diff options
Diffstat (limited to 'etc/snap.profile')
-rw-r--r-- | etc/snap.profile | 62 |
1 files changed, 0 insertions, 62 deletions
diff --git a/etc/snap.profile b/etc/snap.profile deleted file mode 100644 index ef4f3d3a6..000000000 --- a/etc/snap.profile +++ /dev/null | |||
@@ -1,62 +0,0 @@ | |||
1 | # Firejail profile for snap | ||
2 | # Description: Install, configure, refresh and remove snap packages | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include snap.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | # Note: Snap packages have their own confinement mechanism relying on snapd and apparmor. | ||
11 | # As such firejail is not able to deliver any additional sandboxing for snaps. This profile does sandbox | ||
12 | # the snap tool which is used to interact with snap packages. | ||
13 | # See https://docs.snapcraft.io/ for more detailed info. | ||
14 | |||
15 | noblacklist ${HOME}/.snap | ||
16 | noblacklist ${HOME}/snap | ||
17 | noblacklist ${DOWNLOADS} | ||
18 | |||
19 | noblacklist /var/cache/snapd | ||
20 | noblacklist /var/lib/snapd | ||
21 | noblacklist /var/snap | ||
22 | |||
23 | mkdir ${HOME}/.snap | ||
24 | mkdir ${HOME}/snap | ||
25 | whitelist ${HOME}/.snap | ||
26 | whitelist ${HOME}/snap | ||
27 | |||
28 | include disable-common.inc | ||
29 | include disable-devel.inc | ||
30 | include disable-interpreters.inc | ||
31 | include disable-passwdmgr.inc | ||
32 | include disable-programs.inc | ||
33 | include disable-xdg.inc | ||
34 | |||
35 | caps.drop all | ||
36 | ipc-namespace | ||
37 | machine-id | ||
38 | netfilter | ||
39 | no3d | ||
40 | nodbus | ||
41 | nodvd | ||
42 | nogroups | ||
43 | nonewprivs | ||
44 | noroot | ||
45 | nosound | ||
46 | notv | ||
47 | nou2f | ||
48 | novideo | ||
49 | protocol unix,inet,inet6 | ||
50 | seccomp | ||
51 | shell none | ||
52 | |||
53 | disable-mnt | ||
54 | private-bin snap | ||
55 | private-dev | ||
56 | private-etc group,passwd | ||
57 | private-lib snapd | ||
58 | private-tmp | ||
59 | |||
60 | memory-deny-write-execute | ||
61 | noexec ${HOME} | ||
62 | noexec /tmp | ||