9 files changed, 145 insertions, 5 deletions

diff --git a/etc/profile-m-z/makepkg.profile b/etc/profile-m-z/makepkg.profile
index b6afbad59..49e84dedb 100644
--- a/etc/profile-m-z/makepkg.profile
+++ b/etc/profile-m-z/makepkg.profile
@@ -35,8 +35,8 @@ include disable-exec.inc
 include disable-programs.inc
 
 caps.drop all
-machine-id
 ipc-namespace
+machine-id
 netfilter
 no3d
 nodvd
diff --git a/etc/profile-m-z/qt5ct.profile b/etc/profile-m-z/qt5ct.profile
new file mode 100644
index 000000000..83d22c2cd
--- /dev/null
+++ b/etc/profile-m-z/qt5ct.profile
@@ -0,0 +1,65 @@
+# Firejail profile for qt5ct
+# Description: Qt5 Configuration Utility
+# This file is overwritten after every install/update
+# Persistent local customizations
+include qt5ct.local
+# Persistent global definitions
+include globals.local
+
+blacklist /usr/libexec
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-proc.inc
+include disable-programs.inc
+include disable-shell.inc
+include disable-xdg.inc
+
+mkdir ${HOME}/.config/qt5ct
+mkdir ${HOME}/.local/share/qt5ct
+whitelist ${HOME}/.config/qt5ct
+whitelist ${HOME}/.local/share/qt5ct
+
+include whitelist-common.inc
+include whitelist-run-common.inc
+include whitelist-runuser-common.inc
+include whitelist-usr-share-common.inc
+include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+machine-id
+net none
+no3d
+nodvd
+nogroups
+noinput
+nonewprivs
+noprinters
+noroot
+nosound
+notv
+nou2f
+novideo
+protocol unix
+seccomp
+seccomp.block-secondary
+tracelog
+
+disable-mnt
+private-bin qt5ct
+private-cache
+private-dev
+private-etc dbus-1,machine-id
+private-tmp
+
+dbus-user none
+dbus-system none
+
+memory-deny-write-execute
+read-only ${HOME}
+read-write ${HOME}/.config/qt5ct
+read-write ${HOME}/.local/share/qt5ct
+restrict-namespaces
diff --git a/etc/profile-m-z/qt6ct.profile b/etc/profile-m-z/qt6ct.profile
new file mode 100644
index 000000000..5667c98a3
--- /dev/null
+++ b/etc/profile-m-z/qt6ct.profile
@@ -0,0 +1,65 @@
+# Firejail profile for qt6ct
+# Description: Qt6 Configuration Utility
+# This file is overwritten after every install/update
+# Persistent local customizations
+include qt6ct.local
+# Persistent global definitions
+include globals.local
+
+blacklist /usr/libexec
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-proc.inc
+include disable-programs.inc
+include disable-shell.inc
+include disable-xdg.inc
+
+mkdir ${HOME}/.config/qt6ct
+mkdir ${HOME}/.local/share/qt6ct
+whitelist ${HOME}/.config/qt6ct
+whitelist ${HOME}/.local/share/qt6ct
+
+include whitelist-common.inc
+include whitelist-run-common.inc
+include whitelist-runuser-common.inc
+include whitelist-usr-share-common.inc
+include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+machine-id
+net none
+no3d
+nodvd
+nogroups
+noinput
+nonewprivs
+noprinters
+noroot
+nosound
+notv
+nou2f
+novideo
+protocol unix
+seccomp
+seccomp.block-secondary
+tracelog
+
+disable-mnt
+private-bin qt6ct
+private-cache
+private-dev
+private-etc dbus-1,machine-id
+private-tmp
+
+dbus-user none
+dbus-system none
+
+memory-deny-write-execute
+read-only ${HOME}
+read-write ${HOME}/.config/qt6ct
+read-write ${HOME}/.local/share/qt6ct
+restrict-namespaces
diff --git a/etc/profile-m-z/ssh.profile b/etc/profile-m-z/ssh.profile
index fde85be64..62efa28db 100644
--- a/etc/profile-m-z/ssh.profile
+++ b/etc/profile-m-z/ssh.profile
@@ -18,6 +18,7 @@ include disable-common.inc
 include disable-exec.inc
 include disable-programs.inc
 
+whitelist ${RUNUSER}/gcr/ssh
 whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh
 whitelist ${RUNUSER}/keyring/ssh
 include whitelist-usr-share-common.inc
diff --git a/etc/profile-m-z/tar.profile b/etc/profile-m-z/tar.profile
index da3b4f782..ca1234db0 100644
--- a/etc/profile-m-z/tar.profile
+++ b/etc/profile-m-z/tar.profile
@@ -17,7 +17,6 @@ ignore include disable-shell.inc
 # all capabilities this is automatically read-only.
 noblacklist /var/lib/pacman
 
-private-etc
 #private-lib libfakeroot,liblzma.so.*,libreadline.so.*
 # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic)
 writable-var
diff --git a/etc/profile-m-z/unlz4.profile b/etc/profile-m-z/unlz4.profile
new file mode 100644
index 000000000..00e7496e4
--- /dev/null
+++ b/etc/profile-m-z/unlz4.profile
@@ -0,0 +1,11 @@
+# Firejail profile for unlz4
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include unlz4.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+# Redirect
+include lz4.profile
diff --git a/etc/profile-m-z/unrar.profile b/etc/profile-m-z/unrar.profile
index 43d5dae5e..ed2acb12d 100644
--- a/etc/profile-m-z/unrar.profile
+++ b/etc/profile-m-z/unrar.profile
@@ -8,7 +8,6 @@ include unrar.local
 include globals.local
 
 private-bin unrar
-private-etc
 private-tmp
 
 # Redirect
diff --git a/etc/profile-m-z/unzip.profile b/etc/profile-m-z/unzip.profile
index 9fefe6ad3..88341a3ad 100644
--- a/etc/profile-m-z/unzip.profile
+++ b/etc/profile-m-z/unzip.profile
@@ -10,7 +10,5 @@ include globals.local
 # GNOME Shell integration (chrome-gnome-shell)
 noblacklist ${HOME}/.local/share/gnome-shell
 
-private-etc
-
 # Redirect
 include archiver-common.profile
diff --git a/etc/profile-m-z/virt-manager.profile b/etc/profile-m-z/virt-manager.profile
index 86fe63ef9..a93d873a8 100644
--- a/etc/profile-m-z/virt-manager.profile
+++ b/etc/profile-m-z/virt-manager.profile
@@ -6,6 +6,8 @@ include virt-manager.local
 # Persistent global definitions
 include globals.local
 
+blacklist /usr/libexec
+
 noblacklist ${HOME}/.cache/virt-manager
 noblacklist ${RUNUSER}/libvirt