6 files changed, 8 insertions, 14 deletions

diff --git a/etc/cherrytree.profile b/etc/cherrytree.profile
index 7c324a34b..d16e7c067 100644
--- a/etc/cherrytree.profile
+++ b/etc/cherrytree.profile
@@ -1,6 +1,7 @@
 # cherrytree note taking application
 noblacklist /usr/bin/python2*
 noblacklist /usr/lib/python3*
+noblacklist ${HOME}/.config/cherrytree/
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
@@ -15,13 +16,4 @@ seccomp
 protocol unix,inet,inet6,netlink
 tracelog
 
-include /etc/firejail/whitelist-common.inc
 
-# no private-bin support for various reasons:
-#10:25:34 exec 11249 (root) NEW SANDBOX: /usr/bin/firejail /usr/bin/cherrytree 
-#10:25:34 exec 11252 (netblue) /bin/bash -c "/usr/bin/cherrytree"  
-#10:25:34 exec 11252 (netblue) /usr/bin/python /usr/bin/cherrytree 
-#10:25:34 exec 11253 (netblue) sh -c /sbin/ldconfig -p 2>/dev/null 
-#10:25:34 exec 11255 (netblue) sh -c if type gcc >/dev/null 2>&1; then CC=gcc; elif type cc >/dev/null 2>&1; then CC=cc;else exit 10; fi;LANG=C LC_ALL=C $CC -Wl,-t -o /tmp/tmpiYr44S 2>&1 -llibc 
-# it requires acces to browser to show the online help
-# it doesn't play nicely with expect
diff --git a/etc/evince.profile b/etc/evince.profile
index 374fa4aaa..894c7c70d 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -15,5 +15,4 @@ shell none
 tracelog
 
 private-bin evince,evince-previewer,evince-thumbnailer
-whitelist /tmp/.X11-unix
 private-dev
diff --git a/etc/firejail-default b/etc/firejail-default
index 0b771f834..1b0eb7658 100644
--- a/etc/firejail-default
+++ b/etc/firejail-default
@@ -31,6 +31,9 @@ profile firejail-default {
 /{,var/}run/user/**/pulse/ rw,
 /{,var/}run/user/**/pulse/** rw,
 /{,var/}run/firejail/mnt/fslogger r,
+/{,var/}run/firejail/appimage r,
+/{,var/}run/firejail/appimage/** r,
+/{,var/}run/firejail/appimage/** ix,
 /{run,dev}/shm/ r,
 /{run,dev}/shm/** rmwk,
 
diff --git a/etc/keepass.profile b/etc/keepass.profile
index b2085f53d..23f9a7b40 100644
--- a/etc/keepass.profile
+++ b/etc/keepass.profile
@@ -13,7 +13,7 @@ nogroups
 nonewprivs
 noroot
 nosound
-protocol unix
+protocol unix,inet,inet6
 seccomp
 netfilter
 shell none
diff --git a/etc/libreoffice.profile b/etc/libreoffice.profile
index 75a52e9ff..d6aceb7a8 100644
--- a/etc/libreoffice.profile
+++ b/etc/libreoffice.profile
@@ -1,5 +1,6 @@
 # Firejail profile for LibreOffice
 noblacklist ~/.config/libreoffice
+noblacklist /usr/local/sbin
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
@@ -10,9 +11,9 @@ netfilter
 nogroups
 nonewprivs
 noroot
-protocol unix,inet,inet6,netlink
+protocol unix,inet,inet6
 seccomp
 tracelog
 
 private-dev
-whitelist /tmp/.X11-unix/
+# whitelist /tmp/.X11-unix/
diff --git a/etc/vlc.profile b/etc/vlc.profile
index cdd098dd5..446e47864 100644
--- a/etc/vlc.profile
+++ b/etc/vlc.profile
@@ -14,7 +14,6 @@ noroot
 protocol unix,inet,inet6
 seccomp
 shell none
-tracelog
 
 private-bin vlc,cvlc,nvlc,rvlc,qvlc,svlc
 private-dev