aboutsummaryrefslogtreecommitdiffstats
path: root/etc/profile-m-z
diff options
context:
space:
mode:
Diffstat (limited to 'etc/profile-m-z')
-rw-r--r--etc/profile-m-z/PCSX2.profile4
-rw-r--r--etc/profile-m-z/QMediathekView.profile4
-rw-r--r--etc/profile-m-z/Viber.profile2
-rw-r--r--etc/profile-m-z/Xephyr.profile8
-rw-r--r--etc/profile-m-z/Xvfb.profile4
-rw-r--r--etc/profile-m-z/makepkg.profile4
-rw-r--r--etc/profile-m-z/microsoft-edge-beta.profile3
-rw-r--r--etc/profile-m-z/midori.profile6
-rw-r--r--etc/profile-m-z/mocp.profile17
-rw-r--r--etc/profile-m-z/mpDris2.profile6
-rw-r--r--etc/profile-m-z/mpd.profile4
-rw-r--r--etc/profile-m-z/mplayer.profile4
-rw-r--r--etc/profile-m-z/mullvad-browser.profile3
-rw-r--r--etc/profile-m-z/multimc5.profile6
-rw-r--r--etc/profile-m-z/mumble.profile2
-rw-r--r--etc/profile-m-z/musescore.profile4
-rw-r--r--etc/profile-m-z/musixmatch.profile2
-rw-r--r--etc/profile-m-z/mutt.profile7
-rw-r--r--etc/profile-m-z/nano.profile2
-rw-r--r--etc/profile-m-z/ncdu.profile2
-rw-r--r--etc/profile-m-z/neochat.profile2
-rw-r--r--etc/profile-m-z/neomutt.profile7
-rw-r--r--etc/profile-m-z/nicotine.profile5
-rw-r--r--etc/profile-m-z/nitroshare.profile8
-rw-r--r--etc/profile-m-z/nodejs-common.profile5
-rw-r--r--etc/profile-m-z/notable.profile3
-rw-r--r--etc/profile-m-z/nuclear.profile4
-rw-r--r--etc/profile-m-z/ocenaudio.profile2
-rw-r--r--etc/profile-m-z/okular.profile11
-rw-r--r--etc/profile-m-z/onionshare-gui.profile2
-rw-r--r--etc/profile-m-z/openclonk.profile2
-rw-r--r--etc/profile-m-z/orage.profile2
-rw-r--r--etc/profile-m-z/otter-browser.profile2
-rw-r--r--etc/profile-m-z/palemoon.profile2
-rw-r--r--etc/profile-m-z/patch.profile1
-rw-r--r--etc/profile-m-z/pavucontrol-qt.profile5
-rw-r--r--etc/profile-m-z/pidgin.profile2
-rw-r--r--etc/profile-m-z/ping.profile2
-rw-r--r--etc/profile-m-z/pluma.profile8
-rw-r--r--etc/profile-m-z/plv.profile2
-rw-r--r--etc/profile-m-z/pnpm.profile11
-rw-r--r--etc/profile-m-z/pnpx.profile11
-rw-r--r--etc/profile-m-z/psi-plus.profile2
-rw-r--r--etc/profile-m-z/psi.profile2
-rw-r--r--etc/profile-m-z/pycharm-community.profile4
-rw-r--r--etc/profile-m-z/qbittorrent.profile4
-rw-r--r--etc/profile-m-z/qmmp.profile2
-rw-r--r--etc/profile-m-z/qpdfview.profile4
-rw-r--r--etc/profile-m-z/qtox.profile2
-rw-r--r--etc/profile-m-z/quassel.profile2
-rw-r--r--etc/profile-m-z/quiterss.profile2
-rw-r--r--etc/profile-m-z/rpcs3.profile3
-rw-r--r--etc/profile-m-z/rssguard.profile4
-rw-r--r--etc/profile-m-z/scribus.profile2
-rw-r--r--etc/profile-m-z/seamonkey.profile2
-rw-r--r--etc/profile-m-z/server.profile50
-rw-r--r--etc/profile-m-z/silentarmy.profile2
-rw-r--r--etc/profile-m-z/simple-scan.profile10
-rw-r--r--etc/profile-m-z/simutrans.profile2
-rw-r--r--etc/profile-m-z/skanlite.profile12
-rw-r--r--etc/profile-m-z/smplayer.profile6
-rw-r--r--etc/profile-m-z/sniffnet.profile4
-rw-r--r--etc/profile-m-z/sol.profile6
-rw-r--r--etc/profile-m-z/sound-juicer.profile4
-rw-r--r--etc/profile-m-z/spotify.profile2
-rw-r--r--etc/profile-m-z/sqlitebrowser.profile6
-rw-r--r--etc/profile-m-z/ssh.profile6
-rw-r--r--etc/profile-m-z/ssmtp.profile1
-rw-r--r--etc/profile-m-z/standardnotes-desktop.profile2
-rw-r--r--etc/profile-m-z/steam.profile6
-rw-r--r--etc/profile-m-z/subdownloader.profile2
-rw-r--r--etc/profile-m-z/supertux2.profile2
-rw-r--r--etc/profile-m-z/sushi.profile2
-rw-r--r--etc/profile-m-z/sylpheed.profile2
-rw-r--r--etc/profile-m-z/sysprof.profile6
-rw-r--r--etc/profile-m-z/system-log-common.profile60
-rw-r--r--etc/profile-m-z/teamspeak3.profile2
-rw-r--r--etc/profile-m-z/telegram.profile3
-rw-r--r--etc/profile-m-z/termshark.profile15
-rw-r--r--etc/profile-m-z/tesseract.profile1
-rw-r--r--etc/profile-m-z/thunderbird-beta.profile2
-rw-r--r--etc/profile-m-z/thunderbird.profile6
-rw-r--r--etc/profile-m-z/tidal-hifi.profile39
-rw-r--r--etc/profile-m-z/tiny-rdm.profile61
-rw-r--r--etc/profile-m-z/tmux.profile12
-rw-r--r--etc/profile-m-z/torbrowser-launcher.profile3
-rw-r--r--etc/profile-m-z/totem.profile4
-rw-r--r--etc/profile-m-z/tracker.profile6
-rw-r--r--etc/profile-m-z/transgui.profile6
-rw-r--r--etc/profile-m-z/trojita.profile2
-rw-r--r--etc/profile-m-z/tshark.profile3
-rw-r--r--etc/profile-m-z/tutanota-desktop.profile2
-rw-r--r--etc/profile-m-z/tvbrowser.profile2
-rw-r--r--etc/profile-m-z/twitch.profile4
-rw-r--r--etc/profile-m-z/udiskie.profile4
-rw-r--r--etc/profile-m-z/unknown-horizons.profile6
-rw-r--r--etc/profile-m-z/viewnior.profile2
-rw-r--r--etc/profile-m-z/virtualbox.profile2
-rw-r--r--etc/profile-m-z/warzone2100.profile2
-rw-r--r--etc/profile-m-z/wine.profile10
-rw-r--r--etc/profile-m-z/wireshark.profile16
-rw-r--r--etc/profile-m-z/xed.profile10
-rw-r--r--etc/profile-m-z/xfburn.profile6
-rw-r--r--etc/profile-m-z/xfce4-mixer.profile2
-rw-r--r--etc/profile-m-z/xfce4-screenshooter.profile2
-rw-r--r--etc/profile-m-z/xmr-stak.profile2
-rw-r--r--etc/profile-m-z/xplayer.profile8
-rw-r--r--etc/profile-m-z/xpra.profile6
-rw-r--r--etc/profile-m-z/xreader.profile4
-rw-r--r--etc/profile-m-z/xviewer.profile8
-rw-r--r--etc/profile-m-z/yelp.profile6
-rw-r--r--etc/profile-m-z/youtube.profile4
-rw-r--r--etc/profile-m-z/youtubemusic-nativefier.profile6
-rw-r--r--etc/profile-m-z/ytmdesktop.profile4
-rw-r--r--etc/profile-m-z/zeal.profile2
115 files changed, 475 insertions, 231 deletions
diff --git a/etc/profile-m-z/PCSX2.profile b/etc/profile-m-z/PCSX2.profile
index e75de80ac..a6a9ba6bc 100644
--- a/etc/profile-m-z/PCSX2.profile
+++ b/etc/profile-m-z/PCSX2.profile
@@ -40,8 +40,8 @@ notv
40nou2f 40nou2f
41novideo 41novideo
42protocol unix,netlink 42protocol unix,netlink
43#seccomp - breaks loading with no logs 43#seccomp # breaks loading with no logs
44#tracelog - 32/64 bit incompatibility 44#tracelog # 32/64 bit incompatibility
45 45
46private-bin PCSX2 46private-bin PCSX2
47private-cache 47private-cache
diff --git a/etc/profile-m-z/QMediathekView.profile b/etc/profile-m-z/QMediathekView.profile
index 0e18b3cdf..dd5639268 100644
--- a/etc/profile-m-z/QMediathekView.profile
+++ b/etc/profile-m-z/QMediathekView.profile
@@ -57,7 +57,7 @@ include whitelist-var-common.inc
57apparmor 57apparmor
58caps.drop all 58caps.drop all
59netfilter 59netfilter
60# no3d 60#no3d
61nodvd 61nodvd
62nogroups 62nogroups
63noinput 63noinput
@@ -81,5 +81,5 @@ private-tmp
81dbus-user none 81dbus-user none
82dbus-system none 82dbus-system none
83 83
84#memory-deny-write-execute - breaks on Arch (see issue #1803) 84#memory-deny-write-execute # breaks on Arch (see issue #1803)
85restrict-namespaces 85restrict-namespaces
diff --git a/etc/profile-m-z/Viber.profile b/etc/profile-m-z/Viber.profile
index 34d500bb1..fe1f9b877 100644
--- a/etc/profile-m-z/Viber.profile
+++ b/etc/profile-m-z/Viber.profile
@@ -35,4 +35,4 @@ private-bin awk,bash,dig,sh,Viber
35private-etc @tls-ca,@x11,mailcap,proxychains.conf 35private-etc @tls-ca,@x11,mailcap,proxychains.conf
36private-tmp 36private-tmp
37 37
38# restrict-namespaces 38#restrict-namespaces
diff --git a/etc/profile-m-z/Xephyr.profile b/etc/profile-m-z/Xephyr.profile
index 0c3d4c1da..aae1808dd 100644
--- a/etc/profile-m-z/Xephyr.profile
+++ b/etc/profile-m-z/Xephyr.profile
@@ -25,7 +25,7 @@ nogroups
25noinput 25noinput
26nonewprivs 26nonewprivs
27# In noroot mode, Xephyr cannot create a socket in the real /tmp/.X11-unix. 27# In noroot mode, Xephyr cannot create a socket in the real /tmp/.X11-unix.
28# noroot 28#noroot
29nosound 29nosound
30notv 30notv
31nou2f 31nou2f
@@ -35,10 +35,10 @@ seccomp
35disable-mnt 35disable-mnt
36# using a private home directory 36# using a private home directory
37private 37private
38# private-bin sh,Xephyr,xkbcomp 38#private-bin sh,Xephyr,xkbcomp
39# private-bin bash,cat,ls,sh,strace,Xephyr,xkbcomp 39#private-bin bash,cat,ls,sh,strace,Xephyr,xkbcomp
40private-dev 40private-dev
41# private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,nsswitch.conf,resolv.conf 41#private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,nsswitch.conf,resolv.conf
42#private-tmp 42#private-tmp
43 43
44restrict-namespaces 44restrict-namespaces
diff --git a/etc/profile-m-z/Xvfb.profile b/etc/profile-m-z/Xvfb.profile
index 2bb9f171a..052ea520d 100644
--- a/etc/profile-m-z/Xvfb.profile
+++ b/etc/profile-m-z/Xvfb.profile
@@ -39,8 +39,8 @@ seccomp
39disable-mnt 39disable-mnt
40# using a private home directory 40# using a private home directory
41private 41private
42# private-bin sh,xkbcomp,Xvfb 42#private-bin sh,xkbcomp,Xvfb
43# private-bin bash,cat,ls,sh,strace,xkbcomp,Xvfb 43#private-bin bash,cat,ls,sh,strace,xkbcomp,Xvfb
44private-dev 44private-dev
45private-etc gai.conf,host.conf 45private-etc gai.conf,host.conf
46private-tmp 46private-tmp
diff --git a/etc/profile-m-z/makepkg.profile b/etc/profile-m-z/makepkg.profile
index 266d00395..b6afbad59 100644
--- a/etc/profile-m-z/makepkg.profile
+++ b/etc/profile-m-z/makepkg.profile
@@ -14,8 +14,8 @@ blacklist ${RUNUSER}/wayland-*
14# for potential issues and their solutions when Firejailing makepkg 14# for potential issues and their solutions when Firejailing makepkg
15 15
16# This profile could be significantly strengthened by adding the following to makepkg.local 16# This profile could be significantly strengthened by adding the following to makepkg.local
17# whitelist ${HOME}/<Your Build Folder> 17#whitelist ${HOME}/<Your Build Folder>
18# whitelist ${HOME}/.gnupg 18#whitelist ${HOME}/.gnupg
19 19
20# Enable severely restricted access to ${HOME}/.gnupg 20# Enable severely restricted access to ${HOME}/.gnupg
21noblacklist ${HOME}/.gnupg 21noblacklist ${HOME}/.gnupg
diff --git a/etc/profile-m-z/microsoft-edge-beta.profile b/etc/profile-m-z/microsoft-edge-beta.profile
index 6843c11c7..e07bbe6e5 100644
--- a/etc/profile-m-z/microsoft-edge-beta.profile
+++ b/etc/profile-m-z/microsoft-edge-beta.profile
@@ -14,10 +14,7 @@ mkdir ${HOME}/.cache/microsoft-edge-beta
14mkdir ${HOME}/.config/microsoft-edge-beta 14mkdir ${HOME}/.config/microsoft-edge-beta
15whitelist ${HOME}/.cache/microsoft-edge-beta 15whitelist ${HOME}/.cache/microsoft-edge-beta
16whitelist ${HOME}/.config/microsoft-edge-beta 16whitelist ${HOME}/.config/microsoft-edge-beta
17
18whitelist /opt/microsoft/msedge-beta 17whitelist /opt/microsoft/msedge-beta
19# private-opt might break the file-copy-limit, see #5307
20#private-opt microsoft
21 18
22# Redirect 19# Redirect
23include chromium-common.profile 20include chromium-common.profile
diff --git a/etc/profile-m-z/midori.profile b/etc/profile-m-z/midori.profile
index d1655fabb..fcc4845df 100644
--- a/etc/profile-m-z/midori.profile
+++ b/etc/profile-m-z/midori.profile
@@ -13,8 +13,8 @@ noblacklist ${HOME}/.cache/midori
13noblacklist ${HOME}/.config/midori 13noblacklist ${HOME}/.config/midori
14noblacklist ${HOME}/.local/share/midori 14noblacklist ${HOME}/.local/share/midori
15noblacklist ${HOME}/.local/share/pki 15noblacklist ${HOME}/.local/share/pki
16# noblacklist ${HOME}/.local/share/webkit 16#noblacklist ${HOME}/.local/share/webkit
17# noblacklist ${HOME}/.local/share/webkitgtk 17#noblacklist ${HOME}/.local/share/webkitgtk
18noblacklist ${HOME}/.pki 18noblacklist ${HOME}/.pki
19 19
20noblacklist ${HOME}/.cache/gnome-mplayer 20noblacklist ${HOME}/.cache/gnome-mplayer
@@ -54,7 +54,7 @@ caps.drop all
54netfilter 54netfilter
55nodvd 55nodvd
56nonewprivs 56nonewprivs
57# noroot - problems on Ubuntu 14.04 57#noroot # problems on Ubuntu 14.04
58notv 58notv
59protocol unix,inet,inet6,netlink 59protocol unix,inet,inet6,netlink
60seccomp 60seccomp
diff --git a/etc/profile-m-z/mocp.profile b/etc/profile-m-z/mocp.profile
index 2ba03ec97..0a5e4255a 100644
--- a/etc/profile-m-z/mocp.profile
+++ b/etc/profile-m-z/mocp.profile
@@ -10,15 +10,24 @@ include globals.local
10noblacklist ${HOME}/.moc 10noblacklist ${HOME}/.moc
11noblacklist ${MUSIC} 11noblacklist ${MUSIC}
12 12
13blacklist /tmp/.X11-unix
14blacklist ${RUNUSER}/wayland-*
15
13include disable-common.inc 16include disable-common.inc
14include disable-devel.inc 17include disable-devel.inc
15include disable-exec.inc 18include disable-exec.inc
16include disable-interpreters.inc 19include disable-interpreters.inc
20include disable-proc.inc
17include disable-programs.inc 21include disable-programs.inc
18include disable-xdg.inc 22include disable-xdg.inc
19 23
20include whitelist-usr-share-common.inc 24mkdir ${HOME}/.moc
25whitelist ${HOME}/.moc
26whitelist ${MUSIC}
27include whitelist-common.inc
28include whitelist-run-common.inc
21include whitelist-runuser-common.inc 29include whitelist-runuser-common.inc
30include whitelist-usr-share-common.inc
22include whitelist-var-common.inc 31include whitelist-var-common.inc
23 32
24apparmor 33apparmor
@@ -30,18 +39,20 @@ nodvd
30nogroups 39nogroups
31noinput 40noinput
32nonewprivs 41nonewprivs
42noprinters
33noroot 43noroot
34notv 44notv
35nou2f 45nou2f
36novideo 46novideo
37protocol unix,inet,inet6,netlink 47protocol unix,inet,inet6
38seccomp 48seccomp
49seccomp.block-secondary
39tracelog 50tracelog
40 51
41private-bin mocp 52private-bin mocp
42private-cache 53private-cache
43private-dev 54private-dev
44private-etc @tls-ca 55private-etc @network,@tls-ca
45private-tmp 56private-tmp
46 57
47dbus-user none 58dbus-user none
diff --git a/etc/profile-m-z/mpDris2.profile b/etc/profile-m-z/mpDris2.profile
index a9631733c..ab1c93eaf 100644
--- a/etc/profile-m-z/mpDris2.profile
+++ b/etc/profile-m-z/mpDris2.profile
@@ -52,7 +52,11 @@ private-etc
52private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotify.so.*,libpython*,python2*,python3* 52private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotify.so.*,libpython*,python2*,python3*
53private-tmp 53private-tmp
54 54
55#memory-deny-write-execute - breaks on Arch (see issue #1803) 55dbus-user filter
56dbus-user.own org.mpris.MediaPlayer2.mpd
57dbus-system none
58
59#memory-deny-write-execute # breaks on Arch (see issue #1803)
56 60
57read-only ${HOME} 61read-only ${HOME}
58restrict-namespaces 62restrict-namespaces
diff --git a/etc/profile-m-z/mpd.profile b/etc/profile-m-z/mpd.profile
index d1c4bd24f..6bf881faf 100644
--- a/etc/profile-m-z/mpd.profile
+++ b/etc/profile-m-z/mpd.profile
@@ -41,4 +41,8 @@ private-cache
41private-dev 41private-dev
42private-tmp 42private-tmp
43 43
44dbus-user filter
45dbus-user.talk org.mpris.MediaPlayer2.mpd
46dbus-system none
47
44restrict-namespaces 48restrict-namespaces
diff --git a/etc/profile-m-z/mplayer.profile b/etc/profile-m-z/mplayer.profile
index 7d9ff39ad..bdb9fa51d 100644
--- a/etc/profile-m-z/mplayer.profile
+++ b/etc/profile-m-z/mplayer.profile
@@ -24,9 +24,9 @@ include whitelist-var-common.inc
24 24
25apparmor 25apparmor
26caps.drop all 26caps.drop all
27# net none - mplayer can be used for streaming. 27#net none # mplayer can be used for streaming.
28netfilter 28netfilter
29# nogroups 29#nogroups
30noinput 30noinput
31nonewprivs 31nonewprivs
32noroot 32noroot
diff --git a/etc/profile-m-z/mullvad-browser.profile b/etc/profile-m-z/mullvad-browser.profile
index b9eb57743..6706386aa 100644
--- a/etc/profile-m-z/mullvad-browser.profile
+++ b/etc/profile-m-z/mullvad-browser.profile
@@ -73,13 +73,12 @@ novideo
73protocol unix,inet,inet6 73protocol unix,inet,inet6
74seccomp !chroot 74seccomp !chroot
75seccomp.block-secondary 75seccomp.block-secondary
76#tracelog - may cause issues, see #1930 76#tracelog # may cause issues, see #1930
77 77
78disable-mnt 78disable-mnt
79private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mullvad-browser,mv,python*,rm,sed,sh,tail,tar,tclsh,test,update-desktop-database,xmessage,xz,zenity 79private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mullvad-browser,mv,python*,rm,sed,sh,tail,tar,tclsh,test,update-desktop-database,xmessage,xz,zenity
80private-dev 80private-dev
81private-etc @tls-ca 81private-etc @tls-ca
82#private-opt mullvad-browser - can cause slow startup
83private-tmp 82private-tmp
84 83
85blacklist ${PATH}/curl 84blacklist ${PATH}/curl
diff --git a/etc/profile-m-z/multimc5.profile b/etc/profile-m-z/multimc5.profile
index 73107680c..41f82bd07 100644
--- a/etc/profile-m-z/multimc5.profile
+++ b/etc/profile-m-z/multimc5.profile
@@ -41,12 +41,12 @@ notv
41nou2f 41nou2f
42novideo 42novideo
43protocol unix,inet,inet6 43protocol unix,inet,inet6
44# seccomp 44#seccomp
45 45
46disable-mnt 46disable-mnt
47# private-bin works, but causes weirdness 47# private-bin works, but causes weirdness
48# private-bin apt-file,awk,bash,chmod,dirname,dnf,grep,java,kdialog,ldd,mkdir,multimc5,pfl,pkgfile,readlink,sort,valgrind,which,yum,zenity,zypper 48#private-bin apt-file,awk,bash,chmod,dirname,dnf,grep,java,kdialog,ldd,mkdir,multimc5,pfl,pkgfile,readlink,sort,valgrind,which,yum,zenity,zypper
49private-dev 49private-dev
50private-tmp 50private-tmp
51 51
52# restrict-namespaces 52#restrict-namespaces
diff --git a/etc/profile-m-z/mumble.profile b/etc/profile-m-z/mumble.profile
index ef09e6fca..52dc46800 100644
--- a/etc/profile-m-z/mumble.profile
+++ b/etc/profile-m-z/mumble.profile
@@ -41,5 +41,5 @@ disable-mnt
41private-bin mumble 41private-bin mumble
42private-tmp 42private-tmp
43 43
44#memory-deny-write-execute - breaks on Arch (see issue #1803) 44#memory-deny-write-execute # breaks on Arch (see issue #1803)
45restrict-namespaces 45restrict-namespaces
diff --git a/etc/profile-m-z/musescore.profile b/etc/profile-m-z/musescore.profile
index ca951f70c..b62674ad6 100644
--- a/etc/profile-m-z/musescore.profile
+++ b/etc/profile-m-z/musescore.profile
@@ -37,7 +37,7 @@ protocol unix,inet,inet6
37seccomp !chroot 37seccomp !chroot
38tracelog 38tracelog
39 39
40# private-bin musescore,mscore 40#private-bin musescore,mscore
41private-tmp 41private-tmp
42 42
43# restrict-namespaces 43#restrict-namespaces
diff --git a/etc/profile-m-z/musixmatch.profile b/etc/profile-m-z/musixmatch.profile
index 7ce7fbd19..d67cd24bd 100644
--- a/etc/profile-m-z/musixmatch.profile
+++ b/etc/profile-m-z/musixmatch.profile
@@ -35,4 +35,4 @@ disable-mnt
35private-dev 35private-dev
36private-etc @tls-ca 36private-etc @tls-ca
37 37
38# restrict-namespaces 38#restrict-namespaces
diff --git a/etc/profile-m-z/mutt.profile b/etc/profile-m-z/mutt.profile
index 288ffedf1..ab1e0ab02 100644
--- a/etc/profile-m-z/mutt.profile
+++ b/etc/profile-m-z/mutt.profile
@@ -13,6 +13,7 @@ noblacklist ${DOCUMENTS}
13noblacklist ${HOME}/.Mail 13noblacklist ${HOME}/.Mail
14noblacklist ${HOME}/.bogofilter 14noblacklist ${HOME}/.bogofilter
15noblacklist ${HOME}/.cache/mutt 15noblacklist ${HOME}/.cache/mutt
16noblacklist ${HOME}/.config/msmtp
16noblacklist ${HOME}/.config/mutt 17noblacklist ${HOME}/.config/mutt
17noblacklist ${HOME}/.config/nano 18noblacklist ${HOME}/.config/nano
18noblacklist ${HOME}/.elinks 19noblacklist ${HOME}/.elinks
@@ -35,6 +36,7 @@ noblacklist ${HOME}/Mail
35noblacklist ${HOME}/mail 36noblacklist ${HOME}/mail
36noblacklist ${HOME}/postponed 37noblacklist ${HOME}/postponed
37noblacklist ${HOME}/sent 38noblacklist ${HOME}/sent
39noblacklist /etc/msmtprc
38 40
39blacklist /tmp/.X11-unix 41blacklist /tmp/.X11-unix
40blacklist ${RUNUSER}/wayland-* 42blacklist ${RUNUSER}/wayland-*
@@ -69,6 +71,7 @@ whitelist ${DOWNLOADS}
69whitelist ${HOME}/.Mail 71whitelist ${HOME}/.Mail
70whitelist ${HOME}/.bogofilter 72whitelist ${HOME}/.bogofilter
71whitelist ${HOME}/.cache/mutt 73whitelist ${HOME}/.cache/mutt
74whitelist ${HOME}/.config/msmtp
72whitelist ${HOME}/.config/mutt 75whitelist ${HOME}/.config/mutt
73whitelist ${HOME}/.config/nano 76whitelist ${HOME}/.config/nano
74whitelist ${HOME}/.elinks 77whitelist ${HOME}/.elinks
@@ -121,10 +124,10 @@ seccomp
121seccomp.block-secondary 124seccomp.block-secondary
122tracelog 125tracelog
123 126
124# disable-mnt 127#disable-mnt
125private-cache 128private-cache
126private-dev 129private-dev
127private-etc @tls-ca,@x11,Mutt,Muttrc,Muttrc.d,gai.conf,gnupg,gnutls,hosts.conf,mail,mailname,nntpserver,terminfo 130private-etc @tls-ca,@x11,msmtprc,Mutt,Muttrc,Muttrc.d,gai.conf,gnupg,gnutls,hosts.conf,mail,mailname,nntpserver,terminfo
128private-tmp 131private-tmp
129writable-run-user 132writable-run-user
130writable-var 133writable-var
diff --git a/etc/profile-m-z/nano.profile b/etc/profile-m-z/nano.profile
index 6b4074dfb..ba63b2067 100644
--- a/etc/profile-m-z/nano.profile
+++ b/etc/profile-m-z/nano.profile
@@ -41,7 +41,7 @@ seccomp
41tracelog 41tracelog
42x11 none 42x11 none
43 43
44# disable-mnt 44#disable-mnt
45private-bin nano,rnano 45private-bin nano,rnano
46private-cache 46private-cache
47private-dev 47private-dev
diff --git a/etc/profile-m-z/ncdu.profile b/etc/profile-m-z/ncdu.profile
index 09687199b..5cfd8290a 100644
--- a/etc/profile-m-z/ncdu.profile
+++ b/etc/profile-m-z/ncdu.profile
@@ -29,7 +29,7 @@ seccomp
29x11 none 29x11 none
30 30
31private-dev 31private-dev
32# private-tmp 32#private-tmp
33 33
34dbus-user none 34dbus-user none
35dbus-system none 35dbus-system none
diff --git a/etc/profile-m-z/neochat.profile b/etc/profile-m-z/neochat.profile
index 80e28a5e5..d1a36e079 100644
--- a/etc/profile-m-z/neochat.profile
+++ b/etc/profile-m-z/neochat.profile
@@ -45,7 +45,7 @@ nosound
45notv 45notv
46nou2f 46nou2f
47novideo 47novideo
48protocol unix,inet,inet6 48protocol unix,inet,inet6,netlink
49seccomp 49seccomp
50seccomp.block-secondary 50seccomp.block-secondary
51tracelog 51tracelog
diff --git a/etc/profile-m-z/neomutt.profile b/etc/profile-m-z/neomutt.profile
index 5bd1e7cba..b15e98424 100644
--- a/etc/profile-m-z/neomutt.profile
+++ b/etc/profile-m-z/neomutt.profile
@@ -10,6 +10,7 @@ include globals.local
10noblacklist ${DOCUMENTS} 10noblacklist ${DOCUMENTS}
11noblacklist ${HOME}/.Mail 11noblacklist ${HOME}/.Mail
12noblacklist ${HOME}/.bogofilter 12noblacklist ${HOME}/.bogofilter
13noblacklist ${HOME}/.config/msmtp
13noblacklist ${HOME}/.config/mutt 14noblacklist ${HOME}/.config/mutt
14noblacklist ${HOME}/.config/nano 15noblacklist ${HOME}/.config/nano
15noblacklist ${HOME}/.config/neomutt 16noblacklist ${HOME}/.config/neomutt
@@ -34,6 +35,7 @@ noblacklist ${HOME}/Mail
34noblacklist ${HOME}/mail 35noblacklist ${HOME}/mail
35noblacklist ${HOME}/postponed 36noblacklist ${HOME}/postponed
36noblacklist ${HOME}/sent 37noblacklist ${HOME}/sent
38noblacklist /etc/msmtprc
37noblacklist /var/mail 39noblacklist /var/mail
38noblacklist /var/spool/mail 40noblacklist /var/spool/mail
39 41
@@ -59,6 +61,7 @@ whitelist ${DOCUMENTS}
59whitelist ${DOWNLOADS} 61whitelist ${DOWNLOADS}
60whitelist ${HOME}/.Mail 62whitelist ${HOME}/.Mail
61whitelist ${HOME}/.bogofilter 63whitelist ${HOME}/.bogofilter
64whitelist ${HOME}/.config/msmtp
62whitelist ${HOME}/.config/mutt 65whitelist ${HOME}/.config/mutt
63whitelist ${HOME}/.config/nano 66whitelist ${HOME}/.config/nano
64whitelist ${HOME}/.config/neomutt 67whitelist ${HOME}/.config/neomutt
@@ -113,10 +116,10 @@ seccomp
113seccomp.block-secondary 116seccomp.block-secondary
114tracelog 117tracelog
115 118
116# disable-mnt 119#disable-mnt
117private-cache 120private-cache
118private-dev 121private-dev
119private-etc @tls-ca,@x11,Mutt,Muttrc,Muttrc.d,gnupg,hosts.conf,mail,mailname,neomuttrc,neomuttrc.d,nntpserver 122private-etc @tls-ca,@x11,msmtprc,Mutt,Muttrc,Muttrc.d,gnupg,hosts.conf,mail,mailname,neomuttrc,neomuttrc.d,nntpserver
120private-tmp 123private-tmp
121writable-run-user 124writable-run-user
122writable-var 125writable-var
diff --git a/etc/profile-m-z/nicotine.profile b/etc/profile-m-z/nicotine.profile
index 568899eea..d1680e666 100644
--- a/etc/profile-m-z/nicotine.profile
+++ b/etc/profile-m-z/nicotine.profile
@@ -43,7 +43,6 @@ noinput
43nonewprivs 43nonewprivs
44noprinters 44noprinters
45noroot 45noroot
46nosound
47notv 46notv
48nou2f 47nou2f
49novideo 48novideo
@@ -57,7 +56,9 @@ private-cache
57private-dev 56private-dev
58private-tmp 57private-tmp
59 58
60dbus-user none 59dbus-user filter
60dbus-user.own org.nicotine_plus.Nicotine
61dbus-user.talk ca.desrt.dconf
61dbus-system none 62dbus-system none
62 63
63restrict-namespaces 64restrict-namespaces
diff --git a/etc/profile-m-z/nitroshare.profile b/etc/profile-m-z/nitroshare.profile
index 7a97ca825..254eb789a 100644
--- a/etc/profile-m-z/nitroshare.profile
+++ b/etc/profile-m-z/nitroshare.profile
@@ -42,11 +42,11 @@ private-bin awk,grep,nitroshare,nitroshare-cli,nitroshare-nmh,nitroshare-send,ni
42private-cache 42private-cache
43private-dev 43private-dev
44private-etc @tls-ca,@x11 44private-etc @tls-ca,@x11
45# private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare 45#private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare
46private-tmp 46private-tmp
47 47
48# dbus-user none 48#dbus-user none
49# dbus-system none 49#dbus-system none
50 50
51# memory-deny-write-execute 51#memory-deny-write-execute
52restrict-namespaces 52restrict-namespaces
diff --git a/etc/profile-m-z/nodejs-common.profile b/etc/profile-m-z/nodejs-common.profile
index 4c463521c..f301196c6 100644
--- a/etc/profile-m-z/nodejs-common.profile
+++ b/etc/profile-m-z/nodejs-common.profile
@@ -7,7 +7,7 @@ include nodejs-common.local
7# added by caller profile 7# added by caller profile
8#include globals.local 8#include globals.local
9 9
10# Note: gulp, node-gyp, npm, npx, semver and yarn are all node scripts 10# Note: gulp, node-gyp, npm, npx, pnpm, pnpx, semver and yarn are all node scripts
11# using the `#!/usr/bin/env node` shebang. By sandboxing node the full 11# using the `#!/usr/bin/env node` shebang. By sandboxing node the full
12# node.js stack will be firejailed. The only exception is nvm, which is implemented 12# node.js stack will be firejailed. The only exception is nvm, which is implemented
13# as a sourced shell function, not an executable binary. Hence it is not 13# as a sourced shell function, not an executable binary. Hence it is not
@@ -22,6 +22,7 @@ ignore read-only ${HOME}/.npmrc
22ignore read-only ${HOME}/.nvm 22ignore read-only ${HOME}/.nvm
23ignore read-only ${HOME}/.yarnrc 23ignore read-only ${HOME}/.yarnrc
24 24
25noblacklist ${HOME}/.local/share/pnpm
25noblacklist ${HOME}/.node-gyp 26noblacklist ${HOME}/.node-gyp
26noblacklist ${HOME}/.npm 27noblacklist ${HOME}/.npm
27noblacklist ${HOME}/.npmrc 28noblacklist ${HOME}/.npmrc
@@ -43,6 +44,7 @@ include disable-xdg.inc
43 44
44# If you want whitelisting, change ${HOME}/Projects below to your node projects directory 45# If you want whitelisting, change ${HOME}/Projects below to your node projects directory
45# and add the next lines to your nodejs-common.local. 46# and add the next lines to your nodejs-common.local.
47#mkdir ${HOME}/.local/share/pnpm
46#mkdir ${HOME}/.node-gyp 48#mkdir ${HOME}/.node-gyp
47#mkdir ${HOME}/.npm 49#mkdir ${HOME}/.npm
48#mkdir ${HOME}/.npm-packages 50#mkdir ${HOME}/.npm-packages
@@ -52,6 +54,7 @@ include disable-xdg.inc
52#mkdir ${HOME}/.yarn-config 54#mkdir ${HOME}/.yarn-config
53#mkdir ${HOME}/.yarncache 55#mkdir ${HOME}/.yarncache
54#mkfile ${HOME}/.yarnrc 56#mkfile ${HOME}/.yarnrc
57#whitelist ${HOME}/.local/share/pnpm
55#whitelist ${HOME}/.node-gyp 58#whitelist ${HOME}/.node-gyp
56#whitelist ${HOME}/.npm 59#whitelist ${HOME}/.npm
57#whitelist ${HOME}/.npm-packages 60#whitelist ${HOME}/.npm-packages
diff --git a/etc/profile-m-z/notable.profile b/etc/profile-m-z/notable.profile
index 9fbbf94c0..4bd3d45ac 100644
--- a/etc/profile-m-z/notable.profile
+++ b/etc/profile-m-z/notable.profile
@@ -14,11 +14,12 @@ include globals.local
14noblacklist ${HOME}/.config/Notable 14noblacklist ${HOME}/.config/Notable
15noblacklist ${HOME}/.notable 15noblacklist ${HOME}/.notable
16 16
17whitelist /opt/Notable
18
17net none 19net none
18nosound 20nosound
19 21
20?HAS_APPIMAGE: ignore private-dev 22?HAS_APPIMAGE: ignore private-dev
21private-opt Notable
22 23
23dbus-user filter 24dbus-user filter
24dbus-user.talk ca.desrt.dconf 25dbus-user.talk ca.desrt.dconf
diff --git a/etc/profile-m-z/nuclear.profile b/etc/profile-m-z/nuclear.profile
index dec48c827..6d1e3cd8a 100644
--- a/etc/profile-m-z/nuclear.profile
+++ b/etc/profile-m-z/nuclear.profile
@@ -14,12 +14,12 @@ include disable-shell.inc
14 14
15mkdir ${HOME}/.config/nuclear 15mkdir ${HOME}/.config/nuclear
16whitelist ${HOME}/.config/nuclear 16whitelist ${HOME}/.config/nuclear
17whitelist /opt/nuclear
17 18
18no3d 19no3d
19 20
20# private-bin nuclear 21#private-bin nuclear
21private-etc @tls-ca,@x11,host.conf,mime.types 22private-etc @tls-ca,@x11,host.conf,mime.types
22private-opt nuclear
23 23
24# Redirect 24# Redirect
25include electron-common.profile 25include electron-common.profile
diff --git a/etc/profile-m-z/ocenaudio.profile b/etc/profile-m-z/ocenaudio.profile
index 830483bd4..3fe5a4712 100644
--- a/etc/profile-m-z/ocenaudio.profile
+++ b/etc/profile-m-z/ocenaudio.profile
@@ -25,6 +25,7 @@ whitelist ${HOME}/.cache/ocenaudio
25whitelist ${HOME}/.local/share/ocenaudio 25whitelist ${HOME}/.local/share/ocenaudio
26whitelist ${DOWNLOADS} 26whitelist ${DOWNLOADS}
27whitelist ${MUSIC} 27whitelist ${MUSIC}
28whitelist /opt/ocenaudio
28include whitelist-common.inc 29include whitelist-common.inc
29include whitelist-run-common.inc 30include whitelist-run-common.inc
30include whitelist-runuser-common.inc 31include whitelist-runuser-common.inc
@@ -54,7 +55,6 @@ private-bin ocenaudio,ocenvst
54private-cache 55private-cache
55private-dev 56private-dev
56private-etc @tls-ca,@x11,mime.types 57private-etc @tls-ca,@x11,mime.types
57private-opt ocenaudio
58private-tmp 58private-tmp
59 59
60dbus-user none 60dbus-user none
diff --git a/etc/profile-m-z/okular.profile b/etc/profile-m-z/okular.profile
index 8e0758c37..ac573dc47 100644
--- a/etc/profile-m-z/okular.profile
+++ b/etc/profile-m-z/okular.profile
@@ -44,7 +44,7 @@ include whitelist-var-common.inc
44apparmor 44apparmor
45caps.drop all 45caps.drop all
46machine-id 46machine-id
47# net none 47#net none
48netfilter 48netfilter
49nodvd 49nodvd
50nogroups 50nogroups
@@ -62,12 +62,13 @@ tracelog
62private-bin kbuildsycoca4,kdeinit4,lpr,okular,unar,unrar 62private-bin kbuildsycoca4,kdeinit4,lpr,okular,unar,unrar
63private-dev 63private-dev
64private-etc @x11,cups 64private-etc @x11,cups
65# private-tmp - on KDE we need access to the real /tmp for data exchange with email clients 65# on KDE we need access to the real /tmp for data exchange with email clients
66#private-tmp
66 67
67# dbus-user none 68#dbus-user none
68# dbus-system none 69#dbus-system none
69 70
70# memory-deny-write-execute 71#memory-deny-write-execute
71 72
72restrict-namespaces 73restrict-namespaces
73join-or-start okular 74join-or-start okular
diff --git a/etc/profile-m-z/onionshare-gui.profile b/etc/profile-m-z/onionshare-gui.profile
index 47ac9fc05..3338cadf5 100644
--- a/etc/profile-m-z/onionshare-gui.profile
+++ b/etc/profile-m-z/onionshare-gui.profile
@@ -50,7 +50,7 @@ novideo
50protocol unix,inet,inet6 50protocol unix,inet,inet6
51seccomp 51seccomp
52seccomp.block-secondary 52seccomp.block-secondary
53#tracelog - may cause issues, see #1930 53#tracelog # may cause issues, see #1930
54 54
55disable-mnt 55disable-mnt
56private-bin onionshare,onionshare-cli,onionshare-gui,python*,tor* 56private-bin onionshare,onionshare-cli,onionshare-gui,python*,tor*
diff --git a/etc/profile-m-z/openclonk.profile b/etc/profile-m-z/openclonk.profile
index 3449ac686..e10f6011b 100644
--- a/etc/profile-m-z/openclonk.profile
+++ b/etc/profile-m-z/openclonk.profile
@@ -24,7 +24,7 @@ include whitelist-var-common.inc
24apparmor 24apparmor
25caps.drop all 25caps.drop all
26ipc-namespace 26ipc-namespace
27# net none - networked game 27#net none # networked game
28netfilter 28netfilter
29nodvd 29nodvd
30nogroups 30nogroups
diff --git a/etc/profile-m-z/orage.profile b/etc/profile-m-z/orage.profile
index fa16c05e2..c4849b958 100644
--- a/etc/profile-m-z/orage.profile
+++ b/etc/profile-m-z/orage.profile
@@ -24,7 +24,7 @@ nogroups
24noinput 24noinput
25nonewprivs 25nonewprivs
26noroot 26noroot
27# nosound - calendar application, It must be able to play sound to wake you up. 27#nosound # calendar application, It must be able to play sound to wake you up.
28notv 28notv
29nou2f 29nou2f
30novideo 30novideo
diff --git a/etc/profile-m-z/otter-browser.profile b/etc/profile-m-z/otter-browser.profile
index a1c0462ba..76d4a2c52 100644
--- a/etc/profile-m-z/otter-browser.profile
+++ b/etc/profile-m-z/otter-browser.profile
@@ -57,4 +57,4 @@ private-tmp
57 57
58dbus-system none 58dbus-system none
59 59
60# restrict-namespaces 60#restrict-namespaces
diff --git a/etc/profile-m-z/palemoon.profile b/etc/profile-m-z/palemoon.profile
index ab4e24595..8917a9bc5 100644
--- a/etc/profile-m-z/palemoon.profile
+++ b/etc/profile-m-z/palemoon.profile
@@ -12,6 +12,7 @@ mkdir ${HOME}/.cache/moonchild productions/pale moon
12mkdir ${HOME}/.moonchild productions 12mkdir ${HOME}/.moonchild productions
13whitelist ${HOME}/.cache/moonchild productions/pale moon 13whitelist ${HOME}/.cache/moonchild productions/pale moon
14whitelist ${HOME}/.moonchild productions 14whitelist ${HOME}/.moonchild productions
15whitelist /opt/palemoon
15whitelist /usr/share/moonchild productions 16whitelist /usr/share/moonchild productions
16whitelist /usr/share/palemoon 17whitelist /usr/share/palemoon
17 18
@@ -22,7 +23,6 @@ ignore seccomp
22#private-bin palemoon 23#private-bin palemoon
23# private-etc must first be enabled in firefox-common.profile 24# private-etc must first be enabled in firefox-common.profile
24#private-etc palemoon 25#private-etc palemoon
25#private-opt palemoon
26 26
27restrict-namespaces 27restrict-namespaces
28ignore restrict-namespaces 28ignore restrict-namespaces
diff --git a/etc/profile-m-z/patch.profile b/etc/profile-m-z/patch.profile
index 5a0f69f79..23e734b43 100644
--- a/etc/profile-m-z/patch.profile
+++ b/etc/profile-m-z/patch.profile
@@ -10,6 +10,7 @@ include globals.local
10blacklist ${RUNUSER} 10blacklist ${RUNUSER}
11 11
12noblacklist ${DOCUMENTS} 12noblacklist ${DOCUMENTS}
13noblacklist ${PATH}/patch
13 14
14include disable-common.inc 15include disable-common.inc
15include disable-devel.inc 16include disable-devel.inc
diff --git a/etc/profile-m-z/pavucontrol-qt.profile b/etc/profile-m-z/pavucontrol-qt.profile
index f96ba14d2..79ed8777d 100644
--- a/etc/profile-m-z/pavucontrol-qt.profile
+++ b/etc/profile-m-z/pavucontrol-qt.profile
@@ -9,8 +9,9 @@ include pavucontrol-qt.local
9 9
10noblacklist ${HOME}/.config/pavucontrol-qt 10noblacklist ${HOME}/.config/pavucontrol-qt
11 11
12mkdir ${HOME}/.config/pavucontrol-qt 12# whitelisting in ${HOME} is broken, see #3112
13whitelist ${HOME}/.config/pavucontrol-qt 13#mkdir ${HOME}/.config/pavucontrol-qt
14#whitelist ${HOME}/.config/pavucontrol-qt
14 15
15private-bin pavucontrol-qt 16private-bin pavucontrol-qt
16ignore private-lib 17ignore private-lib
diff --git a/etc/profile-m-z/pidgin.profile b/etc/profile-m-z/pidgin.profile
index a852a2a18..5bc0bd700 100644
--- a/etc/profile-m-z/pidgin.profile
+++ b/etc/profile-m-z/pidgin.profile
@@ -40,7 +40,7 @@ protocol unix,inet,inet6,netlink
40seccomp 40seccomp
41tracelog 41tracelog
42 42
43# private-bin pidgin 43#private-bin pidgin
44private-cache 44private-cache
45private-dev 45private-dev
46private-tmp 46private-tmp
diff --git a/etc/profile-m-z/ping.profile b/etc/profile-m-z/ping.profile
index d563064e1..c3aa0a501 100644
--- a/etc/profile-m-z/ping.profile
+++ b/etc/profile-m-z/ping.profile
@@ -55,7 +55,7 @@ tracelog
55 55
56disable-mnt 56disable-mnt
57private 57private
58#private-bin ping - has mammoth problems with execvp: "No such file or directory" 58#private-bin ping # has mammoth problems with execvp: "No such file or directory"
59private-cache 59private-cache
60private-dev 60private-dev
61private-etc @tls-ca 61private-etc @tls-ca
diff --git a/etc/profile-m-z/pluma.profile b/etc/profile-m-z/pluma.profile
index efcdaa661..6e56208d5 100644
--- a/etc/profile-m-z/pluma.profile
+++ b/etc/profile-m-z/pluma.profile
@@ -21,10 +21,10 @@ include disable-shell.inc
21 21
22include whitelist-var-common.inc 22include whitelist-var-common.inc
23 23
24# apparmor - makes settings immutable 24#apparmor # makes settings immutable
25caps.drop all 25caps.drop all
26machine-id 26machine-id
27# net none - makes settings immutable 27#net none # makes settings immutable
28no3d 28no3d
29nodvd 29nodvd
30nogroups 30nogroups
@@ -45,8 +45,8 @@ private-lib aspell,gconv,libgspell-1.so.*,libreadline.so.*,libtinfo.so.*,pluma
45private-tmp 45private-tmp
46 46
47# makes settings immutable 47# makes settings immutable
48# dbus-user none 48#dbus-user none
49# dbus-system none 49#dbus-system none
50 50
51restrict-namespaces 51restrict-namespaces
52join-or-start pluma 52join-or-start pluma
diff --git a/etc/profile-m-z/plv.profile b/etc/profile-m-z/plv.profile
index 34e18cbd7..38fa01553 100644
--- a/etc/profile-m-z/plv.profile
+++ b/etc/profile-m-z/plv.profile
@@ -53,7 +53,7 @@ writable-var-log
53dbus-user none 53dbus-user none
54dbus-system none 54dbus-system none
55 55
56#memory-deny-write-execute - breaks opening file-chooser 56#memory-deny-write-execute # breaks opening file-chooser
57read-only ${HOME} 57read-only ${HOME}
58read-write ${HOME}/.config/PacmanLogViewer 58read-write ${HOME}/.config/PacmanLogViewer
59read-only /var/log/pacman.log 59read-only /var/log/pacman.log
diff --git a/etc/profile-m-z/pnpm.profile b/etc/profile-m-z/pnpm.profile
new file mode 100644
index 000000000..08f88be43
--- /dev/null
+++ b/etc/profile-m-z/pnpm.profile
@@ -0,0 +1,11 @@
1# Firejail profile for pnpm
2# Description: Fast, disk space efficient package manager
3quiet
4# This file is overwritten after every install/update
5# Persistent local customizations
6include pnpm.local
7# Persistent global definitions
8include globals.local
9
10# Redirect
11include nodejs-common.profile
diff --git a/etc/profile-m-z/pnpx.profile b/etc/profile-m-z/pnpx.profile
new file mode 100644
index 000000000..a99d1232a
--- /dev/null
+++ b/etc/profile-m-z/pnpx.profile
@@ -0,0 +1,11 @@
1# Firejail profile for pnpx
2# Description: Part of the Node.js stack
3quiet
4# This file is overwritten after every install/update
5# Persistent local customizations
6include pnpx.local
7# Persistent global definitions
8include globals.local
9
10# Redirect
11include nodejs-common.profile
diff --git a/etc/profile-m-z/psi-plus.profile b/etc/profile-m-z/psi-plus.profile
index af117c3b5..7a735bba7 100644
--- a/etc/profile-m-z/psi-plus.profile
+++ b/etc/profile-m-z/psi-plus.profile
@@ -43,4 +43,4 @@ disable-mnt
43private-dev 43private-dev
44private-tmp 44private-tmp
45 45
46# restrict-namespaces 46#restrict-namespaces
diff --git a/etc/profile-m-z/psi.profile b/etc/profile-m-z/psi.profile
index a1a0606b9..1417a87c9 100644
--- a/etc/profile-m-z/psi.profile
+++ b/etc/profile-m-z/psi.profile
@@ -62,7 +62,7 @@ novideo
62nou2f 62nou2f
63protocol unix,inet,inet6,netlink 63protocol unix,inet,inet6,netlink
64seccomp !chroot 64seccomp !chroot
65#tracelog - breaks on Arch 65#tracelog # breaks on Arch
66 66
67disable-mnt 67disable-mnt
68# Add the next line to your psi.local to enable GPG support. 68# Add the next line to your psi.local to enable GPG support.
diff --git a/etc/profile-m-z/pycharm-community.profile b/etc/profile-m-z/pycharm-community.profile
index 875b83e8e..fa307fc88 100644
--- a/etc/profile-m-z/pycharm-community.profile
+++ b/etc/profile-m-z/pycharm-community.profile
@@ -34,8 +34,8 @@ nou2f
34novideo 34novideo
35tracelog 35tracelog
36 36
37# private-etc alternatives,fonts,passwd - minimal required to run but will probably break 37# minimum required to run but will probably break the program!
38# program! 38#private-etc alternatives,fonts,passwd
39private-dev 39private-dev
40private-tmp 40private-tmp
41 41
diff --git a/etc/profile-m-z/qbittorrent.profile b/etc/profile-m-z/qbittorrent.profile
index 9605da3ac..ae0a2cdf1 100644
--- a/etc/profile-m-z/qbittorrent.profile
+++ b/etc/profile-m-z/qbittorrent.profile
@@ -55,12 +55,12 @@ seccomp
55 55
56private-bin python*,qbittorrent 56private-bin python*,qbittorrent
57private-dev 57private-dev
58# private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssl,X11,xdg 58#private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssl,X11,xdg
59private-tmp 59private-tmp
60 60
61# See https://github.com/netblue30/firejail/issues/3707 for tray-icon 61# See https://github.com/netblue30/firejail/issues/3707 for tray-icon
62dbus-user none 62dbus-user none
63dbus-system none 63dbus-system none
64 64
65# memory-deny-write-execute - problems on Arch, see #1690 on GitHub repo 65#memory-deny-write-execute # problems on Arch, see #1690 on GitHub repo
66restrict-namespaces 66restrict-namespaces
diff --git a/etc/profile-m-z/qmmp.profile b/etc/profile-m-z/qmmp.profile
index ecd62a7d1..66c8f3238 100644
--- a/etc/profile-m-z/qmmp.profile
+++ b/etc/profile-m-z/qmmp.profile
@@ -18,7 +18,7 @@ include disable-xdg.inc
18 18
19caps.drop all 19caps.drop all
20netfilter 20netfilter
21# no3d 21#no3d
22nogroups 22nogroups
23noinput 23noinput
24nonewprivs 24nonewprivs
diff --git a/etc/profile-m-z/qpdfview.profile b/etc/profile-m-z/qpdfview.profile
index 4caa0917f..784d2fafd 100644
--- a/etc/profile-m-z/qpdfview.profile
+++ b/etc/profile-m-z/qpdfview.profile
@@ -41,7 +41,7 @@ private-dev
41private-tmp 41private-tmp
42 42
43# needs D-Bus when started from a file manager 43# needs D-Bus when started from a file manager
44# dbus-user none 44#dbus-user none
45# dbus-system none 45#dbus-system none
46 46
47restrict-namespaces 47restrict-namespaces
diff --git a/etc/profile-m-z/qtox.profile b/etc/profile-m-z/qtox.profile
index ab0f9425a..20c84c5a8 100644
--- a/etc/profile-m-z/qtox.profile
+++ b/etc/profile-m-z/qtox.profile
@@ -48,5 +48,5 @@ private-tmp
48dbus-user none 48dbus-user none
49dbus-system none 49dbus-system none
50 50
51#memory-deny-write-execute - breaks on Arch (see issue #1803) 51#memory-deny-write-execute # breaks on Arch (see issue #1803)
52restrict-namespaces 52restrict-namespaces
diff --git a/etc/profile-m-z/quassel.profile b/etc/profile-m-z/quassel.profile
index 4589c9e4a..4ec990e95 100644
--- a/etc/profile-m-z/quassel.profile
+++ b/etc/profile-m-z/quassel.profile
@@ -25,4 +25,4 @@ seccomp !chroot
25private-cache 25private-cache
26private-tmp 26private-tmp
27 27
28# restrict-namespaces 28#restrict-namespaces
diff --git a/etc/profile-m-z/quiterss.profile b/etc/profile-m-z/quiterss.profile
index a59f01f85..4102b1ea0 100644
--- a/etc/profile-m-z/quiterss.profile
+++ b/etc/profile-m-z/quiterss.profile
@@ -50,6 +50,6 @@ tracelog
50disable-mnt 50disable-mnt
51private-bin quiterss 51private-bin quiterss
52private-dev 52private-dev
53# private-etc alternatives,ca-certificates,crypto-policies,pki,ssl,X11 53#private-etc alternatives,ca-certificates,crypto-policies,pki,ssl,X11
54 54
55restrict-namespaces 55restrict-namespaces
diff --git a/etc/profile-m-z/rpcs3.profile b/etc/profile-m-z/rpcs3.profile
index 405ab818d..603ec8ff4 100644
--- a/etc/profile-m-z/rpcs3.profile
+++ b/etc/profile-m-z/rpcs3.profile
@@ -54,7 +54,8 @@ tracelog
54 54
55disable-mnt 55disable-mnt
56#private-cache 56#private-cache
57#private-etc alternatives,ca-certificates,crypto-policies,machine-id,pki,resolv.conf,ssl # seems to need awk 57# seems to need awk
58#private-etc alternatives,ca-certificates,crypto-policies,machine-id,pki,resolv.conf,ssl
58private-tmp 59private-tmp
59 60
60dbus-user none 61dbus-user none
diff --git a/etc/profile-m-z/rssguard.profile b/etc/profile-m-z/rssguard.profile
index 81381c205..ce455baba 100644
--- a/etc/profile-m-z/rssguard.profile
+++ b/etc/profile-m-z/rssguard.profile
@@ -31,13 +31,13 @@ include whitelist-var-common.inc
31apparmor 31apparmor
32caps.drop all 32caps.drop all
33netfilter 33netfilter
34# no3d 34#no3d
35nodvd 35nodvd
36nogroups 36nogroups
37noinput 37noinput
38nonewprivs 38nonewprivs
39noroot 39noroot
40# nosound 40#nosound
41notv 41notv
42nou2f 42nou2f
43novideo 43novideo
diff --git a/etc/profile-m-z/scribus.profile b/etc/profile-m-z/scribus.profile
index 34cf783fe..8e25375b0 100644
--- a/etc/profile-m-z/scribus.profile
+++ b/etc/profile-m-z/scribus.profile
@@ -55,7 +55,7 @@ protocol unix
55seccomp 55seccomp
56tracelog 56tracelog
57 57
58# private-bin gimp*,gs,scribus 58#private-bin gimp*,gs,scribus
59private-dev 59private-dev
60private-tmp 60private-tmp
61 61
diff --git a/etc/profile-m-z/seamonkey.profile b/etc/profile-m-z/seamonkey.profile
index c2dbbc2c6..1171a52f0 100644
--- a/etc/profile-m-z/seamonkey.profile
+++ b/etc/profile-m-z/seamonkey.profile
@@ -55,7 +55,7 @@ seccomp
55tracelog 55tracelog
56 56
57disable-mnt 57disable-mnt
58# private-etc adobe,alternatives,asound.conf,ca-certificates,crypto-policies,firefox,fonts,group,gtk-2.0,hostname,hosts,iceweasel,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,ssl 58#private-etc adobe,alternatives,asound.conf,ca-certificates,crypto-policies,firefox,fonts,group,gtk-2.0,hostname,hosts,iceweasel,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,ssl
59writable-run-user 59writable-run-user
60 60
61restrict-namespaces 61restrict-namespaces
diff --git a/etc/profile-m-z/server.profile b/etc/profile-m-z/server.profile
index 667f9c557..74587c992 100644
--- a/etc/profile-m-z/server.profile
+++ b/etc/profile-m-z/server.profile
@@ -34,36 +34,36 @@ include globals.local
34noblacklist /sbin 34noblacklist /sbin
35noblacklist /usr/sbin 35noblacklist /usr/sbin
36noblacklist /etc/init.d 36noblacklist /etc/init.d
37# noblacklist /var/opt 37#noblacklist /var/opt
38 38
39blacklist /tmp/.X11-unix 39blacklist /tmp/.X11-unix
40blacklist ${RUNUSER}/wayland-* 40blacklist ${RUNUSER}/wayland-*
41 41
42include disable-common.inc 42include disable-common.inc
43# include disable-devel.inc 43#include disable-devel.inc
44# include disable-exec.inc 44#include disable-exec.inc
45# include disable-interpreters.inc 45#include disable-interpreters.inc
46include disable-programs.inc 46include disable-programs.inc
47include disable-write-mnt.inc 47include disable-write-mnt.inc
48include disable-xdg.inc 48include disable-xdg.inc
49 49
50# include whitelist-runuser-common.inc 50#include whitelist-runuser-common.inc
51# include whitelist-usr-share-common.inc 51#include whitelist-usr-share-common.inc
52# include whitelist-var-common.inc 52#include whitelist-var-common.inc
53 53
54# people use to install servers all over the place! 54# people use to install servers all over the place!
55# apparmor runs executable only from default system locations 55# apparmor runs executable only from default system locations
56# apparmor 56#apparmor
57caps 57caps
58# ipc-namespace 58#ipc-namespace
59machine-id 59machine-id
60# netfilter /etc/firejail/webserver.net 60#netfilter /etc/firejail/webserver.net
61no3d 61no3d
62nodvd 62nodvd
63# nogroups 63#nogroups
64noinput 64noinput
65nonewprivs 65nonewprivs
66# noroot 66#noroot
67nosound 67nosound
68notv 68notv
69nou2f 69nou2f
@@ -74,22 +74,22 @@ tab # allow tab completion
74 74
75disable-mnt 75disable-mnt
76private 76private
77# private-bin program 77#private-bin program
78# private-cache 78#private-cache
79private-dev 79private-dev
80# see /usr/share/doc/firejail/profile.template for more common private-etc paths. 80# see /usr/share/doc/firejail/profile.template for more common private-etc paths.
81# private-etc alternatives 81#private-etc alternatives
82# private-lib 82#private-lib
83# private-opt none 83#private-opt none
84private-tmp 84private-tmp
85# writable-run-user 85#writable-run-user
86# writable-var 86#writable-var
87# writable-var-log 87#writable-var-log
88 88
89dbus-user none 89dbus-user none
90# dbus-system none 90#dbus-system none
91 91
92# deterministic-shutdown 92#deterministic-shutdown
93# memory-deny-write-execute 93#memory-deny-write-execute
94# read-only ${HOME} 94#read-only ${HOME}
95# restrict-namespaces 95#restrict-namespaces
diff --git a/etc/profile-m-z/silentarmy.profile b/etc/profile-m-z/silentarmy.profile
index 96e4cf283..154e29ccf 100644
--- a/etc/profile-m-z/silentarmy.profile
+++ b/etc/profile-m-z/silentarmy.profile
@@ -7,7 +7,7 @@ include globals.local
7 7
8 8
9include disable-common.inc 9include disable-common.inc
10# include disable-devel.inc 10#include disable-devel.inc
11include disable-exec.inc 11include disable-exec.inc
12include disable-interpreters.inc 12include disable-interpreters.inc
13include disable-programs.inc 13include disable-programs.inc
diff --git a/etc/profile-m-z/simple-scan.profile b/etc/profile-m-z/simple-scan.profile
index 14846cf58..f8bcd3c6e 100644
--- a/etc/profile-m-z/simple-scan.profile
+++ b/etc/profile-m-z/simple-scan.profile
@@ -28,15 +28,15 @@ nonewprivs
28noroot 28noroot
29nosound 29nosound
30notv 30notv
31# novideo 31#novideo
32protocol unix,inet,inet6,netlink 32protocol unix,inet,inet6,netlink
33# blacklisting of ioperm system calls breaks simple-scan 33# blacklisting of ioperm system calls breaks simple-scan
34seccomp !ioperm 34seccomp !ioperm
35tracelog 35tracelog
36 36
37# private-bin simple-scan 37#private-bin simple-scan
38# private-dev 38#private-dev
39# private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl 39#private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl
40# private-tmp 40#private-tmp
41 41
42restrict-namespaces 42restrict-namespaces
diff --git a/etc/profile-m-z/simutrans.profile b/etc/profile-m-z/simutrans.profile
index f88ae65c8..995b59538 100644
--- a/etc/profile-m-z/simutrans.profile
+++ b/etc/profile-m-z/simutrans.profile
@@ -33,7 +33,7 @@ novideo
33protocol unix 33protocol unix
34seccomp 34seccomp
35 35
36# private-bin simutrans 36#private-bin simutrans
37private-dev 37private-dev
38private-etc @games,@x11 38private-etc @games,@x11
39private-tmp 39private-tmp
diff --git a/etc/profile-m-z/skanlite.profile b/etc/profile-m-z/skanlite.profile
index 6b73b2289..3b78f7fd2 100644
--- a/etc/profile-m-z/skanlite.profile
+++ b/etc/profile-m-z/skanlite.profile
@@ -22,16 +22,16 @@ nonewprivs
22noroot 22noroot
23nosound 23nosound
24notv 24notv
25# novideo 25#novideo
26protocol unix,inet,inet6,netlink 26protocol unix,inet,inet6,netlink
27# blacklisting of ioperm system calls breaks skanlite 27# blacklisting of ioperm system calls breaks skanlite
28seccomp !ioperm 28seccomp !ioperm
29 29
30# private-bin kbuildsycoca4,kdeinit4,skanlite 30#private-bin kbuildsycoca4,kdeinit4,skanlite
31# private-dev 31#private-dev
32# private-tmp 32#private-tmp
33 33
34# dbus-user none 34#dbus-user none
35# dbus-system none 35#dbus-system none
36 36
37restrict-namespaces 37restrict-namespaces
diff --git a/etc/profile-m-z/smplayer.profile b/etc/profile-m-z/smplayer.profile
index 9dd41fd27..ece191b73 100644
--- a/etc/profile-m-z/smplayer.profile
+++ b/etc/profile-m-z/smplayer.profile
@@ -36,7 +36,7 @@ include whitelist-var-common.inc
36apparmor 36apparmor
37caps.drop all 37caps.drop all
38netfilter 38netfilter
39# nogroups 39#nogroups
40noinput 40noinput
41nonewprivs 41nonewprivs
42noroot 42noroot
@@ -49,7 +49,7 @@ private-dev
49private-tmp 49private-tmp
50 50
51# problems with KDE 51# problems with KDE
52# dbus-user none 52#dbus-user none
53# dbus-system none 53#dbus-system none
54 54
55restrict-namespaces 55restrict-namespaces
diff --git a/etc/profile-m-z/sniffnet.profile b/etc/profile-m-z/sniffnet.profile
index eb18c1f01..940c35b2e 100644
--- a/etc/profile-m-z/sniffnet.profile
+++ b/etc/profile-m-z/sniffnet.profile
@@ -29,8 +29,8 @@ netfilter
29nodvd 29nodvd
30nogroups 30nogroups
31noinput 31noinput
32# nonewprivs - breaks network traffic capture for unprivileged users 32#nonewprivs # breaks network traffic capture for unprivileged users
33# noroot 33#noroot
34notv 34notv
35nou2f 35nou2f
36novideo 36novideo
diff --git a/etc/profile-m-z/sol.profile b/etc/profile-m-z/sol.profile
index e2be4e9e0..07f9b0094 100644
--- a/etc/profile-m-z/sol.profile
+++ b/etc/profile-m-z/sol.profile
@@ -21,13 +21,13 @@ apparmor
21caps.drop all 21caps.drop all
22ipc-namespace 22ipc-namespace
23net none 23net none
24# no3d 24#no3d
25nodvd 25nodvd
26nogroups 26nogroups
27noinput 27noinput
28nonewprivs 28nonewprivs
29noroot 29noroot
30# nosound 30#nosound
31notv 31notv
32nou2f 32nou2f
33novideo 33novideo
@@ -43,5 +43,5 @@ private-tmp
43dbus-user none 43dbus-user none
44dbus-system none 44dbus-system none
45 45
46# memory-deny-write-execute 46#memory-deny-write-execute
47restrict-namespaces 47restrict-namespaces
diff --git a/etc/profile-m-z/sound-juicer.profile b/etc/profile-m-z/sound-juicer.profile
index f5ac6c739..5c5763538 100644
--- a/etc/profile-m-z/sound-juicer.profile
+++ b/etc/profile-m-z/sound-juicer.profile
@@ -38,7 +38,7 @@ private-cache
38private-dev 38private-dev
39private-tmp 39private-tmp
40 40
41# dbus-user none 41#dbus-user none
42# dbus-system none 42#dbus-system none
43 43
44restrict-namespaces 44restrict-namespaces
diff --git a/etc/profile-m-z/spotify.profile b/etc/profile-m-z/spotify.profile
index c893a92fb..63c2c5086 100644
--- a/etc/profile-m-z/spotify.profile
+++ b/etc/profile-m-z/spotify.profile
@@ -26,6 +26,7 @@ whitelist ${HOME}/.cache/spotify
26whitelist ${HOME}/.config/spotify 26whitelist ${HOME}/.config/spotify
27whitelist ${HOME}/.config/spotify-adblock 27whitelist ${HOME}/.config/spotify-adblock
28whitelist ${HOME}/.local/share/spotify 28whitelist ${HOME}/.local/share/spotify
29whitelist /opt/spotify
29include whitelist-common.inc 30include whitelist-common.inc
30include whitelist-var-common.inc 31include whitelist-var-common.inc
31 32
@@ -48,7 +49,6 @@ private-bin bash,cat,dirname,find,grep,head,rm,sh,spotify,tclsh,touch,zenity
48private-dev 49private-dev
49# If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local. 50# If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local.
50private-etc @tls-ca,host.conf,spotify-adblock 51private-etc @tls-ca,host.conf,spotify-adblock
51private-opt spotify
52private-srv none 52private-srv none
53private-tmp 53private-tmp
54 54
diff --git a/etc/profile-m-z/sqlitebrowser.profile b/etc/profile-m-z/sqlitebrowser.profile
index ce356367f..013c7ac13 100644
--- a/etc/profile-m-z/sqlitebrowser.profile
+++ b/etc/profile-m-z/sqlitebrowser.profile
@@ -46,8 +46,8 @@ private-etc @tls-ca
46private-tmp 46private-tmp
47 47
48# breaks proxy creation 48# breaks proxy creation
49# dbus-user none 49#dbus-user none
50# dbus-system none 50#dbus-system none
51 51
52#memory-deny-write-execute - breaks on Arch (see issue #1803) 52#memory-deny-write-execute # breaks on Arch (see issue #1803)
53restrict-namespaces 53restrict-namespaces
diff --git a/etc/profile-m-z/ssh.profile b/etc/profile-m-z/ssh.profile
index a7956a76e..fde85be64 100644
--- a/etc/profile-m-z/ssh.profile
+++ b/etc/profile-m-z/ssh.profile
@@ -32,10 +32,10 @@ nodvd
32nogroups 32nogroups
33noinput 33noinput
34nonewprivs 34nonewprivs
35# noroot - see issue #1543 35#noroot # see issue #1543
36nosound 36nosound
37notv 37notv
38# nou2f - OpenSSH >= 8.2 supports U2F 38#nou2f # OpenSSH >= 8.2 supports U2F
39novideo 39novideo
40protocol unix,inet,inet6 40protocol unix,inet,inet6
41seccomp 41seccomp
@@ -43,7 +43,7 @@ tracelog
43 43
44private-cache 44private-cache
45private-dev 45private-dev
46# private-tmp # Breaks when exiting 46#private-tmp # Breaks when exiting
47writable-run-user 47writable-run-user
48 48
49dbus-user none 49dbus-user none
diff --git a/etc/profile-m-z/ssmtp.profile b/etc/profile-m-z/ssmtp.profile
index 1a224e7b0..b87f514f9 100644
--- a/etc/profile-m-z/ssmtp.profile
+++ b/etc/profile-m-z/ssmtp.profile
@@ -16,6 +16,7 @@ noblacklist /sbin
16noblacklist /usr/sbin 16noblacklist /usr/sbin
17 17
18noblacklist ${DOCUMENTS} 18noblacklist ${DOCUMENTS}
19noblacklist ${PATH}/ssmtp
19include disable-common.inc 20include disable-common.inc
20include disable-devel.inc 21include disable-devel.inc
21include disable-exec.inc 22include disable-exec.inc
diff --git a/etc/profile-m-z/standardnotes-desktop.profile b/etc/profile-m-z/standardnotes-desktop.profile
index 3fe0963a9..fe4e4b6d7 100644
--- a/etc/profile-m-z/standardnotes-desktop.profile
+++ b/etc/profile-m-z/standardnotes-desktop.profile
@@ -47,4 +47,4 @@ private-etc @tls-ca,@x11,host.conf
47dbus-user none 47dbus-user none
48dbus-system none 48dbus-system none
49 49
50# restrict-namespaces 50#restrict-namespaces
diff --git a/etc/profile-m-z/steam.profile b/etc/profile-m-z/steam.profile
index 99317c9dc..34cb3631a 100644
--- a/etc/profile-m-z/steam.profile
+++ b/etc/profile-m-z/steam.profile
@@ -12,10 +12,12 @@ noblacklist ${HOME}/.config/MangoHud
12noblacklist ${HOME}/.config/ModTheSpire 12noblacklist ${HOME}/.config/ModTheSpire
13noblacklist ${HOME}/.config/RogueLegacy 13noblacklist ${HOME}/.config/RogueLegacy
14noblacklist ${HOME}/.config/RogueLegacyStorageContainer 14noblacklist ${HOME}/.config/RogueLegacyStorageContainer
15noblacklist ${HOME}/.factorio
15noblacklist ${HOME}/.killingfloor 16noblacklist ${HOME}/.killingfloor
16noblacklist ${HOME}/.klei 17noblacklist ${HOME}/.klei
17noblacklist ${HOME}/.local/share/3909/PapersPlease 18noblacklist ${HOME}/.local/share/3909/PapersPlease
18noblacklist ${HOME}/.local/share/aspyr-media 19noblacklist ${HOME}/.local/share/aspyr-media
20noblacklist ${HOME}/.local/share/Baba_Is_You
19noblacklist ${HOME}/.local/share/bohemiainteractive 21noblacklist ${HOME}/.local/share/bohemiainteractive
20noblacklist ${HOME}/.local/share/cdprojektred 22noblacklist ${HOME}/.local/share/cdprojektred
21noblacklist ${HOME}/.local/share/Colossal Order 23noblacklist ${HOME}/.local/share/Colossal Order
@@ -64,10 +66,12 @@ mkdir ${HOME}/.config/MangoHud
64mkdir ${HOME}/.config/ModTheSpire 66mkdir ${HOME}/.config/ModTheSpire
65mkdir ${HOME}/.config/RogueLegacy 67mkdir ${HOME}/.config/RogueLegacy
66mkdir ${HOME}/.config/unity3d 68mkdir ${HOME}/.config/unity3d
69mkdir ${HOME}/.factorio
67mkdir ${HOME}/.killingfloor 70mkdir ${HOME}/.killingfloor
68mkdir ${HOME}/.klei 71mkdir ${HOME}/.klei
69mkdir ${HOME}/.local/share/3909/PapersPlease 72mkdir ${HOME}/.local/share/3909/PapersPlease
70mkdir ${HOME}/.local/share/aspyr-media 73mkdir ${HOME}/.local/share/aspyr-media
74mkdir ${HOME}/.local/share/Baba_Is_You
71mkdir ${HOME}/.local/share/bohemiainteractive 75mkdir ${HOME}/.local/share/bohemiainteractive
72mkdir ${HOME}/.local/share/cdprojektred 76mkdir ${HOME}/.local/share/cdprojektred
73mkdir ${HOME}/.local/share/Colossal Order 77mkdir ${HOME}/.local/share/Colossal Order
@@ -100,10 +104,12 @@ whitelist ${HOME}/.config/ModTheSpire
100whitelist ${HOME}/.config/RogueLegacy 104whitelist ${HOME}/.config/RogueLegacy
101whitelist ${HOME}/.config/RogueLegacyStorageContainer 105whitelist ${HOME}/.config/RogueLegacyStorageContainer
102whitelist ${HOME}/.config/unity3d 106whitelist ${HOME}/.config/unity3d
107whitelist ${HOME}/.factorio
103whitelist ${HOME}/.killingfloor 108whitelist ${HOME}/.killingfloor
104whitelist ${HOME}/.klei 109whitelist ${HOME}/.klei
105whitelist ${HOME}/.local/share/3909/PapersPlease 110whitelist ${HOME}/.local/share/3909/PapersPlease
106whitelist ${HOME}/.local/share/aspyr-media 111whitelist ${HOME}/.local/share/aspyr-media
112whitelist ${HOME}/.local/share/Baba_Is_You
107whitelist ${HOME}/.local/share/bohemiainteractive 113whitelist ${HOME}/.local/share/bohemiainteractive
108whitelist ${HOME}/.local/share/cdprojektred 114whitelist ${HOME}/.local/share/cdprojektred
109whitelist ${HOME}/.local/share/Colossal Order 115whitelist ${HOME}/.local/share/Colossal Order
diff --git a/etc/profile-m-z/subdownloader.profile b/etc/profile-m-z/subdownloader.profile
index 6de288c46..8b5d7e253 100644
--- a/etc/profile-m-z/subdownloader.profile
+++ b/etc/profile-m-z/subdownloader.profile
@@ -49,5 +49,5 @@ private-tmp
49dbus-user none 49dbus-user none
50dbus-system none 50dbus-system none
51 51
52#memory-deny-write-execute - breaks on Arch (see issue #1803) 52#memory-deny-write-execute # breaks on Arch (see issue #1803)
53restrict-namespaces 53restrict-namespaces
diff --git a/etc/profile-m-z/supertux2.profile b/etc/profile-m-z/supertux2.profile
index 2ad107f1a..65aea6667 100644
--- a/etc/profile-m-z/supertux2.profile
+++ b/etc/profile-m-z/supertux2.profile
@@ -41,7 +41,7 @@ seccomp.block-secondary
41tracelog 41tracelog
42 42
43disable-mnt 43disable-mnt
44# private-bin supertux2 44#private-bin supertux2
45private-cache 45private-cache
46private-etc 46private-etc
47private-dev 47private-dev
diff --git a/etc/profile-m-z/sushi.profile b/etc/profile-m-z/sushi.profile
index 7b6a87b31..728db012e 100644
--- a/etc/profile-m-z/sushi.profile
+++ b/etc/profile-m-z/sushi.profile
@@ -13,7 +13,7 @@ include disable-common.inc
13include disable-devel.inc 13include disable-devel.inc
14include disable-exec.inc 14include disable-exec.inc
15include disable-interpreters.inc 15include disable-interpreters.inc
16# include disable-programs.inc 16#include disable-programs.inc
17include disable-shell.inc 17include disable-shell.inc
18 18
19include whitelist-runuser-common.inc 19include whitelist-runuser-common.inc
diff --git a/etc/profile-m-z/sylpheed.profile b/etc/profile-m-z/sylpheed.profile
index 5fb35aa04..7cef394c2 100644
--- a/etc/profile-m-z/sylpheed.profile
+++ b/etc/profile-m-z/sylpheed.profile
@@ -13,7 +13,7 @@ whitelist ${HOME}/.sylpheed-2.0
13 13
14whitelist /usr/share/sylpheed 14whitelist /usr/share/sylpheed
15 15
16# private-bin curl,gpg,gpg2,gpg-agent,gpgsm,pinentry,pinentry-gtk-2,sylpheed 16#private-bin curl,gpg,gpg2,gpg-agent,gpgsm,pinentry,pinentry-gtk-2,sylpheed
17 17
18# Redirect 18# Redirect
19include email-common.profile 19include email-common.profile
diff --git a/etc/profile-m-z/sysprof.profile b/etc/profile-m-z/sysprof.profile
index 726baf336..b0a80fc27 100644
--- a/etc/profile-m-z/sysprof.profile
+++ b/etc/profile-m-z/sysprof.profile
@@ -59,11 +59,11 @@ seccomp
59tracelog 59tracelog
60 60
61disable-mnt 61disable-mnt
62#private-bin sysprof - breaks help menu 62#private-bin sysprof # breaks help menu
63private-cache 63private-cache
64private-dev 64private-dev
65private-etc @tls-ca 65private-etc @tls-ca
66# private-lib - breaks help menu 66#private-lib # breaks help menu
67#private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so 67#private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so
68private-tmp 68private-tmp
69 69
@@ -73,5 +73,5 @@ dbus-user.own org.gnome.Yelp
73dbus-user.own org.gnome.Sysprof3 73dbus-user.own org.gnome.Sysprof3
74dbus-user.talk ca.desrt.dconf 74dbus-user.talk ca.desrt.dconf
75 75
76# memory-deny-write-execute - breaks on Arch 76#memory-deny-write-execute # breaks on Arch
77restrict-namespaces 77restrict-namespaces
diff --git a/etc/profile-m-z/system-log-common.profile b/etc/profile-m-z/system-log-common.profile
new file mode 100644
index 000000000..dda8bdc47
--- /dev/null
+++ b/etc/profile-m-z/system-log-common.profile
@@ -0,0 +1,60 @@
1# Firejail profile for system-log-common
2# Description: Common profile for GUI system log viewers
3# This file is overwritten after every install/update
4# Persistent local customizations
5include system-log-common.local
6# Persistent global definitions
7# added by caller profile
8#include globals.local
9
10include disable-common.inc
11include disable-devel.inc
12include disable-exec.inc
13include disable-interpreters.inc
14include disable-proc.inc
15include disable-programs.inc
16include disable-shell.inc
17include disable-xdg.inc
18
19whitelist /run/log/journal
20whitelist /var/log/journal
21include whitelist-common.inc
22include whitelist-run-common.inc
23include whitelist-runuser-common.inc
24include whitelist-usr-share-common.inc
25include whitelist-var-common.inc
26
27apparmor
28caps.drop all
29ipc-namespace
30net none
31no3d
32nodvd
33#nogroups
34noinput
35nonewprivs
36noprinters
37#noroot
38nosound
39notv
40nou2f
41novideo
42protocol unix
43seccomp
44seccomp.block-secondary
45tracelog
46
47disable-mnt
48private-cache
49private-dev
50private-etc machine-id
51private-tmp
52
53dbus-user none
54dbus-system none
55
56restrict-namespaces
57# Add 'ignore read-only ${HOME}' to your system-log-common.local
58# if you export logs to a file under your ${HOME}.
59read-only ${HOME}
60writable-var-log
diff --git a/etc/profile-m-z/teamspeak3.profile b/etc/profile-m-z/teamspeak3.profile
index 41da4ee13..06b547b3d 100644
--- a/etc/profile-m-z/teamspeak3.profile
+++ b/etc/profile-m-z/teamspeak3.profile
@@ -39,4 +39,4 @@ disable-mnt
39private-dev 39private-dev
40private-tmp 40private-tmp
41 41
42# restrict-namespaces 42#restrict-namespaces
diff --git a/etc/profile-m-z/telegram.profile b/etc/profile-m-z/telegram.profile
index ba915c2d4..fa992ad1a 100644
--- a/etc/profile-m-z/telegram.profile
+++ b/etc/profile-m-z/telegram.profile
@@ -7,6 +7,7 @@ include globals.local
7 7
8noblacklist ${HOME}/.TelegramDesktop 8noblacklist ${HOME}/.TelegramDesktop
9noblacklist ${HOME}/.local/share/TelegramDesktop 9noblacklist ${HOME}/.local/share/TelegramDesktop
10noblacklist ${HOME}/.local/share/telegram-desktop
10 11
11# Allow opening hyperlinks 12# Allow opening hyperlinks
12include allow-bin-sh.inc 13include allow-bin-sh.inc
@@ -21,8 +22,10 @@ include disable-xdg.inc
21 22
22mkdir ${HOME}/.TelegramDesktop 23mkdir ${HOME}/.TelegramDesktop
23mkdir ${HOME}/.local/share/TelegramDesktop 24mkdir ${HOME}/.local/share/TelegramDesktop
25mkdir ${HOME}/.local/share/telegram-desktop
24whitelist ${HOME}/.TelegramDesktop 26whitelist ${HOME}/.TelegramDesktop
25whitelist ${HOME}/.local/share/TelegramDesktop 27whitelist ${HOME}/.local/share/TelegramDesktop
28whitelist ${HOME}/.local/share/telegram-desktop
26whitelist ${DOWNLOADS} 29whitelist ${DOWNLOADS}
27whitelist /usr/share/TelegramDesktop 30whitelist /usr/share/TelegramDesktop
28include whitelist-common.inc 31include whitelist-common.inc
diff --git a/etc/profile-m-z/termshark.profile b/etc/profile-m-z/termshark.profile
new file mode 100644
index 000000000..630d5dda6
--- /dev/null
+++ b/etc/profile-m-z/termshark.profile
@@ -0,0 +1,15 @@
1# Firejail profile for termshark
2# Description: Terminal UI for tshark, inspired by Wireshark
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include termshark.local
7# Persistent global definitions
8# added by included profile
9#include globals.local
10
11blacklist /tmp/.X11-unix
12blacklist ${RUNUSER}
13
14# Redirect
15include wireshark.profile
diff --git a/etc/profile-m-z/tesseract.profile b/etc/profile-m-z/tesseract.profile
index 5babfb8d2..c0293406d 100644
--- a/etc/profile-m-z/tesseract.profile
+++ b/etc/profile-m-z/tesseract.profile
@@ -26,6 +26,7 @@ include whitelist-common.inc
26include whitelist-run-common.inc 26include whitelist-run-common.inc
27include whitelist-runuser-common.inc 27include whitelist-runuser-common.inc
28whitelist /usr/share/tessdata 28whitelist /usr/share/tessdata
29whitelist /usr/share/tesseract-ocr
29include whitelist-usr-share-common.inc 30include whitelist-usr-share-common.inc
30include whitelist-var-common.inc 31include whitelist-var-common.inc
31 32
diff --git a/etc/profile-m-z/thunderbird-beta.profile b/etc/profile-m-z/thunderbird-beta.profile
index 46a1e57c8..e01a9d2d8 100644
--- a/etc/profile-m-z/thunderbird-beta.profile
+++ b/etc/profile-m-z/thunderbird-beta.profile
@@ -6,7 +6,7 @@ include thunderbird-beta.local
6# added by included profile 6# added by included profile
7#include globals.local 7#include globals.local
8 8
9private-opt thunderbird-beta 9whitelist /opt/thunderbird-beta
10 10
11# Redirect 11# Redirect
12include thunderbird.profile 12include thunderbird.profile
diff --git a/etc/profile-m-z/thunderbird.profile b/etc/profile-m-z/thunderbird.profile
index 17e2f0856..979971ac2 100644
--- a/etc/profile-m-z/thunderbird.profile
+++ b/etc/profile-m-z/thunderbird.profile
@@ -35,7 +35,7 @@ whitelist ${HOME}/.mozilla/firefox/profiles.ini
35 35
36noblacklist ${HOME}/.cache/thunderbird 36noblacklist ${HOME}/.cache/thunderbird
37noblacklist ${HOME}/.gnupg 37noblacklist ${HOME}/.gnupg
38# noblacklist ${HOME}/.icedove 38#noblacklist ${HOME}/.icedove
39noblacklist ${HOME}/.thunderbird 39noblacklist ${HOME}/.thunderbird
40 40
41include disable-xdg.inc 41include disable-xdg.inc
@@ -46,11 +46,11 @@ include disable-xdg.inc
46# See https://github.com/netblue30/firejail/issues/2357 46# See https://github.com/netblue30/firejail/issues/2357
47mkdir ${HOME}/.cache/thunderbird 47mkdir ${HOME}/.cache/thunderbird
48mkdir ${HOME}/.gnupg 48mkdir ${HOME}/.gnupg
49# mkdir ${HOME}/.icedove 49#mkdir ${HOME}/.icedove
50mkdir ${HOME}/.thunderbird 50mkdir ${HOME}/.thunderbird
51whitelist ${HOME}/.cache/thunderbird 51whitelist ${HOME}/.cache/thunderbird
52whitelist ${HOME}/.gnupg 52whitelist ${HOME}/.gnupg
53# whitelist ${HOME}/.icedove 53#whitelist ${HOME}/.icedove
54whitelist ${HOME}/.thunderbird 54whitelist ${HOME}/.thunderbird
55 55
56whitelist /usr/share/gnupg 56whitelist /usr/share/gnupg
diff --git a/etc/profile-m-z/tidal-hifi.profile b/etc/profile-m-z/tidal-hifi.profile
new file mode 100644
index 000000000..d2e23239e
--- /dev/null
+++ b/etc/profile-m-z/tidal-hifi.profile
@@ -0,0 +1,39 @@
1# Firejail profile for tidal-hifi
2# Description: The web version of Tidal running in electron with hifi support thanks to widevine.
3# This file is overwritten after every install/update
4# Persistent local customizations
5include tidal-hifi.local
6# Persistent global definitions
7include globals.local
8
9ignore noexec ${HOME}
10
11noblacklist ${HOME}/.config/tidal-hifi
12
13include disable-proc.inc
14include disable-shell.inc
15
16whitelist ${HOME}/.config/tidal-hifi
17
18caps.drop all
19no3d
20nonewprivs
21noprinters
22noroot
23protocol unix,inet,inet6
24seccomp !chroot
25seccomp.block-secondary
26tracelog
27
28private-bin chrome-sandbox,tidal-hifi
29private-etc @network,@sound,@tls-ca,@xdg
30private-opt tidal-hifi
31
32ignore dbus-user none
33dbus-user filter
34dbus-user.own org.mpris.MediaPlayer2.tidal-hifi
35dbus-user.talk org.freedesktop.Notifications
36
37join-or-start tidal-hifi
38
39include electron-common.profile
diff --git a/etc/profile-m-z/tiny-rdm.profile b/etc/profile-m-z/tiny-rdm.profile
new file mode 100644
index 000000000..4134d666c
--- /dev/null
+++ b/etc/profile-m-z/tiny-rdm.profile
@@ -0,0 +1,61 @@
1# Firejail profile for tiny-rdm
2# Description: A Modern Redis GUI Client
3# This file is overwritten after every install/update
4# Persistent local customizations
5include tiny-rdm.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.cache/tiny-rdm
10noblacklist ${HOME}/.config/TinyRDM
11
12include disable-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-programs.inc
17include disable-proc.inc
18include disable-shell.inc
19include disable-xdg.inc
20
21mkdir ${HOME}/.cache/tiny-rdm
22mkdir ${HOME}/.config/TinyRDM
23whitelist ${HOME}/.cache/tiny-rdm
24whitelist ${HOME}/.config/TinyRDM
25include whitelist-common.inc
26include whitelist-run-common.inc
27include whitelist-runuser-common.inc
28include whitelist-usr-share-common.inc
29include whitelist-var-common.inc
30
31apparmor
32caps.drop all
33ipc-namespace
34netfilter
35no3d
36nodvd
37nogroups
38noinput
39nonewprivs
40noprinters
41noroot
42notv
43nou2f
44novideo
45nosound
46protocol unix,inet,inet6
47seccomp
48seccomp.block-secondary
49tracelog
50
51disable-mnt
52private-bin tiny-rdm
53private-cache
54private-dev
55private-etc @network,@tls-ca,@x11
56private-tmp
57
58dbus-user none
59dbus-system none
60
61restrict-namespaces
diff --git a/etc/profile-m-z/tmux.profile b/etc/profile-m-z/tmux.profile
index a855ff839..ddd2aa85f 100644
--- a/etc/profile-m-z/tmux.profile
+++ b/etc/profile-m-z/tmux.profile
@@ -12,10 +12,10 @@ blacklist ${RUNUSER}
12 12
13noblacklist /tmp/tmux-* 13noblacklist /tmp/tmux-*
14 14
15# include disable-common.inc 15#include disable-common.inc
16# include disable-devel.inc 16#include disable-devel.inc
17# include disable-exec.inc 17#include disable-exec.inc
18# include disable-programs.inc 18#include disable-programs.inc
19 19
20caps.drop all 20caps.drop all
21ipc-namespace 21ipc-namespace
@@ -36,9 +36,9 @@ seccomp
36seccomp.block-secondary 36seccomp.block-secondary
37tracelog 37tracelog
38 38
39# private-cache 39#private-cache
40private-dev 40private-dev
41# private-tmp 41#private-tmp
42 42
43dbus-user none 43dbus-user none
44dbus-system none 44dbus-system none
diff --git a/etc/profile-m-z/torbrowser-launcher.profile b/etc/profile-m-z/torbrowser-launcher.profile
index 86746c7f1..b9fdcf92c 100644
--- a/etc/profile-m-z/torbrowser-launcher.profile
+++ b/etc/profile-m-z/torbrowser-launcher.profile
@@ -56,13 +56,12 @@ novideo
56protocol unix,inet,inet6 56protocol unix,inet,inet6
57seccomp !chroot 57seccomp !chroot
58seccomp.block-secondary 58seccomp.block-secondary
59#tracelog - may cause issues, see #1930 59#tracelog # may cause issues, see #1930
60 60
61disable-mnt 61disable-mnt
62private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mv,python*,rm,sed,sh,tail,tar,tclsh,test,tor-browser,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity 62private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mv,python*,rm,sed,sh,tail,tar,tclsh,test,tor-browser,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity
63private-dev 63private-dev
64private-etc @tls-ca 64private-etc @tls-ca
65#private-opt tor-browser - can cause slow startup
66private-tmp 65private-tmp
67 66
68dbus-user none 67dbus-user none
diff --git a/etc/profile-m-z/totem.profile b/etc/profile-m-z/totem.profile
index a4cb49171..73d3b0b6f 100644
--- a/etc/profile-m-z/totem.profile
+++ b/etc/profile-m-z/totem.profile
@@ -35,7 +35,7 @@ include whitelist-runuser-common.inc
35include whitelist-usr-share-common.inc 35include whitelist-usr-share-common.inc
36include whitelist-var-common.inc 36include whitelist-var-common.inc
37 37
38# apparmor - makes settings immutable 38#apparmor # makes settings immutable
39caps.drop all 39caps.drop all
40netfilter 40netfilter
41nogroups 41nogroups
@@ -55,7 +55,7 @@ private-etc @tls-ca,@x11,python*
55private-tmp 55private-tmp
56 56
57# makes settings immutable 57# makes settings immutable
58# dbus-user none 58#dbus-user none
59dbus-system none 59dbus-system none
60 60
61restrict-namespaces 61restrict-namespaces
diff --git a/etc/profile-m-z/tracker.profile b/etc/profile-m-z/tracker.profile
index f30b0aef6..c46b00fc9 100644
--- a/etc/profile-m-z/tracker.profile
+++ b/etc/profile-m-z/tracker.profile
@@ -33,8 +33,8 @@ protocol unix
33seccomp 33seccomp
34tracelog 34tracelog
35 35
36# private-bin tracker 36#private-bin tracker
37# private-dev 37#private-dev
38# private-tmp 38#private-tmp
39 39
40restrict-namespaces 40restrict-namespaces
diff --git a/etc/profile-m-z/transgui.profile b/etc/profile-m-z/transgui.profile
index 645c55c3b..9f1f1c241 100644
--- a/etc/profile-m-z/transgui.profile
+++ b/etc/profile-m-z/transgui.profile
@@ -12,6 +12,7 @@ include disable-common.inc
12include disable-devel.inc 12include disable-devel.inc
13include disable-exec.inc 13include disable-exec.inc
14include disable-interpreters.inc 14include disable-interpreters.inc
15include disable-proc.inc
15include disable-programs.inc 16include disable-programs.inc
16include disable-shell.inc 17include disable-shell.inc
17include disable-xdg.inc 18include disable-xdg.inc
@@ -19,7 +20,10 @@ include disable-xdg.inc
19mkdir ${HOME}/.config/transgui 20mkdir ${HOME}/.config/transgui
20whitelist ${HOME}/.config/transgui 21whitelist ${HOME}/.config/transgui
21whitelist ${DOWNLOADS} 22whitelist ${DOWNLOADS}
23whitelist /usr/share/transgui
22include whitelist-common.inc 24include whitelist-common.inc
25include whitelist-run-common.inc
26include whitelist-runuser-common.inc
23include whitelist-usr-share-common.inc 27include whitelist-usr-share-common.inc
24include whitelist-var-common.inc 28include whitelist-var-common.inc
25 29
@@ -44,7 +48,7 @@ tracelog
44private-bin geoiplookup,geoiplookup6,transgui 48private-bin geoiplookup,geoiplookup6,transgui
45private-cache 49private-cache
46private-dev 50private-dev
47private-etc 51private-etc @network,@tls-ca,@x11
48private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.* 52private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.*
49private-tmp 53private-tmp
50 54
diff --git a/etc/profile-m-z/trojita.profile b/etc/profile-m-z/trojita.profile
index 2578eb0be..5e9e7f127 100644
--- a/etc/profile-m-z/trojita.profile
+++ b/etc/profile-m-z/trojita.profile
@@ -52,7 +52,7 @@ protocol unix,inet,inet6,netlink
52seccomp 52seccomp
53tracelog 53tracelog
54 54
55# disable-mnt 55#disable-mnt
56private-bin trojita 56private-bin trojita
57private-cache 57private-cache
58private-dev 58private-dev
diff --git a/etc/profile-m-z/tshark.profile b/etc/profile-m-z/tshark.profile
index 3f5a9647e..f2273e6a7 100644
--- a/etc/profile-m-z/tshark.profile
+++ b/etc/profile-m-z/tshark.profile
@@ -7,5 +7,8 @@ include tshark.local
7# added by included profile 7# added by included profile
8#include globals.local 8#include globals.local
9 9
10blacklist /tmp/.X11-unix
11blacklist ${RUNUSER}
12
10# Redirect 13# Redirect
11include wireshark.profile 14include wireshark.profile
diff --git a/etc/profile-m-z/tutanota-desktop.profile b/etc/profile-m-z/tutanota-desktop.profile
index 55e4a4392..f0a0cacaf 100644
--- a/etc/profile-m-z/tutanota-desktop.profile
+++ b/etc/profile-m-z/tutanota-desktop.profile
@@ -22,6 +22,7 @@ mkdir ${HOME}/.config/tuta_integration
22mkdir ${HOME}/.config/tutanota-desktop 22mkdir ${HOME}/.config/tutanota-desktop
23whitelist ${HOME}/.config/tuta_integration 23whitelist ${HOME}/.config/tuta_integration
24whitelist ${HOME}/.config/tutanota-desktop 24whitelist ${HOME}/.config/tutanota-desktop
25whitelist /opt/tutanota-desktop
25 26
26# The lines below are needed to find the default Firefox profile name, to allow 27# The lines below are needed to find the default Firefox profile name, to allow
27# opening links in an existing instance of Firefox (note that it still fails if 28# opening links in an existing instance of Firefox (note that it still fails if
@@ -34,7 +35,6 @@ nosound
34 35
35?HAS_APPIMAGE: ignore private-dev 36?HAS_APPIMAGE: ignore private-dev
36private-etc @tls-ca 37private-etc @tls-ca
37private-opt tutanota-desktop
38 38
39dbus-user filter 39dbus-user filter
40dbus-user.talk org.freedesktop.Notifications 40dbus-user.talk org.freedesktop.Notifications
diff --git a/etc/profile-m-z/tvbrowser.profile b/etc/profile-m-z/tvbrowser.profile
index 518dc95c7..16162f989 100644
--- a/etc/profile-m-z/tvbrowser.profile
+++ b/etc/profile-m-z/tvbrowser.profile
@@ -1,5 +1,5 @@
1# Firejail profile for tvbrowser 1# Firejail profile for tvbrowser
2# Description: java tv programm form tvbrowser.org 2# Description: java tv program form tvbrowser.org
3# This file is overwritten after every install/update 3# This file is overwritten after every install/update
4# Persistent local customizations 4# Persistent local customizations
5include tvbrowser.local 5include tvbrowser.local
diff --git a/etc/profile-m-z/twitch.profile b/etc/profile-m-z/twitch.profile
index d53acdaf7..55106d622 100644
--- a/etc/profile-m-z/twitch.profile
+++ b/etc/profile-m-z/twitch.profile
@@ -1,5 +1,5 @@
1# Firejail profile for twitch 1# Firejail profile for twitch
2# Description: Unofficial electron based desktop warpper for Twitch 2# Description: Unofficial electron based desktop wrapper for Twitch
3# This file is overwritten after every install/update 3# This file is overwritten after every install/update
4# Persistent local customizations 4# Persistent local customizations
5include twitch.local 5include twitch.local
@@ -16,10 +16,10 @@ include disable-shell.inc
16 16
17mkdir ${HOME}/.config/Twitch 17mkdir ${HOME}/.config/Twitch
18whitelist ${HOME}/.config/Twitch 18whitelist ${HOME}/.config/Twitch
19whitelist /opt/Twitch
19 20
20private-bin electron,electron[0-9],electron[0-9][0-9],twitch 21private-bin electron,electron[0-9],electron[0-9][0-9],twitch
21private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types 22private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types
22private-opt Twitch
23 23
24# Redirect 24# Redirect
25include electron-common.profile 25include electron-common.profile
diff --git a/etc/profile-m-z/udiskie.profile b/etc/profile-m-z/udiskie.profile
index c182326bb..175ae4591 100644
--- a/etc/profile-m-z/udiskie.profile
+++ b/etc/profile-m-z/udiskie.profile
@@ -36,8 +36,8 @@ tracelog
36 36
37private-bin awk,cut,dbus-send,egrep,file,grep,head,python*,readlink,sed,sh,udiskie,uname,which,xdg-mime,xdg-open,xprop 37private-bin awk,cut,dbus-send,egrep,file,grep,head,python*,readlink,sed,sh,udiskie,uname,which,xdg-mime,xdg-open,xprop
38# add your configured file browser in udiskie.local, e. g. 38# add your configured file browser in udiskie.local, e. g.
39# private-bin nautilus 39#private-bin nautilus
40# private-bin thunar 40#private-bin thunar
41private-cache 41private-cache
42private-dev 42private-dev
43private-etc @x11,mime.types 43private-etc @x11,mime.types
diff --git a/etc/profile-m-z/unknown-horizons.profile b/etc/profile-m-z/unknown-horizons.profile
index 3e2b28dec..4e7dc3705 100644
--- a/etc/profile-m-z/unknown-horizons.profile
+++ b/etc/profile-m-z/unknown-horizons.profile
@@ -34,11 +34,11 @@ protocol unix,inet,inet6,netlink
34seccomp 34seccomp
35 35
36disable-mnt 36disable-mnt
37# private-bin unknown-horizons 37#private-bin unknown-horizons
38private-dev 38private-dev
39# private-etc alternatives,ca-certificates,crypto-policies,pki,ssl 39#private-etc alternatives,ca-certificates,crypto-policies,pki,ssl
40private-tmp 40private-tmp
41 41
42# doesn't work - maybe all Tcl/Tk programs have this problem 42# doesn't work - maybe all Tcl/Tk programs have this problem
43# memory-deny-write-execute 43#memory-deny-write-execute
44restrict-namespaces 44restrict-namespaces
diff --git a/etc/profile-m-z/viewnior.profile b/etc/profile-m-z/viewnior.profile
index aa8199442..8c6efaa1c 100644
--- a/etc/profile-m-z/viewnior.profile
+++ b/etc/profile-m-z/viewnior.profile
@@ -49,5 +49,5 @@ private-tmp
49dbus-user none 49dbus-user none
50dbus-system none 50dbus-system none
51 51
52#memory-deny-write-execute - breaks on Arch (see issues #1803 and #1808) 52#memory-deny-write-execute # breaks on Arch (see issues #1803 and #1808)
53restrict-namespaces 53restrict-namespaces
diff --git a/etc/profile-m-z/virtualbox.profile b/etc/profile-m-z/virtualbox.profile
index ae8afbbf1..b768a635a 100644
--- a/etc/profile-m-z/virtualbox.profile
+++ b/etc/profile-m-z/virtualbox.profile
@@ -9,7 +9,7 @@ include globals.local
9noblacklist ${HOME}/.VirtualBox 9noblacklist ${HOME}/.VirtualBox
10noblacklist ${HOME}/.config/VirtualBox 10noblacklist ${HOME}/.config/VirtualBox
11noblacklist ${HOME}/VirtualBox VMs 11noblacklist ${HOME}/VirtualBox VMs
12# noblacklist /usr/bin/virtualbox 12#noblacklist /usr/bin/virtualbox
13noblacklist /usr/lib/virtualbox 13noblacklist /usr/lib/virtualbox
14noblacklist /usr/lib64/virtualbox 14noblacklist /usr/lib64/virtualbox
15 15
diff --git a/etc/profile-m-z/warzone2100.profile b/etc/profile-m-z/warzone2100.profile
index 79ba41d44..a7b0f5f1d 100644
--- a/etc/profile-m-z/warzone2100.profile
+++ b/etc/profile-m-z/warzone2100.profile
@@ -15,7 +15,7 @@ include disable-devel.inc
15include disable-exec.inc 15include disable-exec.inc
16include disable-interpreters.inc 16include disable-interpreters.inc
17include disable-programs.inc 17include disable-programs.inc
18#include disable-shell.inc - problems on Debian 11 18#include disable-shell.inc # problems on Debian 11
19 19
20mkdir ${HOME}/.local/share/warzone2100 20mkdir ${HOME}/.local/share/warzone2100
21mkdir ${HOME}/.local/share/warzone2100-3.3.0 21mkdir ${HOME}/.local/share/warzone2100-3.3.0
diff --git a/etc/profile-m-z/wine.profile b/etc/profile-m-z/wine.profile
index 1e2b164b9..33f404464 100644
--- a/etc/profile-m-z/wine.profile
+++ b/etc/profile-m-z/wine.profile
@@ -20,23 +20,23 @@ include disable-devel.inc
20include disable-interpreters.inc 20include disable-interpreters.inc
21include disable-programs.inc 21include disable-programs.inc
22 22
23# whitelist /usr/share/wine 23#whitelist /usr/share/wine
24# include whitelist-usr-share-common.inc 24#include whitelist-usr-share-common.inc
25include whitelist-var-common.inc 25include whitelist-var-common.inc
26 26
27# Some applications don't need allow-debuggers. Add 'ignore allow-debuggers' to your wine.local if you want to override this. 27# Some applications don't need allow-debuggers. Add 'ignore allow-debuggers' to your wine.local if you want to override this.
28allow-debuggers 28allow-debuggers
29caps.drop all 29caps.drop all
30# net none 30#net none
31netfilter 31netfilter
32nodvd 32nodvd
33nogroups 33nogroups
34noinput 34noinput
35nonewprivs 35nonewprivs
36noroot 36noroot
37# nosound 37#nosound
38notv 38notv
39# novideo 39#novideo
40seccomp 40seccomp
41 41
42private-dev 42private-dev
diff --git a/etc/profile-m-z/wireshark.profile b/etc/profile-m-z/wireshark.profile
index d1b757a25..55c4e6ac7 100644
--- a/etc/profile-m-z/wireshark.profile
+++ b/etc/profile-m-z/wireshark.profile
@@ -9,6 +9,7 @@ include globals.local
9noblacklist ${HOME}/.config/wireshark 9noblacklist ${HOME}/.config/wireshark
10noblacklist ${HOME}/.wireshark 10noblacklist ${HOME}/.wireshark
11noblacklist ${DOCUMENTS} 11noblacklist ${DOCUMENTS}
12noblacklist ${PATH}/dumpcap
12 13
13# Allow lua (blacklisted by disable-interpreters.inc) 14# Allow lua (blacklisted by disable-interpreters.inc)
14include allow-lua.inc 15include allow-lua.inc
@@ -25,29 +26,30 @@ include whitelist-usr-share-common.inc
25include whitelist-var-common.inc 26include whitelist-var-common.inc
26 27
27apparmor 28apparmor
28# caps.drop all 29#caps.drop all
29caps.keep dac_override,dac_read_search,net_admin,net_raw 30caps.keep dac_override,dac_read_search,net_admin,net_raw
30netfilter 31netfilter
31no3d 32no3d
32# nogroups - breaks network traffic capture for unprivileged users 33#nogroups # breaks network traffic capture for unprivileged users
33noinput 34noinput
34# nonewprivs - breaks network traffic capture for unprivileged users 35#nonewprivs # breaks network traffic capture for unprivileged users
35# noroot 36#noroot
36nodvd 37nodvd
37nosound 38nosound
38notv 39notv
39nou2f 40nou2f
40novideo 41novideo
41# protocol unix,inet,inet6,netlink,packet,bluetooth - commented out in case they bring in new protocols 42# commented out in case they bring in new protocols
43#protocol unix,inet,inet6,netlink,packet,bluetooth
42#seccomp 44#seccomp
43tracelog 45tracelog
44 46
45# private-bin wireshark 47#private-bin wireshark
46private-cache 48private-cache
47# private-dev prevents (some) interfaces from being shown. 49# private-dev prevents (some) interfaces from being shown.
48# Add the below line to your wirehsark.local if you only want to inspect pcap files. 50# Add the below line to your wirehsark.local if you only want to inspect pcap files.
49#private-dev 51#private-dev
50# private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,resolv.conf,ssl 52#private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,resolv.conf,ssl
51private-tmp 53private-tmp
52 54
53dbus-user none 55dbus-user none
diff --git a/etc/profile-m-z/xed.profile b/etc/profile-m-z/xed.profile
index dda803bd5..b47437e2d 100644
--- a/etc/profile-m-z/xed.profile
+++ b/etc/profile-m-z/xed.profile
@@ -23,10 +23,10 @@ include disable-shell.inc
23 23
24include whitelist-var-common.inc 24include whitelist-var-common.inc
25 25
26# apparmor - makes settings immutable 26#apparmor # makes settings immutable
27caps.drop all 27caps.drop all
28machine-id 28machine-id
29# net none - makes settings immutable 29#net none # makes settings immutable
30no3d 30no3d
31nodvd 31nodvd
32nogroups 32nogroups
@@ -46,9 +46,9 @@ private-dev
46private-tmp 46private-tmp
47 47
48# makes settings immutable 48# makes settings immutable
49# dbus-user none 49#dbus-user none
50# dbus-system none 50#dbus-system none
51 51
52# xed uses python plugins, memory-deny-write-execute breaks python 52# xed uses python plugins, memory-deny-write-execute breaks python
53# memory-deny-write-execute 53#memory-deny-write-execute
54restrict-namespaces 54restrict-namespaces
diff --git a/etc/profile-m-z/xfburn.profile b/etc/profile-m-z/xfburn.profile
index 141fda909..96edc15ab 100644
--- a/etc/profile-m-z/xfburn.profile
+++ b/etc/profile-m-z/xfburn.profile
@@ -25,8 +25,8 @@ protocol unix
25seccomp 25seccomp
26tracelog 26tracelog
27 27
28# private-bin xfburn 28#private-bin xfburn
29# private-dev 29#private-dev
30# private-tmp 30#private-tmp
31 31
32restrict-namespaces 32restrict-namespaces
diff --git a/etc/profile-m-z/xfce4-mixer.profile b/etc/profile-m-z/xfce4-mixer.profile
index 9c4fa8293..6c3a5812b 100644
--- a/etc/profile-m-z/xfce4-mixer.profile
+++ b/etc/profile-m-z/xfce4-mixer.profile
@@ -53,5 +53,5 @@ dbus-user.own org.xfce.xfce4-mixer
53dbus-user.talk org.xfce.Xfconf 53dbus-user.talk org.xfce.Xfconf
54dbus-system none 54dbus-system none
55 55
56# memory-deny-write-execute - breaks on Arch 56#memory-deny-write-execute # breaks on Arch
57restrict-namespaces 57restrict-namespaces
diff --git a/etc/profile-m-z/xfce4-screenshooter.profile b/etc/profile-m-z/xfce4-screenshooter.profile
index 4d841b35c..9094a7872 100644
--- a/etc/profile-m-z/xfce4-screenshooter.profile
+++ b/etc/profile-m-z/xfce4-screenshooter.profile
@@ -47,5 +47,5 @@ private-tmp
47dbus-user none 47dbus-user none
48dbus-system none 48dbus-system none
49 49
50# memory-deny-write-execute -- see #3790 50#memory-deny-write-execute # see #3790
51restrict-namespaces 51restrict-namespaces
diff --git a/etc/profile-m-z/xmr-stak.profile b/etc/profile-m-z/xmr-stak.profile
index b8bf0ae96..06f0b5833 100644
--- a/etc/profile-m-z/xmr-stak.profile
+++ b/etc/profile-m-z/xmr-stak.profile
@@ -16,6 +16,7 @@ include disable-shell.inc
16include disable-xdg.inc 16include disable-xdg.inc
17 17
18mkdir ${HOME}/.xmr-stak 18mkdir ${HOME}/.xmr-stak
19whitelist /opt/cuda
19include whitelist-var-common.inc 20include whitelist-var-common.inc
20 21
21caps.drop all 22caps.drop all
@@ -39,7 +40,6 @@ private-bin xmr-stak
39private-dev 40private-dev
40private-etc @tls-ca 41private-etc @tls-ca
41#private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend 42#private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend
42private-opt cuda
43private-tmp 43private-tmp
44 44
45memory-deny-write-execute 45memory-deny-write-execute
diff --git a/etc/profile-m-z/xplayer.profile b/etc/profile-m-z/xplayer.profile
index a673d6aa3..9741888f0 100644
--- a/etc/profile-m-z/xplayer.profile
+++ b/etc/profile-m-z/xplayer.profile
@@ -27,7 +27,7 @@ include whitelist-common.inc
27include whitelist-player-common.inc 27include whitelist-player-common.inc
28include whitelist-var-common.inc 28include whitelist-var-common.inc
29 29
30# apparmor - makes settings immutable 30#apparmor # makes settings immutable
31caps.drop all 31caps.drop all
32netfilter 32netfilter
33nogroups 33nogroups
@@ -41,11 +41,11 @@ tracelog
41 41
42private-bin xplayer,xplayer-audio-preview,xplayer-video-thumbnailer 42private-bin xplayer,xplayer-audio-preview,xplayer-video-thumbnailer
43private-dev 43private-dev
44# private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl 44#private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl
45private-tmp 45private-tmp
46 46
47# makes settings immutable 47# makes settings immutable
48# dbus-user none 48#dbus-user none
49# dbus-system none 49#dbus-system none
50 50
51restrict-namespaces 51restrict-namespaces
diff --git a/etc/profile-m-z/xpra.profile b/etc/profile-m-z/xpra.profile
index 05c12b9a2..b00307394 100644
--- a/etc/profile-m-z/xpra.profile
+++ b/etc/profile-m-z/xpra.profile
@@ -45,11 +45,11 @@ seccomp
45 45
46disable-mnt 46disable-mnt
47# private home directory doesn't work on some distros, so we go for a regular home 47# private home directory doesn't work on some distros, so we go for a regular home
48# private 48#private
49# older Xpra versions also use Xvfb 49# older Xpra versions also use Xvfb
50# private-bin bash,cat,dbus-launch,ldconfig,ls,pactl,python*,sh,strace,which,xauth,xkbcomp,Xorg,xpra,Xvfb 50#private-bin bash,cat,dbus-launch,ldconfig,ls,pactl,python*,sh,strace,which,xauth,xkbcomp,Xorg,xpra,Xvfb
51private-dev 51private-dev
52# private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,machine-id,nsswitch.conf,resolv.conf,X11,xpra 52#private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,machine-id,nsswitch.conf,resolv.conf,X11,xpra
53private-tmp 53private-tmp
54 54
55restrict-namespaces 55restrict-namespaces
diff --git a/etc/profile-m-z/xreader.profile b/etc/profile-m-z/xreader.profile
index 6edbf9357..cad836fdc 100644
--- a/etc/profile-m-z/xreader.profile
+++ b/etc/profile-m-z/xreader.profile
@@ -18,9 +18,9 @@ include disable-programs.inc
18include disable-xdg.inc 18include disable-xdg.inc
19 19
20# Breaks xreader on Mint 18.3 20# Breaks xreader on Mint 18.3
21# include whitelist-var-common.inc 21#include whitelist-var-common.inc
22 22
23# apparmor 23#apparmor
24caps.drop all 24caps.drop all
25no3d 25no3d
26nodvd 26nodvd
diff --git a/etc/profile-m-z/xviewer.profile b/etc/profile-m-z/xviewer.profile
index 6c31df4a9..575c1bf68 100644
--- a/etc/profile-m-z/xviewer.profile
+++ b/etc/profile-m-z/xviewer.profile
@@ -19,9 +19,9 @@ include disable-shell.inc
19 19
20include whitelist-var-common.inc 20include whitelist-var-common.inc
21 21
22# apparmor - makes settings immutable 22#apparmor # makes settings immutable
23caps.drop all 23caps.drop all
24# net none - makes settings immutable 24#net none # makes settings immutable
25no3d 25no3d
26nodvd 26nodvd
27nogroups 27nogroups
@@ -42,8 +42,8 @@ private-lib
42private-tmp 42private-tmp
43 43
44# makes settings immutable 44# makes settings immutable
45# dbus-user none 45#dbus-user none
46# dbus-system none 46#dbus-system none
47 47
48memory-deny-write-execute 48memory-deny-write-execute
49restrict-namespaces 49restrict-namespaces
diff --git a/etc/profile-m-z/yelp.profile b/etc/profile-m-z/yelp.profile
index f5dd0c309..f957954dd 100644
--- a/etc/profile-m-z/yelp.profile
+++ b/etc/profile-m-z/yelp.profile
@@ -33,16 +33,14 @@ include whitelist-var-common.inc
33 33
34apparmor 34apparmor
35caps.drop all 35caps.drop all
36# machine-id breaks sound - add the next line to your yelp.local if you don't need sound support. 36#machine-id # add this to your yelp.local if you don't need sound support.
37#machine-id
38net none 37net none
39nodvd 38nodvd
40nogroups 39nogroups
41noinput 40noinput
42nonewprivs 41nonewprivs
43noroot 42noroot
44# nosound - add the next line to your yelp.local if you don't need sound support. 43#nosound # add this to your yelp.local if you don't need sound support.
45#nosound
46notv 44notv
47nou2f 45nou2f
48novideo 46novideo
diff --git a/etc/profile-m-z/youtube.profile b/etc/profile-m-z/youtube.profile
index 4d1e9a063..0fb87f747 100644
--- a/etc/profile-m-z/youtube.profile
+++ b/etc/profile-m-z/youtube.profile
@@ -1,5 +1,5 @@
1# Firejail profile for youtube 1# Firejail profile for youtube
2# Description: Unofficial electron based desktop warpper for YouTube 2# Description: Unofficial electron based desktop wrapper for YouTube
3# This file is overwritten after every install/update 3# This file is overwritten after every install/update
4# Persistent local customizations 4# Persistent local customizations
5include youtube.local 5include youtube.local
@@ -15,10 +15,10 @@ include disable-shell.inc
15 15
16mkdir ${HOME}/.config/Youtube 16mkdir ${HOME}/.config/Youtube
17whitelist ${HOME}/.config/Youtube 17whitelist ${HOME}/.config/Youtube
18whitelist /opt/Youtube
18 19
19private-bin electron,electron[0-9],electron[0-9][0-9],youtube 20private-bin electron,electron[0-9],electron[0-9][0-9],youtube
20private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types 21private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types
21private-opt Youtube
22 22
23# Redirect 23# Redirect
24include electron-common.profile 24include electron-common.profile
diff --git a/etc/profile-m-z/youtubemusic-nativefier.profile b/etc/profile-m-z/youtubemusic-nativefier.profile
index cfee8c426..e5ece41bc 100644
--- a/etc/profile-m-z/youtubemusic-nativefier.profile
+++ b/etc/profile-m-z/youtubemusic-nativefier.profile
@@ -1,8 +1,8 @@
1# Firejail profile for youtubemusic-nativefier 1# Firejail profile for youtubemusic-nativefier
2# Description: Unofficial electron based desktop warpper for YouTube Music 2# Description: Unofficial electron based desktop wrapper for YouTube Music
3# This file is overwritten after every install/update 3# This file is overwritten after every install/update
4# Persistent local customizations 4# Persistent local customizations
5include youtube.local 5include youtubemusic-nativefier.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
@@ -12,10 +12,10 @@ include disable-shell.inc
12 12
13mkdir ${HOME}/.config/youtubemusic-nativefier-040164 13mkdir ${HOME}/.config/youtubemusic-nativefier-040164
14whitelist ${HOME}/.config/youtubemusic-nativefier-040164 14whitelist ${HOME}/.config/youtubemusic-nativefier-040164
15whitelist /opt/youtubemusic-nativefier
15 16
16private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier 17private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier
17private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types 18private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types
18private-opt youtubemusic-nativefier
19 19
20# Redirect 20# Redirect
21include electron-common.profile 21include electron-common.profile
diff --git a/etc/profile-m-z/ytmdesktop.profile b/etc/profile-m-z/ytmdesktop.profile
index de07e3ddf..ccf5f1e63 100644
--- a/etc/profile-m-z/ytmdesktop.profile
+++ b/etc/profile-m-z/ytmdesktop.profile
@@ -13,9 +13,9 @@ noblacklist ${HOME}/.config/youtube-music-desktop-app
13mkdir ${HOME}/.config/youtube-music-desktop-app 13mkdir ${HOME}/.config/youtube-music-desktop-app
14whitelist ${HOME}/.config/youtube-music-desktop-app 14whitelist ${HOME}/.config/youtube-music-desktop-app
15 15
16# private-bin env,ytmdesktop 16#private-bin env,ytmdesktop
17private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types 17private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types
18# private-opt 18#private-opt
19 19
20# Redirect 20# Redirect
21include electron-common.profile 21include electron-common.profile
diff --git a/etc/profile-m-z/zeal.profile b/etc/profile-m-z/zeal.profile
index 09a1d37a3..d576dbefd 100644
--- a/etc/profile-m-z/zeal.profile
+++ b/etc/profile-m-z/zeal.profile
@@ -67,5 +67,5 @@ dbus-user.talk org.mozilla.*
67?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher 67?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
68dbus-system none 68dbus-system none
69 69
70# memory-deny-write-execute - breaks on Arch 70#memory-deny-write-execute # breaks on Arch
71restrict-namespaces 71restrict-namespaces
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-11 12:29:31 +0000