89 | # read-only ${HOME} | 88 | # read-only ${HOME} |
90 | # writable-run-user | 89 | # writable-run-user |
diff --git a/etc/profile-m-z/servo.profile b/etc/profile-m-z/servo.profile index df8fbc3e3..7788974ce 100644 --- a/etc/profile-m-z/servo.profile +++ b/etc/profile-m-z/servo.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/shellcheck.profile b/etc/profile-m-z/shellcheck.profile index b7f398f45..61fe534d6 100644 --- a/etc/profile-m-z/shellcheck.profile +++ b/etc/profile-m-z/shellcheck.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
@@ -51,5 +50,3 @@ private-tmp | |||
51 | 50 | ||
52 | dbus-user none | 51 | dbus-user none |
53 | dbus-system none | 52 | dbus-system none |
54 | |||
55 | memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/shortwave.profile b/etc/profile-m-z/shortwave.profile index d629240ec..0bcf5f693 100644 --- a/etc/profile-m-z/shortwave.profile +++ b/etc/profile-m-z/shortwave.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/shotcut.profile b/etc/profile-m-z/shotcut.profile index 63af4d367..e5dbf5c5f 100644 --- a/etc/profile-m-z/shotcut.profile +++ b/etc/profile-m-z/shotcut.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | caps.drop all | 19 | caps.drop all |
diff --git a/etc/profile-m-z/shotwell.profile b/etc/profile-m-z/shotwell.profile index ddc8a7743..3b569eeaf 100644 --- a/etc/profile-m-z/shotwell.profile +++ b/etc/profile-m-z/shotwell.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ tracelog | |||
50 | private-bin shotwell | 49 | private-bin shotwell |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc alternatives,fonts,machine-id | 52 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
54 | private-opt none | 53 | private-opt none |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
diff --git a/etc/profile-m-z/signal-cli.profile b/etc/profile-m-z/signal-cli.profile index 478377344..24f1464f9 100644 --- a/etc/profile-m-z/signal-cli.profile +++ b/etc/profile-m-z/signal-cli.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
diff --git a/etc/profile-m-z/signal-desktop.profile b/etc/profile-m-z/signal-desktop.profile index 77a7f5b38..1166f378b 100644 --- a/etc/profile-m-z/signal-desktop.profile +++ b/etc/profile-m-z/signal-desktop.profile | |||
@@ -21,9 +21,15 @@ whitelist ${HOME}/.config/Signal | |||
21 | 21 | ||
22 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id,nsswitch.conf,pki,resolv.conf,ssl | 22 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id,nsswitch.conf,pki,resolv.conf,ssl |
23 | 23 | ||
24 | # allow D-Bus notifications | ||
25 | dbus-user filter | 24 | dbus-user filter |
25 | |||
26 | # allow D-Bus notifications | ||
26 | dbus-user.talk org.freedesktop.Notifications | 27 | dbus-user.talk org.freedesktop.Notifications |
28 | |||
29 | # allow D-Bus communication with firefox for opening links | ||
30 | dbus-user.talk org.mozilla.Firefox.* | ||
31 | dbus-user.talk org.mozilla.firefox.* | ||
32 | |||
27 | ignore dbus-user none | 33 | ignore dbus-user none |
28 | 34 | ||
29 | # Redirect | 35 | # Redirect |
diff --git a/etc/profile-m-z/silentarmy.profile b/etc/profile-m-z/silentarmy.profile index 3f3e2a75d..4351a4d43 100644 --- a/etc/profile-m-z/silentarmy.profile +++ b/etc/profile-m-z/silentarmy.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | # include disable-devel.inc | 10 | # include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/simple-scan.profile b/etc/profile-m-z/simple-scan.profile index 17920677b..b0ab0d039 100644 --- a/etc/profile-m-z/simple-scan.profile +++ b/etc/profile-m-z/simple-scan.profile | |||
@@ -12,7 +12,6 @@ noblacklist ${DOCUMENTS} | |||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/simplescreenrecorder.profile b/etc/profile-m-z/simplescreenrecorder.profile index d664f8bf5..03a350327 100644 --- a/etc/profile-m-z/simplescreenrecorder.profile +++ b/etc/profile-m-z/simplescreenrecorder.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/simutrans.profile b/etc/profile-m-z/simutrans.profile index afaa0f6d8..55e472dbe 100644 --- a/etc/profile-m-z/simutrans.profile +++ b/etc/profile-m-z/simutrans.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/.simutrans | 17 | mkdir ${HOME}/.simutrans |
diff --git a/etc/profile-m-z/skanlite.profile b/etc/profile-m-z/skanlite.profile index 093a61398..4965d3882 100644 --- a/etc/profile-m-z/skanlite.profile +++ b/etc/profile-m-z/skanlite.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${DOCUMENTS} | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
17 | 16 | ||
diff --git a/etc/profile-m-z/skypeforlinux.profile b/etc/profile-m-z/skypeforlinux.profile index ed04eda8e..3734f8f4a 100644 --- a/etc/profile-m-z/skypeforlinux.profile +++ b/etc/profile-m-z/skypeforlinux.profile | |||
@@ -6,24 +6,28 @@ include skypeforlinux.local | |||
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Disabled until someone reported positive feedback | 8 | # Disabled until someone reported positive feedback |
9 | ignore whitelist ${DOWNLOADS} | ||
10 | ignore include whitelist-common.inc | ||
11 | ignore include whitelist-runuser-common.inc | 9 | ignore include whitelist-runuser-common.inc |
12 | ignore include whitelist-usr-share-common.inc | 10 | ignore include whitelist-usr-share-common.inc |
13 | ignore include whitelist-var-common.inc | 11 | ignore include whitelist-var-common.inc |
14 | ignore nou2f | 12 | ignore nou2f |
15 | ignore novideo | ||
16 | ignore private-dev | ||
17 | ignore dbus-user none | ||
18 | ignore dbus-system none | ||
19 | 13 | ||
20 | # breaks Skype | 14 | # breaks Skype |
21 | ignore apparmor | 15 | ignore apparmor |
16 | ignore dbus-user none | ||
22 | ignore noexec /tmp | 17 | ignore noexec /tmp |
18 | ignore novideo | ||
19 | ignore private-dev # needs /dev/disk | ||
23 | 20 | ||
24 | noblacklist ${HOME}/.config/skypeforlinux | 21 | noblacklist ${HOME}/.config/skypeforlinux |
25 | 22 | ||
26 | # private-dev - needs /dev/disk | 23 | mkdir ${HOME}/.config/skypeforlinux |
24 | whitelist ${HOME}/.config/skypeforlinux | ||
25 | |||
26 | dbus-user filter | ||
27 | dbus-user.talk org.freedesktop.Notifications | ||
28 | dbus-user.talk org.freedesktop.secrets | ||
29 | # Note: Skype will log out the current session on start-up without this: | ||
30 | dbus-user.talk org.kde.StatusNotifierWatcher | ||
27 | 31 | ||
28 | # Redirect | 32 | # Redirect |
29 | include electron.profile | 33 | include electron.profile |
diff --git a/etc/profile-m-z/slack.profile b/etc/profile-m-z/slack.profile index 9ad772cd5..a511ebb1c 100644 --- a/etc/profile-m-z/slack.profile +++ b/etc/profile-m-z/slack.profile | |||
@@ -18,13 +18,15 @@ ignore dbus-system none | |||
18 | 18 | ||
19 | noblacklist ${HOME}/.config/Slack | 19 | noblacklist ${HOME}/.config/Slack |
20 | 20 | ||
21 | include allow-bin-sh.inc | ||
22 | |||
21 | include disable-shell.inc | 23 | include disable-shell.inc |
22 | 24 | ||
23 | mkdir ${HOME}/.config/Slack | 25 | mkdir ${HOME}/.config/Slack |
24 | whitelist ${HOME}/.config/Slack | 26 | whitelist ${HOME}/.config/Slack |
25 | 27 | ||
26 | private-bin locale,slack | 28 | private-bin electron,electron[0-9],electron[0-9][0-9],locale,sh,slack |
27 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fedora-release,fonts,group,ld.so.cache,ld.so.conf,localtime,machine-id,os-release,passwd,pki,pulse,redhat-release,resolv.conf,ssl,system-release,system-release-cpe | 29 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fedora-release,fonts,group,ld.so.cache,ld.so.conf,ld.so.preload,localtime,machine-id,os-release,passwd,pki,pulse,redhat-release,resolv.conf,ssl,system-release,system-release-cpe |
28 | 30 | ||
29 | # Redirect | 31 | # Redirect |
30 | include electron.profile | 32 | include electron.profile |
diff --git a/etc/profile-m-z/slashem.profile b/etc/profile-m-z/slashem.profile index c5a31c237..bebf77ccc 100644 --- a/etc/profile-m-z/slashem.profile +++ b/etc/profile-m-z/slashem.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | whitelist /var/games/slashem | 17 | whitelist /var/games/slashem |
diff --git a/etc/profile-m-z/smplayer.profile b/etc/profile-m-z/smplayer.profile index 01547e5c1..7c1e18ac3 100644 --- a/etc/profile-m-z/smplayer.profile +++ b/etc/profile-m-z/smplayer.profile | |||
@@ -24,7 +24,6 @@ include disable-common.inc | |||
24 | include disable-devel.inc | 24 | include disable-devel.inc |
25 | include disable-exec.inc | 25 | include disable-exec.inc |
26 | include disable-interpreters.inc | 26 | include disable-interpreters.inc |
27 | include disable-passwdmgr.inc | ||
28 | include disable-programs.inc | 27 | include disable-programs.inc |
29 | include disable-shell.inc | 28 | include disable-shell.inc |
30 | include disable-xdg.inc | 29 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/smtube.profile b/etc/profile-m-z/smtube.profile index 196950eaf..65e6d38e4 100644 --- a/etc/profile-m-z/smtube.profile +++ b/etc/profile-m-z/smtube.profile | |||
@@ -19,7 +19,6 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
25 | 24 | ||
diff --git a/etc/profile-m-z/smuxi-frontend-gnome.profile b/etc/profile-m-z/smuxi-frontend-gnome.profile index c3a9bb858..0cdb5537e 100644 --- a/etc/profile-m-z/smuxi-frontend-gnome.profile +++ b/etc/profile-m-z/smuxi-frontend-gnome.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -49,7 +48,7 @@ disable-mnt | |||
49 | private-bin bash,mono,mono-sgen,sh,smuxi-frontend-gnome | 48 | private-bin bash,mono,mono-sgen,sh,smuxi-frontend-gnome |
50 | private-cache | 49 | private-cache |
51 | private-dev | 50 | private-dev |
52 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.conf,machine-id,mono,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg | 51 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.preload,machine-id,mono,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
55 | dbus-user none | 54 | dbus-user none |
diff --git a/etc/profile-m-z/snox.profile b/etc/profile-m-z/snox.profile index 83493652c..9d3ed8c1a 100644 --- a/etc/profile-m-z/snox.profile +++ b/etc/profile-m-z/snox.profile | |||
@@ -5,8 +5,7 @@ include snox.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Disable for now, see https://www.tutorialspoint.com/difference-between-void-main-and-int-main-in-c-cplusplus | 8 | # Disable for now, see https://github.com/netblue30/firejail/pull/3688#issuecomment-718711565 |
9 | ignore whitelist /usr/share/chromium | ||
10 | ignore include whitelist-runuser-common.inc | 9 | ignore include whitelist-runuser-common.inc |
11 | ignore include whitelist-usr-share-common.inc | 10 | ignore include whitelist-usr-share-common.inc |
12 | 11 | ||
diff --git a/etc/profile-m-z/softmaker-common.profile b/etc/profile-m-z/softmaker-common.profile index 83315231f..099e6a2ad 100644 --- a/etc/profile-m-z/softmaker-common.profile +++ b/etc/profile-m-z/softmaker-common.profile | |||
@@ -6,9 +6,9 @@ include softmaker-common.local | |||
6 | # added by caller profile | 6 | # added by caller profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | # The offical packages install the desktop file under /usr/local/share/applications | 9 | # The official packages install the desktop file under /usr/local/share/applications |
10 | # with an absolute Exec line. These files are NOT handelt by firecfg, | 10 | # with an absolute Exec line. These files are NOT handled by firecfg, |
11 | # therefore you must manualy copy them in you home and remove '/usr/bin/'. | 11 | # therefore you must manually copy them in you home and remove '/usr/bin/'. |
12 | 12 | ||
13 | noblacklist ${HOME}/SoftMaker | 13 | noblacklist ${HOME}/SoftMaker |
14 | 14 | ||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | whitelist /usr/share/office2018 | 21 | whitelist /usr/share/office2018 |
@@ -44,7 +43,7 @@ tracelog | |||
44 | private-bin freeoffice-planmaker,freeoffice-presentations,freeoffice-textmaker,planmaker18,planmaker18free,presentations18,presentations18free,sh,textmaker18,textmaker18free | 43 | private-bin freeoffice-planmaker,freeoffice-presentations,freeoffice-textmaker,planmaker18,planmaker18free,presentations18,presentations18free,sh,textmaker18,textmaker18free |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,SoftMaker,ssl | 46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,SoftMaker,ssl |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/sol.profile b/etc/profile-m-z/sol.profile index 6b8a17813..0af88e048 100644 --- a/etc/profile-m-z/sol.profile +++ b/etc/profile-m-z/sol.profile | |||
@@ -9,7 +9,6 @@ include disable-common.inc | |||
9 | include disable-devel.inc | 9 | include disable-devel.inc |
10 | include disable-exec.inc | 10 | include disable-exec.inc |
11 | include disable-interpreters.inc | 11 | include disable-interpreters.inc |
12 | include disable-passwdmgr.inc | ||
13 | include disable-programs.inc | 12 | include disable-programs.inc |
14 | include disable-shell.inc | 13 | include disable-shell.inc |
15 | include disable-xdg.inc | 14 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/sound-juicer.profile b/etc/profile-m-z/sound-juicer.profile index ef00fdfff..4c37ece8a 100644 --- a/etc/profile-m-z/sound-juicer.profile +++ b/etc/profile-m-z/sound-juicer.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/soundconverter.profile b/etc/profile-m-z/soundconverter.profile index 4dbf34100..e5ff26327 100644 --- a/etc/profile-m-z/soundconverter.profile +++ b/etc/profile-m-z/soundconverter.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-m-z/spectacle.profile b/etc/profile-m-z/spectacle.profile index 4468f21e7..fc4ae2b04 100644 --- a/etc/profile-m-z/spectacle.profile +++ b/etc/profile-m-z/spectacle.profile | |||
@@ -19,11 +19,10 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | 22 | include disable-programs.inc |
24 | include disable-xdg.inc | 23 | include disable-xdg.inc |
25 | 24 | ||
26 | mkfile ${HOME}/.config/spectaclerc | 25 | mkfile ${HOME}/.config/spectaclerc |
27 | whitelist ${HOME}/.config/spectaclerc | 26 | whitelist ${HOME}/.config/spectaclerc |
28 | whitelist ${PICTURES} | 27 | whitelist ${PICTURES} |
29 | whitelist /usr/share/kconf_update/spectacle_newConfig.upd | 28 | whitelist /usr/share/kconf_update/spectacle_newConfig.upd |
@@ -57,7 +56,7 @@ disable-mnt | |||
57 | private-bin spectacle | 56 | private-bin spectacle |
58 | private-cache | 57 | private-cache |
59 | private-dev | 58 | private-dev |
60 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d | 59 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload |
61 | private-tmp | 60 | private-tmp |
62 | 61 | ||
63 | dbus-user filter | 62 | dbus-user filter |
diff --git a/etc/profile-m-z/spectral.profile b/etc/profile-m-z/spectral.profile index 283674517..3f7f68009 100644 --- a/etc/profile-m-z/spectral.profile +++ b/etc/profile-m-z/spectral.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -50,10 +49,8 @@ private-dev | |||
50 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 49 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
53 | dbus-user none | 52 | dbus-user filter |
54 | # Add the next lines to your spectral.local to enable notification support. | 53 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher |
55 | #ignore dbus-user none | 54 | # Add the next line to your spectral.local to enable notification support. |
56 | #dbus-user filter | ||
57 | #dbus-user.talk org.freedesktop.Notifications | 55 | #dbus-user.talk org.freedesktop.Notifications |
58 | #dbus-user.talk org.kde.StatusNotifierWatcher | ||
59 | dbus-system none | 56 | dbus-system none |
diff --git a/etc/profile-m-z/spectre-meltdown-checker.profile b/etc/profile-m-z/spectre-meltdown-checker.profile index 984461f90..19d7f8ae3 100644 --- a/etc/profile-m-z/spectre-meltdown-checker.profile +++ b/etc/profile-m-z/spectre-meltdown-checker.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-xdg.inc | 22 | include disable-xdg.inc |
24 | 23 | ||
diff --git a/etc/profile-m-z/spotify.profile b/etc/profile-m-z/spotify.profile index f679be9e7..0ce918161 100644 --- a/etc/profile-m-z/spotify.profile +++ b/etc/profile-m-z/spotify.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | mkdir ${HOME}/.cache/spotify | 20 | mkdir ${HOME}/.cache/spotify |
@@ -44,8 +43,8 @@ tracelog | |||
44 | disable-mnt | 43 | disable-mnt |
45 | private-bin bash,cat,dirname,find,grep,head,rm,sh,spotify,tclsh,touch,zenity | 44 | private-bin bash,cat,dirname,find,grep,head,rm,sh,spotify,tclsh,touch,zenity |
46 | private-dev | 45 | private-dev |
47 | # Comment the next line or put 'ignore private-etc' in your spotify.local if want to see the albums covers or if you want to use the radio | 46 | # If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local. |
48 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,host.conf,hosts,ld.so.cache,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl | 47 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,host.conf,hosts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl |
49 | private-opt spotify | 48 | private-opt spotify |
50 | private-srv none | 49 | private-srv none |
51 | private-tmp | 50 | private-tmp |
diff --git a/etc/profile-m-z/sqlitebrowser.profile b/etc/profile-m-z/sqlitebrowser.profile index 4dd2c7262..deaf37f52 100644 --- a/etc/profile-m-z/sqlitebrowser.profile +++ b/etc/profile-m-z/sqlitebrowser.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -43,7 +42,7 @@ shell none | |||
43 | private-bin sqlitebrowser | 42 | private-bin sqlitebrowser |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,machine-id,passwd,pki,ssl | 45 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd,pki,ssl |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | # breaks proxy creation | 48 | # breaks proxy creation |
diff --git a/etc/profile-m-z/ssh-agent.profile b/etc/profile-m-z/ssh-agent.profile index 5802299a3..11723664f 100644 --- a/etc/profile-m-z/ssh-agent.profile +++ b/etc/profile-m-z/ssh-agent.profile | |||
@@ -13,7 +13,6 @@ blacklist /tmp/.X11-unix | |||
13 | blacklist ${RUNUSER}/wayland-* | 13 | blacklist ${RUNUSER}/wayland-* |
14 | 14 | ||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | include whitelist-usr-share-common.inc | 18 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-m-z/ssh.profile b/etc/profile-m-z/ssh.profile index a58642192..4da0db517 100644 --- a/etc/profile-m-z/ssh.profile +++ b/etc/profile-m-z/ssh.profile | |||
@@ -16,7 +16,6 @@ include allow-ssh.inc | |||
16 | 16 | ||
17 | include disable-common.inc | 17 | include disable-common.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh | 21 | whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh |
@@ -51,4 +50,5 @@ writable-run-user | |||
51 | dbus-user none | 50 | dbus-user none |
52 | dbus-system none | 51 | dbus-system none |
53 | 52 | ||
53 | deterministic-shutdown | ||
54 | memory-deny-write-execute | 54 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/standardnotes-desktop.profile b/etc/profile-m-z/standardnotes-desktop.profile index 48a532876..7a59274bf 100644 --- a/etc/profile-m-z/standardnotes-desktop.profile +++ b/etc/profile-m-z/standardnotes-desktop.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/Standard Notes Backups | 17 | mkdir ${HOME}/Standard Notes Backups |
@@ -39,7 +38,7 @@ seccomp !chroot | |||
39 | disable-mnt | 38 | disable-mnt |
40 | private-dev | 39 | private-dev |
41 | private-tmp | 40 | private-tmp |
42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,pki,resolv.conf,ssl,xdg | 41 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl,xdg |
43 | 42 | ||
44 | dbus-user none | 43 | dbus-user none |
45 | dbus-system none | 44 | dbus-system none |
diff --git a/etc/profile-m-z/steam.profile b/etc/profile-m-z/steam.profile index 369255324..b0be8a517 100644 --- a/etc/profile-m-z/steam.profile +++ b/etc/profile-m-z/steam.profile | |||
@@ -8,6 +8,7 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.config/Epic | 9 | noblacklist ${HOME}/.config/Epic |
10 | noblacklist ${HOME}/.config/Loop_Hero | 10 | noblacklist ${HOME}/.config/Loop_Hero |
11 | noblacklist ${HOME}/.config/MangoHud | ||
11 | noblacklist ${HOME}/.config/ModTheSpire | 12 | noblacklist ${HOME}/.config/ModTheSpire |
12 | noblacklist ${HOME}/.config/RogueLegacy | 13 | noblacklist ${HOME}/.config/RogueLegacy |
13 | noblacklist ${HOME}/.config/RogueLegacyStorageContainer | 14 | noblacklist ${HOME}/.config/RogueLegacyStorageContainer |
@@ -51,11 +52,11 @@ include allow-python3.inc | |||
51 | include disable-common.inc | 52 | include disable-common.inc |
52 | include disable-devel.inc | 53 | include disable-devel.inc |
53 | include disable-interpreters.inc | 54 | include disable-interpreters.inc |
54 | include disable-passwdmgr.inc | ||
55 | include disable-programs.inc | 55 | include disable-programs.inc |
56 | 56 | ||
57 | mkdir ${HOME}/.config/Epic | 57 | mkdir ${HOME}/.config/Epic |
58 | mkdir ${HOME}/.config/Loop_Hero | 58 | mkdir ${HOME}/.config/Loop_Hero |
59 | mkdir ${HOME}/.config/MangoHud | ||
59 | mkdir ${HOME}/.config/ModTheSpire | 60 | mkdir ${HOME}/.config/ModTheSpire |
60 | mkdir ${HOME}/.config/RogueLegacy | 61 | mkdir ${HOME}/.config/RogueLegacy |
61 | mkdir ${HOME}/.config/unity3d | 62 | mkdir ${HOME}/.config/unity3d |
@@ -86,6 +87,7 @@ mkfile ${HOME}/.steampath | |||
86 | mkfile ${HOME}/.steampid | 87 | mkfile ${HOME}/.steampid |
87 | whitelist ${HOME}/.config/Epic | 88 | whitelist ${HOME}/.config/Epic |
88 | whitelist ${HOME}/.config/Loop_Hero | 89 | whitelist ${HOME}/.config/Loop_Hero |
90 | whitelist ${HOME}/.config/MangoHud | ||
89 | whitelist ${HOME}/.config/ModTheSpire | 91 | whitelist ${HOME}/.config/ModTheSpire |
90 | whitelist ${HOME}/.config/RogueLegacy | 92 | whitelist ${HOME}/.config/RogueLegacy |
91 | whitelist ${HOME}/.config/RogueLegacyStorageContainer | 93 | whitelist ${HOME}/.config/RogueLegacyStorageContainer |
@@ -119,7 +121,7 @@ whitelist ${HOME}/.steampid | |||
119 | include whitelist-common.inc | 121 | include whitelist-common.inc |
120 | include whitelist-var-common.inc | 122 | include whitelist-var-common.inc |
121 | 123 | ||
122 | # Note: The following were intentionally left out as they are alternative | 124 | # NOTE: The following were intentionally left out as they are alternative |
123 | # (i.e.: unnecessary and/or legacy) paths whose existence may potentially | 125 | # (i.e.: unnecessary and/or legacy) paths whose existence may potentially |
124 | # clobber other paths (see #4225). If you use any, either add the entry to | 126 | # clobber other paths (see #4225). If you use any, either add the entry to |
125 | # steam.local or move the contents to a path listed above (or open an issue if | 127 | # steam.local or move the contents to a path listed above (or open an issue if |
@@ -131,34 +133,37 @@ caps.drop all | |||
131 | #ipc-namespace | 133 | #ipc-namespace |
132 | netfilter | 134 | netfilter |
133 | nodvd | 135 | nodvd |
134 | # nVidia users may need to comment / ignore nogroups and noroot | ||
135 | nogroups | 136 | nogroups |
136 | nonewprivs | 137 | nonewprivs |
137 | noroot | 138 | noroot |
138 | notv | 139 | notv |
139 | nou2f | 140 | nou2f |
140 | # novideo should be commented for VR | 141 | # For VR support add 'ignore novideo' to your steam.local. |
141 | novideo | 142 | novideo |
142 | protocol unix,inet,inet6,netlink | 143 | protocol unix,inet,inet6,netlink |
143 | # seccomp sometimes causes issues (see #2951, #3267), | 144 | # seccomp sometimes causes issues (see #2951, #3267). |
144 | # comment it or add 'ignore seccomp' to steam.local if so. | 145 | # Add 'ignore seccomp' to your steam.local if you experience this. |
145 | seccomp !ptrace | 146 | seccomp !ptrace |
146 | shell none | 147 | shell none |
147 | # tracelog breaks integrated browser | 148 | # tracelog breaks integrated browser |
148 | #tracelog | 149 | #tracelog |
149 | 150 | ||
150 | # private-bin is disabled while in testing, but has been tested working with multiple games | 151 | # private-bin is disabled while in testing, but is known to work with multiple games. |
151 | #private-bin awk,basename,bash,bsdtar,bzip2,cat,chmod,cksum,cmp,comm,compress,cp,curl,cut,date,dbus-launch,dbus-send,desktop-file-edit,desktop-file-install,desktop-file-validate,dirname,echo,env,expr,file,find,getopt,grep,gtar,gzip,head,hostname,id,lbzip2,ldconfig,ldd,ln,ls,lsb_release,lsof,lspci,lz4,lzip,lzma,lzop,md5sum,mkdir,mktemp,mv,netstat,ps,pulseaudio,python*,readlink,realpath,rm,sed,sh,sha1sum,sha256sum,sha512sum,sleep,sort,steam,steamdeps,steam-native,steam-runtime,sum,tail,tar,tclsh,test,touch,tr,umask,uname,update-desktop-database,wc,wget,which,whoami,xterm,xz,zenity | 152 | # Add the next line to your steam.local to enable private-bin. |
152 | # extra programs are available which might be needed for select games | 153 | #private-bin awk,basename,bash,bsdtar,bzip2,cat,chmod,cksum,cmp,comm,compress,cp,curl,cut,date,dbus-launch,dbus-send,desktop-file-edit,desktop-file-install,desktop-file-validate,dirname,echo,env,expr,file,find,getopt,grep,gtar,gzip,head,hostname,id,lbzip2,ldconfig,ldd,ln,ls,lsb_release,lsof,lspci,lz4,lzip,lzma,lzop,md5sum,mkdir,mktemp,mv,netstat,ps,pulseaudio,python*,readlink,realpath,rm,sed,sh,sha1sum,sha256sum,sha512sum,sleep,sort,steam,steamdeps,steam-native,steam-runtime,sum,tail,tar,tclsh,test,touch,tr,umask,uname,update-desktop-database,wc,wget,wget2,which,whoami,xterm,xz,zenity |
154 | # Extra programs are available which might be needed for select games. | ||
155 | # Add the next line to your steam.local to enable support for these programs. | ||
153 | #private-bin java,java-config,mono | 156 | #private-bin java,java-config,mono |
154 | # picture viewers are needed for viewing screenshots | 157 | # To view screenshots add the next line to your steam.local. |
155 | #private-bin eog,eom,gthumb,pix,viewnior,xviewer | 158 | #private-bin eog,eom,gthumb,pix,viewnior,xviewer |
156 | 159 | ||
157 | private-dev | 160 | private-dev |
158 | # private-etc breaks a small selection of games on some systems, comment to support those | 161 | # private-etc breaks a small selection of games on some systems. Add 'ignore private-etc' |
159 | private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,lsb-release,machine-id,mime.types,nvidia,os-release,passwd,pki,pulse,resolv.conf,services,ssl | 162 | # to your steam.local to support those. |
163 | private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,lsb-release,machine-id,mime.types,nvidia,os-release,passwd,pki,pulse,resolv.conf,services,ssl,vulkan | ||
160 | private-tmp | 164 | private-tmp |
161 | 165 | ||
162 | # breaks appindicator support | ||
163 | # dbus-user none | 166 | # dbus-user none |
164 | # dbus-system none | 167 | # dbus-system none |
168 | |||
169 | read-only ${HOME}/.config/MangoHud | ||
diff --git a/etc/profile-m-z/stellarium.profile b/etc/profile-m-z/stellarium.profile index a752ab53c..d2ebce45f 100644 --- a/etc/profile-m-z/stellarium.profile +++ b/etc/profile-m-z/stellarium.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/straw-viewer.profile b/etc/profile-m-z/straw-viewer.profile index f8108c9d6..513abc21b 100644 --- a/etc/profile-m-z/straw-viewer.profile +++ b/etc/profile-m-z/straw-viewer.profile | |||
@@ -1,7 +1,7 @@ | |||
1 | # Firejail profile for straw-viewer | 1 | # Firejail profile for straw-viewer |
2 | # Description: Fork of youtube-viewer acts like an invidious frontend | 2 | # Description: Fork of youtube-viewer acts like an invidious frontend |
3 | quiet | ||
4 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
5 | # Persistent local customizations | 5 | # Persistent local customizations |
6 | include straw-viewer.local | 6 | include straw-viewer.local |
7 | # Persistent global definitions | 7 | # Persistent global definitions |
@@ -10,55 +10,12 @@ include globals.local | |||
10 | noblacklist ${HOME}/.cache/straw-viewer | 10 | noblacklist ${HOME}/.cache/straw-viewer |
11 | noblacklist ${HOME}/.config/straw-viewer | 11 | noblacklist ${HOME}/.config/straw-viewer |
12 | 12 | ||
13 | # Allow lua (blacklisted by disable-interpreters.inc) | ||
14 | include allow-lua.inc | ||
15 | |||
16 | # Allow perl (blacklisted by disable-interpreters.inc) | ||
17 | include allow-perl.inc | ||
18 | |||
19 | # Allow python (blacklisted by disable-interpreters.inc) | ||
20 | include allow-python2.inc | ||
21 | include allow-python3.inc | ||
22 | |||
23 | include disable-common.inc | ||
24 | include disable-devel.inc | ||
25 | include disable-exec.inc | ||
26 | include disable-interpreters.inc | ||
27 | include disable-passwdmgr.inc | ||
28 | include disable-programs.inc | ||
29 | include disable-xdg.inc | ||
30 | |||
31 | mkdir ${HOME}/.config/straw-viewer | 13 | mkdir ${HOME}/.config/straw-viewer |
32 | mkdir ${HOME}/.cache/straw-viewer | 14 | mkdir ${HOME}/.cache/straw-viewer |
33 | whitelist ${HOME}/.cache/straw-viewer | 15 | whitelist ${HOME}/.cache/straw-viewer |
34 | whitelist ${HOME}/.config/straw-viewer | 16 | whitelist ${HOME}/.config/straw-viewer |
35 | whitelist ${DOWNLOADS} | ||
36 | include whitelist-common.inc | ||
37 | include whitelist-usr-share-common.inc | ||
38 | include whitelist-var-common.inc | ||
39 | |||
40 | apparmor | ||
41 | caps.drop all | ||
42 | netfilter | ||
43 | nodvd | ||
44 | nogroups | ||
45 | noinput | ||
46 | nonewprivs | ||
47 | noroot | ||
48 | notv | ||
49 | nou2f | ||
50 | novideo | ||
51 | protocol unix,inet,inet6 | ||
52 | seccomp | ||
53 | shell none | ||
54 | tracelog | ||
55 | 17 | ||
56 | disable-mnt | 18 | private-bin gtk-straw-viewer,straw-viewer |
57 | private-bin bash,ffmpeg,ffprobe,gtk-straw-viewer,mpv,perl,python*,sh,smplayer,straw-viewer,stty,vlc,wget,which,youtube-dl | ||
58 | private-cache | ||
59 | private-dev | ||
60 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg | ||
61 | private-tmp | ||
62 | 19 | ||
63 | dbus-user none | 20 | # Redirect |
64 | dbus-system none | 21 | include youtube-viewers-common.profile |
diff --git a/etc/profile-m-z/strawberry.profile b/etc/profile-m-z/strawberry.profile index b87906f55..32e43f079 100644 --- a/etc/profile-m-z/strawberry.profile +++ b/etc/profile-m-z/strawberry.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
21 | 20 | ||
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin strawberry,strawberry-tagreader | 43 | private-bin strawberry,strawberry-tagreader |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,nsswitch.conf,pki,resolv.conf,ssl | 46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-system none | 49 | dbus-system none |
diff --git a/etc/profile-m-z/strings.profile b/etc/profile-m-z/strings.profile index 1ebcded7f..9298e6614 100644 --- a/etc/profile-m-z/strings.profile +++ b/etc/profile-m-z/strings.profile | |||
@@ -13,7 +13,6 @@ blacklist ${RUNUSER} | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | #include disable-programs.inc | 16 | #include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | #include disable-xdg.inc | 18 | #include disable-xdg.inc |
diff --git a/etc/profile-m-z/subdownloader.profile b/etc/profile-m-z/subdownloader.profile index bbe92fd38..a9f22085b 100644 --- a/etc/profile-m-z/subdownloader.profile +++ b/etc/profile-m-z/subdownloader.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
@@ -45,7 +44,7 @@ tracelog | |||
45 | 44 | ||
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc alternatives,fonts | 47 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-m-z/supertux2.profile b/etc/profile-m-z/supertux2.profile index dd456f085..464fa1b08 100644 --- a/etc/profile-m-z/supertux2.profile +++ b/etc/profile-m-z/supertux2.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -20,6 +19,7 @@ include disable-xdg.inc | |||
20 | mkdir ${HOME}/.local/share/supertux2 | 19 | mkdir ${HOME}/.local/share/supertux2 |
21 | whitelist ${HOME}/.local/share/supertux2 | 20 | whitelist ${HOME}/.local/share/supertux2 |
22 | whitelist /usr/share/supertux2 | 21 | whitelist /usr/share/supertux2 |
22 | whitelist /usr/share/games/supertux2 # Debian version | ||
23 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | 24 | include whitelist-runuser-common.inc |
25 | include whitelist-usr-share-common.inc | 25 | include whitelist-usr-share-common.inc |
@@ -30,7 +30,6 @@ caps.drop all | |||
30 | net none | 30 | net none |
31 | nodvd | 31 | nodvd |
32 | nogroups | 32 | nogroups |
33 | noinput | ||
34 | nonewprivs | 33 | nonewprivs |
35 | noroot | 34 | noroot |
36 | notv | 35 | notv |
@@ -45,7 +44,7 @@ tracelog | |||
45 | disable-mnt | 44 | disable-mnt |
46 | # private-bin supertux2 | 45 | # private-bin supertux2 |
47 | private-cache | 46 | private-cache |
48 | private-etc machine-id | 47 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
49 | private-dev | 48 | private-dev |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
diff --git a/etc/profile-m-z/supertuxkart.profile b/etc/profile-m-z/supertuxkart.profile index 6a0ed46e0..23c8a6c58 100644 --- a/etc/profile-m-z/supertuxkart.profile +++ b/etc/profile-m-z/supertuxkart.profile | |||
@@ -10,11 +10,12 @@ noblacklist ${HOME}/.config/supertuxkart | |||
10 | noblacklist ${HOME}/.cache/supertuxkart | 10 | noblacklist ${HOME}/.cache/supertuxkart |
11 | noblacklist ${HOME}/.local/share/supertuxkart | 11 | noblacklist ${HOME}/.local/share/supertuxkart |
12 | 12 | ||
13 | blacklist /usr/libexec | ||
14 | |||
13 | include disable-common.inc | 15 | include disable-common.inc |
14 | include disable-devel.inc | 16 | include disable-devel.inc |
15 | include disable-exec.inc | 17 | include disable-exec.inc |
16 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 19 | include disable-programs.inc |
19 | include disable-shell.inc | 20 | include disable-shell.inc |
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
@@ -26,6 +27,7 @@ whitelist ${HOME}/.config/supertuxkart | |||
26 | whitelist ${HOME}/.cache/supertuxkart | 27 | whitelist ${HOME}/.cache/supertuxkart |
27 | whitelist ${HOME}/.local/share/supertuxkart | 28 | whitelist ${HOME}/.local/share/supertuxkart |
28 | whitelist /usr/share/supertuxkart | 29 | whitelist /usr/share/supertuxkart |
30 | whitelist /usr/share/games/supertuxkart # Debian version | ||
29 | include whitelist-common.inc | 31 | include whitelist-common.inc |
30 | include whitelist-runuser-common.inc | 32 | include whitelist-runuser-common.inc |
31 | include whitelist-usr-share-common.inc | 33 | include whitelist-usr-share-common.inc |
@@ -41,7 +43,7 @@ noroot | |||
41 | notv | 43 | notv |
42 | nou2f | 44 | nou2f |
43 | novideo | 45 | novideo |
44 | protocol unix,inet,inet6,bluetooth | 46 | protocol unix,inet,inet6,netlink,bluetooth |
45 | seccomp | 47 | seccomp |
46 | seccomp.block-secondary | 48 | seccomp.block-secondary |
47 | shell none | 49 | shell none |
@@ -52,7 +54,7 @@ private-bin supertuxkart | |||
52 | private-cache | 54 | private-cache |
53 | # Add the next line to your supertuxkart.local if you do not need controller support. | 55 | # Add the next line to your supertuxkart.local if you do not need controller support. |
54 | #private-dev | 56 | #private-dev |
55 | private-etc alternatives,ca-certificates,crypto-policies,drirc,hosts,machine-id,openal,pki,resolv.conf,ssl | 57 | private-etc alternatives,ca-certificates,crypto-policies,drirc,hosts,ld.so.cache,ld.so.preload,machine-id,openal,pki,resolv.conf,ssl |
56 | private-tmp | 58 | private-tmp |
57 | private-opt none | 59 | private-opt none |
58 | private-srv none | 60 | private-srv none |
diff --git a/etc/profile-m-z/surf.profile b/etc/profile-m-z/surf.profile index 8db7d2433..c04f00cab 100644 --- a/etc/profile-m-z/surf.profile +++ b/etc/profile-m-z/surf.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${HOME}/.surf | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | mkdir ${HOME}/.surf | 16 | mkdir ${HOME}/.surf |
@@ -35,6 +34,6 @@ tracelog | |||
35 | disable-mnt | 34 | disable-mnt |
36 | private-bin bash,curl,dmenu,ls,printf,sed,sh,sleep,st,stterm,surf,xargs,xprop | 35 | private-bin bash,curl,dmenu,ls,printf,sed,sh,sleep,st,stterm,surf,xargs,xprop |
37 | private-dev | 36 | private-dev |
38 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,resolv.conf,ssl | 37 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,ld.so.cache,ld.so.preload,machine-id,passwd,pki,resolv.conf,ssl |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
diff --git a/etc/profile-m-z/sushi.profile b/etc/profile-m-z/sushi.profile index 2a15a5d09..621622043 100644 --- a/etc/profile-m-z/sushi.profile +++ b/etc/profile-m-z/sushi.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | # include disable-programs.inc | 16 | # include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/sway.profile b/etc/profile-m-z/sway.profile new file mode 100644 index 000000000..046d1b4be --- /dev/null +++ b/etc/profile-m-z/sway.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for Sway | ||
2 | # Description: i3-compatible Wayland compositor | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include sway.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # all applications started in sway will run in this profile | ||
10 | noblacklist ${HOME}/.config/sway | ||
11 | # sway uses ~/.config/i3 as fallback if there is no ~/.config/sway | ||
12 | noblacklist ${HOME}/.config/i3 | ||
13 | include disable-common.inc | ||
14 | |||
15 | caps.drop all | ||
16 | netfilter | ||
17 | noroot | ||
18 | protocol unix,inet,inet6 | ||
19 | seccomp | ||
diff --git a/etc/profile-m-z/synfigstudio.profile b/etc/profile-m-z/synfigstudio.profile index c60186c42..7f23992a8 100644 --- a/etc/profile-m-z/synfigstudio.profile +++ b/etc/profile-m-z/synfigstudio.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | caps.drop all | 18 | caps.drop all |
diff --git a/etc/profile-m-z/sysprof.profile b/etc/profile-m-z/sysprof.profile index 2473988e4..c7119ae0f 100644 --- a/etc/profile-m-z/sysprof.profile +++ b/etc/profile-m-z/sysprof.profile | |||
@@ -11,12 +11,18 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
17 | 16 | ||
18 | # help menu functionality (yelp) - comment or add this block prepended with 'ignore' | 17 | # Add the next lines to your sysprof.local if you don't need (yelp) help menu functionality. |
19 | # to your sysprof.local if you don't need the help functionality | 18 | #ignore noblacklist ${HOME}/.config/yelp |
19 | #ignore mkdir ${HOME}/.config/yelp | ||
20 | #nowhitelist ${HOME}/.config/yelp | ||
21 | #nowhitelist /usr/share/help/C/sysprof | ||
22 | #nowhitelist /usr/share/yelp | ||
23 | #nowhitelist /usr/share/yelp-tools | ||
24 | #nowhitelist /usr/share/yelp-xsl | ||
25 | |||
20 | noblacklist ${HOME}/.config/yelp | 26 | noblacklist ${HOME}/.config/yelp |
21 | mkdir ${HOME}/.config/yelp | 27 | mkdir ${HOME}/.config/yelp |
22 | whitelist ${HOME}/.config/yelp | 28 | whitelist ${HOME}/.config/yelp |
@@ -41,7 +47,8 @@ nodvd | |||
41 | nogroups | 47 | nogroups |
42 | noinput | 48 | noinput |
43 | nonewprivs | 49 | nonewprivs |
44 | # Ubuntu 16.04 version needs root privileges - comment or put 'ignore noroot' in sysprof.local if you run Xenial | 50 | # Some older Debian/Ubuntu sysprof versions need root privileges. |
51 | # Add 'ignore noroot' to your sysprof.local if you run one of these. | ||
45 | noroot | 52 | noroot |
46 | nosound | 53 | nosound |
47 | notv | 54 | notv |
@@ -56,8 +63,8 @@ disable-mnt | |||
56 | #private-bin sysprof - breaks help menu | 63 | #private-bin sysprof - breaks help menu |
57 | private-cache | 64 | private-cache |
58 | private-dev | 65 | private-dev |
59 | private-etc alternatives,fonts,ld.so.cache,machine-id,ssl | 66 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id,ssl |
60 | # private-lib breaks help menu | 67 | # private-lib - breaks help menu |
61 | #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so | 68 | #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so |
62 | private-tmp | 69 | private-tmp |
63 | 70 | ||
diff --git a/etc/profile-m-z/tar.profile b/etc/profile-m-z/tar.profile index 0d3a900e9..0817adda8 100644 --- a/etc/profile-m-z/tar.profile +++ b/etc/profile-m-z/tar.profile | |||
@@ -14,7 +14,7 @@ ignore include disable-shell.inc | |||
14 | # all capabilities this is automatically read-only. | 14 | # all capabilities this is automatically read-only. |
15 | noblacklist /var/lib/pacman | 15 | noblacklist /var/lib/pacman |
16 | 16 | ||
17 | private-etc alternatives,group,localtime,login.defs,passwd | 17 | private-etc alternatives,group,ld.so.cache,ld.so.preload,localtime,login.defs,passwd |
18 | #private-lib libfakeroot,liblzma.so.*,libreadline.so.* | 18 | #private-lib libfakeroot,liblzma.so.*,libreadline.so.* |
19 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) | 19 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) |
20 | writable-var | 20 | writable-var |
diff --git a/etc/profile-m-z/tcpdump.profile b/etc/profile-m-z/tcpdump.profile index e2ba5893c..57301a54d 100644 --- a/etc/profile-m-z/tcpdump.profile +++ b/etc/profile-m-z/tcpdump.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/teams-for-linux.profile b/etc/profile-m-z/teams-for-linux.profile index eee083332..5711c1b36 100644 --- a/etc/profile-m-z/teams-for-linux.profile +++ b/etc/profile-m-z/teams-for-linux.profile | |||
@@ -11,6 +11,8 @@ ignore include disable-xdg.inc | |||
11 | ignore include whitelist-runuser-common.inc | 11 | ignore include whitelist-runuser-common.inc |
12 | ignore include whitelist-usr-share-common.inc | 12 | ignore include whitelist-usr-share-common.inc |
13 | 13 | ||
14 | ignore noinput | ||
15 | |||
14 | ignore dbus-user none | 16 | ignore dbus-user none |
15 | ignore dbus-system none | 17 | ignore dbus-system none |
16 | 18 | ||
@@ -19,8 +21,8 @@ noblacklist ${HOME}/.config/teams-for-linux | |||
19 | mkdir ${HOME}/.config/teams-for-linux | 21 | mkdir ${HOME}/.config/teams-for-linux |
20 | whitelist ${HOME}/.config/teams-for-linux | 22 | whitelist ${HOME}/.config/teams-for-linux |
21 | 23 | ||
22 | private-bin bash,cut,echo,egrep,grep,head,sed,sh,teams-for-linux,tr,xdg-mime,xdg-open,zsh | 24 | private-bin bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,teams-for-linux,tr,xdg-mime,xdg-open,zsh |
23 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,resolv.conf,ssl | 25 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,resolv.conf,ssl |
24 | 26 | ||
25 | # Redirect | 27 | # Redirect |
26 | include electron.profile | 28 | include electron.profile |
diff --git a/etc/profile-m-z/teams.profile b/etc/profile-m-z/teams.profile index c8d98cbaa..ad52ca45f 100644 --- a/etc/profile-m-z/teams.profile +++ b/etc/profile-m-z/teams.profile | |||
@@ -13,6 +13,8 @@ ignore include whitelist-usr-share-common.inc | |||
13 | ignore novideo | 13 | ignore novideo |
14 | ignore private-tmp | 14 | ignore private-tmp |
15 | 15 | ||
16 | ignore novideo | ||
17 | |||
16 | # see #3404 | 18 | # see #3404 |
17 | ignore apparmor | 19 | ignore apparmor |
18 | ignore dbus-user none | 20 | ignore dbus-user none |
diff --git a/etc/profile-m-z/teamspeak3.profile b/etc/profile-m-z/teamspeak3.profile index 02a2c8ae4..c149473f6 100644 --- a/etc/profile-m-z/teamspeak3.profile +++ b/etc/profile-m-z/teamspeak3.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.ts3client | 18 | mkdir ${HOME}/.ts3client |
diff --git a/etc/profile-m-z/teeworlds.profile b/etc/profile-m-z/teeworlds.profile index be01aee12..d0fb0d43e 100644 --- a/etc/profile-m-z/teeworlds.profile +++ b/etc/profile-m-z/teeworlds.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -27,7 +26,6 @@ ipc-namespace | |||
27 | netfilter | 26 | netfilter |
28 | nodvd | 27 | nodvd |
29 | nogroups | 28 | nogroups |
30 | noinput | ||
31 | nonewprivs | 29 | nonewprivs |
32 | noroot | 30 | noroot |
33 | notv | 31 | notv |
diff --git a/etc/profile-m-z/telegram-desktop.profile b/etc/profile-m-z/telegram-desktop.profile index e0c5aee9e..7463b761f 100644 --- a/etc/profile-m-z/telegram-desktop.profile +++ b/etc/profile-m-z/telegram-desktop.profile | |||
@@ -2,7 +2,7 @@ | |||
2 | # Description: Official Telegram Desktop client | 2 | # Description: Official Telegram Desktop client |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include tekegram-desktop.local | 5 | include telegram-desktop.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
diff --git a/etc/profile-m-z/telegram.profile b/etc/profile-m-z/telegram.profile index 05c621fb2..ce0119078 100644 --- a/etc/profile-m-z/telegram.profile +++ b/etc/profile-m-z/telegram.profile | |||
@@ -8,11 +8,13 @@ include globals.local | |||
8 | noblacklist ${HOME}/.TelegramDesktop | 8 | noblacklist ${HOME}/.TelegramDesktop |
9 | noblacklist ${HOME}/.local/share/TelegramDesktop | 9 | noblacklist ${HOME}/.local/share/TelegramDesktop |
10 | 10 | ||
11 | # Allow opening hyperlinks | ||
12 | include allow-bin-sh.inc | ||
13 | |||
11 | include disable-common.inc | 14 | include disable-common.inc |
12 | include disable-devel.inc | 15 | include disable-devel.inc |
13 | include disable-exec.inc | 16 | include disable-exec.inc |
14 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 18 | include disable-programs.inc |
17 | include disable-shell.inc | 19 | include disable-shell.inc |
18 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -22,6 +24,7 @@ mkdir ${HOME}/.local/share/TelegramDesktop | |||
22 | whitelist ${HOME}/.TelegramDesktop | 24 | whitelist ${HOME}/.TelegramDesktop |
23 | whitelist ${HOME}/.local/share/TelegramDesktop | 25 | whitelist ${HOME}/.local/share/TelegramDesktop |
24 | whitelist ${DOWNLOADS} | 26 | whitelist ${DOWNLOADS} |
27 | whitelist /usr/share/TelegramDesktop | ||
25 | include whitelist-common.inc | 28 | include whitelist-common.inc |
26 | include whitelist-runuser-common.inc | 29 | include whitelist-runuser-common.inc |
27 | include whitelist-usr-share-common.inc | 30 | include whitelist-usr-share-common.inc |
@@ -39,18 +42,18 @@ protocol unix,inet,inet6,netlink | |||
39 | seccomp | 42 | seccomp |
40 | seccomp.block-secondary | 43 | seccomp.block-secondary |
41 | shell none | 44 | shell none |
42 | tracelog | ||
43 | 45 | ||
44 | disable-mnt | 46 | disable-mnt |
45 | #private-bin telegram,Telegram,telegram-desktop | 47 | private-bin bash,sh,telegram,Telegram,telegram-desktop,xdg-open |
46 | private-cache | 48 | private-cache |
47 | private-dev | 49 | private-dev |
48 | private-etc alsa,alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,machine-id,os-release,passwd,pki,pulse,resolv.conf,ssl,xdg | 50 | private-etc alsa,alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,machine-id,os-release,passwd,pki,pulse,resolv.conf,ssl,xdg |
49 | private-tmp | 51 | private-tmp |
50 | 52 | ||
51 | dbus-user filter | 53 | dbus-user filter |
54 | dbus-user.own org.telegram.desktop.* | ||
52 | dbus-user.talk org.freedesktop.Notifications | 55 | dbus-user.talk org.freedesktop.Notifications |
53 | dbus-user.talk org.kde.StatusNotifierWatcher | 56 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher |
54 | dbus-user.talk org.gnome.Mutter.IdleMonitor | 57 | dbus-user.talk org.gnome.Mutter.IdleMonitor |
55 | dbus-user.talk org.freedesktop.ScreenSaver | 58 | dbus-user.talk org.freedesktop.ScreenSaver |
56 | dbus-system none | 59 | dbus-system none |
diff --git a/etc/profile-m-z/telnet.profile b/etc/profile-m-z/telnet.profile new file mode 100644 index 000000000..ea91364ab --- /dev/null +++ b/etc/profile-m-z/telnet.profile | |||
@@ -0,0 +1,54 @@ | |||
1 | # Firejail profile for telnet | ||
2 | # Description: standard telnet client | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include telnet.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | noblacklist ${PATH}/telnet | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-proc.inc | ||
17 | include disable-programs.inc | ||
18 | #include disable-shell.inc | ||
19 | include disable-write-mnt.inc | ||
20 | include disable-X11.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | ipc-namespace | ||
26 | machine-id | ||
27 | netfilter | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | noinput | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | nosound | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol inet,inet6 | ||
39 | seccomp | ||
40 | shell none | ||
41 | tracelog | ||
42 | |||
43 | #disable-mnt | ||
44 | #private-bin PROGRAMS | ||
45 | private-cache | ||
46 | private-dev | ||
47 | #private-etc FILES | ||
48 | private-tmp | ||
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
53 | memory-deny-write-execute | ||
54 | noexec ${HOME} | ||
diff --git a/etc/profile-m-z/terasology.profile b/etc/profile-m-z/terasology.profile index ce2ca1d17..0f6691b49 100644 --- a/etc/profile-m-z/terasology.profile +++ b/etc/profile-m-z/terasology.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | mkdir ${HOME}/.java | 21 | mkdir ${HOME}/.java |
diff --git a/etc/profile-m-z/thunderbird.profile b/etc/profile-m-z/thunderbird.profile index b478fbe1e..1ac80bc9a 100644 --- a/etc/profile-m-z/thunderbird.profile +++ b/etc/profile-m-z/thunderbird.profile | |||
@@ -31,7 +31,6 @@ noblacklist ${HOME}/.gnupg | |||
31 | # noblacklist ${HOME}/.icedove | 31 | # noblacklist ${HOME}/.icedove |
32 | noblacklist ${HOME}/.thunderbird | 32 | noblacklist ${HOME}/.thunderbird |
33 | 33 | ||
34 | include disable-passwdmgr.inc | ||
35 | include disable-xdg.inc | 34 | include disable-xdg.inc |
36 | 35 | ||
37 | # If you have setup Thunderbird to archive emails to a local folder, | 36 | # If you have setup Thunderbird to archive emails to a local folder, |
@@ -48,6 +47,7 @@ whitelist ${HOME}/.gnupg | |||
48 | whitelist ${HOME}/.thunderbird | 47 | whitelist ${HOME}/.thunderbird |
49 | 48 | ||
50 | whitelist /usr/share/gnupg | 49 | whitelist /usr/share/gnupg |
50 | whitelist /usr/share/gnupg2 | ||
51 | whitelist /usr/share/mozilla | 51 | whitelist /usr/share/mozilla |
52 | whitelist /usr/share/thunderbird | 52 | whitelist /usr/share/thunderbird |
53 | whitelist /usr/share/webext | 53 | whitelist /usr/share/webext |
diff --git a/etc/profile-m-z/tilp.profile b/etc/profile-m-z/tilp.profile index dd4a372c4..d2db44b1c 100644 --- a/etc/profile-m-z/tilp.profile +++ b/etc/profile-m-z/tilp.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | 16 | ||
@@ -31,6 +30,6 @@ tracelog | |||
31 | disable-mnt | 30 | disable-mnt |
32 | private-bin tilp | 31 | private-bin tilp |
33 | private-cache | 32 | private-cache |
34 | private-etc alternatives,fonts | 33 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
35 | private-tmp | 34 | private-tmp |
36 | 35 | ||
diff --git a/etc/profile-m-z/tin.profile b/etc/profile-m-z/tin.profile new file mode 100644 index 000000000..1d4ee9370 --- /dev/null +++ b/etc/profile-m-z/tin.profile | |||
@@ -0,0 +1,68 @@ | |||
1 | # Firejail profile for tin | ||
2 | # Description: ncurses-based Usenet newsreader | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include tin.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.newsrc | ||
10 | noblacklist ${HOME}/.tin | ||
11 | |||
12 | blacklist /tmp/.X11-unix | ||
13 | blacklist ${RUNUSER} | ||
14 | blacklist /usr/libexec | ||
15 | |||
16 | include disable-common.inc | ||
17 | include disable-devel.inc | ||
18 | include disable-exec.inc | ||
19 | include disable-interpreters.inc | ||
20 | include disable-programs.inc | ||
21 | include disable-shell.inc | ||
22 | include disable-xdg.inc | ||
23 | |||
24 | mkdir ${HOME}/.tin | ||
25 | mkfile ${HOME}/.newsrc | ||
26 | # Note: files/directories directly in ${HOME} can't be whitelisted, as | ||
27 | # tin saves .newsrc by renaming a temporary file, which is not possible for | ||
28 | # bind-mounted files. | ||
29 | #whitelist ${HOME}/.newsrc | ||
30 | #whitelist ${HOME}/.tin | ||
31 | #include whitelist-common.inc | ||
32 | include whitelist-runuser-common.inc | ||
33 | include whitelist-usr-share-common.inc | ||
34 | include whitelist-var-common.inc | ||
35 | |||
36 | apparmor | ||
37 | caps.drop all | ||
38 | ipc-namespace | ||
39 | machine-id | ||
40 | netfilter | ||
41 | no3d | ||
42 | nodvd | ||
43 | nogroups | ||
44 | noinput | ||
45 | nonewprivs | ||
46 | noroot | ||
47 | nosound | ||
48 | notv | ||
49 | nou2f | ||
50 | novideo | ||
51 | protocol inet,inet6 | ||
52 | seccomp | ||
53 | seccomp.block-secondary | ||
54 | shell none | ||
55 | tracelog | ||
56 | |||
57 | disable-mnt | ||
58 | private-bin rtin,tin | ||
59 | private-cache | ||
60 | private-dev | ||
61 | private-etc alternatives,ld.so.cache,ld.so.preload,passwd,resolv.conf,terminfo,tin | ||
62 | private-lib terminfo | ||
63 | private-tmp | ||
64 | |||
65 | dbus-user none | ||
66 | dbus-system none | ||
67 | |||
68 | memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/tmux.profile b/etc/profile-m-z/tmux.profile index 0139d7515..1e783d2b9 100644 --- a/etc/profile-m-z/tmux.profile +++ b/etc/profile-m-z/tmux.profile | |||
@@ -15,7 +15,6 @@ noblacklist /tmp/tmux-* | |||
15 | # include disable-common.inc | 15 | # include disable-common.inc |
16 | # include disable-devel.inc | 16 | # include disable-devel.inc |
17 | # include disable-exec.inc | 17 | # include disable-exec.inc |
18 | include disable-passwdmgr.inc | ||
19 | # include disable-programs.inc | 18 | # include disable-programs.inc |
20 | 19 | ||
21 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/profile-m-z/tor-browser.profile b/etc/profile-m-z/tor-browser.profile index 76a0e1fa5..13f422b0a 100644 --- a/etc/profile-m-z/tor-browser.profile +++ b/etc/profile-m-z/tor-browser.profile | |||
@@ -7,9 +7,12 @@ include tor-browser.local | |||
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.tor-browser | 9 | noblacklist ${HOME}/.tor-browser |
10 | noblacklist ${HOME}/.local/opt/tor-browser | ||
10 | 11 | ||
11 | mkdir ${HOME}/.tor-browser | 12 | mkdir ${HOME}/.tor-browser |
12 | whitelist ${HOME}/.tor-browser | 13 | whitelist ${HOME}/.tor-browser |
14 | mkdir ${HOME}/.local/opt/tor-browser | ||
15 | whitelist ${HOME}/.local/opt/tor-browser | ||
13 | 16 | ||
14 | # Redirect | 17 | # Redirect |
15 | include torbrowser-launcher.profile | 18 | include torbrowser-launcher.profile |
diff --git a/etc/profile-m-z/tor.profile b/etc/profile-m-z/tor.profile index 73ef290f4..d8cd8eb44 100644 --- a/etc/profile-m-z/tor.profile +++ b/etc/profile-m-z/tor.profile | |||
@@ -21,7 +21,6 @@ include disable-common.inc | |||
21 | include disable-devel.inc | 21 | include disable-devel.inc |
22 | include disable-exec.inc | 22 | include disable-exec.inc |
23 | include disable-interpreters.inc | 23 | include disable-interpreters.inc |
24 | include disable-passwdmgr.inc | ||
25 | include disable-programs.inc | 24 | include disable-programs.inc |
26 | include disable-xdg.inc | 25 | include disable-xdg.inc |
27 | 26 | ||
@@ -47,6 +46,6 @@ private | |||
47 | private-bin bash,tor | 46 | private-bin bash,tor |
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | private-etc alternatives,ca-certificates,crypto-policies,passwd,pki,ssl,tor | 49 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,passwd,pki,ssl,tor |
51 | private-tmp | 50 | private-tmp |
52 | writable-var | 51 | writable-var |
diff --git a/etc/profile-m-z/torbrowser-launcher.profile b/etc/profile-m-z/torbrowser-launcher.profile index 7659ed1e9..469e99d02 100644 --- a/etc/profile-m-z/torbrowser-launcher.profile +++ b/etc/profile-m-z/torbrowser-launcher.profile | |||
@@ -15,14 +15,12 @@ noblacklist ${HOME}/.local/share/torbrowser | |||
15 | include allow-python2.inc | 15 | include allow-python2.inc |
16 | include allow-python3.inc | 16 | include allow-python3.inc |
17 | 17 | ||
18 | blacklist /opt | ||
19 | blacklist /srv | 18 | blacklist /srv |
20 | 19 | ||
21 | include disable-common.inc | 20 | include disable-common.inc |
22 | include disable-devel.inc | 21 | include disable-devel.inc |
23 | include disable-exec.inc | 22 | include disable-exec.inc |
24 | include disable-interpreters.inc | 23 | include disable-interpreters.inc |
25 | include disable-passwdmgr.inc | ||
26 | include disable-programs.inc | 24 | include disable-programs.inc |
27 | include disable-xdg.inc | 25 | include disable-xdg.inc |
28 | 26 | ||
@@ -31,6 +29,7 @@ mkdir ${HOME}/.local/share/torbrowser | |||
31 | whitelist ${DOWNLOADS} | 29 | whitelist ${DOWNLOADS} |
32 | whitelist ${HOME}/.config/torbrowser | 30 | whitelist ${HOME}/.config/torbrowser |
33 | whitelist ${HOME}/.local/share/torbrowser | 31 | whitelist ${HOME}/.local/share/torbrowser |
32 | whitelist /opt/tor-browser | ||
34 | whitelist /usr/share/torbrowser-launcher | 33 | whitelist /usr/share/torbrowser-launcher |
35 | include whitelist-common.inc | 34 | include whitelist-common.inc |
36 | include whitelist-var-common.inc | 35 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/torbrowser.profile b/etc/profile-m-z/torbrowser.profile new file mode 100644 index 000000000..fc579b973 --- /dev/null +++ b/etc/profile-m-z/torbrowser.profile | |||
@@ -0,0 +1,26 @@ | |||
1 | # Firejail profile for torbrowser | ||
2 | # Description: This profile was tested with www-client/torbrowser::torbrowser | ||
3 | # on Gentoo Linux. | ||
4 | # This file is overwritten after every install/update | ||
5 | # Persistent local customizations | ||
6 | include torbrowser.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | ignore dbus-user none | ||
11 | |||
12 | noblacklist ${HOME}/.cache/mozilla | ||
13 | noblacklist ${HOME}/.mozilla | ||
14 | |||
15 | blacklist /usr/libexec | ||
16 | |||
17 | mkdir ${HOME}/.cache/mozilla/torbrowser | ||
18 | mkdir ${HOME}/.mozilla | ||
19 | whitelist ${HOME}/.cache/mozilla/torbrowser | ||
20 | whitelist ${HOME}/.mozilla | ||
21 | include whitelist-usr-share-common.inc | ||
22 | |||
23 | dbus-user filter | ||
24 | dbus-user.own org.mozilla.torbrowser.* | ||
25 | |||
26 | include firefox-common.profile | ||
diff --git a/etc/profile-m-z/torcs.profile b/etc/profile-m-z/torcs.profile index 0f98a8f64..19e586db4 100644 --- a/etc/profile-m-z/torcs.profile +++ b/etc/profile-m-z/torcs.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
@@ -29,7 +28,6 @@ ipc-namespace | |||
29 | net none | 28 | net none |
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | noinput | ||
33 | nonewprivs | 31 | nonewprivs |
34 | noroot | 32 | noroot |
35 | notv | 33 | notv |
diff --git a/etc/profile-m-z/totem.profile b/etc/profile-m-z/totem.profile index 70d9e0aee..dac753fd1 100644 --- a/etc/profile-m-z/totem.profile +++ b/etc/profile-m-z/totem.profile | |||
@@ -20,7 +20,6 @@ include disable-common.inc | |||
20 | include disable-devel.inc | 20 | include disable-devel.inc |
21 | include disable-exec.inc | 21 | include disable-exec.inc |
22 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | 23 | include disable-programs.inc |
25 | include disable-shell.inc | 24 | include disable-shell.inc |
26 | 25 | ||
diff --git a/etc/profile-m-z/tracker.profile b/etc/profile-m-z/tracker.profile index 87c5de076..ba44224f9 100644 --- a/etc/profile-m-z/tracker.profile +++ b/etc/profile-m-z/tracker.profile | |||
@@ -14,7 +14,6 @@ blacklist ${RUNUSER}/wayland-* | |||
14 | include disable-common.inc | 14 | include disable-common.inc |
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/transgui.profile b/etc/profile-m-z/transgui.profile index ea118a9f0..4acb8e7e8 100644 --- a/etc/profile-m-z/transgui.profile +++ b/etc/profile-m-z/transgui.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ tracelog | |||
46 | private-bin geoiplookup,geoiplookup6,transgui | 45 | private-bin geoiplookup,geoiplookup6,transgui |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
50 | private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.* | 49 | private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.* |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
diff --git a/etc/profile-m-z/transmission-cli.profile b/etc/profile-m-z/transmission-cli.profile index 486be5fe6..8a1711e97 100644 --- a/etc/profile-m-z/transmission-cli.profile +++ b/etc/profile-m-z/transmission-cli.profile | |||
@@ -8,7 +8,7 @@ include transmission-cli.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | private-bin transmission-cli | 10 | private-bin transmission-cli |
11 | private-etc alternatives,ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl | 11 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
12 | 12 | ||
13 | # Redirect | 13 | # Redirect |
14 | include transmission-common.profile | 14 | include transmission-common.profile |
diff --git a/etc/profile-m-z/transmission-common.profile b/etc/profile-m-z/transmission-common.profile index 82671b709..9d9b8cc2c 100644 --- a/etc/profile-m-z/transmission-common.profile +++ b/etc/profile-m-z/transmission-common.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | mkdir ${HOME}/.cache/transmission | 19 | mkdir ${HOME}/.cache/transmission |
diff --git a/etc/profile-m-z/transmission-daemon.profile b/etc/profile-m-z/transmission-daemon.profile index 348d3cb80..5d28f2f10 100644 --- a/etc/profile-m-z/transmission-daemon.profile +++ b/etc/profile-m-z/transmission-daemon.profile | |||
@@ -17,7 +17,7 @@ caps.keep ipc_lock,net_bind_service,setgid,setuid,sys_chroot | |||
17 | protocol packet | 17 | protocol packet |
18 | 18 | ||
19 | private-bin transmission-daemon | 19 | private-bin transmission-daemon |
20 | private-etc alternatives,ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl | 20 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
21 | 21 | ||
22 | read-write /var/lib/transmission | 22 | read-write /var/lib/transmission |
23 | writable-var-log | 23 | writable-var-log |
diff --git a/etc/profile-m-z/transmission-remote-gtk.profile b/etc/profile-m-z/transmission-remote-gtk.profile index a6400e2c0..6a0f1bde3 100644 --- a/etc/profile-m-z/transmission-remote-gtk.profile +++ b/etc/profile-m-z/transmission-remote-gtk.profile | |||
@@ -12,7 +12,7 @@ noblacklist ${HOME}/.config/transmission-remote-gtk | |||
12 | mkdir ${HOME}/.config/transmission-remote-gtk | 12 | mkdir ${HOME}/.config/transmission-remote-gtk |
13 | whitelist ${HOME}/.config/transmission-remote-gtk | 13 | whitelist ${HOME}/.config/transmission-remote-gtk |
14 | 14 | ||
15 | private-etc fonts,hostname,hosts,resolv.conf | 15 | private-etc alternatives,fonts,hostname,hosts,ld.so.cache,ld.so.preload,resolv.conf |
16 | # Problems with private-lib (see issue #2889) | 16 | # Problems with private-lib (see issue #2889) |
17 | ignore private-lib | 17 | ignore private-lib |
18 | 18 | ||
diff --git a/etc/profile-m-z/transmission-remote.profile b/etc/profile-m-z/transmission-remote.profile index fee4999e6..565433d99 100644 --- a/etc/profile-m-z/transmission-remote.profile +++ b/etc/profile-m-z/transmission-remote.profile | |||
@@ -8,7 +8,7 @@ include transmission-remote.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | private-bin transmission-remote | 10 | private-bin transmission-remote |
11 | private-etc alternatives,hosts,nsswitch.conf | 11 | private-etc alternatives,hosts,ld.so.cache,ld.so.preload,nsswitch.conf |
12 | 12 | ||
13 | # Redirect | 13 | # Redirect |
14 | include transmission-common.profile | 14 | include transmission-common.profile |
diff --git a/etc/profile-m-z/transmission-show.profile b/etc/profile-m-z/transmission-show.profile index 5a3c83f58..0a5826ec4 100644 --- a/etc/profile-m-z/transmission-show.profile +++ b/etc/profile-m-z/transmission-show.profile | |||
@@ -8,7 +8,7 @@ include transmission-show.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | private-bin transmission-show | 10 | private-bin transmission-show |
11 | private-etc alternatives,hosts,nsswitch.conf | 11 | private-etc alternatives,hosts,ld.so.cache,ld.so.preload,nsswitch.conf |
12 | 12 | ||
13 | # Redirect | 13 | # Redirect |
14 | include transmission-common.profile | 14 | include transmission-common.profile |
diff --git a/etc/profile-m-z/tremulous.profile b/etc/profile-m-z/tremulous.profile index aba563fac..96541ae25 100644 --- a/etc/profile-m-z/tremulous.profile +++ b/etc/profile-m-z/tremulous.profile | |||
@@ -8,11 +8,13 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.tremulous | 9 | noblacklist ${HOME}/.tremulous |
10 | 10 | ||
11 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
12 | include allow-bin-sh.inc | ||
13 | |||
11 | include disable-common.inc | 14 | include disable-common.inc |
12 | include disable-devel.inc | 15 | include disable-devel.inc |
13 | include disable-exec.inc | 16 | include disable-exec.inc |
14 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 18 | include disable-programs.inc |
17 | include disable-shell.inc | 19 | include disable-shell.inc |
18 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -42,7 +44,7 @@ shell none | |||
42 | tracelog | 44 | tracelog |
43 | 45 | ||
44 | disable-mnt | 46 | disable-mnt |
45 | private-bin tremded,tremulous,tremulous-wrapper | 47 | private-bin env,sh,tremded,tremulous,tremulous-wrapper |
46 | private-cache | 48 | private-cache |
47 | private-dev | 49 | private-dev |
48 | private-tmp | 50 | private-tmp |
diff --git a/etc/profile-m-z/trojita.profile b/etc/profile-m-z/trojita.profile index 2d95081f6..60a192ac1 100644 --- a/etc/profile-m-z/trojita.profile +++ b/etc/profile-m-z/trojita.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -55,7 +54,7 @@ tracelog | |||
55 | private-bin trojita | 54 | private-bin trojita |
56 | private-cache | 55 | private-cache |
57 | private-dev | 56 | private-dev |
58 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg | 57 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.preload,pki,resolv.conf,selinux,ssl,xdg |
59 | private-tmp | 58 | private-tmp |
60 | 59 | ||
61 | dbus-user filter | 60 | dbus-user filter |
diff --git a/etc/profile-m-z/truecraft.profile b/etc/profile-m-z/truecraft.profile index 749626475..503e1ae64 100644 --- a/etc/profile-m-z/truecraft.profile +++ b/etc/profile-m-z/truecraft.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | mkdir ${HOME}/.config/mono | 17 | mkdir ${HOME}/.config/mono |
diff --git a/etc/profile-m-z/tuxguitar.profile b/etc/profile-m-z/tuxguitar.profile index d0bcbe79f..807d43281 100644 --- a/etc/profile-m-z/tuxguitar.profile +++ b/etc/profile-m-z/tuxguitar.profile | |||
@@ -6,6 +6,9 @@ include tuxguitar.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # tuxguitar fails to launch | ||
10 | ignore noexec ${HOME} | ||
11 | |||
9 | noblacklist ${HOME}/.tuxguitar* | 12 | noblacklist ${HOME}/.tuxguitar* |
10 | noblacklist ${DOCUMENTS} | 13 | noblacklist ${DOCUMENTS} |
11 | noblacklist ${MUSIC} | 14 | noblacklist ${MUSIC} |
@@ -17,7 +20,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 20 | include disable-devel.inc |
18 | include disable-exec.inc | 21 | include disable-exec.inc |
19 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 23 | include disable-programs.inc |
22 | include disable-xdg.inc | 24 | include disable-xdg.inc |
23 | 25 | ||
@@ -41,6 +43,3 @@ tracelog | |||
41 | 43 | ||
42 | private-dev | 44 | private-dev |
43 | private-tmp | 45 | private-tmp |
44 | |||
45 | # noexec ${HOME} - tuxguitar may fail to launch | ||
46 | noexec /tmp | ||
diff --git a/etc/profile-m-z/tvbrowser.profile b/etc/profile-m-z/tvbrowser.profile index dae7d86da..8a18519ac 100644 --- a/etc/profile-m-z/tvbrowser.profile +++ b/etc/profile-m-z/tvbrowser.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-m-z/twitch.profile b/etc/profile-m-z/twitch.profile index 2f573c872..987a2b719 100644 --- a/etc/profile-m-z/twitch.profile +++ b/etc/profile-m-z/twitch.profile | |||
@@ -17,8 +17,8 @@ include disable-shell.inc | |||
17 | mkdir ${HOME}/.config/Twitch | 17 | mkdir ${HOME}/.config/Twitch |
18 | whitelist ${HOME}/.config/Twitch | 18 | whitelist ${HOME}/.config/Twitch |
19 | 19 | ||
20 | private-bin twitch | 20 | private-bin electron,electron[0-9],electron[0-9][0-9],twitch |
21 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 21 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
22 | private-opt Twitch | 22 | private-opt Twitch |
23 | 23 | ||
24 | # Redirect | 24 | # Redirect |
diff --git a/etc/profile-m-z/udiskie.profile b/etc/profile-m-z/udiskie.profile index 601b818c2..02f05af16 100644 --- a/etc/profile-m-z/udiskie.profile +++ b/etc/profile-m-z/udiskie.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/uefitool.profile b/etc/profile-m-z/uefitool.profile index 3e4fdbb03..2e5630f3d 100644 --- a/etc/profile-m-z/uefitool.profile +++ b/etc/profile-m-z/uefitool.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
17 | 16 | ||
diff --git a/etc/profile-m-z/unbound.profile b/etc/profile-m-z/unbound.profile index 0c077babf..e8424cd7d 100644 --- a/etc/profile-m-z/unbound.profile +++ b/etc/profile-m-z/unbound.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
22 | 21 | ||
diff --git a/etc/profile-m-z/unf.profile b/etc/profile-m-z/unf.profile index 6db7ba362..1b82ad881 100644 --- a/etc/profile-m-z/unf.profile +++ b/etc/profile-m-z/unf.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ private-bin unf | |||
50 | private-cache | 49 | private-cache |
51 | ?HAS_APPIMAGE: ignore private-dev | 50 | ?HAS_APPIMAGE: ignore private-dev |
52 | private-dev | 51 | private-dev |
53 | private-etc alternatives | 52 | private-etc alternatives,ld.so.cache,ld.so.preload |
54 | private-lib gcc/*/*/libgcc_s.so.* | 53 | private-lib gcc/*/*/libgcc_s.so.* |
55 | private-tmp | 54 | private-tmp |
56 | 55 | ||
diff --git a/etc/profile-m-z/unknown-horizons.profile b/etc/profile-m-z/unknown-horizons.profile index 956492f52..b8f4dc431 100644 --- a/etc/profile-m-z/unknown-horizons.profile +++ b/etc/profile-m-z/unknown-horizons.profile | |||
@@ -10,7 +10,6 @@ noblacklist ${HOME}/.unknown-horizons | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | 14 | ||
16 | mkdir ${HOME}/.unknown-horizons | 15 | mkdir ${HOME}/.unknown-horizons |
diff --git a/etc/profile-m-z/unrar.profile b/etc/profile-m-z/unrar.profile index 9d3d9b40e..443d1f415 100644 --- a/etc/profile-m-z/unrar.profile +++ b/etc/profile-m-z/unrar.profile | |||
@@ -8,7 +8,7 @@ include unrar.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | private-bin unrar | 10 | private-bin unrar |
11 | private-etc alternatives,group,localtime,passwd | 11 | private-etc alternatives,group,ld.so.cache,ld.so.preload,localtime,passwd |
12 | private-tmp | 12 | private-tmp |
13 | 13 | ||
14 | # Redirect | 14 | # Redirect |
diff --git a/etc/profile-m-z/unzip.profile b/etc/profile-m-z/unzip.profile index 0231e3dba..97df693ba 100644 --- a/etc/profile-m-z/unzip.profile +++ b/etc/profile-m-z/unzip.profile | |||
@@ -10,7 +10,7 @@ include globals.local | |||
10 | # GNOME Shell integration (chrome-gnome-shell) | 10 | # GNOME Shell integration (chrome-gnome-shell) |
11 | noblacklist ${HOME}/.local/share/gnome-shell | 11 | noblacklist ${HOME}/.local/share/gnome-shell |
12 | 12 | ||
13 | private-etc alternatives,group,localtime,passwd | 13 | private-etc alternatives,group,ld.so.cache,ld.so.preload,localtime,passwd |
14 | 14 | ||
15 | # Redirect | 15 | # Redirect |
16 | include archiver-common.profile | 16 | include archiver-common.profile |
diff --git a/etc/profile-m-z/utox.profile b/etc/profile-m-z/utox.profile index dd881f091..5a867a683 100644 --- a/etc/profile-m-z/utox.profile +++ b/etc/profile-m-z/utox.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ disable-mnt | |||
44 | private-bin utox | 43 | private-bin utox |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,openal,pki,pulse,resolv.conf,ssl | 46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,localtime,machine-id,openal,pki,pulse,resolv.conf,ssl |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | memory-deny-write-execute | 49 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/uudeview.profile b/etc/profile-m-z/uudeview.profile index 2adc044e5..426766e17 100644 --- a/etc/profile-m-z/uudeview.profile +++ b/etc/profile-m-z/uudeview.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | 18 | ||
@@ -42,7 +41,7 @@ x11 none | |||
42 | private-bin uudeview | 41 | private-bin uudeview |
43 | private-cache | 42 | private-cache |
44 | private-dev | 43 | private-dev |
45 | private-etc alternatives,ld.so.preload | 44 | private-etc alternatives,ld.so.cache,ld.so.preload |
46 | 45 | ||
47 | dbus-user none | 46 | dbus-user none |
48 | dbus-system none | 47 | dbus-system none |
diff --git a/etc/profile-m-z/uzbl-browser.profile b/etc/profile-m-z/uzbl-browser.profile index 41487a8f2..dcdae279f 100644 --- a/etc/profile-m-z/uzbl-browser.profile +++ b/etc/profile-m-z/uzbl-browser.profile | |||
@@ -8,6 +8,7 @@ include globals.local | |||
8 | noblacklist ${HOME}/.config/uzbl | 8 | noblacklist ${HOME}/.config/uzbl |
9 | noblacklist ${HOME}/.gnupg | 9 | noblacklist ${HOME}/.gnupg |
10 | noblacklist ${HOME}/.local/share/uzbl | 10 | noblacklist ${HOME}/.local/share/uzbl |
11 | noblacklist ${HOME}/.password-store | ||
11 | 12 | ||
12 | # Allow python (blacklisted by disable-interpreters.inc) | 13 | # Allow python (blacklisted by disable-interpreters.inc) |
13 | include allow-python2.inc | 14 | include allow-python2.inc |
diff --git a/etc/profile-m-z/viewnior.profile b/etc/profile-m-z/viewnior.profile index a9ba344dd..585a8eddb 100644 --- a/etc/profile-m-z/viewnior.profile +++ b/etc/profile-m-z/viewnior.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | include disable-shell.inc | 20 | include disable-shell.inc |
22 | 21 | ||
@@ -44,7 +43,7 @@ tracelog | |||
44 | private-bin viewnior | 43 | private-bin viewnior |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,fonts,machine-id | 46 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
50 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/viking.profile b/etc/profile-m-z/viking.profile index 8f8ef5939..fd15228cf 100644 --- a/etc/profile-m-z/viking.profile +++ b/etc/profile-m-z/viking.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/vim.profile b/etc/profile-m-z/vim.profile index c3cfe5980..a6e05a32a 100644 --- a/etc/profile-m-z/vim.profile +++ b/etc/profile-m-z/vim.profile | |||
@@ -14,7 +14,6 @@ noblacklist ${HOME}/.vimrc | |||
14 | include allow-common-devel.inc | 14 | include allow-common-devel.inc |
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | include whitelist-runuser-common.inc | 19 | include whitelist-runuser-common.inc |
diff --git a/etc/profile-m-z/virtualbox.profile b/etc/profile-m-z/virtualbox.profile index c22fb0ff9..227ad83cc 100644 --- a/etc/profile-m-z/virtualbox.profile +++ b/etc/profile-m-z/virtualbox.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
@@ -46,7 +45,7 @@ tracelog | |||
46 | #disable-mnt | 45 | #disable-mnt |
47 | #private-bin awk,basename,bash,env,gawk,grep,ps,readlink,sh,virtualbox,VirtualBox,VBox*,vbox*,whoami | 46 | #private-bin awk,basename,bash,env,gawk,grep,ps,readlink,sh,virtualbox,VirtualBox,VBox*,vbox*,whoami |
48 | private-cache | 47 | private-cache |
49 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl | 48 | private-etc alsa,alternatives,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,pulse,resolv.conf,ssl |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-m-z/vlc.profile b/etc/profile-m-z/vlc.profile index cd7dccd8a..68db032aa 100644 --- a/etc/profile-m-z/vlc.profile +++ b/etc/profile-m-z/vlc.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | read-only ${DESKTOP} | 20 | read-only ${DESKTOP} |
diff --git a/etc/profile-m-z/vmware-view.profile b/etc/profile-m-z/vmware-view.profile index f07c31b68..278a66149 100644 --- a/etc/profile-m-z/vmware-view.profile +++ b/etc/profile-m-z/vmware-view.profile | |||
@@ -7,6 +7,7 @@ include vmware-view.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.vmware | 9 | noblacklist ${HOME}/.vmware |
10 | noblacklist /usr/lib/vmware | ||
10 | 11 | ||
11 | noblacklist /sbin | 12 | noblacklist /sbin |
12 | noblacklist /usr/sbin | 13 | noblacklist /usr/sbin |
@@ -17,7 +18,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 18 | include disable-devel.inc |
18 | include disable-exec.inc | 19 | include disable-exec.inc |
19 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | 22 | include disable-shell.inc |
23 | include disable-xdg.inc | 23 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/vmware.profile b/etc/profile-m-z/vmware.profile index 5241e27b3..57fbbae96 100644 --- a/etc/profile-m-z/vmware.profile +++ b/etc/profile-m-z/vmware.profile | |||
@@ -8,12 +8,12 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.cache/vmware | 9 | noblacklist ${HOME}/.cache/vmware |
10 | noblacklist ${HOME}/.vmware | 10 | noblacklist ${HOME}/.vmware |
11 | noblacklist /usr/lib/vmware | ||
11 | 12 | ||
12 | include disable-common.inc | 13 | include disable-common.inc |
13 | include disable-devel.inc | 14 | include disable-devel.inc |
14 | include disable-exec.inc | 15 | include disable-exec.inc |
15 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-xdg.inc | 18 | include disable-xdg.inc |
19 | 19 | ||
@@ -39,6 +39,6 @@ tracelog | |||
39 | #disable-mnt | 39 | #disable-mnt |
40 | # Add the next line to your vmware.local to enable private-bin. | 40 | # Add the next line to your vmware.local to enable private-bin. |
41 | #private-bin env,bash,sh,ovftool,vmafossexec,vmaf_*,vmnet-*,vmplayer,vmrest,vmrun,vmss2core,vmstat,vmware,vmware-* | 41 | #private-bin env,bash,sh,ovftool,vmafossexec,vmaf_*,vmnet-*,vmplayer,vmrest,vmrun,vmss2core,vmstat,vmware,vmware-* |
42 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl,vmware,vmware-installer,vmware-vix | 42 | private-etc alsa,alternatives,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl,vmware,vmware-installer,vmware-vix |
43 | dbus-user none | 43 | dbus-user none |
44 | dbus-system none | 44 | dbus-system none |
diff --git a/etc/profile-m-z/vscodium.profile b/etc/profile-m-z/vscodium.profile index a4a4fb7d8..9c0a887b2 100644 --- a/etc/profile-m-z/vscodium.profile +++ b/etc/profile-m-z/vscodium.profile | |||
@@ -1,4 +1,4 @@ | |||
1 | # Firejail profile alias for Visual Studio Code | 1 | # Firejail profile alias for VSCodium |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | # Persistent local customizations | 3 | # Persistent local customizations |
4 | include vscodium.local | 4 | include vscodium.local |
@@ -7,6 +7,8 @@ include vscodium.local | |||
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.VSCodium | 9 | noblacklist ${HOME}/.VSCodium |
10 | noblacklist ${HOME}/.config/VSCodium | ||
11 | noblacklist ${HOME}/.vscode-oss | ||
10 | 12 | ||
11 | # Redirect | 13 | # Redirect |
12 | include code.profile | 14 | include code.profile |
diff --git a/etc/profile-m-z/vym.profile b/etc/profile-m-z/vym.profile index 5421c4e4b..6632ccb6b 100644 --- a/etc/profile-m-z/vym.profile +++ b/etc/profile-m-z/vym.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | caps.drop all | 17 | caps.drop all |
diff --git a/etc/profile-m-z/w3m.profile b/etc/profile-m-z/w3m.profile index 131213ed2..c9e209142 100644 --- a/etc/profile-m-z/w3m.profile +++ b/etc/profile-m-z/w3m.profile | |||
@@ -17,18 +17,31 @@ noblacklist ${HOME}/.w3m | |||
17 | blacklist /tmp/.X11-unix | 17 | blacklist /tmp/.X11-unix |
18 | blacklist ${RUNUSER}/wayland-* | 18 | blacklist ${RUNUSER}/wayland-* |
19 | 19 | ||
20 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
21 | include allow-bin-sh.inc | ||
22 | |||
23 | # Allow perl (blacklisted by disable-interpreters.inc) | ||
20 | include allow-perl.inc | 24 | include allow-perl.inc |
21 | 25 | ||
22 | include disable-common.inc | 26 | include disable-common.inc |
23 | include disable-devel.inc | 27 | include disable-devel.inc |
28 | include disable-exec.inc | ||
24 | include disable-interpreters.inc | 29 | include disable-interpreters.inc |
25 | include disable-passwdmgr.inc | ||
26 | include disable-programs.inc | 30 | include disable-programs.inc |
31 | include disable-shell.inc | ||
27 | include disable-xdg.inc | 32 | include disable-xdg.inc |
28 | 33 | ||
34 | mkdir ${HOME}/.w3m | ||
35 | whitelist /usr/share/w3m | ||
36 | whitelist ${DOWNLOADS} | ||
37 | whitelist ${HOME}/.w3m | ||
29 | include whitelist-runuser-common.inc | 38 | include whitelist-runuser-common.inc |
39 | include whitelist-usr-share-common.inc | ||
40 | include whitelist-var-common.inc | ||
30 | 41 | ||
31 | caps.drop all | 42 | caps.drop all |
43 | ipc-namespace | ||
44 | machine-id | ||
32 | netfilter | 45 | netfilter |
33 | no3d | 46 | no3d |
34 | nodvd | 47 | nodvd |
@@ -45,8 +58,14 @@ seccomp | |||
45 | shell none | 58 | shell none |
46 | tracelog | 59 | tracelog |
47 | 60 | ||
48 | # private-bin w3m | 61 | disable-mnt |
62 | private-bin perl,sh,w3m | ||
49 | private-cache | 63 | private-cache |
50 | private-dev | 64 | private-dev |
51 | private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl | 65 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,mailcap,nsswitch.conf,pki,resolv.conf,ssl |
52 | private-tmp | 66 | private-tmp |
67 | |||
68 | dbus-user none | ||
69 | dbus-system none | ||
70 | |||
71 | memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/warmux.profile b/etc/profile-m-z/warmux.profile index 1227a202c..0a6f19b1e 100644 --- a/etc/profile-m-z/warmux.profile +++ b/etc/profile-m-z/warmux.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ disable-mnt | |||
50 | private-bin warmux | 49 | private-bin warmux |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc ca-certificates,crypto-policies,host.conf,hostname,hosts,machine-id,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | 52 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
56 | dbus-user none | 55 | dbus-user none |
diff --git a/etc/profile-m-z/warsow.profile b/etc/profile-m-z/warsow.profile index e0cd3daad..2f818b733 100644 --- a/etc/profile-m-z/warsow.profile +++ b/etc/profile-m-z/warsow.profile | |||
@@ -11,11 +11,13 @@ ignore noexec ${HOME} | |||
11 | noblacklist ${HOME}/.cache/warsow-2.1 | 11 | noblacklist ${HOME}/.cache/warsow-2.1 |
12 | noblacklist ${HOME}/.local/share/warsow-2.1 | 12 | noblacklist ${HOME}/.local/share/warsow-2.1 |
13 | 13 | ||
14 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
15 | include allow-bin-sh.inc | ||
16 | |||
14 | include disable-common.inc | 17 | include disable-common.inc |
15 | include disable-devel.inc | 18 | include disable-devel.inc |
16 | include disable-exec.inc | 19 | include disable-exec.inc |
17 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 21 | include disable-programs.inc |
20 | include disable-shell.inc | 22 | include disable-shell.inc |
21 | include disable-xdg.inc | 23 | include disable-xdg.inc |
@@ -35,19 +37,18 @@ ipc-namespace | |||
35 | netfilter | 37 | netfilter |
36 | nodvd | 38 | nodvd |
37 | nogroups | 39 | nogroups |
38 | noinput | ||
39 | nonewprivs | 40 | nonewprivs |
40 | noroot | 41 | noroot |
41 | notv | 42 | notv |
42 | nou2f | 43 | nou2f |
43 | novideo | 44 | novideo |
44 | protocol unix,inet,inet6 | 45 | protocol unix,inet,inet6,netlink |
45 | seccomp | 46 | seccomp |
46 | shell none | 47 | shell none |
47 | tracelog | 48 | tracelog |
48 | 49 | ||
49 | disable-mnt | 50 | disable-mnt |
50 | private-bin warsow | 51 | private-bin basename,bash,dirname,sed,sh,uname,warsow |
51 | private-cache | 52 | private-cache |
52 | private-dev | 53 | private-dev |
53 | private-tmp | 54 | private-tmp |
diff --git a/etc/profile-m-z/warzone2100.profile b/etc/profile-m-z/warzone2100.profile index 420e8927e..5519c3c1e 100644 --- a/etc/profile-m-z/warzone2100.profile +++ b/etc/profile-m-z/warzone2100.profile | |||
@@ -7,20 +7,22 @@ include warzone2100.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.warzone2100-3.* | 9 | noblacklist ${HOME}/.warzone2100-3.* |
10 | noblacklist ${HOME}/.local/share/warzone2100-3.* | ||
10 | 11 | ||
11 | include disable-common.inc | 12 | include disable-common.inc |
12 | include disable-devel.inc | 13 | include disable-devel.inc |
13 | include disable-exec.inc | 14 | include disable-exec.inc |
14 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | 17 | #include disable-shell.inc - problems on Debian 11 |
18 | 18 | ||
19 | mkdir ${HOME}/.warzone2100-3.1 | 19 | mkdir ${HOME}/.warzone2100-3.1 |
20 | mkdir ${HOME}/.warzone2100-3.2 | 20 | mkdir ${HOME}/.warzone2100-3.2 |
21 | whitelist ${HOME}/.local/share/warzone2100-3.3.0 # config dir moved under .local/share | ||
21 | whitelist ${HOME}/.warzone2100-3.1 | 22 | whitelist ${HOME}/.warzone2100-3.1 |
22 | whitelist ${HOME}/.warzone2100-3.2 | 23 | whitelist ${HOME}/.warzone2100-3.2 |
23 | whitelist /usr/share/games | 24 | whitelist /usr/share/games |
25 | whitelist /usr/share/gdm | ||
24 | include whitelist-common.inc | 26 | include whitelist-common.inc |
25 | include whitelist-runuser-common.inc | 27 | include whitelist-runuser-common.inc |
26 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
@@ -43,6 +45,6 @@ shell none | |||
43 | tracelog | 45 | tracelog |
44 | 46 | ||
45 | disable-mnt | 47 | disable-mnt |
46 | private-bin warzone2100 | 48 | private-bin bash,dash,sh,warzone2100,which |
47 | private-dev | 49 | private-dev |
48 | private-tmp | 50 | private-tmp |
diff --git a/etc/profile-m-z/webstorm.profile b/etc/profile-m-z/webstorm.profile index 69e96d0cd..4d849c582 100644 --- a/etc/profile-m-z/webstorm.profile +++ b/etc/profile-m-z/webstorm.profile | |||
@@ -24,7 +24,6 @@ noblacklist ${HOME}/.nvm | |||
24 | include disable-common.inc | 24 | include disable-common.inc |
25 | include disable-devel.inc | 25 | include disable-devel.inc |
26 | include disable-interpreters.inc | 26 | include disable-interpreters.inc |
27 | include disable-passwdmgr.inc | ||
28 | include disable-programs.inc | 27 | include disable-programs.inc |
29 | 28 | ||
30 | caps.drop all | 29 | caps.drop all |
diff --git a/etc/profile-m-z/webui-aria2.profile b/etc/profile-m-z/webui-aria2.profile index d5a998f35..2fe727b9c 100644 --- a/etc/profile-m-z/webui-aria2.profile +++ b/etc/profile-m-z/webui-aria2.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
18 | 17 | ||
diff --git a/etc/profile-m-z/weechat-curses.profile b/etc/profile-m-z/weechat-curses.profile index 92c968fb6..3e84375a7 100644 --- a/etc/profile-m-z/weechat-curses.profile +++ b/etc/profile-m-z/weechat-curses.profile | |||
@@ -1,5 +1,6 @@ | |||
1 | # Firejail profile alias for weechat | 1 | # Firejail profile alias for weechat |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | quiet | ||
3 | # Persistent local customizations | 4 | # Persistent local customizations |
4 | include weechat-curses.local | 5 | include weechat-curses.local |
5 | # Persistent global definitions | 6 | # Persistent global definitions |
diff --git a/etc/profile-m-z/weechat.profile b/etc/profile-m-z/weechat.profile index 3a93d2ec7..07babd502 100644 --- a/etc/profile-m-z/weechat.profile +++ b/etc/profile-m-z/weechat.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for weechat | 1 | # Firejail profile for weechat |
2 | # Description: Fast, light and extensible chat client | 2 | # Description: Fast, light and extensible chat client |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include weechat.local | 6 | include weechat.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
@@ -11,6 +12,7 @@ noblacklist ${HOME}/.weechat | |||
11 | include disable-common.inc | 12 | include disable-common.inc |
12 | include disable-programs.inc | 13 | include disable-programs.inc |
13 | 14 | ||
15 | whitelist /usr/share/weechat | ||
14 | include whitelist-usr-share-common.inc | 16 | include whitelist-usr-share-common.inc |
15 | include whitelist-var-common.inc | 17 | include whitelist-var-common.inc |
16 | 18 | ||
diff --git a/etc/profile-m-z/wesnoth.profile b/etc/profile-m-z/wesnoth.profile index 199b3c6f0..345b26a2c 100644 --- a/etc/profile-m-z/wesnoth.profile +++ b/etc/profile-m-z/wesnoth.profile | |||
@@ -13,7 +13,6 @@ noblacklist ${HOME}/.local/share/wesnoth | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | 17 | ||
19 | mkdir ${HOME}/.cache/wesnoth | 18 | mkdir ${HOME}/.cache/wesnoth |
diff --git a/etc/profile-m-z/wget.profile b/etc/profile-m-z/wget.profile index 53c4711bd..4c21d6965 100644 --- a/etc/profile-m-z/wget.profile +++ b/etc/profile-m-z/wget.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | # Depending on workflow you can add the next line to your wget.local. | 23 | # Depending on workflow you can add the next line to your wget.local. |
diff --git a/etc/profile-m-z/wget2.profile b/etc/profile-m-z/wget2.profile new file mode 100644 index 000000000..18918c6af --- /dev/null +++ b/etc/profile-m-z/wget2.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for wget2 | ||
2 | # Description: Updated version of the popular wget URL retrieval tool | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include wget2.local | ||
7 | # Persistent global definitions | ||
8 | # added by included profile | ||
9 | #include globals.local | ||
10 | |||
11 | noblacklist ${HOME}/.config/wget | ||
12 | ignore noblacklist ${HOME}/.wgetrc | ||
13 | |||
14 | private-bin wget2 | ||
15 | # Depending on workflow you can add the next line to your wget2.local. | ||
16 | #private-etc wget2rc | ||
17 | |||
18 | # Redirect | ||
19 | include wget.profile | ||
diff --git a/etc/profile-m-z/whalebird.profile b/etc/profile-m-z/whalebird.profile index 22a84274d..92ebebdae 100644 --- a/etc/profile-m-z/whalebird.profile +++ b/etc/profile-m-z/whalebird.profile | |||
@@ -20,8 +20,8 @@ whitelist ${HOME}/.config/Whalebird | |||
20 | 20 | ||
21 | no3d | 21 | no3d |
22 | 22 | ||
23 | private-bin whalebird | 23 | private-bin electron,electron[0-9],electron[0-9][0-9],whalebird |
24 | private-etc fonts,machine-id | 24 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
25 | 25 | ||
26 | # Redirect | 26 | # Redirect |
27 | include electron.profile | 27 | include electron.profile |
diff --git a/etc/profile-m-z/whois.profile b/etc/profile-m-z/whois.profile index 93871a5a4..afff6f587 100644 --- a/etc/profile-m-z/whois.profile +++ b/etc/profile-m-z/whois.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -48,7 +47,7 @@ private | |||
48 | private-bin bash,sh,whois | 47 | private-bin bash,sh,whois |
49 | private-cache | 48 | private-cache |
50 | private-dev | 49 | private-dev |
51 | private-etc alternatives,hosts,jwhois.conf,resolv.conf,services,whois.conf | 50 | private-etc alternatives,hosts,jwhois.conf,ld.so.cache,ld.so.preload,resolv.conf,services,whois.conf |
52 | private-lib gconv | 51 | private-lib gconv |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
diff --git a/etc/profile-m-z/widelands.profile b/etc/profile-m-z/widelands.profile index 0dc26b11d..6561be784 100644 --- a/etc/profile-m-z/widelands.profile +++ b/etc/profile-m-z/widelands.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/wine.profile b/etc/profile-m-z/wine.profile index 0ea24aafd..f30fc971f 100644 --- a/etc/profile-m-z/wine.profile +++ b/etc/profile-m-z/wine.profile | |||
@@ -6,6 +6,7 @@ include wine.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.cache/wine | ||
9 | noblacklist ${HOME}/.cache/winetricks | 10 | noblacklist ${HOME}/.cache/winetricks |
10 | noblacklist ${HOME}/.Steam | 11 | noblacklist ${HOME}/.Steam |
11 | noblacklist ${HOME}/.local/share/Steam | 12 | noblacklist ${HOME}/.local/share/Steam |
@@ -17,7 +18,6 @@ noblacklist /tmp/.wine-* | |||
17 | include disable-common.inc | 18 | include disable-common.inc |
18 | include disable-devel.inc | 19 | include disable-devel.inc |
19 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | 22 | ||
23 | # whitelist /usr/share/wine | 23 | # whitelist /usr/share/wine |
diff --git a/etc/profile-m-z/wire-desktop.profile b/etc/profile-m-z/wire-desktop.profile index 151cd2adb..d8742cd71 100644 --- a/etc/profile-m-z/wire-desktop.profile +++ b/etc/profile-m-z/wire-desktop.profile | |||
@@ -26,7 +26,7 @@ mkdir ${HOME}/.config/Wire | |||
26 | whitelist ${HOME}/.config/Wire | 26 | whitelist ${HOME}/.config/Wire |
27 | 27 | ||
28 | private-bin bash,electron,electron[0-9],electron[0-9][0-9],env,sh,wire-desktop | 28 | private-bin bash,electron,electron[0-9],electron[0-9][0-9],env,sh,wire-desktop |
29 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl | 29 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,machine-id,pki,resolv.conf,ssl |
30 | 30 | ||
31 | # Redirect | 31 | # Redirect |
32 | include electron.profile | 32 | include electron.profile |
diff --git a/etc/profile-m-z/wireshark.profile b/etc/profile-m-z/wireshark.profile index 1824026a8..c336efb86 100644 --- a/etc/profile-m-z/wireshark.profile +++ b/etc/profile-m-z/wireshark.profile | |||
@@ -17,7 +17,6 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | include disable-xdg.inc | 21 | include disable-xdg.inc |
23 | 22 | ||
@@ -27,7 +26,7 @@ include whitelist-var-common.inc | |||
27 | 26 | ||
28 | apparmor | 27 | apparmor |
29 | # caps.drop all | 28 | # caps.drop all |
30 | caps.keep dac_override,net_admin,net_raw | 29 | caps.keep dac_override,dac_read_search,net_admin,net_raw |
31 | netfilter | 30 | netfilter |
32 | no3d | 31 | no3d |
33 | # nogroups - breaks network traffic capture for unprivileged users | 32 | # nogroups - breaks network traffic capture for unprivileged users |
@@ -46,7 +45,9 @@ tracelog | |||
46 | 45 | ||
47 | # private-bin wireshark | 46 | # private-bin wireshark |
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | # private-dev prevents (some) interfaces from being shown. |
49 | # Add the below line to your wirehsark.local if you only want to inspect pcap files. | ||
50 | #private-dev | ||
50 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,ssl | 51 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,ssl |
51 | private-tmp | 52 | private-tmp |
52 | 53 | ||
diff --git a/etc/profile-m-z/wordwarvi.profile b/etc/profile-m-z/wordwarvi.profile index 9c724a5d2..3147c2ac3 100644 --- a/etc/profile-m-z/wordwarvi.profile +++ b/etc/profile-m-z/wordwarvi.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -46,7 +45,7 @@ private | |||
46 | private-bin wordwarvi | 45 | private-bin wordwarvi |
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-etc alsa,asound.conf,machine-id,pulse | 48 | private-etc alsa,alternatives,asound.conf,ld.so.cache,ld.so.preload,machine-id,pulse |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
52 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-m-z/wps.profile b/etc/profile-m-z/wps.profile index a44b6490e..cb0301378 100644 --- a/etc/profile-m-z/wps.profile +++ b/etc/profile-m-z/wps.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | include whitelist-usr-share-common.inc | 19 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-m-z/x2goclient.profile b/etc/profile-m-z/x2goclient.profile index 557f07cd9..3fcac351d 100644 --- a/etc/profile-m-z/x2goclient.profile +++ b/etc/profile-m-z/x2goclient.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | apparmor | 21 | apparmor |
diff --git a/etc/profile-m-z/xbill.profile b/etc/profile-m-z/xbill.profile index 384f76acc..bb119996c 100644 --- a/etc/profile-m-z/xbill.profile +++ b/etc/profile-m-z/xbill.profile | |||
@@ -10,7 +10,6 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 13 | include disable-programs.inc |
15 | include disable-shell.inc | 14 | include disable-shell.inc |
16 | include disable-xdg.inc | 15 | include disable-xdg.inc |
@@ -45,7 +44,7 @@ private | |||
45 | private-bin xbill | 44 | private-bin xbill |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc none | 47 | private-etc alternatives,ld.so.cache,ld.so.preload |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-m-z/xcalc.profile b/etc/profile-m-z/xcalc.profile index 7fb483289..3f8aa2d34 100644 --- a/etc/profile-m-z/xcalc.profile +++ b/etc/profile-m-z/xcalc.profile | |||
@@ -9,7 +9,6 @@ include disable-common.inc | |||
9 | include disable-devel.inc | 9 | include disable-devel.inc |
10 | include disable-exec.inc | 10 | include disable-exec.inc |
11 | include disable-interpreters.inc | 11 | include disable-interpreters.inc |
12 | include disable-passwdmgr.inc | ||
13 | include disable-programs.inc | 12 | include disable-programs.inc |
14 | include disable-shell.inc | 13 | include disable-shell.inc |
15 | include disable-xdg.inc | 14 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/xed.profile b/etc/profile-m-z/xed.profile index 4a3022e83..26383bda3 100644 --- a/etc/profile-m-z/xed.profile +++ b/etc/profile-m-z/xed.profile | |||
@@ -18,7 +18,6 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | 21 | include disable-programs.inc |
23 | include disable-shell.inc | 22 | include disable-shell.inc |
24 | 23 | ||
diff --git a/etc/profile-m-z/xfburn.profile b/etc/profile-m-z/xfburn.profile index cd9561e74..91e25048d 100644 --- a/etc/profile-m-z/xfburn.profile +++ b/etc/profile-m-z/xfburn.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${HOME}/.config/xfburn | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | 15 | ||
17 | caps.drop all | 16 | caps.drop all |
diff --git a/etc/profile-m-z/xfce4-dict.profile b/etc/profile-m-z/xfce4-dict.profile index ecd321c7e..fcfec10d0 100644 --- a/etc/profile-m-z/xfce4-dict.profile +++ b/etc/profile-m-z/xfce4-dict.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | 16 | ||
18 | include whitelist-var-common.inc | 17 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/xfce4-mixer.profile b/etc/profile-m-z/xfce4-mixer.profile index bb38dbebd..386ef2bd6 100644 --- a/etc/profile-m-z/xfce4-mixer.profile +++ b/etc/profile-m-z/xfce4-mixer.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -47,7 +46,7 @@ disable-mnt | |||
47 | private-bin xfce4-mixer,xfconf-query | 46 | private-bin xfce4-mixer,xfconf-query |
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | private-etc alternatives,asound.conf,fonts,machine-id,pulse | 49 | private-etc alternatives,asound.conf,fonts,ld.so.cache,ld.so.preload,machine-id,pulse |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
53 | dbus-user filter | 52 | dbus-user filter |
diff --git a/etc/profile-m-z/xfce4-notes.profile b/etc/profile-m-z/xfce4-notes.profile index ebfb4333c..5004b8fb6 100644 --- a/etc/profile-m-z/xfce4-notes.profile +++ b/etc/profile-m-z/xfce4-notes.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | 18 | ||
20 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/xfce4-screenshooter.profile b/etc/profile-m-z/xfce4-screenshooter.profile index b1e5bafbf..d74ed5754 100644 --- a/etc/profile-m-z/xfce4-screenshooter.profile +++ b/etc/profile-m-z/xfce4-screenshooter.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -43,7 +42,7 @@ tracelog | |||
43 | disable-mnt | 42 | disable-mnt |
44 | private-bin xfce4-screenshooter,xfconf-query | 43 | private-bin xfce4-screenshooter,xfconf-query |
45 | private-dev | 44 | private-dev |
46 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,pki,resolv.conf,ssl | 45 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
49 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-m-z/xiphos.profile b/etc/profile-m-z/xiphos.profile index 81d98db7a..c7fd0799b 100644 --- a/etc/profile-m-z/xiphos.profile +++ b/etc/profile-m-z/xiphos.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | 20 | ||
@@ -48,5 +47,5 @@ disable-mnt | |||
48 | private-bin xiphos | 47 | private-bin xiphos |
49 | private-cache | 48 | private-cache |
50 | private-dev | 49 | private-dev |
51 | private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssli,sword,sword.conf | 50 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssli,sword,sword.conf |
52 | private-tmp | 51 | private-tmp |
diff --git a/etc/profile-m-z/xlinks.profile b/etc/profile-m-z/xlinks.profile index 7987af280..404baf607 100644 --- a/etc/profile-m-z/xlinks.profile +++ b/etc/profile-m-z/xlinks.profile | |||
@@ -8,14 +8,13 @@ include xlinks.local | |||
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | noblacklist /tmp/.X11-unix | 10 | noblacklist /tmp/.X11-unix |
11 | noblacklist ${HOME}/.links | ||
12 | 11 | ||
13 | include whitelist-common.inc | 12 | include whitelist-common.inc |
14 | 13 | ||
15 | # if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' | 14 | # if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' |
16 | # to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line | 15 | # to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line |
17 | private-bin xlinks | 16 | private-bin xlinks |
18 | private-etc fonts | 17 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
19 | 18 | ||
20 | # Redirect | 19 | # Redirect |
21 | include links.profile | 20 | include links.profile |
diff --git a/etc/profile-m-z/xlinks2 b/etc/profile-m-z/xlinks2 new file mode 100644 index 000000000..d7edd3543 --- /dev/null +++ b/etc/profile-m-z/xlinks2 | |||
@@ -0,0 +1,20 @@ | |||
1 | # Firejail profile for xlinks2 | ||
2 | # Description: Text WWW browser (X11) | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include xlinks2.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | noblacklist /tmp/.X11-unix | ||
11 | |||
12 | include whitelist-common.inc | ||
13 | |||
14 | # if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' | ||
15 | # to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line | ||
16 | private-bin xlinks2 | ||
17 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload | ||
18 | |||
19 | # Redirect | ||
20 | include links2.profile | ||
diff --git a/etc/profile-m-z/xmms.profile b/etc/profile-m-z/xmms.profile index 25261d925..4003f69a2 100644 --- a/etc/profile-m-z/xmms.profile +++ b/etc/profile-m-z/xmms.profile | |||
@@ -11,7 +11,6 @@ noblacklist ${MUSIC} | |||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/xmr-stak.profile b/etc/profile-m-z/xmr-stak.profile index e7020f36b..e541436a4 100644 --- a/etc/profile-m-z/xmr-stak.profile +++ b/etc/profile-m-z/xmr-stak.profile | |||
@@ -11,7 +11,6 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-exec.inc | 12 | include disable-exec.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | 14 | include disable-programs.inc |
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | include disable-xdg.inc | 16 | include disable-xdg.inc |
@@ -39,7 +38,7 @@ disable-mnt | |||
39 | private ${HOME}/.xmr-stak | 38 | private ${HOME}/.xmr-stak |
40 | private-bin xmr-stak | 39 | private-bin xmr-stak |
41 | private-dev | 40 | private-dev |
42 | private-etc alternatives,ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl | 41 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
43 | #private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend | 42 | #private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend |
44 | private-opt cuda | 43 | private-opt cuda |
45 | private-tmp | 44 | private-tmp |
diff --git a/etc/profile-m-z/xonotic.profile b/etc/profile-m-z/xonotic.profile index 53c9a0a08..7c2b38d1d 100644 --- a/etc/profile-m-z/xonotic.profile +++ b/etc/profile-m-z/xonotic.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | include disable-shell.inc | 19 | include disable-shell.inc |
21 | include disable-xdg.inc | 20 | include disable-xdg.inc |
@@ -33,7 +32,6 @@ caps.drop all | |||
33 | netfilter | 32 | netfilter |
34 | nodvd | 33 | nodvd |
35 | nogroups | 34 | nogroups |
36 | noinput | ||
37 | nonewprivs | 35 | nonewprivs |
38 | noroot | 36 | noroot |
39 | notv | 37 | notv |
diff --git a/etc/profile-m-z/xournal.profile b/etc/profile-m-z/xournal.profile index c4f092d50..a0e77b4e7 100644 --- a/etc/profile-m-z/xournal.profile +++ b/etc/profile-m-z/xournal.profile | |||
@@ -12,7 +12,6 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
@@ -44,7 +43,7 @@ tracelog | |||
44 | private-bin xournal | 43 | private-bin xournal |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-etc alternatives,fonts,group,machine-id,passwd | 46 | private-etc alternatives,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd |
48 | # TODO should use private-lib | 47 | # TODO should use private-lib |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
diff --git a/etc/profile-m-z/xournalpp.profile b/etc/profile-m-z/xournalpp.profile index 988b878b9..a23ad68df 100644 --- a/etc/profile-m-z/xournalpp.profile +++ b/etc/profile-m-z/xournalpp.profile | |||
@@ -7,6 +7,8 @@ include xournalpp.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | noblacklist ${HOME}/.cache/xournalpp | ||
11 | noblacklist ${HOME}/.config/xournalpp | ||
10 | noblacklist ${HOME}/.xournalpp | 12 | noblacklist ${HOME}/.xournalpp |
11 | 13 | ||
12 | include allow-lua.inc | 14 | include allow-lua.inc |
@@ -16,14 +18,17 @@ whitelist /usr/share/xournalpp | |||
16 | whitelist /var/lib/texmf | 18 | whitelist /var/lib/texmf |
17 | include whitelist-runuser-common.inc | 19 | include whitelist-runuser-common.inc |
18 | 20 | ||
19 | #mkdir ${HOME}/.xournalpp | 21 | #mkdir ${HOME}/.cache/xournalpp |
22 | #mkdir ${HOME}/.config/xournalpp | ||
23 | #whitelist ${HOME}/.cache/xournalpp | ||
24 | #whitelist ${HOME}/.config/xournalpp | ||
20 | #whitelist ${HOME}/.xournalpp | 25 | #whitelist ${HOME}/.xournalpp |
21 | #whitelist ${HOME}/.texlive20* | 26 | #whitelist ${HOME}/.texlive20* |
22 | #whitelist ${DOCUMENTS} | 27 | #whitelist ${DOCUMENTS} |
23 | #include whitelist-common.inc | 28 | #include whitelist-common.inc |
24 | 29 | ||
25 | private-bin kpsewhich,pdflatex,xournalpp | 30 | private-bin kpsewhich,pdflatex,xournalpp |
26 | private-etc latexmk.conf,texlive | 31 | private-etc alternatives,latexmk.conf,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,texlive |
27 | 32 | ||
28 | # Redirect | 33 | # Redirect |
29 | include xournal.profile | 34 | include xournal.profile |
diff --git a/etc/profile-m-z/xpdf.profile b/etc/profile-m-z/xpdf.profile index 1447ec9a7..0149d36a3 100644 --- a/etc/profile-m-z/xpdf.profile +++ b/etc/profile-m-z/xpdf.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
diff --git a/etc/profile-m-z/xplayer.profile b/etc/profile-m-z/xplayer.profile index c3bb3292c..d1ea2c9d5 100644 --- a/etc/profile-m-z/xplayer.profile +++ b/etc/profile-m-z/xplayer.profile | |||
@@ -16,7 +16,6 @@ include disable-common.inc | |||
16 | include disable-devel.inc | 16 | include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | 19 | include disable-programs.inc |
21 | 20 | ||
22 | read-only ${DESKTOP} | 21 | read-only ${DESKTOP} |
diff --git a/etc/profile-m-z/xpra.profile b/etc/profile-m-z/xpra.profile index 6e409e1aa..aed6c102f 100644 --- a/etc/profile-m-z/xpra.profile +++ b/etc/profile-m-z/xpra.profile | |||
@@ -22,7 +22,6 @@ include allow-python3.inc | |||
22 | include disable-common.inc | 22 | include disable-common.inc |
23 | include disable-devel.inc | 23 | include disable-devel.inc |
24 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
25 | include disable-passwdmgr.inc | ||
26 | include disable-programs.inc | 25 | include disable-programs.inc |
27 | 26 | ||
28 | whitelist /var/lib/xkb | 27 | whitelist /var/lib/xkb |
diff --git a/etc/profile-m-z/xreader.profile b/etc/profile-m-z/xreader.profile index 3ab35edfc..8b880426f 100644 --- a/etc/profile-m-z/xreader.profile +++ b/etc/profile-m-z/xreader.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
20 | 19 | ||
@@ -40,7 +39,7 @@ tracelog | |||
40 | 39 | ||
41 | private-bin xreader,xreader-previewer,xreader-thumbnailer | 40 | private-bin xreader,xreader-previewer,xreader-thumbnailer |
42 | private-dev | 41 | private-dev |
43 | private-etc alternatives,fonts,ld.so.cache | 42 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
44 | private-tmp | 43 | private-tmp |
45 | 44 | ||
46 | memory-deny-write-execute | 45 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/xviewer.profile b/etc/profile-m-z/xviewer.profile index 4d454f81c..5c8d6a47e 100644 --- a/etc/profile-m-z/xviewer.profile +++ b/etc/profile-m-z/xviewer.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | 19 | ||
diff --git a/etc/profile-m-z/yandex-browser.profile b/etc/profile-m-z/yandex-browser.profile index 81cd021f7..3ae6b1cf0 100644 --- a/etc/profile-m-z/yandex-browser.profile +++ b/etc/profile-m-z/yandex-browser.profile | |||
@@ -5,8 +5,7 @@ include yandex-browser.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Disable for now, see https://www.tutorialspoint.com/difference-between-void-main-and-int-main-in-c-cplusplus | 8 | # Disable for now, see https://github.com/netblue30/firejail/pull/3688#issuecomment-718711565 |
9 | ignore whitelist /usr/share/chromium | ||
10 | ignore include whitelist-runuser-common.inc | 9 | ignore include whitelist-runuser-common.inc |
11 | ignore include whitelist-usr-share-common.inc | 10 | ignore include whitelist-usr-share-common.inc |
12 | 11 | ||
diff --git a/etc/profile-m-z/yarn.profile b/etc/profile-m-z/yarn.profile index 360bd8442..05b55d071 100644 --- a/etc/profile-m-z/yarn.profile +++ b/etc/profile-m-z/yarn.profile | |||
@@ -6,25 +6,5 @@ include yarn.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | ignore read-only ${HOME}/.yarnrc | ||
10 | |||
11 | noblacklist ${HOME}/.yarn | ||
12 | noblacklist ${HOME}/.yarn-config | ||
13 | noblacklist ${HOME}/.yarncache | ||
14 | noblacklist ${HOME}/.yarnrc | ||
15 | |||
16 | # If you want whitelisting, change ${HOME}/Projects below to your yarn projects directory and | ||
17 | # add the next lines to you yarn.local. | ||
18 | #mkdir ${HOME}/.yarn | ||
19 | #mkdir ${HOME}/.yarn-config | ||
20 | #mkdir ${HOME}/.yarncache | ||
21 | #mkfile ${HOME}/.yarnrc | ||
22 | #whitelist ${HOME}/.yarn | ||
23 | #whitelist ${HOME}/.yarn-config | ||
24 | #whitelist ${HOME}/.yarncache | ||
25 | #whitelist ${HOME}/.yarnrc | ||
26 | #whitelist ${HOME}/Projects | ||
27 | #include whitelist-common.inc | ||
28 | |||
29 | # Redirect | 9 | # Redirect |
30 | include nodejs-common.profile | 10 | include nodejs-common.profile |
diff --git a/etc/profile-m-z/yelp.profile b/etc/profile-m-z/yelp.profile index 93054bfed..31a51b2c4 100644 --- a/etc/profile-m-z/yelp.profile +++ b/etc/profile-m-z/yelp.profile | |||
@@ -12,13 +12,13 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | 15 | include disable-programs.inc |
17 | include disable-shell.inc | 16 | include disable-shell.inc |
18 | include disable-xdg.inc | 17 | include disable-xdg.inc |
19 | 18 | ||
20 | mkdir ${HOME}/.config/yelp | 19 | mkdir ${HOME}/.config/yelp |
21 | whitelist ${HOME}/.config/yelp | 20 | whitelist ${HOME}/.config/yelp |
21 | whitelist /usr/libexec/webkit2gtk-4.0 | ||
22 | whitelist /usr/share/doc | 22 | whitelist /usr/share/doc |
23 | whitelist /usr/share/groff | 23 | whitelist /usr/share/groff |
24 | whitelist /usr/share/help | 24 | whitelist /usr/share/help |
@@ -56,7 +56,7 @@ disable-mnt | |||
56 | private-bin groff,man,tbl,troff,yelp | 56 | private-bin groff,man,tbl,troff,yelp |
57 | private-cache | 57 | private-cache |
58 | private-dev | 58 | private-dev |
59 | private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,groff,gtk-3.0,machine-id,man_db.conf,openal,os-release,pulse,sgml,xml | 59 | private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,groff,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,man_db.conf,openal,os-release,pulse,sgml,xml |
60 | private-tmp | 60 | private-tmp |
61 | 61 | ||
62 | dbus-user filter | 62 | dbus-user filter |
diff --git a/etc/profile-m-z/youtube-dl-gui.profile b/etc/profile-m-z/youtube-dl-gui.profile index b52271a2c..94f37a92b 100644 --- a/etc/profile-m-z/youtube-dl-gui.profile +++ b/etc/profile-m-z/youtube-dl-gui.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -50,7 +49,7 @@ disable-mnt | |||
50 | private-bin atomicparsley,ffmpeg,ffprobe,python*,youtube-dl-gui | 49 | private-bin atomicparsley,ffmpeg,ffprobe,python*,youtube-dl-gui |
51 | private-cache | 50 | private-cache |
52 | private-dev | 51 | private-dev |
53 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,locale,locale.conf,passwd,pki,resolv.conf,ssl | 52 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,locale,locale.conf,passwd,pki,resolv.conf,ssl |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
56 | dbus-user none | 55 | dbus-user none |
diff --git a/etc/profile-m-z/youtube-dl.profile b/etc/profile-m-z/youtube-dl.profile index 24c4d6db3..71e50ab11 100644 --- a/etc/profile-m-z/youtube-dl.profile +++ b/etc/profile-m-z/youtube-dl.profile | |||
@@ -27,7 +27,6 @@ include disable-common.inc | |||
27 | include disable-devel.inc | 27 | include disable-devel.inc |
28 | include disable-exec.inc | 28 | include disable-exec.inc |
29 | include disable-interpreters.inc | 29 | include disable-interpreters.inc |
30 | include disable-passwdmgr.inc | ||
31 | include disable-programs.inc | 30 | include disable-programs.inc |
32 | include disable-shell.inc | 31 | include disable-shell.inc |
33 | include disable-xdg.inc | 32 | include disable-xdg.inc |
@@ -59,7 +58,7 @@ tracelog | |||
59 | private-bin env,ffmpeg,python*,youtube-dl | 58 | private-bin env,ffmpeg,python*,youtube-dl |
60 | private-cache | 59 | private-cache |
61 | private-dev | 60 | private-dev |
62 | private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,ld.so.cache,mime.types,pki,resolv.conf,ssl,youtube-dl.conf | 61 | private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,pki,resolv.conf,ssl,youtube-dl.conf |
63 | private-tmp | 62 | private-tmp |
64 | 63 | ||
65 | dbus-user none | 64 | dbus-user none |
diff --git a/etc/profile-m-z/youtube-viewer.profile b/etc/profile-m-z/youtube-viewer.profile index 7d6e9b0eb..825599fcc 100644 --- a/etc/profile-m-z/youtube-viewer.profile +++ b/etc/profile-m-z/youtube-viewer.profile | |||
@@ -10,51 +10,12 @@ include globals.local | |||
10 | noblacklist ${HOME}/.cache/youtube-viewer | 10 | noblacklist ${HOME}/.cache/youtube-viewer |
11 | noblacklist ${HOME}/.config/youtube-viewer | 11 | noblacklist ${HOME}/.config/youtube-viewer |
12 | 12 | ||
13 | # Allow perl (blacklisted by disable-interpreters.inc) | ||
14 | include allow-perl.inc | ||
15 | |||
16 | # Allow python (blacklisted by disable-interpreters.inc) | ||
17 | include allow-python2.inc | ||
18 | include allow-python3.inc | ||
19 | |||
20 | include disable-common.inc | ||
21 | include disable-devel.inc | ||
22 | include disable-exec.inc | ||
23 | include disable-interpreters.inc | ||
24 | include disable-passwdmgr.inc | ||
25 | include disable-programs.inc | ||
26 | include disable-xdg.inc | ||
27 | |||
28 | mkdir ${HOME}/.cache/youtube-viewer | 13 | mkdir ${HOME}/.cache/youtube-viewer |
29 | mkdir ${HOME}/.config/youtube-viewer | 14 | mkdir ${HOME}/.config/youtube-viewer |
30 | whitelist ${HOME}/.cache/youtube-viewer | 15 | whitelist ${HOME}/.cache/youtube-viewer |
31 | whitelist ${HOME}/.config/youtube-viewer | 16 | whitelist ${HOME}/.config/youtube-viewer |
32 | include whitelist-common.inc | ||
33 | include whitelist-usr-share-common.inc | ||
34 | include whitelist-var-common.inc | ||
35 | |||
36 | apparmor | ||
37 | caps.drop all | ||
38 | netfilter | ||
39 | nodvd | ||
40 | nogroups | ||
41 | noinput | ||
42 | nonewprivs | ||
43 | noroot | ||
44 | notv | ||
45 | nou2f | ||
46 | novideo | ||
47 | protocol unix,inet,inet6 | ||
48 | seccomp | ||
49 | shell none | ||
50 | tracelog | ||
51 | 17 | ||
52 | disable-mnt | 18 | private-bin gtk-youtube-viewer,gtk2-youtube-viewer,gtk3-youtube-viewer,youtube-viewer |
53 | private-bin ffmpeg,ffprobe,firefox,gtk-youtube-viewer,gtk2-youtube-viewer,gtk3-youtube-viewer,mpv,python*,sh,smplayer,stty,vlc,which,youtube-dl,youtube-viewer | ||
54 | private-cache | ||
55 | private-dev | ||
56 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg | ||
57 | private-tmp | ||
58 | 19 | ||
59 | dbus-user none | 20 | # Redirect |
60 | dbus-system none | 21 | include youtube-viewers-common.profile |
diff --git a/etc/profile-m-z/youtube-viewers-common.profile b/etc/profile-m-z/youtube-viewers-common.profile new file mode 100644 index 000000000..f212a6721 --- /dev/null +++ b/etc/profile-m-z/youtube-viewers-common.profile | |||
@@ -0,0 +1,60 @@ | |||
1 | # Firejail profile for youtube-viewer clones | ||
2 | # Description: common profile for Trizen's Youtube viewers | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include youtube-viewers-common.local | ||
6 | # Persistent global definitions | ||
7 | # added by caller profile | ||
8 | #include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.cache/youtube-dl | ||
11 | |||
12 | # Allow lua (blacklisted by disable-interpreters.inc) | ||
13 | include allow-lua.inc | ||
14 | |||
15 | # Allow perl (blacklisted by disable-interpreters.inc) | ||
16 | include allow-perl.inc | ||
17 | |||
18 | # Allow python (blacklisted by disable-interpreters.inc) | ||
19 | include allow-python2.inc | ||
20 | include allow-python3.inc | ||
21 | |||
22 | include disable-common.inc | ||
23 | include disable-devel.inc | ||
24 | include disable-exec.inc | ||
25 | include disable-interpreters.inc | ||
26 | include disable-programs.inc | ||
27 | include disable-xdg.inc | ||
28 | |||
29 | whitelist ${DOWNLOADS} | ||
30 | whitelist ${HOME}/.cache/youtube-dl/youtube-sigfuncs | ||
31 | include whitelist-common.inc | ||
32 | include whitelist-runuser-common.inc | ||
33 | include whitelist-usr-share-common.inc | ||
34 | include whitelist-var-common.inc | ||
35 | |||
36 | apparmor | ||
37 | caps.drop all | ||
38 | netfilter | ||
39 | nodvd | ||
40 | nogroups | ||
41 | noinput | ||
42 | nonewprivs | ||
43 | noroot | ||
44 | notv | ||
45 | nou2f | ||
46 | novideo | ||
47 | protocol unix,inet,inet6 | ||
48 | seccomp | ||
49 | shell none | ||
50 | tracelog | ||
51 | |||
52 | disable-mnt | ||
53 | private-bin bash,ffmpeg,ffprobe,firefox,mpv,perl,python*,sh,smplayer,stty,wget,wget2,which,xterm,youtube-dl,yt-dlp | ||
54 | private-cache | ||
55 | private-dev | ||
56 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg | ||
57 | private-tmp | ||
58 | |||
59 | dbus-user none | ||
60 | dbus-system none | ||
diff --git a/etc/profile-m-z/youtube.profile b/etc/profile-m-z/youtube.profile index ad7ceaee4..5c4d697da 100644 --- a/etc/profile-m-z/youtube.profile +++ b/etc/profile-m-z/youtube.profile | |||
@@ -16,8 +16,8 @@ include disable-shell.inc | |||
16 | mkdir ${HOME}/.config/Youtube | 16 | mkdir ${HOME}/.config/Youtube |
17 | whitelist ${HOME}/.config/Youtube | 17 | whitelist ${HOME}/.config/Youtube |
18 | 18 | ||
19 | private-bin youtube | 19 | private-bin electron,electron[0-9],electron[0-9][0-9],youtube |
20 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 20 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
21 | private-opt Youtube | 21 | private-opt Youtube |
22 | 22 | ||
23 | # Redirect | 23 | # Redirect |
diff --git a/etc/profile-m-z/youtubemusic-nativefier.profile b/etc/profile-m-z/youtubemusic-nativefier.profile index 74b0e38b9..2b5ffeaaf 100644 --- a/etc/profile-m-z/youtubemusic-nativefier.profile +++ b/etc/profile-m-z/youtubemusic-nativefier.profile | |||
@@ -13,8 +13,8 @@ include disable-shell.inc | |||
13 | mkdir ${HOME}/.config/youtubemusic-nativefier-040164 | 13 | mkdir ${HOME}/.config/youtubemusic-nativefier-040164 |
14 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 | 14 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 |
15 | 15 | ||
16 | private-bin youtubemusic-nativefier | 16 | private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier |
17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
18 | private-opt youtubemusic-nativefier | 18 | private-opt youtubemusic-nativefier |
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
diff --git a/etc/profile-m-z/yt-dlp.profile b/etc/profile-m-z/yt-dlp.profile new file mode 100644 index 000000000..6e835b03f --- /dev/null +++ b/etc/profile-m-z/yt-dlp.profile | |||
@@ -0,0 +1,21 @@ | |||
1 | # Firejail profile for yt-dlp | ||
2 | # Description: Downloader of videos of various sites | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include yt-dlp.local | ||
7 | # Persistent global definitions | ||
8 | # added by included profile | ||
9 | #include globals.local | ||
10 | |||
11 | noblacklist ${HOME}/.cache/yt-dlp | ||
12 | noblacklist ${HOME}/.config/yt-dlp | ||
13 | noblacklist ${HOME}/.config/yt-dlp.conf | ||
14 | noblacklist ${HOME}/yt-dlp.conf | ||
15 | noblacklist ${HOME}/yt-dlp.conf.txt | ||
16 | |||
17 | private-bin ffprobe,yt-dlp | ||
18 | private-etc alternatives,ld.so.cache,ld.so.preload,yt-dlp.conf | ||
19 | |||
20 | # Redirect | ||
21 | include youtube-dl.profile | ||
diff --git a/etc/profile-m-z/ytmdesktop.profile b/etc/profile-m-z/ytmdesktop.profile index ab46fccc2..59b6e2543 100644 --- a/etc/profile-m-z/ytmdesktop.profile +++ b/etc/profile-m-z/ytmdesktop.profile | |||
@@ -14,7 +14,7 @@ mkdir ${HOME}/.config/youtube-music-desktop-app | |||
14 | whitelist ${HOME}/.config/youtube-music-desktop-app | 14 | whitelist ${HOME}/.config/youtube-music-desktop-app |
15 | 15 | ||
16 | # private-bin env,ytmdesktop | 16 | # private-bin env,ytmdesktop |
17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
18 | # private-opt | 18 | # private-opt |
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
diff --git a/etc/profile-m-z/zaproxy.profile b/etc/profile-m-z/zaproxy.profile index 5a168feb6..1f11f133f 100644 --- a/etc/profile-m-z/zaproxy.profile +++ b/etc/profile-m-z/zaproxy.profile | |||
@@ -15,7 +15,6 @@ include disable-common.inc | |||
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | 18 | include disable-programs.inc |
20 | 19 | ||
21 | mkdir ${HOME}/.java | 20 | mkdir ${HOME}/.java |
diff --git a/etc/profile-m-z/zart.profile b/etc/profile-m-z/zart.profile index 10f83aa30..f534aee8f 100644 --- a/etc/profile-m-z/zart.profile +++ b/etc/profile-m-z/zart.profile | |||
@@ -13,7 +13,6 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | 16 | include disable-programs.inc |
18 | include disable-shell.inc | 17 | include disable-shell.inc |
19 | include disable-xdg.inc | 18 | include disable-xdg.inc |
diff --git a/etc/profile-m-z/zathura.profile b/etc/profile-m-z/zathura.profile index a39729685..68c9b0a93 100644 --- a/etc/profile-m-z/zathura.profile +++ b/etc/profile-m-z/zathura.profile | |||
@@ -14,15 +14,16 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
19 | include disable-write-mnt.inc | ||
20 | include disable-xdg.inc | 20 | include disable-xdg.inc |
21 | 21 | ||
22 | mkdir ${HOME}/.config/zathura | 22 | mkdir ${HOME}/.config/zathura |
23 | mkdir ${HOME}/.local/share/zathura | 23 | mkdir ${HOME}/.local/share/zathura |
24 | whitelist /usr/share/doc | 24 | whitelist /usr/share/doc |
25 | whitelist /usr/share/zathura | 25 | whitelist /usr/share/zathura |
26 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
28 | 29 | ||
@@ -41,6 +42,7 @@ nou2f | |||
41 | novideo | 42 | novideo |
42 | protocol unix | 43 | protocol unix |
43 | seccomp | 44 | seccomp |
45 | seccomp.block-secondary | ||
44 | shell none | 46 | shell none |
45 | tracelog | 47 | tracelog |
46 | 48 | ||
diff --git a/etc/profile-m-z/zeal.profile b/etc/profile-m-z/zeal.profile index 2c6f6910f..eaf06b66a 100644 --- a/etc/profile-m-z/zeal.profile +++ b/etc/profile-m-z/zeal.profile | |||
@@ -6,27 +6,35 @@ include zeal.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.config/Zeal | ||
10 | noblacklist ${HOME}/.cache/Zeal | 9 | noblacklist ${HOME}/.cache/Zeal |
10 | noblacklist ${HOME}/.config/Zeal | ||
11 | noblacklist ${HOME}/.local/share/Zeal | 11 | noblacklist ${HOME}/.local/share/Zeal |
12 | 12 | ||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-proc.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | 19 | include disable-shell.inc |
20 | include disable-xdg.inc | 20 | include disable-xdg.inc |
21 | 21 | ||
22 | # Allow zeal to open links in Firefox. | ||
23 | # This also requires dbus-user filtering (see below). | ||
24 | noblacklist ${HOME}/.mozilla | ||
25 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | ||
26 | read-only ${HOME}/.mozilla/firefox/profiles.ini | ||
27 | |||
22 | mkdir ${HOME}/.cache/Zeal | 28 | mkdir ${HOME}/.cache/Zeal |
23 | mkdir ${HOME}/.config/qt5ct | ||
24 | mkdir ${HOME}/.config/Zeal | 29 | mkdir ${HOME}/.config/Zeal |
25 | mkdir ${HOME}/.local/share/Zeal | 30 | mkdir ${HOME}/.local/share/Zeal |
26 | whitelist ${HOME}/.cache/Zeal | 31 | whitelist ${HOME}/.cache/Zeal |
27 | whitelist ${HOME}/.config/Zeal | 32 | whitelist ${HOME}/.config/Zeal |
28 | whitelist ${HOME}/.local/share/Zeal | 33 | whitelist ${HOME}/.local/share/Zeal |
29 | include whitelist-common.inc | 34 | include whitelist-common.inc |
35 | include whitelist-run-common.inc | ||
36 | include whitelist-runuser-common.inc | ||
37 | include whitelist-usr-share-common.inc | ||
30 | include whitelist-var-common.inc | 38 | include whitelist-var-common.inc |
31 | 39 | ||
32 | apparmor | 40 | apparmor |
@@ -45,6 +53,7 @@ nou2f | |||
45 | novideo | 53 | novideo |
46 | protocol unix,inet,inet6,netlink | 54 | protocol unix,inet,inet6,netlink |
47 | seccomp | 55 | seccomp |
56 | seccomp.block-secondary | ||
48 | shell none | 57 | shell none |
49 | tracelog | 58 | tracelog |
50 | 59 | ||
@@ -55,7 +64,10 @@ private-dev | |||
55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssl,Trolltech.conf,X11,xdg | 64 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssl,Trolltech.conf,X11,xdg |
56 | private-tmp | 65 | private-tmp |
57 | 66 | ||
58 | dbus-user none | 67 | dbus-user filter |
68 | dbus-user.talk org.mozilla.Firefox.* | ||
69 | dbus-user.talk org.mozilla.firefox.* | ||
70 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher | ||
59 | dbus-system none | 71 | dbus-system none |
60 | 72 | ||
61 | # memory-deny-write-execute - breaks on Arch | 73 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/profile-m-z/zim.profile b/etc/profile-m-z/zim.profile new file mode 100644 index 000000000..fa67b76c7 --- /dev/null +++ b/etc/profile-m-z/zim.profile | |||
@@ -0,0 +1,71 @@ | |||
1 | # Firejail profile for Zim | ||
2 | # Description: Desktop wiki & notekeeper | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include zim.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/zim | ||
10 | noblacklist ${HOME}/.config/zim | ||
11 | |||
12 | # Allow python (blacklisted by disable-interpreters.inc) | ||
13 | include allow-python2.inc | ||
14 | include allow-python3.inc | ||
15 | |||
16 | blacklist /usr/libexec | ||
17 | |||
18 | include disable-common.inc | ||
19 | include disable-devel.inc | ||
20 | include disable-exec.inc | ||
21 | include disable-interpreters.inc | ||
22 | include disable-programs.inc | ||
23 | include disable-shell.inc | ||
24 | |||
25 | mkdir ${HOME}/.cache/zim | ||
26 | mkdir ${HOME}/.config/zim | ||
27 | mkdir ${HOME}/Notebooks | ||
28 | whitelist ${HOME}/.cache/zim | ||
29 | whitelist ${HOME}/.config/zim | ||
30 | whitelist ${HOME}/Notebooks | ||
31 | whitelist ${DESKTOP} | ||
32 | whitelist ${DOCUMENTS} | ||
33 | whitelist ${DOWNLOADS} | ||
34 | whitelist ${MUSIC} | ||
35 | whitelist ${PICTURES} | ||
36 | whitelist ${VIDEOS} | ||
37 | whitelist /usr/share/zim | ||
38 | include whitelist-common.inc | ||
39 | include whitelist-runuser-common.inc | ||
40 | include whitelist-usr-share-common.inc | ||
41 | include whitelist-var-common.inc | ||
42 | |||
43 | apparmor | ||
44 | caps.drop all | ||
45 | machine-id | ||
46 | net none | ||
47 | no3d | ||
48 | nodvd | ||
49 | nogroups | ||
50 | noinput | ||
51 | nonewprivs | ||
52 | noroot | ||
53 | nosound | ||
54 | notv | ||
55 | nou2f | ||
56 | novideo | ||
57 | protocol unix | ||
58 | seccomp | ||
59 | seccomp.block-secondary | ||
60 | shell none | ||
61 | tracelog | ||
62 | |||
63 | disable-mnt | ||
64 | private-bin python*,zim | ||
65 | private-cache | ||
66 | private-dev | ||
67 | private-etc alternatives,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11 | ||
68 | private-tmp | ||
69 | |||
70 | dbus-user none | ||
71 | dbus-system none | ||
diff --git a/etc/profile-m-z/zulip.profile b/etc/profile-m-z/zulip.profile index 093da5212..8acfdd651 100644 --- a/etc/profile-m-z/zulip.profile +++ b/etc/profile-m-z/zulip.profile | |||
@@ -14,7 +14,6 @@ include disable-common.inc | |||
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | 17 | include disable-programs.inc |
19 | include disable-shell.inc | 18 | include disable-shell.inc |
20 | include disable-xdg.inc | 19 | include disable-xdg.inc |
@@ -45,5 +44,5 @@ disable-mnt | |||
45 | private-bin locale,zulip | 44 | private-bin locale,zulip |
46 | private-cache | 45 | private-cache |
47 | private-dev | 46 | private-dev |
48 | private-etc asound.conf,fonts,machine-id | 47 | private-etc alternatives,asound.conf,fonts,ld.so.cache,ld.so.preload,machine-id |
49 | private-tmp | 48 | private-tmp |