diff options
Diffstat (limited to 'etc')
-rw-r--r-- | etc/Thunar.profile | 33 | ||||
-rw-r--r-- | etc/apparmor/firejail-default (renamed from etc/firejail-default) | 8 | ||||
-rw-r--r-- | etc/apparmor/firejail-local (renamed from etc/firejail-local) | 0 | ||||
-rw-r--r-- | etc/caja.profile | 43 | ||||
-rw-r--r-- | etc/dolphin.profile | 39 | ||||
-rw-r--r-- | etc/firejail.config | 39 | ||||
-rw-r--r-- | etc/inc/allow-common-devel.inc (renamed from etc/allow-common-devel.inc) | 6 | ||||
-rw-r--r-- | etc/inc/allow-gjs.inc (renamed from etc/allow-gjs.inc) | 1 | ||||
-rw-r--r-- | etc/inc/allow-java.inc (renamed from etc/allow-java.inc) | 0 | ||||
-rw-r--r-- | etc/inc/allow-lua.inc (renamed from etc/allow-lua.inc) | 4 | ||||
-rw-r--r-- | etc/inc/allow-perl.inc (renamed from etc/allow-perl.inc) | 0 | ||||
-rw-r--r-- | etc/inc/allow-php.inc (renamed from etc/allow-php.inc) | 0 | ||||
-rw-r--r-- | etc/inc/allow-python2.inc (renamed from etc/allow-python2.inc) | 0 | ||||
-rw-r--r-- | etc/inc/allow-python3.inc (renamed from etc/allow-python3.inc) | 0 | ||||
-rw-r--r-- | etc/inc/allow-ruby.inc (renamed from etc/allow-ruby.inc) | 0 | ||||
-rw-r--r-- | etc/inc/disable-common.inc (renamed from etc/disable-common.inc) | 76 | ||||
-rw-r--r-- | etc/inc/disable-devel.inc (renamed from etc/disable-devel.inc) | 1 | ||||
-rw-r--r-- | etc/inc/disable-exec.inc (renamed from etc/disable-exec.inc) | 0 | ||||
-rw-r--r-- | etc/inc/disable-interpreters.inc (renamed from etc/disable-interpreters.inc) | 6 | ||||
-rw-r--r-- | etc/inc/disable-passwdmgr.inc (renamed from etc/disable-passwdmgr.inc) | 0 | ||||
-rw-r--r-- | etc/inc/disable-programs.inc (renamed from etc/disable-programs.inc) | 117 | ||||
-rw-r--r-- | etc/inc/disable-shell.inc | 13 | ||||
-rw-r--r-- | etc/inc/disable-xdg.inc (renamed from etc/disable-xdg.inc) | 0 | ||||
-rw-r--r-- | etc/inc/feh-network.inc (renamed from etc/feh-network.inc) | 0 | ||||
-rw-r--r-- | etc/inc/firefox-common-addons.inc (renamed from etc/firefox-common-addons.inc) | 5 | ||||
-rw-r--r-- | etc/inc/softmaker-common.inc (renamed from etc/softmaker-common.inc) | 4 | ||||
-rw-r--r-- | etc/inc/whitelist-common.inc (renamed from etc/whitelist-common.inc) | 3 | ||||
-rw-r--r-- | etc/inc/whitelist-runuser-common.inc | 12 | ||||
-rw-r--r-- | etc/inc/whitelist-usr-share-common.inc (renamed from etc/whitelist-usr-share-common.inc) | 5 | ||||
-rw-r--r-- | etc/inc/whitelist-var-common.inc (renamed from etc/whitelist-var-common.inc) | 0 | ||||
-rw-r--r-- | etc/keepassxc.profile | 56 | ||||
-rw-r--r-- | etc/nautilus.profile | 44 | ||||
-rw-r--r-- | etc/nemo.profile | 38 | ||||
-rw-r--r-- | etc/net/nolocal.net (renamed from etc/nolocal.net) | 2 | ||||
-rw-r--r-- | etc/net/tcpserver.net (renamed from etc/tcpserver.net) | 0 | ||||
-rw-r--r-- | etc/net/webserver.net (renamed from etc/webserver.net) | 0 | ||||
-rw-r--r-- | etc/pcmanfm.profile | 33 | ||||
-rw-r--r-- | etc/profile-a-l/0ad.profile (renamed from etc/0ad.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/2048-qt.profile (renamed from etc/2048-qt.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/7z.profile (renamed from etc/7z.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/7za.profile (renamed from etc/7za.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/7zr.profile (renamed from etc/7zr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Builder.profile (renamed from etc/Builder.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Cheese.profile (renamed from etc/Cheese.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Cryptocat.profile (renamed from etc/Cryptocat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Cyberfox.profile (renamed from etc/Cyberfox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Discord.profile (renamed from etc/Discord.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/DiscordCanary.profile (renamed from etc/DiscordCanary.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Documents.profile (renamed from etc/Documents.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/FossaMail.profile (renamed from etc/FossaMail.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Fritzing.profile (renamed from etc/Fritzing.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Gitter.profile (renamed from etc/Gitter.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/JDownloader.profile (renamed from etc/JDownloader.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/Logs.profile (renamed from etc/Logs.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/abiword.profile | 49 | ||||
-rw-r--r-- | etc/profile-a-l/abrowser.profile (renamed from etc/abrowser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/acat.profile (renamed from etc/acat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/adiff.profile (renamed from etc/adiff.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/akonadi_control.profile (renamed from etc/akonadi_control.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/akregator.profile (renamed from etc/akregator.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/als.profile (renamed from etc/als.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/amarok.profile (renamed from etc/amarok.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/amule.profile (renamed from etc/amule.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/amuled.profile (renamed from etc/amuled.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/android-studio.profile (renamed from etc/android-studio.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/anki.profile (renamed from etc/anki.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/anydesk.profile (renamed from etc/anydesk.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/aosp.profile (renamed from etc/aosp.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/apack.profile (renamed from etc/apack.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/apktool.profile (renamed from etc/apktool.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/apostrophe.profile | 58 | ||||
-rw-r--r-- | etc/profile-a-l/ar.profile (renamed from etc/ar.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/arch-audit.profile (renamed from etc/arch-audit.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/archaudit-report.profile (renamed from etc/archaudit-report.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ardour4.profile (renamed from etc/ardour4.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ardour5.profile (renamed from etc/ardour5.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/arduino.profile (renamed from etc/arduino.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/arepack.profile (renamed from etc/arepack.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/aria2c.profile (renamed from etc/aria2c.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/ark.profile (renamed from etc/ark.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/arm.profile (renamed from etc/arm.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/artha.profile (renamed from etc/artha.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/assogiate.profile (renamed from etc/assogiate.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/asunder.profile (renamed from etc/asunder.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/atom-beta.profile (renamed from etc/atom-beta.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/atom.profile (renamed from etc/atom.profile) | 10 | ||||
-rw-r--r-- | etc/profile-a-l/atool.profile (renamed from etc/atool.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/atril-previewer.profile (renamed from etc/atril-previewer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/atril-thumbnailer.profile (renamed from etc/atril-thumbnailer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/atril.profile (renamed from etc/atril.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/audacious.profile (renamed from etc/audacious.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/audacity.profile (renamed from etc/audacity.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/audio-recorder.profile (renamed from etc/audio-recorder.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/aunpack.profile (renamed from etc/aunpack.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/authenticator.profile (renamed from etc/authenticator.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/autokey-common.profile (renamed from etc/autokey-common.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/autokey-gtk.profile (renamed from etc/autokey-gtk.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/autokey-qt.profile (renamed from etc/autokey-qt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/autokey-run.profile (renamed from etc/autokey-run.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/autokey-shell.profile (renamed from etc/autokey-shell.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/aweather.profile (renamed from etc/aweather.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/awesome.profile (renamed from etc/awesome.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/baloo_file.profile (renamed from etc/baloo_file.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/baloo_filemetadata_temp_extractor.profile (renamed from etc/baloo_filemetadata_temp_extractor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/baobab.profile (renamed from etc/baobab.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/barrier.profile (renamed from etc/barrier.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/basilisk.profile (renamed from etc/basilisk.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/beaker.profile (renamed from etc/beaker.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bibletime.profile (renamed from etc/bibletime.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/bibtex.profile (renamed from etc/bibtex.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bijiben.profile | 58 | ||||
-rw-r--r-- | etc/profile-a-l/bitcoin-qt.profile (renamed from etc/bitcoin-qt.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/bitlbee.profile (renamed from etc/bitlbee.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bitwarden.profile (renamed from etc/bitwarden.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/blackbox.profile (renamed from etc/blackbox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bleachbit.profile (renamed from etc/bleachbit.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/blender-2.8.profile (renamed from etc/blender-2.8.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/blender.profile (renamed from etc/blender.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/bless.profile (renamed from etc/bless.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/blobwars.profile | 50 | ||||
-rw-r--r-- | etc/profile-a-l/bluefish.profile (renamed from etc/bluefish.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/bnox.profile (renamed from etc/bnox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brackets.profile (renamed from etc/brackets.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brasero.profile (renamed from etc/brasero.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/brave-browser-beta.profile (renamed from etc/brave-browser-beta.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brave-browser-dev.profile (renamed from etc/brave-browser-dev.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brave-browser-nightly.profile (renamed from etc/brave-browser-nightly.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brave-browser-stable.profile (renamed from etc/brave-browser-stable.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brave-browser.profile (renamed from etc/brave-browser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brave.profile (renamed from etc/brave.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bsdcat.profile (renamed from etc/bsdcat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bsdcpio.profile (renamed from etc/bsdcpio.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bsdtar.profile (renamed from etc/bsdtar.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/bunzip2.profile (renamed from etc/bunzip2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bzcat.profile (renamed from etc/bzcat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bzflag.profile (renamed from etc/bzflag.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/bzip2.profile (renamed from etc/bzip2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/caja.profile | 15 | ||||
-rw-r--r-- | etc/profile-a-l/calibre.profile (renamed from etc/calibre.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/calligra.profile (renamed from etc/calligra.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/calligraauthor.profile (renamed from etc/calligraauthor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/calligraconverter.profile (renamed from etc/calligraconverter.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/calligraflow.profile (renamed from etc/calligraflow.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/calligraplan.profile (renamed from etc/calligraplan.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/calligraplanwork.profile (renamed from etc/calligraplanwork.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/calligrasheets.profile (renamed from etc/calligrasheets.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/calligrastage.profile (renamed from etc/calligrastage.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/calligrawords.profile (renamed from etc/calligrawords.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/cameramonitor.profile (renamed from etc/cameramonitor.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/cantata.profile (renamed from etc/cantata.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/catfish.profile (renamed from etc/catfish.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/cawbird.profile | 46 | ||||
-rw-r--r-- | etc/profile-a-l/celluloid.profile (renamed from etc/celluloid.profile) | 7 | ||||
-rw-r--r-- | etc/profile-a-l/checkbashisms.profile (renamed from etc/checkbashisms.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/cheese.profile (renamed from etc/cheese.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/cherrytree.profile (renamed from etc/cherrytree.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/chromium-browser.profile (renamed from etc/chromium-browser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/chromium-common.profile (renamed from etc/chromium-common.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/chromium.profile (renamed from etc/chromium.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/cin.profile (renamed from etc/cin.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/cinelerra.profile (renamed from etc/cinelerra.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clamav.profile (renamed from etc/clamav.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/clamdscan.profile (renamed from etc/clamdscan.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clamdtop.profile (renamed from etc/clamdtop.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clamscan.profile (renamed from etc/clamscan.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clamtk.profile (renamed from etc/clamtk.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/claws-mail.profile (renamed from etc/claws-mail.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clawsker.profile (renamed from etc/clawsker.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/clementine.profile (renamed from etc/clementine.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clion.profile (renamed from etc/clion.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clipgrab.profile (renamed from etc/clipgrab.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/clipit.profile (renamed from etc/clipit.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/cliqz.profile (renamed from etc/cliqz.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clocks.profile (renamed from etc/clocks.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/cmus.profile (renamed from etc/cmus.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/code-oss.profile (renamed from etc/code-oss.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/code.profile (renamed from etc/code.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/com.github.dahenson.agenda.profile | 66 | ||||
-rw-r--r-- | etc/profile-a-l/com.github.johnfactotum.Foliate.profile (renamed from etc/com.github.johnfactotum.Foliate.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/com.gitlab.newsflash.profile | 5 | ||||
-rw-r--r-- | etc/profile-a-l/conkeror.profile (renamed from etc/conkeror.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/conky.profile (renamed from etc/conky.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/conplay.profile (renamed from etc/conplay.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/corebird.profile (renamed from etc/corebird.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/cower.profile (renamed from etc/cower.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/cpio.profile (renamed from etc/cpio.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/crawl-tiles.profile (renamed from etc/crawl-tiles.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/crawl.profile (renamed from etc/crawl.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/crow.profile (renamed from etc/crow.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/cryptocat.profile (renamed from etc/cryptocat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/curl.profile (renamed from etc/curl.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/cvlc.profile (renamed from etc/cvlc.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/cyberfox.profile (renamed from etc/cyberfox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/d-feet.profile (renamed from etc/d-feet.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/darktable.profile (renamed from etc/darktable.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dconf-editor.profile (renamed from etc/dconf-editor.profile) | 7 | ||||
-rw-r--r-- | etc/profile-a-l/dconf.profile (renamed from etc/dconf.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ddgtk.profile (renamed from etc/ddgtk.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/deadbeef.profile (renamed from etc/deadbeef.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/default.profile (renamed from etc/default.profile) | 14 | ||||
-rw-r--r-- | etc/profile-a-l/deluge.profile (renamed from etc/deluge.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/desktopeditors.profile (renamed from etc/desktopeditors.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/devhelp.profile (renamed from etc/devhelp.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/devilspie.profile (renamed from etc/devilspie.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/devilspie2.profile (renamed from etc/devilspie2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dex2jar.profile (renamed from etc/dex2jar.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/dia.profile (renamed from etc/dia.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/dig.profile (renamed from etc/dig.profile) | 10 | ||||
-rw-r--r-- | etc/profile-a-l/digikam.profile (renamed from etc/digikam.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/dillo.profile (renamed from etc/dillo.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dino-im.profile | 14 | ||||
-rw-r--r-- | etc/profile-a-l/dino.profile (renamed from etc/dino.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/discord-canary.profile (renamed from etc/discord-canary.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/discord-common.profile (renamed from etc/discord-common.profile) | 11 | ||||
-rw-r--r-- | etc/profile-a-l/discord.profile (renamed from etc/discord.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/display.profile (renamed from etc/display.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/dnox.profile (renamed from etc/dnox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dnscrypt-proxy.profile (renamed from etc/dnscrypt-proxy.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/dnsmasq.profile (renamed from etc/dnsmasq.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dolphin.profile | 14 | ||||
-rw-r--r-- | etc/profile-a-l/dooble-qt4.profile (renamed from etc/dooble-qt4.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dooble.profile (renamed from etc/dooble.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dosbox.profile (renamed from etc/dosbox.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/dragon.profile (renamed from etc/dragon.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/drawio.profile (renamed from etc/drawio.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/dropbox.profile (renamed from etc/dropbox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/easystroke.profile (renamed from etc/easystroke.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/ebook-viewer.profile (renamed from etc/ebook-viewer.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/electron-mail.profile (renamed from etc/electron-mail.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/electron.profile (renamed from etc/electron.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/electrum.profile (renamed from etc/electrum.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/element-desktop.profile | 22 | ||||
-rw-r--r-- | etc/profile-a-l/elinks.profile (renamed from etc/elinks.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/emacs.profile (renamed from etc/emacs.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/email-common.profile (renamed from etc/email-common.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/empathy.profile (renamed from etc/empathy.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/enchant-2.profile (renamed from etc/enchant-2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/enchant-lsmod-2.profile (renamed from etc/enchant-lsmod-2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/enchant-lsmod.profile (renamed from etc/enchant-lsmod.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/enchant.profile (renamed from etc/enchant.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/engrampa.profile (renamed from etc/engrampa.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/enox.profile (renamed from etc/enox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/enpass.profile (renamed from etc/enpass.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/eo-common.profile (renamed from etc/eo-common.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/eog.profile (renamed from etc/eog.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/eom.profile (renamed from etc/eom.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ephemeral.profile (renamed from etc/ephemeral.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/epiphany.profile (renamed from etc/epiphany.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/et.profile (renamed from etc/et.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/etr.profile (renamed from etc/etr.profile) | 9 | ||||
-rw-r--r-- | etc/profile-a-l/evince-previewer.profile (renamed from etc/evince-previewer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/evince-thumbnailer.profile (renamed from etc/evince-thumbnailer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/evince.profile (renamed from etc/evince.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/evolution.profile (renamed from etc/evolution.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/exfalso.profile (renamed from etc/exfalso.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/exiftool.profile (renamed from etc/exiftool.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/falkon.profile (renamed from etc/falkon.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/fbreader.profile (renamed from etc/fbreader.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/fdns.profile | 50 | ||||
-rw-r--r-- | etc/profile-a-l/feedreader.profile (renamed from etc/feedreader.profile) | 10 | ||||
-rw-r--r-- | etc/profile-a-l/feh.profile (renamed from etc/feh.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/ferdi.profile | 46 | ||||
-rw-r--r-- | etc/profile-a-l/fetchmail.profile (renamed from etc/fetchmail.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ffmpeg.profile (renamed from etc/ffmpeg.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/ffmpegthumbnailer.profile (renamed from etc/ffmpegthumbnailer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ffplay.profile (renamed from etc/ffplay.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ffprobe.profile (renamed from etc/ffprobe.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/file-manager-common.profile | 52 | ||||
-rw-r--r-- | etc/profile-a-l/file-roller.profile (renamed from etc/file-roller.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/file.profile (renamed from etc/file.profile) | 9 | ||||
-rw-r--r-- | etc/profile-a-l/filezilla.profile (renamed from etc/filezilla.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-beta.profile (renamed from etc/firefox-beta.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-common.profile (renamed from etc/firefox-common.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-developer-edition.profile (renamed from etc/firefox-developer-edition.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-esr.profile (renamed from etc/firefox-esr.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-nightly.profile (renamed from etc/firefox-nightly.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-wayland.profile (renamed from etc/firefox-wayland.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-x11.profile (renamed from etc/firefox-x11.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/firefox.profile (renamed from etc/firefox.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/five-or-more.profile | 21 | ||||
-rw-r--r-- | etc/profile-a-l/flacsplt.profile (renamed from etc/flacsplt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/flameshot.profile (renamed from etc/flameshot.profile) | 17 | ||||
-rw-r--r-- | etc/profile-a-l/flashpeak-slimjet.profile (renamed from etc/flashpeak-slimjet.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/flowblade.profile (renamed from etc/flowblade.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/fluxbox.profile (renamed from etc/fluxbox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/font-manager.profile (renamed from etc/font-manager.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/fontforge.profile (renamed from etc/fontforge.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/fossamail.profile (renamed from etc/fossamail.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/four-in-a-row.profile | 19 | ||||
-rw-r--r-- | etc/profile-a-l/franz.profile (renamed from etc/franz.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/freecad.profile (renamed from etc/freecad.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/freecadcmd.profile (renamed from etc/freecadcmd.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/freeciv-gtk3.profile (renamed from etc/freeciv-gtk3.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/freeciv-mp-gtk3.profile (renamed from etc/freeciv-mp-gtk3.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/freeciv.profile (renamed from etc/freeciv.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/freecol.profile (renamed from etc/freecol.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/freemind.profile (renamed from etc/freemind.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/freeoffice-planmaker.profile (renamed from etc/freeoffice-planmaker.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/freeoffice-presentations.profile (renamed from etc/freeoffice-presentations.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/freeoffice-textmaker.profile (renamed from etc/freeoffice-textmaker.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/freetube.profile | 31 | ||||
-rw-r--r-- | etc/profile-a-l/freshclam.profile (renamed from etc/freshclam.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/frogatto.profile | 50 | ||||
-rw-r--r-- | etc/profile-a-l/frozen-bubble.profile (renamed from etc/frozen-bubble.profile) | 11 | ||||
-rw-r--r-- | etc/profile-a-l/gajim-history-manager.profile (renamed from etc/gajim-history-manager.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gajim.profile (renamed from etc/gajim.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/galculator.profile (renamed from etc/galculator.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/gapplication.profile | 71 | ||||
-rw-r--r-- | etc/profile-a-l/gcalccmd.profile (renamed from etc/gcalccmd.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gcloud.profile (renamed from etc/gcloud.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/gconf-editor.profile (renamed from etc/gconf-editor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gconf-merge-schema.profile (renamed from etc/gconf-merge-schema.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gconf-merge-tree.profile (renamed from etc/gconf-merge-tree.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gconf.profile (renamed from etc/gconf.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gconfpkg.profile (renamed from etc/gconfpkg.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gconftool-2.profile (renamed from etc/gconftool-2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/geany.profile (renamed from etc/geany.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/geary.profile (renamed from etc/geary.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gedit.profile (renamed from etc/gedit.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/geekbench.profile (renamed from etc/geekbench.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/geeqie.profile (renamed from etc/geeqie.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gfeeds.profile (renamed from etc/gfeeds.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/ghb.profile (renamed from etc/ghb.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ghostwriter.profile (renamed from etc/ghostwriter.profile) | 15 | ||||
-rw-r--r-- | etc/profile-a-l/gimp-2.10.profile (renamed from etc/gimp-2.10.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gimp-2.8.profile (renamed from etc/gimp-2.8.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gimp.profile (renamed from etc/gimp.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/gist-paste.profile (renamed from etc/gist-paste.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gist.profile (renamed from etc/gist.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/git-cola.profile | 66 | ||||
-rw-r--r-- | etc/profile-a-l/git.profile (renamed from etc/git.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gitg.profile (renamed from etc/gitg.profile) | 16 | ||||
-rw-r--r-- | etc/profile-a-l/github-desktop.profile (renamed from etc/github-desktop.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/gitter.profile (renamed from etc/gitter.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gjs.profile (renamed from etc/gjs.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/globaltime.profile (renamed from etc/globaltime.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gmpc.profile (renamed from etc/gmpc.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-2048.profile | 19 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-books.profile (renamed from etc/gnome-books.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-builder.profile (renamed from etc/gnome-builder.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-calculator.profile (renamed from etc/gnome-calculator.profile) | 11 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-calendar.profile | 62 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-character-map.profile (renamed from etc/gnome-character-map.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-characters.profile (renamed from etc/gnome-characters.profile) | 11 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-chess.profile (renamed from etc/gnome-chess.profile) | 10 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-clocks.profile (renamed from etc/gnome-clocks.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-contacts.profile (renamed from etc/gnome-contacts.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-documents.profile (renamed from etc/gnome-documents.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-font-viewer.profile (renamed from etc/gnome-font-viewer.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-hexgl.profile (renamed from etc/gnome-hexgl.profile) | 10 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-keyring-3.profile (renamed from etc/gnome-keyring-3.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-keyring.profile (renamed from etc/gnome-keyring.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-klotski.profile | 19 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-latex.profile (renamed from etc/gnome-latex.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-logs.profile (renamed from etc/gnome-logs.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-mahjongg.profile | 16 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-maps.profile (renamed from etc/gnome-maps.profile) | 11 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-mines.profile | 20 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-mplayer.profile (renamed from etc/gnome-mplayer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-mpv.profile (renamed from etc/gnome-mpv.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-music.profile (renamed from etc/gnome-music.profile) | 7 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-nettool.profile (renamed from etc/gnome-nettool.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-nibbles.profile | 23 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-passwordsafe.profile (renamed from etc/gnome-passwordsafe.profile) | 7 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-photos.profile (renamed from etc/gnome-photos.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-pie.profile (renamed from etc/gnome-pie.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-pomodoro.profile | 59 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-recipes.profile (renamed from etc/gnome-recipes.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-ring.profile (renamed from etc/gnome-ring.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-robots.profile | 19 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-schedule.profile (renamed from etc/gnome-schedule.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-screenshot.profile | 50 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-sound-recorder.profile (renamed from etc/gnome-sound-recorder.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-sudoku.profile | 19 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-system-log.profile (renamed from etc/gnome-system-log.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-taquin.profile | 19 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-tetravex.profile | 14 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-todo.profile | 64 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-twitch.profile (renamed from etc/gnome-twitch.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-weather.profile (renamed from etc/gnome-weather.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/gnome_games-common.profile | 48 | ||||
-rw-r--r-- | etc/profile-a-l/gnote.profile | 59 | ||||
-rw-r--r-- | etc/profile-a-l/gnubik.profile | 50 | ||||
-rw-r--r-- | etc/profile-a-l/godot.profile (renamed from etc/godot.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/goobox.profile (renamed from etc/goobox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/google-chrome-beta.profile (renamed from etc/google-chrome-beta.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/google-chrome-stable.profile (renamed from etc/google-chrome-stable.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/google-chrome-unstable.profile (renamed from etc/google-chrome-unstable.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/google-chrome.profile (renamed from etc/google-chrome.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/google-earth-pro.profile (renamed from etc/google-earth-pro.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/google-earth.profile (renamed from etc/google-earth.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/google-play-music-desktop-player.profile (renamed from etc/google-play-music-desktop-player.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gpa.profile (renamed from etc/gpa.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gpg-agent.profile (renamed from etc/gpg-agent.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gpg.profile (renamed from etc/gpg.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gpg2.profile (renamed from etc/gpg2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gpicview.profile (renamed from etc/gpicview.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/gpredict.profile (renamed from etc/gpredict.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/gradio.profile (renamed from etc/gradio.profile) | 15 | ||||
-rw-r--r-- | etc/profile-a-l/gramps.profile (renamed from etc/gramps.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/gravity-beams-and-evaporating-stars.profile | 47 | ||||
-rw-r--r-- | etc/profile-a-l/gsettings-data-convert.profile (renamed from etc/gsettings-data-convert.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gsettings-schema-convert.profile (renamed from etc/gsettings-schema-convert.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gsettings.profile (renamed from etc/gsettings.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gtar.profile (renamed from etc/gtar.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gthumb.profile (renamed from etc/gthumb.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/gtk-update-icon-cache.profile (renamed from etc/gtk-update-icon-cache.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/gtk-youtube-viewer | 18 | ||||
-rw-r--r-- | etc/profile-a-l/gtk2-youtube-viewer | 18 | ||||
-rw-r--r-- | etc/profile-a-l/gtk3-youtube-viewer | 18 | ||||
-rw-r--r-- | etc/profile-a-l/guayadeque.profile (renamed from etc/guayadeque.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/gucharmap.profile (renamed from etc/gucharmap.profile) | 7 | ||||
-rw-r--r-- | etc/profile-a-l/gummi.profile (renamed from etc/gummi.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gunzip.profile (renamed from etc/gunzip.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gwenview.profile (renamed from etc/gwenview.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/gzexe.profile (renamed from etc/gzexe.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gzip.profile (renamed from etc/gzip.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/handbrake-gtk.profile (renamed from etc/handbrake-gtk.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/handbrake.profile (renamed from etc/handbrake.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/hashcat.profile (renamed from etc/hashcat.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/hedgewars.profile (renamed from etc/hedgewars.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/hexchat.profile (renamed from etc/hexchat.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/highlight.profile (renamed from etc/highlight.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/hitori.profile | 14 | ||||
-rw-r--r-- | etc/profile-a-l/homebank.profile | 59 | ||||
-rw-r--r-- | etc/profile-a-l/host.profile | 52 | ||||
-rw-r--r-- | etc/profile-a-l/hugin.profile (renamed from etc/hugin.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/hyperrogue.profile | 51 | ||||
-rw-r--r-- | etc/profile-a-l/i2prouter.profile (renamed from etc/i2prouter.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/i3.profile (renamed from etc/i3.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/iagno.profile (renamed from etc/gnome-2048.profile) | 24 | ||||
-rw-r--r-- | etc/profile-a-l/icecat.profile (renamed from etc/icecat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/icedove.profile (renamed from etc/icedove.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/iceweasel.profile (renamed from etc/iceweasel.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/idea.profile (renamed from etc/idea.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/idea.sh.profile (renamed from etc/idea.sh.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ideaIC.profile (renamed from etc/ideaIC.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/imagej.profile (renamed from etc/imagej.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/img2txt.profile (renamed from etc/img2txt.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/impressive.profile (renamed from etc/impressive.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/inkscape.profile (renamed from etc/inkscape.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/inkview.profile (renamed from etc/inkview.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/inox.profile (renamed from etc/inox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/iridium-browser.profile (renamed from etc/iridium-browser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/iridium.profile (renamed from etc/iridium.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/itch.profile (renamed from etc/itch.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/jd-gui.profile (renamed from etc/jd-gui.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/jdownloader.profile (renamed from etc/jdownloader.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/jerry.profile (renamed from etc/jerry.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/jitsi-meet-desktop.profile | 39 | ||||
-rw-r--r-- | etc/profile-a-l/jitsi.profile (renamed from etc/jitsi.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/jumpnbump-menu.profile | 15 | ||||
-rw-r--r-- | etc/profile-a-l/jumpnbump.profile | 49 | ||||
-rw-r--r-- | etc/profile-a-l/k3b.profile (renamed from etc/k3b.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/kaffeine.profile (renamed from etc/kaffeine.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/kalgebra.profile (renamed from etc/kalgebra.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/kalgebramobile.profile (renamed from etc/kalgebramobile.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/karbon.profile (renamed from etc/karbon.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/kate.profile (renamed from etc/kate.profile) | 11 | ||||
-rw-r--r-- | etc/profile-a-l/kcalc.profile (renamed from etc/kcalc.profile) | 7 | ||||
-rw-r--r-- | etc/profile-a-l/kdeinit4.profile (renamed from etc/kdeinit4.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/kdenlive.profile (renamed from etc/kdenlive.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/keepass.profile (renamed from etc/keepass.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/keepass2.profile (renamed from etc/keepass2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/keepassx.profile (renamed from etc/keepassx.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/keepassx2.profile (renamed from etc/keepassx2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/keepassxc-cli.profile (renamed from etc/keepassxc-cli.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/keepassxc-proxy.profile (renamed from etc/keepassxc-proxy.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/keepassxc.profile | 81 | ||||
-rw-r--r-- | etc/profile-a-l/kfind.profile (renamed from etc/kfind.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/kget.profile (renamed from etc/kget.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/kid3-cli.profile (renamed from etc/kid3-cli.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/kid3-qt.profile (renamed from etc/kid3-qt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/kid3.profile (renamed from etc/kid3.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/kino.profile (renamed from etc/kino.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/kiwix-desktop.profile (renamed from etc/kiwix-desktop.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/klatexformula.profile (renamed from etc/klatexformula.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/klatexformula_cmdl.profile (renamed from etc/klatexformula_cmdl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/klavaro.profile (renamed from etc/klavaro.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/kmail.profile (renamed from etc/kmail.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/kmplayer.profile | 41 | ||||
-rw-r--r-- | etc/profile-a-l/knotes.profile (renamed from etc/knotes.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/kodi.profile (renamed from etc/kodi.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/konversation.profile (renamed from etc/konversation.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/kopete.profile (renamed from etc/kopete.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/krita.profile (renamed from etc/krita.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/krunner.profile (renamed from etc/krunner.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ktorrent.profile (renamed from etc/ktorrent.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/ktouch.profile (renamed from etc/ktouch.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/kwin_x11.profile (renamed from etc/kwin_x11.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/kwrite.profile (renamed from etc/kwrite.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/latex-common.profile (renamed from etc/latex-common.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/latex.profile (renamed from etc/latex.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lbunzip2.profile (renamed from etc/lbunzip2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lbzcat.profile (renamed from etc/lbzcat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lbzip2.profile (renamed from etc/lbzip2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/leafpad.profile (renamed from etc/leafpad.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/less.profile (renamed from etc/less.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/libreoffice.profile (renamed from etc/libreoffice.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/liferea.profile (renamed from etc/liferea.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lightsoff.profile | 16 | ||||
-rw-r--r-- | etc/profile-a-l/lincity-ng.profile (renamed from etc/lincity-ng.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/links.profile (renamed from etc/links.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/linphone.profile (renamed from etc/linphone.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lmms.profile (renamed from etc/lmms.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/lobase.profile (renamed from etc/lobase.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/localc.profile (renamed from etc/localc.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lodraw.profile (renamed from etc/lodraw.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/loffice.profile (renamed from etc/loffice.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lofromtemplate.profile (renamed from etc/lofromtemplate.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/loimpress.profile (renamed from etc/loimpress.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lollypop.profile (renamed from etc/lollypop.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lomath.profile (renamed from etc/lomath.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/loweb.profile (renamed from etc/loweb.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lowriter.profile (renamed from etc/lowriter.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lrunzip.profile (renamed from etc/lrunzip.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lrz.profile (renamed from etc/lrz.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lrzcat.profile (renamed from etc/lrzcat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lrzip.profile (renamed from etc/lrzip.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lrztar.profile (renamed from etc/lrztar.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lrzuntar.profile (renamed from etc/lrzuntar.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lugaru.profile (renamed from etc/lugaru.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/luminance-hdr.profile (renamed from etc/luminance-hdr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lximage-qt.profile (renamed from etc/lximage-qt.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/lxmusic.profile (renamed from etc/lxmusic.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lynx.profile (renamed from etc/lynx.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/lyx.profile | 33 | ||||
-rw-r--r-- | etc/profile-a-l/lzcat.profile (renamed from etc/lzcat.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzcmp.profile (renamed from etc/lzcmp.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzdiff.profile (renamed from etc/lzdiff.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lzegrep.profile (renamed from etc/lzegrep.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzfgrep.profile (renamed from etc/lzfgrep.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzgrep.profile (renamed from etc/lzgrep.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzip.profile (renamed from etc/lzip.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzless.profile (renamed from etc/lzless.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzma.profile (renamed from etc/lzma.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzmadec.profile (renamed from etc/lzmadec.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lzmainfo.profile (renamed from etc/lzmainfo.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzmore.profile (renamed from etc/lzmore.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/Maelstrom.profile (renamed from etc/Maelstrom.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/Maps.profile (renamed from etc/Maps.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/Mathematica.profile (renamed from etc/Mathematica.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/Natron.profile (renamed from etc/Natron.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/PPSSPPQt.profile (renamed from etc/PPSSPPQt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/QMediathekView.profile (renamed from etc/QMediathekView.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/QOwnNotes.profile (renamed from etc/QOwnNotes.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/Screenshot.profile | 6 | ||||
-rw-r--r-- | etc/profile-m-z/Telegram.profile (renamed from etc/Telegram.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/Thunar.profile | 12 | ||||
-rw-r--r-- | etc/profile-m-z/Viber.profile (renamed from etc/Viber.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/VirtualBox.profile (renamed from etc/VirtualBox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/XMind.profile (renamed from etc/XMind.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/Xephyr.profile (renamed from etc/Xephyr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/Xvfb.profile (renamed from etc/Xvfb.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ZeGrapher.profile | 48 | ||||
-rw-r--r-- | etc/profile-m-z/macrofusion.profile (renamed from etc/macrofusion.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/magicor.profile | 52 | ||||
-rw-r--r-- | etc/profile-m-z/makepkg.profile (renamed from etc/makepkg.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/manaplus.profile (renamed from etc/manaplus.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/masterpdfeditor.profile (renamed from etc/masterpdfeditor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/masterpdfeditor4.profile (renamed from etc/masterpdfeditor4.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/masterpdfeditor5.profile (renamed from etc/masterpdfeditor5.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mate-calc.profile (renamed from etc/mate-calc.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/mate-calculator.profile (renamed from etc/mate-calculator.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mate-color-select.profile (renamed from etc/mate-color-select.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/mate-dictionary.profile (renamed from etc/mate-dictionary.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/mathematica.profile (renamed from etc/mathematica.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mattermost-desktop.profile | 46 | ||||
-rw-r--r-- | etc/profile-m-z/mcabber.profile (renamed from etc/mcabber.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/mediainfo.profile (renamed from etc/mediainfo.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/mediathekview.profile (renamed from etc/mediathekview.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/megaglest.profile (renamed from etc/megaglest.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/megaglest_editor.profile (renamed from etc/megaglest_editor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/meld.profile (renamed from etc/meld.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/mencoder.profile (renamed from etc/mencoder.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/mendeleydesktop.profile (renamed from etc/mendeleydesktop.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/meteo-qt.profile (renamed from etc/meteo-qt.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/midori.profile (renamed from etc/midori.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/min.profile (renamed from etc/min.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mindless.profile | 51 | ||||
-rw-r--r-- | etc/profile-m-z/minecraft-launcher.profile | 58 | ||||
-rw-r--r-- | etc/profile-m-z/minetest.profile (renamed from etc/minetest.profile) | 11 | ||||
-rw-r--r-- | etc/profile-m-z/minitube.profile | 61 | ||||
-rw-r--r-- | etc/profile-m-z/mirrormagic.profile | 51 | ||||
-rw-r--r-- | etc/profile-m-z/mocp.profile | 53 | ||||
-rw-r--r-- | etc/profile-m-z/mousepad.profile (renamed from etc/mousepad.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/mp3splt-gtk.profile (renamed from etc/mp3splt-gtk.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/mp3splt.profile (renamed from etc/mp3splt.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/mp3wrap.profile (renamed from etc/mp3wrap.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpDris2.profile (renamed from etc/mpDris2.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/mpd.profile (renamed from etc/mpd.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-alsa.profile (renamed from etc/mpg123-alsa.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-id3dump.profile (renamed from etc/mpg123-id3dump.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-jack.profile (renamed from etc/mpg123-jack.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-nas.profile (renamed from etc/mpg123-nas.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-openal.profile (renamed from etc/mpg123-openal.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-oss.profile (renamed from etc/mpg123-oss.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-portaudio.profile (renamed from etc/mpg123-portaudio.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-pulse.profile (renamed from etc/mpg123-pulse.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-strip.profile (renamed from etc/mpg123-strip.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123.bin.profile (renamed from etc/mpg123.bin.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123.profile (renamed from etc/mpg123.profile) | 10 | ||||
-rw-r--r-- | etc/profile-m-z/mplayer.profile (renamed from etc/mplayer.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/mpsyt.profile (renamed from etc/mpsyt.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/mpv.profile (renamed from etc/mpv.profile) | 13 | ||||
-rw-r--r-- | etc/profile-m-z/mrrescue.profile | 49 | ||||
-rw-r--r-- | etc/profile-m-z/ms-excel.profile (renamed from etc/ms-excel.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ms-office.profile (renamed from etc/ms-office.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/ms-onenote.profile (renamed from etc/ms-onenote.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ms-outlook.profile (renamed from etc/ms-outlook.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ms-powerpoint.profile (renamed from etc/ms-powerpoint.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ms-skype.profile (renamed from etc/ms-skype.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ms-word.profile (renamed from etc/ms-word.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mtpaint.profile | 49 | ||||
-rw-r--r-- | etc/profile-m-z/multimc.profile (renamed from etc/multimc.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/multimc5.profile (renamed from etc/multimc5.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mumble.profile (renamed from etc/mumble.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/mupdf-gl.profile (renamed from etc/mupdf-gl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mupdf-x11-curl.profile (renamed from etc/mupdf-x11-curl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mupdf-x11.profile (renamed from etc/mupdf-x11.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mupdf.profile (renamed from etc/mupdf.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/mupen64plus.profile (renamed from etc/mupen64plus.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/muraster.profile (renamed from etc/muraster.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/musescore.profile (renamed from etc/musescore.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/musixmatch.profile (renamed from etc/musixmatch.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mutool.profile (renamed from etc/mutool.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mutt.profile (renamed from etc/mutt.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/mypaint-ora-thumbnailer.profile (renamed from etc/mypaint-ora-thumbnailer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mypaint.profile (renamed from etc/mypaint.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/nano.profile (renamed from etc/nano.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/natron.profile (renamed from etc/natron.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/nautilus.profile | 15 | ||||
-rw-r--r-- | etc/profile-m-z/ncdu.profile (renamed from etc/ncdu.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/nemo.profile | 12 | ||||
-rw-r--r-- | etc/profile-m-z/netactview.profile (renamed from etc/netactview.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/nethack-vultures.profile (renamed from etc/nethack-vultures.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/nethack.profile (renamed from etc/nethack.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/netsurf.profile (renamed from etc/netsurf.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/neverball.profile (renamed from etc/neverball.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/neverputt.profile (renamed from etc/neverputt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/newsbeuter.profile (renamed from etc/newsbeuter.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/newsboat.profile (renamed from etc/newsboat.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/newsflash.profile | 60 | ||||
-rw-r--r-- | etc/profile-m-z/nheko.profile (renamed from etc/nheko.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/nicotine.profile | 56 | ||||
-rw-r--r-- | etc/profile-m-z/nitroshare-cli.profile (renamed from etc/nitroshare-cli.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/nitroshare-nmh.profile (renamed from etc/nitroshare-nmh.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/nitroshare-send.profile (renamed from etc/nitroshare-send.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/nitroshare-ui.profile (renamed from etc/nitroshare-ui.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/nitroshare.profile (renamed from etc/nitroshare.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/nomacs.profile (renamed from etc/nomacs.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/nslookup.profile | 56 | ||||
-rw-r--r-- | etc/profile-m-z/nuclear.profile | 40 | ||||
-rw-r--r-- | etc/profile-m-z/nylas.profile (renamed from etc/nylas.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/nyx.profile (renamed from etc/nyx.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/obs.profile (renamed from etc/obs.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ocenaudio.profile (renamed from etc/ocenaudio.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/odt2txt.profile (renamed from etc/odt2txt.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/oggsplt.profile (renamed from etc/oggsplt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/okular.profile (renamed from etc/okular.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/onionshare-gui.profile (renamed from etc/onionshare-gui.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ooffice.profile (renamed from etc/ooffice.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ooviewdoc.profile (renamed from etc/ooviewdoc.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/open-invaders.profile (renamed from etc/open-invaders.profile) | 10 | ||||
-rw-r--r-- | etc/profile-m-z/openarena.profile (renamed from etc/openarena.profile) | 27 | ||||
-rw-r--r-- | etc/profile-m-z/openarena_ded.profile | 5 | ||||
-rw-r--r-- | etc/profile-m-z/openbox.profile (renamed from etc/openbox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/opencity.profile (renamed from etc/opencity.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/openclonk.profile (renamed from etc/openclonk.profile) | 9 | ||||
-rw-r--r-- | etc/profile-m-z/openoffice.org.profile (renamed from etc/openoffice.org.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/openshot-qt.profile (renamed from etc/openshot-qt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/openshot.profile (renamed from etc/openshot.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/openttd.profile (renamed from etc/openttd.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/opera-beta.profile (renamed from etc/opera-beta.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/opera.profile (renamed from etc/opera.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/orage.profile (renamed from etc/orage.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/org.gnome.NautilusPreviewer.profile | 10 | ||||
-rw-r--r-- | etc/profile-m-z/ostrichriders.profile (renamed from etc/ostrichriders.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/otter-browser.profile | 59 | ||||
-rw-r--r-- | etc/profile-m-z/out123.profile (renamed from etc/out123.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/p7zip.profile (renamed from etc/p7zip.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/palemoon.profile (renamed from etc/palemoon.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pandoc.profile (renamed from etc/pandoc.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/parole.profile (renamed from etc/parole.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/patch.profile (renamed from etc/patch.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/pavucontrol-qt.profile (renamed from etc/pavucontrol-qt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pavucontrol.profile (renamed from etc/pavucontrol.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/pcmanfm.profile | 12 | ||||
-rw-r--r-- | etc/profile-m-z/pdfchain.profile (renamed from etc/pdfchain.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/pdflatex.profile (renamed from etc/pdflatex.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pdfmod.profile (renamed from etc/pdfmod.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/pdfsam.profile (renamed from etc/pdfsam.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/pdftotext.profile (renamed from etc/pdftotext.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/peek.profile (renamed from etc/peek.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/penguin-command.profile | 42 | ||||
-rw-r--r-- | etc/profile-m-z/picard.profile (renamed from etc/picard.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pidgin.profile (renamed from etc/pidgin.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ping.profile (renamed from etc/ping.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/pingus.profile (renamed from etc/pingus.profile) | 17 | ||||
-rw-r--r-- | etc/profile-m-z/pinta.profile (renamed from etc/pinta.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/pioneer.profile (renamed from etc/pioneer.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/pithos.profile (renamed from etc/pithos.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/pitivi.profile (renamed from etc/pitivi.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/pix.profile (renamed from etc/pix.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/planmaker18.profile (renamed from etc/planmaker18.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/planmaker18free.profile (renamed from etc/planmaker18free.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/playonlinux.profile (renamed from etc/playonlinux.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pluma.profile (renamed from etc/pluma.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/plv.profile | 59 | ||||
-rw-r--r-- | etc/profile-m-z/pngquant.profile (renamed from etc/pngquant.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/polari.profile (renamed from etc/polari.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/ppsspp.profile (renamed from etc/ppsspp.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/pragha.profile (renamed from etc/pragha.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/presentations18.profile (renamed from etc/presentations18.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/presentations18free.profile (renamed from etc/presentations18free.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/profanity.profile (renamed from etc/profanity.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/psi-plus.profile (renamed from etc/psi-plus.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pybitmessage.profile (renamed from etc/pybitmessage.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pycharm-community.profile (renamed from etc/pycharm-community.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pycharm-professional.profile (renamed from etc/pycharm-professional.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pzstd.profile (renamed from etc/pzstd.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/qbittorrent.profile (renamed from etc/qbittorrent.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/qemu-launcher.profile (renamed from etc/qemu-launcher.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/qemu-system-x86_64.profile (renamed from etc/qemu-system-x86_64.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/qgis.profile (renamed from etc/qgis.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/qlipper.profile (renamed from etc/qlipper.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/qmmp.profile (renamed from etc/qmmp.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/qpdfview.profile (renamed from etc/qpdfview.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/qt-faststart.profile (renamed from etc/qt-faststart.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/qtox.profile (renamed from etc/qtox.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/quadrapassel.profile | 20 | ||||
-rw-r--r-- | etc/profile-m-z/quassel.profile (renamed from etc/quassel.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/quiterss.profile (renamed from etc/quiterss.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/qupzilla.profile (renamed from etc/qupzilla.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/qutebrowser.profile (renamed from etc/qutebrowser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/rambox.profile (renamed from etc/rambox.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/ranger.profile | 12 | ||||
-rw-r--r-- | etc/profile-m-z/redeclipse.profile (renamed from etc/redeclipse.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/redshift.profile (renamed from etc/redshift.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/regextester.profile (renamed from etc/regextester.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/remmina.profile (renamed from etc/remmina.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/rhythmbox-client.profile (renamed from etc/rhythmbox-client.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/rhythmbox.profile (renamed from etc/rhythmbox.profile) | 17 | ||||
-rw-r--r-- | etc/profile-m-z/ricochet.profile (renamed from etc/ricochet.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/riot-desktop.profile (renamed from etc/riot-desktop.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/riot-web.profile (renamed from etc/riot-web.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ripperx.profile | 43 | ||||
-rw-r--r-- | etc/profile-m-z/ristretto.profile (renamed from etc/ristretto.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/rnano.profile (renamed from etc/rnano.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/rocketchat.profile (renamed from etc/rocketchat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/rsync-download_only.profile (renamed from etc/rsync-download_only.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/rtorrent.profile (renamed from etc/rtorrent.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/rtv.profile (renamed from etc/rtv.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/runenpass.sh.profile (renamed from etc/runenpass.sh.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/rview.profile (renamed from etc/rview.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/rvim.profile (renamed from etc/rvim.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/sayonara.profile (renamed from etc/sayonara.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/scallion.profile (renamed from etc/scallion.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/scorched3d-wrapper.profile | 10 | ||||
-rw-r--r-- | etc/profile-m-z/scorched3d.profile (renamed from etc/scorched3d.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/scorchwentbonkers.profile | 50 | ||||
-rw-r--r-- | etc/profile-m-z/scp.profile (renamed from etc/scp.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/scribus.profile (renamed from etc/scribus.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/sdat2img.profile (renamed from etc/sdat2img.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/seahorse-adventures.profile | 51 | ||||
-rw-r--r-- | etc/profile-m-z/seahorse-daemon.profile (renamed from etc/seahorse-daemon.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/seahorse-tool.profile (renamed from etc/seahorse-tool.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/seahorse.profile (renamed from etc/seahorse.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/seamonkey-bin.profile (renamed from etc/seamonkey-bin.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/seamonkey.profile (renamed from etc/seamonkey.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/secret-tool.profile (renamed from etc/secret-tool.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/server.profile (renamed from etc/server.profile) | 29 | ||||
-rw-r--r-- | etc/profile-m-z/sftp.profile (renamed from etc/sftp.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/shellcheck.profile (renamed from etc/shellcheck.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/shortwave.profile | 50 | ||||
-rw-r--r-- | etc/profile-m-z/shotcut.profile (renamed from etc/shotcut.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/signal-cli.profile (renamed from etc/signal-cli.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/signal-desktop.profile (renamed from etc/signal-desktop.profile) | 11 | ||||
-rw-r--r-- | etc/profile-m-z/silentarmy.profile (renamed from etc/silentarmy.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/simple-scan.profile (renamed from etc/simple-scan.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/simplescreenrecorder.profile (renamed from etc/simplescreenrecorder.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/simutrans.profile (renamed from etc/simutrans.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/skanlite.profile (renamed from etc/skanlite.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/skypeforlinux.profile (renamed from etc/skypeforlinux.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/slack.profile (renamed from etc/slack.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/slashem.profile (renamed from etc/slashem.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/smplayer.profile (renamed from etc/smplayer.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/smtube.profile (renamed from etc/smtube.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/snox.profile (renamed from etc/snox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/soffice.profile (renamed from etc/soffice.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/sol.profile (renamed from etc/sol.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/sound-juicer.profile | 43 | ||||
-rw-r--r-- | etc/profile-m-z/soundconverter.profile (renamed from etc/soundconverter.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/spectre-meltdown-checker.profile (renamed from etc/spectre-meltdown-checker.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/spotify.profile (renamed from etc/spotify.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/sqlitebrowser.profile (renamed from etc/sqlitebrowser.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/ssh-agent.profile (renamed from etc/ssh-agent.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/ssh.profile (renamed from etc/ssh.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/standardnotes-desktop.profile (renamed from etc/standardnotes-desktop.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/start-tor-browser.desktop.profile (renamed from etc/start-tor-browser.desktop.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/start-tor-browser.profile (renamed from etc/start-tor-browser.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/steam-native.profile (renamed from etc/steam-native.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/steam-runtime.profile | 5 | ||||
-rw-r--r-- | etc/profile-m-z/steam.profile (renamed from etc/steam.profile) | 65 | ||||
-rw-r--r-- | etc/profile-m-z/stellarium.profile (renamed from etc/stellarium.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/strawberry.profile | 49 | ||||
-rw-r--r-- | etc/profile-m-z/strings.profile (renamed from etc/strings.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/studio.sh.profile (renamed from etc/studio.sh.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/subdownloader.profile (renamed from etc/subdownloader.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/supertux2.profile (renamed from etc/supertux2.profile) | 11 | ||||
-rw-r--r-- | etc/profile-m-z/supertuxkart.profile (renamed from etc/supertuxkart.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/surf.profile (renamed from etc/surf.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/sushi.profile | 48 | ||||
-rw-r--r-- | etc/profile-m-z/swell-foop.profile | 21 | ||||
-rw-r--r-- | etc/profile-m-z/sylpheed.profile (renamed from etc/sylpheed.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/synfigstudio.profile (renamed from etc/synfigstudio.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/sysprof-cli.profile (renamed from etc/sysprof-cli.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/sysprof.profile (renamed from etc/sysprof.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/tar.profile (renamed from etc/tar.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/tb-starter-wrapper.profile (renamed from etc/tb-starter-wrapper.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tcpdump.profile (renamed from etc/tcpdump.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/teams-for-linux.profile (renamed from etc/teams-for-linux.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/teams.profile (renamed from etc/teams.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/teamspeak3.profile (renamed from etc/teamspeak3.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/teeworlds.profile (renamed from etc/teeworlds.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/telegram-desktop.profile (renamed from etc/telegram-desktop.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/telegram.profile (renamed from etc/telegram.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/terasology.profile (renamed from etc/terasology.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/tex.profile (renamed from etc/tex.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/textmaker18.profile (renamed from etc/textmaker18.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/textmaker18free.profile (renamed from etc/textmaker18free.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/thunar.profile (renamed from etc/thunar.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/thunderbird-beta.profile (renamed from etc/thunderbird-beta.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/thunderbird-wayland.profile (renamed from etc/thunderbird-wayland.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/thunderbird.profile (renamed from etc/thunderbird.profile) | 17 | ||||
-rw-r--r-- | etc/profile-m-z/tilp.profile (renamed from etc/tilp.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ar.profile (renamed from etc/tor-browser-ar.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ca.profile (renamed from etc/tor-browser-ca.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-cs.profile (renamed from etc/tor-browser-cs.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-da.profile (renamed from etc/tor-browser-da.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-de.profile (renamed from etc/tor-browser-de.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-el.profile (renamed from etc/tor-browser-el.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-en-us.profile (renamed from etc/tor-browser-en-us.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-en.profile (renamed from etc/tor-browser-en.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-es-es.profile (renamed from etc/tor-browser-es-es.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-es.profile (renamed from etc/tor-browser-es.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-fa.profile (renamed from etc/tor-browser-fa.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-fr.profile (renamed from etc/tor-browser-fr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ga-ie.profile (renamed from etc/tor-browser-ga-ie.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-he.profile (renamed from etc/tor-browser-he.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-hu.profile (renamed from etc/tor-browser-hu.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-id.profile (renamed from etc/tor-browser-id.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-is.profile (renamed from etc/tor-browser-is.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-it.profile (renamed from etc/tor-browser-it.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ja.profile (renamed from etc/tor-browser-ja.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ka.profile (renamed from etc/tor-browser-ka.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ko.profile (renamed from etc/tor-browser-ko.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-nb.profile (renamed from etc/tor-browser-nb.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-nl.profile (renamed from etc/tor-browser-nl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-pl.profile (renamed from etc/tor-browser-pl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-pt-br.profile (renamed from etc/tor-browser-pt-br.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ru.profile (renamed from etc/tor-browser-ru.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-sv-se.profile (renamed from etc/tor-browser-sv-se.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-tr.profile (renamed from etc/tor-browser-tr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-vi.profile (renamed from etc/tor-browser-vi.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-zh-cn.profile (renamed from etc/tor-browser-zh-cn.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-zh-tw.profile (renamed from etc/tor-browser-zh-tw.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser.profile (renamed from etc/tor-browser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ar.profile (renamed from etc/tor-browser_ar.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ca.profile (renamed from etc/tor-browser_ca.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_cs.profile (renamed from etc/tor-browser_cs.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_da.profile (renamed from etc/tor-browser_da.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_de.profile (renamed from etc/tor-browser_de.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_el.profile (renamed from etc/tor-browser_el.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_en-US.profile (renamed from etc/tor-browser_en-US.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_en.profile (renamed from etc/tor-browser_en.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_es-ES.profile (renamed from etc/tor-browser_es-ES.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_es.profile (renamed from etc/tor-browser_es.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_fa.profile (renamed from etc/tor-browser_fa.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_fr.profile (renamed from etc/tor-browser_fr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ga-IE.profile (renamed from etc/tor-browser_ga-IE.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_he.profile (renamed from etc/tor-browser_he.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_hu.profile (renamed from etc/tor-browser_hu.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_id.profile (renamed from etc/tor-browser_id.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_is.profile (renamed from etc/tor-browser_is.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_it.profile (renamed from etc/tor-browser_it.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ja.profile (renamed from etc/tor-browser_ja.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ka.profile (renamed from etc/tor-browser_ka.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ko.profile (renamed from etc/tor-browser_ko.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_nb.profile (renamed from etc/tor-browser_nb.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_nl.profile (renamed from etc/tor-browser_nl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_pl.profile (renamed from etc/tor-browser_pl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_pt-BR.profile (renamed from etc/tor-browser_pt-BR.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ru.profile (renamed from etc/tor-browser_ru.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_sv-SE.profile (renamed from etc/tor-browser_sv-SE.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_tr.profile (renamed from etc/tor-browser_tr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_vi.profile (renamed from etc/tor-browser_vi.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_zh-CN.profile (renamed from etc/tor-browser_zh-CN.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_zh-TW.profile (renamed from etc/tor-browser_zh-TW.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor.profile (renamed from etc/tor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/torbrowser-launcher.profile (renamed from etc/torbrowser-launcher.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/torcs.profile (renamed from etc/torcs.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/totem.profile (renamed from etc/totem.profile) | 10 | ||||
-rw-r--r-- | etc/profile-m-z/tracker.profile (renamed from etc/tracker.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/transgui.profile (renamed from etc/transgui.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-cli.profile (renamed from etc/transmission-cli.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-common.profile (renamed from etc/transmission-common.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-create.profile (renamed from etc/transmission-create.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-daemon.profile (renamed from etc/transmission-daemon.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-edit.profile (renamed from etc/transmission-edit.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-gtk.profile (renamed from etc/transmission-gtk.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-qt.profile (renamed from etc/transmission-qt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-remote-cli.profile (renamed from etc/transmission-remote-cli.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-remote-gtk.profile (renamed from etc/transmission-remote-gtk.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-remote.profile (renamed from etc/transmission-remote.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-show.profile (renamed from etc/transmission-show.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tremulous.profile (renamed from etc/tremulous.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/truecraft.profile (renamed from etc/truecraft.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ts3client_runscript.sh.profile | 19 | ||||
-rw-r--r-- | etc/profile-m-z/tshark.profile (renamed from etc/tshark.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/tuxguitar.profile (renamed from etc/tuxguitar.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/tvbrowser.profile (renamed from etc/tvbrowser.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/udiskie.profile (renamed from etc/udiskie.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/uefitool.profile (renamed from etc/uefitool.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/uget-gtk.profile (renamed from etc/uget-gtk.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/unbound.profile (renamed from etc/unbound.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/uncompress.profile (renamed from etc/uncompress.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/unf.profile (renamed from etc/unf.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/unknown-horizons.profile (renamed from etc/unknown-horizons.profile) | 10 | ||||
-rw-r--r-- | etc/profile-m-z/unlzma.profile (renamed from etc/unlzma.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/unrar.profile (renamed from etc/unrar.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/unxz.profile (renamed from etc/unxz.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/unzip.profile (renamed from etc/unzip.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/unzstd.profile (renamed from etc/unzstd.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/utox.profile (renamed from etc/utox.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/uudeview.profile (renamed from etc/uudeview.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/uzbl-browser.profile (renamed from etc/uzbl-browser.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/viewnior.profile (renamed from etc/viewnior.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/viking.profile (renamed from etc/viking.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vim.profile (renamed from etc/vim.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/vimcat.profile (renamed from etc/vimcat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vimdiff.profile (renamed from etc/vimdiff.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vimpager.profile (renamed from etc/vimpager.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vimtutor.profile (renamed from etc/vimtutor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/virtualbox.profile (renamed from etc/virtualbox.profile) | 19 | ||||
-rw-r--r-- | etc/profile-m-z/vivaldi-beta.profile (renamed from etc/vivaldi-beta.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vivaldi-snapshot.profile (renamed from etc/vivaldi-snapshot.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vivaldi-stable.profile (renamed from etc/vivaldi-stable.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vivaldi.profile (renamed from etc/vivaldi.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/vlc.profile (renamed from etc/vlc.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/vmware.profile | 39 | ||||
-rw-r--r-- | etc/profile-m-z/vscodium.profile (renamed from etc/vscodium.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vulturesclaw.profile (renamed from etc/vulturesclaw.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vultureseye.profile (renamed from etc/vultureseye.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vym.profile (renamed from etc/vym.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/w3m.profile (renamed from etc/w3m.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/warmux.profile | 56 | ||||
-rw-r--r-- | etc/profile-m-z/warsow.profile (renamed from etc/warsow.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/warzone2100.profile (renamed from etc/warzone2100.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/waterfox-classic.profile (renamed from etc/waterfox-classic.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/waterfox-current.profile (renamed from etc/waterfox-current.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/waterfox.profile (renamed from etc/waterfox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/webstorm.profile (renamed from etc/webstorm.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/webui-aria2.profile (renamed from etc/webui-aria2.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/weechat-curses.profile (renamed from etc/weechat-curses.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/weechat.profile (renamed from etc/weechat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/wesnoth.profile (renamed from etc/wesnoth.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/wget.profile (renamed from etc/wget.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/whalebird.profile (renamed from etc/whalebird.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/whois.profile (renamed from etc/whois.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/widelands.profile (renamed from etc/widelands.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/wine.profile (renamed from etc/wine.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/wire-desktop.profile (renamed from etc/wire-desktop.profile) | 9 | ||||
-rw-r--r-- | etc/profile-m-z/wireshark-gtk.profile (renamed from etc/wireshark-gtk.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/wireshark-qt.profile (renamed from etc/wireshark-qt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/wireshark.profile (renamed from etc/wireshark.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/wordwarvi.profile | 52 | ||||
-rw-r--r-- | etc/profile-m-z/wpp.profile (renamed from etc/wpp.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/wps.profile (renamed from etc/wps.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/wpspdf.profile (renamed from etc/wpspdf.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/x-terminal-emulator.profile (renamed from etc/x-terminal-emulator.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/x2goclient.profile | 49 | ||||
-rw-r--r-- | etc/profile-m-z/xbill.profile | 54 | ||||
-rw-r--r-- | etc/profile-m-z/xcalc.profile (renamed from etc/xcalc.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/xchat.profile (renamed from etc/xchat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xed.profile (renamed from etc/xed.profile) | 10 | ||||
-rw-r--r-- | etc/profile-m-z/xfburn.profile (renamed from etc/xfburn.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xfce4-dict.profile (renamed from etc/xfce4-dict.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/xfce4-mixer.profile (renamed from etc/xfce4-mixer.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/xfce4-notes.profile (renamed from etc/xfce4-notes.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/xfce4-screenshooter.profile | 51 | ||||
-rw-r--r-- | etc/profile-m-z/xiphos.profile (renamed from etc/xiphos.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xlinks.profile (renamed from etc/xlinks.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xmms.profile (renamed from etc/xmms.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xmr-stak.profile (renamed from etc/xmr-stak.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xonotic-glx.profile (renamed from etc/xonotic-glx.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xonotic-sdl-wrapper.profile | 6 | ||||
-rw-r--r-- | etc/profile-m-z/xonotic-sdl.profile (renamed from etc/xonotic-sdl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xonotic.profile (renamed from etc/xonotic.profile) | 15 | ||||
-rw-r--r-- | etc/profile-m-z/xournal.profile | 50 | ||||
-rw-r--r-- | etc/profile-m-z/xpdf.profile (renamed from etc/xpdf.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/xplayer-audio-preview.profile (renamed from etc/xplayer-audio-preview.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xplayer-video-thumbnailer.profile (renamed from etc/xplayer-video-thumbnailer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xplayer.profile (renamed from etc/xplayer.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/xpra.profile (renamed from etc/xpra.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xreader-previewer.profile (renamed from etc/xreader-previewer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xreader-thumbnailer.profile (renamed from etc/xreader-thumbnailer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xreader.profile (renamed from etc/xreader.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xviewer.profile (renamed from etc/xviewer.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/xxd.profile (renamed from etc/xxd.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/xz.profile (renamed from etc/xz.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xzcat.profile (renamed from etc/xzcat.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xzcmp.profile (renamed from etc/xzcmp.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xzdec.profile (renamed from etc/xzdec.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/xzdiff.profile (renamed from etc/xzdiff.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xzegrep.profile (renamed from etc/xzegrep.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xzfgrep.profile (renamed from etc/xzfgrep.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xzgrep.profile (renamed from etc/xzgrep.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xzless.profile (renamed from etc/xzless.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xzmore.profile (renamed from etc/xzmore.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/yandex-browser.profile (renamed from etc/yandex-browser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/yelp.profile (renamed from etc/yelp.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/youtube-dl.profile (renamed from etc/youtube-dl.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/youtube-viewer.profile | 57 | ||||
-rw-r--r-- | etc/profile-m-z/zaproxy.profile (renamed from etc/zaproxy.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zart.profile (renamed from etc/zart.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/zathura.profile (renamed from etc/zathura.profile) | 9 | ||||
-rw-r--r-- | etc/profile-m-z/zcat.profile (renamed from etc/zcat.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/zcmp.profile (renamed from etc/zcmp.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zdiff.profile (renamed from etc/zdiff.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zeal.profile (renamed from etc/zeal.profile) | 16 | ||||
-rw-r--r-- | etc/profile-m-z/zegrep.profile (renamed from etc/zegrep.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zfgrep.profile (renamed from etc/zfgrep.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zforce.profile (renamed from etc/zforce.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zgrep.profile (renamed from etc/zgrep.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/zless.profile (renamed from etc/zless.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zmore.profile (renamed from etc/zmore.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/znew.profile (renamed from etc/znew.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zoom.profile (renamed from etc/zoom.profile) | 18 | ||||
-rw-r--r-- | etc/profile-m-z/zpaq.profile (renamed from etc/zpaq.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zstd.profile (renamed from etc/zstd.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/zstdcat.profile (renamed from etc/zstdcat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zstdgrep.profile (renamed from etc/zstdgrep.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zstdless.profile (renamed from etc/zstdless.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zstdmt.profile (renamed from etc/zstdmt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zulip.profile (renamed from etc/zulip.profile) | 1 | ||||
-rw-r--r-- | etc/ranger.profile | 42 | ||||
-rw-r--r-- | etc/templates/profile.template | 24 |
1048 files changed, 5678 insertions, 800 deletions
diff --git a/etc/Thunar.profile b/etc/Thunar.profile deleted file mode 100644 index 761440ccc..000000000 --- a/etc/Thunar.profile +++ /dev/null | |||
@@ -1,33 +0,0 @@ | |||
1 | # Firejail profile for Thunar | ||
2 | # Description: File Manager for Xfce | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include Thunar.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/Trash | ||
10 | noblacklist ${HOME}/.config/Thunar | ||
11 | noblacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | # include disable-programs.inc | ||
18 | |||
19 | allusers | ||
20 | caps.drop all | ||
21 | netfilter | ||
22 | no3d | ||
23 | nodvd | ||
24 | nogroups | ||
25 | nonewprivs | ||
26 | noroot | ||
27 | nosound | ||
28 | notv | ||
29 | novideo | ||
30 | protocol unix | ||
31 | seccomp | ||
32 | shell none | ||
33 | tracelog | ||
diff --git a/etc/firejail-default b/etc/apparmor/firejail-default index 763b838d3..04a38f0ce 100644 --- a/etc/firejail-default +++ b/etc/apparmor/firejail-default | |||
@@ -19,6 +19,8 @@ profile firejail-default flags=(attach_disconnected,mediate_deleted) { | |||
19 | #include <abstractions/dbus-strict> | 19 | #include <abstractions/dbus-strict> |
20 | #include <abstractions/dbus-session-strict> | 20 | #include <abstractions/dbus-session-strict> |
21 | dbus, | 21 | dbus, |
22 | # Add rule in order to avoid dbus-*=filter breakage (#3432) | ||
23 | owner /{,var/}run/firejail/dbus/[0-9]*/[0-9]*-user w, | ||
22 | 24 | ||
23 | ########## | 25 | ########## |
24 | # With ptrace it is possible to inspect and hijack running programs. | 26 | # With ptrace it is possible to inspect and hijack running programs. |
@@ -47,6 +49,10 @@ owner /{,run/firejail/mnt/oroot/}{,var/}run/firejail/mnt/trace w, | |||
47 | owner /{,run/firejail/mnt/oroot/}{,var/}run/user/[0-9]*/** w, | 49 | owner /{,run/firejail/mnt/oroot/}{,var/}run/user/[0-9]*/** w, |
48 | owner /{,run/firejail/mnt/oroot/}{run,dev}/shm/** w, | 50 | owner /{,run/firejail/mnt/oroot/}{run,dev}/shm/** w, |
49 | 51 | ||
52 | # Allow writing to /var/mail and /var/spool/mail (for mail clients) | ||
53 | # Uncomment to enable | ||
54 | #owner /var/{mail,spool/mail}/** w, | ||
55 | |||
50 | # Allow writing to removable media | 56 | # Allow writing to removable media |
51 | owner /{,var/}run/media/** w, | 57 | owner /{,var/}run/media/** w, |
52 | 58 | ||
@@ -65,6 +71,8 @@ owner /proc/@{PID}/{uid_map,gid_map,setgroups} w, | |||
65 | 71 | ||
66 | # Needed for electron apps | 72 | # Needed for electron apps |
67 | /proc/@{PID}/comm w, | 73 | /proc/@{PID}/comm w, |
74 | # Needed for nslookup, dig, host | ||
75 | /proc/@{PID}/task/@{PID}/comm w, | ||
68 | 76 | ||
69 | # Used by chromium | 77 | # Used by chromium |
70 | owner /proc/@{PID}/oom_score_adj w, | 78 | owner /proc/@{PID}/oom_score_adj w, |
diff --git a/etc/firejail-local b/etc/apparmor/firejail-local index f086653f8..f086653f8 100644 --- a/etc/firejail-local +++ b/etc/apparmor/firejail-local | |||
diff --git a/etc/caja.profile b/etc/caja.profile deleted file mode 100644 index 7bf901ae3..000000000 --- a/etc/caja.profile +++ /dev/null | |||
@@ -1,43 +0,0 @@ | |||
1 | # Firejail profile for caja | ||
2 | # Description: File manager for the MATE desktop | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include caja.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Caja is started by systemd on most systems. Therefore it is not firejailed by default. Since there | ||
10 | # is already a caja process running on MATE desktops firejail will have no effect. | ||
11 | |||
12 | noblacklist ${HOME}/.local/share/Trash | ||
13 | # noblacklist ${HOME}/.config/caja - disable-programs.inc is disabled, see below | ||
14 | # noblacklist ${HOME}/.local/share/caja-python | ||
15 | |||
16 | # Allow python (blacklisted by disable-interpreters.inc) | ||
17 | include allow-python2.inc | ||
18 | include allow-python3.inc | ||
19 | |||
20 | include disable-common.inc | ||
21 | include disable-devel.inc | ||
22 | include disable-interpreters.inc | ||
23 | include disable-passwdmgr.inc | ||
24 | # include disable-programs.inc | ||
25 | |||
26 | allusers | ||
27 | caps.drop all | ||
28 | netfilter | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | notv | ||
34 | novideo | ||
35 | protocol unix | ||
36 | seccomp | ||
37 | shell none | ||
38 | tracelog | ||
39 | |||
40 | # caja needs to be able to start arbitrary applications so we cannot blacklist their files | ||
41 | # private-bin caja | ||
42 | # private-dev | ||
43 | # private-tmp | ||
diff --git a/etc/dolphin.profile b/etc/dolphin.profile deleted file mode 100644 index 0e5a6e6fe..000000000 --- a/etc/dolphin.profile +++ /dev/null | |||
@@ -1,39 +0,0 @@ | |||
1 | # Firejail profile for dolphin | ||
2 | # Description: File manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include dolphin.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/Trash | ||
10 | # noblacklist ${HOME}/.cache/dolphin - disable-programs.inc is disabled, see below | ||
11 | # noblacklist ${HOME}/.config/dolphinrc | ||
12 | # noblacklist ${HOME}/.local/share/dolphin | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | # dolphin needs to be able to start arbitrary applications so we cannot blacklist their files | ||
19 | # include disable-programs.inc | ||
20 | |||
21 | allusers | ||
22 | caps.drop all | ||
23 | # net none | ||
24 | netfilter | ||
25 | nodvd | ||
26 | nogroups | ||
27 | nonewprivs | ||
28 | # Comment the next line (or put 'ignore noroot' in your dolphin.local) if you use MPV+Vulkan (see issue #3012) | ||
29 | noroot | ||
30 | notv | ||
31 | novideo | ||
32 | protocol unix,inet,inet6,netlink | ||
33 | seccomp | ||
34 | shell none | ||
35 | |||
36 | private-dev | ||
37 | # private-tmp | ||
38 | |||
39 | join-or-start dolphin | ||
diff --git a/etc/firejail.config b/etc/firejail.config index 6fb7d829a..731e744dd 100644 --- a/etc/firejail.config +++ b/etc/firejail.config | |||
@@ -27,7 +27,7 @@ | |||
27 | # Enable or disable chroot support, default enabled. | 27 | # Enable or disable chroot support, default enabled. |
28 | # chroot yes | 28 | # chroot yes |
29 | 29 | ||
30 | # Enable or disable dbus handling by --nodbus flag, default enabled. | 30 | # Enable or disable dbus handling, default enabled. |
31 | # dbus yes | 31 | # dbus yes |
32 | 32 | ||
33 | # Disable /mnt, /media, /run/mount and /run/media access. By default access | 33 | # Disable /mnt, /media, /run/mount and /run/media access. By default access |
@@ -70,6 +70,13 @@ | |||
70 | # Enable or disable sandbox name change, default enabled. | 70 | # Enable or disable sandbox name change, default enabled. |
71 | # name-change yes | 71 | # name-change yes |
72 | 72 | ||
73 | # Change default netfilter configuration. When using --netfilter option without | ||
74 | # a file argument, the default filter is hardcoded (see man 1 firejail). This | ||
75 | # configuration entry allows the user to change the default by specifying | ||
76 | # a file containing the filter configuration. The filter file format is the | ||
77 | # format of iptables-save and iptable-restore commands. Example: | ||
78 | # netfilter-default /etc/iptables.iptables.rules | ||
79 | |||
73 | # Enable or disable networking features, default enabled. | 80 | # Enable or disable networking features, default enabled. |
74 | # network yes | 81 | # network yes |
75 | 82 | ||
@@ -79,12 +86,12 @@ | |||
79 | # Remove /usr/local directories from private-bin list, default disabled. | 86 | # Remove /usr/local directories from private-bin list, default disabled. |
80 | # private-bin-no-local no | 87 | # private-bin-no-local no |
81 | 88 | ||
82 | # Enable or disable private-home feature, default enabled | ||
83 | # private-home yes | ||
84 | |||
85 | # Enable or disable private-cache feature, default enabled | 89 | # Enable or disable private-cache feature, default enabled |
86 | # private-cache yes | 90 | # private-cache yes |
87 | 91 | ||
92 | # Enable or disable private-home feature, default enabled | ||
93 | # private-home yes | ||
94 | |||
88 | # Enable or disable private-lib feature, default enabled | 95 | # Enable or disable private-lib feature, default enabled |
89 | # private-lib yes | 96 | # private-lib yes |
90 | 97 | ||
@@ -97,16 +104,12 @@ | |||
97 | # --netfilter only to root user. Regular users are only allowed --net=none. | 104 | # --netfilter only to root user. Regular users are only allowed --net=none. |
98 | # restricted-network no | 105 | # restricted-network no |
99 | 106 | ||
100 | # Change default netfilter configuration. When using --netfilter option without | ||
101 | # a file argument, the default filter is hardcoded (see man 1 firejail). This | ||
102 | # configuration entry allows the user to change the default by specifying | ||
103 | # a file containing the filter configuration. The filter file format is the | ||
104 | # format of iptables-save and iptable-restore commands. Example: | ||
105 | # netfilter-default /etc/iptables.iptables.rules | ||
106 | |||
107 | # Enable or disable seccomp support, default enabled. | 107 | # Enable or disable seccomp support, default enabled. |
108 | # seccomp yes | 108 | # seccomp yes |
109 | 109 | ||
110 | # Seccomp error action, kill, log or errno (EPERM, ENOSYS etc) | ||
111 | # seccomp-error-action EPERM | ||
112 | |||
110 | # Enable or disable user namespace support, default enabled. | 113 | # Enable or disable user namespace support, default enabled. |
111 | # userns yes | 114 | # userns yes |
112 | 115 | ||
@@ -116,6 +119,10 @@ | |||
116 | # Enable or disable X11 sandboxing support, default enabled. | 119 | # Enable or disable X11 sandboxing support, default enabled. |
117 | # x11 yes | 120 | # x11 yes |
118 | 121 | ||
122 | # Xephyr command extra parameters. None by default; these are examples. | ||
123 | # xephyr-extra-params -keybd ephyr,,,xkbmodel=evdev | ||
124 | # xephyr-extra-params -grayscale | ||
125 | |||
119 | # Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for | 126 | # Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for |
120 | # a full list of resolutions available on your specific setup. | 127 | # a full list of resolutions available on your specific setup. |
121 | # xephyr-screen 640x480 | 128 | # xephyr-screen 640x480 |
@@ -126,17 +133,13 @@ | |||
126 | # Firejail window title in Xephyr, default enabled. | 133 | # Firejail window title in Xephyr, default enabled. |
127 | # xephyr-window-title yes | 134 | # xephyr-window-title yes |
128 | 135 | ||
129 | # Xephyr command extra parameters. None by default; these are examples. | ||
130 | # xephyr-extra-params -keybd ephyr,,,xkbmodel=evdev | ||
131 | # xephyr-extra-params -grayscale | ||
132 | |||
133 | # Xpra server command extra parameters. None by default; this is an example. | ||
134 | # xpra-extra-params --dpi 96 | ||
135 | |||
136 | # Enable this option if you have a version of Xpra that supports --attach switch | 136 | # Enable this option if you have a version of Xpra that supports --attach switch |
137 | # for start command, default disabled. | 137 | # for start command, default disabled. |
138 | # xpra-attach no | 138 | # xpra-attach no |
139 | 139 | ||
140 | # Xpra server command extra parameters. None by default; this is an example. | ||
141 | # xpra-extra-params --dpi 96 | ||
142 | |||
140 | # Screen size for --x11=xvfb, default 800x600x24. The third dimension is | 143 | # Screen size for --x11=xvfb, default 800x600x24. The third dimension is |
141 | # color depth; use 24 unless you know exactly what you're doing. | 144 | # color depth; use 24 unless you know exactly what you're doing. |
142 | # xvfb-screen 640x480x24 | 145 | # xvfb-screen 640x480x24 |
diff --git a/etc/allow-common-devel.inc b/etc/inc/allow-common-devel.inc index 63174eda6..7cd087b14 100644 --- a/etc/allow-common-devel.inc +++ b/etc/inc/allow-common-devel.inc | |||
@@ -12,10 +12,16 @@ noblacklist ${HOME}/.gradle | |||
12 | noblacklist ${HOME}/.java | 12 | noblacklist ${HOME}/.java |
13 | 13 | ||
14 | # Python | 14 | # Python |
15 | noblacklist ${HOME}/.pylint.d | ||
15 | noblacklist ${HOME}/.python-history | 16 | noblacklist ${HOME}/.python-history |
16 | noblacklist ${HOME}/.python_history | 17 | noblacklist ${HOME}/.python_history |
17 | noblacklist ${HOME}/.pythonhist | 18 | noblacklist ${HOME}/.pythonhist |
18 | 19 | ||
19 | # Rust | 20 | # Rust |
21 | noblacklist ${HOME}/.cargo/advisory-db | ||
20 | noblacklist ${HOME}/.cargo/config | 22 | noblacklist ${HOME}/.cargo/config |
23 | noblacklist ${HOME}/.cargo/git | ||
21 | noblacklist ${HOME}/.cargo/registry | 24 | noblacklist ${HOME}/.cargo/registry |
25 | noblacklist ${HOME}/.cargo/.crates.toml | ||
26 | noblacklist ${HOME}/.cargo/.crates2.json | ||
27 | noblacklist ${HOME}/.cargo/.package-cache | ||
diff --git a/etc/allow-gjs.inc b/etc/inc/allow-gjs.inc index f552ede9d..f4f9926cd 100644 --- a/etc/allow-gjs.inc +++ b/etc/inc/allow-gjs.inc | |||
@@ -8,3 +8,4 @@ noblacklist /usr/lib/gjs | |||
8 | noblacklist /usr/lib64/gjs | 8 | noblacklist /usr/lib64/gjs |
9 | noblacklist /usr/lib/libgjs* | 9 | noblacklist /usr/lib/libgjs* |
10 | noblacklist /usr/lib64/libgjs* | 10 | noblacklist /usr/lib64/libgjs* |
11 | noblacklist /usr/lib64/libmozjs-* | ||
diff --git a/etc/allow-java.inc b/etc/inc/allow-java.inc index 24d18fb77..24d18fb77 100644 --- a/etc/allow-java.inc +++ b/etc/inc/allow-java.inc | |||
diff --git a/etc/allow-lua.inc b/etc/inc/allow-lua.inc index fbdee22ee..9df8e8d32 100644 --- a/etc/allow-lua.inc +++ b/etc/inc/allow-lua.inc | |||
@@ -3,6 +3,8 @@ | |||
3 | include allow-lua.local | 3 | include allow-lua.local |
4 | 4 | ||
5 | noblacklist ${PATH}/lua* | 5 | noblacklist ${PATH}/lua* |
6 | noblacklist /usr/include/lua* | 6 | noblacklist /usr/include |
7 | noblacklist /usr/lib/liblua* | ||
7 | noblacklist /usr/lib/lua | 8 | noblacklist /usr/lib/lua |
8 | noblacklist /usr/share/lua | 9 | noblacklist /usr/share/lua |
10 | noblacklist /usr/share/lua* | ||
diff --git a/etc/allow-perl.inc b/etc/inc/allow-perl.inc index f44e1e3cc..f44e1e3cc 100644 --- a/etc/allow-perl.inc +++ b/etc/inc/allow-perl.inc | |||
diff --git a/etc/allow-php.inc b/etc/inc/allow-php.inc index a0950dc26..a0950dc26 100644 --- a/etc/allow-php.inc +++ b/etc/inc/allow-php.inc | |||
diff --git a/etc/allow-python2.inc b/etc/inc/allow-python2.inc index b0525e2e1..b0525e2e1 100644 --- a/etc/allow-python2.inc +++ b/etc/inc/allow-python2.inc | |||
diff --git a/etc/allow-python3.inc b/etc/inc/allow-python3.inc index d968886b0..d968886b0 100644 --- a/etc/allow-python3.inc +++ b/etc/inc/allow-python3.inc | |||
diff --git a/etc/allow-ruby.inc b/etc/inc/allow-ruby.inc index a8c701219..a8c701219 100644 --- a/etc/allow-ruby.inc +++ b/etc/inc/allow-ruby.inc | |||
diff --git a/etc/disable-common.inc b/etc/inc/disable-common.inc index bf29cd137..c7516ab42 100644 --- a/etc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -64,8 +64,9 @@ blacklist /etc/xdg/autostart | |||
64 | read-only ${HOME}/.Xauthority | 64 | read-only ${HOME}/.Xauthority |
65 | 65 | ||
66 | # Session manager | 66 | # Session manager |
67 | ?HAS_X11: blacklist ${HOME}/.ICEauthority | 67 | # see #3358 |
68 | ?HAS_X11: blacklist /tmp/.ICE-unix | 68 | #?HAS_X11: blacklist ${HOME}/.ICEauthority |
69 | #?HAS_X11: blacklist /tmp/.ICE-unix | ||
69 | 70 | ||
70 | # KDE config | 71 | # KDE config |
71 | blacklist ${HOME}/.config/khotkeysrc | 72 | blacklist ${HOME}/.config/khotkeysrc |
@@ -136,21 +137,27 @@ read-only ${HOME}/.local/share/kssl | |||
136 | blacklist ${RUNUSER}/*.slave-socket | 137 | blacklist ${RUNUSER}/*.slave-socket |
137 | blacklist ${RUNUSER}/kdeinit5__* | 138 | blacklist ${RUNUSER}/kdeinit5__* |
138 | blacklist ${RUNUSER}/kdesud_* | 139 | blacklist ${RUNUSER}/kdesud_* |
139 | ?HAS_NODBUS: blacklist ${RUNUSER}/ksocket-* | 140 | # see #3358 |
140 | ?HAS_NODBUS: blacklist /tmp/ksocket-* | 141 | #?HAS_NODBUS: blacklist ${RUNUSER}/ksocket-* |
142 | #?HAS_NODBUS: blacklist /tmp/ksocket-* | ||
141 | 143 | ||
142 | # gnome | 144 | # gnome |
143 | # contains extensions, last used times of applications, and notifications | 145 | # contains extensions, last used times of applications, and notifications |
144 | blacklist ${HOME}/.local/share/gnome-shell | 146 | blacklist ${HOME}/.local/share/gnome-shell |
145 | # no direct modification of dconf database | 147 | # no direct modification of dconf database |
146 | read-only ${HOME}/.config/dconf | 148 | read-only ${HOME}/.config/dconf |
149 | blacklist ${RUNUSER}/gnome-session-leader-fifo | ||
150 | blacklist ${RUNUSER}/gnome-shell | ||
151 | blacklist ${RUNUSER}/gsconnect | ||
147 | 152 | ||
148 | # systemd | 153 | # systemd |
149 | blacklist ${HOME}/.config/systemd | 154 | blacklist ${HOME}/.config/systemd |
150 | blacklist ${HOME}/.local/share/systemd | 155 | blacklist ${HOME}/.local/share/systemd |
151 | blacklist /var/lib/systemd | 156 | blacklist /var/lib/systemd |
152 | # blacklist /var/run/systemd | 157 | blacklist ${PATH}/systemd-run |
158 | blacklist ${RUNUSER}/systemd | ||
153 | # creates problems on Arch where /etc/resolv.conf is a symlink to /var/run/systemd/resolve/resolv.conf | 159 | # creates problems on Arch where /etc/resolv.conf is a symlink to /var/run/systemd/resolve/resolv.conf |
160 | #blacklist /var/run/systemd | ||
154 | 161 | ||
155 | # openrc | 162 | # openrc |
156 | blacklist /etc/runlevels/ | 163 | blacklist /etc/runlevels/ |
@@ -166,6 +173,21 @@ blacklist ${HOME}/VirtualBox VMs | |||
166 | blacklist ${HOME}/.config/gnome-boxes | 173 | blacklist ${HOME}/.config/gnome-boxes |
167 | blacklist ${HOME}/.local/share/gnome-boxes | 174 | blacklist ${HOME}/.local/share/gnome-boxes |
168 | 175 | ||
176 | # libvirt | ||
177 | blacklist ${HOME}/.cache/libvirt | ||
178 | blacklist ${HOME}/.config/libvirt | ||
179 | blacklist ${RUNUSER}/libvirt | ||
180 | blacklist /var/cache/libvirt | ||
181 | blacklist /var/lib/libvirt | ||
182 | blacklist /var/log/libvirt | ||
183 | |||
184 | # OCI-Containers / Podman | ||
185 | blacklist ${RUNUSER}/containers | ||
186 | blacklist ${RUNUSER}/crun | ||
187 | blacklist ${RUNUSER}/libpod | ||
188 | blacklist ${RUNUSER}/runc | ||
189 | blacklist ${RUNUSER}/toolbox | ||
190 | |||
169 | # VeraCrypt | 191 | # VeraCrypt |
170 | blacklist ${HOME}/.VeraCrypt | 192 | blacklist ${HOME}/.VeraCrypt |
171 | blacklist ${PATH}/veracrypt | 193 | blacklist ${PATH}/veracrypt |
@@ -300,13 +322,17 @@ read-only ${HOME}/bin | |||
300 | read-only ${HOME}/.bin | 322 | read-only ${HOME}/.bin |
301 | read-only ${HOME}/.local/bin | 323 | read-only ${HOME}/.local/bin |
302 | read-only ${HOME}/.cargo/bin | 324 | read-only ${HOME}/.cargo/bin |
303 | read-only ${HOME}/.cargo/env | ||
304 | 325 | ||
305 | # Write-protection for desktop entries | 326 | # Write-protection for desktop entries |
306 | read-only ${HOME}/.config/menus | 327 | read-only ${HOME}/.config/menus |
307 | read-only ${HOME}/.gnome/apps | 328 | read-only ${HOME}/.gnome/apps |
308 | read-only ${HOME}/.local/share/applications | 329 | read-only ${HOME}/.local/share/applications |
309 | 330 | ||
331 | read-only ${HOME}/.config/mimeapps.list | ||
332 | read-only ${HOME}/.config/user-dirs.dirs | ||
333 | read-only ${HOME}/.config/user-dirs.locale | ||
334 | read-only ${HOME}/.local/share/mime | ||
335 | |||
310 | # Write-protection for thumbnailer dir | 336 | # Write-protection for thumbnailer dir |
311 | read-only ${HOME}/.local/share/thumbnailers | 337 | read-only ${HOME}/.local/share/thumbnailers |
312 | 338 | ||
@@ -376,6 +402,7 @@ blacklist /usr/sbin | |||
376 | 402 | ||
377 | # system management | 403 | # system management |
378 | blacklist ${PATH}/at | 404 | blacklist ${PATH}/at |
405 | blacklist ${PATH}/busybox | ||
379 | blacklist ${PATH}/chage | 406 | blacklist ${PATH}/chage |
380 | blacklist ${PATH}/chfn | 407 | blacklist ${PATH}/chfn |
381 | blacklist ${PATH}/chsh | 408 | blacklist ${PATH}/chsh |
@@ -443,14 +470,30 @@ blacklist /vmlinuz* | |||
443 | blacklist /.snapshots | 470 | blacklist /.snapshots |
444 | 471 | ||
445 | # flatpak | 472 | # flatpak |
473 | blacklist ${HOME}/.cache/flatpak | ||
446 | blacklist ${HOME}/.config/flatpak | 474 | blacklist ${HOME}/.config/flatpak |
447 | blacklist ${HOME}/.local/share/flatpak | 475 | blacklist ${HOME}/.local/share/flatpak/app |
476 | blacklist ${HOME}/.local/share/flatpak/appstream | ||
477 | blacklist ${HOME}/.local/share/flatpak/db | ||
478 | read-only ${HOME}/.local/share/flatpak/exports | ||
479 | blacklist ${HOME}/.local/share/flatpak/oci | ||
480 | blacklist ${HOME}/.local/share/flatpak/overrides | ||
481 | blacklist ${HOME}/.local/share/flatpak/repo | ||
482 | blacklist ${HOME}/.local/share/flatpak/runtime | ||
448 | blacklist ${HOME}/.var | 483 | blacklist ${HOME}/.var |
484 | blacklist ${RUNUSER}/app | ||
485 | blacklist ${RUNUSER}/doc | ||
486 | blacklist ${RUNUSER}/.dbus-proxy | ||
487 | blacklist ${RUNUSER}/.flatpak | ||
488 | blacklist ${RUNUSER}/.flatpak-helper | ||
449 | blacklist /usr/share/flatpak | 489 | blacklist /usr/share/flatpak |
450 | blacklist /var/lib/flatpak | 490 | blacklist /var/lib/flatpak |
451 | # most of the time bwrap is SUID binary | 491 | # most of the time bwrap is SUID binary |
452 | blacklist ${PATH}/bwrap | 492 | blacklist ${PATH}/bwrap |
453 | 493 | ||
494 | # snap | ||
495 | blacklist ${RUNUSER}/snapd-session-agent.socket | ||
496 | |||
454 | # mail directories used by mutt | 497 | # mail directories used by mutt |
455 | blacklist ${HOME}/.Mail | 498 | blacklist ${HOME}/.Mail |
456 | blacklist ${HOME}/.mail | 499 | blacklist ${HOME}/.mail |
@@ -462,3 +505,22 @@ blacklist ${HOME}/sent | |||
462 | 505 | ||
463 | # kernel configuration | 506 | # kernel configuration |
464 | blacklist /proc/config.gz | 507 | blacklist /proc/config.gz |
508 | |||
509 | # prevent DNS malware attempting to communicate with the server | ||
510 | # using regular DNS tools | ||
511 | blacklist ${PATH}/dig | ||
512 | blacklist ${PATH}/kdig | ||
513 | blacklist ${PATH}/nslookup | ||
514 | blacklist ${PATH}/host | ||
515 | blacklist ${PATH}/dlint | ||
516 | blacklist ${PATH}/dnswalk | ||
517 | blacklist ${PATH}/dns2tcp | ||
518 | blacklist ${PATH}/iodine | ||
519 | blacklist ${PATH}/knsupdate | ||
520 | blacklist ${PATH}/resolvectl | ||
521 | |||
522 | # rest of ${RUNUSER} | ||
523 | blacklist ${RUNUSER}/*.lock | ||
524 | blacklist ${RUNUSER}/inaccessible | ||
525 | blacklist ${RUNUSER}/update-notifier.pid | ||
526 | blacklist ${RUNUSER}/pk-debconf-socket | ||
diff --git a/etc/disable-devel.inc b/etc/inc/disable-devel.inc index 59df9fb0f..e1ba13380 100644 --- a/etc/disable-devel.inc +++ b/etc/inc/disable-devel.inc | |||
@@ -26,7 +26,6 @@ blacklist ${PATH}/*-gcc* | |||
26 | blacklist ${PATH}/*-g++* | 26 | blacklist ${PATH}/*-g++* |
27 | blacklist ${PATH}/*-gcc* | 27 | blacklist ${PATH}/*-gcc* |
28 | blacklist ${PATH}/*-g++* | 28 | blacklist ${PATH}/*-g++* |
29 | blacklist /usr/include | ||
30 | # seems to create problems on Gentoo | 29 | # seems to create problems on Gentoo |
31 | #blacklist /usr/lib/gcc | 30 | #blacklist /usr/lib/gcc |
32 | 31 | ||
diff --git a/etc/disable-exec.inc b/etc/inc/disable-exec.inc index ee3391730..ee3391730 100644 --- a/etc/disable-exec.inc +++ b/etc/inc/disable-exec.inc | |||
diff --git a/etc/disable-interpreters.inc b/etc/inc/disable-interpreters.inc index ae539e1bc..59e9c7de3 100644 --- a/etc/disable-interpreters.inc +++ b/etc/inc/disable-interpreters.inc | |||
@@ -13,8 +13,12 @@ blacklist /usr/lib64/libgjs* | |||
13 | # Lua | 13 | # Lua |
14 | blacklist ${PATH}/lua* | 14 | blacklist ${PATH}/lua* |
15 | blacklist /usr/include/lua* | 15 | blacklist /usr/include/lua* |
16 | blacklist /usr/lib/liblua* | ||
16 | blacklist /usr/lib/lua | 17 | blacklist /usr/lib/lua |
17 | blacklist /usr/share/lua | 18 | blacklist /usr/share/lua* |
19 | |||
20 | # mozjs | ||
21 | blacklist /usr/lib64/libmozjs-* | ||
18 | 22 | ||
19 | # Node.js | 23 | # Node.js |
20 | blacklist ${PATH}/node | 24 | blacklist ${PATH}/node |
diff --git a/etc/disable-passwdmgr.inc b/etc/inc/disable-passwdmgr.inc index 316378cb8..316378cb8 100644 --- a/etc/disable-passwdmgr.inc +++ b/etc/inc/disable-passwdmgr.inc | |||
diff --git a/etc/disable-programs.inc b/etc/inc/disable-programs.inc index db257c1b6..e5dd9cb59 100644 --- a/etc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -8,6 +8,9 @@ blacklist ${HOME}/Monero/wallets | |||
8 | blacklist ${HOME}/Nextcloud/Notes | 8 | blacklist ${HOME}/Nextcloud/Notes |
9 | blacklist ${HOME}/SoftMaker | 9 | blacklist ${HOME}/SoftMaker |
10 | blacklist ${HOME}/Standard Notes Backups | 10 | blacklist ${HOME}/Standard Notes Backups |
11 | blacklist ${HOME}/TeamSpeak3-Client-linux_x86 | ||
12 | blacklist ${HOME}/TeamSpeak3-Client-linux_amd64 | ||
13 | blacklist ${HOME}/hyperrogue.ini | ||
11 | blacklist ${HOME}/mps | 14 | blacklist ${HOME}/mps |
12 | blacklist ${HOME}/wallet.dat | 15 | blacklist ${HOME}/wallet.dat |
13 | blacklist ${HOME}/.*coin | 16 | blacklist ${HOME}/.*coin |
@@ -51,8 +54,13 @@ blacklist ${HOME}/.bibletime | |||
51 | blacklist ${HOME}/.bitcoin | 54 | blacklist ${HOME}/.bitcoin |
52 | blacklist ${HOME}/.bogofilter | 55 | blacklist ${HOME}/.bogofilter |
53 | blacklist ${HOME}/.bzf | 56 | blacklist ${HOME}/.bzf |
54 | blacklist ${HOME}/.cargo/registry | 57 | blacklist ${HOME}/.cargo/advisory-db |
55 | blacklist ${HOME}/.cargo/config | 58 | blacklist ${HOME}/.cargo/config |
59 | blacklist ${HOME}/.cargo/git | ||
60 | blacklist ${HOME}/.cargo/registry | ||
61 | blacklist ${HOME}/.cargo/.crates.toml | ||
62 | blacklist ${HOME}/.cargo/.crates2.json | ||
63 | blacklist ${HOME}/.cargo/.package-cache | ||
56 | blacklist ${HOME}/.claws-mail | 64 | blacklist ${HOME}/.claws-mail |
57 | blacklist ${HOME}/.cliqz | 65 | blacklist ${HOME}/.cliqz |
58 | blacklist ${HOME}/.clonk | 66 | blacklist ${HOME}/.clonk |
@@ -72,9 +80,15 @@ blacklist ${HOME}/.config/Code - OSS | |||
72 | blacklist ${HOME}/.config/Code Industry | 80 | blacklist ${HOME}/.config/Code Industry |
73 | blacklist ${HOME}/.config/Cryptocat | 81 | blacklist ${HOME}/.config/Cryptocat |
74 | blacklist ${HOME}/.config/Debauchee/Barrier.conf | 82 | blacklist ${HOME}/.config/Debauchee/Barrier.conf |
83 | blacklist ${HOME}/.config/Dharkael | ||
84 | blacklist ${HOME}/.config/Element | ||
85 | blacklist ${HOME}/.config/Element (Riot) | ||
75 | blacklist ${HOME}/.config/Enox | 86 | blacklist ${HOME}/.config/Enox |
87 | blacklist ${HOME}/.config/Ferdi | ||
88 | blacklist ${HOME}/.config/Flavio Tordini | ||
76 | blacklist ${HOME}/.config/Franz | 89 | blacklist ${HOME}/.config/Franz |
77 | blacklist ${HOME}/.config/FreeCAD | 90 | blacklist ${HOME}/.config/FreeCAD |
91 | blacklist ${HOME}/.config/FreeTube | ||
78 | blacklist ${HOME}/.config/Fritzing | 92 | blacklist ${HOME}/.config/Fritzing |
79 | blacklist ${HOME}/.config/GIMP | 93 | blacklist ${HOME}/.config/GIMP |
80 | blacklist ${HOME}/.config/GitHub Desktop | 94 | blacklist ${HOME}/.config/GitHub Desktop |
@@ -84,9 +98,12 @@ blacklist ${HOME}/.config/Google Play Music Desktop Player | |||
84 | blacklist ${HOME}/.config/Gpredict | 98 | blacklist ${HOME}/.config/Gpredict |
85 | blacklist ${HOME}/.config/INRIA | 99 | blacklist ${HOME}/.config/INRIA |
86 | blacklist ${HOME}/.config/InSilmaril | 100 | blacklist ${HOME}/.config/InSilmaril |
101 | blacklist ${HOME}/.config/Jitsi Meet | ||
87 | blacklist ${HOME}/.config/Kid3 | 102 | blacklist ${HOME}/.config/Kid3 |
88 | blacklist ${HOME}/.config/Kingsoft | 103 | blacklist ${HOME}/.config/Kingsoft |
89 | blacklist ${HOME}/.config/Luminance | 104 | blacklist ${HOME}/.config/Luminance |
105 | blacklist ${HOME}/.config/LyX | ||
106 | blacklist ${HOME}/.config/Mattermost | ||
90 | blacklist ${HOME}/.config/Meltytech | 107 | blacklist ${HOME}/.config/Meltytech |
91 | blacklist ${HOME}/.config/Mendeley Ltd. | 108 | blacklist ${HOME}/.config/Mendeley Ltd. |
92 | blacklist ${HOME}/.config/Min | 109 | blacklist ${HOME}/.config/Min |
@@ -97,6 +114,7 @@ blacklist ${HOME}/.config/MuseScore | |||
97 | blacklist ${HOME}/.config/MusicBrainz | 114 | blacklist ${HOME}/.config/MusicBrainz |
98 | blacklist ${HOME}/.config/Nathan Osman | 115 | blacklist ${HOME}/.config/Nathan Osman |
99 | blacklist ${HOME}/.config/Nylas Mail | 116 | blacklist ${HOME}/.config/Nylas Mail |
117 | blacklist ${HOME}/.config/PacmanLogViewer | ||
100 | blacklist ${HOME}/.config/PBE | 118 | blacklist ${HOME}/.config/PBE |
101 | blacklist ${HOME}/.config/Philipp Schmieder | 119 | blacklist ${HOME}/.config/Philipp Schmieder |
102 | blacklist ${HOME}/.config/QGIS | 120 | blacklist ${HOME}/.config/QGIS |
@@ -113,11 +131,16 @@ blacklist ${HOME}/.config/Slack | |||
113 | blacklist ${HOME}/.config/Standard Notes | 131 | blacklist ${HOME}/.config/Standard Notes |
114 | blacklist ${HOME}/.config/SubDownloader | 132 | blacklist ${HOME}/.config/SubDownloader |
115 | blacklist ${HOME}/.config/Thunar | 133 | blacklist ${HOME}/.config/Thunar |
134 | blacklist ${HOME}/.config/Unknown Organization | ||
116 | blacklist ${HOME}/.config/VirtualBox | 135 | blacklist ${HOME}/.config/VirtualBox |
117 | blacklist ${HOME}/.config/Wire | 136 | blacklist ${HOME}/.config/Wire |
118 | blacklist ${HOME}/.config/Zeal | 137 | blacklist ${HOME}/.config/Zeal |
138 | blacklist ${HOME}/.config/ZeGrapher Project | ||
139 | blacklist ${HOME}/.config/abiword | ||
140 | blacklist ${HOME}/.config/agenda | ||
119 | blacklist ${HOME}/.config/akonadi* | 141 | blacklist ${HOME}/.config/akonadi* |
120 | blacklist ${HOME}/.config/akregatorrc | 142 | blacklist ${HOME}/.config/akregatorrc |
143 | blacklist ${HOME}/.config/alacritty | ||
121 | blacklist ${HOME}/.config/ardour4 | 144 | blacklist ${HOME}/.config/ardour4 |
122 | blacklist ${HOME}/.config/ardour5 | 145 | blacklist ${HOME}/.config/ardour5 |
123 | blacklist ${HOME}/.config/aria2 | 146 | blacklist ${HOME}/.config/aria2 |
@@ -129,6 +152,7 @@ blacklist ${HOME}/.config/atril | |||
129 | blacklist ${HOME}/.config/audacious | 152 | blacklist ${HOME}/.config/audacious |
130 | blacklist ${HOME}/.config/autokey | 153 | blacklist ${HOME}/.config/autokey |
131 | blacklist ${HOME}/.config/aweather | 154 | blacklist ${HOME}/.config/aweather |
155 | blacklist ${HOME}/.config/backintime | ||
132 | blacklist ${HOME}/.config/baloofilerc | 156 | blacklist ${HOME}/.config/baloofilerc |
133 | blacklist ${HOME}/.config/baloorc | 157 | blacklist ${HOME}/.config/baloorc |
134 | blacklist ${HOME}/.config/blender | 158 | blacklist ${HOME}/.config/blender |
@@ -142,8 +166,15 @@ blacklist ${HOME}/.config/caja | |||
142 | blacklist ${HOME}/.config/calibre | 166 | blacklist ${HOME}/.config/calibre |
143 | blacklist ${HOME}/.config/cantata | 167 | blacklist ${HOME}/.config/cantata |
144 | blacklist ${HOME}/.config/catfish | 168 | blacklist ${HOME}/.config/catfish |
169 | blacklist ${HOME}/.config/cawbird | ||
145 | blacklist ${HOME}/.config/celluloid | 170 | blacklist ${HOME}/.config/celluloid |
146 | blacklist ${HOME}/.config/cherrytree | 171 | blacklist ${HOME}/.config/cherrytree |
172 | blacklist ${HOME}/.config/chrome-beta-flags.conf | ||
173 | blacklist ${HOME}/.config/chrome-beta-flags.config | ||
174 | blacklist ${HOME}/.config/chrome-flags.conf | ||
175 | blacklist ${HOME}/.config/chrome-flags.config | ||
176 | blacklist ${HOME}/.config/chrome-unstable-flags.conf | ||
177 | blacklist ${HOME}/.config/chrome-unstable-flags.config | ||
147 | blacklist ${HOME}/.config/chromium | 178 | blacklist ${HOME}/.config/chromium |
148 | blacklist ${HOME}/.config/chromium-dev | 179 | blacklist ${HOME}/.config/chromium-dev |
149 | blacklist ${HOME}/.config/chromium-flags.conf | 180 | blacklist ${HOME}/.config/chromium-flags.conf |
@@ -188,13 +219,20 @@ blacklist ${HOME}/.config/geeqie | |||
188 | blacklist ${HOME}/.config/ghb | 219 | blacklist ${HOME}/.config/ghb |
189 | blacklist ${HOME}/.config/ghostwriter | 220 | blacklist ${HOME}/.config/ghostwriter |
190 | blacklist ${HOME}/.config/git | 221 | blacklist ${HOME}/.config/git |
222 | blacklist ${HOME}/.config/git-cola | ||
223 | blacklist ${HOME}/.config/glade.conf | ||
191 | blacklist ${HOME}/.config/globaltime | 224 | blacklist ${HOME}/.config/globaltime |
192 | blacklist ${HOME}/.config/gmpc | 225 | blacklist ${HOME}/.config/gmpc |
193 | blacklist ${HOME}/.config/gnome-builder | 226 | blacklist ${HOME}/.config/gnome-builder |
227 | blacklist ${HOME}/.config/gnome-chess | ||
228 | blacklist ${HOME}/.config/gnome-control-center | ||
229 | blacklist ${HOME}/.config/gnome-initial-setup-done | ||
194 | blacklist ${HOME}/.config/gnome-latex | 230 | blacklist ${HOME}/.config/gnome-latex |
195 | blacklist ${HOME}/.config/gnome-mplayer | 231 | blacklist ${HOME}/.config/gnome-mplayer |
196 | blacklist ${HOME}/.config/gnome-mpv | 232 | blacklist ${HOME}/.config/gnome-mpv |
197 | blacklist ${HOME}/.config/gnome-pie | 233 | blacklist ${HOME}/.config/gnome-pie |
234 | blacklist ${HOME}/.config/gnome-session | ||
235 | blacklist ${HOME}/.config/gnote | ||
198 | blacklist ${HOME}/.config/godot | 236 | blacklist ${HOME}/.config/godot |
199 | blacklist ${HOME}/.config/google-chrome | 237 | blacklist ${HOME}/.config/google-chrome |
200 | blacklist ${HOME}/.config/google-chrome-beta | 238 | blacklist ${HOME}/.config/google-chrome-beta |
@@ -204,6 +242,7 @@ blacklist ${HOME}/.config/gthumb | |||
204 | blacklist ${HOME}/.config/gummi | 242 | blacklist ${HOME}/.config/gummi |
205 | blacklist ${HOME}/.config/gwenviewrc | 243 | blacklist ${HOME}/.config/gwenviewrc |
206 | blacklist ${HOME}/.config/hexchat | 244 | blacklist ${HOME}/.config/hexchat |
245 | blacklist ${HOME}/.config/homebank | ||
207 | blacklist ${HOME}/.config/i2p | 246 | blacklist ${HOME}/.config/i2p |
208 | blacklist ${HOME}/.config/inkscape | 247 | blacklist ${HOME}/.config/inkscape |
209 | blacklist ${HOME}/.config/inox | 248 | blacklist ${HOME}/.config/inox |
@@ -228,8 +267,10 @@ blacklist ${HOME}/.config/klavaro | |||
228 | blacklist ${HOME}/.config/klipperrc | 267 | blacklist ${HOME}/.config/klipperrc |
229 | blacklist ${HOME}/.config/kmail2rc | 268 | blacklist ${HOME}/.config/kmail2rc |
230 | blacklist ${HOME}/.config/kmailsearchindexingrc | 269 | blacklist ${HOME}/.config/kmailsearchindexingrc |
270 | blacklist ${HOME}/.config/kmplayerrc | ||
231 | blacklist ${HOME}/.config/knotesrc | 271 | blacklist ${HOME}/.config/knotesrc |
232 | blacklist ${HOME}/.config/konversationrc | 272 | blacklist ${HOME}/.config/konversationrc |
273 | blacklist ${HOME}/.config/konversation.notifyrc | ||
233 | blacklist ${HOME}/.config/kritarc | 274 | blacklist ${HOME}/.config/kritarc |
234 | blacklist ${HOME}/.config/ktorrentrc | 275 | blacklist ${HOME}/.config/ktorrentrc |
235 | blacklist ${HOME}/.config/ktouch2rc | 276 | blacklist ${HOME}/.config/ktouch2rc |
@@ -246,6 +287,7 @@ blacklist ${HOME}/.config/mate/eom | |||
246 | blacklist ${HOME}/.config/mate/mate-dictionary | 287 | blacklist ${HOME}/.config/mate/mate-dictionary |
247 | blacklist ${HOME}/.config/meld | 288 | blacklist ${HOME}/.config/meld |
248 | blacklist ${HOME}/.config/meteo-qt | 289 | blacklist ${HOME}/.config/meteo-qt |
290 | blacklist ${HOME}/.config/menulibre.cfg | ||
249 | blacklist ${HOME}/.config/mfusion | 291 | blacklist ${HOME}/.config/mfusion |
250 | blacklist ${HOME}/.config/Microsoft | 292 | blacklist ${HOME}/.config/Microsoft |
251 | blacklist ${HOME}/.config/midori | 293 | blacklist ${HOME}/.config/midori |
@@ -255,15 +297,18 @@ blacklist ${HOME}/.config/mpd | |||
255 | blacklist ${HOME}/.config/mps-youtube | 297 | blacklist ${HOME}/.config/mps-youtube |
256 | blacklist ${HOME}/.config/mpv | 298 | blacklist ${HOME}/.config/mpv |
257 | blacklist ${HOME}/.config/mupen64plus | 299 | blacklist ${HOME}/.config/mupen64plus |
300 | blacklist ${HOME}/.config/mutter | ||
258 | blacklist ${HOME}/.config/mypaint | 301 | blacklist ${HOME}/.config/mypaint |
259 | blacklist ${HOME}/.config/nano | 302 | blacklist ${HOME}/.config/nano |
260 | blacklist ${HOME}/.config/nautilus | 303 | blacklist ${HOME}/.config/nautilus |
261 | blacklist ${HOME}/.config/nemo | 304 | blacklist ${HOME}/.config/nemo |
262 | blacklist ${HOME}/.config/netsurf | 305 | blacklist ${HOME}/.config/netsurf |
263 | blacklist ${HOME}/.config/newsbeuter | 306 | blacklist ${HOME}/.config/newsbeuter |
307 | blacklist ${HOME}/.config/newsflash | ||
264 | blacklist ${HOME}/.config/nheko | 308 | blacklist ${HOME}/.config/nheko |
265 | blacklist ${HOME}/.config/NitroShare | 309 | blacklist ${HOME}/.config/NitroShare |
266 | blacklist ${HOME}/.config/nomacs | 310 | blacklist ${HOME}/.config/nomacs |
311 | blacklist ${HOME}/.config/nuclear | ||
267 | blacklist ${HOME}/.config/obs-studio | 312 | blacklist ${HOME}/.config/obs-studio |
268 | blacklist ${HOME}/.config/okularpartrc | 313 | blacklist ${HOME}/.config/okularpartrc |
269 | blacklist ${HOME}/.config/okularrc | 314 | blacklist ${HOME}/.config/okularrc |
@@ -274,6 +319,7 @@ blacklist ${HOME}/.config/opera-beta | |||
274 | blacklist ${HOME}/.config/orage | 319 | blacklist ${HOME}/.config/orage |
275 | blacklist ${HOME}/.config/org.gabmus.gfeeds.json | 320 | blacklist ${HOME}/.config/org.gabmus.gfeeds.json |
276 | blacklist ${HOME}/.config/org.kde.gwenviewrc | 321 | blacklist ${HOME}/.config/org.kde.gwenviewrc |
322 | blacklist ${HOME}/.config/otter | ||
277 | blacklist ${HOME}/.config/pavucontrol-qt | 323 | blacklist ${HOME}/.config/pavucontrol-qt |
278 | blacklist ${HOME}/.config/pavucontrol.ini | 324 | blacklist ${HOME}/.config/pavucontrol.ini |
279 | blacklist ${HOME}/.config/pcmanfm | 325 | blacklist ${HOME}/.config/pcmanfm |
@@ -305,13 +351,16 @@ blacklist ${HOME}/.config/slimjet | |||
305 | blacklist ${HOME}/.config/smplayer | 351 | blacklist ${HOME}/.config/smplayer |
306 | blacklist ${HOME}/.config/smtube | 352 | blacklist ${HOME}/.config/smtube |
307 | blacklist ${HOME}/.config/snox | 353 | blacklist ${HOME}/.config/snox |
354 | blacklist ${HOME}/.config/sound-juicer | ||
308 | blacklist ${HOME}/.config/specialmailcollectionsrc | 355 | blacklist ${HOME}/.config/specialmailcollectionsrc |
309 | blacklist ${HOME}/.config/spotify | 356 | blacklist ${HOME}/.config/spotify |
310 | blacklist ${HOME}/.config/sqlitebrowser | 357 | blacklist ${HOME}/.config/sqlitebrowser |
311 | blacklist ${HOME}/.config/stellarium | 358 | blacklist ${HOME}/.config/stellarium |
359 | blacklist ${HOME}/.config/strawberry | ||
312 | blacklist ${HOME}/.config/supertuxkart | 360 | blacklist ${HOME}/.config/supertuxkart |
313 | blacklist ${HOME}/.config/synfig | 361 | blacklist ${HOME}/.config/synfig |
314 | blacklist ${HOME}/.config/teams | 362 | blacklist ${HOME}/.config/teams |
363 | blacklist ${HOME}/.config/teams-for-linux | ||
315 | blacklist ${HOME}/.config/telepathy-account-widgets | 364 | blacklist ${HOME}/.config/telepathy-account-widgets |
316 | blacklist ${HOME}/.config/torbrowser | 365 | blacklist ${HOME}/.config/torbrowser |
317 | blacklist ${HOME}/.config/totem | 366 | blacklist ${HOME}/.config/totem |
@@ -327,6 +376,7 @@ blacklist ${HOME}/.config/vivaldi | |||
327 | blacklist ${HOME}/.config/vivaldi-snapshot | 376 | blacklist ${HOME}/.config/vivaldi-snapshot |
328 | blacklist ${HOME}/.config/vlc | 377 | blacklist ${HOME}/.config/vlc |
329 | blacklist ${HOME}/.config/wesnoth | 378 | blacklist ${HOME}/.config/wesnoth |
379 | blacklist ${HOME}/.config/wormux | ||
330 | blacklist ${HOME}/.config/Whalebird | 380 | blacklist ${HOME}/.config/Whalebird |
331 | blacklist ${HOME}/.config/wireshark | 381 | blacklist ${HOME}/.config/wireshark |
332 | blacklist ${HOME}/.config/xchat | 382 | blacklist ${HOME}/.config/xchat |
@@ -346,11 +396,13 @@ blacklist ${HOME}/.config/yandex-browser | |||
346 | blacklist ${HOME}/.config/yandex-browser-beta | 396 | blacklist ${HOME}/.config/yandex-browser-beta |
347 | blacklist ${HOME}/.config/yelp | 397 | blacklist ${HOME}/.config/yelp |
348 | blacklist ${HOME}/.config/youtube-dl | 398 | blacklist ${HOME}/.config/youtube-dl |
399 | blacklist ${HOME}/.config/youtube-viewer | ||
349 | blacklist ${HOME}/.config/zathura | 400 | blacklist ${HOME}/.config/zathura |
350 | blacklist ${HOME}/.config/zoomus.conf | 401 | blacklist ${HOME}/.config/zoomus.conf |
351 | blacklist ${HOME}/.config/Zulip | 402 | blacklist ${HOME}/.config/Zulip |
352 | blacklist ${HOME}/.conkeror.mozdev.org | 403 | blacklist ${HOME}/.conkeror.mozdev.org |
353 | blacklist ${HOME}/.crawl | 404 | blacklist ${HOME}/.crawl |
405 | blacklist ${HOME}/.cups | ||
354 | blacklist ${HOME}/.curlrc | 406 | blacklist ${HOME}/.curlrc |
355 | blacklist ${HOME}/.dashcore | 407 | blacklist ${HOME}/.dashcore |
356 | blacklist ${HOME}/.devilspie | 408 | blacklist ${HOME}/.devilspie |
@@ -375,6 +427,7 @@ blacklist ${HOME}/.fossamail | |||
375 | blacklist ${HOME}/.freeciv | 427 | blacklist ${HOME}/.freeciv |
376 | blacklist ${HOME}/.freecol | 428 | blacklist ${HOME}/.freecol |
377 | blacklist ${HOME}/.freemind | 429 | blacklist ${HOME}/.freemind |
430 | blacklist ${HOME}/.frogatto | ||
378 | blacklist ${HOME}/.frozen-bubble | 431 | blacklist ${HOME}/.frozen-bubble |
379 | blacklist ${HOME}/.gimp* | 432 | blacklist ${HOME}/.gimp* |
380 | blacklist ${HOME}/.gist | 433 | blacklist ${HOME}/.gist |
@@ -388,6 +441,7 @@ blacklist ${HOME}/.gradle | |||
388 | blacklist ${HOME}/.gramps | 441 | blacklist ${HOME}/.gramps |
389 | blacklist ${HOME}/.guayadeque | 442 | blacklist ${HOME}/.guayadeque |
390 | blacklist ${HOME}/.hashcat | 443 | blacklist ${HOME}/.hashcat |
444 | blacklist ${HOME}/.hex-a-hop | ||
391 | blacklist ${HOME}/.hedgewars | 445 | blacklist ${HOME}/.hedgewars |
392 | blacklist ${HOME}/.hugin | 446 | blacklist ${HOME}/.hugin |
393 | blacklist ${HOME}/.i2p | 447 | blacklist ${HOME}/.i2p |
@@ -401,6 +455,7 @@ blacklist ${HOME}/.jak | |||
401 | blacklist ${HOME}/.java | 455 | blacklist ${HOME}/.java |
402 | blacklist ${HOME}/.jd | 456 | blacklist ${HOME}/.jd |
403 | blacklist ${HOME}/.jitsi | 457 | blacklist ${HOME}/.jitsi |
458 | blacklist ${HOME}/.jumpnbump | ||
404 | blacklist ${HOME}/.kde/share/apps/digikam | 459 | blacklist ${HOME}/.kde/share/apps/digikam |
405 | blacklist ${HOME}/.kde/share/apps/gwenview | 460 | blacklist ${HOME}/.kde/share/apps/gwenview |
406 | blacklist ${HOME}/.kde/share/apps/kaffeine | 461 | blacklist ${HOME}/.kde/share/apps/kaffeine |
@@ -424,6 +479,7 @@ blacklist ${HOME}/.kde/share/config/kfindrc | |||
424 | blacklist ${HOME}/.kde/share/config/kgetrc | 479 | blacklist ${HOME}/.kde/share/config/kgetrc |
425 | blacklist ${HOME}/.kde/share/config/khtmlrc | 480 | blacklist ${HOME}/.kde/share/config/khtmlrc |
426 | blacklist ${HOME}/.kde/share/config/klipperrc | 481 | blacklist ${HOME}/.kde/share/config/klipperrc |
482 | blacklist ${HOME}/.kde/share/config/kmplayerrc | ||
427 | blacklist ${HOME}/.kde/share/config/konq_history | 483 | blacklist ${HOME}/.kde/share/config/konq_history |
428 | blacklist ${HOME}/.kde/share/config/konqsidebartngrc | 484 | blacklist ${HOME}/.kde/share/config/konqsidebartngrc |
429 | blacklist ${HOME}/.kde/share/config/konquerorrc | 485 | blacklist ${HOME}/.kde/share/config/konquerorrc |
@@ -479,6 +535,7 @@ blacklist ${HOME}/.local/share/3909/PapersPlease | |||
479 | blacklist ${HOME}/.local/share/Anki2 | 535 | blacklist ${HOME}/.local/share/Anki2 |
480 | blacklist ${HOME}/.local/share/Empathy | 536 | blacklist ${HOME}/.local/share/Empathy |
481 | blacklist ${HOME}/.local/share/Enpass | 537 | blacklist ${HOME}/.local/share/Enpass |
538 | blacklist ${HOME}/.local/share/Flavio Tordini | ||
482 | blacklist ${HOME}/.local/share/JetBrains | 539 | blacklist ${HOME}/.local/share/JetBrains |
483 | blacklist ${HOME}/.local/share/Kingsoft | 540 | blacklist ${HOME}/.local/share/Kingsoft |
484 | blacklist ${HOME}/.local/share/Mendeley Ltd. | 541 | blacklist ${HOME}/.local/share/Mendeley Ltd. |
@@ -488,6 +545,7 @@ blacklist ${HOME}/.local/share/QGIS | |||
488 | blacklist ${HOME}/.local/share/QMediathekView | 545 | blacklist ${HOME}/.local/share/QMediathekView |
489 | blacklist ${HOME}/.local/share/QuiteRss | 546 | blacklist ${HOME}/.local/share/QuiteRss |
490 | blacklist ${HOME}/.local/share/Ricochet | 547 | blacklist ${HOME}/.local/share/Ricochet |
548 | blacklist ${HOME}/.local/share/Shortwave | ||
491 | blacklist ${HOME}/.local/share/Steam | 549 | blacklist ${HOME}/.local/share/Steam |
492 | blacklist ${HOME}/.local/share/SuperHexagon | 550 | blacklist ${HOME}/.local/share/SuperHexagon |
493 | blacklist ${HOME}/.local/share/TelegramDesktop | 551 | blacklist ${HOME}/.local/share/TelegramDesktop |
@@ -496,12 +554,15 @@ blacklist ${HOME}/.local/share/TpLogger | |||
496 | blacklist ${HOME}/.local/share/Zeal | 554 | blacklist ${HOME}/.local/share/Zeal |
497 | blacklist ${HOME}/.local/share/akonadi* | 555 | blacklist ${HOME}/.local/share/akonadi* |
498 | blacklist ${HOME}/.local/share/akregator | 556 | blacklist ${HOME}/.local/share/akregator |
557 | blacklist ${HOME}/.local/share/agenda | ||
499 | blacklist ${HOME}/.local/share/apps/korganizer | 558 | blacklist ${HOME}/.local/share/apps/korganizer |
500 | blacklist ${HOME}/.local/share/aspyr-media | 559 | blacklist ${HOME}/.local/share/aspyr-media |
501 | blacklist ${HOME}/.local/share/autokey | 560 | blacklist ${HOME}/.local/share/autokey |
561 | blacklist ${HOME}/.local/share/backintime | ||
502 | blacklist ${HOME}/.local/share/baloo | 562 | blacklist ${HOME}/.local/share/baloo |
503 | blacklist ${HOME}/.local/share/barrier | 563 | blacklist ${HOME}/.local/share/barrier |
504 | blacklist ${HOME}/.local/share/bibletime | 564 | blacklist ${HOME}/.local/share/bibletime |
565 | blacklist ${HOME}/.local/share/bijiben | ||
505 | blacklist ${HOME}/.local/share/caja-python | 566 | blacklist ${HOME}/.local/share/caja-python |
506 | blacklist ${HOME}/.local/share/cantata | 567 | blacklist ${HOME}/.local/share/cantata |
507 | blacklist ${HOME}/.local/share/cdprojektred | 568 | blacklist ${HOME}/.local/share/cdprojektred |
@@ -519,8 +580,10 @@ blacklist ${HOME}/.local/share/dolphin | |||
519 | blacklist ${HOME}/.local/share/emailidentities | 580 | blacklist ${HOME}/.local/share/emailidentities |
520 | blacklist ${HOME}/.local/share/epiphany | 581 | blacklist ${HOME}/.local/share/epiphany |
521 | blacklist ${HOME}/.local/share/evolution | 582 | blacklist ${HOME}/.local/share/evolution |
583 | blacklist ${HOME}/.local/share/FasterThanLight | ||
522 | blacklist ${HOME}/.local/share/feedreader | 584 | blacklist ${HOME}/.local/share/feedreader |
523 | blacklist ${HOME}/.local/share/feral-interactive | 585 | blacklist ${HOME}/.local/share/feral-interactive |
586 | blacklist ${HOME}/.local/share/five-or-more | ||
524 | blacklist ${HOME}/.local/share/freecol | 587 | blacklist ${HOME}/.local/share/freecol |
525 | blacklist ${HOME}/.local/share/gajim | 588 | blacklist ${HOME}/.local/share/gajim |
526 | blacklist ${HOME}/.local/share/geary | 589 | blacklist ${HOME}/.local/share/geary |
@@ -528,18 +591,26 @@ blacklist ${HOME}/.local/share/geeqie | |||
528 | blacklist ${HOME}/.local/share/ghostwriter | 591 | blacklist ${HOME}/.local/share/ghostwriter |
529 | blacklist ${HOME}/.local/share/gitg | 592 | blacklist ${HOME}/.local/share/gitg |
530 | blacklist ${HOME}/.local/share/gnome-2048 | 593 | blacklist ${HOME}/.local/share/gnome-2048 |
531 | blacklist ${HOME}/.local/share/gnome-chess | 594 | blacklist ${HOME}/.local/share/gnome-boxes |
532 | blacklist ${HOME}/.local/share/gnome-builder | 595 | blacklist ${HOME}/.local/share/gnome-builder |
596 | blacklist ${HOME}/.local/share/gnome-chess | ||
597 | blacklist ${HOME}/.local/share/gnome-klotski | ||
533 | blacklist ${HOME}/.local/share/gnome-latex | 598 | blacklist ${HOME}/.local/share/gnome-latex |
599 | blacklist ${HOME}/.local/share/gnome-mines | ||
534 | blacklist ${HOME}/.local/share/gnome-music | 600 | blacklist ${HOME}/.local/share/gnome-music |
601 | blacklist ${HOME}/.local/share/gnome-nibbles | ||
535 | blacklist ${HOME}/.local/share/gnome-photos | 602 | blacklist ${HOME}/.local/share/gnome-photos |
603 | blacklist ${HOME}/.local/share/gnome-pomodoro | ||
536 | blacklist ${HOME}/.local/share/gnome-recipes | 604 | blacklist ${HOME}/.local/share/gnome-recipes |
537 | blacklist ${HOME}/.local/share/gnome-ring | 605 | blacklist ${HOME}/.local/share/gnome-ring |
606 | blacklist ${HOME}/.local/share/gnome-sudoku | ||
538 | blacklist ${HOME}/.local/share/gnome-twitch | 607 | blacklist ${HOME}/.local/share/gnome-twitch |
608 | blacklist ${HOME}/.local/share/gnote | ||
539 | blacklist ${HOME}/.local/share/godot | 609 | blacklist ${HOME}/.local/share/godot |
540 | blacklist ${HOME}/.local/share/gradio | 610 | blacklist ${HOME}/.local/share/gradio |
541 | blacklist ${HOME}/.local/share/gwenview | 611 | blacklist ${HOME}/.local/share/gwenview |
542 | blacklist ${HOME}/.local/share/i2p | 612 | blacklist ${HOME}/.local/share/i2p |
613 | blacklist ${HOME}/.local/share/IntoTheBreach | ||
543 | blacklist ${HOME}/.local/share/kaffeine | 614 | blacklist ${HOME}/.local/share/kaffeine |
544 | blacklist ${HOME}/.local/share/kalgebra | 615 | blacklist ${HOME}/.local/share/kalgebra |
545 | blacklist ${HOME}/.local/share/kate | 616 | blacklist ${HOME}/.local/share/kate |
@@ -549,15 +620,18 @@ blacklist ${HOME}/.local/share/kiwix | |||
549 | blacklist ${HOME}/.local/share/kiwix-desktop | 620 | blacklist ${HOME}/.local/share/kiwix-desktop |
550 | blacklist ${HOME}/.local/share/klavaro | 621 | blacklist ${HOME}/.local/share/klavaro |
551 | blacklist ${HOME}/.local/share/kmail2 | 622 | blacklist ${HOME}/.local/share/kmail2 |
623 | blacklist ${HOME}/.local/share/kmplayer | ||
552 | blacklist ${HOME}/.local/share/knotes | 624 | blacklist ${HOME}/.local/share/knotes |
553 | blacklist ${HOME}/.local/share/krita | 625 | blacklist ${HOME}/.local/share/krita |
554 | blacklist ${HOME}/.local/share/ktorrent | 626 | blacklist ${HOME}/.local/share/ktorrent |
555 | blacklist ${HOME}/.local/share/ktorrentrc | 627 | blacklist ${HOME}/.local/share/ktorrentrc |
556 | blacklist ${HOME}/.local/share/ktouch | 628 | blacklist ${HOME}/.local/share/ktouch |
557 | blacklist ${HOME}/.local/share/kwrite | 629 | blacklist ${HOME}/.local/share/kwrite |
630 | blacklist ${HOME}/.local/share/kxmlgui5/* | ||
558 | blacklist ${HOME}/.local/share/liferea | 631 | blacklist ${HOME}/.local/share/liferea |
559 | blacklist ${HOME}/.local/share/local-mail | 632 | blacklist ${HOME}/.local/share/local-mail |
560 | blacklist ${HOME}/.local/share/lollypop | 633 | blacklist ${HOME}/.local/share/lollypop |
634 | blacklist ${HOME}/.local/share/love | ||
561 | blacklist ${HOME}/.local/share/lugaru | 635 | blacklist ${HOME}/.local/share/lugaru |
562 | blacklist ${HOME}/.local/share/mana | 636 | blacklist ${HOME}/.local/share/mana |
563 | blacklist ${HOME}/.local/share/maps-places.json | 637 | blacklist ${HOME}/.local/share/maps-places.json |
@@ -571,6 +645,7 @@ blacklist ${HOME}/.local/share/nautilus | |||
571 | blacklist ${HOME}/.local/share/nautilus-python | 645 | blacklist ${HOME}/.local/share/nautilus-python |
572 | blacklist ${HOME}/.local/share/nemo | 646 | blacklist ${HOME}/.local/share/nemo |
573 | blacklist ${HOME}/.local/share/nemo-python | 647 | blacklist ${HOME}/.local/share/nemo-python |
648 | blacklist ${HOME}/.local/share/news-flash | ||
574 | blacklist ${HOME}/.local/share/nomacs | 649 | blacklist ${HOME}/.local/share/nomacs |
575 | blacklist ${HOME}/.local/share/notes | 650 | blacklist ${HOME}/.local/share/notes |
576 | blacklist ${HOME}/.local/share/ocenaudio | 651 | blacklist ${HOME}/.local/share/ocenaudio |
@@ -578,10 +653,12 @@ blacklist ${HOME}/.local/share/okular | |||
578 | blacklist ${HOME}/.local/share/onlyoffice | 653 | blacklist ${HOME}/.local/share/onlyoffice |
579 | blacklist ${HOME}/.local/share/orage | 654 | blacklist ${HOME}/.local/share/orage |
580 | blacklist ${HOME}/.local/share/org.kde.gwenview | 655 | blacklist ${HOME}/.local/share/org.kde.gwenview |
656 | blacklist ${HOME}/.local/share/Paradox Interactive | ||
581 | blacklist ${HOME}/.local/share/pix | 657 | blacklist ${HOME}/.local/share/pix |
582 | blacklist ${HOME}/.local/share/plasma_notes | 658 | blacklist ${HOME}/.local/share/plasma_notes |
583 | blacklist ${HOME}/.local/share/profanity | 659 | blacklist ${HOME}/.local/share/profanity |
584 | blacklist ${HOME}/.local/share/psi+ | 660 | blacklist ${HOME}/.local/share/psi+ |
661 | blacklist ${HOME}/.local/share/quadrapassel | ||
585 | blacklist ${HOME}/.local/share/qpdfview | 662 | blacklist ${HOME}/.local/share/qpdfview |
586 | blacklist ${HOME}/.local/share/qutebrowser | 663 | blacklist ${HOME}/.local/share/qutebrowser |
587 | blacklist ${HOME}/.local/share/remmina | 664 | blacklist ${HOME}/.local/share/remmina |
@@ -591,8 +668,10 @@ blacklist ${HOME}/.local/share/scribus | |||
591 | blacklist ${HOME}/.local/share/signal-cli | 668 | blacklist ${HOME}/.local/share/signal-cli |
592 | blacklist ${HOME}/.local/share/spotify | 669 | blacklist ${HOME}/.local/share/spotify |
593 | blacklist ${HOME}/.local/share/steam | 670 | blacklist ${HOME}/.local/share/steam |
671 | blacklist ${HOME}/.local/share/strawberry | ||
594 | blacklist ${HOME}/.local/share/supertux2 | 672 | blacklist ${HOME}/.local/share/supertux2 |
595 | blacklist ${HOME}/.local/share/supertuxkart | 673 | blacklist ${HOME}/.local/share/supertuxkart |
674 | blacklist ${HOME}/.local/share/swell-foop | ||
596 | blacklist ${HOME}/.local/share/telepathy | 675 | blacklist ${HOME}/.local/share/telepathy |
597 | blacklist ${HOME}/.local/share/terasology | 676 | blacklist ${HOME}/.local/share/terasology |
598 | blacklist ${HOME}/.local/share/torbrowser | 677 | blacklist ${HOME}/.local/share/torbrowser |
@@ -603,16 +682,23 @@ blacklist ${HOME}/.local/share/vpltd | |||
603 | blacklist ${HOME}/.local/share/vulkan | 682 | blacklist ${HOME}/.local/share/vulkan |
604 | blacklist ${HOME}/.local/share/warsow-2.1 | 683 | blacklist ${HOME}/.local/share/warsow-2.1 |
605 | blacklist ${HOME}/.local/share/wesnoth | 684 | blacklist ${HOME}/.local/share/wesnoth |
685 | blacklist ${HOME}/.local/share/wormux | ||
606 | blacklist ${HOME}/.local/share/xplayer | 686 | blacklist ${HOME}/.local/share/xplayer |
607 | blacklist ${HOME}/.local/share/xreader | 687 | blacklist ${HOME}/.local/share/xreader |
608 | blacklist ${HOME}/.local/share/zathura | 688 | blacklist ${HOME}/.local/share/zathura |
609 | blacklist ${HOME}/.lv2 | 689 | blacklist ${HOME}/.lv2 |
690 | blacklist ${HOME}/.lyx | ||
691 | blacklist ${HOME}/.magicor | ||
610 | blacklist ${HOME}/.masterpdfeditor | 692 | blacklist ${HOME}/.masterpdfeditor |
693 | blacklist ${HOME}/.mbwarband | ||
611 | blacklist ${HOME}/.mcabber | 694 | blacklist ${HOME}/.mcabber |
612 | blacklist ${HOME}/.mcabberrc | 695 | blacklist ${HOME}/.mcabberrc |
613 | blacklist ${HOME}/.mediathek3 | 696 | blacklist ${HOME}/.mediathek3 |
614 | blacklist ${HOME}/.megaglest | 697 | blacklist ${HOME}/.megaglest |
698 | blacklist ${HOME}/.minecraft | ||
615 | blacklist ${HOME}/.minetest | 699 | blacklist ${HOME}/.minetest |
700 | blacklist ${HOME}/.mirrormagic | ||
701 | blacklist ${HOME}/.moc | ||
616 | blacklist ${HOME}/.moonchild productions/basilisk | 702 | blacklist ${HOME}/.moonchild productions/basilisk |
617 | blacklist ${HOME}/.moonchild productions/pale moon | 703 | blacklist ${HOME}/.moonchild productions/pale moon |
618 | blacklist ${HOME}/.mozilla | 704 | blacklist ${HOME}/.mozilla |
@@ -627,6 +713,7 @@ blacklist ${HOME}/.netactview | |||
627 | blacklist ${HOME}/.neverball | 713 | blacklist ${HOME}/.neverball |
628 | blacklist ${HOME}/.newsbeuter | 714 | blacklist ${HOME}/.newsbeuter |
629 | blacklist ${HOME}/.newsboat | 715 | blacklist ${HOME}/.newsboat |
716 | blacklist ${HOME}/.nicotine | ||
630 | blacklist ${HOME}/.nv | 717 | blacklist ${HOME}/.nv |
631 | blacklist ${HOME}/.nylas-mail | 718 | blacklist ${HOME}/.nylas-mail |
632 | blacklist ${HOME}/.openarena | 719 | blacklist ${HOME}/.openarena |
@@ -638,9 +725,13 @@ blacklist ${HOME}/.openttd | |||
638 | blacklist ${HOME}/.opera | 725 | blacklist ${HOME}/.opera |
639 | blacklist ${HOME}/.opera-beta | 726 | blacklist ${HOME}/.opera-beta |
640 | blacklist ${HOME}/.ostrichriders | 727 | blacklist ${HOME}/.ostrichriders |
728 | blacklist ${HOME}/.paradoxinteractive | ||
729 | blacklist ${HOME}/.parallelrealities/blobwars | ||
730 | blacklist ${HOME}/.penguin-command | ||
641 | blacklist ${HOME}/.pingus | 731 | blacklist ${HOME}/.pingus |
642 | blacklist ${HOME}/.pioneer | 732 | blacklist ${HOME}/.pioneer |
643 | blacklist ${HOME}/.purple | 733 | blacklist ${HOME}/.purple |
734 | blacklist ${HOME}/.pylint.d | ||
644 | blacklist ${HOME}/.qemu-launcher | 735 | blacklist ${HOME}/.qemu-launcher |
645 | blacklist ${HOME}/.qgis2 | 736 | blacklist ${HOME}/.qgis2 |
646 | blacklist ${HOME}/.qmmp | 737 | blacklist ${HOME}/.qmmp |
@@ -650,6 +741,7 @@ blacklist ${HOME}/.remmina | |||
650 | blacklist ${HOME}/.repo_.gitconfig.json | 741 | blacklist ${HOME}/.repo_.gitconfig.json |
651 | blacklist ${HOME}/.repoconfig | 742 | blacklist ${HOME}/.repoconfig |
652 | blacklist ${HOME}/.retroshare | 743 | blacklist ${HOME}/.retroshare |
744 | blacklist ${HOME}/.ripperXrc | ||
653 | blacklist ${HOME}/.scorched3d | 745 | blacklist ${HOME}/.scorched3d |
654 | blacklist ${HOME}/.scribus | 746 | blacklist ${HOME}/.scribus |
655 | blacklist ${HOME}/.scribusrc | 747 | blacklist ${HOME}/.scribusrc |
@@ -662,13 +754,14 @@ blacklist ${HOME}/.steampid | |||
662 | blacklist ${HOME}/.stellarium | 754 | blacklist ${HOME}/.stellarium |
663 | blacklist ${HOME}/.subversion | 755 | blacklist ${HOME}/.subversion |
664 | blacklist ${HOME}/.surf | 756 | blacklist ${HOME}/.surf |
757 | blacklist ${HOME}/.swb.ini | ||
665 | blacklist ${HOME}/.sword | 758 | blacklist ${HOME}/.sword |
666 | blacklist ${HOME}/.sylpheed-2.0 | 759 | blacklist ${HOME}/.sylpheed-2.0 |
667 | blacklist ${HOME}/.synfig | 760 | blacklist ${HOME}/.synfig |
668 | blacklist ${HOME}/.config/teams-for-linux | ||
669 | blacklist ${HOME}/.tb | 761 | blacklist ${HOME}/.tb |
670 | blacklist ${HOME}/.tconn | 762 | blacklist ${HOME}/.tconn |
671 | blacklist ${HOME}/.teeworlds | 763 | blacklist ${HOME}/.teeworlds |
764 | blacklist ${HOME}/.texlive2018 | ||
672 | blacklist ${HOME}/.thunderbird | 765 | blacklist ${HOME}/.thunderbird |
673 | blacklist ${HOME}/.tilp | 766 | blacklist ${HOME}/.tilp |
674 | blacklist ${HOME}/.tooling | 767 | blacklist ${HOME}/.tooling |
@@ -683,6 +776,7 @@ blacklist ${HOME}/.viking | |||
683 | blacklist ${HOME}/.viking-maps | 776 | blacklist ${HOME}/.viking-maps |
684 | blacklist ${HOME}/.vim | 777 | blacklist ${HOME}/.vim |
685 | blacklist ${HOME}/.vimrc | 778 | blacklist ${HOME}/.vimrc |
779 | blacklist ${HOME}/.vmware | ||
686 | blacklist ${HOME}/.vscode | 780 | blacklist ${HOME}/.vscode |
687 | blacklist ${HOME}/.vscode-oss | 781 | blacklist ${HOME}/.vscode-oss |
688 | blacklist ${HOME}/.vst | 782 | blacklist ${HOME}/.vst |
@@ -697,6 +791,8 @@ blacklist ${HOME}/.widelands | |||
697 | blacklist ${HOME}/.wine | 791 | blacklist ${HOME}/.wine |
698 | blacklist ${HOME}/.wine64 | 792 | blacklist ${HOME}/.wine64 |
699 | blacklist ${HOME}/.wireshark | 793 | blacklist ${HOME}/.wireshark |
794 | blacklist ${HOME}/.wordwarvi | ||
795 | blacklist ${HOME}/.wormux | ||
700 | blacklist ${HOME}/.xiphos | 796 | blacklist ${HOME}/.xiphos |
701 | blacklist ${HOME}/.xmind | 797 | blacklist ${HOME}/.xmind |
702 | blacklist ${HOME}/.xmms | 798 | blacklist ${HOME}/.xmms |
@@ -721,12 +817,18 @@ blacklist ${HOME}/.cache/BraveSoftware | |||
721 | blacklist ${HOME}/.cache/Clementine | 817 | blacklist ${HOME}/.cache/Clementine |
722 | blacklist ${HOME}/.cache/Enox | 818 | blacklist ${HOME}/.cache/Enox |
723 | blacklist ${HOME}/.cache/Enpass | 819 | blacklist ${HOME}/.cache/Enpass |
820 | blacklist ${HOME}/.cache/Ferdi | ||
821 | blacklist ${HOME}/.cache/Flavio Tordini | ||
724 | blacklist ${HOME}/.cache/Franz | 822 | blacklist ${HOME}/.cache/Franz |
725 | blacklist ${HOME}/.cache/INRIA | 823 | blacklist ${HOME}/.cache/INRIA |
726 | blacklist ${HOME}/.cache/MusicBrainz | 824 | blacklist ${HOME}/.cache/MusicBrainz |
825 | blacklist ${HOME}/.cache/NewsFlashGTK | ||
826 | blacklist ${HOME}/.cache/Otter | ||
727 | blacklist ${HOME}/.cache/QuiteRss | 827 | blacklist ${HOME}/.cache/QuiteRss |
828 | blacklist ${HOME}/.cache/Shortwave | ||
728 | blacklist ${HOME}/.cache/Tox | 829 | blacklist ${HOME}/.cache/Tox |
729 | blacklist ${HOME}/.cache/Zeal | 830 | blacklist ${HOME}/.cache/Zeal |
831 | blacklist ${HOME}/.cache/agenda | ||
730 | blacklist ${HOME}/.cache/akonadi* | 832 | blacklist ${HOME}/.cache/akonadi* |
731 | blacklist ${HOME}/.cache/atril | 833 | blacklist ${HOME}/.cache/atril |
732 | blacklist ${HOME}/.cache/attic | 834 | blacklist ${HOME}/.cache/attic |
@@ -741,6 +843,7 @@ blacklist ${HOME}/.cache/chromium-dev | |||
741 | blacklist ${HOME}/.cache/cliqz | 843 | blacklist ${HOME}/.cache/cliqz |
742 | blacklist ${HOME}/.cache/com.github.johnfactotum.Foliate | 844 | blacklist ${HOME}/.cache/com.github.johnfactotum.Foliate |
743 | blacklist ${HOME}/.cache/darktable | 845 | blacklist ${HOME}/.cache/darktable |
846 | blacklist ${HOME}/.cache/deja-dup | ||
744 | blacklist ${HOME}/.cache/discover | 847 | blacklist ${HOME}/.cache/discover |
745 | blacklist ${HOME}/.cache/dnox | 848 | blacklist ${HOME}/.cache/dnox |
746 | blacklist ${HOME}/.cache/dolphin | 849 | blacklist ${HOME}/.cache/dolphin |
@@ -757,8 +860,12 @@ blacklist ${HOME}/.cache/gegl-0.4 | |||
757 | blacklist ${HOME}/.cache/geeqie | 860 | blacklist ${HOME}/.cache/geeqie |
758 | blacklist ${HOME}/.cache/gfeeds | 861 | blacklist ${HOME}/.cache/gfeeds |
759 | blacklist ${HOME}/.cache/gimp | 862 | blacklist ${HOME}/.cache/gimp |
863 | blacklist ${HOME}/.cache/gnome-boxes | ||
760 | blacklist ${HOME}/.cache/gnome-builder | 864 | blacklist ${HOME}/.cache/gnome-builder |
865 | blacklist ${HOME}/.cache/gnome-control-center | ||
761 | blacklist ${HOME}/.cache/gnome-recipes | 866 | blacklist ${HOME}/.cache/gnome-recipes |
867 | blacklist ${HOME}/.cache/gnome-screenshot | ||
868 | blacklist ${HOME}/.cache/gnome-software | ||
762 | blacklist ${HOME}/.cache/gnome-twitch | 869 | blacklist ${HOME}/.cache/gnome-twitch |
763 | blacklist ${HOME}/.cache/godot | 870 | blacklist ${HOME}/.cache/godot |
764 | blacklist ${HOME}/.cache/google-chrome | 871 | blacklist ${HOME}/.cache/google-chrome |
@@ -773,6 +880,7 @@ blacklist ${HOME}/.cache/inox | |||
773 | blacklist ${HOME}/.cache/iridium | 880 | blacklist ${HOME}/.cache/iridium |
774 | blacklist ${HOME}/.cache/kcmshell5 | 881 | blacklist ${HOME}/.cache/kcmshell5 |
775 | blacklist ${HOME}/.cache/kdenlive | 882 | blacklist ${HOME}/.cache/kdenlive |
883 | blacklist ${HOME}/.cache/keepassxc | ||
776 | blacklist ${HOME}/.cache/kfind | 884 | blacklist ${HOME}/.cache/kfind |
777 | blacklist ${HOME}/.cache/kinfocenter | 885 | blacklist ${HOME}/.cache/kinfocenter |
778 | blacklist ${HOME}/.cache/kmail2 | 886 | blacklist ${HOME}/.cache/kmail2 |
@@ -809,6 +917,7 @@ blacklist ${HOME}/.cache/org.gnome.Books | |||
809 | blacklist ${HOME}/.cache/org.gnome.Maps | 917 | blacklist ${HOME}/.cache/org.gnome.Maps |
810 | blacklist ${HOME}/.cache/pdfmod | 918 | blacklist ${HOME}/.cache/pdfmod |
811 | blacklist ${HOME}/.cache/peek | 919 | blacklist ${HOME}/.cache/peek |
920 | blacklist ${HOME}/.cache/pip | ||
812 | blacklist ${HOME}/.cache/plasmashell | 921 | blacklist ${HOME}/.cache/plasmashell |
813 | blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite* | 922 | blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite* |
814 | blacklist ${HOME}/.cache/qBittorrent | 923 | blacklist ${HOME}/.cache/qBittorrent |
@@ -819,6 +928,7 @@ blacklist ${HOME}/.cache/simple-scan | |||
819 | blacklist ${HOME}/.cache/slimjet | 928 | blacklist ${HOME}/.cache/slimjet |
820 | blacklist ${HOME}/.cache/snox | 929 | blacklist ${HOME}/.cache/snox |
821 | blacklist ${HOME}/.cache/spotify | 930 | blacklist ${HOME}/.cache/spotify |
931 | blacklist ${HOME}/.cache/strawberry | ||
822 | blacklist ${HOME}/.cache/supertuxkart | 932 | blacklist ${HOME}/.cache/supertuxkart |
823 | blacklist ${HOME}/.cache/systemsettings | 933 | blacklist ${HOME}/.cache/systemsettings |
824 | blacklist ${HOME}/.cache/telepathy | 934 | blacklist ${HOME}/.cache/telepathy |
@@ -828,6 +938,7 @@ blacklist ${HOME}/.cache/transmission | |||
828 | blacklist ${HOME}/.cache/vivaldi | 938 | blacklist ${HOME}/.cache/vivaldi |
829 | blacklist ${HOME}/.cache/vivaldi-snapshot | 939 | blacklist ${HOME}/.cache/vivaldi-snapshot |
830 | blacklist ${HOME}/.cache/vlc | 940 | blacklist ${HOME}/.cache/vlc |
941 | blacklist ${HOME}/.cache/vmware | ||
831 | blacklist ${HOME}/.cache/warsow-2.1 | 942 | blacklist ${HOME}/.cache/warsow-2.1 |
832 | blacklist ${HOME}/.cache/waterfox | 943 | blacklist ${HOME}/.cache/waterfox |
833 | blacklist ${HOME}/.cache/wesnoth | 944 | blacklist ${HOME}/.cache/wesnoth |
diff --git a/etc/inc/disable-shell.inc b/etc/inc/disable-shell.inc new file mode 100644 index 000000000..fda528eb6 --- /dev/null +++ b/etc/inc/disable-shell.inc | |||
@@ -0,0 +1,13 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include disable-shell.local | ||
4 | |||
5 | blacklist ${PATH}/bash | ||
6 | blacklist ${PATH}/csh | ||
7 | blacklist ${PATH}/dash | ||
8 | blacklist ${PATH}/fish | ||
9 | blacklist ${PATH}/ksh | ||
10 | blacklist ${PATH}/sh | ||
11 | blacklist ${PATH}/tclsh | ||
12 | blacklist ${PATH}/tcsh | ||
13 | blacklist ${PATH}/zsh | ||
diff --git a/etc/disable-xdg.inc b/etc/inc/disable-xdg.inc index 22acf272d..22acf272d 100644 --- a/etc/disable-xdg.inc +++ b/etc/inc/disable-xdg.inc | |||
diff --git a/etc/feh-network.inc b/etc/inc/feh-network.inc index e94e7205c..e94e7205c 100644 --- a/etc/feh-network.inc +++ b/etc/inc/feh-network.inc | |||
diff --git a/etc/firefox-common-addons.inc b/etc/inc/firefox-common-addons.inc index 1dca67e06..11acb7b42 100644 --- a/etc/firefox-common-addons.inc +++ b/etc/inc/firefox-common-addons.inc | |||
@@ -17,6 +17,7 @@ noblacklist ${HOME}/.kde4/share/config/kgetrc | |||
17 | noblacklist ${HOME}/.kde4/share/config/okularpartrc | 17 | noblacklist ${HOME}/.kde4/share/config/okularpartrc |
18 | noblacklist ${HOME}/.kde4/share/config/okularrc | 18 | noblacklist ${HOME}/.kde4/share/config/okularrc |
19 | noblacklist ${HOME}/.local/share/kget | 19 | noblacklist ${HOME}/.local/share/kget |
20 | noblacklist ${HOME}/.local/share/kxmlgui5/okular | ||
20 | noblacklist ${HOME}/.local/share/okular | 21 | noblacklist ${HOME}/.local/share/okular |
21 | noblacklist ${HOME}/.local/share/qpdfview | 22 | noblacklist ${HOME}/.local/share/qpdfview |
22 | 23 | ||
@@ -41,6 +42,7 @@ whitelist ${HOME}/.kde4/share/config/okularrc | |||
41 | whitelist ${HOME}/.keysnail.js | 42 | whitelist ${HOME}/.keysnail.js |
42 | whitelist ${HOME}/.lastpass | 43 | whitelist ${HOME}/.lastpass |
43 | whitelist ${HOME}/.local/share/kget | 44 | whitelist ${HOME}/.local/share/kget |
45 | whitelist ${HOME}/.local/share/kxmlgui5/okular | ||
44 | whitelist ${HOME}/.local/share/okular | 46 | whitelist ${HOME}/.local/share/okular |
45 | whitelist ${HOME}/.local/share/qpdfview | 47 | whitelist ${HOME}/.local/share/qpdfview |
46 | whitelist ${HOME}/.local/share/tridactyl | 48 | whitelist ${HOME}/.local/share/tridactyl |
@@ -57,7 +59,8 @@ whitelist ${HOME}/dwhelper | |||
57 | # GNOME Shell integration (chrome-gnome-shell) needs dbus and python 3 (blacklisted by disable-interpreters.inc) | 59 | # GNOME Shell integration (chrome-gnome-shell) needs dbus and python 3 (blacklisted by disable-interpreters.inc) |
58 | noblacklist ${HOME}/.local/share/gnome-shell | 60 | noblacklist ${HOME}/.local/share/gnome-shell |
59 | whitelist ${HOME}/.local/share/gnome-shell | 61 | whitelist ${HOME}/.local/share/gnome-shell |
60 | ignore nodbus | 62 | ignore dbus-user none |
63 | ignore dbus-system none | ||
61 | include allow-python3.inc | 64 | include allow-python3.inc |
62 | 65 | ||
63 | # KeePassXC Browser Integration | 66 | # KeePassXC Browser Integration |
diff --git a/etc/softmaker-common.inc b/etc/inc/softmaker-common.inc index 48249877c..a8ec5848c 100644 --- a/etc/softmaker-common.inc +++ b/etc/inc/softmaker-common.inc | |||
@@ -28,7 +28,6 @@ apparmor | |||
28 | caps.drop all | 28 | caps.drop all |
29 | ipc-namespace | 29 | ipc-namespace |
30 | netfilter | 30 | netfilter |
31 | nodbus | ||
32 | nodvd | 31 | nodvd |
33 | nogroups | 32 | nogroups |
34 | nonewprivs | 33 | nonewprivs |
@@ -46,3 +45,6 @@ private-cache | |||
46 | private-dev | 45 | private-dev |
47 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,SoftMaker,ssl | 46 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,SoftMaker,ssl |
48 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/whitelist-common.inc b/etc/inc/whitelist-common.inc index 9c1b7b92c..0798c7d3e 100644 --- a/etc/whitelist-common.inc +++ b/etc/inc/whitelist-common.inc | |||
@@ -11,6 +11,8 @@ whitelist ${HOME}/.config/pkcs11 | |||
11 | read-only ${HOME}/.config/pkcs11 | 11 | read-only ${HOME}/.config/pkcs11 |
12 | whitelist ${HOME}/.config/user-dirs.dirs | 12 | whitelist ${HOME}/.config/user-dirs.dirs |
13 | read-only ${HOME}/.config/user-dirs.dirs | 13 | read-only ${HOME}/.config/user-dirs.dirs |
14 | whitelist ${HOME}/.config/user-dirs.locale | ||
15 | read-only ${HOME}/.config/user-dirs.locale | ||
14 | whitelist ${HOME}/.drirc | 16 | whitelist ${HOME}/.drirc |
15 | whitelist ${HOME}/.icons | 17 | whitelist ${HOME}/.icons |
16 | ?HAS_APPIMAGE: whitelist ${HOME}/.local/share/appimagekit | 18 | ?HAS_APPIMAGE: whitelist ${HOME}/.local/share/appimagekit |
@@ -38,6 +40,7 @@ whitelist ${HOME}/.pangorc | |||
38 | # gtk | 40 | # gtk |
39 | whitelist ${HOME}/.config/gtk-2.0 | 41 | whitelist ${HOME}/.config/gtk-2.0 |
40 | whitelist ${HOME}/.config/gtk-3.0 | 42 | whitelist ${HOME}/.config/gtk-3.0 |
43 | whitelist ${HOME}/.config/gtk-4.0 | ||
41 | whitelist ${HOME}/.config/gtkrc | 44 | whitelist ${HOME}/.config/gtkrc |
42 | whitelist ${HOME}/.config/gtkrc-2.0 | 45 | whitelist ${HOME}/.config/gtkrc-2.0 |
43 | whitelist ${HOME}/.gnome2 | 46 | whitelist ${HOME}/.gnome2 |
diff --git a/etc/inc/whitelist-runuser-common.inc b/etc/inc/whitelist-runuser-common.inc new file mode 100644 index 000000000..f2a510e9d --- /dev/null +++ b/etc/inc/whitelist-runuser-common.inc | |||
@@ -0,0 +1,12 @@ | |||
1 | # Local customizations come here | ||
2 | include whitelist-runuser-common.local | ||
3 | |||
4 | # common ${RUNUSER} (=/run/user/$UID) whitelist for all profiles | ||
5 | |||
6 | whitelist ${RUNUSER}/bus | ||
7 | whitelist ${RUNUSER}/dconf | ||
8 | whitelist ${RUNUSER}/gdm/Xauthority | ||
9 | whitelist ${RUNUSER}/ICEauthority | ||
10 | whitelist ${RUNUSER}/.mutter-Xwaylandauth.* | ||
11 | whitelist ${RUNUSER}/pulse/native | ||
12 | whitelist ${RUNUSER}/wayland-0 | ||
diff --git a/etc/whitelist-usr-share-common.inc b/etc/inc/whitelist-usr-share-common.inc index a9d4cadb8..ceeb14dcc 100644 --- a/etc/whitelist-usr-share-common.inc +++ b/etc/inc/whitelist-usr-share-common.inc | |||
@@ -22,6 +22,7 @@ whitelist /usr/share/glib-2.0 | |||
22 | whitelist /usr/share/glvnd | 22 | whitelist /usr/share/glvnd |
23 | whitelist /usr/share/gtk-2.0 | 23 | whitelist /usr/share/gtk-2.0 |
24 | whitelist /usr/share/gtk-3.0 | 24 | whitelist /usr/share/gtk-3.0 |
25 | whitelist /usr/share/gtk-engines | ||
25 | whitelist /usr/share/gtksourceview-3.0 | 26 | whitelist /usr/share/gtksourceview-3.0 |
26 | whitelist /usr/share/gtksourceview-4 | 27 | whitelist /usr/share/gtksourceview-4 |
27 | whitelist /usr/share/hunspell | 28 | whitelist /usr/share/hunspell |
@@ -40,6 +41,8 @@ whitelist /usr/share/misc | |||
40 | whitelist /usr/share/Modules | 41 | whitelist /usr/share/Modules |
41 | whitelist /usr/share/myspell | 42 | whitelist /usr/share/myspell |
42 | whitelist /usr/share/p11-kit | 43 | whitelist /usr/share/p11-kit |
44 | whitelist /usr/share/perl | ||
45 | whitelist /usr/share/perl5 | ||
43 | whitelist /usr/share/pixmaps | 46 | whitelist /usr/share/pixmaps |
44 | whitelist /usr/share/pki | 47 | whitelist /usr/share/pki |
45 | whitelist /usr/share/plasma | 48 | whitelist /usr/share/plasma |
@@ -47,8 +50,10 @@ whitelist /usr/share/publicsuffix | |||
47 | whitelist /usr/share/qt | 50 | whitelist /usr/share/qt |
48 | whitelist /usr/share/qt4 | 51 | whitelist /usr/share/qt4 |
49 | whitelist /usr/share/qt5 | 52 | whitelist /usr/share/qt5 |
53 | whitelist /usr/share/qt5ct | ||
50 | whitelist /usr/share/sounds | 54 | whitelist /usr/share/sounds |
51 | whitelist /usr/share/tcl8.6 | 55 | whitelist /usr/share/tcl8.6 |
56 | whitelist /usr/share/tcltk | ||
52 | whitelist /usr/share/terminfo | 57 | whitelist /usr/share/terminfo |
53 | whitelist /usr/share/texlive | 58 | whitelist /usr/share/texlive |
54 | whitelist /usr/share/texmf | 59 | whitelist /usr/share/texmf |
diff --git a/etc/whitelist-var-common.inc b/etc/inc/whitelist-var-common.inc index e2210057b..e2210057b 100644 --- a/etc/whitelist-var-common.inc +++ b/etc/inc/whitelist-var-common.inc | |||
diff --git a/etc/keepassxc.profile b/etc/keepassxc.profile deleted file mode 100644 index d04ada227..000000000 --- a/etc/keepassxc.profile +++ /dev/null | |||
@@ -1,56 +0,0 @@ | |||
1 | # Firejail profile for keepassxc | ||
2 | # Description: Cross Platform Password Manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include keepassxc.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/*.kdb | ||
10 | noblacklist ${HOME}/*.kdbx | ||
11 | noblacklist ${HOME}/.config/keepassxc | ||
12 | noblacklist ${HOME}/.keepassxc | ||
13 | # 2.2.4 needs this path when compiled with "Native messaging browser extension" | ||
14 | noblacklist ${HOME}/.mozilla | ||
15 | noblacklist ${DOCUMENTS} | ||
16 | |||
17 | include disable-common.inc | ||
18 | include disable-devel.inc | ||
19 | include disable-exec.inc | ||
20 | include disable-interpreters.inc | ||
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | ||
23 | include disable-xdg.inc | ||
24 | |||
25 | whitelist /usr/share/keepassxc | ||
26 | include whitelist-usr-share-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | caps.drop all | ||
30 | machine-id | ||
31 | net none | ||
32 | no3d | ||
33 | nodvd | ||
34 | # Breaks 'Lock database when session is locked or lid is closed' (#2899). | ||
35 | # Also breaks (Plasma) tray icon, | ||
36 | # you can safely uncomment it or add to keepassxc.local if you don't need these features. | ||
37 | #nodbus | ||
38 | nogroups | ||
39 | nonewprivs | ||
40 | noroot | ||
41 | nosound | ||
42 | notv | ||
43 | nou2f | ||
44 | novideo | ||
45 | protocol unix,netlink | ||
46 | seccomp | ||
47 | shell none | ||
48 | tracelog | ||
49 | |||
50 | private-bin keepassxc,keepassxc-cli,keepassxc-proxy | ||
51 | private-dev | ||
52 | private-etc alternatives,fonts,ld.so.cache,machine-id | ||
53 | private-tmp | ||
54 | |||
55 | # Mutex is stored in /tmp by default, which is broken by private-tmp | ||
56 | join-or-start keepassxc | ||
diff --git a/etc/nautilus.profile b/etc/nautilus.profile deleted file mode 100644 index e003488de..000000000 --- a/etc/nautilus.profile +++ /dev/null | |||
@@ -1,44 +0,0 @@ | |||
1 | # Firejail profile for nautilus | ||
2 | # Description: File manager and graphical shell for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nautilus.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Nautilus is started by systemd on most systems. Therefore it is not firejailed by default. Since there | ||
10 | # is already a nautilus process running on gnome desktops firejail will have no effect. | ||
11 | |||
12 | noblacklist ${HOME}/.config/nautilus | ||
13 | noblacklist ${HOME}/.local/share/Trash | ||
14 | noblacklist ${HOME}/.local/share/nautilus | ||
15 | noblacklist ${HOME}/.local/share/nautilus-python | ||
16 | |||
17 | # Allow python (blacklisted by disable-interpreters.inc) | ||
18 | include allow-python2.inc | ||
19 | include allow-python3.inc | ||
20 | |||
21 | include disable-common.inc | ||
22 | include disable-devel.inc | ||
23 | include disable-interpreters.inc | ||
24 | include disable-passwdmgr.inc | ||
25 | # include disable-programs.inc | ||
26 | |||
27 | allusers | ||
28 | caps.drop all | ||
29 | netfilter | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | novideo | ||
36 | protocol unix | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | # nautilus needs to be able to start arbitrary applications so we cannot blacklist their files | ||
42 | # private-bin nautilus | ||
43 | # private-dev | ||
44 | # private-tmp | ||
diff --git a/etc/nemo.profile b/etc/nemo.profile deleted file mode 100644 index 6a62a3a0c..000000000 --- a/etc/nemo.profile +++ /dev/null | |||
@@ -1,38 +0,0 @@ | |||
1 | # Firejail profile for nemo | ||
2 | # Description: File manager and graphical shell for Cinnamon | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nemo.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/nemo | ||
10 | noblacklist ${HOME}/.local/share/Trash | ||
11 | noblacklist ${HOME}/.local/share/nemo | ||
12 | noblacklist ${HOME}/.local/share/nemo-python | ||
13 | |||
14 | # Allow python (blacklisted by disable-interpreters.inc) | ||
15 | include allow-python2.inc | ||
16 | include allow-python3.inc | ||
17 | |||
18 | include disable-common.inc | ||
19 | include disable-devel.inc | ||
20 | include disable-exec.inc | ||
21 | include disable-interpreters.inc | ||
22 | include disable-passwdmgr.inc | ||
23 | |||
24 | allusers | ||
25 | caps.drop all | ||
26 | netfilter | ||
27 | no3d | ||
28 | nodvd | ||
29 | nogroups | ||
30 | nonewprivs | ||
31 | noroot | ||
32 | nosound | ||
33 | notv | ||
34 | novideo | ||
35 | protocol unix,inet,inet6 | ||
36 | seccomp | ||
37 | shell none | ||
38 | |||
diff --git a/etc/nolocal.net b/etc/net/nolocal.net index 8955f740d..0eb9f9784 100644 --- a/etc/nolocal.net +++ b/etc/net/nolocal.net | |||
@@ -32,5 +32,5 @@ | |||
32 | -A OUTPUT -d 172.16.0.0/12 -j DROP | 32 | -A OUTPUT -d 172.16.0.0/12 -j DROP |
33 | 33 | ||
34 | # drop multicast traffic | 34 | # drop multicast traffic |
35 | -A OUTPUT -d 244.0.0.0/4 -j DROP | 35 | -A OUTPUT -d 224.0.0.0/4 -j DROP |
36 | COMMIT | 36 | COMMIT |
diff --git a/etc/tcpserver.net b/etc/net/tcpserver.net index 9c39ee5fb..9c39ee5fb 100644 --- a/etc/tcpserver.net +++ b/etc/net/tcpserver.net | |||
diff --git a/etc/webserver.net b/etc/net/webserver.net index 83db76825..83db76825 100644 --- a/etc/webserver.net +++ b/etc/net/webserver.net | |||
diff --git a/etc/pcmanfm.profile b/etc/pcmanfm.profile deleted file mode 100644 index 7f2a0d673..000000000 --- a/etc/pcmanfm.profile +++ /dev/null | |||
@@ -1,33 +0,0 @@ | |||
1 | # Firejail profile for pcmanfm | ||
2 | # Description: Extremely fast and lightweight file manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include pcmanfm.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/Trash | ||
10 | # noblacklist ${HOME}/.config/libfm - disable-programs.inc is disabled, see below | ||
11 | # noblacklist ${HOME}/.config/pcmanfm | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | # include disable-programs.inc | ||
18 | |||
19 | allusers | ||
20 | caps.drop all | ||
21 | # net none - see issue #1467, computer:/// location broken | ||
22 | no3d | ||
23 | # nodbus | ||
24 | nodvd | ||
25 | nonewprivs | ||
26 | noroot | ||
27 | nosound | ||
28 | notv | ||
29 | novideo | ||
30 | protocol unix | ||
31 | seccomp | ||
32 | shell none | ||
33 | tracelog | ||
diff --git a/etc/0ad.profile b/etc/profile-a-l/0ad.profile index 8b5820d5e..6869ea631 100644 --- a/etc/0ad.profile +++ b/etc/profile-a-l/0ad.profile | |||
@@ -24,13 +24,13 @@ whitelist ${HOME}/.cache/0ad | |||
24 | whitelist ${HOME}/.config/0ad | 24 | whitelist ${HOME}/.config/0ad |
25 | whitelist ${HOME}/.local/share/0ad | 25 | whitelist ${HOME}/.local/share/0ad |
26 | whitelist /usr/share/0ad | 26 | whitelist /usr/share/0ad |
27 | whitelist /usr/share/games | ||
27 | include whitelist-common.inc | 28 | include whitelist-common.inc |
28 | include whitelist-usr-share-common.inc | 29 | include whitelist-usr-share-common.inc |
29 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
30 | 31 | ||
31 | caps.drop all | 32 | caps.drop all |
32 | netfilter | 33 | netfilter |
33 | nodbus | ||
34 | nodvd | 34 | nodvd |
35 | nogroups | 35 | nogroups |
36 | nonewprivs | 36 | nonewprivs |
@@ -45,6 +45,9 @@ tracelog | |||
45 | 45 | ||
46 | disable-mnt | 46 | disable-mnt |
47 | private-bin 0ad,pyrogenesis,sh,which | 47 | private-bin 0ad,pyrogenesis,sh,which |
48 | private-cache | ||
48 | private-dev | 49 | private-dev |
49 | private-tmp | 50 | private-tmp |
50 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
diff --git a/etc/2048-qt.profile b/etc/profile-a-l/2048-qt.profile index 2347039a6..12268706a 100644 --- a/etc/2048-qt.profile +++ b/etc/profile-a-l/2048-qt.profile | |||
@@ -23,8 +23,9 @@ whitelist ${HOME}/.config/xiaoyong | |||
23 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
25 | 25 | ||
26 | apparmor | ||
26 | caps.drop all | 27 | caps.drop all |
27 | netfilter | 28 | net none |
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
diff --git a/etc/7z.profile b/etc/profile-a-l/7z.profile index b60bb9ee9..02a2e7ea0 100644 --- a/etc/7z.profile +++ b/etc/profile-a-l/7z.profile | |||
@@ -23,7 +23,6 @@ ipc-namespace | |||
23 | machine-id | 23 | machine-id |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | #nogroups | 27 | #nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -42,4 +41,7 @@ x11 none | |||
42 | private-cache | 41 | private-cache |
43 | private-dev | 42 | private-dev |
44 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
46 | |||
45 | memory-deny-write-execute | 47 | memory-deny-write-execute |
diff --git a/etc/7za.profile b/etc/profile-a-l/7za.profile index 9cd04cad1..9cd04cad1 100644 --- a/etc/7za.profile +++ b/etc/profile-a-l/7za.profile | |||
diff --git a/etc/7zr.profile b/etc/profile-a-l/7zr.profile index bd3842900..bd3842900 100644 --- a/etc/7zr.profile +++ b/etc/profile-a-l/7zr.profile | |||
diff --git a/etc/Builder.profile b/etc/profile-a-l/Builder.profile index 54b437441..54b437441 100644 --- a/etc/Builder.profile +++ b/etc/profile-a-l/Builder.profile | |||
diff --git a/etc/Cheese.profile b/etc/profile-a-l/Cheese.profile index 5bb5064f0..5bb5064f0 100644 --- a/etc/Cheese.profile +++ b/etc/profile-a-l/Cheese.profile | |||
diff --git a/etc/Cryptocat.profile b/etc/profile-a-l/Cryptocat.profile index e9cc07bd7..e9cc07bd7 100644 --- a/etc/Cryptocat.profile +++ b/etc/profile-a-l/Cryptocat.profile | |||
diff --git a/etc/Cyberfox.profile b/etc/profile-a-l/Cyberfox.profile index 26a4348c9..26a4348c9 100644 --- a/etc/Cyberfox.profile +++ b/etc/profile-a-l/Cyberfox.profile | |||
diff --git a/etc/Discord.profile b/etc/profile-a-l/Discord.profile index 3f274b21c..3f274b21c 100644 --- a/etc/Discord.profile +++ b/etc/profile-a-l/Discord.profile | |||
diff --git a/etc/DiscordCanary.profile b/etc/profile-a-l/DiscordCanary.profile index d24e73ed8..d24e73ed8 100644 --- a/etc/DiscordCanary.profile +++ b/etc/profile-a-l/DiscordCanary.profile | |||
diff --git a/etc/Documents.profile b/etc/profile-a-l/Documents.profile index 171ab4357..171ab4357 100644 --- a/etc/Documents.profile +++ b/etc/profile-a-l/Documents.profile | |||
diff --git a/etc/FossaMail.profile b/etc/profile-a-l/FossaMail.profile index 9e1f61421..9e1f61421 100644 --- a/etc/FossaMail.profile +++ b/etc/profile-a-l/FossaMail.profile | |||
diff --git a/etc/Fritzing.profile b/etc/profile-a-l/Fritzing.profile index d318da885..d318da885 100644 --- a/etc/Fritzing.profile +++ b/etc/profile-a-l/Fritzing.profile | |||
diff --git a/etc/Gitter.profile b/etc/profile-a-l/Gitter.profile index a8bcb6a54..a8bcb6a54 100644 --- a/etc/Gitter.profile +++ b/etc/profile-a-l/Gitter.profile | |||
diff --git a/etc/JDownloader.profile b/etc/profile-a-l/JDownloader.profile index 1435f3422..45ec71e63 100644 --- a/etc/JDownloader.profile +++ b/etc/profile-a-l/JDownloader.profile | |||
@@ -28,7 +28,6 @@ caps.drop all | |||
28 | ipc-namespace | 28 | ipc-namespace |
29 | netfilter | 29 | netfilter |
30 | no3d | 30 | no3d |
31 | nodbus | ||
32 | nodvd | 31 | nodvd |
33 | nogroups | 32 | nogroups |
34 | nonewprivs | 33 | nonewprivs |
@@ -45,3 +44,5 @@ private-cache | |||
45 | private-dev | 44 | private-dev |
46 | private-tmp | 45 | private-tmp |
47 | 46 | ||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/Logs.profile b/etc/profile-a-l/Logs.profile index 431439f17..431439f17 100644 --- a/etc/Logs.profile +++ b/etc/profile-a-l/Logs.profile | |||
diff --git a/etc/profile-a-l/abiword.profile b/etc/profile-a-l/abiword.profile new file mode 100644 index 000000000..1fdc9e9fe --- /dev/null +++ b/etc/profile-a-l/abiword.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for abiword | ||
2 | # Description: flexible cross-platform word processor | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include abiword.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/abiword | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | |||
19 | whitelist /usr/share/abiword-3.0 | ||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-runuser-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | machine-id | ||
27 | net none | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | private-bin abiword | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc fonts,gtk-3.0,passwd | ||
46 | private-tmp | ||
47 | |||
48 | # dbus-user none | ||
49 | # dbus-system none | ||
diff --git a/etc/abrowser.profile b/etc/profile-a-l/abrowser.profile index 2e6e8f1af..2e6e8f1af 100644 --- a/etc/abrowser.profile +++ b/etc/profile-a-l/abrowser.profile | |||
diff --git a/etc/acat.profile b/etc/profile-a-l/acat.profile index 522d8db4e..522d8db4e 100644 --- a/etc/acat.profile +++ b/etc/profile-a-l/acat.profile | |||
diff --git a/etc/adiff.profile b/etc/profile-a-l/adiff.profile index a80886d56..a80886d56 100644 --- a/etc/adiff.profile +++ b/etc/profile-a-l/adiff.profile | |||
diff --git a/etc/akonadi_control.profile b/etc/profile-a-l/akonadi_control.profile index ffc613f1e..4ab1967a6 100644 --- a/etc/akonadi_control.profile +++ b/etc/profile-a-l/akonadi_control.profile | |||
@@ -47,7 +47,7 @@ notv | |||
47 | nou2f | 47 | nou2f |
48 | novideo | 48 | novideo |
49 | # protocol unix,inet,inet6,netlink | 49 | # protocol unix,inet,inet6,netlink |
50 | # seccomp !io_getevents,!io_setup,!io_submit,!ioprio_set | 50 | # seccomp !io_destroy,!io_getevents,!io_setup,!io_submit,!ioprio_set |
51 | tracelog | 51 | tracelog |
52 | 52 | ||
53 | private-dev | 53 | private-dev |
diff --git a/etc/akregator.profile b/etc/profile-a-l/akregator.profile index 34933f283..6a4d775e7 100644 --- a/etc/akregator.profile +++ b/etc/profile-a-l/akregator.profile | |||
@@ -8,6 +8,7 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.config/akregatorrc | 9 | noblacklist ${HOME}/.config/akregatorrc |
10 | noblacklist ${HOME}/.local/share/akregator | 10 | noblacklist ${HOME}/.local/share/akregator |
11 | noblacklist ${HOME}/.local/share/kxmlgui5/akregator | ||
11 | 12 | ||
12 | include disable-common.inc | 13 | include disable-common.inc |
13 | include disable-devel.inc | 14 | include disable-devel.inc |
@@ -15,12 +16,15 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
18 | 20 | ||
19 | mkfile ${HOME}/.config/akregatorrc | 21 | mkfile ${HOME}/.config/akregatorrc |
20 | mkdir ${HOME}/.local/share/akregator | 22 | mkdir ${HOME}/.local/share/akregator |
23 | mkdir ${HOME}/.local/share/kxmlgui5/akregator | ||
21 | whitelist ${HOME}/.config/akregatorrc | 24 | whitelist ${HOME}/.config/akregatorrc |
22 | whitelist ${HOME}/.local/share/akregator | 25 | whitelist ${HOME}/.local/share/akregator |
23 | whitelist ${HOME}/.local/share/kssl | 26 | whitelist ${HOME}/.local/share/kssl |
27 | whitelist ${HOME}/.local/share/kxmlgui5/akregator | ||
24 | include whitelist-common.inc | 28 | include whitelist-common.inc |
25 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
26 | 30 | ||
diff --git a/etc/als.profile b/etc/profile-a-l/als.profile index 5eae228b6..5eae228b6 100644 --- a/etc/als.profile +++ b/etc/profile-a-l/als.profile | |||
diff --git a/etc/amarok.profile b/etc/profile-a-l/amarok.profile index 0b974e9ac..0b974e9ac 100644 --- a/etc/amarok.profile +++ b/etc/profile-a-l/amarok.profile | |||
diff --git a/etc/amule.profile b/etc/profile-a-l/amule.profile index feb4a5e7e..feb4a5e7e 100644 --- a/etc/amule.profile +++ b/etc/profile-a-l/amule.profile | |||
diff --git a/etc/amuled.profile b/etc/profile-a-l/amuled.profile index 58b796875..58b796875 100644 --- a/etc/amuled.profile +++ b/etc/profile-a-l/amuled.profile | |||
diff --git a/etc/android-studio.profile b/etc/profile-a-l/android-studio.profile index 2e4e564dd..2e4e564dd 100644 --- a/etc/android-studio.profile +++ b/etc/profile-a-l/android-studio.profile | |||
diff --git a/etc/anki.profile b/etc/profile-a-l/anki.profile index a0a79ef48..61e5f2eea 100644 --- a/etc/anki.profile +++ b/etc/profile-a-l/anki.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | mkdir ${HOME}/.local/share/Anki2 | 25 | mkdir ${HOME}/.local/share/Anki2 |
@@ -32,7 +33,6 @@ caps.drop all | |||
32 | machine-id | 33 | machine-id |
33 | netfilter | 34 | netfilter |
34 | no3d | 35 | no3d |
35 | nodbus | ||
36 | nodvd | 36 | nodvd |
37 | nogroups | 37 | nogroups |
38 | nonewprivs | 38 | nonewprivs |
@@ -53,3 +53,6 @@ private-cache | |||
53 | private-dev | 53 | private-dev |
54 | private-etc alternatives,ca-certificates,fonts,gtk-2.0,hostname,hosts,machine-id,pki,resolv.conf,ssl,Trolltech.conf | 54 | private-etc alternatives,ca-certificates,fonts,gtk-2.0,hostname,hosts,machine-id,pki,resolv.conf,ssl,Trolltech.conf |
55 | private-tmp | 55 | private-tmp |
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/anydesk.profile b/etc/profile-a-l/anydesk.profile index 35b18bab4..c847a04dc 100644 --- a/etc/anydesk.profile +++ b/etc/profile-a-l/anydesk.profile | |||
@@ -9,9 +9,10 @@ noblacklist ${HOME}/.anydesk | |||
9 | 9 | ||
10 | include disable-common.inc | 10 | include disable-common.inc |
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-interpreters.inc | ||
12 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
13 | include disable-programs.inc | 14 | include disable-programs.inc |
14 | include disable-interpreters.inc | 15 | include disable-shell.inc |
15 | 16 | ||
16 | mkdir ${HOME}/.anydesk | 17 | mkdir ${HOME}/.anydesk |
17 | whitelist ${HOME}/.anydesk | 18 | whitelist ${HOME}/.anydesk |
diff --git a/etc/aosp.profile b/etc/profile-a-l/aosp.profile index a5b1ba9f1..a5b1ba9f1 100644 --- a/etc/aosp.profile +++ b/etc/profile-a-l/aosp.profile | |||
diff --git a/etc/apack.profile b/etc/profile-a-l/apack.profile index 9fef911af..9fef911af 100644 --- a/etc/apack.profile +++ b/etc/profile-a-l/apack.profile | |||
diff --git a/etc/apktool.profile b/etc/profile-a-l/apktool.profile index aeeb845ea..39c5da9ab 100644 --- a/etc/apktool.profile +++ b/etc/profile-a-l/apktool.profile | |||
@@ -18,7 +18,6 @@ include whitelist-var-common.inc | |||
18 | caps.drop all | 18 | caps.drop all |
19 | net none | 19 | net none |
20 | no3d | 20 | no3d |
21 | nodbus | ||
22 | nodvd | 21 | nodvd |
23 | nogroups | 22 | nogroups |
24 | nonewprivs | 23 | nonewprivs |
@@ -34,3 +33,6 @@ shell none | |||
34 | private-bin apktool,basename,bash,dirname,expr,java,sh | 33 | private-bin apktool,basename,bash,dirname,expr,java,sh |
35 | private-cache | 34 | private-cache |
36 | private-dev | 35 | private-dev |
36 | |||
37 | dbus-user none | ||
38 | dbus-system none | ||
diff --git a/etc/profile-a-l/apostrophe.profile b/etc/profile-a-l/apostrophe.profile new file mode 100644 index 000000000..9c0b92598 --- /dev/null +++ b/etc/profile-a-l/apostrophe.profile | |||
@@ -0,0 +1,58 @@ | |||
1 | # Firejail profile for apostrophe | ||
2 | # Description: Distraction free Markdown editor for GNU/Linux made with GTK+ | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include apostrophe.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${DOCUMENTS} | ||
10 | noblacklist ${PICTURES} | ||
11 | |||
12 | # Allow python (blacklisted by disable-interpreters.inc) | ||
13 | include allow-python3.inc | ||
14 | |||
15 | include disable-common.inc | ||
16 | include disable-devel.inc | ||
17 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | ||
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | ||
21 | include disable-shell.inc | ||
22 | include disable-xdg.inc | ||
23 | |||
24 | whitelist /usr/share/apostrophe | ||
25 | whitelist /usr/share/pandoc-* | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | machine-id | ||
33 | net none | ||
34 | no3d | ||
35 | nodvd | ||
36 | nogroups | ||
37 | nonewprivs | ||
38 | noroot | ||
39 | nosound | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix | ||
44 | seccomp | ||
45 | shell none | ||
46 | tracelog | ||
47 | |||
48 | disable-mnt | ||
49 | private-bin apostrophe,pandoc,python3* | ||
50 | private-cache | ||
51 | private-dev | ||
52 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11 | ||
53 | private-tmp | ||
54 | |||
55 | dbus-user filter | ||
56 | dbus-user.own org.gnome.gitlab.somas.Apostrophe | ||
57 | dbus-user.talk ca.desrt.dconf | ||
58 | dbus-system none | ||
diff --git a/etc/ar.profile b/etc/profile-a-l/ar.profile index e28370450..183587ff8 100644 --- a/etc/ar.profile +++ b/etc/profile-a-l/ar.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | apparmor | 20 | apparmor |
20 | caps.drop all | 21 | caps.drop all |
@@ -23,7 +24,6 @@ ipc-namespace | |||
23 | machine-id | 24 | machine-id |
24 | net none | 25 | net none |
25 | no3d | 26 | no3d |
26 | nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -42,4 +42,7 @@ private-bin ar | |||
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | 44 | ||
45 | dbus-user none | ||
46 | dbus-system none | ||
47 | |||
45 | memory-deny-write-execute | 48 | memory-deny-write-execute |
diff --git a/etc/arch-audit.profile b/etc/profile-a-l/arch-audit.profile index 0a87ec297..934b89404 100644 --- a/etc/arch-audit.profile +++ b/etc/profile-a-l/arch-audit.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | whitelist /usr/share/arch-audit | 21 | whitelist /usr/share/arch-audit |
@@ -26,7 +27,6 @@ ipc-namespace | |||
26 | machine-id | 27 | machine-id |
27 | netfilter | 28 | netfilter |
28 | no3d | 29 | no3d |
29 | nodbus | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -46,4 +46,7 @@ private-cache | |||
46 | private-dev | 46 | private-dev |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
49 | memory-deny-write-execute | 52 | memory-deny-write-execute |
diff --git a/etc/archaudit-report.profile b/etc/profile-a-l/archaudit-report.profile index 19c37f90e..19c37f90e 100644 --- a/etc/archaudit-report.profile +++ b/etc/profile-a-l/archaudit-report.profile | |||
diff --git a/etc/ardour4.profile b/etc/profile-a-l/ardour4.profile index 4ad8dd456..4ad8dd456 100644 --- a/etc/ardour4.profile +++ b/etc/profile-a-l/ardour4.profile | |||
diff --git a/etc/ardour5.profile b/etc/profile-a-l/ardour5.profile index 5ebeafa76..a27cb4f6e 100644 --- a/etc/ardour5.profile +++ b/etc/profile-a-l/ardour5.profile | |||
@@ -23,7 +23,6 @@ include disable-xdg.inc | |||
23 | caps.drop all | 23 | caps.drop all |
24 | ipc-namespace | 24 | ipc-namespace |
25 | net none | 25 | net none |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -40,3 +39,5 @@ private-dev | |||
40 | #private-etc alternatives,ardour4,ardour5,asound.conf,fonts,machine-id,pulse,X11 | 39 | #private-etc alternatives,ardour4,ardour5,asound.conf,fonts,machine-id,pulse,X11 |
41 | private-tmp | 40 | private-tmp |
42 | 41 | ||
42 | dbus-user none | ||
43 | dbus-system none | ||
diff --git a/etc/arduino.profile b/etc/profile-a-l/arduino.profile index fd1ca9a09..fd1ca9a09 100644 --- a/etc/arduino.profile +++ b/etc/profile-a-l/arduino.profile | |||
diff --git a/etc/arepack.profile b/etc/profile-a-l/arepack.profile index 012f2f049..012f2f049 100644 --- a/etc/arepack.profile +++ b/etc/profile-a-l/arepack.profile | |||
diff --git a/etc/aria2c.profile b/etc/profile-a-l/aria2c.profile index a52a26d6f..d2dcaace1 100644 --- a/etc/aria2c.profile +++ b/etc/profile-a-l/aria2c.profile | |||
@@ -27,7 +27,6 @@ caps.drop all | |||
27 | ipc-namespace | 27 | ipc-namespace |
28 | netfilter | 28 | netfilter |
29 | no3d | 29 | no3d |
30 | nodbus | ||
31 | nodvd | 30 | nodvd |
32 | nogroups | 31 | nogroups |
33 | nonewprivs | 32 | nonewprivs |
@@ -50,4 +49,7 @@ private-etc alternatives,ca-certificates,crypto-policies,groups,login.defs,machi | |||
50 | private-lib libreadline.so.* | 49 | private-lib libreadline.so.* |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
53 | memory-deny-write-execute | 55 | memory-deny-write-execute |
diff --git a/etc/ark.profile b/etc/profile-a-l/ark.profile index 2fe546b55..4b81b2717 100644 --- a/etc/ark.profile +++ b/etc/profile-a-l/ark.profile | |||
@@ -7,6 +7,7 @@ include ark.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.config/arkrc | 9 | noblacklist ${HOME}/.config/arkrc |
10 | noblacklist ${HOME}/.local/share/kxmlgui5/ark | ||
10 | 11 | ||
11 | include disable-common.inc | 12 | include disable-common.inc |
12 | include disable-devel.inc | 13 | include disable-devel.inc |
@@ -23,7 +24,6 @@ apparmor | |||
23 | caps.drop all | 24 | caps.drop all |
24 | # net none | 25 | # net none |
25 | netfilter | 26 | netfilter |
26 | # nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -42,3 +42,5 @@ private-bin 7z,ark,bash,lrzip,lsar,lz4,lzop,p7zip,rar,sh,tclsh,unar,unrar,unzip, | |||
42 | private-dev | 42 | private-dev |
43 | private-tmp | 43 | private-tmp |
44 | 44 | ||
45 | # dbus-user none | ||
46 | # dbus-system none | ||
diff --git a/etc/arm.profile b/etc/profile-a-l/arm.profile index 51dad94d1..51dad94d1 100644 --- a/etc/arm.profile +++ b/etc/profile-a-l/arm.profile | |||
diff --git a/etc/artha.profile b/etc/profile-a-l/artha.profile index aaaede7ee..adb33fae1 100644 --- a/etc/artha.profile +++ b/etc/profile-a-l/artha.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | # whitelisting in ${HOME} makes settings immutable, see #3112 | 25 | # whitelisting in ${HOME} makes settings immutable, see #3112 |
@@ -38,7 +39,6 @@ caps.drop all | |||
38 | ipc-namespace | 39 | ipc-namespace |
39 | # net none - breaks on Ubuntu | 40 | # net none - breaks on Ubuntu |
40 | no3d | 41 | no3d |
41 | # nodbus | ||
42 | nodvd | 42 | nodvd |
43 | nogroups | 43 | nogroups |
44 | nonewprivs | 44 | nonewprivs |
@@ -60,4 +60,7 @@ private-etc alternatives,fonts,machine-id | |||
60 | private-lib libnotify.so.* | 60 | private-lib libnotify.so.* |
61 | private-tmp | 61 | private-tmp |
62 | 62 | ||
63 | # dbus-user none | ||
64 | # dbus-system none | ||
65 | |||
63 | memory-deny-write-execute | 66 | memory-deny-write-execute |
diff --git a/etc/assogiate.profile b/etc/profile-a-l/assogiate.profile index 542b3da8d..2686839ef 100644 --- a/etc/assogiate.profile +++ b/etc/profile-a-l/assogiate.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | whitelist ${PICTURES} | 20 | whitelist ${PICTURES} |
@@ -26,7 +27,6 @@ caps.drop all | |||
26 | machine-id | 27 | machine-id |
27 | net none | 28 | net none |
28 | no3d | 29 | no3d |
29 | nodbus | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -47,4 +47,7 @@ private-dev | |||
47 | private-lib gnome-vfs-2.0,libacl.so.*,libattr.so.*,libfam.so.* | 47 | private-lib gnome-vfs-2.0,libacl.so.*,libattr.so.*,libfam.so.* |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
50 | memory-deny-write-execute | 53 | memory-deny-write-execute |
diff --git a/etc/asunder.profile b/etc/profile-a-l/asunder.profile index 1f3acd735..33dd4103f 100644 --- a/etc/asunder.profile +++ b/etc/profile-a-l/asunder.profile | |||
@@ -20,23 +20,29 @@ include disable-passwdmgr.inc | |||
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-xdg.inc | 21 | include disable-xdg.inc |
22 | 22 | ||
23 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
24 | 25 | ||
25 | apparmor | 26 | apparmor |
26 | caps.drop all | 27 | caps.drop all |
27 | netfilter | 28 | netfilter |
28 | nodbus | 29 | no3d |
29 | # nogroups | 30 | # nogroups |
30 | nonewprivs | 31 | nonewprivs |
31 | noroot | 32 | noroot |
32 | nou2f | 33 | nou2f |
34 | notv | ||
33 | novideo | 35 | novideo |
34 | protocol unix,inet,inet6 | 36 | protocol unix,inet,inet6 |
35 | seccomp | 37 | seccomp |
36 | shell none | 38 | shell none |
37 | 39 | ||
40 | private-cache | ||
38 | private-dev | 41 | private-dev |
39 | private-tmp | 42 | private-tmp |
40 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
46 | |||
41 | # mdwe is disabled due to breaking hardware accelerated decoding | 47 | # mdwe is disabled due to breaking hardware accelerated decoding |
42 | # memory-deny-write-execute | 48 | # memory-deny-write-execute |
diff --git a/etc/atom-beta.profile b/etc/profile-a-l/atom-beta.profile index c0ee2c492..c0ee2c492 100644 --- a/etc/atom-beta.profile +++ b/etc/profile-a-l/atom-beta.profile | |||
diff --git a/etc/atom.profile b/etc/profile-a-l/atom.profile index b9cb49d08..cf0a5a42b 100644 --- a/etc/atom.profile +++ b/etc/profile-a-l/atom.profile | |||
@@ -17,22 +17,20 @@ include disable-exec.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | caps.drop all | 20 | caps.keep sys_admin,sys_chroot |
21 | # net none | 21 | # net none |
22 | netfilter | 22 | netfilter |
23 | nodbus | ||
24 | nodvd | 23 | nodvd |
25 | nogroups | 24 | nogroups |
26 | nonewprivs | ||
27 | noroot | ||
28 | nosound | 25 | nosound |
29 | notv | 26 | notv |
30 | nou2f | 27 | nou2f |
31 | novideo | 28 | novideo |
32 | protocol unix,inet,inet6,netlink | ||
33 | seccomp | ||
34 | shell none | 29 | shell none |
35 | 30 | ||
36 | private-cache | 31 | private-cache |
37 | private-dev | 32 | private-dev |
38 | private-tmp | 33 | private-tmp |
34 | |||
35 | dbus-user none | ||
36 | dbus-system none | ||
diff --git a/etc/atool.profile b/etc/profile-a-l/atool.profile index 0250451fc..e501e956c 100644 --- a/etc/atool.profile +++ b/etc/profile-a-l/atool.profile | |||
@@ -25,10 +25,8 @@ hostname atool | |||
25 | ipc-namespace | 25 | ipc-namespace |
26 | machine-id | 26 | machine-id |
27 | net none | 27 | net none |
28 | netfilter | ||
29 | no3d | 28 | no3d |
30 | nodvd | 29 | nodvd |
31 | nodbus | ||
32 | nogroups | 30 | nogroups |
33 | nonewprivs | 31 | nonewprivs |
34 | noroot | 32 | noroot |
@@ -49,4 +47,7 @@ private-dev | |||
49 | private-etc alternatives,group,login.defs,passwd | 47 | private-etc alternatives,group,login.defs,passwd |
50 | private-tmp | 48 | private-tmp |
51 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
52 | memory-deny-write-execute | 53 | memory-deny-write-execute |
diff --git a/etc/atril-previewer.profile b/etc/profile-a-l/atril-previewer.profile index 7f4697357..7f4697357 100644 --- a/etc/atril-previewer.profile +++ b/etc/profile-a-l/atril-previewer.profile | |||
diff --git a/etc/atril-thumbnailer.profile b/etc/profile-a-l/atril-thumbnailer.profile index 8f6129ea6..8f6129ea6 100644 --- a/etc/atril-thumbnailer.profile +++ b/etc/profile-a-l/atril-thumbnailer.profile | |||
diff --git a/etc/atril.profile b/etc/profile-a-l/atril.profile index adca38cb5..adca38cb5 100644 --- a/etc/atril.profile +++ b/etc/profile-a-l/atril.profile | |||
diff --git a/etc/audacious.profile b/etc/profile-a-l/audacious.profile index 4d0c93047..2e1f6f32a 100644 --- a/etc/audacious.profile +++ b/etc/profile-a-l/audacious.profile | |||
@@ -23,7 +23,6 @@ include whitelist-var-common.inc | |||
23 | apparmor | 23 | apparmor |
24 | caps.drop all | 24 | caps.drop all |
25 | netfilter | 25 | netfilter |
26 | #nodbus - dbus needed for MPRIS | ||
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
29 | noroot | 28 | noroot |
@@ -40,4 +39,6 @@ private-cache | |||
40 | private-dev | 39 | private-dev |
41 | private-tmp | 40 | private-tmp |
42 | 41 | ||
43 | memory-deny-write-execute | 42 | # dbus needed for MPRIS |
43 | # dbus-user none | ||
44 | # dbus-system none | ||
diff --git a/etc/audacity.profile b/etc/profile-a-l/audacity.profile index 200d3a387..a11e59553 100644 --- a/etc/audacity.profile +++ b/etc/profile-a-l/audacity.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
@@ -24,7 +25,6 @@ apparmor | |||
24 | caps.drop all | 25 | caps.drop all |
25 | net none | 26 | net none |
26 | no3d | 27 | no3d |
27 | # nodbus - problems on Fedora 27 | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -41,4 +41,6 @@ private-bin audacity | |||
41 | private-dev | 41 | private-dev |
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
44 | memory-deny-write-execute | 44 | # problems on Fedora 27 |
45 | # dbus-user none | ||
46 | # dbus-system none | ||
diff --git a/etc/audio-recorder.profile b/etc/profile-a-l/audio-recorder.profile index b2ed3b030..b2ed3b030 100644 --- a/etc/audio-recorder.profile +++ b/etc/profile-a-l/audio-recorder.profile | |||
diff --git a/etc/aunpack.profile b/etc/profile-a-l/aunpack.profile index 6ce4aa491..6ce4aa491 100644 --- a/etc/aunpack.profile +++ b/etc/profile-a-l/aunpack.profile | |||
diff --git a/etc/authenticator.profile b/etc/profile-a-l/authenticator.profile index 4887299ec..131b20c70 100644 --- a/etc/authenticator.profile +++ b/etc/profile-a-l/authenticator.profile | |||
@@ -24,7 +24,6 @@ include disable-programs.inc | |||
24 | caps.drop all | 24 | caps.drop all |
25 | netfilter | 25 | netfilter |
26 | no3d | 26 | no3d |
27 | # nodbus - makes settings immutable | ||
28 | nodvd | 27 | nodvd |
29 | nogroups | 28 | nogroups |
30 | nonewprivs | 29 | nonewprivs |
@@ -43,4 +42,8 @@ private-dev | |||
43 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,pki,resolv.conf,ssl | 42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,pki,resolv.conf,ssl |
44 | private-tmp | 43 | private-tmp |
45 | 44 | ||
45 | # makes settings immutable | ||
46 | # dbus-user none | ||
47 | # dbus-system none | ||
48 | |||
46 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 49 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/autokey-common.profile b/etc/profile-a-l/autokey-common.profile index b1a77c0a4..b1a77c0a4 100644 --- a/etc/autokey-common.profile +++ b/etc/profile-a-l/autokey-common.profile | |||
diff --git a/etc/autokey-gtk.profile b/etc/profile-a-l/autokey-gtk.profile index e16449064..e16449064 100644 --- a/etc/autokey-gtk.profile +++ b/etc/profile-a-l/autokey-gtk.profile | |||
diff --git a/etc/autokey-qt.profile b/etc/profile-a-l/autokey-qt.profile index b6f1210dd..b6f1210dd 100644 --- a/etc/autokey-qt.profile +++ b/etc/profile-a-l/autokey-qt.profile | |||
diff --git a/etc/autokey-run.profile b/etc/profile-a-l/autokey-run.profile index 05669351a..05669351a 100644 --- a/etc/autokey-run.profile +++ b/etc/profile-a-l/autokey-run.profile | |||
diff --git a/etc/autokey-shell.profile b/etc/profile-a-l/autokey-shell.profile index dfbd8759f..dfbd8759f 100644 --- a/etc/autokey-shell.profile +++ b/etc/profile-a-l/autokey-shell.profile | |||
diff --git a/etc/aweather.profile b/etc/profile-a-l/aweather.profile index d7228570f..44c3110a0 100644 --- a/etc/aweather.profile +++ b/etc/profile-a-l/aweather.profile | |||
@@ -13,6 +13,7 @@ include disable-devel.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | 17 | ||
17 | mkdir ${HOME}/.config/aweather | 18 | mkdir ${HOME}/.config/aweather |
18 | whitelist ${HOME}/.config/aweather | 19 | whitelist ${HOME}/.config/aweather |
diff --git a/etc/awesome.profile b/etc/profile-a-l/awesome.profile index 5d1bf5071..5d1bf5071 100644 --- a/etc/awesome.profile +++ b/etc/profile-a-l/awesome.profile | |||
diff --git a/etc/baloo_file.profile b/etc/profile-a-l/baloo_file.profile index 785e37a16..785e37a16 100644 --- a/etc/baloo_file.profile +++ b/etc/profile-a-l/baloo_file.profile | |||
diff --git a/etc/baloo_filemetadata_temp_extractor.profile b/etc/profile-a-l/baloo_filemetadata_temp_extractor.profile index ff10e9965..ff10e9965 100644 --- a/etc/baloo_filemetadata_temp_extractor.profile +++ b/etc/profile-a-l/baloo_filemetadata_temp_extractor.profile | |||
diff --git a/etc/baobab.profile b/etc/profile-a-l/baobab.profile index 18c862a4d..3937e1966 100644 --- a/etc/baobab.profile +++ b/etc/profile-a-l/baobab.profile | |||
@@ -12,12 +12,14 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | # include disable-programs.inc | 14 | # include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | # include disable-xdg.inc | 16 | # include disable-xdg.inc |
16 | 17 | ||
18 | include whitelist-runuser-common.inc | ||
19 | |||
17 | caps.drop all | 20 | caps.drop all |
18 | net none | 21 | net none |
19 | no3d | 22 | no3d |
20 | #nodbus | ||
21 | nodvd | 23 | nodvd |
22 | nogroups | 24 | nogroups |
23 | nonewprivs | 25 | nonewprivs |
@@ -29,9 +31,13 @@ novideo | |||
29 | protocol unix | 31 | protocol unix |
30 | seccomp | 32 | seccomp |
31 | shell none | 33 | shell none |
34 | tracelog | ||
32 | 35 | ||
33 | private-bin baobab | 36 | private-bin baobab |
34 | private-dev | 37 | private-dev |
35 | private-tmp | 38 | private-tmp |
36 | 39 | ||
40 | # dbus-user none | ||
41 | # dbus-system none | ||
42 | |||
37 | read-only ${HOME} | 43 | read-only ${HOME} |
diff --git a/etc/barrier.profile b/etc/profile-a-l/barrier.profile index f5da3782e..f5da3782e 100644 --- a/etc/barrier.profile +++ b/etc/profile-a-l/barrier.profile | |||
diff --git a/etc/basilisk.profile b/etc/profile-a-l/basilisk.profile index 8dc3847a0..8dc3847a0 100644 --- a/etc/basilisk.profile +++ b/etc/profile-a-l/basilisk.profile | |||
diff --git a/etc/beaker.profile b/etc/profile-a-l/beaker.profile index cc1886a49..cc1886a49 100644 --- a/etc/beaker.profile +++ b/etc/profile-a-l/beaker.profile | |||
diff --git a/etc/bibletime.profile b/etc/profile-a-l/bibletime.profile index b76bc8367..99e2802eb 100644 --- a/etc/bibletime.profile +++ b/etc/profile-a-l/bibletime.profile | |||
@@ -35,7 +35,6 @@ apparmor | |||
35 | caps.drop all | 35 | caps.drop all |
36 | machine-id | 36 | machine-id |
37 | netfilter | 37 | netfilter |
38 | nodbus | ||
39 | nodvd | 38 | nodvd |
40 | nogroups | 39 | nogroups |
41 | nonewprivs | 40 | nonewprivs |
@@ -54,3 +53,6 @@ private-cache | |||
54 | private-dev | 53 | private-dev |
55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,login.defs,machine-id,passwd,pki,resolv.conf,ssl,sword,sword.conf | 54 | private-etc alternatives,ca-certificates,crypto-policies,fonts,login.defs,machine-id,passwd,pki,resolv.conf,ssl,sword,sword.conf |
56 | private-tmp | 55 | private-tmp |
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/bibtex.profile b/etc/profile-a-l/bibtex.profile index e868dcbab..e868dcbab 100644 --- a/etc/bibtex.profile +++ b/etc/profile-a-l/bibtex.profile | |||
diff --git a/etc/profile-a-l/bijiben.profile b/etc/profile-a-l/bijiben.profile new file mode 100644 index 000000000..c1c338536 --- /dev/null +++ b/etc/profile-a-l/bijiben.profile | |||
@@ -0,0 +1,58 @@ | |||
1 | # Firejail profile for bijiben | ||
2 | # Description: Simple Note Viewer | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include bijiben.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/bijiben | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.local/share/bijiben | ||
21 | whitelist ${HOME}/.local/share/bijiben | ||
22 | whitelist ${HOME}/.cache/tracker | ||
23 | whitelist /usr/share/bijiben | ||
24 | whitelist /usr/share/tracker | ||
25 | include whitelist-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | machine-id | ||
33 | net none | ||
34 | nodvd | ||
35 | nogroups | ||
36 | nonewprivs | ||
37 | noroot | ||
38 | nosound | ||
39 | notv | ||
40 | nou2f | ||
41 | novideo | ||
42 | protocol unix | ||
43 | seccomp | ||
44 | shell none | ||
45 | tracelog | ||
46 | |||
47 | disable-mnt | ||
48 | private-bin bijiben | ||
49 | # private-cache -- access to .cache/tracker is required | ||
50 | private-dev | ||
51 | private-etc dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload | ||
52 | private-tmp | ||
53 | |||
54 | dbus-user filter | ||
55 | dbus-user.own org.gnome.Notes | ||
56 | dbus-user.talk ca.desrt.dconf | ||
57 | dbus-user.talk org.freedesktop.Tracker1 | ||
58 | dbus-system none | ||
diff --git a/etc/bitcoin-qt.profile b/etc/profile-a-l/bitcoin-qt.profile index ac1e21ba7..3a3f2b62c 100644 --- a/etc/bitcoin-qt.profile +++ b/etc/profile-a-l/bitcoin-qt.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | mkdir ${HOME}/.bitcoin | 20 | mkdir ${HOME}/.bitcoin |
20 | mkdir ${HOME}/.config/Bitcoin | 21 | mkdir ${HOME}/.config/Bitcoin |
diff --git a/etc/bitlbee.profile b/etc/profile-a-l/bitlbee.profile index 62eeb88f3..62eeb88f3 100644 --- a/etc/bitlbee.profile +++ b/etc/profile-a-l/bitlbee.profile | |||
diff --git a/etc/bitwarden.profile b/etc/profile-a-l/bitwarden.profile index a5538bacc..41f8e51fd 100644 --- a/etc/bitwarden.profile +++ b/etc/profile-a-l/bitwarden.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | mkdir ${HOME}/.config/Bitwarden | 22 | mkdir ${HOME}/.config/Bitwarden |
@@ -29,7 +30,6 @@ caps.drop all | |||
29 | machine-id | 30 | machine-id |
30 | netfilter | 31 | netfilter |
31 | no3d | 32 | no3d |
32 | #nodbus - breaks appindicator (tray) functionality | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -39,7 +39,7 @@ notv | |||
39 | nou2f | 39 | nou2f |
40 | novideo | 40 | novideo |
41 | protocol unix,inet,inet6,netlink | 41 | protocol unix,inet,inet6,netlink |
42 | seccomp | 42 | seccomp !chroot |
43 | shell none | 43 | shell none |
44 | #tracelog - breaks on Arch | 44 | #tracelog - breaks on Arch |
45 | 45 | ||
@@ -51,4 +51,8 @@ private-etc alternatives,ca-certificates,crypto-policies,fonts,hosts,nsswitch.co | |||
51 | private-opt Bitwarden | 51 | private-opt Bitwarden |
52 | private-tmp | 52 | private-tmp |
53 | 53 | ||
54 | # breaks appindicator (tray) functionality | ||
55 | # dbus-user none | ||
56 | # dbus-system none | ||
57 | |||
54 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 58 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/blackbox.profile b/etc/profile-a-l/blackbox.profile index 13e83493d..13e83493d 100644 --- a/etc/blackbox.profile +++ b/etc/profile-a-l/blackbox.profile | |||
diff --git a/etc/bleachbit.profile b/etc/profile-a-l/bleachbit.profile index 47c0cfa48..8f230a413 100644 --- a/etc/bleachbit.profile +++ b/etc/profile-a-l/bleachbit.profile | |||
@@ -20,7 +20,6 @@ include disable-passwdmgr.inc | |||
20 | caps.drop all | 20 | caps.drop all |
21 | net none | 21 | net none |
22 | no3d | 22 | no3d |
23 | nodbus | ||
24 | nodvd | 23 | nodvd |
25 | nogroups | 24 | nogroups |
26 | nonewprivs | 25 | nonewprivs |
@@ -36,5 +35,8 @@ shell none | |||
36 | private-dev | 35 | private-dev |
37 | # private-tmp | 36 | # private-tmp |
38 | 37 | ||
38 | dbus-user none | ||
39 | dbus-system none | ||
40 | |||
39 | # memory-deny-write-execute breaks some systems, see issue #1850 | 41 | # memory-deny-write-execute breaks some systems, see issue #1850 |
40 | # memory-deny-write-execute | 42 | # memory-deny-write-execute |
diff --git a/etc/blender-2.8.profile b/etc/profile-a-l/blender-2.8.profile index b7242c443..b7242c443 100644 --- a/etc/blender-2.8.profile +++ b/etc/profile-a-l/blender-2.8.profile | |||
diff --git a/etc/blender.profile b/etc/profile-a-l/blender.profile index 6a72fb602..0f80f0a63 100644 --- a/etc/blender.profile +++ b/etc/profile-a-l/blender.profile | |||
@@ -33,9 +33,8 @@ noroot | |||
33 | notv | 33 | notv |
34 | nou2f | 34 | nou2f |
35 | protocol unix,inet,inet6,netlink | 35 | protocol unix,inet,inet6,netlink |
36 | seccomp | 36 | # numpy, used by many add-ons, requires the mbind syscall |
37 | seccomp !mbind | ||
37 | shell none | 38 | shell none |
38 | 39 | ||
39 | private-dev | 40 | private-dev |
40 | private-tmp | ||
41 | |||
diff --git a/etc/bless.profile b/etc/profile-a-l/bless.profile index 35235962e..216e86109 100644 --- a/etc/bless.profile +++ b/etc/profile-a-l/bless.profile | |||
@@ -20,7 +20,6 @@ include whitelist-var-common.inc | |||
20 | caps.drop all | 20 | caps.drop all |
21 | net none | 21 | net none |
22 | no3d | 22 | no3d |
23 | nodbus | ||
24 | nodvd | 23 | nodvd |
25 | nogroups | 24 | nogroups |
26 | nonewprivs | 25 | nonewprivs |
@@ -39,3 +38,5 @@ private-dev | |||
39 | private-etc alternatives,fonts,mono | 38 | private-etc alternatives,fonts,mono |
40 | private-tmp | 39 | private-tmp |
41 | 40 | ||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/profile-a-l/blobwars.profile b/etc/profile-a-l/blobwars.profile new file mode 100644 index 000000000..d43a9d241 --- /dev/null +++ b/etc/profile-a-l/blobwars.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for blobwars | ||
2 | # Description: Mission and Objective based 2D Platform Game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include blobwars.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.parallelrealities/blobwars | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.parallelrealities/blobwars | ||
21 | whitelist ${HOME}/.parallelrealities/blobwars | ||
22 | whitelist /usr/share/blobwars | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix,netlink | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin blobwars | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc machine-id | ||
47 | private-tmp | ||
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/bluefish.profile b/etc/profile-a-l/bluefish.profile index 412088ba9..88ac9c0ed 100644 --- a/etc/bluefish.profile +++ b/etc/profile-a-l/bluefish.profile | |||
@@ -15,10 +15,10 @@ include disable-programs.inc | |||
15 | 15 | ||
16 | include whitelist-var-common.inc | 16 | include whitelist-var-common.inc |
17 | 17 | ||
18 | apparmor | ||
18 | caps.drop all | 19 | caps.drop all |
19 | net none | 20 | net none |
20 | no3d | 21 | no3d |
21 | nodbus | ||
22 | nodvd | 22 | nodvd |
23 | nogroups | 23 | nogroups |
24 | nonewprivs | 24 | nonewprivs |
@@ -36,3 +36,5 @@ private-bin bluefish | |||
36 | private-dev | 36 | private-dev |
37 | private-tmp | 37 | private-tmp |
38 | 38 | ||
39 | dbus-user none | ||
40 | dbus-system none | ||
diff --git a/etc/bnox.profile b/etc/profile-a-l/bnox.profile index 031f3f4bd..031f3f4bd 100644 --- a/etc/bnox.profile +++ b/etc/profile-a-l/bnox.profile | |||
diff --git a/etc/brackets.profile b/etc/profile-a-l/brackets.profile index 70f62813e..70f62813e 100644 --- a/etc/brackets.profile +++ b/etc/profile-a-l/brackets.profile | |||
diff --git a/etc/brasero.profile b/etc/profile-a-l/brasero.profile index 67fc07afb..417a6b3e0 100644 --- a/etc/brasero.profile +++ b/etc/profile-a-l/brasero.profile | |||
@@ -15,6 +15,9 @@ include disable-interpreters.inc | |||
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | 17 | ||
18 | include whitelist-var-common.inc | ||
19 | |||
20 | apparmor | ||
18 | caps.drop all | 21 | caps.drop all |
19 | net none | 22 | net none |
20 | nogroups | 23 | nogroups |
diff --git a/etc/brave-browser-beta.profile b/etc/profile-a-l/brave-browser-beta.profile index 528a6402d..528a6402d 100644 --- a/etc/brave-browser-beta.profile +++ b/etc/profile-a-l/brave-browser-beta.profile | |||
diff --git a/etc/brave-browser-dev.profile b/etc/profile-a-l/brave-browser-dev.profile index 4601de119..4601de119 100644 --- a/etc/brave-browser-dev.profile +++ b/etc/profile-a-l/brave-browser-dev.profile | |||
diff --git a/etc/brave-browser-nightly.profile b/etc/profile-a-l/brave-browser-nightly.profile index 43d3cc724..43d3cc724 100644 --- a/etc/brave-browser-nightly.profile +++ b/etc/profile-a-l/brave-browser-nightly.profile | |||
diff --git a/etc/brave-browser-stable.profile b/etc/profile-a-l/brave-browser-stable.profile index 06d33dea4..06d33dea4 100644 --- a/etc/brave-browser-stable.profile +++ b/etc/profile-a-l/brave-browser-stable.profile | |||
diff --git a/etc/brave-browser.profile b/etc/profile-a-l/brave-browser.profile index e223ecf87..e223ecf87 100644 --- a/etc/brave-browser.profile +++ b/etc/profile-a-l/brave-browser.profile | |||
diff --git a/etc/brave.profile b/etc/profile-a-l/brave.profile index 35c59f5a3..35c59f5a3 100644 --- a/etc/brave.profile +++ b/etc/profile-a-l/brave.profile | |||
diff --git a/etc/bsdcat.profile b/etc/profile-a-l/bsdcat.profile index 5271ee5d6..5271ee5d6 100644 --- a/etc/bsdcat.profile +++ b/etc/profile-a-l/bsdcat.profile | |||
diff --git a/etc/bsdcpio.profile b/etc/profile-a-l/bsdcpio.profile index 5271ee5d6..5271ee5d6 100644 --- a/etc/bsdcpio.profile +++ b/etc/profile-a-l/bsdcpio.profile | |||
diff --git a/etc/bsdtar.profile b/etc/profile-a-l/bsdtar.profile index 5ce9b6406..08e51f3c1 100644 --- a/etc/bsdtar.profile +++ b/etc/profile-a-l/bsdtar.profile | |||
@@ -22,7 +22,6 @@ ipc-namespace | |||
22 | machine-id | 22 | machine-id |
23 | net none | 23 | net none |
24 | no3d | 24 | no3d |
25 | nodbus | ||
26 | nodvd | 25 | nodvd |
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
@@ -43,4 +42,7 @@ private-cache | |||
43 | private-dev | 42 | private-dev |
44 | private-etc alternatives,group,localtime,passwd | 43 | private-etc alternatives,group,localtime,passwd |
45 | 44 | ||
45 | dbus-user none | ||
46 | dbus-system none | ||
47 | |||
46 | memory-deny-write-execute | 48 | memory-deny-write-execute |
diff --git a/etc/bunzip2.profile b/etc/profile-a-l/bunzip2.profile index 37b47c2ce..37b47c2ce 100644 --- a/etc/bunzip2.profile +++ b/etc/profile-a-l/bunzip2.profile | |||
diff --git a/etc/bzcat.profile b/etc/profile-a-l/bzcat.profile index edefb6bb8..edefb6bb8 100644 --- a/etc/bzcat.profile +++ b/etc/profile-a-l/bzcat.profile | |||
diff --git a/etc/bzflag.profile b/etc/profile-a-l/bzflag.profile index 86ab73e0b..f06bead1e 100644 --- a/etc/bzflag.profile +++ b/etc/profile-a-l/bzflag.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.bzf | 20 | mkdir ${HOME}/.bzf |
@@ -24,7 +25,6 @@ include whitelist-var-common.inc | |||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | netfilter | 27 | netfilter |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -42,3 +42,6 @@ private-bin bzadmin,bzflag,bzflag-wrapper,bzfs | |||
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/bzip2.profile b/etc/profile-a-l/bzip2.profile index 0756e0537..0756e0537 100644 --- a/etc/bzip2.profile +++ b/etc/profile-a-l/bzip2.profile | |||
diff --git a/etc/profile-a-l/caja.profile b/etc/profile-a-l/caja.profile new file mode 100644 index 000000000..1af102ca8 --- /dev/null +++ b/etc/profile-a-l/caja.profile | |||
@@ -0,0 +1,15 @@ | |||
1 | # Firejail profile for caja | ||
2 | # Description: File manager for the MATE desktop | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include caja.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Caja is started by systemd on most systems. Therefore it is not firejailed by default. Since there | ||
10 | # is already a caja process running on MATE desktops firejail will have no effect. | ||
11 | |||
12 | # Put 'ignore noroot' in your caja.local if you use MPV+Vulkan (see issue #3012) | ||
13 | |||
14 | # Redirect | ||
15 | include file-manager-common.profile | ||
diff --git a/etc/calibre.profile b/etc/profile-a-l/calibre.profile index ad6f0aa0d..d17cfa85f 100644 --- a/etc/calibre.profile +++ b/etc/profile-a-l/calibre.profile | |||
@@ -19,6 +19,7 @@ include disable-xdg.inc | |||
19 | 19 | ||
20 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
21 | 21 | ||
22 | apparmor | ||
22 | caps.drop all | 23 | caps.drop all |
23 | netfilter | 24 | netfilter |
24 | nodvd | 25 | nodvd |
diff --git a/etc/calligra.profile b/etc/profile-a-l/calligra.profile index 7054739c8..f4ce47018 100644 --- a/etc/calligra.profile +++ b/etc/profile-a-l/calligra.profile | |||
@@ -6,6 +6,8 @@ include calligra.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.local/share/kxmlgui5/calligra | ||
10 | |||
9 | include disable-common.inc | 11 | include disable-common.inc |
10 | include disable-devel.inc | 12 | include disable-devel.inc |
11 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
@@ -16,7 +18,6 @@ caps.drop all | |||
16 | ipc-namespace | 18 | ipc-namespace |
17 | # net none | 19 | # net none |
18 | netfilter | 20 | netfilter |
19 | # nodbus | ||
20 | nodvd | 21 | nodvd |
21 | nogroups | 22 | nogroups |
22 | nonewprivs | 23 | nonewprivs |
@@ -31,5 +32,8 @@ shell none | |||
31 | private-bin calligra,calligraauthor,calligraconverter,calligraflow,calligraplan,calligraplanwork,calligrasheets,calligrastage,calligrawords,dbus-launch,kbuildsycoca4,kdeinit4 | 32 | private-bin calligra,calligraauthor,calligraconverter,calligraflow,calligraplan,calligraplanwork,calligrasheets,calligrastage,calligrawords,dbus-launch,kbuildsycoca4,kdeinit4 |
32 | private-dev | 33 | private-dev |
33 | 34 | ||
35 | # dbus-user none | ||
36 | # dbus-system none | ||
37 | |||
34 | # noexec ${HOME} | 38 | # noexec ${HOME} |
35 | noexec /tmp | 39 | noexec /tmp |
diff --git a/etc/calligraauthor.profile b/etc/profile-a-l/calligraauthor.profile index 7804a3b97..7804a3b97 100644 --- a/etc/calligraauthor.profile +++ b/etc/profile-a-l/calligraauthor.profile | |||
diff --git a/etc/calligraconverter.profile b/etc/profile-a-l/calligraconverter.profile index 7804a3b97..7804a3b97 100644 --- a/etc/calligraconverter.profile +++ b/etc/profile-a-l/calligraconverter.profile | |||
diff --git a/etc/calligraflow.profile b/etc/profile-a-l/calligraflow.profile index 7804a3b97..7804a3b97 100644 --- a/etc/calligraflow.profile +++ b/etc/profile-a-l/calligraflow.profile | |||
diff --git a/etc/calligraplan.profile b/etc/profile-a-l/calligraplan.profile index 7804a3b97..23dd61175 100644 --- a/etc/calligraplan.profile +++ b/etc/profile-a-l/calligraplan.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for calligra | 1 | # Firejail profile alias for calligra |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | noblacklist ${HOME}/.local/share/kxmlgui5/calligraplan | ||
5 | |||
4 | # Redirect | 6 | # Redirect |
5 | include calligra.profile | 7 | include calligra.profile |
diff --git a/etc/calligraplanwork.profile b/etc/profile-a-l/calligraplanwork.profile index 7804a3b97..1c283a3cb 100644 --- a/etc/calligraplanwork.profile +++ b/etc/profile-a-l/calligraplanwork.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for calligra | 1 | # Firejail profile alias for calligra |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | noblacklist ${HOME}/.local/share/kxmlgui5/calligraplanwork | ||
5 | |||
4 | # Redirect | 6 | # Redirect |
5 | include calligra.profile | 7 | include calligra.profile |
diff --git a/etc/calligrasheets.profile b/etc/profile-a-l/calligrasheets.profile index 7804a3b97..8ef75be71 100644 --- a/etc/calligrasheets.profile +++ b/etc/profile-a-l/calligrasheets.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for calligra | 1 | # Firejail profile alias for calligra |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | noblacklist ${HOME}/.local/share/kxmlgui5/calligrasheets | ||
5 | |||
4 | # Redirect | 6 | # Redirect |
5 | include calligra.profile | 7 | include calligra.profile |
diff --git a/etc/calligrastage.profile b/etc/profile-a-l/calligrastage.profile index 7804a3b97..d5c960248 100644 --- a/etc/calligrastage.profile +++ b/etc/profile-a-l/calligrastage.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for calligra | 1 | # Firejail profile alias for calligra |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | noblacklist ${HOME}/.local/share/kxmlgui5/calligrastage | ||
5 | |||
4 | # Redirect | 6 | # Redirect |
5 | include calligra.profile | 7 | include calligra.profile |
diff --git a/etc/calligrawords.profile b/etc/profile-a-l/calligrawords.profile index 7804a3b97..5985b4250 100644 --- a/etc/calligrawords.profile +++ b/etc/profile-a-l/calligrawords.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for calligra | 1 | # Firejail profile alias for calligra |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | noblacklist ${HOME}/.local/share/kxmlgui5/calligrawords | ||
5 | |||
4 | # Redirect | 6 | # Redirect |
5 | include calligra.profile | 7 | include calligra.profile |
diff --git a/etc/cameramonitor.profile b/etc/profile-a-l/cameramonitor.profile index 1d7aa0f9c..74c7cc34b 100644 --- a/etc/cameramonitor.profile +++ b/etc/profile-a-l/cameramonitor.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | whitelist /usr/share/cameramonitor | 23 | whitelist /usr/share/cameramonitor |
@@ -30,7 +31,6 @@ ipc-namespace | |||
30 | machine-id | 31 | machine-id |
31 | net none | 32 | net none |
32 | no3d | 33 | no3d |
33 | #nodbus | ||
34 | nodvd | 34 | nodvd |
35 | nogroups | 35 | nogroups |
36 | nonewprivs | 36 | nonewprivs |
@@ -50,4 +50,7 @@ private-cache | |||
50 | private-etc alternatives,fonts | 50 | private-etc alternatives,fonts |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | # dbus-user none | ||
54 | # dbus-system none | ||
55 | |||
53 | # memory-deny-write-execute - breaks on Arch | 56 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/cantata.profile b/etc/profile-a-l/cantata.profile index c44d56b90..294bb31b3 100644 --- a/etc/cantata.profile +++ b/etc/profile-a-l/cantata.profile | |||
@@ -20,6 +20,7 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 21 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-shell.inc | ||
23 | include disable-xdg.inc | 24 | include disable-xdg.inc |
24 | 25 | ||
25 | # apparmor | 26 | # apparmor |
diff --git a/etc/catfish.profile b/etc/profile-a-l/catfish.profile index c6c2d7e8a..009d3a049 100644 --- a/etc/catfish.profile +++ b/etc/profile-a-l/catfish.profile | |||
@@ -24,10 +24,10 @@ include disable-passwdmgr.inc | |||
24 | whitelist /var/lib/mlocate | 24 | whitelist /var/lib/mlocate |
25 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
26 | 26 | ||
27 | apparmor | ||
27 | caps.drop all | 28 | caps.drop all |
28 | net none | 29 | net none |
29 | no3d | 30 | no3d |
30 | nodbus | ||
31 | nodvd | 31 | nodvd |
32 | nogroups | 32 | nogroups |
33 | nonewprivs | 33 | nonewprivs |
@@ -45,3 +45,6 @@ tracelog | |||
45 | # private-bin bash,catfish,env,locate,ls,mlocate,python* | 45 | # private-bin bash,catfish,env,locate,ls,mlocate,python* |
46 | # private-dev | 46 | # private-dev |
47 | # private-tmp | 47 | # private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/profile-a-l/cawbird.profile b/etc/profile-a-l/cawbird.profile new file mode 100644 index 000000000..3d29c3817 --- /dev/null +++ b/etc/profile-a-l/cawbird.profile | |||
@@ -0,0 +1,46 @@ | |||
1 | # Firejail profile for cawbird | ||
2 | # Description: Open-source Twitter client for Linux | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include cawbird.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/cawbird | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | apparmor | ||
21 | caps.drop all | ||
22 | machine-id | ||
23 | netfilter | ||
24 | no3d | ||
25 | nodvd | ||
26 | nogroups | ||
27 | nonewprivs | ||
28 | noroot | ||
29 | nosound | ||
30 | notv | ||
31 | nou2f | ||
32 | novideo | ||
33 | protocol unix,inet,inet6 | ||
34 | seccomp | ||
35 | shell none | ||
36 | tracelog | ||
37 | |||
38 | disable-mnt | ||
39 | private-bin cawbird | ||
40 | private-cache | ||
41 | private-dev | ||
42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,resolv.conf,ssl,X11,xdg | ||
43 | private-tmp | ||
44 | |||
45 | # dbus-user none | ||
46 | dbus-system none | ||
diff --git a/etc/celluloid.profile b/etc/profile-a-l/celluloid.profile index d099ba11e..567bd912a 100644 --- a/etc/celluloid.profile +++ b/etc/profile-a-l/celluloid.profile | |||
@@ -24,13 +24,13 @@ include disable-passwdmgr.inc | |||
24 | include disable-programs.inc | 24 | include disable-programs.inc |
25 | include disable-xdg.inc | 25 | include disable-xdg.inc |
26 | 26 | ||
27 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
28 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
29 | 30 | ||
30 | apparmor | 31 | apparmor |
31 | caps.drop all | 32 | caps.drop all |
32 | netfilter | 33 | netfilter |
33 | # nodbus -- uses dconf, MPRIS | ||
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
36 | noroot | 36 | noroot |
@@ -46,5 +46,10 @@ private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3 | |||
46 | private-dev | 46 | private-dev |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user filter | ||
50 | dbus-user.own io.github.celluloid_player.Celluloid | ||
51 | dbus-user.talk org.gnome.SettingsDaemon.MediaKeys | ||
52 | dbus-system none | ||
53 | |||
49 | read-only ${HOME} | 54 | read-only ${HOME} |
50 | read-write ${HOME}/.config/celluloid | 55 | read-write ${HOME}/.config/celluloid |
diff --git a/etc/checkbashisms.profile b/etc/profile-a-l/checkbashisms.profile index e15131dca..93f61091b 100644 --- a/etc/checkbashisms.profile +++ b/etc/profile-a-l/checkbashisms.profile | |||
@@ -32,7 +32,6 @@ ipc-namespace | |||
32 | machine-id | 32 | machine-id |
33 | net none | 33 | net none |
34 | no3d | 34 | no3d |
35 | nodbus | ||
36 | nodvd | 35 | nodvd |
37 | nogroups | 36 | nogroups |
38 | nonewprivs | 37 | nonewprivs |
@@ -51,4 +50,7 @@ private-dev | |||
51 | private-lib libfreebl3.so,perl* | 50 | private-lib libfreebl3.so,perl* |
52 | private-tmp | 51 | private-tmp |
53 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
54 | memory-deny-write-execute | 56 | memory-deny-write-execute |
diff --git a/etc/cheese.profile b/etc/profile-a-l/cheese.profile index 633928260..337117c4a 100644 --- a/etc/cheese.profile +++ b/etc/profile-a-l/cheese.profile | |||
@@ -26,7 +26,6 @@ apparmor | |||
26 | caps.drop all | 26 | caps.drop all |
27 | machine-id | 27 | machine-id |
28 | net none | 28 | net none |
29 | nodbus | ||
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
@@ -43,3 +42,6 @@ private-bin cheese | |||
43 | private-cache | 42 | private-cache |
44 | private-etc alternatives,clutter-1.0,dconf,drirc,fonts,gtk-3.0 | 43 | private-etc alternatives,clutter-1.0,dconf,drirc,fonts,gtk-3.0 |
45 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/cherrytree.profile b/etc/profile-a-l/cherrytree.profile index 70dea5bd9..70dea5bd9 100644 --- a/etc/cherrytree.profile +++ b/etc/profile-a-l/cherrytree.profile | |||
diff --git a/etc/chromium-browser.profile b/etc/profile-a-l/chromium-browser.profile index f83052d9a..f83052d9a 100644 --- a/etc/chromium-browser.profile +++ b/etc/profile-a-l/chromium-browser.profile | |||
diff --git a/etc/chromium-common.profile b/etc/profile-a-l/chromium-common.profile index c54fb0e19..899400d25 100644 --- a/etc/chromium-common.profile +++ b/etc/profile-a-l/chromium-common.profile | |||
@@ -29,7 +29,6 @@ include whitelist-var-common.inc | |||
29 | apparmor | 29 | apparmor |
30 | caps.keep sys_admin,sys_chroot | 30 | caps.keep sys_admin,sys_chroot |
31 | netfilter | 31 | netfilter |
32 | # nodbus - prevents access to passwords saved in GNOME Keyring and KWallet, also breaks Gnome connector | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | notv | 34 | notv |
@@ -40,5 +39,9 @@ disable-mnt | |||
40 | ?BROWSER_DISABLE_U2F: private-dev | 39 | ?BROWSER_DISABLE_U2F: private-dev |
41 | # private-tmp - problems with multiple browser sessions | 40 | # private-tmp - problems with multiple browser sessions |
42 | 41 | ||
42 | # prevents access to passwords saved in GNOME Keyring and KWallet, also breaks Gnome connector | ||
43 | # dbus-user none | ||
44 | dbus-system none | ||
45 | |||
43 | # the file dialog needs to work without d-bus | 46 | # the file dialog needs to work without d-bus |
44 | ?HAS_NODBUS: env NO_CHROME_KDE_FILE_DIALOG=1 | 47 | ?HAS_NODBUS: env NO_CHROME_KDE_FILE_DIALOG=1 |
diff --git a/etc/chromium.profile b/etc/profile-a-l/chromium.profile index dab9ce449..dab9ce449 100644 --- a/etc/chromium.profile +++ b/etc/profile-a-l/chromium.profile | |||
diff --git a/etc/cin.profile b/etc/profile-a-l/cin.profile index efeb9cd14..8c3fb42d1 100644 --- a/etc/cin.profile +++ b/etc/profile-a-l/cin.profile | |||
@@ -17,7 +17,6 @@ include disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | ipc-namespace | 18 | ipc-namespace |
19 | net none | 19 | net none |
20 | nodbus | ||
21 | nodvd | 20 | nodvd |
22 | #nogroups | 21 | #nogroups |
23 | nonewprivs | 22 | nonewprivs |
@@ -34,3 +33,5 @@ shell none | |||
34 | private-cache | 33 | private-cache |
35 | private-dev | 34 | private-dev |
36 | 35 | ||
36 | dbus-user none | ||
37 | dbus-system none | ||
diff --git a/etc/cinelerra.profile b/etc/profile-a-l/cinelerra.profile index 88a65037e..88a65037e 100644 --- a/etc/cinelerra.profile +++ b/etc/profile-a-l/cinelerra.profile | |||
diff --git a/etc/clamav.profile b/etc/profile-a-l/clamav.profile index 51bc58108..2726ab5af 100644 --- a/etc/clamav.profile +++ b/etc/profile-a-l/clamav.profile | |||
@@ -15,7 +15,6 @@ caps.drop all | |||
15 | ipc-namespace | 15 | ipc-namespace |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodbus | ||
19 | nodvd | 18 | nodvd |
20 | nogroups | 19 | nogroups |
21 | nonewprivs | 20 | nonewprivs |
@@ -31,6 +30,10 @@ tracelog | |||
31 | x11 none | 30 | x11 none |
32 | 31 | ||
33 | private-dev | 32 | private-dev |
33 | |||
34 | dbus-user none | ||
35 | dbus-system none | ||
36 | |||
34 | read-only ${HOME} | 37 | read-only ${HOME} |
35 | 38 | ||
36 | memory-deny-write-execute | 39 | memory-deny-write-execute |
diff --git a/etc/clamdscan.profile b/etc/profile-a-l/clamdscan.profile index 4c6c56c5f..4c6c56c5f 100644 --- a/etc/clamdscan.profile +++ b/etc/profile-a-l/clamdscan.profile | |||
diff --git a/etc/clamdtop.profile b/etc/profile-a-l/clamdtop.profile index 4c6c56c5f..4c6c56c5f 100644 --- a/etc/clamdtop.profile +++ b/etc/profile-a-l/clamdtop.profile | |||
diff --git a/etc/clamscan.profile b/etc/profile-a-l/clamscan.profile index 4c6c56c5f..4c6c56c5f 100644 --- a/etc/clamscan.profile +++ b/etc/profile-a-l/clamscan.profile | |||
diff --git a/etc/clamtk.profile b/etc/profile-a-l/clamtk.profile index bc09808cb..4425a2bd0 100644 --- a/etc/clamtk.profile +++ b/etc/profile-a-l/clamtk.profile | |||
@@ -11,7 +11,6 @@ caps.drop all | |||
11 | ipc-namespace | 11 | ipc-namespace |
12 | net none | 12 | net none |
13 | no3d | 13 | no3d |
14 | nodbus | ||
15 | nodvd | 14 | nodvd |
16 | nogroups | 15 | nogroups |
17 | nonewprivs | 16 | nonewprivs |
@@ -25,3 +24,6 @@ seccomp | |||
25 | shell none | 24 | shell none |
26 | 25 | ||
27 | private-dev | 26 | private-dev |
27 | |||
28 | dbus-user none | ||
29 | dbus-system none | ||
diff --git a/etc/claws-mail.profile b/etc/profile-a-l/claws-mail.profile index 24954b2d8..24954b2d8 100644 --- a/etc/claws-mail.profile +++ b/etc/profile-a-l/claws-mail.profile | |||
diff --git a/etc/clawsker.profile b/etc/profile-a-l/clawsker.profile index 07db86c92..12ce47401 100644 --- a/etc/clawsker.profile +++ b/etc/profile-a-l/clawsker.profile | |||
@@ -29,7 +29,6 @@ apparmor | |||
29 | caps.drop all | 29 | caps.drop all |
30 | net none | 30 | net none |
31 | no3d | 31 | no3d |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -50,4 +49,7 @@ private-etc alternatives,fonts | |||
50 | private-lib girepository-1.*,libdbus-glib-1.so.*,libetpan.so.*,libgirepository-1.*,libgtk-x11-2.0.so.*,libstartup-notification-1.so.*,perl* | 49 | private-lib girepository-1.*,libdbus-glib-1.so.*,libetpan.so.*,libgirepository-1.*,libgtk-x11-2.0.so.*,libstartup-notification-1.so.*,perl* |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
53 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 55 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/clementine.profile b/etc/profile-a-l/clementine.profile index 4d92157d0..4d92157d0 100644 --- a/etc/clementine.profile +++ b/etc/profile-a-l/clementine.profile | |||
diff --git a/etc/clion.profile b/etc/profile-a-l/clion.profile index b27d93684..b27d93684 100644 --- a/etc/clion.profile +++ b/etc/profile-a-l/clion.profile | |||
diff --git a/etc/clipgrab.profile b/etc/profile-a-l/clipgrab.profile index 786d1c866..dace5e83e 100644 --- a/etc/clipgrab.profile +++ b/etc/profile-a-l/clipgrab.profile | |||
@@ -25,8 +25,6 @@ apparmor | |||
25 | caps.drop all | 25 | caps.drop all |
26 | machine-id | 26 | machine-id |
27 | netfilter | 27 | netfilter |
28 | # Breaks tray-icon, uncommend or add to clipgrab.local if you don't need it. | ||
29 | #nodbus | ||
30 | nodvd | 28 | nodvd |
31 | nogroups | 29 | nogroups |
32 | nonewprivs | 30 | nonewprivs |
@@ -43,3 +41,7 @@ disable-mnt | |||
43 | private-cache | 41 | private-cache |
44 | private-dev | 42 | private-dev |
45 | private-tmp | 43 | private-tmp |
44 | |||
45 | # Breaks tray icon, uncomment or add to clipgrab.local if you don't need it | ||
46 | # dbus-user none | ||
47 | # dbus-system none | ||
diff --git a/etc/clipit.profile b/etc/profile-a-l/clipit.profile index 66b5fc859..66b5fc859 100644 --- a/etc/clipit.profile +++ b/etc/profile-a-l/clipit.profile | |||
diff --git a/etc/cliqz.profile b/etc/profile-a-l/cliqz.profile index d0b8cc0ef..d0b8cc0ef 100644 --- a/etc/cliqz.profile +++ b/etc/profile-a-l/cliqz.profile | |||
diff --git a/etc/clocks.profile b/etc/profile-a-l/clocks.profile index da50e7d49..da50e7d49 100644 --- a/etc/clocks.profile +++ b/etc/profile-a-l/clocks.profile | |||
diff --git a/etc/cmus.profile b/etc/profile-a-l/cmus.profile index fa1e5d722..bcd557787 100644 --- a/etc/cmus.profile +++ b/etc/profile-a-l/cmus.profile | |||
@@ -14,6 +14,7 @@ include disable-devel.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/code-oss.profile b/etc/profile-a-l/code-oss.profile index 6d45d5994..6d45d5994 100644 --- a/etc/code-oss.profile +++ b/etc/profile-a-l/code-oss.profile | |||
diff --git a/etc/code.profile b/etc/profile-a-l/code.profile index 6f8a25211..6f8a25211 100644 --- a/etc/code.profile +++ b/etc/profile-a-l/code.profile | |||
diff --git a/etc/profile-a-l/com.github.dahenson.agenda.profile b/etc/profile-a-l/com.github.dahenson.agenda.profile new file mode 100644 index 000000000..77b6c7bd8 --- /dev/null +++ b/etc/profile-a-l/com.github.dahenson.agenda.profile | |||
@@ -0,0 +1,66 @@ | |||
1 | # Firejail profile for com.github.dahenson.agenda | ||
2 | # Description: Simple, fast, no-nonsense to-do (task) list | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include com.github.dahenson.agenda.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/agenda | ||
10 | noblacklist ${HOME}/.config/agenda | ||
11 | noblacklist ${HOME}/.local/share/agenda | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | mkdir ${HOME}/.cache/agenda | ||
23 | mkdir ${HOME}/.config/agenda | ||
24 | mkdir ${HOME}/.local/share/agenda | ||
25 | whitelist ${HOME}/.cache/agenda | ||
26 | whitelist ${HOME}/.config/agenda | ||
27 | whitelist ${HOME}/.local/share/agenda | ||
28 | include whitelist-common.inc | ||
29 | include whitelist-usr-share-common.inc | ||
30 | include whitelist-runuser-common.inc | ||
31 | include whitelist-var-common.inc | ||
32 | |||
33 | apparmor | ||
34 | caps.drop all | ||
35 | machine-id | ||
36 | net none | ||
37 | no3d | ||
38 | nodvd | ||
39 | nogroups | ||
40 | nonewprivs | ||
41 | noroot | ||
42 | nosound | ||
43 | notv | ||
44 | nou2f | ||
45 | novideo | ||
46 | protocol unix | ||
47 | seccomp | ||
48 | shell none | ||
49 | tracelog | ||
50 | |||
51 | disable-mnt | ||
52 | private-bin com.github.dahenson.agenda | ||
53 | private-cache | ||
54 | private-dev | ||
55 | private-etc dconf,fonts,gtk-3.0 | ||
56 | private-tmp | ||
57 | |||
58 | dbus-user filter | ||
59 | dbus-user.own com.github.dahenson.agenda | ||
60 | dbus-user.talk ca.desrt.dconf | ||
61 | dbus-system none | ||
62 | |||
63 | read-only ${HOME} | ||
64 | read-write ${HOME}/.cache/agenda | ||
65 | read-write ${HOME}/.config/agenda | ||
66 | read-write ${HOME}/.local/share/agenda | ||
diff --git a/etc/com.github.johnfactotum.Foliate.profile b/etc/profile-a-l/com.github.johnfactotum.Foliate.profile index 39a9a360d..c1800fe4c 100644 --- a/etc/com.github.johnfactotum.Foliate.profile +++ b/etc/profile-a-l/com.github.johnfactotum.Foliate.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | mkdir ${HOME}/.cache/com.github.johnfactotum.Foliate | 25 | mkdir ${HOME}/.cache/com.github.johnfactotum.Foliate |
diff --git a/etc/profile-a-l/com.gitlab.newsflash.profile b/etc/profile-a-l/com.gitlab.newsflash.profile new file mode 100644 index 000000000..0628d3d01 --- /dev/null +++ b/etc/profile-a-l/com.gitlab.newsflash.profile | |||
@@ -0,0 +1,5 @@ | |||
1 | # Firejail profile alias for newsflash | ||
2 | # This file is overwritten after every install/update | ||
3 | |||
4 | # Redirect | ||
5 | include newsflash.profile | ||
diff --git a/etc/conkeror.profile b/etc/profile-a-l/conkeror.profile index 38edf0d21..38edf0d21 100644 --- a/etc/conkeror.profile +++ b/etc/profile-a-l/conkeror.profile | |||
diff --git a/etc/conky.profile b/etc/profile-a-l/conky.profile index 10a243cd3..e5cd7085a 100644 --- a/etc/conky.profile +++ b/etc/profile-a-l/conky.profile | |||
@@ -8,6 +8,9 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${PICTURES} | 9 | noblacklist ${PICTURES} |
10 | 10 | ||
11 | # Allow lua (blacklisted by disable-interpreters.inc) | ||
12 | include allow-lua.inc | ||
13 | |||
11 | include disable-common.inc | 14 | include disable-common.inc |
12 | include disable-devel.inc | 15 | include disable-devel.inc |
13 | include disable-exec.inc | 16 | include disable-exec.inc |
diff --git a/etc/conplay.profile b/etc/profile-a-l/conplay.profile index 8d9f3324f..8d9f3324f 100644 --- a/etc/conplay.profile +++ b/etc/profile-a-l/conplay.profile | |||
diff --git a/etc/corebird.profile b/etc/profile-a-l/corebird.profile index dbb043c17..e9a2c9441 100644 --- a/etc/corebird.profile +++ b/etc/profile-a-l/corebird.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
diff --git a/etc/cower.profile b/etc/profile-a-l/cower.profile index 8efe48240..0ab5a7f78 100644 --- a/etc/cower.profile +++ b/etc/profile-a-l/cower.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | # This profile could be significantly strengthened by adding the following to cower.local | 22 | # This profile could be significantly strengthened by adding the following to cower.local |
diff --git a/etc/cpio.profile b/etc/profile-a-l/cpio.profile index 1156b7439..087a5b2bb 100644 --- a/etc/cpio.profile +++ b/etc/profile-a-l/cpio.profile | |||
@@ -25,7 +25,6 @@ ipc-namespace | |||
25 | machine-id | 25 | machine-id |
26 | net none | 26 | net none |
27 | no3d | 27 | no3d |
28 | nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -41,4 +40,7 @@ x11 none | |||
41 | private-cache | 40 | private-cache |
42 | private-dev | 41 | private-dev |
43 | 42 | ||
43 | dbus-user none | ||
44 | dbus-system none | ||
45 | |||
44 | memory-deny-write-execute | 46 | memory-deny-write-execute |
diff --git a/etc/crawl-tiles.profile b/etc/profile-a-l/crawl-tiles.profile index 39151865e..39151865e 100644 --- a/etc/crawl-tiles.profile +++ b/etc/profile-a-l/crawl-tiles.profile | |||
diff --git a/etc/crawl.profile b/etc/profile-a-l/crawl.profile index af78ac738..3da2413d9 100644 --- a/etc/crawl.profile +++ b/etc/profile-a-l/crawl.profile | |||
@@ -25,7 +25,6 @@ caps.drop all | |||
25 | ipc-namespace | 25 | ipc-namespace |
26 | net none | 26 | net none |
27 | no3d | 27 | no3d |
28 | nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -43,3 +42,6 @@ private-bin crawl,crawl-tiles | |||
43 | private-cache | 42 | private-cache |
44 | private-dev | 43 | private-dev |
45 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/crow.profile b/etc/profile-a-l/crow.profile index 755b6e9f8..db4be7679 100644 --- a/etc/crow.profile +++ b/etc/profile-a-l/crow.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | include whitelist-common.inc | 23 | include whitelist-common.inc |
diff --git a/etc/cryptocat.profile b/etc/profile-a-l/cryptocat.profile index 69aa39de2..69aa39de2 100644 --- a/etc/cryptocat.profile +++ b/etc/profile-a-l/cryptocat.profile | |||
diff --git a/etc/curl.profile b/etc/profile-a-l/curl.profile index 3f93e5f7e..996ff51d3 100644 --- a/etc/curl.profile +++ b/etc/profile-a-l/curl.profile | |||
@@ -10,6 +10,8 @@ include globals.local | |||
10 | noblacklist ${HOME}/.curlrc | 10 | noblacklist ${HOME}/.curlrc |
11 | 11 | ||
12 | blacklist /tmp/.X11-unix | 12 | blacklist /tmp/.X11-unix |
13 | blacklist ${RUNUSER}/wayland-* | ||
14 | blacklist ${RUNUSER} | ||
13 | 15 | ||
14 | include disable-common.inc | 16 | include disable-common.inc |
15 | include disable-exec.inc | 17 | include disable-exec.inc |
@@ -19,13 +21,14 @@ include disable-programs.inc | |||
19 | #include disable-xdg.inc | 21 | #include disable-xdg.inc |
20 | 22 | ||
21 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | ||
22 | 25 | ||
26 | apparmor | ||
23 | caps.drop all | 27 | caps.drop all |
24 | ipc-namespace | 28 | ipc-namespace |
25 | machine-id | 29 | machine-id |
26 | netfilter | 30 | netfilter |
27 | no3d | 31 | no3d |
28 | nodbus | ||
29 | nodvd | 32 | nodvd |
30 | nogroups | 33 | nogroups |
31 | nonewprivs | 34 | nonewprivs |
@@ -44,3 +47,6 @@ private-cache | |||
44 | private-dev | 47 | private-dev |
45 | # private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl | 48 | # private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl |
46 | private-tmp | 49 | private-tmp |
50 | |||
51 | dbus-user none | ||
52 | dbus-system none | ||
diff --git a/etc/cvlc.profile b/etc/profile-a-l/cvlc.profile index 56c0d965c..56c0d965c 100644 --- a/etc/cvlc.profile +++ b/etc/profile-a-l/cvlc.profile | |||
diff --git a/etc/cyberfox.profile b/etc/profile-a-l/cyberfox.profile index d1fff0004..d1fff0004 100644 --- a/etc/cyberfox.profile +++ b/etc/profile-a-l/cyberfox.profile | |||
diff --git a/etc/d-feet.profile b/etc/profile-a-l/d-feet.profile index 897bf5f5d..7e622799a 100644 --- a/etc/d-feet.profile +++ b/etc/profile-a-l/d-feet.profile | |||
@@ -18,12 +18,14 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
23 | mkdir ${HOME}/.config/d-feet | 24 | mkdir ${HOME}/.config/d-feet |
24 | whitelist ${HOME}/.config/d-feet | 25 | whitelist ${HOME}/.config/d-feet |
25 | whitelist /usr/share/d-feet | 26 | whitelist /usr/share/d-feet |
26 | include whitelist-common.inc | 27 | include whitelist-common.inc |
28 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | 29 | include whitelist-usr-share-common.inc |
28 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
29 | 31 | ||
diff --git a/etc/darktable.profile b/etc/profile-a-l/darktable.profile index 2a71ad11c..2a71ad11c 100644 --- a/etc/darktable.profile +++ b/etc/profile-a-l/darktable.profile | |||
diff --git a/etc/dconf-editor.profile b/etc/profile-a-l/dconf-editor.profile index a9d25128f..d6541850d 100644 --- a/etc/dconf-editor.profile +++ b/etc/profile-a-l/dconf-editor.profile | |||
@@ -12,10 +12,12 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | whitelist ${HOME}/.local/share/glib-2.0 | 18 | whitelist ${HOME}/.local/share/glib-2.0 |
18 | include whitelist-common.inc | 19 | include whitelist-common.inc |
20 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
21 | 23 | ||
@@ -43,3 +45,8 @@ private-dev | |||
43 | private-etc alternatives,dconf,fonts,gtk-3.0,machine-id | 45 | private-etc alternatives,dconf,fonts,gtk-3.0,machine-id |
44 | private-lib | 46 | private-lib |
45 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user filter | ||
50 | dbus-user.own ca.desrt.dconf-editor | ||
51 | dbus-user.talk ca.desrt.dconf | ||
52 | dbus-system none | ||
diff --git a/etc/dconf.profile b/etc/profile-a-l/dconf.profile index ea19b2209..ea19b2209 100644 --- a/etc/dconf.profile +++ b/etc/profile-a-l/dconf.profile | |||
diff --git a/etc/ddgtk.profile b/etc/profile-a-l/ddgtk.profile index 3dfc657bc..5b95b74be 100644 --- a/etc/ddgtk.profile +++ b/etc/profile-a-l/ddgtk.profile | |||
@@ -30,7 +30,6 @@ ipc-namespace | |||
30 | machine-id | 30 | machine-id |
31 | net none | 31 | net none |
32 | no3d | 32 | no3d |
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nogroups | 34 | nogroups |
36 | nonewprivs | 35 | nonewprivs |
@@ -50,4 +49,7 @@ private-cache | |||
50 | private-etc alternatives,fonts | 49 | private-etc alternatives,fonts |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
53 | # memory-deny-write-execute - breaks on Arch | 55 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/deadbeef.profile b/etc/profile-a-l/deadbeef.profile index 8e67d9daa..8e67d9daa 100644 --- a/etc/deadbeef.profile +++ b/etc/profile-a-l/deadbeef.profile | |||
diff --git a/etc/default.profile b/etc/profile-a-l/default.profile index 95a6e8095..74314cf92 100644 --- a/etc/default.profile +++ b/etc/profile-a-l/default.profile | |||
@@ -16,6 +16,11 @@ include disable-passwdmgr.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | # include disable-xdg.inc | 17 | # include disable-xdg.inc |
18 | 18 | ||
19 | # include whitelist-common.inc | ||
20 | # include whitelist-usr-share-common.inc | ||
21 | # include whitelist-runuser-common.inc | ||
22 | # include whitelist-var-common.inc | ||
23 | |||
19 | # apparmor | 24 | # apparmor |
20 | caps.drop all | 25 | caps.drop all |
21 | # ipc-namespace | 26 | # ipc-namespace |
@@ -23,7 +28,6 @@ caps.drop all | |||
23 | # net none | 28 | # net none |
24 | netfilter | 29 | netfilter |
25 | # no3d | 30 | # no3d |
26 | # nodbus | ||
27 | # nodvd | 31 | # nodvd |
28 | # nogroups | 32 | # nogroups |
29 | nonewprivs | 33 | nonewprivs |
@@ -42,8 +46,14 @@ seccomp | |||
42 | # private-bin program | 46 | # private-bin program |
43 | # private-cache | 47 | # private-cache |
44 | # private-dev | 48 | # private-dev |
45 | # private-etc alternatives | 49 | # see /usr/share/doc/firejail/profile.template for more common private-etc paths. |
50 | # private-etc alternatives,fonts,machine-id | ||
46 | # private-lib | 51 | # private-lib |
52 | # private-opt none | ||
47 | # private-tmp | 53 | # private-tmp |
48 | 54 | ||
55 | # dbus-user none | ||
56 | # dbus-system none | ||
57 | |||
49 | # memory-deny-write-execute | 58 | # memory-deny-write-execute |
59 | # read-only ${HOME} | ||
diff --git a/etc/deluge.profile b/etc/profile-a-l/deluge.profile index 8f4f9fbe9..17c5059f5 100644 --- a/etc/deluge.profile +++ b/etc/profile-a-l/deluge.profile | |||
@@ -14,6 +14,7 @@ include allow-python3.inc | |||
14 | 14 | ||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | # include disable-devel.inc | 16 | # include disable-devel.inc |
17 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 20 | include disable-programs.inc |
@@ -24,6 +25,7 @@ whitelist ${HOME}/.config/deluge | |||
24 | include whitelist-common.inc | 25 | include whitelist-common.inc |
25 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
26 | 27 | ||
28 | apparmor | ||
27 | caps.drop all | 29 | caps.drop all |
28 | machine-id | 30 | machine-id |
29 | netfilter | 31 | netfilter |
diff --git a/etc/desktopeditors.profile b/etc/profile-a-l/desktopeditors.profile index d0c727c5c..9a98c4933 100644 --- a/etc/desktopeditors.profile +++ b/etc/profile-a-l/desktopeditors.profile | |||
@@ -24,7 +24,6 @@ apparmor | |||
24 | caps.drop all | 24 | caps.drop all |
25 | ipc-namespace | 25 | ipc-namespace |
26 | netfilter | 26 | netfilter |
27 | nodbus | ||
28 | nodvd | 27 | nodvd |
29 | nogroups | 28 | nogroups |
30 | nonewprivs | 29 | nonewprivs |
@@ -41,3 +40,6 @@ private-bin desktopeditors,sh | |||
41 | private-cache | 40 | private-cache |
42 | private-dev | 41 | private-dev |
43 | private-tmp | 42 | private-tmp |
43 | |||
44 | dbus-user none | ||
45 | dbus-system none | ||
diff --git a/etc/devhelp.profile b/etc/profile-a-l/devhelp.profile index cc9553e73..b8b07469d 100644 --- a/etc/devhelp.profile +++ b/etc/profile-a-l/devhelp.profile | |||
@@ -13,6 +13,7 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | include disable-xdg.inc | 17 | include disable-xdg.inc |
17 | 18 | ||
18 | whitelist /usr/share/devhelp | 19 | whitelist /usr/share/devhelp |
@@ -24,7 +25,6 @@ include whitelist-usr-share-common.inc | |||
24 | apparmor | 25 | apparmor |
25 | caps.drop all | 26 | caps.drop all |
26 | # net none - makes settings immutable | 27 | # net none - makes settings immutable |
27 | # nodbus - makes settings immutable | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -45,6 +45,10 @@ private-dev | |||
45 | private-etc alternatives,dconf,fonts,ld.so.cache,machine-id,ssl | 45 | private-etc alternatives,dconf,fonts,ld.so.cache,machine-id,ssl |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # makes settings immutable | ||
49 | # dbus-user none | ||
50 | # dbus-system none | ||
51 | |||
48 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 52 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
49 | 53 | ||
50 | read-only ${HOME} | 54 | read-only ${HOME} |
diff --git a/etc/devilspie.profile b/etc/profile-a-l/devilspie.profile index b561787d8..1ab10a6f6 100644 --- a/etc/devilspie.profile +++ b/etc/profile-a-l/devilspie.profile | |||
@@ -30,7 +30,6 @@ ipc-namespace | |||
30 | machine-id | 30 | machine-id |
31 | net none | 31 | net none |
32 | no3d | 32 | no3d |
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nogroups | 34 | nogroups |
36 | nonewprivs | 35 | nonewprivs |
@@ -53,6 +52,9 @@ private-etc alternatives | |||
53 | private-lib gconv | 52 | private-lib gconv |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
55 | dbus-user none | ||
56 | dbus-system none | ||
57 | |||
56 | memory-deny-write-execute | 58 | memory-deny-write-execute |
57 | 59 | ||
58 | read-only ${HOME} | 60 | read-only ${HOME} |
diff --git a/etc/devilspie2.profile b/etc/profile-a-l/devilspie2.profile index 9eab3f536..9eab3f536 100644 --- a/etc/devilspie2.profile +++ b/etc/profile-a-l/devilspie2.profile | |||
diff --git a/etc/dex2jar.profile b/etc/profile-a-l/dex2jar.profile index e5f37b06a..7a59c5d73 100644 --- a/etc/dex2jar.profile +++ b/etc/profile-a-l/dex2jar.profile | |||
@@ -22,7 +22,6 @@ include whitelist-var-common.inc | |||
22 | caps.drop all | 22 | caps.drop all |
23 | net none | 23 | net none |
24 | no3d | 24 | no3d |
25 | nodbus | ||
26 | nodvd | 25 | nodvd |
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
@@ -39,3 +38,5 @@ private-bin bash,dex2jar,dirname,expr,grep,java,ls,sh,uname | |||
39 | private-cache | 38 | private-cache |
40 | private-dev | 39 | private-dev |
41 | 40 | ||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/dia.profile b/etc/profile-a-l/dia.profile index bd79797b7..52bf1c7f8 100644 --- a/etc/dia.profile +++ b/etc/profile-a-l/dia.profile | |||
@@ -19,10 +19,12 @@ include disable-passwdmgr.inc | |||
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-xdg.inc | 20 | include disable-xdg.inc |
21 | 21 | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
22 | caps.drop all | 25 | caps.drop all |
23 | net none | 26 | net none |
24 | no3d | 27 | no3d |
25 | nodbus | ||
26 | nodvd | 28 | nodvd |
27 | nogroups | 29 | nogroups |
28 | nonewprivs | 30 | nonewprivs |
@@ -41,3 +43,5 @@ private-cache | |||
41 | private-dev | 43 | private-dev |
42 | private-tmp | 44 | private-tmp |
43 | 45 | ||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/dig.profile b/etc/profile-a-l/dig.profile index 054e4891d..152dfd980 100644 --- a/etc/dig.profile +++ b/etc/profile-a-l/dig.profile | |||
@@ -8,8 +8,11 @@ include dig.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | noblacklist ${HOME}/.digrc | 10 | noblacklist ${HOME}/.digrc |
11 | noblacklist ${PATH}/dig | ||
11 | 12 | ||
12 | blacklist /tmp/.X11-unix | 13 | blacklist /tmp/.X11-unix |
14 | blacklist ${RUNUSER}/wayland-* | ||
15 | blacklist ${RUNUSER} | ||
13 | 16 | ||
14 | include disable-common.inc | 17 | include disable-common.inc |
15 | # include disable-devel.inc | 18 | # include disable-devel.inc |
@@ -25,12 +28,12 @@ include whitelist-common.inc | |||
25 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
27 | 30 | ||
31 | apparmor | ||
28 | caps.drop all | 32 | caps.drop all |
29 | ipc-namespace | 33 | ipc-namespace |
30 | machine-id | 34 | machine-id |
31 | netfilter | 35 | netfilter |
32 | no3d | 36 | no3d |
33 | nodbus | ||
34 | nodvd | 37 | nodvd |
35 | nogroups | 38 | nogroups |
36 | nonewprivs | 39 | nonewprivs |
@@ -45,12 +48,13 @@ shell none | |||
45 | tracelog | 48 | tracelog |
46 | 49 | ||
47 | disable-mnt | 50 | disable-mnt |
48 | private | ||
49 | private-bin bash,dig,sh | 51 | private-bin bash,dig,sh |
50 | private-cache | ||
51 | private-dev | 52 | private-dev |
52 | # Uncomment the next line (or put 'private-lib' in your dig.local) on non Debian/Ubuntu OS (see issue #3038) | 53 | # Uncomment the next line (or put 'private-lib' in your dig.local) on non Debian/Ubuntu OS (see issue #3038) |
53 | #private-lib | 54 | #private-lib |
54 | private-tmp | 55 | private-tmp |
55 | 56 | ||
57 | dbus-user none | ||
58 | dbus-system none | ||
59 | |||
56 | memory-deny-write-execute | 60 | memory-deny-write-execute |
diff --git a/etc/digikam.profile b/etc/profile-a-l/digikam.profile index e66434444..ae4a63c62 100644 --- a/etc/digikam.profile +++ b/etc/profile-a-l/digikam.profile | |||
@@ -25,7 +25,6 @@ include whitelist-var-common.inc | |||
25 | apparmor | 25 | apparmor |
26 | caps.drop all | 26 | caps.drop all |
27 | netfilter | 27 | netfilter |
28 | # nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -39,3 +38,6 @@ shell none | |||
39 | # private-dev - prevents libdc1394 loading; this lib is used to connect to a camera device | 38 | # private-dev - prevents libdc1394 loading; this lib is used to connect to a camera device |
40 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl | 39 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl |
41 | private-tmp | 40 | private-tmp |
41 | |||
42 | # dbus-user none | ||
43 | # dbus-system none | ||
diff --git a/etc/dillo.profile b/etc/profile-a-l/dillo.profile index 7103d0285..7103d0285 100644 --- a/etc/dillo.profile +++ b/etc/profile-a-l/dillo.profile | |||
diff --git a/etc/profile-a-l/dino-im.profile b/etc/profile-a-l/dino-im.profile new file mode 100644 index 000000000..ae0549d3e --- /dev/null +++ b/etc/profile-a-l/dino-im.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for dino-im | ||
2 | # Description: Modern XMPP Chat Client using GTK+/Vala, Ubuntu specific bin name | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include dino-im.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | # Add Ubuntu specific binary name | ||
11 | private-bin dino-im | ||
12 | |||
13 | # Redirect | ||
14 | include dino.profile | ||
diff --git a/etc/dino.profile b/etc/profile-a-l/dino.profile index 82ddf2819..d06ca042e 100644 --- a/etc/dino.profile +++ b/etc/profile-a-l/dino.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | mkdir ${HOME}/.local/share/dino | 19 | mkdir ${HOME}/.local/share/dino |
19 | whitelist ${HOME}/.local/share/dino | 20 | whitelist ${HOME}/.local/share/dino |
diff --git a/etc/discord-canary.profile b/etc/profile-a-l/discord-canary.profile index 3e9dacd1e..3e9dacd1e 100644 --- a/etc/discord-canary.profile +++ b/etc/profile-a-l/discord-canary.profile | |||
diff --git a/etc/discord-common.profile b/etc/profile-a-l/discord-common.profile index a6e730937..35bea4aaa 100644 --- a/etc/discord-common.profile +++ b/etc/profile-a-l/discord-common.profile | |||
@@ -6,12 +6,17 @@ include discord-common.local | |||
6 | # added by caller profile | 6 | # added by caller profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | ignore noexec ${HOME} | ||
10 | |||
9 | include disable-common.inc | 11 | include disable-common.inc |
10 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
11 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
12 | include disable-programs.inc | 15 | include disable-programs.inc |
13 | 16 | ||
14 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
18 | whitelist ${HOME}/.config/BetterDiscord | ||
19 | whitelist ${HOME}/.local/share/betterdiscordctl | ||
15 | include whitelist-common.inc | 20 | include whitelist-common.inc |
16 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
17 | 22 | ||
@@ -25,11 +30,9 @@ notv | |||
25 | nou2f | 30 | nou2f |
26 | novideo | 31 | novideo |
27 | protocol unix,inet,inet6,netlink | 32 | protocol unix,inet,inet6,netlink |
28 | seccomp | 33 | seccomp !chroot |
29 | 34 | ||
30 | private-bin bash,cut,echo,egrep,grep,head,sed,sh,tr,xdg-mime,xdg-open,zsh | 35 | private-bin bash,cut,echo,egrep,fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh |
31 | private-dev | 36 | private-dev |
32 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,resolv.conf,ssl | 37 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,resolv.conf,ssl |
33 | private-tmp | 38 | private-tmp |
34 | |||
35 | noexec /tmp | ||
diff --git a/etc/discord.profile b/etc/profile-a-l/discord.profile index 8ef02a30f..8ef02a30f 100644 --- a/etc/discord.profile +++ b/etc/profile-a-l/discord.profile | |||
diff --git a/etc/display.profile b/etc/profile-a-l/display.profile index 9e976c11a..9de634da9 100644 --- a/etc/display.profile +++ b/etc/profile-a-l/display.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
@@ -24,7 +25,6 @@ include whitelist-var-common.inc | |||
24 | 25 | ||
25 | caps.drop all | 26 | caps.drop all |
26 | net none | 27 | net none |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -42,3 +42,6 @@ private-dev | |||
42 | # On Debian-based systems, display is a symlink in /etc/alternatives | 42 | # On Debian-based systems, display is a symlink in /etc/alternatives |
43 | private-etc alternatives | 43 | private-etc alternatives |
44 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/dnox.profile b/etc/profile-a-l/dnox.profile index e02395771..e02395771 100644 --- a/etc/dnox.profile +++ b/etc/profile-a-l/dnox.profile | |||
diff --git a/etc/dnscrypt-proxy.profile b/etc/profile-a-l/dnscrypt-proxy.profile index 6637b8d02..e48e9d1ac 100644 --- a/etc/dnscrypt-proxy.profile +++ b/etc/profile-a-l/dnscrypt-proxy.profile | |||
@@ -31,7 +31,6 @@ ipc-namespace | |||
31 | machine-id | 31 | machine-id |
32 | netfilter | 32 | netfilter |
33 | no3d | 33 | no3d |
34 | nodbus | ||
35 | nodvd | 34 | nodvd |
36 | nonewprivs | 35 | nonewprivs |
37 | nosound | 36 | nosound |
@@ -48,5 +47,8 @@ private | |||
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
51 | # mdwe can break modules/plugins | 53 | # mdwe can break modules/plugins |
52 | memory-deny-write-execute | 54 | memory-deny-write-execute |
diff --git a/etc/dnsmasq.profile b/etc/profile-a-l/dnsmasq.profile index 6db71bd49..6db71bd49 100644 --- a/etc/dnsmasq.profile +++ b/etc/profile-a-l/dnsmasq.profile | |||
diff --git a/etc/profile-a-l/dolphin.profile b/etc/profile-a-l/dolphin.profile new file mode 100644 index 000000000..e0300a577 --- /dev/null +++ b/etc/profile-a-l/dolphin.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for dolphin | ||
2 | # Description: File manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include dolphin.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Put 'ignore noroot' in your dolphin.local if you use MPV+Vulkan (see issue #3012) | ||
10 | |||
11 | # Redirect | ||
12 | include file-manager-common.profile | ||
13 | |||
14 | join-or-start dolphin | ||
diff --git a/etc/dooble-qt4.profile b/etc/profile-a-l/dooble-qt4.profile index 70a21e11c..70a21e11c 100644 --- a/etc/dooble-qt4.profile +++ b/etc/profile-a-l/dooble-qt4.profile | |||
diff --git a/etc/dooble.profile b/etc/profile-a-l/dooble.profile index bc197b223..bc197b223 100644 --- a/etc/dooble.profile +++ b/etc/profile-a-l/dooble.profile | |||
diff --git a/etc/dosbox.profile b/etc/profile-a-l/dosbox.profile index 17ccc9b9a..11b9a4f42 100644 --- a/etc/dosbox.profile +++ b/etc/profile-a-l/dosbox.profile | |||
@@ -14,6 +14,7 @@ include disable-devel.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
diff --git a/etc/dragon.profile b/etc/profile-a-l/dragon.profile index df839cc47..d355cd121 100644 --- a/etc/dragon.profile +++ b/etc/profile-a-l/dragon.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | whitelist /usr/share/dragonplayer | 22 | whitelist /usr/share/dragonplayer |
diff --git a/etc/drawio.profile b/etc/profile-a-l/drawio.profile index d4fd735a1..4d723c8aa 100644 --- a/etc/drawio.profile +++ b/etc/profile-a-l/drawio.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.config/draw.io | 20 | mkdir ${HOME}/.config/draw.io |
@@ -28,7 +29,6 @@ caps.drop all | |||
28 | ipc-namespace | 29 | ipc-namespace |
29 | machine-id | 30 | machine-id |
30 | net none | 31 | net none |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -48,4 +48,7 @@ private-dev | |||
48 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | dbus-user none | ||
52 | dbus-system none | ||
53 | |||
51 | # memory-deny-write-execute - breaks on Arch | 54 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/dropbox.profile b/etc/profile-a-l/dropbox.profile index 1b242d422..1b242d422 100644 --- a/etc/dropbox.profile +++ b/etc/profile-a-l/dropbox.profile | |||
diff --git a/etc/easystroke.profile b/etc/profile-a-l/easystroke.profile index 1297f5f40..bb711b1bf 100644 --- a/etc/easystroke.profile +++ b/etc/profile-a-l/easystroke.profile | |||
@@ -27,7 +27,6 @@ caps.drop all | |||
27 | machine-id | 27 | machine-id |
28 | net none | 28 | net none |
29 | no3d | 29 | no3d |
30 | # nodbus | ||
31 | nodvd | 30 | nodvd |
32 | nogroups | 31 | nogroups |
33 | nonewprivs | 32 | nonewprivs |
@@ -51,4 +50,7 @@ private-etc alternatives,fonts,group,passwd | |||
51 | #private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* | 50 | #private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* |
52 | private-tmp | 51 | private-tmp |
53 | 52 | ||
53 | # dbus-user none | ||
54 | # dbus-system none | ||
55 | |||
54 | memory-deny-write-execute | 56 | memory-deny-write-execute |
diff --git a/etc/ebook-viewer.profile b/etc/profile-a-l/ebook-viewer.profile index 29cb87a62..706aec737 100644 --- a/etc/ebook-viewer.profile +++ b/etc/profile-a-l/ebook-viewer.profile | |||
@@ -4,7 +4,8 @@ | |||
4 | include ebook-viewer.local | 4 | include ebook-viewer.local |
5 | 5 | ||
6 | net none | 6 | net none |
7 | nodbus | 7 | dbus-user none |
8 | dbus-system none | ||
8 | 9 | ||
9 | # Redirect | 10 | # Redirect |
10 | include calibre.profile | 11 | include calibre.profile |
diff --git a/etc/electron-mail.profile b/etc/profile-a-l/electron-mail.profile index bde8978df..39366470f 100644 --- a/etc/electron-mail.profile +++ b/etc/profile-a-l/electron-mail.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | mkdir ${HOME}/.config/electron-mail | 22 | mkdir ${HOME}/.config/electron-mail |
@@ -29,7 +30,6 @@ apparmor | |||
29 | caps.drop all | 30 | caps.drop all |
30 | netfilter | 31 | netfilter |
31 | no3d | 32 | no3d |
32 | # nodbus - breaks tray functionality | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -49,4 +49,8 @@ private-etc alternatives,fonts | |||
49 | private-opt ElectronMail | 49 | private-opt ElectronMail |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | # breaks tray functionality | ||
53 | # dbus-user none | ||
54 | # dbus-system none | ||
55 | |||
52 | # memory-deny-write-execute - breaks on Arch | 56 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/electron.profile b/etc/profile-a-l/electron.profile index c24100f17..9b99c7ffb 100644 --- a/etc/electron.profile +++ b/etc/profile-a-l/electron.profile | |||
@@ -15,7 +15,6 @@ whitelist ${DOWNLOADS} | |||
15 | apparmor | 15 | apparmor |
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | nodbus | ||
19 | nodvd | 18 | nodvd |
20 | nogroups | 19 | nogroups |
21 | nonewprivs | 20 | nonewprivs |
@@ -23,3 +22,6 @@ noroot | |||
23 | notv | 22 | notv |
24 | protocol unix,inet,inet6,netlink | 23 | protocol unix,inet,inet6,netlink |
25 | seccomp | 24 | seccomp |
25 | |||
26 | dbus-user none | ||
27 | dbus-system none | ||
diff --git a/etc/electrum.profile b/etc/profile-a-l/electrum.profile index c9f50f12a..73c19f380 100644 --- a/etc/electrum.profile +++ b/etc/profile-a-l/electrum.profile | |||
@@ -18,6 +18,7 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
23 | mkdir ${HOME}/.electrum | 24 | mkdir ${HOME}/.electrum |
@@ -29,7 +30,6 @@ caps.drop all | |||
29 | ipc-namespace | 30 | ipc-namespace |
30 | netfilter | 31 | netfilter |
31 | no3d | 32 | no3d |
32 | #nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -50,3 +50,5 @@ private-dev | |||
50 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,machine-id,pki,resolv.conf,ssl | 50 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,machine-id,pki,resolv.conf,ssl |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | # dbus-user none | ||
54 | # dbus-system none | ||
diff --git a/etc/profile-a-l/element-desktop.profile b/etc/profile-a-l/element-desktop.profile new file mode 100644 index 000000000..c1aa821e3 --- /dev/null +++ b/etc/profile-a-l/element-desktop.profile | |||
@@ -0,0 +1,22 @@ | |||
1 | # Firejail profile for element-desktop | ||
2 | # Description: All-in-one secure chat app for teams, friends and organisations | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include element-desktop.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.config/Element | ||
11 | noblacklist ${HOME}/.config/Element (Riot) | ||
12 | |||
13 | mkdir ${HOME}/.config/Element | ||
14 | mkdir ${HOME}/.config/Element (Riot) | ||
15 | whitelist ${HOME}/.config/Element | ||
16 | whitelist ${HOME}/.config/Element (Riot) | ||
17 | whitelist /opt/Element | ||
18 | |||
19 | private-opt Element | ||
20 | |||
21 | # Redirect | ||
22 | include riot-desktop.profile | ||
diff --git a/etc/elinks.profile b/etc/profile-a-l/elinks.profile index 82d1ba528..2a306d704 100644 --- a/etc/elinks.profile +++ b/etc/profile-a-l/elinks.profile | |||
@@ -18,6 +18,8 @@ include disable-passwdmgr.inc | |||
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-xdg.inc | 19 | include disable-xdg.inc |
20 | 20 | ||
21 | include whitelist-runuser-common.inc | ||
22 | |||
21 | caps.drop all | 23 | caps.drop all |
22 | netfilter | 24 | netfilter |
23 | no3d | 25 | no3d |
diff --git a/etc/emacs.profile b/etc/profile-a-l/emacs.profile index ab378105e..226237b5b 100644 --- a/etc/emacs.profile +++ b/etc/profile-a-l/emacs.profile | |||
@@ -29,3 +29,6 @@ notv | |||
29 | novideo | 29 | novideo |
30 | protocol unix,inet,inet6 | 30 | protocol unix,inet,inet6 |
31 | seccomp | 31 | seccomp |
32 | |||
33 | read-write ${HOME}/.emacs | ||
34 | read-write ${HOME}/.emacs.d | ||
diff --git a/etc/email-common.profile b/etc/profile-a-l/email-common.profile index f9d96858b..67af04267 100644 --- a/etc/email-common.profile +++ b/etc/profile-a-l/email-common.profile | |||
@@ -63,6 +63,8 @@ read-only ${HOME}/.config/mimeapps.list | |||
63 | writable-run-user | 63 | writable-run-user |
64 | 64 | ||
65 | # If you want to read local mail stored in /var/mail, add the following to email-common.local: | 65 | # If you want to read local mail stored in /var/mail, add the following to email-common.local: |
66 | # whitelist /var/mail | 66 | #noblacklist /var/mail |
67 | # whitelist /var/spool/mail | 67 | #noblacklist /var/spool/mail |
68 | # writable-var | 68 | #whitelist /var/mail |
69 | #whitelist /var/spool/mail | ||
70 | #writable-var | ||
diff --git a/etc/empathy.profile b/etc/profile-a-l/empathy.profile index 5ca640d30..5ca640d30 100644 --- a/etc/empathy.profile +++ b/etc/profile-a-l/empathy.profile | |||
diff --git a/etc/enchant-2.profile b/etc/profile-a-l/enchant-2.profile index 32cc0e691..32cc0e691 100644 --- a/etc/enchant-2.profile +++ b/etc/profile-a-l/enchant-2.profile | |||
diff --git a/etc/enchant-lsmod-2.profile b/etc/profile-a-l/enchant-lsmod-2.profile index a7199955e..a7199955e 100644 --- a/etc/enchant-lsmod-2.profile +++ b/etc/profile-a-l/enchant-lsmod-2.profile | |||
diff --git a/etc/enchant-lsmod.profile b/etc/profile-a-l/enchant-lsmod.profile index ba4353d15..ba4353d15 100644 --- a/etc/enchant-lsmod.profile +++ b/etc/profile-a-l/enchant-lsmod.profile | |||
diff --git a/etc/enchant.profile b/etc/profile-a-l/enchant.profile index fa556c7d2..2b5de799f 100644 --- a/etc/enchant.profile +++ b/etc/profile-a-l/enchant.profile | |||
@@ -21,6 +21,7 @@ include disable-xdg.inc | |||
21 | mkdir ${HOME}/.config/enchant | 21 | mkdir ${HOME}/.config/enchant |
22 | whitelist ${HOME}/.config/enchant | 22 | whitelist ${HOME}/.config/enchant |
23 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | 25 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
26 | 27 | ||
@@ -30,7 +31,6 @@ ipc-namespace | |||
30 | machine-id | 31 | machine-id |
31 | net none | 32 | net none |
32 | no3d | 33 | no3d |
33 | nodbus | ||
34 | nodvd | 34 | nodvd |
35 | nogroups | 35 | nogroups |
36 | nonewprivs | 36 | nonewprivs |
@@ -52,4 +52,7 @@ private-etc alternatives | |||
52 | private-lib | 52 | private-lib |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | dbus-user none | ||
56 | dbus-system none | ||
57 | |||
55 | memory-deny-write-execute | 58 | memory-deny-write-execute |
diff --git a/etc/engrampa.profile b/etc/profile-a-l/engrampa.profile index aaf3e3382..6c0892c56 100644 --- a/etc/engrampa.profile +++ b/etc/profile-a-l/engrampa.profile | |||
@@ -19,7 +19,6 @@ apparmor | |||
19 | caps.drop all | 19 | caps.drop all |
20 | net none | 20 | net none |
21 | no3d | 21 | no3d |
22 | nodbus | ||
23 | nodvd | 22 | nodvd |
24 | nogroups | 23 | nogroups |
25 | nonewprivs | 24 | nonewprivs |
@@ -37,4 +36,7 @@ tracelog | |||
37 | private-dev | 36 | private-dev |
38 | # private-tmp | 37 | # private-tmp |
39 | 38 | ||
39 | dbus-user none | ||
40 | dbus-system none | ||
41 | |||
40 | memory-deny-write-execute | 42 | memory-deny-write-execute |
diff --git a/etc/enox.profile b/etc/profile-a-l/enox.profile index d8ac8b24a..d8ac8b24a 100644 --- a/etc/enox.profile +++ b/etc/profile-a-l/enox.profile | |||
diff --git a/etc/enpass.profile b/etc/profile-a-l/enpass.profile index 68113e294..68113e294 100644 --- a/etc/enpass.profile +++ b/etc/profile-a-l/enpass.profile | |||
diff --git a/etc/eo-common.profile b/etc/profile-a-l/eo-common.profile index 13f498c03..80c704c6b 100644 --- a/etc/eo-common.profile +++ b/etc/profile-a-l/eo-common.profile | |||
@@ -18,6 +18,7 @@ include disable-interpreters.inc | |||
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | 20 | ||
21 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
diff --git a/etc/eog.profile b/etc/profile-a-l/eog.profile index 6690b33ca..0d0153fc2 100644 --- a/etc/eog.profile +++ b/etc/profile-a-l/eog.profile | |||
@@ -15,5 +15,10 @@ whitelist /usr/share/eog | |||
15 | # or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eog.local | 15 | # or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eog.local |
16 | private-bin eog | 16 | private-bin eog |
17 | 17 | ||
18 | dbus-user filter | ||
19 | dbus-user.own org.gnome.eog | ||
20 | dbus-user.talk ca.desrt.dconf | ||
21 | dbus-system none | ||
22 | |||
18 | # Redirect | 23 | # Redirect |
19 | include eo-common.profile | 24 | include eo-common.profile |
diff --git a/etc/eom.profile b/etc/profile-a-l/eom.profile index 5bfeb8c8f..5bfeb8c8f 100644 --- a/etc/eom.profile +++ b/etc/profile-a-l/eom.profile | |||
diff --git a/etc/ephemeral.profile b/etc/profile-a-l/ephemeral.profile index c688c2324..029f613c6 100644 --- a/etc/ephemeral.profile +++ b/etc/profile-a-l/ephemeral.profile | |||
@@ -39,8 +39,6 @@ caps.drop all | |||
39 | # machine-id breaks pulse audio; it should work fine in setups where sound is not required. | 39 | # machine-id breaks pulse audio; it should work fine in setups where sound is not required. |
40 | #machine-id | 40 | #machine-id |
41 | netfilter | 41 | netfilter |
42 | # nodbus breaks preferences | ||
43 | #nodbus | ||
44 | nodvd | 42 | nodvd |
45 | nogroups | 43 | nogroups |
46 | nonewprivs | 44 | nonewprivs |
@@ -59,3 +57,7 @@ private-cache | |||
59 | # private-etc below works fine on most distributions. There are some problems on CentOS. | 57 | # private-etc below works fine on most distributions. There are some problems on CentOS. |
60 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,login.defs,machine-id,mailcap,mime.types,nsswitch.conf,os-release,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 58 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,login.defs,machine-id,mailcap,mime.types,nsswitch.conf,os-release,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
61 | private-tmp | 59 | private-tmp |
60 | |||
61 | # breaks preferences | ||
62 | # dbus-user none | ||
63 | # dbus-system none | ||
diff --git a/etc/epiphany.profile b/etc/profile-a-l/epiphany.profile index 225811226..225811226 100644 --- a/etc/epiphany.profile +++ b/etc/profile-a-l/epiphany.profile | |||
diff --git a/etc/et.profile b/etc/profile-a-l/et.profile index 4e70bb114..4e70bb114 100644 --- a/etc/et.profile +++ b/etc/profile-a-l/et.profile | |||
diff --git a/etc/etr.profile b/etc/profile-a-l/etr.profile index 97a43bb59..1c34335d2 100644 --- a/etc/etr.profile +++ b/etc/profile-a-l/etr.profile | |||
@@ -9,21 +9,25 @@ include globals.local | |||
9 | noblacklist ${HOME}/.etr | 9 | noblacklist ${HOME}/.etr |
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | ||
12 | include disable-exec.inc | 13 | include disable-exec.inc |
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
16 | include disable-xdg.inc | 18 | include disable-xdg.inc |
17 | 19 | ||
18 | mkdir ${HOME}/.etr | 20 | mkdir ${HOME}/.etr |
19 | whitelist ${HOME}/.etr | 21 | whitelist ${HOME}/.etr |
22 | whitelist /usr/share/etr | ||
20 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
22 | 27 | ||
23 | apparmor | 28 | apparmor |
24 | caps.drop all | 29 | caps.drop all |
25 | net none | 30 | net none |
26 | nodbus | ||
27 | nodvd | 31 | nodvd |
28 | nogroups | 32 | nogroups |
29 | nonewprivs | 33 | nonewprivs |
@@ -42,3 +46,6 @@ private-cache | |||
42 | private-dev | 46 | private-dev |
43 | # private-etc alternatives,drirc,machine-id,openal | 47 | # private-etc alternatives,drirc,machine-id,openal |
44 | private-tmp | 48 | private-tmp |
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/evince-previewer.profile b/etc/profile-a-l/evince-previewer.profile index 3857d6f7b..3857d6f7b 100644 --- a/etc/evince-previewer.profile +++ b/etc/profile-a-l/evince-previewer.profile | |||
diff --git a/etc/evince-thumbnailer.profile b/etc/profile-a-l/evince-thumbnailer.profile index 080a04a52..080a04a52 100644 --- a/etc/evince-thumbnailer.profile +++ b/etc/profile-a-l/evince-thumbnailer.profile | |||
diff --git a/etc/evince.profile b/etc/profile-a-l/evince.profile index 143a347e6..77a48f0ba 100644 --- a/etc/evince.profile +++ b/etc/profile-a-l/evince.profile | |||
@@ -15,12 +15,14 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | whitelist /usr/share/doc | 21 | whitelist /usr/share/doc |
21 | whitelist /usr/share/evince | 22 | whitelist /usr/share/evince |
22 | whitelist /usr/share/poppler | 23 | whitelist /usr/share/poppler |
23 | whitelist /usr/share/tracker | 24 | whitelist /usr/share/tracker |
25 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
26 | 28 | ||
@@ -29,8 +31,6 @@ machine-id | |||
29 | # net none - breaks AppArmor on Ubuntu systems | 31 | # net none - breaks AppArmor on Ubuntu systems |
30 | netfilter | 32 | netfilter |
31 | no3d | 33 | no3d |
32 | # nodbus might break two-page-view on some systems | ||
33 | nodbus | ||
34 | nodvd | 34 | nodvd |
35 | nogroups | 35 | nogroups |
36 | nonewprivs | 36 | nonewprivs |
@@ -51,3 +51,7 @@ private-etc alternatives,fonts,group,ld.so.cache,machine-id,passwd | |||
51 | # private-lib might break two-page-view on some systems | 51 | # private-lib might break two-page-view on some systems |
52 | private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* | 52 | private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* |
53 | private-tmp | 53 | private-tmp |
54 | |||
55 | # might break two-page-view on some systems | ||
56 | dbus-user none | ||
57 | dbus-system none | ||
diff --git a/etc/evolution.profile b/etc/profile-a-l/evolution.profile index 71a7a5600..422200ffe 100644 --- a/etc/evolution.profile +++ b/etc/profile-a-l/evolution.profile | |||
@@ -23,6 +23,8 @@ include disable-interpreters.inc | |||
23 | include disable-passwdmgr.inc | 23 | include disable-passwdmgr.inc |
24 | include disable-programs.inc | 24 | include disable-programs.inc |
25 | 25 | ||
26 | include whitelist-runuser-common.inc | ||
27 | |||
26 | caps.drop all | 28 | caps.drop all |
27 | netfilter | 29 | netfilter |
28 | # no3d breaks under wayland | 30 | # no3d breaks under wayland |
@@ -41,4 +43,4 @@ shell none | |||
41 | 43 | ||
42 | private-dev | 44 | private-dev |
43 | private-tmp | 45 | private-tmp |
44 | 46 | writable-var | |
diff --git a/etc/exfalso.profile b/etc/profile-a-l/exfalso.profile index 04bafdde4..192858304 100644 --- a/etc/exfalso.profile +++ b/etc/profile-a-l/exfalso.profile | |||
@@ -22,6 +22,7 @@ include disable-exec.inc | |||
22 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
23 | include disable-passwdmgr.inc | 23 | include disable-passwdmgr.inc |
24 | include disable-programs.inc | 24 | include disable-programs.inc |
25 | include disable-shell.inc | ||
25 | include disable-xdg.inc | 26 | include disable-xdg.inc |
26 | 27 | ||
27 | mkdir ${HOME}/.quodlibet | 28 | mkdir ${HOME}/.quodlibet |
@@ -35,7 +36,6 @@ ipc-namespace | |||
35 | machine-id | 36 | machine-id |
36 | netfilter | 37 | netfilter |
37 | no3d | 38 | no3d |
38 | nodbus | ||
39 | nodvd | 39 | nodvd |
40 | nogroups | 40 | nogroups |
41 | nonewprivs | 41 | nonewprivs |
@@ -55,4 +55,7 @@ private-etc alternatives,fonts,group,passwd | |||
55 | private-lib libatk-1.0.so.*,libgdk-3.so.*,libgdk_pixbuf-2.0.so.*,libgirepository-1.0.so.*,libgstreamer-1.0.so.*,libgtk-3.so.*,libgtksourceview-3.0.so.*,libpango-1.0.so.*,libpython*,libreadline.so.*,libsoup-2.4.so.*,libssl.so.1.*,python2*,python3* | 55 | private-lib libatk-1.0.so.*,libgdk-3.so.*,libgdk_pixbuf-2.0.so.*,libgirepository-1.0.so.*,libgstreamer-1.0.so.*,libgtk-3.so.*,libgtksourceview-3.0.so.*,libpango-1.0.so.*,libpython*,libreadline.so.*,libsoup-2.4.so.*,libssl.so.1.*,python2*,python3* |
56 | private-tmp | 56 | private-tmp |
57 | 57 | ||
58 | dbus-user none | ||
59 | dbus-system none | ||
60 | |||
58 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 61 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/exiftool.profile b/etc/profile-a-l/exiftool.profile index daacbc0c7..90d8a0fc2 100644 --- a/etc/exiftool.profile +++ b/etc/profile-a-l/exiftool.profile | |||
@@ -29,7 +29,6 @@ ipc-namespace | |||
29 | machine-id | 29 | machine-id |
30 | net none | 30 | net none |
31 | no3d | 31 | no3d |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -52,4 +51,7 @@ private-dev | |||
52 | private-etc alternatives | 51 | private-etc alternatives |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
54 | dbus-user none | ||
55 | dbus-system none | ||
56 | |||
55 | memory-deny-write-execute | 57 | memory-deny-write-execute |
diff --git a/etc/falkon.profile b/etc/profile-a-l/falkon.profile index 0024b6660..0024b6660 100644 --- a/etc/falkon.profile +++ b/etc/profile-a-l/falkon.profile | |||
diff --git a/etc/fbreader.profile b/etc/profile-a-l/fbreader.profile index 701f14dce..e9fcc2231 100644 --- a/etc/fbreader.profile +++ b/etc/profile-a-l/fbreader.profile | |||
@@ -11,15 +11,18 @@ noblacklist ${DOCUMENTS} | |||
11 | 11 | ||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 19 | include disable-xdg.inc |
18 | 20 | ||
19 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
20 | 22 | ||
23 | apparmor | ||
21 | caps.drop all | 24 | caps.drop all |
22 | netfilter | 25 | net none |
23 | nodvd | 26 | nodvd |
24 | nonewprivs | 27 | nonewprivs |
25 | noroot | 28 | noroot |
diff --git a/etc/profile-a-l/fdns.profile b/etc/profile-a-l/fdns.profile new file mode 100644 index 000000000..179540806 --- /dev/null +++ b/etc/profile-a-l/fdns.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for server | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include fdns.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | noblacklist /sbin | ||
9 | noblacklist /usr/sbin | ||
10 | |||
11 | blacklist /tmp/.X11-unix | ||
12 | blacklist ${RUNUSER}/wayland-* | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | #include whitelist-usr-share-common.inc | ||
23 | #include whitelist-var-common.inc | ||
24 | |||
25 | caps.keep kill,net_bind_service,setgid,setuid,sys_admin,sys_chroot | ||
26 | ipc-namespace | ||
27 | # netfilter /etc/firejail/webserver.net | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | # noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix,inet,inet6 | ||
38 | #seccomp | ||
39 | #shell none | ||
40 | |||
41 | disable-mnt | ||
42 | private | ||
43 | private-bin bash,fdns,sh | ||
44 | # private-cache | ||
45 | private-dev | ||
46 | private-etc ca-certificates,crypto-policies,fdns,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pki,ssl | ||
47 | # private-lib | ||
48 | private-tmp | ||
49 | |||
50 | memory-deny-write-execute | ||
diff --git a/etc/feedreader.profile b/etc/profile-a-l/feedreader.profile index 5a72b60ea..2abd80b06 100644 --- a/etc/feedreader.profile +++ b/etc/profile-a-l/feedreader.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | mkdir ${HOME}/.cache/feedreader | 21 | mkdir ${HOME}/.cache/feedreader |
@@ -23,6 +24,7 @@ whitelist ${HOME}/.cache/feedreader | |||
23 | whitelist ${HOME}/.local/share/feedreader | 24 | whitelist ${HOME}/.local/share/feedreader |
24 | whitelist /usr/share/feedreader | 25 | whitelist /usr/share/feedreader |
25 | include whitelist-common.inc | 26 | include whitelist-common.inc |
27 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
28 | 30 | ||
@@ -47,3 +49,11 @@ private-cache | |||
47 | private-dev | 49 | private-dev |
48 | private-tmp | 50 | private-tmp |
49 | 51 | ||
52 | dbus-user filter | ||
53 | dbus-user.own org.gnome.FeedReader | ||
54 | dbus-user.own org.gnome.FeedReader.ArticleView | ||
55 | dbus-user.talk org.freedesktop.secrets | ||
56 | # Enable as you need. | ||
57 | #dbus-user.talk org.freedesktop.Notifications | ||
58 | #dbus-user.talk org.gnome.OnlineAccounts | ||
59 | dbus-system none | ||
diff --git a/etc/feh.profile b/etc/profile-a-l/feh.profile index 6a8071c28..3ee07e559 100644 --- a/etc/feh.profile +++ b/etc/profile-a-l/feh.profile | |||
@@ -12,6 +12,7 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | 16 | ||
16 | # This profile disables network access | 17 | # This profile disables network access |
17 | # In order to enable network access, | 18 | # In order to enable network access, |
@@ -21,7 +22,6 @@ include disable-programs.inc | |||
21 | caps.drop all | 22 | caps.drop all |
22 | net none | 23 | net none |
23 | no3d | 24 | no3d |
24 | nodbus | ||
25 | nodvd | 25 | nodvd |
26 | nogroups | 26 | nogroups |
27 | nonewprivs | 27 | nonewprivs |
@@ -39,3 +39,6 @@ private-cache | |||
39 | private-dev | 39 | private-dev |
40 | private-etc alternatives,feh | 40 | private-etc alternatives,feh |
41 | private-tmp | 41 | private-tmp |
42 | |||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/profile-a-l/ferdi.profile b/etc/profile-a-l/ferdi.profile new file mode 100644 index 000000000..9b4c5f114 --- /dev/null +++ b/etc/profile-a-l/ferdi.profile | |||
@@ -0,0 +1,46 @@ | |||
1 | # Firejail profile for ferdi | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include ferdi.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | ignore noexec /tmp | ||
9 | |||
10 | noblacklist ${HOME}/.cache/Ferdi | ||
11 | noblacklist ${HOME}/.config/Ferdi | ||
12 | noblacklist ${HOME}/.pki | ||
13 | noblacklist ${HOME}/.local/share/pki | ||
14 | |||
15 | include disable-common.inc | ||
16 | include disable-devel.inc | ||
17 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | ||
19 | include disable-programs.inc | ||
20 | |||
21 | mkdir ${HOME}/.cache/Ferdi | ||
22 | mkdir ${HOME}/.config/Ferdi | ||
23 | mkdir ${HOME}/.pki | ||
24 | mkdir ${HOME}/.local/share/pki | ||
25 | whitelist ${DOWNLOADS} | ||
26 | whitelist ${HOME}/.cache/Ferdi | ||
27 | whitelist ${HOME}/.config/Ferdi | ||
28 | whitelist ${HOME}/.pki | ||
29 | whitelist ${HOME}/.local/share/pki | ||
30 | include whitelist-common.inc | ||
31 | |||
32 | caps.drop all | ||
33 | netfilter | ||
34 | nodvd | ||
35 | nogroups | ||
36 | nonewprivs | ||
37 | noroot | ||
38 | notv | ||
39 | nou2f | ||
40 | protocol unix,inet,inet6,netlink | ||
41 | seccomp !chroot | ||
42 | shell none | ||
43 | |||
44 | disable-mnt | ||
45 | private-dev | ||
46 | private-tmp | ||
diff --git a/etc/fetchmail.profile b/etc/profile-a-l/fetchmail.profile index d64fe830f..d64fe830f 100644 --- a/etc/fetchmail.profile +++ b/etc/profile-a-l/fetchmail.profile | |||
diff --git a/etc/ffmpeg.profile b/etc/profile-a-l/ffmpeg.profile index b392087e8..fb5c9ee57 100644 --- a/etc/ffmpeg.profile +++ b/etc/profile-a-l/ffmpeg.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | whitelist /usr/share/devedeng | 22 | whitelist /usr/share/devedeng |
@@ -29,7 +30,6 @@ caps.drop all | |||
29 | ipc-namespace | 30 | ipc-namespace |
30 | machine-id | 31 | machine-id |
31 | netfilter | 32 | netfilter |
32 | nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -50,4 +50,7 @@ private-dev | |||
50 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pkcs11,pki,resolv.conf,ssl | 50 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pkcs11,pki,resolv.conf,ssl |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
53 | # memory-deny-write-execute - it breaks old versions of ffmpeg | 56 | # memory-deny-write-execute - it breaks old versions of ffmpeg |
diff --git a/etc/ffmpegthumbnailer.profile b/etc/profile-a-l/ffmpegthumbnailer.profile index 6d72c3b99..6d72c3b99 100644 --- a/etc/ffmpegthumbnailer.profile +++ b/etc/profile-a-l/ffmpegthumbnailer.profile | |||
diff --git a/etc/ffplay.profile b/etc/profile-a-l/ffplay.profile index 04134cbf4..04134cbf4 100644 --- a/etc/ffplay.profile +++ b/etc/profile-a-l/ffplay.profile | |||
diff --git a/etc/ffprobe.profile b/etc/profile-a-l/ffprobe.profile index e7c9f678d..e7c9f678d 100644 --- a/etc/ffprobe.profile +++ b/etc/profile-a-l/ffprobe.profile | |||
diff --git a/etc/profile-a-l/file-manager-common.profile b/etc/profile-a-l/file-manager-common.profile new file mode 100644 index 000000000..24339953b --- /dev/null +++ b/etc/profile-a-l/file-manager-common.profile | |||
@@ -0,0 +1,52 @@ | |||
1 | # Firejail profile for file managers | ||
2 | # Description: Common profile for GUI file managers | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include file-manager-common.local | ||
6 | # Persistent global definitions | ||
7 | # added by caller profile | ||
8 | #include globals.local | ||
9 | |||
10 | # File managers need to be able to see everything under ${HOME} | ||
11 | # and be able to start arbitrary applications | ||
12 | |||
13 | ignore noexec ${HOME} | ||
14 | |||
15 | # Allow lua (blacklisted by disable-interpreters.inc) | ||
16 | include allow-lua.inc | ||
17 | |||
18 | # Allow perl | ||
19 | include allow-perl.inc | ||
20 | |||
21 | # Allow python (blacklisted by disable-interpreters.inc) | ||
22 | include allow-python2.inc | ||
23 | include allow-python3.inc | ||
24 | |||
25 | #include disable-common.inc | ||
26 | include disable-devel.inc | ||
27 | include disable-exec.inc | ||
28 | include disable-interpreters.inc | ||
29 | include disable-passwdmgr.inc | ||
30 | #include disable-programs.inc | ||
31 | |||
32 | allusers | ||
33 | #apparmor | ||
34 | caps.drop all | ||
35 | #net none | ||
36 | netfilter | ||
37 | nodvd | ||
38 | nogroups | ||
39 | nonewprivs | ||
40 | noroot | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix,inet,inet6,netlink | ||
45 | seccomp | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | private-dev | ||
50 | |||
51 | #dbus-user none | ||
52 | #dbus-system none | ||
diff --git a/etc/file-roller.profile b/etc/profile-a-l/file-roller.profile index 253b82cfe..745b8b8e9 100644 --- a/etc/file-roller.profile +++ b/etc/profile-a-l/file-roller.profile | |||
@@ -14,6 +14,7 @@ include disable-passwdmgr.inc | |||
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | 15 | ||
16 | whitelist /usr/share/file-roller | 16 | whitelist /usr/share/file-roller |
17 | include whitelist-runuser-common.inc | ||
17 | include whitelist-usr-share-common.inc | 18 | include whitelist-usr-share-common.inc |
18 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
19 | 20 | ||
@@ -36,8 +37,10 @@ seccomp | |||
36 | shell none | 37 | shell none |
37 | tracelog | 38 | tracelog |
38 | 39 | ||
39 | private-bin 7z,7za,7zr,ar,arj,brotli,bzip2,compress,cpio,dpkg-deb,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,rar,rzip,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,xz,zip,zoo | 40 | private-bin 7z,7za,7zr,ar,arj,bash,brotli,bzip2,compress,cpio,dpkg-deb,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,p7zip,rar,rzip,sh,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,xz,zip,zoo |
40 | private-cache | 41 | private-cache |
41 | private-dev | 42 | private-dev |
42 | private-etc dconf,fonts,gtk-3.0,xdg | 43 | private-etc dconf,fonts,gtk-3.0,xdg |
43 | # private-tmp | 44 | # private-tmp |
45 | |||
46 | dbus-system none | ||
diff --git a/etc/file.profile b/etc/profile-a-l/file.profile index 9b21818f8..74620d4cd 100644 --- a/etc/file.profile +++ b/etc/profile-a-l/file.profile | |||
@@ -8,6 +8,7 @@ include file.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | include disable-common.inc | 13 | include disable-common.inc |
13 | include disable-exec.inc | 14 | include disable-exec.inc |
@@ -21,7 +22,6 @@ ipc-namespace | |||
21 | machine-id | 22 | machine-id |
22 | net none | 23 | net none |
23 | no3d | 24 | no3d |
24 | nodbus | ||
25 | nodvd | 25 | nodvd |
26 | nogroups | 26 | nogroups |
27 | nonewprivs | 27 | nonewprivs |
@@ -38,8 +38,11 @@ x11 none | |||
38 | #private-bin bzip2,file,gzip,lrzip,lz4,lzip,xz,zstd | 38 | #private-bin bzip2,file,gzip,lrzip,lz4,lzip,xz,zstd |
39 | private-cache | 39 | private-cache |
40 | private-dev | 40 | private-dev |
41 | private-etc alternatives,localtime,magic,magic.mgc | 41 | #private-etc alternatives,localtime,magic,magic.mgc |
42 | private-lib file,libarchive.so.*,libfakeroot,libmagic.so.* | 42 | #private-lib file,libarchive.so.*,libfakeroot,libmagic.so.*,libseccomp.so.* |
43 | |||
44 | dbus-user none | ||
45 | dbus-system none | ||
43 | 46 | ||
44 | memory-deny-write-execute | 47 | memory-deny-write-execute |
45 | read-only ${HOME} | 48 | read-only ${HOME} |
diff --git a/etc/filezilla.profile b/etc/profile-a-l/filezilla.profile index d8d4c1746..6c7ab8f0d 100644 --- a/etc/filezilla.profile +++ b/etc/profile-a-l/filezilla.profile | |||
@@ -17,6 +17,8 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | |||
21 | include whitelist-runuser-common.inc | ||
20 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
21 | 23 | ||
22 | caps.drop all | 24 | caps.drop all |
diff --git a/etc/firefox-beta.profile b/etc/profile-a-l/firefox-beta.profile index fa8bbb1f5..fa8bbb1f5 100644 --- a/etc/firefox-beta.profile +++ b/etc/profile-a-l/firefox-beta.profile | |||
diff --git a/etc/firefox-common.profile b/etc/profile-a-l/firefox-common.profile index 323070289..7c343c26d 100644 --- a/etc/firefox-common.profile +++ b/etc/profile-a-l/firefox-common.profile | |||
@@ -34,9 +34,6 @@ caps.drop all | |||
34 | # machine-id breaks pulse audio; it should work fine in setups where sound is not required. | 34 | # machine-id breaks pulse audio; it should work fine in setups where sound is not required. |
35 | #machine-id | 35 | #machine-id |
36 | netfilter | 36 | netfilter |
37 | # nodbus breaks various desktop integration features | ||
38 | # among other things global menus, native notifications, Gnome connector, KDE connect and power management on KDE Plasma | ||
39 | nodbus | ||
40 | nodvd | 37 | nodvd |
41 | nogroups | 38 | nogroups |
42 | nonewprivs | 39 | nonewprivs |
@@ -56,3 +53,8 @@ disable-mnt | |||
56 | # private-etc below works fine on most distributions. There are some problems on CentOS. | 53 | # private-etc below works fine on most distributions. There are some problems on CentOS. |
57 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 54 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
58 | private-tmp | 55 | private-tmp |
56 | |||
57 | # breaks various desktop integration features | ||
58 | # among other things global menus, native notifications, Gnome connector, KDE connect and power management on KDE Plasma | ||
59 | dbus-user none | ||
60 | dbus-system none | ||
diff --git a/etc/firefox-developer-edition.profile b/etc/profile-a-l/firefox-developer-edition.profile index 8c7ca3887..8c7ca3887 100644 --- a/etc/firefox-developer-edition.profile +++ b/etc/profile-a-l/firefox-developer-edition.profile | |||
diff --git a/etc/firefox-esr.profile b/etc/profile-a-l/firefox-esr.profile index 6c1d77986..5e69fdb51 100644 --- a/etc/firefox-esr.profile +++ b/etc/profile-a-l/firefox-esr.profile | |||
@@ -6,5 +6,7 @@ include firefox-esr.local | |||
6 | # added by included profile | 6 | # added by included profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | whitelist /usr/share/firefox-esr | ||
10 | |||
9 | # Redirect | 11 | # Redirect |
10 | include firefox.profile | 12 | include firefox.profile |
diff --git a/etc/firefox-nightly.profile b/etc/profile-a-l/firefox-nightly.profile index 96d2bf898..96d2bf898 100644 --- a/etc/firefox-nightly.profile +++ b/etc/profile-a-l/firefox-nightly.profile | |||
diff --git a/etc/firefox-wayland.profile b/etc/profile-a-l/firefox-wayland.profile index 17c9f059e..17c9f059e 100644 --- a/etc/firefox-wayland.profile +++ b/etc/profile-a-l/firefox-wayland.profile | |||
diff --git a/etc/firefox-x11.profile b/etc/profile-a-l/firefox-x11.profile index ffd64aad7..ffd64aad7 100644 --- a/etc/firefox-x11.profile +++ b/etc/profile-a-l/firefox-x11.profile | |||
diff --git a/etc/firefox.profile b/etc/profile-a-l/firefox.profile index 0530516d8..337311ed8 100644 --- a/etc/firefox.profile +++ b/etc/profile-a-l/firefox.profile | |||
@@ -15,6 +15,7 @@ whitelist ${HOME}/.cache/mozilla/firefox | |||
15 | whitelist ${HOME}/.mozilla | 15 | whitelist ${HOME}/.mozilla |
16 | 16 | ||
17 | whitelist /usr/share/doc | 17 | whitelist /usr/share/doc |
18 | whitelist /usr/share/firefox | ||
18 | whitelist /usr/share/gtk-doc/html | 19 | whitelist /usr/share/gtk-doc/html |
19 | whitelist /usr/share/mozilla | 20 | whitelist /usr/share/mozilla |
20 | whitelist /usr/share/webext | 21 | whitelist /usr/share/webext |
@@ -27,5 +28,12 @@ include whitelist-usr-share-common.inc | |||
27 | # private-etc must first be enabled in firefox-common.profile | 28 | # private-etc must first be enabled in firefox-common.profile |
28 | #private-etc firefox | 29 | #private-etc firefox |
29 | 30 | ||
31 | dbus-user filter | ||
32 | dbus-user.own org.mozilla.firefox.* | ||
33 | dbus-user.own org.mpris.MediaPlayer2.firefox.* | ||
34 | # Uncomment or put in your firefox.local to enable native notifications. | ||
35 | #dbus-user.talk org.freedesktop.Notifications | ||
36 | ignore dbus-user none | ||
37 | |||
30 | # Redirect | 38 | # Redirect |
31 | include firefox-common.profile | 39 | include firefox-common.profile |
diff --git a/etc/profile-a-l/five-or-more.profile b/etc/profile-a-l/five-or-more.profile new file mode 100644 index 000000000..2c86d3ac7 --- /dev/null +++ b/etc/profile-a-l/five-or-more.profile | |||
@@ -0,0 +1,21 @@ | |||
1 | # Firejail profile for five-or-more | ||
2 | # Description: GNOME port of the once-popular Colour Lines game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include five-or-more.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/five-or-more | ||
10 | |||
11 | mkdir ${HOME}/.local/share/five-or-more | ||
12 | whitelist ${HOME}/.local/share/five-or-more | ||
13 | |||
14 | whitelist /usr/share/five-or-more | ||
15 | |||
16 | private-bin five-or-more | ||
17 | |||
18 | dbus-user.own org.gnome.five-or-more | ||
19 | |||
20 | # Redirect | ||
21 | include gnome_games-common.profile | ||
diff --git a/etc/flacsplt.profile b/etc/profile-a-l/flacsplt.profile index 2efef0f22..2efef0f22 100644 --- a/etc/flacsplt.profile +++ b/etc/profile-a-l/flacsplt.profile | |||
diff --git a/etc/flameshot.profile b/etc/profile-a-l/flameshot.profile index 3aad9723b..7c41417ec 100644 --- a/etc/flameshot.profile +++ b/etc/profile-a-l/flameshot.profile | |||
@@ -8,6 +8,7 @@ include flameshot.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | noblacklist ${PICTURES} | 10 | noblacklist ${PICTURES} |
11 | noblacklist ${HOME}/.config/Dharkael | ||
11 | 12 | ||
12 | include disable-common.inc | 13 | include disable-common.inc |
13 | include disable-devel.inc | 14 | include disable-devel.inc |
@@ -15,13 +16,21 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 20 | include disable-xdg.inc |
19 | 21 | ||
22 | #whitelist ${PICTURES} | ||
23 | #whitelist ${HOME}/.config/Dharkael | ||
24 | whitelist /usr/share/flameshot | ||
25 | #include whitelist-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
20 | caps.drop all | 30 | caps.drop all |
21 | ipc-namespace | 31 | ipc-namespace |
22 | netfilter | 32 | netfilter |
23 | no3d | 33 | no3d |
24 | # nodbus | ||
25 | nodvd | 34 | nodvd |
26 | nogroups | 35 | nogroups |
27 | nonewprivs | 36 | nonewprivs |
@@ -33,11 +42,15 @@ novideo | |||
33 | protocol unix,inet,inet6 | 42 | protocol unix,inet,inet6 |
34 | seccomp | 43 | seccomp |
35 | shell none | 44 | shell none |
45 | tracelog | ||
36 | 46 | ||
37 | disable-mnt | 47 | disable-mnt |
38 | private-bin flameshot | 48 | private-bin flameshot |
39 | private-cache | 49 | private-cache |
40 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.conf,pki,resolv.conf,ssl | 50 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.conf,machine-id,pki,resolv.conf,ssl |
41 | private-dev | 51 | private-dev |
42 | private-tmp | 52 | private-tmp |
43 | 53 | ||
54 | dbus-user filter | ||
55 | dbus-user.own org.dharkael.Flameshot | ||
56 | dbus-system none | ||
diff --git a/etc/flashpeak-slimjet.profile b/etc/profile-a-l/flashpeak-slimjet.profile index b841bce75..b841bce75 100644 --- a/etc/flashpeak-slimjet.profile +++ b/etc/profile-a-l/flashpeak-slimjet.profile | |||
diff --git a/etc/flowblade.profile b/etc/profile-a-l/flowblade.profile index 40472ab93..40472ab93 100644 --- a/etc/flowblade.profile +++ b/etc/profile-a-l/flowblade.profile | |||
diff --git a/etc/fluxbox.profile b/etc/profile-a-l/fluxbox.profile index c296c0491..c296c0491 100644 --- a/etc/fluxbox.profile +++ b/etc/profile-a-l/fluxbox.profile | |||
diff --git a/etc/font-manager.profile b/etc/profile-a-l/font-manager.profile index ae0e32d1e..acad6ad13 100644 --- a/etc/font-manager.profile +++ b/etc/profile-a-l/font-manager.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | mkdir ${HOME}/.cache/font-manager | 25 | mkdir ${HOME}/.cache/font-manager |
diff --git a/etc/fontforge.profile b/etc/profile-a-l/fontforge.profile index 6d305e2af..6d305e2af 100644 --- a/etc/fontforge.profile +++ b/etc/profile-a-l/fontforge.profile | |||
diff --git a/etc/fossamail.profile b/etc/profile-a-l/fossamail.profile index 2d700d336..2d700d336 100644 --- a/etc/fossamail.profile +++ b/etc/profile-a-l/fossamail.profile | |||
diff --git a/etc/profile-a-l/four-in-a-row.profile b/etc/profile-a-l/four-in-a-row.profile new file mode 100644 index 000000000..eb0c43ca5 --- /dev/null +++ b/etc/profile-a-l/four-in-a-row.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for four-in-a-row | ||
2 | # Description: four-in-a-row game for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include four-in-a-row.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore machine-id | ||
10 | ignore nosound | ||
11 | |||
12 | whitelist /usr/share/four-in-a-row | ||
13 | |||
14 | private-bin four-in-a-row | ||
15 | |||
16 | dbus-user.own org.gnome.Four-in-a-row | ||
17 | |||
18 | # Redirect | ||
19 | include gnome_games-common.profile | ||
diff --git a/etc/franz.profile b/etc/profile-a-l/franz.profile index 344804ca9..344804ca9 100644 --- a/etc/franz.profile +++ b/etc/profile-a-l/franz.profile | |||
diff --git a/etc/freecad.profile b/etc/profile-a-l/freecad.profile index 6f0f52a55..0a1d4a750 100644 --- a/etc/freecad.profile +++ b/etc/profile-a-l/freecad.profile | |||
@@ -24,7 +24,6 @@ include disable-xdg.inc | |||
24 | caps.drop all | 24 | caps.drop all |
25 | ipc-namespace | 25 | ipc-namespace |
26 | net none | 26 | net none |
27 | nodbus | ||
28 | nodvd | 27 | nodvd |
29 | nogroups | 28 | nogroups |
30 | nonewprivs | 29 | nonewprivs |
@@ -42,3 +41,5 @@ private-cache | |||
42 | private-dev | 41 | private-dev |
43 | private-tmp | 42 | private-tmp |
44 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
diff --git a/etc/freecadcmd.profile b/etc/profile-a-l/freecadcmd.profile index 44bf62cfe..44bf62cfe 100644 --- a/etc/freecadcmd.profile +++ b/etc/profile-a-l/freecadcmd.profile | |||
diff --git a/etc/freeciv-gtk3.profile b/etc/profile-a-l/freeciv-gtk3.profile index fa36459e7..fa36459e7 100644 --- a/etc/freeciv-gtk3.profile +++ b/etc/profile-a-l/freeciv-gtk3.profile | |||
diff --git a/etc/freeciv-mp-gtk3.profile b/etc/profile-a-l/freeciv-mp-gtk3.profile index fa36459e7..fa36459e7 100644 --- a/etc/freeciv-mp-gtk3.profile +++ b/etc/profile-a-l/freeciv-mp-gtk3.profile | |||
diff --git a/etc/freeciv.profile b/etc/profile-a-l/freeciv.profile index fa115d325..0fe933478 100644 --- a/etc/freeciv.profile +++ b/etc/profile-a-l/freeciv.profile | |||
@@ -21,10 +21,10 @@ whitelist ${HOME}/.freeciv | |||
21 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | apparmor | ||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | netfilter | 27 | netfilter |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -42,3 +42,6 @@ private-bin freeciv-gtk3,freeciv-manual,freeciv-mp-gtk3,freeciv-server | |||
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/freecol.profile b/etc/profile-a-l/freecol.profile index baeb4c528..3cbd2ff53 100644 --- a/etc/freecol.profile +++ b/etc/profile-a-l/freecol.profile | |||
@@ -37,7 +37,6 @@ include whitelist-var-common.inc | |||
37 | caps.drop all | 37 | caps.drop all |
38 | ipc-namespace | 38 | ipc-namespace |
39 | netfilter | 39 | netfilter |
40 | nodbus | ||
41 | nodvd | 40 | nodvd |
42 | nogroups | 41 | nogroups |
43 | nonewprivs | 42 | nonewprivs |
@@ -54,3 +53,6 @@ disable-mnt | |||
54 | private-cache | 53 | private-cache |
55 | private-dev | 54 | private-dev |
56 | private-tmp | 55 | private-tmp |
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/freemind.profile b/etc/profile-a-l/freemind.profile index ba945c0fb..0ffb5c54d 100644 --- a/etc/freemind.profile +++ b/etc/profile-a-l/freemind.profile | |||
@@ -27,7 +27,6 @@ caps.drop all | |||
27 | machine-id | 27 | machine-id |
28 | netfilter | 28 | netfilter |
29 | no3d | 29 | no3d |
30 | nodbus | ||
31 | nodvd | 30 | nodvd |
32 | nogroups | 31 | nogroups |
33 | nonewprivs | 32 | nonewprivs |
@@ -49,3 +48,6 @@ private-dev | |||
49 | private-tmp | 48 | private-tmp |
50 | private-opt none | 49 | private-opt none |
51 | private-srv none | 50 | private-srv none |
51 | |||
52 | dbus-user none | ||
53 | dbus-system none | ||
diff --git a/etc/freeoffice-planmaker.profile b/etc/profile-a-l/freeoffice-planmaker.profile index b6ca167eb..9449e7c48 100644 --- a/etc/freeoffice-planmaker.profile +++ b/etc/profile-a-l/freeoffice-planmaker.profile | |||
@@ -7,4 +7,4 @@ include freeoffice-planmaker.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/freeoffice-presentations.profile b/etc/profile-a-l/freeoffice-presentations.profile index 43661028c..636868e2e 100644 --- a/etc/freeoffice-presentations.profile +++ b/etc/profile-a-l/freeoffice-presentations.profile | |||
@@ -7,4 +7,4 @@ include freeoffice-presentations.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/freeoffice-textmaker.profile b/etc/profile-a-l/freeoffice-textmaker.profile index f7d30eaed..5d98d1cc6 100644 --- a/etc/freeoffice-textmaker.profile +++ b/etc/profile-a-l/freeoffice-textmaker.profile | |||
@@ -6,4 +6,4 @@ include freeoffice-textmaker.local | |||
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Redirect | 8 | # Redirect |
9 | include softmaker-common.profile | 9 | include softmaker-common.inc |
diff --git a/etc/profile-a-l/freetube.profile b/etc/profile-a-l/freetube.profile new file mode 100644 index 000000000..91f0caf87 --- /dev/null +++ b/etc/profile-a-l/freetube.profile | |||
@@ -0,0 +1,31 @@ | |||
1 | # Firejail profile for freetube | ||
2 | # Description: Youtube client with local subscription feature | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include freetube.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/FreeTube | ||
10 | |||
11 | include disable-devel.inc | ||
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-shell.inc | ||
15 | include disable-xdg.inc | ||
16 | |||
17 | mkdir ${HOME}/.config/FreeTube | ||
18 | whitelist ${HOME}/.config/FreeTube | ||
19 | |||
20 | seccomp !chroot | ||
21 | shell none | ||
22 | |||
23 | disable-mnt | ||
24 | private-bin freetube | ||
25 | private-cache | ||
26 | private-dev | ||
27 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg | ||
28 | private-tmp | ||
29 | |||
30 | # Redirect | ||
31 | include electron.profile | ||
diff --git a/etc/freshclam.profile b/etc/profile-a-l/freshclam.profile index 2bab79e2e..2bab79e2e 100644 --- a/etc/freshclam.profile +++ b/etc/profile-a-l/freshclam.profile | |||
diff --git a/etc/profile-a-l/frogatto.profile b/etc/profile-a-l/frogatto.profile new file mode 100644 index 000000000..653272499 --- /dev/null +++ b/etc/profile-a-l/frogatto.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for frogatto | ||
2 | # Description: 2D platformer game starring a quixotic frog | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include frogatto.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.frogatto | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.frogatto | ||
20 | whitelist ${HOME}/.frogatto | ||
21 | whitelist /usr/share/frogatto | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin frogatto,sh | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc machine-id | ||
47 | private-tmp | ||
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/frozen-bubble.profile b/etc/profile-a-l/frozen-bubble.profile index 6cef181c8..9245ae3a9 100644 --- a/etc/frozen-bubble.profile +++ b/etc/profile-a-l/frozen-bubble.profile | |||
@@ -13,18 +13,23 @@ include allow-perl.inc | |||
13 | 13 | ||
14 | include disable-common.inc | 14 | include disable-common.inc |
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-xdg.inc | ||
19 | 21 | ||
20 | mkdir ${HOME}/.frozen-bubble | 22 | mkdir ${HOME}/.frozen-bubble |
21 | whitelist ${HOME}/.frozen-bubble | 23 | whitelist ${HOME}/.frozen-bubble |
24 | whitelist /usr/share/perl5 | ||
22 | include whitelist-common.inc | 25 | include whitelist-common.inc |
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
24 | 29 | ||
30 | apparmor | ||
25 | caps.drop all | 31 | caps.drop all |
26 | net none | 32 | net none |
27 | nodbus | ||
28 | nodvd | 33 | nodvd |
29 | nogroups | 34 | nogroups |
30 | nonewprivs | 35 | nonewprivs |
@@ -35,8 +40,12 @@ novideo | |||
35 | protocol unix,netlink | 40 | protocol unix,netlink |
36 | seccomp | 41 | seccomp |
37 | shell none | 42 | shell none |
43 | tracelog | ||
38 | 44 | ||
39 | disable-mnt | 45 | disable-mnt |
40 | # private-bin frozen-bubble | 46 | # private-bin frozen-bubble |
41 | private-dev | 47 | private-dev |
42 | private-tmp | 48 | private-tmp |
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/gajim-history-manager.profile b/etc/profile-a-l/gajim-history-manager.profile index 2ae6dd9d8..2ae6dd9d8 100644 --- a/etc/gajim-history-manager.profile +++ b/etc/profile-a-l/gajim-history-manager.profile | |||
diff --git a/etc/gajim.profile b/etc/profile-a-l/gajim.profile index 85d9b9bd9..85d9b9bd9 100644 --- a/etc/gajim.profile +++ b/etc/profile-a-l/gajim.profile | |||
diff --git a/etc/galculator.profile b/etc/profile-a-l/galculator.profile index f757aed69..89f20b923 100644 --- a/etc/galculator.profile +++ b/etc/profile-a-l/galculator.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.config/galculator | 20 | mkdir ${HOME}/.config/galculator |
@@ -26,7 +27,6 @@ caps.drop all | |||
26 | #hostname galculator - breaks Arch Linux | 27 | #hostname galculator - breaks Arch Linux |
27 | #ipc-namespace | 28 | #ipc-namespace |
28 | net none | 29 | net none |
29 | nodbus | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -47,4 +47,7 @@ private-etc alternatives,fonts | |||
47 | private-lib | 47 | private-lib |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
50 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 53 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/profile-a-l/gapplication.profile b/etc/profile-a-l/gapplication.profile new file mode 100644 index 000000000..74b468020 --- /dev/null +++ b/etc/profile-a-l/gapplication.profile | |||
@@ -0,0 +1,71 @@ | |||
1 | # Firejail profile for gapplication | ||
2 | # Description: D-Bus application launcher | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gapplication.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | blacklist ${RUNUSER}/wayland-* | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | include whitelist-common.inc | ||
21 | include whitelist-runuser-common.inc | ||
22 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | |||
25 | apparmor | ||
26 | caps.drop all | ||
27 | ipc-namespace | ||
28 | machine-id | ||
29 | net none | ||
30 | no3d | ||
31 | nodvd | ||
32 | nogroups | ||
33 | nonewprivs | ||
34 | noroot | ||
35 | nosound | ||
36 | notv | ||
37 | nou2f | ||
38 | novideo | ||
39 | protocol unix | ||
40 | seccomp | ||
41 | shell none | ||
42 | tracelog | ||
43 | x11 none | ||
44 | |||
45 | disable-mnt | ||
46 | private | ||
47 | private-bin gapplication | ||
48 | private-cache | ||
49 | private-dev | ||
50 | private-etc none | ||
51 | private-tmp | ||
52 | |||
53 | # Uncomment (or add to your gapplcation.local) the next line to filter D-Bus names. | ||
54 | # You might need to add additional dbus-user.talk rules. see 'gapplication list-apps'. | ||
55 | #dbus-user filter | ||
56 | dbus-user.talk org.gnome.Boxes | ||
57 | dbus-user.talk org.gnome.Builder | ||
58 | dbus-user.talk org.gnome.Calendar | ||
59 | dbus-user.talk org.gnome.ChromeGnomeShell | ||
60 | dbus-user.talk org.gnome.DejaDup | ||
61 | dbus-user.talk org.gnome.DiskUtility | ||
62 | dbus-user.talk org.gnome.Extensions | ||
63 | dbus-user.talk org.gnome.Maps | ||
64 | dbus-user.talk org.gnome.Nautilus | ||
65 | dbus-user.talk org.gnome.Shell.PortalHelper | ||
66 | dbus-user.talk org.gnome.Software | ||
67 | dbus-user.talk org.gnome.Weather | ||
68 | dbus-system none | ||
69 | |||
70 | memory-deny-write-execute | ||
71 | read-only ${HOME} | ||
diff --git a/etc/gcalccmd.profile b/etc/profile-a-l/gcalccmd.profile index 691d6b0c4..691d6b0c4 100644 --- a/etc/gcalccmd.profile +++ b/etc/profile-a-l/gcalccmd.profile | |||
diff --git a/etc/gcloud.profile b/etc/profile-a-l/gcloud.profile index 7ca99f420..46a862a21 100644 --- a/etc/gcloud.profile +++ b/etc/profile-a-l/gcloud.profile | |||
@@ -21,7 +21,6 @@ apparmor | |||
21 | caps.drop all | 21 | caps.drop all |
22 | machine-id | 22 | machine-id |
23 | netfilter | 23 | netfilter |
24 | nodbus | ||
25 | nodvd | 24 | nodvd |
26 | # required for sudo-free docker | 25 | # required for sudo-free docker |
27 | #nogroups | 26 | #nogroups |
@@ -38,3 +37,6 @@ disable-mnt | |||
38 | private-dev | 37 | private-dev |
39 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,localtime,nsswitch.conf,pki,resolv.conf,ssl | 38 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,localtime,nsswitch.conf,pki,resolv.conf,ssl |
40 | private-tmp | 39 | private-tmp |
40 | |||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/gconf-editor.profile b/etc/profile-a-l/gconf-editor.profile index cb39174e5..cb39174e5 100644 --- a/etc/gconf-editor.profile +++ b/etc/profile-a-l/gconf-editor.profile | |||
diff --git a/etc/gconf-merge-schema.profile b/etc/profile-a-l/gconf-merge-schema.profile index 619f801b0..619f801b0 100644 --- a/etc/gconf-merge-schema.profile +++ b/etc/profile-a-l/gconf-merge-schema.profile | |||
diff --git a/etc/gconf-merge-tree.profile b/etc/profile-a-l/gconf-merge-tree.profile index 2f6bfe5e5..2f6bfe5e5 100644 --- a/etc/gconf-merge-tree.profile +++ b/etc/profile-a-l/gconf-merge-tree.profile | |||
diff --git a/etc/gconf.profile b/etc/profile-a-l/gconf.profile index 96848575d..96848575d 100644 --- a/etc/gconf.profile +++ b/etc/profile-a-l/gconf.profile | |||
diff --git a/etc/gconfpkg.profile b/etc/profile-a-l/gconfpkg.profile index 5bfc1250a..5bfc1250a 100644 --- a/etc/gconfpkg.profile +++ b/etc/profile-a-l/gconfpkg.profile | |||
diff --git a/etc/gconftool-2.profile b/etc/profile-a-l/gconftool-2.profile index 947e4252f..947e4252f 100644 --- a/etc/gconftool-2.profile +++ b/etc/profile-a-l/gconftool-2.profile | |||
diff --git a/etc/geany.profile b/etc/profile-a-l/geany.profile index 31599e32a..31599e32a 100644 --- a/etc/geany.profile +++ b/etc/profile-a-l/geany.profile | |||
diff --git a/etc/geary.profile b/etc/profile-a-l/geary.profile index eb427c077..fa01d04b7 100644 --- a/etc/geary.profile +++ b/etc/profile-a-l/geary.profile | |||
@@ -10,7 +10,8 @@ include geary.local | |||
10 | # Users have Geary set to open a browser by clicking a link in an email | 10 | # Users have Geary set to open a browser by clicking a link in an email |
11 | # We are not allowed to blacklist browser-specific directories | 11 | # We are not allowed to blacklist browser-specific directories |
12 | 12 | ||
13 | ignore nodbus | 13 | ignore dbus-user none |
14 | ignore dbus-system none | ||
14 | ignore private-tmp | 15 | ignore private-tmp |
15 | 16 | ||
16 | noblacklist ${HOME}/.gnupg | 17 | noblacklist ${HOME}/.gnupg |
diff --git a/etc/gedit.profile b/etc/profile-a-l/gedit.profile index a4471077a..17b7ad563 100644 --- a/etc/gedit.profile +++ b/etc/profile-a-l/gedit.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | 21 | ||
22 | include whitelist-runuser-common.inc | ||
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
24 | # apparmor - makes settings immutable | 25 | # apparmor - makes settings immutable |
@@ -26,7 +27,6 @@ caps.drop all | |||
26 | machine-id | 27 | machine-id |
27 | # net none - makes settings immutable | 28 | # net none - makes settings immutable |
28 | no3d | 29 | no3d |
29 | # nodbus - makes settings immutable | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -46,3 +46,6 @@ private-dev | |||
46 | #private-lib aspell,gconv,gedit,libgspell-1.so.*,libgtksourceview-*,libpeas-gtk-1.0.so.*,libreadline.so.*,libtinfo.so.* | 46 | #private-lib aspell,gconv,gedit,libgspell-1.so.*,libgtksourceview-*,libpeas-gtk-1.0.so.*,libreadline.so.*,libtinfo.so.* |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | # makes settings immutable | ||
50 | # dbus-user none | ||
51 | # dbus-system none | ||
diff --git a/etc/geekbench.profile b/etc/profile-a-l/geekbench.profile index 6398505ed..e06a9afad 100644 --- a/etc/geekbench.profile +++ b/etc/profile-a-l/geekbench.profile | |||
@@ -25,7 +25,6 @@ ipc-namespace | |||
25 | machine-id | 25 | machine-id |
26 | netfilter | 26 | netfilter |
27 | no3d | 27 | no3d |
28 | nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -48,6 +47,9 @@ private-lib gcc/*/*/libstdc++.so.* | |||
48 | private-opt none | 47 | private-opt none |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
51 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 53 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
52 | 54 | ||
53 | read-only ${HOME} | 55 | read-only ${HOME} |
diff --git a/etc/geeqie.profile b/etc/profile-a-l/geeqie.profile index 8810ca161..8810ca161 100644 --- a/etc/geeqie.profile +++ b/etc/profile-a-l/geeqie.profile | |||
diff --git a/etc/gfeeds.profile b/etc/profile-a-l/gfeeds.profile index d332c1bbe..d97ab530b 100644 --- a/etc/gfeeds.profile +++ b/etc/profile-a-l/gfeeds.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | mkdir ${HOME}/.cache/gfeeds | 25 | mkdir ${HOME}/.cache/gfeeds |
@@ -29,6 +30,7 @@ whitelist ${HOME}/.cache/org.gabmus.gfeeds | |||
29 | whitelist ${HOME}/.config/org.gabmus.gfeeds.json | 30 | whitelist ${HOME}/.config/org.gabmus.gfeeds.json |
30 | whitelist /usr/share/gfeeds | 31 | whitelist /usr/share/gfeeds |
31 | include whitelist-common.inc | 32 | include whitelist-common.inc |
33 | include whitelist-runuser-common.inc | ||
32 | include whitelist-usr-share-common.inc | 34 | include whitelist-usr-share-common.inc |
33 | include whitelist-var-common.inc | 35 | include whitelist-var-common.inc |
34 | 36 | ||
@@ -37,7 +39,6 @@ caps.drop all | |||
37 | machine-id | 39 | machine-id |
38 | netfilter | 40 | netfilter |
39 | no3d | 41 | no3d |
40 | #nodbus | ||
41 | nodvd | 42 | nodvd |
42 | nogroups | 43 | nogroups |
43 | nonewprivs | 44 | nonewprivs |
@@ -57,3 +58,8 @@ private-bin gfeeds,python3* | |||
57 | private-dev | 58 | private-dev |
58 | private-etc alternatives,ca-certificates,crypto-policies,dbus-1,dconf,fonts,gconf,group,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,passwd,pki,protocols,resolv.conf,rpc,services,ssl,X11,xdg | 59 | private-etc alternatives,ca-certificates,crypto-policies,dbus-1,dconf,fonts,gconf,group,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,passwd,pki,protocols,resolv.conf,rpc,services,ssl,X11,xdg |
59 | private-tmp | 60 | private-tmp |
61 | |||
62 | dbus-user filter | ||
63 | dbus-user.own org.gabmus.gfeeds | ||
64 | dbus-user.talk ca.desrt.dconf | ||
65 | dbus-system none | ||
diff --git a/etc/ghb.profile b/etc/profile-a-l/ghb.profile index 1e7ce2350..1e7ce2350 100644 --- a/etc/ghb.profile +++ b/etc/profile-a-l/ghb.profile | |||
diff --git a/etc/ghostwriter.profile b/etc/profile-a-l/ghostwriter.profile index 27becf8fe..5bb410278 100644 --- a/etc/ghostwriter.profile +++ b/etc/profile-a-l/ghostwriter.profile | |||
@@ -17,13 +17,15 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | #whitelist /usr/share/ghostwriter | 23 | whitelist /usr/share/ghostwriter |
23 | #whitelist /usr/share/mozilla-dicts | 24 | whitelist /usr/share/mozilla-dicts |
24 | #whitelist /usr/share/texlive | 25 | whitelist /usr/share/texlive |
25 | #whitelist /usr/share/pandoc* | 26 | whitelist /usr/share/pandoc* |
26 | #include whitelist-usr-share-common.inc | 27 | include whitelist-runuser-common.inc |
28 | include whitelist-usr-share-common.inc | ||
27 | 29 | ||
28 | apparmor | 30 | apparmor |
29 | caps.drop all | 31 | caps.drop all |
@@ -48,3 +50,6 @@ private-dev | |||
48 | # passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed | 50 | # passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed |
49 | private-etc alternatives,ca-certificates,crypto-policies,dbus-1,dconf,firejail,fonts,gconf,groups,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,machine-id,mime.types,nsswitch.conf,pango,passwd,pki,protocols,resolv.conf,rpc,services,ssl,texlive,Trolltech.conf,X11,xdg | 51 | private-etc alternatives,ca-certificates,crypto-policies,dbus-1,dconf,firejail,fonts,gconf,groups,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,machine-id,mime.types,nsswitch.conf,pango,passwd,pki,protocols,resolv.conf,rpc,services,ssl,texlive,Trolltech.conf,X11,xdg |
50 | private-tmp | 52 | private-tmp |
53 | |||
54 | dbus-user none | ||
55 | dbus-system none | ||
diff --git a/etc/gimp-2.10.profile b/etc/profile-a-l/gimp-2.10.profile index dbf49ac22..dbf49ac22 100644 --- a/etc/gimp-2.10.profile +++ b/etc/profile-a-l/gimp-2.10.profile | |||
diff --git a/etc/gimp-2.8.profile b/etc/profile-a-l/gimp-2.8.profile index dbf49ac22..dbf49ac22 100644 --- a/etc/gimp-2.8.profile +++ b/etc/profile-a-l/gimp-2.8.profile | |||
diff --git a/etc/gimp.profile b/etc/profile-a-l/gimp.profile index 94035bc02..8093c0c39 100644 --- a/etc/gimp.profile +++ b/etc/profile-a-l/gimp.profile | |||
@@ -36,7 +36,6 @@ include whitelist-var-common.inc | |||
36 | apparmor | 36 | apparmor |
37 | caps.drop all | 37 | caps.drop all |
38 | net none | 38 | net none |
39 | nodbus | ||
40 | nodvd | 39 | nodvd |
41 | nogroups | 40 | nogroups |
42 | nonewprivs | 41 | nonewprivs |
@@ -51,3 +50,6 @@ tracelog | |||
51 | 50 | ||
52 | private-dev | 51 | private-dev |
53 | private-tmp | 52 | private-tmp |
53 | |||
54 | dbus-user none | ||
55 | dbus-system none | ||
diff --git a/etc/gist-paste.profile b/etc/profile-a-l/gist-paste.profile index 56b3176ed..56b3176ed 100644 --- a/etc/gist-paste.profile +++ b/etc/profile-a-l/gist-paste.profile | |||
diff --git a/etc/gist.profile b/etc/profile-a-l/gist.profile index 59fcb2775..681fc2829 100644 --- a/etc/gist.profile +++ b/etc/profile-a-l/gist.profile | |||
@@ -36,7 +36,6 @@ ipc-namespace | |||
36 | machine-id | 36 | machine-id |
37 | netfilter | 37 | netfilter |
38 | no3d | 38 | no3d |
39 | nodbus | ||
40 | nodvd | 39 | nodvd |
41 | nogroups | 40 | nogroups |
42 | nonewprivs | 41 | nonewprivs |
@@ -56,4 +55,7 @@ private-dev | |||
56 | private-etc alternatives | 55 | private-etc alternatives |
57 | private-tmp | 56 | private-tmp |
58 | 57 | ||
58 | dbus-user none | ||
59 | dbus-system none | ||
60 | |||
59 | memory-deny-write-execute | 61 | memory-deny-write-execute |
diff --git a/etc/profile-a-l/git-cola.profile b/etc/profile-a-l/git-cola.profile new file mode 100644 index 000000000..30e80f519 --- /dev/null +++ b/etc/profile-a-l/git-cola.profile | |||
@@ -0,0 +1,66 @@ | |||
1 | # Firejail profile for git-cola | ||
2 | # Description: Linux native frontend for Git | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include git-cola.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore noexec ${HOME} | ||
10 | |||
11 | noblacklist ${HOME}/.gitconfig | ||
12 | noblacklist ${HOME}/.git-credentials | ||
13 | noblacklist ${HOME}/.gnupg | ||
14 | noblacklist ${HOME}/.ssh | ||
15 | noblacklist ${HOME}/.config/git | ||
16 | noblacklist ${HOME}/.config/git-cola | ||
17 | # Put your editor,diff viewer config path below and uncomment to load settings | ||
18 | # noblacklist ${HOME}/ | ||
19 | |||
20 | include allow-python2.inc | ||
21 | include allow-python3.inc | ||
22 | |||
23 | include disable-common.inc | ||
24 | include disable-devel.inc | ||
25 | include disable-exec.inc | ||
26 | include disable-interpreters.inc | ||
27 | include disable-passwdmgr.inc | ||
28 | include disable-programs.inc | ||
29 | include disable-xdg.inc | ||
30 | |||
31 | include whitelist-runuser-common.inc | ||
32 | include whitelist-var-common.inc | ||
33 | |||
34 | apparmor | ||
35 | caps.drop all | ||
36 | machine-id | ||
37 | netfilter | ||
38 | no3d | ||
39 | nodvd | ||
40 | nogroups | ||
41 | nonewprivs | ||
42 | noroot | ||
43 | nosound | ||
44 | notv | ||
45 | nou2f | ||
46 | novideo | ||
47 | protocol unix,inet,inet6,netlink | ||
48 | seccomp | ||
49 | shell none | ||
50 | tracelog | ||
51 | |||
52 | # private-bin atom,bash,colordiff,emacs,fldiff,geany,gedit,git,git gui,git-cola,git-dag,gitk,gpg,gvim,leafpad,meld,mousepad,nano,notepadqq,python*,sh,ssh,vim,vimdiff,which,xed | ||
53 | private-cache | ||
54 | private-dev | ||
55 | # Comment if you sign commits with GPG | ||
56 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,localtime,login.defs,machine-id,mime.types,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,X11,xdg | ||
57 | private-tmp | ||
58 | |||
59 | dbus-user filter | ||
60 | # Uncomment if you need keyring access | ||
61 | # dbus-user.talk org.freedesktop.secrets | ||
62 | dbus-system none | ||
63 | |||
64 | read-only ${HOME}/.ssh | ||
65 | read-only ${HOME}/.gnupg | ||
66 | read-only ${HOME}/.git-credentials | ||
diff --git a/etc/git.profile b/etc/profile-a-l/git.profile index e5a2f3985..e5a2f3985 100644 --- a/etc/git.profile +++ b/etc/profile-a-l/git.profile | |||
diff --git a/etc/gitg.profile b/etc/profile-a-l/gitg.profile index 56f8e136f..71b8e9b11 100644 --- a/etc/gitg.profile +++ b/etc/profile-a-l/gitg.profile | |||
@@ -19,7 +19,16 @@ include disable-interpreters.inc | |||
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | 21 | ||
22 | #whitelist ${HOME}/YOUR_GIT_PROJECTS_DIRECTORY | ||
23 | #whitelist ${HOME}/.config/git | ||
24 | #whitelist ${HOME}/.gitconfig | ||
25 | #whitelist ${HOME}/.git-credentials | ||
26 | #whitelist ${HOME}/.local/share/gitg | ||
27 | #whitelist ${HOME}/.ssh | ||
28 | #include whitelist-common.inc | ||
29 | |||
22 | whitelist /usr/share/gitg | 30 | whitelist /usr/share/gitg |
31 | include whitelist-runuser-common.inc | ||
23 | include whitelist-usr-share-common.inc | 32 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | 33 | include whitelist-var-common.inc |
25 | 34 | ||
@@ -43,3 +52,10 @@ private-bin git,gitg,ssh | |||
43 | private-cache | 52 | private-cache |
44 | private-dev | 53 | private-dev |
45 | private-tmp | 54 | private-tmp |
55 | |||
56 | dbus-user filter | ||
57 | dbus-user.own org.gnome.gitg | ||
58 | dbus-user.talk ca.desrt.dconf | ||
59 | # Uncomment (or put in your gitg.local) if you need keyring access. | ||
60 | #dbus-user.talk org.freedesktop.secrets | ||
61 | dbus-system none | ||
diff --git a/etc/github-desktop.profile b/etc/profile-a-l/github-desktop.profile index b25b138ad..152396553 100644 --- a/etc/github-desktop.profile +++ b/etc/profile-a-l/github-desktop.profile | |||
@@ -30,7 +30,7 @@ notv | |||
30 | nou2f | 30 | nou2f |
31 | novideo | 31 | novideo |
32 | protocol unix,inet,inet6,netlink | 32 | protocol unix,inet,inet6,netlink |
33 | seccomp | 33 | seccomp !chroot |
34 | 34 | ||
35 | # Note: On debian-based distributions the binary might be located in | 35 | # Note: On debian-based distributions the binary might be located in |
36 | # /opt/GitHub Desktop/github-desktop, and therefore not be in PATH. | 36 | # /opt/GitHub Desktop/github-desktop, and therefore not be in PATH. |
diff --git a/etc/gitter.profile b/etc/profile-a-l/gitter.profile index 017b1765a..017b1765a 100644 --- a/etc/gitter.profile +++ b/etc/profile-a-l/gitter.profile | |||
diff --git a/etc/gjs.profile b/etc/profile-a-l/gjs.profile index 85dd57f29..9c8848b8a 100644 --- a/etc/gjs.profile +++ b/etc/profile-a-l/gjs.profile | |||
@@ -22,6 +22,7 @@ include disable-interpreters.inc | |||
22 | include disable-passwdmgr.inc | 22 | include disable-passwdmgr.inc |
23 | include disable-programs.inc | 23 | include disable-programs.inc |
24 | 24 | ||
25 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
27 | 28 | ||
diff --git a/etc/globaltime.profile b/etc/profile-a-l/globaltime.profile index bb78a608e..bb78a608e 100644 --- a/etc/globaltime.profile +++ b/etc/profile-a-l/globaltime.profile | |||
diff --git a/etc/gmpc.profile b/etc/profile-a-l/gmpc.profile index b1546db30..b3aad8b2c 100644 --- a/etc/gmpc.profile +++ b/etc/profile-a-l/gmpc.profile | |||
@@ -30,7 +30,6 @@ caps.drop all | |||
30 | ipc-namespace | 30 | ipc-namespace |
31 | netfilter | 31 | netfilter |
32 | no3d | 32 | no3d |
33 | #nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nogroups | 34 | nogroups |
36 | nonewprivs | 35 | nonewprivs |
@@ -50,4 +49,7 @@ private-etc alternatives,fonts | |||
50 | private-tmp | 49 | private-tmp |
51 | writable-run-user | 50 | writable-run-user |
52 | 51 | ||
52 | # dbus-user none | ||
53 | # dbus-system none | ||
54 | |||
53 | # memory-deny-write-execute - breaks on Arch | 55 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/profile-a-l/gnome-2048.profile b/etc/profile-a-l/gnome-2048.profile new file mode 100644 index 000000000..777c81dbe --- /dev/null +++ b/etc/profile-a-l/gnome-2048.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for gnome-2048 | ||
2 | # Description: Sliding tile puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-2048.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/gnome-2048 | ||
10 | |||
11 | mkdir ${HOME}/.local/share/gnome-2048 | ||
12 | whitelist ${HOME}/.local/share/gnome-2048 | ||
13 | |||
14 | private-bin gnome-2048 | ||
15 | |||
16 | dbus-user.own org.gnome.TwentyFortyEight | ||
17 | |||
18 | # Redirect | ||
19 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-books.profile b/etc/profile-a-l/gnome-books.profile index 84e38d0e1..998109ca7 100644 --- a/etc/gnome-books.profile +++ b/etc/profile-a-l/gnome-books.profile | |||
@@ -23,8 +23,9 @@ include disable-xdg.inc | |||
23 | 23 | ||
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
25 | 25 | ||
26 | apparmor | ||
26 | caps.drop all | 27 | caps.drop all |
27 | netfilter | 28 | net none |
28 | no3d | 29 | no3d |
29 | nodvd | 30 | nodvd |
30 | nogroups | 31 | nogroups |
diff --git a/etc/gnome-builder.profile b/etc/profile-a-l/gnome-builder.profile index eaf48931d..7a684dd59 100644 --- a/etc/gnome-builder.profile +++ b/etc/profile-a-l/gnome-builder.profile | |||
@@ -17,6 +17,8 @@ include disable-common.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-runuser-common.inc | ||
21 | |||
20 | caps.drop all | 22 | caps.drop all |
21 | ipc-namespace | 23 | ipc-namespace |
22 | netfilter | 24 | netfilter |
diff --git a/etc/gnome-calculator.profile b/etc/profile-a-l/gnome-calculator.profile index 6709a331e..ceb01f2a0 100644 --- a/etc/gnome-calculator.profile +++ b/etc/profile-a-l/gnome-calculator.profile | |||
@@ -13,9 +13,11 @@ include disable-exec.inc | |||
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | include disable-xdg.inc | 17 | include disable-xdg.inc |
17 | 18 | ||
18 | include whitelist-common.inc | 19 | include whitelist-common.inc |
20 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
21 | 23 | ||
@@ -23,10 +25,9 @@ apparmor | |||
23 | caps.drop all | 25 | caps.drop all |
24 | ipc-namespace | 26 | ipc-namespace |
25 | machine-id | 27 | machine-id |
26 | # net none | 28 | #net none -- breaks currency conversion |
27 | netfilter | 29 | netfilter |
28 | no3d | 30 | no3d |
29 | # nodbus - makes settings immutable | ||
30 | nodvd | 31 | nodvd |
31 | nogroups | 32 | nogroups |
32 | nonewprivs | 33 | nonewprivs |
@@ -38,6 +39,7 @@ novideo | |||
38 | protocol unix,inet,inet6 | 39 | protocol unix,inet,inet6 |
39 | seccomp | 40 | seccomp |
40 | shell none | 41 | shell none |
42 | tracelog | ||
41 | 43 | ||
42 | disable-mnt | 44 | disable-mnt |
43 | private-bin gnome-calculator | 45 | private-bin gnome-calculator |
@@ -46,4 +48,7 @@ private-dev | |||
46 | #private-lib gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.*,libgnutls.so.*,libproxy.so.*,librsvg-2.so.*,libxml2.so.* | 48 | #private-lib gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.*,libgnutls.so.*,libproxy.so.*,librsvg-2.so.*,libxml2.so.* |
47 | private-tmp | 49 | private-tmp |
48 | 50 | ||
49 | # memory-deny-write-execute | 51 | dbus-user filter |
52 | dbus-user.own org.gnome.Calculator | ||
53 | dbus-user.talk ca.desrt.dconf | ||
54 | dbus-system none | ||
diff --git a/etc/profile-a-l/gnome-calendar.profile b/etc/profile-a-l/gnome-calendar.profile new file mode 100644 index 000000000..3e815234c --- /dev/null +++ b/etc/profile-a-l/gnome-calendar.profile | |||
@@ -0,0 +1,62 @@ | |||
1 | # Firejail profile for gnome-calendar | ||
2 | # Description: Calendar for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-calendar.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | whitelist /usr/share/libgweather | ||
19 | include whitelist-common.inc | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | machine-id | ||
27 | netfilter | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix,inet,inet6 | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private | ||
44 | private-bin gnome-calendar | ||
45 | private-cache | ||
46 | private-dev | ||
47 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,nsswitch.conf,pki,resolv.conf,ssl | ||
48 | private-tmp | ||
49 | |||
50 | dbus-user filter | ||
51 | dbus-user.own org.gnome.Calendar | ||
52 | dbus-user.talk ca.desrt.dconf | ||
53 | dbus-user.talk org.gnome.evolution.dataserver.* | ||
54 | #dbus-user.talk org.gnome.OnlineAccounts | ||
55 | #dbus-user.talk org.gnome.ControlCenter | ||
56 | # NOTE: dbus-system none fails, filter without rules works. | ||
57 | dbus-system filter | ||
58 | #dbus-system.talk org.freedesktop.timedate1 | ||
59 | #dbus-system.talk org.freedesktop.login1 | ||
60 | #dbus-system.talk org.freedesktop.GeoClue2 | ||
61 | |||
62 | read-only ${HOME} | ||
diff --git a/etc/gnome-character-map.profile b/etc/profile-a-l/gnome-character-map.profile index 27804fdd0..27804fdd0 100644 --- a/etc/gnome-character-map.profile +++ b/etc/profile-a-l/gnome-character-map.profile | |||
diff --git a/etc/gnome-characters.profile b/etc/profile-a-l/gnome-characters.profile index 2d4724610..f4f3ae2d7 100644 --- a/etc/gnome-characters.profile +++ b/etc/profile-a-l/gnome-characters.profile | |||
@@ -15,20 +15,20 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | whitelist /usr/share/org.gnome.Characters | 21 | whitelist /usr/share/org.gnome.Characters |
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | ||
22 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
23 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
24 | 26 | ||
27 | apparmor | ||
25 | caps.drop all | 28 | caps.drop all |
26 | machine-id | 29 | machine-id |
27 | net none | 30 | net none |
28 | no3d | 31 | no3d |
29 | # Uncomment the next line (or add it to your gnome-characters.local) | ||
30 | # if you don't need recently used chars | ||
31 | #nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -52,4 +52,9 @@ private-dev | |||
52 | private-etc alternatives,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,pango,X11,xdg | 52 | private-etc alternatives,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,pango,X11,xdg |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | # Uncomment the next lines (or add it to your gnome-characters.local) | ||
56 | # if you don't need recently used chars | ||
57 | # dbus-user none | ||
58 | # dbus-system none | ||
59 | |||
55 | read-only ${HOME} | 60 | read-only ${HOME} |
diff --git a/etc/gnome-chess.profile b/etc/profile-a-l/gnome-chess.profile index e657293ac..84a3cabd6 100644 --- a/etc/gnome-chess.profile +++ b/etc/profile-a-l/gnome-chess.profile | |||
@@ -6,6 +6,7 @@ include gnome-chess.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.config/gnome-chess | ||
9 | noblacklist ${HOME}/.local/share/gnome-chess | 10 | noblacklist ${HOME}/.local/share/gnome-chess |
10 | 11 | ||
11 | include disable-common.inc | 12 | include disable-common.inc |
@@ -14,8 +15,17 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 19 | include disable-xdg.inc |
18 | 20 | ||
21 | #mkdir ${HOME}/.local/share/gnome-chess | ||
22 | #whitelist ${HOME}/.local/share/gnome-chess | ||
23 | #include whitelist-common.inc | ||
24 | |||
25 | whitelist /usr/share/gnuchess | ||
26 | whitelist /usr/share/gnome-chess | ||
27 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
19 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
20 | 30 | ||
21 | apparmor | 31 | apparmor |
diff --git a/etc/gnome-clocks.profile b/etc/profile-a-l/gnome-clocks.profile index 025335a23..fc899178f 100644 --- a/etc/gnome-clocks.profile +++ b/etc/profile-a-l/gnome-clocks.profile | |||
@@ -12,11 +12,13 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | whitelist /usr/share/gnome-clocks | 18 | whitelist /usr/share/gnome-clocks |
18 | whitelist /usr/share/libgweather | 19 | whitelist /usr/share/libgweather |
19 | include whitelist-common.inc | 20 | include whitelist-common.inc |
21 | include whitelist-runuser-common.inc | ||
20 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
21 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
22 | 24 | ||
diff --git a/etc/gnome-contacts.profile b/etc/profile-a-l/gnome-contacts.profile index ac6d82451..7a38bdc8a 100644 --- a/etc/gnome-contacts.profile +++ b/etc/profile-a-l/gnome-contacts.profile | |||
@@ -17,11 +17,12 @@ include disable-programs.inc | |||
17 | include disable-xdg.inc | 17 | include disable-xdg.inc |
18 | 18 | ||
19 | include whitelist-common.inc | 19 | include whitelist-common.inc |
20 | include whitelist-runuser-common.inc | ||
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
22 | caps.drop all | 23 | caps.drop all |
23 | netfilter | 24 | netfilter |
24 | no3d | 25 | #no3d - breaks on Arch |
25 | nodvd | 26 | nodvd |
26 | nonewprivs | 27 | nonewprivs |
27 | noroot | 28 | noroot |
diff --git a/etc/gnome-documents.profile b/etc/profile-a-l/gnome-documents.profile index 705fe624e..705fe624e 100644 --- a/etc/gnome-documents.profile +++ b/etc/profile-a-l/gnome-documents.profile | |||
diff --git a/etc/gnome-font-viewer.profile b/etc/profile-a-l/gnome-font-viewer.profile index 468ef0401..b2327133c 100644 --- a/etc/gnome-font-viewer.profile +++ b/etc/profile-a-l/gnome-font-viewer.profile | |||
@@ -17,8 +17,9 @@ include disable-xdg.inc | |||
17 | 17 | ||
18 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
19 | 19 | ||
20 | apparmor | ||
20 | caps.drop all | 21 | caps.drop all |
21 | netfilter | 22 | net none |
22 | no3d | 23 | no3d |
23 | nodvd | 24 | nodvd |
24 | nonewprivs | 25 | nonewprivs |
diff --git a/etc/gnome-hexgl.profile b/etc/profile-a-l/gnome-hexgl.profile index 386c33d7f..5ae7bbe01 100644 --- a/etc/gnome-hexgl.profile +++ b/etc/profile-a-l/gnome-hexgl.profile | |||
@@ -12,19 +12,18 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | mkdir ${HOME}/.cache/mesa_shader_cache | 18 | mkdir ${HOME}/.cache/mesa_shader_cache |
18 | whitelist ${RUNUSER}/pulse | ||
19 | whitelist ${RUNUSER}/wayland-0 | ||
20 | whitelist /usr/share/gnome-hexgl | 19 | whitelist /usr/share/gnome-hexgl |
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | apparmor | 24 | apparmor |
25 | caps.drop all | 25 | caps.drop all |
26 | net none | 26 | net none |
27 | nodbus | ||
28 | nodvd | 27 | nodvd |
29 | nogroups | 28 | nogroups |
30 | nonewprivs | 29 | nonewprivs |
@@ -42,8 +41,11 @@ private | |||
42 | private-bin gnome-hexgl | 41 | private-bin gnome-hexgl |
43 | private-cache | 42 | private-cache |
44 | private-dev | 43 | private-dev |
45 | private-etc machine-id | 44 | private-etc alsa,asound.conf,machine-id,pulse |
46 | private-tmp | 45 | private-tmp |
47 | 46 | ||
47 | dbus-user none | ||
48 | dbus-system none | ||
49 | |||
48 | read-only ${HOME} | 50 | read-only ${HOME} |
49 | read-write ${HOME}/.cache/mesa_shader_cache | 51 | read-write ${HOME}/.cache/mesa_shader_cache |
diff --git a/etc/gnome-keyring-3.profile b/etc/profile-a-l/gnome-keyring-3.profile index e9961e4f0..e9961e4f0 100644 --- a/etc/gnome-keyring-3.profile +++ b/etc/profile-a-l/gnome-keyring-3.profile | |||
diff --git a/etc/gnome-keyring.profile b/etc/profile-a-l/gnome-keyring.profile index 7e2d701b7..ecbb74158 100644 --- a/etc/gnome-keyring.profile +++ b/etc/profile-a-l/gnome-keyring.profile | |||
@@ -31,7 +31,6 @@ ipc-namespace | |||
31 | machine-id | 31 | machine-id |
32 | netfilter | 32 | netfilter |
33 | no3d | 33 | no3d |
34 | # nodbus | ||
35 | nodvd | 34 | nodvd |
36 | nogroups | 35 | nogroups |
37 | nonewprivs | 36 | nonewprivs |
@@ -52,4 +51,7 @@ private-dev | |||
52 | #private-lib alternatives,gnome-keyring,libsecret-1.so.*,pkcs11,security | 51 | #private-lib alternatives,gnome-keyring,libsecret-1.so.*,pkcs11,security |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
54 | # dbus-user none | ||
55 | # dbus-system none | ||
56 | |||
55 | memory-deny-write-execute | 57 | memory-deny-write-execute |
diff --git a/etc/profile-a-l/gnome-klotski.profile b/etc/profile-a-l/gnome-klotski.profile new file mode 100644 index 000000000..c67a5c0da --- /dev/null +++ b/etc/profile-a-l/gnome-klotski.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for gnome-klotski | ||
2 | # Description: Sliding block puzzles game for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-klotski.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/gnome-klotski | ||
10 | |||
11 | mkdir ${HOME}/.local/share/gnome-klotski | ||
12 | whitelist ${HOME}/.local/share/gnome-klotski | ||
13 | |||
14 | private-bin gnome-klotski | ||
15 | |||
16 | dbus-user.own org.gnome.Klotski | ||
17 | |||
18 | # Redirect | ||
19 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-latex.profile b/etc/profile-a-l/gnome-latex.profile index 1bf48c6ab..eb5e9ec40 100644 --- a/etc/gnome-latex.profile +++ b/etc/profile-a-l/gnome-latex.profile | |||
@@ -22,6 +22,7 @@ include disable-programs.inc | |||
22 | whitelist /usr/share/gnome-latex | 22 | whitelist /usr/share/gnome-latex |
23 | whitelist /usr/share/perl5 | 23 | whitelist /usr/share/perl5 |
24 | whitelist /usr/share/texlive | 24 | whitelist /usr/share/texlive |
25 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
26 | # May cause issues. | 27 | # May cause issues. |
27 | #include whitelist-var-common.inc | 28 | #include whitelist-var-common.inc |
@@ -48,3 +49,5 @@ private-cache | |||
48 | private-dev | 49 | private-dev |
49 | # passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed | 50 | # passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed |
50 | private-etc alternatives,dconf,fonts,gtk-3.0,latexmk.conf,login.defs,passwd,texlive | 51 | private-etc alternatives,dconf,fonts,gtk-3.0,latexmk.conf,login.defs,passwd,texlive |
52 | |||
53 | dbus-system none | ||
diff --git a/etc/gnome-logs.profile b/etc/profile-a-l/gnome-logs.profile index 0c5bec144..41218d3f7 100644 --- a/etc/gnome-logs.profile +++ b/etc/profile-a-l/gnome-logs.profile | |||
@@ -12,9 +12,11 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | whitelist /var/log/journal | 18 | whitelist /var/log/journal |
19 | include whitelist-runuser-common.inc | ||
18 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
19 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
20 | 22 | ||
@@ -23,7 +25,6 @@ caps.drop all | |||
23 | ipc-namespace | 25 | ipc-namespace |
24 | net none | 26 | net none |
25 | no3d | 27 | no3d |
26 | nodbus | ||
27 | nodvd | 28 | nodvd |
28 | # When using 'volatile' storage (https://www.freedesktop.org/software/systemd/man/journald.conf.html), | 29 | # When using 'volatile' storage (https://www.freedesktop.org/software/systemd/man/journald.conf.html), |
29 | # comment both 'nogroups' and 'noroot' | 30 | # comment both 'nogroups' and 'noroot' |
@@ -49,6 +50,9 @@ private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.s | |||
49 | private-tmp | 50 | private-tmp |
50 | writable-var-log | 51 | writable-var-log |
51 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
52 | # comment this if you export logs to a file in your ${HOME} | 56 | # comment this if you export logs to a file in your ${HOME} |
53 | # or put 'ignore read-only ${HOME}' in your gnome-logs.local. | 57 | # or put 'ignore read-only ${HOME}' in your gnome-logs.local. |
54 | read-only ${HOME} | 58 | read-only ${HOME} |
diff --git a/etc/profile-a-l/gnome-mahjongg.profile b/etc/profile-a-l/gnome-mahjongg.profile new file mode 100644 index 000000000..42409dce8 --- /dev/null +++ b/etc/profile-a-l/gnome-mahjongg.profile | |||
@@ -0,0 +1,16 @@ | |||
1 | # Firejail profile for gnome-mahjongg | ||
2 | # Description: A matching game played with Mahjongg tiles | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-mahjongg.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | whitelist /usr/share/gnome-mahjongg | ||
10 | |||
11 | private-bin gnome-mahjongg | ||
12 | |||
13 | dbus-user.own org.gnome.Mahjongg | ||
14 | |||
15 | # Redirect | ||
16 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-maps.profile b/etc/profile-a-l/gnome-maps.profile index 62350b862..eb0030dda 100644 --- a/etc/gnome-maps.profile +++ b/etc/profile-a-l/gnome-maps.profile | |||
@@ -13,7 +13,6 @@ include globals.local | |||
13 | 13 | ||
14 | noblacklist ${HOME}/.cache/champlain | 14 | noblacklist ${HOME}/.cache/champlain |
15 | noblacklist ${HOME}/.cache/org.gnome.Maps | 15 | noblacklist ${HOME}/.cache/org.gnome.Maps |
16 | noblacklist ${HOME}/.local/share/flatpak | ||
17 | noblacklist ${HOME}/.local/share/maps-places.json | 16 | noblacklist ${HOME}/.local/share/maps-places.json |
18 | 17 | ||
19 | # Allow gjs (blacklisted by disable-interpreters.inc) | 18 | # Allow gjs (blacklisted by disable-interpreters.inc) |
@@ -25,6 +24,7 @@ include disable-exec.inc | |||
25 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
26 | include disable-passwdmgr.inc | 25 | include disable-passwdmgr.inc |
27 | include disable-programs.inc | 26 | include disable-programs.inc |
27 | include disable-shell.inc | ||
28 | include disable-xdg.inc | 28 | include disable-xdg.inc |
29 | 29 | ||
30 | mkdir ${HOME}/.cache/champlain | 30 | mkdir ${HOME}/.cache/champlain |
@@ -36,6 +36,7 @@ whitelist ${PICTURES} | |||
36 | whitelist /usr/share/gnome-maps | 36 | whitelist /usr/share/gnome-maps |
37 | whitelist /usr/share/libgweather | 37 | whitelist /usr/share/libgweather |
38 | include whitelist-common.inc | 38 | include whitelist-common.inc |
39 | include whitelist-runuser-common.inc | ||
39 | include whitelist-usr-share-common.inc | 40 | include whitelist-usr-share-common.inc |
40 | include whitelist-var-common.inc | 41 | include whitelist-var-common.inc |
41 | 42 | ||
@@ -62,3 +63,11 @@ private-bin gjs,gnome-maps | |||
62 | private-dev | 63 | private-dev |
63 | private-etc alternatives,ca-certificates,clutter-1.0,crypto-policies,dconf,drirc,fonts,gconf,gcrypt,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pango,pkcs11,pki,protocols,resolv.conf,rpc,services,ssl,X11,xdg | 64 | private-etc alternatives,ca-certificates,clutter-1.0,crypto-policies,dconf,drirc,fonts,gconf,gcrypt,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pango,pkcs11,pki,protocols,resolv.conf,rpc,services,ssl,X11,xdg |
64 | private-tmp | 65 | private-tmp |
66 | |||
67 | dbus-user filter | ||
68 | dbus-user.own org.gnome.Maps | ||
69 | #dbus-user.talk org.freedesktop.secrets | ||
70 | #dbus-user.talk org.gnome.OnlineAccounts | ||
71 | dbus-system filter | ||
72 | #dbus-system.talk org.freedesktop.NetworkManager | ||
73 | dbus-system.talk org.freedesktop.GeoClue2 | ||
diff --git a/etc/profile-a-l/gnome-mines.profile b/etc/profile-a-l/gnome-mines.profile new file mode 100644 index 000000000..4fe8986c2 --- /dev/null +++ b/etc/profile-a-l/gnome-mines.profile | |||
@@ -0,0 +1,20 @@ | |||
1 | # Firejail profile for gnome-mines | ||
2 | # Description: The popular logic puzzle minesweeper | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-mines.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/gnome-mines | ||
10 | |||
11 | mkdir ${HOME}/.local/share/gnome-mines | ||
12 | whitelist ${HOME}/.local/share/gnome-mines | ||
13 | whitelist /usr/share/gnome-mines | ||
14 | |||
15 | private-bin gnome-mines | ||
16 | |||
17 | dbus-user.own org.gnome.Mines | ||
18 | |||
19 | # Redirect | ||
20 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-mplayer.profile b/etc/profile-a-l/gnome-mplayer.profile index 12bee6448..12bee6448 100644 --- a/etc/gnome-mplayer.profile +++ b/etc/profile-a-l/gnome-mplayer.profile | |||
diff --git a/etc/gnome-mpv.profile b/etc/profile-a-l/gnome-mpv.profile index f5d652732..f5d652732 100644 --- a/etc/gnome-mpv.profile +++ b/etc/profile-a-l/gnome-mpv.profile | |||
diff --git a/etc/gnome-music.profile b/etc/profile-a-l/gnome-music.profile index ad3fa1753..36b46897c 100644 --- a/etc/gnome-music.profile +++ b/etc/profile-a-l/gnome-music.profile | |||
@@ -21,8 +21,10 @@ include disable-passwdmgr.inc | |||
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-xdg.inc | 22 | include disable-xdg.inc |
23 | 23 | ||
24 | include whitelist-runuser-common.inc | ||
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
27 | apparmor | ||
26 | caps.drop all | 28 | caps.drop all |
27 | netfilter | 29 | netfilter |
28 | no3d | 30 | no3d |
@@ -37,8 +39,9 @@ seccomp | |||
37 | shell none | 39 | shell none |
38 | tracelog | 40 | tracelog |
39 | 41 | ||
40 | private-bin env,gio-launch-desktop,gnome-music,python*,yelp | 42 | # private-bin calls a file manager - whatever is installed! |
43 | #private-bin env,gio-launch-desktop,gnome-music,python*,yelp | ||
41 | private-dev | 44 | private-dev |
42 | private-etc alternatives,asound.conf,fonts,machine-id,pulse | 45 | private-etc alternatives,asound.conf,dconf,fonts,fonts,gtk-3.0,machine-id,pulse,selinux,xdg |
43 | private-tmp | 46 | private-tmp |
44 | 47 | ||
diff --git a/etc/gnome-nettool.profile b/etc/profile-a-l/gnome-nettool.profile index d15299890..33eb9c81a 100644 --- a/etc/gnome-nettool.profile +++ b/etc/profile-a-l/gnome-nettool.profile | |||
@@ -16,6 +16,7 @@ include disable-xdg.inc | |||
16 | 16 | ||
17 | whitelist /usr/share/gnome-nettool | 17 | whitelist /usr/share/gnome-nettool |
18 | #include whitelist-common.inc -- see #903 | 18 | #include whitelist-common.inc -- see #903 |
19 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
@@ -24,7 +25,6 @@ ipc-namespace | |||
24 | machine-id | 25 | machine-id |
25 | netfilter | 26 | netfilter |
26 | no3d | 27 | no3d |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | # ping needs to elevate privileges, noroot and nonewprivs will kill it | 30 | # ping needs to elevate privileges, noroot and nonewprivs will kill it |
@@ -44,3 +44,5 @@ private-dev | |||
44 | private-lib libbind9.so.*,libcrypto.so.*,libdns.so.*,libgtk-3.so.*,libgtop*,libirs.so.*,liblua.so.*,libssh2.so.*,libssl.so.* | 44 | private-lib libbind9.so.*,libcrypto.so.*,libdns.so.*,libgtk-3.so.*,libgtop*,libirs.so.*,liblua.so.*,libssh2.so.*,libssl.so.* |
45 | private-tmp | 45 | private-tmp |
46 | 46 | ||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/profile-a-l/gnome-nibbles.profile b/etc/profile-a-l/gnome-nibbles.profile new file mode 100644 index 000000000..b22810d34 --- /dev/null +++ b/etc/profile-a-l/gnome-nibbles.profile | |||
@@ -0,0 +1,23 @@ | |||
1 | # Firejail profile for gnome-nibbles | ||
2 | # Description: A worm game for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-nibbles.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore machine-id | ||
10 | ignore nosound | ||
11 | |||
12 | noblacklist ${HOME}/.local/share/gnome-nibbles | ||
13 | |||
14 | mkdir ${HOME}/.local/share/gnome-nibbles | ||
15 | whitelist ${HOME}/.local/share/gnome-nibbles | ||
16 | whitelist /usr/share/gnome-nibbles | ||
17 | |||
18 | private-bin gnome-nibbles | ||
19 | |||
20 | dbus-user.own org.gnome.Nibbles | ||
21 | |||
22 | # Redirect | ||
23 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-passwordsafe.profile b/etc/profile-a-l/gnome-passwordsafe.profile index de8f6ad7d..615be7873 100644 --- a/etc/gnome-passwordsafe.profile +++ b/etc/profile-a-l/gnome-passwordsafe.profile | |||
@@ -19,15 +19,12 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | whitelist ${RUNUSER}/bus | ||
25 | # If you have a second wayland compositor, whitelist its socket here. | ||
26 | whitelist ${RUNUSER}/wayland-0 | ||
27 | whitelist ${RUNUSER}/gdm/Xauthority | ||
28 | |||
29 | whitelist /usr/share/cracklib | 25 | whitelist /usr/share/cracklib |
30 | whitelist /usr/share/passwordsafe | 26 | whitelist /usr/share/passwordsafe |
27 | include whitelist-runuser-common.inc | ||
31 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
32 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
33 | 30 | ||
diff --git a/etc/gnome-photos.profile b/etc/profile-a-l/gnome-photos.profile index aa0b7dbe3..2af406af9 100644 --- a/etc/gnome-photos.profile +++ b/etc/profile-a-l/gnome-photos.profile | |||
@@ -17,8 +17,10 @@ include disable-interpreters.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-runuser-common.inc | ||
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
23 | apparmor | ||
22 | caps.drop all | 24 | caps.drop all |
23 | netfilter | 25 | netfilter |
24 | nodvd | 26 | nodvd |
diff --git a/etc/gnome-pie.profile b/etc/profile-a-l/gnome-pie.profile index c1d2dae35..c1d2dae35 100644 --- a/etc/gnome-pie.profile +++ b/etc/profile-a-l/gnome-pie.profile | |||
diff --git a/etc/profile-a-l/gnome-pomodoro.profile b/etc/profile-a-l/gnome-pomodoro.profile new file mode 100644 index 000000000..a46e47759 --- /dev/null +++ b/etc/profile-a-l/gnome-pomodoro.profile | |||
@@ -0,0 +1,59 @@ | |||
1 | # Firejail profile for gnome-pomodoro | ||
2 | # Description: time management utility for GNOME based on the pomodoro technique | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-pomodoro.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/gnome-pomodoro | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.local/share/gnome-pomodoro | ||
20 | whitelist ${HOME}/.local/share/gnome-pomodoro | ||
21 | whitelist /usr/share/gnome-pomodoro | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | no3d | ||
31 | nodvd | ||
32 | nogroups | ||
33 | nonewprivs | ||
34 | noroot | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix | ||
39 | seccomp | ||
40 | shell none | ||
41 | tracelog | ||
42 | |||
43 | disable-mnt | ||
44 | private-bin gnome-pomodoro | ||
45 | private-cache | ||
46 | private-dev | ||
47 | private-etc dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id | ||
48 | private-tmp | ||
49 | |||
50 | dbus-user filter | ||
51 | dbus-user.own org.gnome.Pomodoro | ||
52 | dbus-user.talk ca.desrt.dconf | ||
53 | dbus-user.talk org.gnome.Mutter.IdleMonitor | ||
54 | dbus-user.talk org.gnome.Shell | ||
55 | dbus-user.talk org.freedesktop.Notifications | ||
56 | dbus-system none | ||
57 | |||
58 | read-only ${HOME} | ||
59 | read-write ${HOME}/.local/share/gnome-pomodoro | ||
diff --git a/etc/gnome-recipes.profile b/etc/profile-a-l/gnome-recipes.profile index b4791afc5..c4969590f 100644 --- a/etc/gnome-recipes.profile +++ b/etc/profile-a-l/gnome-recipes.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | 20 | ||
20 | mkdir ${HOME}/.cache/gnome-recipes | 21 | mkdir ${HOME}/.cache/gnome-recipes |
21 | mkdir ${HOME}/.local/share/gnome-recipes | 22 | mkdir ${HOME}/.local/share/gnome-recipes |
@@ -26,6 +27,7 @@ include whitelist-common.inc | |||
26 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
28 | 29 | ||
30 | apparmor | ||
29 | caps.drop all | 31 | caps.drop all |
30 | ipc-namespace | 32 | ipc-namespace |
31 | machine-id | 33 | machine-id |
diff --git a/etc/gnome-ring.profile b/etc/profile-a-l/gnome-ring.profile index 78ceb9c4f..78ceb9c4f 100644 --- a/etc/gnome-ring.profile +++ b/etc/profile-a-l/gnome-ring.profile | |||
diff --git a/etc/profile-a-l/gnome-robots.profile b/etc/profile-a-l/gnome-robots.profile new file mode 100644 index 000000000..8835f2b93 --- /dev/null +++ b/etc/profile-a-l/gnome-robots.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for gnome-robots | ||
2 | # Description: Based on classic BSD Robots | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-robots.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore machine-id | ||
10 | ignore nosound | ||
11 | |||
12 | whitelist /usr/share/gnome-robots | ||
13 | |||
14 | private-bin gnome-robots | ||
15 | |||
16 | dbus-user.own org.gnome.Robots | ||
17 | |||
18 | # Redirect | ||
19 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-schedule.profile b/etc/profile-a-l/gnome-schedule.profile index c8dd8ead7..55913a2d7 100644 --- a/etc/gnome-schedule.profile +++ b/etc/profile-a-l/gnome-schedule.profile | |||
@@ -39,6 +39,7 @@ whitelist /usr/share/gnome-schedule | |||
39 | whitelist /var/spool/atd | 39 | whitelist /var/spool/atd |
40 | whitelist /var/spool/cron | 40 | whitelist /var/spool/cron |
41 | include whitelist-common.inc | 41 | include whitelist-common.inc |
42 | include whitelist-runuser-common.inc | ||
42 | include whitelist-usr-share-common.inc | 43 | include whitelist-usr-share-common.inc |
43 | include whitelist-var-common.inc | 44 | include whitelist-var-common.inc |
44 | 45 | ||
diff --git a/etc/profile-a-l/gnome-screenshot.profile b/etc/profile-a-l/gnome-screenshot.profile new file mode 100644 index 000000000..82fb1b658 --- /dev/null +++ b/etc/profile-a-l/gnome-screenshot.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for gnome-screenshot | ||
2 | # Description: GNOME screenshot tool | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-screenshot.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${PICTURES} | ||
10 | noblacklist ${HOME}/.cache/gnome-screenshot | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-runuser-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | |||
25 | apparmor | ||
26 | caps.drop all | ||
27 | net none | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | disable-mnt | ||
42 | private-bin gnome-screenshot | ||
43 | private-dev | ||
44 | private-etc dconf,fonts,gtk-3.0,localtime,machine-id | ||
45 | private-tmp | ||
46 | |||
47 | dbus-user filter | ||
48 | dbus-user.own org.gnome.Screenshot | ||
49 | dbus-user.talk org.gnome.Shell.Screenshot | ||
50 | dbus-system none | ||
diff --git a/etc/gnome-sound-recorder.profile b/etc/profile-a-l/gnome-sound-recorder.profile index 7f8fc8a0c..a64ec25a9 100644 --- a/etc/gnome-sound-recorder.profile +++ b/etc/profile-a-l/gnome-sound-recorder.profile | |||
@@ -7,7 +7,6 @@ include gnome-sound-recorder.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${MUSIC} | 9 | noblacklist ${MUSIC} |
10 | noblacklist ${HOME}/.local/share/flatpak | ||
11 | noblacklist ${HOME}/.local/share/Trash | 10 | noblacklist ${HOME}/.local/share/Trash |
12 | 11 | ||
13 | # Allow gjs (blacklisted by disable-interpreters.inc) | 12 | # Allow gjs (blacklisted by disable-interpreters.inc) |
diff --git a/etc/profile-a-l/gnome-sudoku.profile b/etc/profile-a-l/gnome-sudoku.profile new file mode 100644 index 000000000..12fd48a86 --- /dev/null +++ b/etc/profile-a-l/gnome-sudoku.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for gnome-sudoku | ||
2 | # Description: puzzle game for the popular Japanese sudoku logic puzzle | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-sudoku.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/gnome-sudoku | ||
10 | |||
11 | mkdir ${HOME}/.local/share/gnome-sudoku | ||
12 | whitelist ${HOME}/.local/share/gnome-sudoku | ||
13 | |||
14 | private-bin gnome-sudoku | ||
15 | |||
16 | dbus-user.own org.gnome.Sudoku | ||
17 | |||
18 | # Redirect | ||
19 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-system-log.profile b/etc/profile-a-l/gnome-system-log.profile index cfe39d18b..14b0f758e 100644 --- a/etc/gnome-system-log.profile +++ b/etc/profile-a-l/gnome-system-log.profile | |||
@@ -12,6 +12,7 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | whitelist /var/log | 18 | whitelist /var/log |
@@ -24,7 +25,6 @@ caps.drop all | |||
24 | ipc-namespace | 25 | ipc-namespace |
25 | # net none - breaks dbus | 26 | # net none - breaks dbus |
26 | no3d | 27 | no3d |
27 | # nodbus | ||
28 | nodvd | 28 | nodvd |
29 | # When using 'volatile' storage (https://www.freedesktop.org/software/systemd/man/journald.conf.html), | 29 | # When using 'volatile' storage (https://www.freedesktop.org/software/systemd/man/journald.conf.html), |
30 | # comment both 'nogroups' and 'noroot' | 30 | # comment both 'nogroups' and 'noroot' |
@@ -49,6 +49,9 @@ private-lib | |||
49 | private-tmp | 49 | private-tmp |
50 | writable-var-log | 50 | writable-var-log |
51 | 51 | ||
52 | # dbus-user none | ||
53 | # dbus-system none | ||
54 | |||
52 | memory-deny-write-execute | 55 | memory-deny-write-execute |
53 | 56 | ||
54 | # comment this if you export logs to a file in your ${HOME} | 57 | # comment this if you export logs to a file in your ${HOME} |
diff --git a/etc/profile-a-l/gnome-taquin.profile b/etc/profile-a-l/gnome-taquin.profile new file mode 100644 index 000000000..2341334f7 --- /dev/null +++ b/etc/profile-a-l/gnome-taquin.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for gnome-taquin | ||
2 | # Description: A sliding puzzle game for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-taquin.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore machine-id | ||
10 | ignore nosound | ||
11 | |||
12 | whitelist /usr/share/gnome-taquin | ||
13 | |||
14 | private-bin gnome-taquin | ||
15 | |||
16 | dbus-user.own org.gnome.Taquin | ||
17 | |||
18 | # Redirect | ||
19 | include gnome_games-common.profile | ||
diff --git a/etc/profile-a-l/gnome-tetravex.profile b/etc/profile-a-l/gnome-tetravex.profile new file mode 100644 index 000000000..6e820dd70 --- /dev/null +++ b/etc/profile-a-l/gnome-tetravex.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for gnome-tetravex | ||
2 | # Description: A simple puzzle game for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-tetravex.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | private-bin gnome-tetravex | ||
10 | |||
11 | dbus-user.own org.gnome.Tetravex | ||
12 | |||
13 | # Redirect | ||
14 | include gnome_games-common.profile | ||
diff --git a/etc/profile-a-l/gnome-todo.profile b/etc/profile-a-l/gnome-todo.profile new file mode 100644 index 000000000..2fab3dcc7 --- /dev/null +++ b/etc/profile-a-l/gnome-todo.profile | |||
@@ -0,0 +1,64 @@ | |||
1 | # Firejail profile for gnome-todo | ||
2 | # Description: Personal task manager for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-todo.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Allow python (blacklisted by disable-interpreters.inc) | ||
10 | include allow-python3.inc | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | whitelist /usr/share/gnome-todo | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | machine-id | ||
30 | net none | ||
31 | nodvd | ||
32 | nogroups | ||
33 | nonewprivs | ||
34 | noroot | ||
35 | nosound | ||
36 | notv | ||
37 | nou2f | ||
38 | novideo | ||
39 | protocol unix | ||
40 | seccomp | ||
41 | shell none | ||
42 | tracelog | ||
43 | |||
44 | disable-mnt | ||
45 | #private | ||
46 | private-bin gnome-todo | ||
47 | private-cache | ||
48 | private-dev | ||
49 | private-etc dconf,fonts,gtk-3.0,localtime,passwd,xdg | ||
50 | private-tmp | ||
51 | |||
52 | dbus-user filter | ||
53 | dbus-user.own org.gnome.Todo | ||
54 | dbus-user.talk ca.desrt.dconf | ||
55 | #dbus-user.talk org.gnome.evolution.dataserver.AddressBook9 | ||
56 | #dbus-user.talk org.gnome.evolution.dataserver.Calendar8 | ||
57 | #dbus-user.talk org.gnome.evolution.dataserver.Sources5 | ||
58 | #dbus-user.talk org.gnome.evolution.dataserver.Subprocess.Backend.* | ||
59 | #dbus-user.talk org.gnome.OnlineAccounts | ||
60 | dbus-system none | ||
61 | #dbus-system filter | ||
62 | #dbus-system.talk org.freedesktop.login1 | ||
63 | |||
64 | read-only ${HOME} | ||
diff --git a/etc/gnome-twitch.profile b/etc/profile-a-l/gnome-twitch.profile index 5e8153035..5e8153035 100644 --- a/etc/gnome-twitch.profile +++ b/etc/profile-a-l/gnome-twitch.profile | |||
diff --git a/etc/gnome-weather.profile b/etc/profile-a-l/gnome-weather.profile index 10db6296b..a181f1b9e 100644 --- a/etc/gnome-weather.profile +++ b/etc/profile-a-l/gnome-weather.profile | |||
@@ -21,6 +21,7 @@ include disable-passwdmgr.inc | |||
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-xdg.inc | 22 | include disable-xdg.inc |
23 | 23 | ||
24 | include whitelist-runuser-common.inc | ||
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
26 | caps.drop all | 27 | caps.drop all |
diff --git a/etc/profile-a-l/gnome_games-common.profile b/etc/profile-a-l/gnome_games-common.profile new file mode 100644 index 000000000..c46fbc1d9 --- /dev/null +++ b/etc/profile-a-l/gnome_games-common.profile | |||
@@ -0,0 +1,48 @@ | |||
1 | # Firejail profile for gnome_games-common | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include gnome_games-common.local | ||
5 | # Persistent global definitions | ||
6 | # added by caller profile | ||
7 | #include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | include whitelist-common.inc | ||
19 | include whitelist-runuser-common.inc | ||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | machine-id | ||
26 | net none | ||
27 | nodvd | ||
28 | nogroups | ||
29 | nonewprivs | ||
30 | noroot | ||
31 | nosound | ||
32 | notv | ||
33 | nou2f | ||
34 | novideo | ||
35 | protocol unix | ||
36 | seccomp | ||
37 | shell none | ||
38 | tracelog | ||
39 | |||
40 | disable-mnt | ||
41 | private-cache | ||
42 | private-dev | ||
43 | private-etc dconf,fonts,gconf,gtk-2.0,gtk-3.0,machine-id,pango,passwd,X11 | ||
44 | private-tmp | ||
45 | |||
46 | dbus-user filter | ||
47 | dbus-user.talk ca.desrt.dconf | ||
48 | dbus-system none | ||
diff --git a/etc/profile-a-l/gnote.profile b/etc/profile-a-l/gnote.profile new file mode 100644 index 000000000..1b5129fc5 --- /dev/null +++ b/etc/profile-a-l/gnote.profile | |||
@@ -0,0 +1,59 @@ | |||
1 | # Firejail profile for gnote | ||
2 | # Description: A simple note-taking application for Gnome | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnote.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/gnote | ||
10 | noblacklist ${HOME}/.local/share/gnote | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | mkdir ${HOME}/.config/gnote | ||
22 | mkdir ${HOME}/.local/share/gnote | ||
23 | whitelist ${HOME}/.config/gnote | ||
24 | whitelist ${HOME}/.local/share/gnote | ||
25 | whitelist /usr/share/gnote | ||
26 | include whitelist-common.inc | ||
27 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
29 | include whitelist-var-common.inc | ||
30 | |||
31 | apparmor | ||
32 | caps.drop all | ||
33 | machine-id | ||
34 | net none | ||
35 | no3d | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | nosound | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix | ||
45 | seccomp | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | disable-mnt | ||
50 | private-bin gnote | ||
51 | private-cache | ||
52 | private-dev | ||
53 | private-etc dconf,fonts,gtk-3.0,pango,X11 | ||
54 | private-tmp | ||
55 | |||
56 | dbus-user filter | ||
57 | dbus-user.own org.gnome.Gnote | ||
58 | dbus-user.talk ca.desrt.dconf | ||
59 | dbus-system none | ||
diff --git a/etc/profile-a-l/gnubik.profile b/etc/profile-a-l/gnubik.profile new file mode 100644 index 000000000..8eaba161c --- /dev/null +++ b/etc/profile-a-l/gnubik.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for gnubik | ||
2 | # Description: DESCRIPTION | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnubik.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | whitelist /usr/share/gnubik | ||
19 | include whitelist-common.inc | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | machine-id | ||
27 | net none | ||
28 | nodvd | ||
29 | nogroups | ||
30 | nonewprivs | ||
31 | noroot | ||
32 | nosound | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | disable-mnt | ||
42 | private | ||
43 | private-bin gnubik | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc drirc,fonts,gtk-2.0 | ||
47 | private-tmp | ||
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/godot.profile b/etc/profile-a-l/godot.profile index 2baf09b1d..8324a4eb5 100644 --- a/etc/godot.profile +++ b/etc/profile-a-l/godot.profile | |||
@@ -22,7 +22,6 @@ include whitelist-var-common.inc | |||
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | netfilter | 24 | netfilter |
25 | nodbus | ||
26 | nodvd | 25 | nodvd |
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
@@ -41,3 +40,6 @@ private-cache | |||
41 | private-dev | 40 | private-dev |
42 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,machine-id,nsswitch.conf,openal,pki,pulse,resolv.conf,ssl | 41 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,machine-id,nsswitch.conf,openal,pki,pulse,resolv.conf,ssl |
43 | private-tmp | 42 | private-tmp |
43 | |||
44 | dbus-user none | ||
45 | dbus-system none | ||
diff --git a/etc/goobox.profile b/etc/profile-a-l/goobox.profile index c932ad528..c932ad528 100644 --- a/etc/goobox.profile +++ b/etc/profile-a-l/goobox.profile | |||
diff --git a/etc/google-chrome-beta.profile b/etc/profile-a-l/google-chrome-beta.profile index 73101f509..a62e4cf74 100644 --- a/etc/google-chrome-beta.profile +++ b/etc/profile-a-l/google-chrome-beta.profile | |||
@@ -8,10 +8,16 @@ include globals.local | |||
8 | noblacklist ${HOME}/.cache/google-chrome-beta | 8 | noblacklist ${HOME}/.cache/google-chrome-beta |
9 | noblacklist ${HOME}/.config/google-chrome-beta | 9 | noblacklist ${HOME}/.config/google-chrome-beta |
10 | 10 | ||
11 | noblacklist ${HOME}/.config/chrome-beta-flags.conf | ||
12 | noblacklist ${HOME}/.config/chrome-beta-flags.config | ||
13 | |||
11 | mkdir ${HOME}/.cache/google-chrome-beta | 14 | mkdir ${HOME}/.cache/google-chrome-beta |
12 | mkdir ${HOME}/.config/google-chrome-beta | 15 | mkdir ${HOME}/.config/google-chrome-beta |
13 | whitelist ${HOME}/.cache/google-chrome-beta | 16 | whitelist ${HOME}/.cache/google-chrome-beta |
14 | whitelist ${HOME}/.config/google-chrome-beta | 17 | whitelist ${HOME}/.config/google-chrome-beta |
15 | 18 | ||
19 | whitelist ${HOME}/.config/chrome-beta-flags.conf | ||
20 | whitelist ${HOME}/.config/chrome-beta-flags.config | ||
21 | |||
16 | # Redirect | 22 | # Redirect |
17 | include chromium-common.profile | 23 | include chromium-common.profile |
diff --git a/etc/google-chrome-stable.profile b/etc/profile-a-l/google-chrome-stable.profile index a456e8d61..a456e8d61 100644 --- a/etc/google-chrome-stable.profile +++ b/etc/profile-a-l/google-chrome-stable.profile | |||
diff --git a/etc/google-chrome-unstable.profile b/etc/profile-a-l/google-chrome-unstable.profile index 50e9923aa..14547eab2 100644 --- a/etc/google-chrome-unstable.profile +++ b/etc/profile-a-l/google-chrome-unstable.profile | |||
@@ -8,10 +8,16 @@ include globals.local | |||
8 | noblacklist ${HOME}/.cache/google-chrome-unstable | 8 | noblacklist ${HOME}/.cache/google-chrome-unstable |
9 | noblacklist ${HOME}/.config/google-chrome-unstable | 9 | noblacklist ${HOME}/.config/google-chrome-unstable |
10 | 10 | ||
11 | noblacklist ${HOME}/.config/chrome-unstable-flags.conf | ||
12 | noblacklist ${HOME}/.config/chrome-unstable-flags.config | ||
13 | |||
11 | mkdir ${HOME}/.cache/google-chrome-unstable | 14 | mkdir ${HOME}/.cache/google-chrome-unstable |
12 | mkdir ${HOME}/.config/google-chrome-unstable | 15 | mkdir ${HOME}/.config/google-chrome-unstable |
13 | whitelist ${HOME}/.cache/google-chrome-unstable | 16 | whitelist ${HOME}/.cache/google-chrome-unstable |
14 | whitelist ${HOME}/.config/google-chrome-unstable | 17 | whitelist ${HOME}/.config/google-chrome-unstable |
15 | 18 | ||
19 | whitelist ${HOME}/.config/chrome-unstable-flags.conf | ||
20 | whitelist ${HOME}/.config/chrome-unstable-flags.config | ||
21 | |||
16 | # Redirect | 22 | # Redirect |
17 | include chromium-common.profile | 23 | include chromium-common.profile |
diff --git a/etc/google-chrome.profile b/etc/profile-a-l/google-chrome.profile index c69e98271..66f76caa0 100644 --- a/etc/google-chrome.profile +++ b/etc/profile-a-l/google-chrome.profile | |||
@@ -8,10 +8,16 @@ include globals.local | |||
8 | noblacklist ${HOME}/.cache/google-chrome | 8 | noblacklist ${HOME}/.cache/google-chrome |
9 | noblacklist ${HOME}/.config/google-chrome | 9 | noblacklist ${HOME}/.config/google-chrome |
10 | 10 | ||
11 | noblacklist ${HOME}/.config/chrome-flags.conf | ||
12 | noblacklist ${HOME}/.config/chrome-flags.config | ||
13 | |||
11 | mkdir ${HOME}/.cache/google-chrome | 14 | mkdir ${HOME}/.cache/google-chrome |
12 | mkdir ${HOME}/.config/google-chrome | 15 | mkdir ${HOME}/.config/google-chrome |
13 | whitelist ${HOME}/.cache/google-chrome | 16 | whitelist ${HOME}/.cache/google-chrome |
14 | whitelist ${HOME}/.config/google-chrome | 17 | whitelist ${HOME}/.config/google-chrome |
15 | 18 | ||
19 | whitelist ${HOME}/.config/chrome-flags.conf | ||
20 | whitelist ${HOME}/.config/chrome-flags.config | ||
21 | |||
16 | # Redirect | 22 | # Redirect |
17 | include chromium-common.profile | 23 | include chromium-common.profile |
diff --git a/etc/google-earth-pro.profile b/etc/profile-a-l/google-earth-pro.profile index c1f919769..c1f919769 100644 --- a/etc/google-earth-pro.profile +++ b/etc/profile-a-l/google-earth-pro.profile | |||
diff --git a/etc/google-earth.profile b/etc/profile-a-l/google-earth.profile index a331ef8d2..a331ef8d2 100644 --- a/etc/google-earth.profile +++ b/etc/profile-a-l/google-earth.profile | |||
diff --git a/etc/google-play-music-desktop-player.profile b/etc/profile-a-l/google-play-music-desktop-player.profile index daa385234..daa385234 100644 --- a/etc/google-play-music-desktop-player.profile +++ b/etc/profile-a-l/google-play-music-desktop-player.profile | |||
diff --git a/etc/gpa.profile b/etc/profile-a-l/gpa.profile index ce7c8496d..ce7c8496d 100644 --- a/etc/gpa.profile +++ b/etc/profile-a-l/gpa.profile | |||
diff --git a/etc/gpg-agent.profile b/etc/profile-a-l/gpg-agent.profile index 16bda186e..adc8957e6 100644 --- a/etc/gpg-agent.profile +++ b/etc/profile-a-l/gpg-agent.profile | |||
@@ -21,9 +21,12 @@ include disable-xdg.inc | |||
21 | 21 | ||
22 | mkdir ${HOME}/.gnupg | 22 | mkdir ${HOME}/.gnupg |
23 | whitelist ${HOME}/.gnupg | 23 | whitelist ${HOME}/.gnupg |
24 | whitelist ${RUNUSER}/gnupg | ||
25 | whitelist ${RUNUSER}/keyring | ||
24 | whitelist /usr/share/gnupg | 26 | whitelist /usr/share/gnupg |
25 | whitelist /usr/share/gnupg2 | 27 | whitelist /usr/share/gnupg2 |
26 | include whitelist-common.inc | 28 | include whitelist-common.inc |
29 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | 30 | include whitelist-usr-share-common.inc |
28 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
29 | 32 | ||
diff --git a/etc/gpg.profile b/etc/profile-a-l/gpg.profile index b408a0123..787f35f9e 100644 --- a/etc/gpg.profile +++ b/etc/profile-a-l/gpg.profile | |||
@@ -18,9 +18,12 @@ include disable-interpreters.inc | |||
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | 20 | ||
21 | whitelist ${RUNUSER}/gnupg | ||
22 | whitelist ${RUNUSER}/keyring | ||
21 | whitelist /usr/share/gnupg | 23 | whitelist /usr/share/gnupg |
22 | whitelist /usr/share/gnupg2 | 24 | whitelist /usr/share/gnupg2 |
23 | whitelist /usr/share/pacman/keyrings | 25 | whitelist /usr/share/pacman/keyrings |
26 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
26 | 29 | ||
diff --git a/etc/gpg2.profile b/etc/profile-a-l/gpg2.profile index b831b0f62..b831b0f62 100644 --- a/etc/gpg2.profile +++ b/etc/profile-a-l/gpg2.profile | |||
diff --git a/etc/gpicview.profile b/etc/profile-a-l/gpicview.profile index eb00688dd..a536e5985 100644 --- a/etc/gpicview.profile +++ b/etc/profile-a-l/gpicview.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | whitelist /usr/share/gpicview | 19 | whitelist /usr/share/gpicview |
19 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
@@ -24,7 +25,6 @@ caps.drop all | |||
24 | ipc-namespace | 25 | ipc-namespace |
25 | machine-id | 26 | machine-id |
26 | net none | 27 | net none |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -45,4 +45,7 @@ private-etc alternatives,fonts,group,passwd | |||
45 | private-lib | 45 | private-lib |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
48 | memory-deny-write-execute | 51 | memory-deny-write-execute |
diff --git a/etc/gpredict.profile b/etc/profile-a-l/gpredict.profile index c1f1b53a0..3152db096 100644 --- a/etc/gpredict.profile +++ b/etc/profile-a-l/gpredict.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | mkdir ${HOME}/.config/Gpredict | 19 | mkdir ${HOME}/.config/Gpredict |
19 | whitelist ${HOME}/.config/Gpredict | 20 | whitelist ${HOME}/.config/Gpredict |
diff --git a/etc/gradio.profile b/etc/profile-a-l/gradio.profile index 82e2504b9..a16e65efb 100644 --- a/etc/gradio.profile +++ b/etc/profile-a-l/gradio.profile | |||
@@ -14,12 +14,15 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | ||
17 | 18 | ||
18 | mkdir ${HOME}/.cache/gradio | 19 | mkdir ${HOME}/.cache/gradio |
19 | mkdir ${HOME}/.local/share/gradio | 20 | mkdir ${HOME}/.local/share/gradio |
20 | whitelist ${HOME}/.cache/gradio | 21 | whitelist ${HOME}/.cache/gradio |
21 | whitelist ${HOME}/.local/share/gradio | 22 | whitelist ${HOME}/.local/share/gradio |
22 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
24 | 27 | ||
25 | caps.drop all | 28 | caps.drop all |
@@ -30,11 +33,23 @@ nogroups | |||
30 | nonewprivs | 33 | nonewprivs |
31 | noroot | 34 | noroot |
32 | notv | 35 | notv |
36 | nou2f | ||
33 | novideo | 37 | novideo |
34 | protocol unix,inet,inet6 | 38 | protocol unix,inet,inet6 |
35 | seccomp | 39 | seccomp |
40 | seccomp.block-secondary | ||
36 | shell none | 41 | shell none |
42 | tracelog | ||
37 | 43 | ||
44 | disable-mnt | ||
45 | private-bin gradio | ||
46 | private-cache | ||
47 | private-dev | ||
38 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,xdg | 48 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,xdg |
39 | private-tmp | 49 | private-tmp |
40 | 50 | ||
51 | dbus-user filter | ||
52 | dbus-user.own de.haeckerfelix.gradio | ||
53 | dbus-user.own org.mpris.MediaPlayer2.gradio | ||
54 | dbus-user.talk ca.desrt.dconf | ||
55 | dbus-system none | ||
diff --git a/etc/gramps.profile b/etc/profile-a-l/gramps.profile index 54b154964..427fe2d7a 100644 --- a/etc/gramps.profile +++ b/etc/profile-a-l/gramps.profile | |||
@@ -30,7 +30,6 @@ caps.drop all | |||
30 | ipc-namespace | 30 | ipc-namespace |
31 | netfilter | 31 | netfilter |
32 | no3d | 32 | no3d |
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nogroups | 34 | nogroups |
36 | nonewprivs | 35 | nonewprivs |
@@ -47,3 +46,6 @@ disable-mnt | |||
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-tmp | 48 | private-tmp |
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile b/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile new file mode 100644 index 000000000..0cb3aa864 --- /dev/null +++ b/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile | |||
@@ -0,0 +1,47 @@ | |||
1 | # Firejail profile for gravity-beams-and-evaporating-stars | ||
2 | # Description: a game about hurling asteroids into the sun | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gravity-beams-and-evaporating-stars.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | whitelist /usr/share/gravity-beams-and-evaporating-stars | ||
19 | include whitelist-common.inc | ||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | net none | ||
26 | nodvd | ||
27 | nogroups | ||
28 | nonewprivs | ||
29 | noroot | ||
30 | notv | ||
31 | nou2f | ||
32 | novideo | ||
33 | protocol unix | ||
34 | seccomp | ||
35 | shell none | ||
36 | tracelog | ||
37 | |||
38 | disable-mnt | ||
39 | private | ||
40 | private-bin gravity-beams-and-evaporating-stars | ||
41 | private-cache | ||
42 | private-dev | ||
43 | private-etc fonts,machine-id | ||
44 | private-tmp | ||
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/gsettings-data-convert.profile b/etc/profile-a-l/gsettings-data-convert.profile index 6f1d43939..6f1d43939 100644 --- a/etc/gsettings-data-convert.profile +++ b/etc/profile-a-l/gsettings-data-convert.profile | |||
diff --git a/etc/gsettings-schema-convert.profile b/etc/profile-a-l/gsettings-schema-convert.profile index 5c8b0e2e2..5c8b0e2e2 100644 --- a/etc/gsettings-schema-convert.profile +++ b/etc/profile-a-l/gsettings-schema-convert.profile | |||
diff --git a/etc/gsettings.profile b/etc/profile-a-l/gsettings.profile index 2203fac15..2203fac15 100644 --- a/etc/gsettings.profile +++ b/etc/profile-a-l/gsettings.profile | |||
diff --git a/etc/gtar.profile b/etc/profile-a-l/gtar.profile index 2391c121b..2391c121b 100644 --- a/etc/gtar.profile +++ b/etc/profile-a-l/gtar.profile | |||
diff --git a/etc/gthumb.profile b/etc/profile-a-l/gthumb.profile index 77de59802..de0fc96ae 100644 --- a/etc/gthumb.profile +++ b/etc/profile-a-l/gthumb.profile | |||
@@ -15,6 +15,7 @@ include disable-devel.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
20 | nodvd | 21 | nodvd |
diff --git a/etc/gtk-update-icon-cache.profile b/etc/profile-a-l/gtk-update-icon-cache.profile index 668a48f9a..2051a8af6 100644 --- a/etc/gtk-update-icon-cache.profile +++ b/etc/profile-a-l/gtk-update-icon-cache.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | include whitelist-common.inc | 21 | include whitelist-common.inc |
@@ -27,7 +28,6 @@ ipc-namespace | |||
27 | machine-id | 28 | machine-id |
28 | net none | 29 | net none |
29 | no3d | 30 | no3d |
30 | nodbus | ||
31 | nodvd | 31 | nodvd |
32 | nogroups | 32 | nogroups |
33 | nonewprivs | 33 | nonewprivs |
@@ -50,4 +50,7 @@ private-etc none | |||
50 | private-lib | 50 | private-lib |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
53 | memory-deny-write-execute | 56 | memory-deny-write-execute |
diff --git a/etc/profile-a-l/gtk-youtube-viewer b/etc/profile-a-l/gtk-youtube-viewer new file mode 100644 index 000000000..023f10d3d --- /dev/null +++ b/etc/profile-a-l/gtk-youtube-viewer | |||
@@ -0,0 +1,18 @@ | |||
1 | # Firejail profile for gtk-youtube-viewer | ||
2 | # Description: Gtk front-end to youtube-viewer | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gtk-youtube-viewer.local | ||
6 | # Persistent global definitions | ||
7 | # include globals.local | ||
8 | |||
9 | ignore quiet | ||
10 | |||
11 | noblacklist /tmp/.X11-unix | ||
12 | noblacklist ${RUNUSER}/wayland-* | ||
13 | noblacklist ${RUNUSER} | ||
14 | |||
15 | include whitelist-runuser-common.inc | ||
16 | |||
17 | # Redirect | ||
18 | include youtube-viewer.profile \ No newline at end of file | ||
diff --git a/etc/profile-a-l/gtk2-youtube-viewer b/etc/profile-a-l/gtk2-youtube-viewer new file mode 100644 index 000000000..331e73218 --- /dev/null +++ b/etc/profile-a-l/gtk2-youtube-viewer | |||
@@ -0,0 +1,18 @@ | |||
1 | # Firejail profile for gtk2-youtube-viewer | ||
2 | # Description: Gtk front-end to youtube-viewer | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gtk2-youtube-viewer.local | ||
6 | # Persistent global definitions | ||
7 | # include globals.local | ||
8 | |||
9 | ignore quiet | ||
10 | |||
11 | noblacklist /tmp/.X11-unix | ||
12 | noblacklist ${RUNUSER}/wayland-* | ||
13 | noblacklist ${RUNUSER} | ||
14 | |||
15 | include whitelist-runuser-common.inc | ||
16 | |||
17 | # Redirect | ||
18 | include youtube-viewer.profile \ No newline at end of file | ||
diff --git a/etc/profile-a-l/gtk3-youtube-viewer b/etc/profile-a-l/gtk3-youtube-viewer new file mode 100644 index 000000000..4c5bde55f --- /dev/null +++ b/etc/profile-a-l/gtk3-youtube-viewer | |||
@@ -0,0 +1,18 @@ | |||
1 | # Firejail profile for gtk3-youtube-viewer | ||
2 | # Description: Gtk front-end to youtube-viewer | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gtk3-youtube-viewer.local | ||
6 | # Persistent global definitions | ||
7 | # include globals.local | ||
8 | |||
9 | ignore quiet | ||
10 | |||
11 | noblacklist /tmp/.X11-unix | ||
12 | noblacklist ${RUNUSER}/wayland-* | ||
13 | noblacklist ${RUNUSER} | ||
14 | |||
15 | include whitelist-runuser-common.inc | ||
16 | |||
17 | # Redirect | ||
18 | include youtube-viewer.profile \ No newline at end of file | ||
diff --git a/etc/guayadeque.profile b/etc/profile-a-l/guayadeque.profile index 8ffd7ff58..8a7f65918 100644 --- a/etc/guayadeque.profile +++ b/etc/profile-a-l/guayadeque.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/gucharmap.profile b/etc/profile-a-l/gucharmap.profile index b3aa58d29..c0254b5ec 100644 --- a/etc/gucharmap.profile +++ b/etc/profile-a-l/gucharmap.profile | |||
@@ -12,9 +12,11 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | include whitelist-common.inc | 18 | include whitelist-common.inc |
19 | include whitelist-runuser-common.inc | ||
18 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
19 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
20 | 22 | ||
@@ -23,7 +25,6 @@ caps.drop all | |||
23 | machine-id | 25 | machine-id |
24 | #net none - breaks dbus | 26 | #net none - breaks dbus |
25 | no3d | 27 | no3d |
26 | #nodbus - breaks state saveing | ||
27 | nodvd | 28 | nodvd |
28 | nogroups | 29 | nogroups |
29 | nonewprivs | 30 | nonewprivs |
@@ -45,4 +46,8 @@ private-etc alternatives,dbus-1,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld | |||
45 | private-lib | 46 | private-lib |
46 | private-tmp | 47 | private-tmp |
47 | 48 | ||
49 | # breaks state saving | ||
50 | # dbus-user none | ||
51 | # dbus-system none | ||
52 | |||
48 | read-only ${HOME} | 53 | read-only ${HOME} |
diff --git a/etc/gummi.profile b/etc/profile-a-l/gummi.profile index 922b2cbde..40c268c46 100644 --- a/etc/gummi.profile +++ b/etc/profile-a-l/gummi.profile | |||
@@ -12,8 +12,7 @@ include allow-lua.inc | |||
12 | include allow-perl.inc | 12 | include allow-perl.inc |
13 | include allow-python3.inc | 13 | include allow-python3.inc |
14 | 14 | ||
15 | private-bin dvipdf,dvips,env,gummi,latex,latexmk,lua*,lualatex,luatex,pdflatex,pdftex,perl,ps2pdf,python3*,rubber,synctex,tex,xelatex,xetex | 15 | private-bin dvipdf,dvips,env,gummi,latex,latexmk,lua*,pdflatex,pdftex,perl,ps2pdf,python3*,rubber,synctex,tex,xelatex,xetex |
16 | 16 | ||
17 | # Redirect | 17 | # Redirect |
18 | include latex-common.profile | 18 | include latex-common.profile |
19 | |||
diff --git a/etc/gunzip.profile b/etc/profile-a-l/gunzip.profile index 6e97c6b78..6e97c6b78 100644 --- a/etc/gunzip.profile +++ b/etc/profile-a-l/gunzip.profile | |||
diff --git a/etc/gwenview.profile b/etc/profile-a-l/gwenview.profile index 5a5d81378..efdc56e38 100644 --- a/etc/gwenview.profile +++ b/etc/profile-a-l/gwenview.profile | |||
@@ -15,6 +15,7 @@ noblacklist ${HOME}/.kde/share/config/gwenviewrc | |||
15 | noblacklist ${HOME}/.kde4/share/apps/gwenview | 15 | noblacklist ${HOME}/.kde4/share/apps/gwenview |
16 | noblacklist ${HOME}/.kde4/share/config/gwenviewrc | 16 | noblacklist ${HOME}/.kde4/share/config/gwenviewrc |
17 | noblacklist ${HOME}/.local/share/gwenview | 17 | noblacklist ${HOME}/.local/share/gwenview |
18 | noblacklist ${HOME}/.local/share/kxmlgui5/gwenview | ||
18 | noblacklist ${HOME}/.local/share/org.kde.gwenview | 19 | noblacklist ${HOME}/.local/share/org.kde.gwenview |
19 | 20 | ||
20 | include disable-common.inc | 21 | include disable-common.inc |
@@ -23,6 +24,7 @@ include disable-exec.inc | |||
23 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
24 | include disable-passwdmgr.inc | 25 | include disable-passwdmgr.inc |
25 | include disable-programs.inc | 26 | include disable-programs.inc |
27 | include disable-shell.inc | ||
26 | 28 | ||
27 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
28 | 30 | ||
@@ -30,7 +32,6 @@ apparmor | |||
30 | caps.drop all | 32 | caps.drop all |
31 | # net none | 33 | # net none |
32 | netfilter | 34 | netfilter |
33 | # nodbus | ||
34 | nodvd | 35 | nodvd |
35 | nogroups | 36 | nogroups |
36 | nonewprivs | 37 | nonewprivs |
@@ -47,4 +48,7 @@ private-bin gimp*,gwenview,kbuildsycoca4,kdeinit4 | |||
47 | private-dev | 48 | private-dev |
48 | private-etc alternatives,fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,xdg | 49 | private-etc alternatives,fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,xdg |
49 | 50 | ||
51 | # dbus-user none | ||
52 | # dbus-system none | ||
53 | |||
50 | # memory-deny-write-execute | 54 | # memory-deny-write-execute |
diff --git a/etc/gzexe.profile b/etc/profile-a-l/gzexe.profile index bb570d553..bb570d553 100644 --- a/etc/gzexe.profile +++ b/etc/profile-a-l/gzexe.profile | |||
diff --git a/etc/gzip.profile b/etc/profile-a-l/gzip.profile index 1af15d227..8ec39d8ca 100644 --- a/etc/gzip.profile +++ b/etc/profile-a-l/gzip.profile | |||
@@ -26,7 +26,6 @@ ipc-namespace | |||
26 | machine-id | 26 | machine-id |
27 | net none | 27 | net none |
28 | no3d | 28 | no3d |
29 | nodbus | ||
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
@@ -44,4 +43,7 @@ x11 none | |||
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | 45 | ||
46 | dbus-user none | ||
47 | dbus-system none | ||
48 | |||
47 | memory-deny-write-execute | 49 | memory-deny-write-execute |
diff --git a/etc/handbrake-gtk.profile b/etc/profile-a-l/handbrake-gtk.profile index 1e7ce2350..1e7ce2350 100644 --- a/etc/handbrake-gtk.profile +++ b/etc/profile-a-l/handbrake-gtk.profile | |||
diff --git a/etc/handbrake.profile b/etc/profile-a-l/handbrake.profile index 324c629e3..0539ffcb8 100644 --- a/etc/handbrake.profile +++ b/etc/profile-a-l/handbrake.profile | |||
@@ -22,8 +22,7 @@ include whitelist-var-common.inc | |||
22 | 22 | ||
23 | apparmor | 23 | apparmor |
24 | caps.drop all | 24 | caps.drop all |
25 | netfilter | 25 | net none |
26 | nodbus | ||
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
29 | noroot | 28 | noroot |
@@ -36,3 +35,5 @@ shell none | |||
36 | private-dev | 35 | private-dev |
37 | private-tmp | 36 | private-tmp |
38 | 37 | ||
38 | dbus-user none | ||
39 | dbus-system none | ||
diff --git a/etc/hashcat.profile b/etc/profile-a-l/hashcat.profile index b4d6d52f0..8ec67ff19 100644 --- a/etc/hashcat.profile +++ b/etc/profile-a-l/hashcat.profile | |||
@@ -23,7 +23,6 @@ include disable-xdg.inc | |||
23 | 23 | ||
24 | caps.drop all | 24 | caps.drop all |
25 | net none | 25 | net none |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -43,3 +42,5 @@ private-cache | |||
43 | private-dev | 42 | private-dev |
44 | private-tmp | 43 | private-tmp |
45 | 44 | ||
45 | dbus-user none | ||
46 | dbus-system none | ||
diff --git a/etc/hedgewars.profile b/etc/profile-a-l/hedgewars.profile index 898a07a5f..898a07a5f 100644 --- a/etc/hedgewars.profile +++ b/etc/profile-a-l/hedgewars.profile | |||
diff --git a/etc/hexchat.profile b/etc/profile-a-l/hexchat.profile index 7723cbd6b..4c8911a06 100644 --- a/etc/hexchat.profile +++ b/etc/profile-a-l/hexchat.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | mkdir ${HOME}/.config/hexchat | 25 | mkdir ${HOME}/.config/hexchat |
diff --git a/etc/highlight.profile b/etc/profile-a-l/highlight.profile index 036de8d99..0761aa2fc 100644 --- a/etc/highlight.profile +++ b/etc/profile-a-l/highlight.profile | |||
@@ -7,17 +7,18 @@ include highlight.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | blacklist ${RUNUSER}/wayland-* | 9 | blacklist ${RUNUSER}/wayland-* |
10 | blacklist ${RUNUSER} | ||
10 | 11 | ||
11 | include disable-common.inc | 12 | include disable-common.inc |
12 | include disable-devel.inc | 13 | include disable-devel.inc |
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
16 | 18 | ||
17 | caps.drop all | 19 | caps.drop all |
18 | net none | 20 | net none |
19 | no3d | 21 | no3d |
20 | nodbus | ||
21 | nodvd | 22 | nodvd |
22 | nogroups | 23 | nogroups |
23 | nonewprivs | 24 | nonewprivs |
@@ -36,3 +37,6 @@ private-bin highlight | |||
36 | private-cache | 37 | private-cache |
37 | private-dev | 38 | private-dev |
38 | private-tmp | 39 | private-tmp |
40 | |||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/profile-a-l/hitori.profile b/etc/profile-a-l/hitori.profile new file mode 100644 index 000000000..6d67f4587 --- /dev/null +++ b/etc/profile-a-l/hitori.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for hitori | ||
2 | # Description: Play the Hitori puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include hitori.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | private-bin hitori | ||
10 | |||
11 | dbus-user.own org.gnome.Hitori | ||
12 | |||
13 | # Redirect | ||
14 | include gnome_games-common.profile | ||
diff --git a/etc/profile-a-l/homebank.profile b/etc/profile-a-l/homebank.profile new file mode 100644 index 000000000..8e600a2d7 --- /dev/null +++ b/etc/profile-a-l/homebank.profile | |||
@@ -0,0 +1,59 @@ | |||
1 | # Firejail profile for homebank | ||
2 | # Description: Personal finance manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include homebank.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/homebank | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-programs.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.config/homebank | ||
21 | whitelist ${DOWNLOADS} | ||
22 | whitelist ${HOME}/.config/homebank | ||
23 | whitelist /usr/share/homebank | ||
24 | include whitelist-common.inc | ||
25 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | apparmor | ||
30 | caps.drop all | ||
31 | machine-id | ||
32 | # net none | ||
33 | netfilter | ||
34 | nodvd | ||
35 | no3d | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | nosound | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix,inet,inet6 | ||
45 | seccomp | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | disable-mnt | ||
50 | private-bin homebank | ||
51 | private-cache | ||
52 | private-dev | ||
53 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11 | ||
54 | private-tmp | ||
55 | |||
56 | dbus-user none | ||
57 | dbus-system none | ||
58 | |||
59 | # memory-deny-write-execute | ||
diff --git a/etc/profile-a-l/host.profile b/etc/profile-a-l/host.profile new file mode 100644 index 000000000..e5a5a7efa --- /dev/null +++ b/etc/profile-a-l/host.profile | |||
@@ -0,0 +1,52 @@ | |||
1 | # Firejail profile for host | ||
2 | # Description: DNS lookup utility | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include host.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist ${RUNUSER} | ||
11 | noblacklist ${PATH}/host | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | ipc-namespace | ||
27 | machine-id | ||
28 | netfilter | ||
29 | no3d | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | nosound | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix,inet,inet6 | ||
39 | seccomp | ||
40 | shell none | ||
41 | tracelog | ||
42 | |||
43 | disable-mnt | ||
44 | private | ||
45 | private-bin bash,host,sh | ||
46 | private-dev | ||
47 | private-tmp | ||
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
52 | memory-deny-write-execute | ||
diff --git a/etc/hugin.profile b/etc/profile-a-l/hugin.profile index 07a697c05..e03b68128 100644 --- a/etc/hugin.profile +++ b/etc/profile-a-l/hugin.profile | |||
@@ -16,11 +16,11 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | caps.drop all | 22 | caps.drop all |
22 | net none | 23 | net none |
23 | nodbus | ||
24 | nodvd | 24 | nodvd |
25 | nogroups | 25 | nogroups |
26 | nonewprivs | 26 | nonewprivs |
@@ -38,3 +38,5 @@ private-cache | |||
38 | private-dev | 38 | private-dev |
39 | private-tmp | 39 | private-tmp |
40 | 40 | ||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/profile-a-l/hyperrogue.profile b/etc/profile-a-l/hyperrogue.profile new file mode 100644 index 000000000..f2cb25edf --- /dev/null +++ b/etc/profile-a-l/hyperrogue.profile | |||
@@ -0,0 +1,51 @@ | |||
1 | # Firejail profile for hyperrogue | ||
2 | # Description: An SDL roguelike in a non-euclidean world | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include hyperrogue.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/hyperrogue.ini | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkfile ${HOME}/hyperrogue.ini | ||
21 | whitelist ${HOME}/hyperrogue.ini | ||
22 | whitelist /usr/share/hyperrogue | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin hyperrogue | ||
44 | private-cache | ||
45 | private-cwd ${HOME} | ||
46 | private-dev | ||
47 | private-etc fonts,machine-id | ||
48 | private-tmp | ||
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/i2prouter.profile b/etc/profile-a-l/i2prouter.profile index 9ffdb9e9b..9ffdb9e9b 100644 --- a/etc/i2prouter.profile +++ b/etc/profile-a-l/i2prouter.profile | |||
diff --git a/etc/i3.profile b/etc/profile-a-l/i3.profile index c1ca0e413..c1ca0e413 100644 --- a/etc/i3.profile +++ b/etc/profile-a-l/i3.profile | |||
diff --git a/etc/gnome-2048.profile b/etc/profile-a-l/iagno.profile index 9eb4c147d..42fc7d449 100644 --- a/etc/gnome-2048.profile +++ b/etc/profile-a-l/iagno.profile | |||
@@ -1,38 +1,40 @@ | |||
1 | # Firejail profile for gnome-2048 | 1 | # Firejail profile for iagno |
2 | # Description: Sliding tile puzzle game | 2 | # Description: Reversi clone for Gnome desktop |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include gnome-2048.local | 5 | include iagno.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.local/share/gnome-2048 | ||
10 | |||
11 | include disable-common.inc | 9 | include disable-common.inc |
12 | include disable-devel.inc | 10 | include disable-devel.inc |
13 | include disable-exec.inc | 11 | include disable-exec.inc |
14 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
17 | 16 | ||
18 | include whitelist-var-common.inc | 17 | include whitelist-var-common.inc |
19 | 18 | ||
20 | mkdir ${HOME}/.local/share/gnome-2048 | 19 | apparmor |
21 | whitelist ${HOME}/.local/share/gnome-2048 | ||
22 | include whitelist-common.inc | ||
23 | |||
24 | caps.drop all | 20 | caps.drop all |
25 | netfilter | 21 | net none |
26 | nodvd | 22 | nodvd |
23 | nogroups | ||
27 | nonewprivs | 24 | nonewprivs |
28 | noroot | 25 | noroot |
29 | notv | 26 | notv |
30 | nou2f | 27 | nou2f |
31 | novideo | 28 | novideo |
32 | protocol unix,inet,inet6 | 29 | protocol unix |
33 | seccomp | 30 | seccomp |
31 | shell none | ||
34 | 32 | ||
35 | disable-mnt | 33 | disable-mnt |
34 | private | ||
35 | private-bin iagno | ||
36 | private-dev | 36 | private-dev |
37 | private-tmp | 37 | private-tmp |
38 | 38 | ||
39 | # dbus-user none | ||
40 | # dbus-system none | ||
diff --git a/etc/icecat.profile b/etc/profile-a-l/icecat.profile index 660343a29..660343a29 100644 --- a/etc/icecat.profile +++ b/etc/profile-a-l/icecat.profile | |||
diff --git a/etc/icedove.profile b/etc/profile-a-l/icedove.profile index 19690cd5a..19690cd5a 100644 --- a/etc/icedove.profile +++ b/etc/profile-a-l/icedove.profile | |||
diff --git a/etc/iceweasel.profile b/etc/profile-a-l/iceweasel.profile index badd2648a..badd2648a 100644 --- a/etc/iceweasel.profile +++ b/etc/profile-a-l/iceweasel.profile | |||
diff --git a/etc/idea.profile b/etc/profile-a-l/idea.profile index 4e43bb629..4e43bb629 100644 --- a/etc/idea.profile +++ b/etc/profile-a-l/idea.profile | |||
diff --git a/etc/idea.sh.profile b/etc/profile-a-l/idea.sh.profile index a7d0d531f..a7d0d531f 100644 --- a/etc/idea.sh.profile +++ b/etc/profile-a-l/idea.sh.profile | |||
diff --git a/etc/ideaIC.profile b/etc/profile-a-l/ideaIC.profile index 7e1778f58..7e1778f58 100644 --- a/etc/ideaIC.profile +++ b/etc/profile-a-l/ideaIC.profile | |||
diff --git a/etc/imagej.profile b/etc/profile-a-l/imagej.profile index 00ee115ed..91a60c188 100644 --- a/etc/imagej.profile +++ b/etc/profile-a-l/imagej.profile | |||
@@ -21,7 +21,6 @@ include disable-programs.inc | |||
21 | caps.drop all | 21 | caps.drop all |
22 | ipc-namespace | 22 | ipc-namespace |
23 | net none | 23 | net none |
24 | nodbus | ||
25 | nodvd | 24 | nodvd |
26 | nogroups | 25 | nogroups |
27 | nonewprivs | 26 | nonewprivs |
@@ -38,3 +37,5 @@ private-bin awk,basename,bash,cut,free,grep,hostname,imagej,ln,ls,mkdir,rm,sort, | |||
38 | private-dev | 37 | private-dev |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
40 | dbus-user none | ||
41 | dbus-system none | ||
diff --git a/etc/img2txt.profile b/etc/profile-a-l/img2txt.profile index 0b30ec33f..ae03fc8bc 100644 --- a/etc/img2txt.profile +++ b/etc/profile-a-l/img2txt.profile | |||
@@ -27,7 +27,6 @@ caps.drop all | |||
27 | ipc-namespace | 27 | ipc-namespace |
28 | machine-id | 28 | machine-id |
29 | net none | 29 | net none |
30 | nodbus | ||
31 | nodvd | 30 | nodvd |
32 | nogroups | 31 | nogroups |
33 | nonewprivs | 32 | nonewprivs |
@@ -47,4 +46,7 @@ private-cache | |||
47 | private-dev | 46 | private-dev |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
50 | memory-deny-write-execute | 52 | memory-deny-write-execute |
diff --git a/etc/impressive.profile b/etc/profile-a-l/impressive.profile index 0bfe5de5a..af82fb059 100644 --- a/etc/impressive.profile +++ b/etc/profile-a-l/impressive.profile | |||
@@ -33,7 +33,6 @@ caps.drop all | |||
33 | ipc-namespace | 33 | ipc-namespace |
34 | machine-id | 34 | machine-id |
35 | net none | 35 | net none |
36 | nodbus | ||
37 | nodvd | 36 | nodvd |
38 | nogroups | 37 | nogroups |
39 | nonewprivs | 38 | nonewprivs |
@@ -51,5 +50,8 @@ private-cache | |||
51 | private-dev | 50 | private-dev |
52 | private-tmp | 51 | private-tmp |
53 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
54 | read-only ${HOME} | 56 | read-only ${HOME} |
55 | read-write ${HOME}/.cache/mesa_shader_cache | 57 | read-write ${HOME}/.cache/mesa_shader_cache |
diff --git a/etc/inkscape.profile b/etc/profile-a-l/inkscape.profile index 30cb5d75d..f14868668 100644 --- a/etc/inkscape.profile +++ b/etc/profile-a-l/inkscape.profile | |||
@@ -37,7 +37,6 @@ caps.drop all | |||
37 | ipc-namespace | 37 | ipc-namespace |
38 | machine-id | 38 | machine-id |
39 | net none | 39 | net none |
40 | nodbus | ||
41 | nodvd | 40 | nodvd |
42 | nogroups | 41 | nogroups |
43 | nonewprivs | 42 | nonewprivs |
@@ -56,4 +55,7 @@ private-cache | |||
56 | private-dev | 55 | private-dev |
57 | private-tmp | 56 | private-tmp |
58 | 57 | ||
58 | dbus-user none | ||
59 | dbus-system none | ||
60 | |||
59 | # memory-deny-write-execute | 61 | # memory-deny-write-execute |
diff --git a/etc/inkview.profile b/etc/profile-a-l/inkview.profile index 4f88b0258..4f88b0258 100644 --- a/etc/inkview.profile +++ b/etc/profile-a-l/inkview.profile | |||
diff --git a/etc/inox.profile b/etc/profile-a-l/inox.profile index 1b3db73b4..1b3db73b4 100644 --- a/etc/inox.profile +++ b/etc/profile-a-l/inox.profile | |||
diff --git a/etc/iridium-browser.profile b/etc/profile-a-l/iridium-browser.profile index c7ee64d56..c7ee64d56 100644 --- a/etc/iridium-browser.profile +++ b/etc/profile-a-l/iridium-browser.profile | |||
diff --git a/etc/iridium.profile b/etc/profile-a-l/iridium.profile index ebb39b0a3..ebb39b0a3 100644 --- a/etc/iridium.profile +++ b/etc/profile-a-l/iridium.profile | |||
diff --git a/etc/itch.profile b/etc/profile-a-l/itch.profile index b3c78c810..b3c78c810 100644 --- a/etc/itch.profile +++ b/etc/profile-a-l/itch.profile | |||
diff --git a/etc/jd-gui.profile b/etc/profile-a-l/jd-gui.profile index 5b7275718..0944051e5 100644 --- a/etc/jd-gui.profile +++ b/etc/profile-a-l/jd-gui.profile | |||
@@ -23,7 +23,6 @@ include whitelist-var-common.inc | |||
23 | caps.drop all | 23 | caps.drop all |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -41,3 +40,5 @@ private-cache | |||
41 | private-dev | 40 | private-dev |
42 | private-tmp | 41 | private-tmp |
43 | 42 | ||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/jdownloader.profile b/etc/profile-a-l/jdownloader.profile index b5f892a9d..b5f892a9d 100644 --- a/etc/jdownloader.profile +++ b/etc/profile-a-l/jdownloader.profile | |||
diff --git a/etc/jerry.profile b/etc/profile-a-l/jerry.profile index f6bfb9953..b79ae0ee0 100644 --- a/etc/jerry.profile +++ b/etc/profile-a-l/jerry.profile | |||
@@ -20,7 +20,6 @@ caps.drop all | |||
20 | machine-id | 20 | machine-id |
21 | net none | 21 | net none |
22 | no3d | 22 | no3d |
23 | nodbus | ||
24 | nodvd | 23 | nodvd |
25 | nogroups | 24 | nogroups |
26 | nonewprivs | 25 | nonewprivs |
@@ -38,4 +37,7 @@ private-dev | |||
38 | private-etc fonts,gtk-2.0,gtk-3.0 | 37 | private-etc fonts,gtk-2.0,gtk-3.0 |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
40 | dbus-user none | ||
41 | dbus-system none | ||
42 | |||
41 | memory-deny-write-execute | 43 | memory-deny-write-execute |
diff --git a/etc/profile-a-l/jitsi-meet-desktop.profile b/etc/profile-a-l/jitsi-meet-desktop.profile new file mode 100644 index 000000000..c4121d835 --- /dev/null +++ b/etc/profile-a-l/jitsi-meet-desktop.profile | |||
@@ -0,0 +1,39 @@ | |||
1 | # Firejail profile for jitsi-meet-desktop | ||
2 | # Description: Jitsi Meet desktop application powered by Electron | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include jitsi-meet-desktop.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore noexec /tmp | ||
10 | |||
11 | noblacklist ${HOME}/.config/Jitsi Meet | ||
12 | |||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | nowhitelist ${DOWNLOADS} | ||
19 | |||
20 | mkdir ${HOME}/.config/Jitsi Meet | ||
21 | |||
22 | whitelist ${HOME}/.config/Jitsi Meet | ||
23 | |||
24 | include whitelist-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | seccomp !chroot | ||
30 | |||
31 | disable-mnt | ||
32 | private-bin bash,jitsi-meet-desktop | ||
33 | private-cache | ||
34 | private-dev | ||
35 | private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,drirc,fonts,glvnd,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,nvidia,pango,passwd,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg | ||
36 | private-tmp | ||
37 | |||
38 | # Redirect | ||
39 | include electron.profile | ||
diff --git a/etc/jitsi.profile b/etc/profile-a-l/jitsi.profile index 223c360b8..223c360b8 100644 --- a/etc/jitsi.profile +++ b/etc/profile-a-l/jitsi.profile | |||
diff --git a/etc/profile-a-l/jumpnbump-menu.profile b/etc/profile-a-l/jumpnbump-menu.profile new file mode 100644 index 000000000..b1852b015 --- /dev/null +++ b/etc/profile-a-l/jumpnbump-menu.profile | |||
@@ -0,0 +1,15 @@ | |||
1 | # Firejail profile for jumpnbump-menu | ||
2 | # Description: Level selection and config menu for the Jump 'n Bump game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include jumpnbump-menu.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | include allow-python3.inc | ||
11 | |||
12 | private-bin jumpnbump-menu,python3* | ||
13 | |||
14 | # Redirect | ||
15 | include jumpnbump.profile | ||
diff --git a/etc/profile-a-l/jumpnbump.profile b/etc/profile-a-l/jumpnbump.profile new file mode 100644 index 000000000..daeb54610 --- /dev/null +++ b/etc/profile-a-l/jumpnbump.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for jumpnbump | ||
2 | # Description: Cute multiplayer platform game with bunnies | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include jumpnbump.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.jumpnbump | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.jumpnbump | ||
20 | whitelist ${HOME}/.jumpnbump | ||
21 | whitelist /usr/share/jumpnbump | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | |||
26 | apparmor | ||
27 | caps.drop all | ||
28 | net none | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix,netlink | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | disable-mnt | ||
42 | private-bin jumpnbump | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc none | ||
46 | private-tmp | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/k3b.profile b/etc/profile-a-l/k3b.profile index 0c1da7ae1..86292744c 100644 --- a/etc/k3b.profile +++ b/etc/profile-a-l/k3b.profile | |||
@@ -9,6 +9,7 @@ include globals.local | |||
9 | noblacklist ${HOME}/.config/k3brc | 9 | noblacklist ${HOME}/.config/k3brc |
10 | noblacklist ${HOME}/.kde/share/config/k3brc | 10 | noblacklist ${HOME}/.kde/share/config/k3brc |
11 | noblacklist ${HOME}/.kde4/share/config/k3brc | 11 | noblacklist ${HOME}/.kde4/share/config/k3brc |
12 | noblacklist ${HOME}/.local/share/kxmlgui5/k3b | ||
12 | noblacklist ${MUSIC} | 13 | noblacklist ${MUSIC} |
13 | 14 | ||
14 | include disable-common.inc | 15 | include disable-common.inc |
diff --git a/etc/kaffeine.profile b/etc/profile-a-l/kaffeine.profile index c7f811939..c7f811939 100644 --- a/etc/kaffeine.profile +++ b/etc/profile-a-l/kaffeine.profile | |||
diff --git a/etc/kalgebra.profile b/etc/profile-a-l/kalgebra.profile index 2dc90b9b9..e1e93163b 100644 --- a/etc/kalgebra.profile +++ b/etc/profile-a-l/kalgebra.profile | |||
@@ -25,7 +25,6 @@ apparmor | |||
25 | caps.drop all | 25 | caps.drop all |
26 | machine-id | 26 | machine-id |
27 | net none | 27 | net none |
28 | nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -45,3 +44,6 @@ private-cache | |||
45 | private-dev | 44 | private-dev |
46 | private-etc fonts,machine-id | 45 | private-etc fonts,machine-id |
47 | private-tmp | 46 | private-tmp |
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/kalgebramobile.profile b/etc/profile-a-l/kalgebramobile.profile index d2394fe20..d2394fe20 100644 --- a/etc/kalgebramobile.profile +++ b/etc/profile-a-l/kalgebramobile.profile | |||
diff --git a/etc/karbon.profile b/etc/profile-a-l/karbon.profile index 3b2e93b0a..d54d6d3d0 100644 --- a/etc/karbon.profile +++ b/etc/profile-a-l/karbon.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for krita | 1 | # Firejail profile alias for krita |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | noblacklist ${HOME}/.local/share/kxmlgui5/karbon | ||
5 | |||
4 | # Redirect | 6 | # Redirect |
5 | include krita.profile | 7 | include krita.profile |
diff --git a/etc/kate.profile b/etc/profile-a-l/kate.profile index 3035393c4..37605dfa9 100644 --- a/etc/kate.profile +++ b/etc/profile-a-l/kate.profile | |||
@@ -15,6 +15,13 @@ noblacklist ${HOME}/.config/kateschemarc | |||
15 | noblacklist ${HOME}/.config/katesyntaxhighlightingrc | 15 | noblacklist ${HOME}/.config/katesyntaxhighlightingrc |
16 | noblacklist ${HOME}/.config/katevirc | 16 | noblacklist ${HOME}/.config/katevirc |
17 | noblacklist ${HOME}/.local/share/kate | 17 | noblacklist ${HOME}/.local/share/kate |
18 | noblacklist ${HOME}/.local/share/kxmlgui5/kate | ||
19 | noblacklist ${HOME}/.local/share/kxmlgui5/katefiletree | ||
20 | noblacklist ${HOME}/.local/share/kxmlgui5/katekonsole | ||
21 | noblacklist ${HOME}/.local/share/kxmlgui5/kateopenheaderplugin | ||
22 | noblacklist ${HOME}/.local/share/kxmlgui5/katepart | ||
23 | noblacklist ${HOME}/.local/share/kxmlgui5/kateproject | ||
24 | noblacklist ${HOME}/.local/share/kxmlgui5/katesearch | ||
18 | 25 | ||
19 | include disable-common.inc | 26 | include disable-common.inc |
20 | # include disable-devel.inc | 27 | # include disable-devel.inc |
@@ -28,7 +35,6 @@ include whitelist-var-common.inc | |||
28 | # apparmor | 35 | # apparmor |
29 | caps.drop all | 36 | caps.drop all |
30 | # net none | 37 | # net none |
31 | # nodbus | ||
32 | netfilter | 38 | netfilter |
33 | nodvd | 39 | nodvd |
34 | nogroups | 40 | nogroups |
@@ -48,4 +54,7 @@ private-dev | |||
48 | # private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg | 54 | # private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg |
49 | private-tmp | 55 | private-tmp |
50 | 56 | ||
57 | # dbus-user none | ||
58 | # dbus-system none | ||
59 | |||
51 | join-or-start kate | 60 | join-or-start kate |
diff --git a/etc/kcalc.profile b/etc/profile-a-l/kcalc.profile index 8c641802b..fa82e76f3 100644 --- a/etc/kcalc.profile +++ b/etc/profile-a-l/kcalc.profile | |||
@@ -6,6 +6,7 @@ include kcalc.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.local/share/kxmlgui5/kcalc | ||
9 | 10 | ||
10 | include disable-common.inc | 11 | include disable-common.inc |
11 | include disable-devel.inc | 12 | include disable-devel.inc |
@@ -13,13 +14,16 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
16 | 18 | ||
19 | mkdir ${HOME}/.local/share/kxmlgui5/kcalc | ||
17 | mkfile ${HOME}/.config/kcalcrc | 20 | mkfile ${HOME}/.config/kcalcrc |
18 | mkfile ${HOME}/.kde/share/config/kcalcrc | 21 | mkfile ${HOME}/.kde/share/config/kcalcrc |
19 | mkfile ${HOME}/.kde4/share/config/kcalcrc | 22 | mkfile ${HOME}/.kde4/share/config/kcalcrc |
20 | whitelist ${HOME}/.config/kcalcrc | 23 | whitelist ${HOME}/.config/kcalcrc |
21 | whitelist ${HOME}/.kde/share/config/kcalcrc | 24 | whitelist ${HOME}/.kde/share/config/kcalcrc |
22 | whitelist ${HOME}/.kde4/share/config/kcalcrc | 25 | whitelist ${HOME}/.kde4/share/config/kcalcrc |
26 | whitelist ${HOME}/.local/share/kxmlgui5/kcalc | ||
23 | include whitelist-common.inc | 27 | include whitelist-common.inc |
24 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
25 | 29 | ||
@@ -27,7 +31,6 @@ apparmor | |||
27 | caps.drop all | 31 | caps.drop all |
28 | net none | 32 | net none |
29 | no3d | 33 | no3d |
30 | nodbus | ||
31 | nodvd | 34 | nodvd |
32 | nogroups | 35 | nogroups |
33 | nonewprivs | 36 | nonewprivs |
@@ -46,3 +49,5 @@ private-dev | |||
46 | # private-lib - problems on Arch | 49 | # private-lib - problems on Arch |
47 | private-tmp | 50 | private-tmp |
48 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
diff --git a/etc/kdeinit4.profile b/etc/profile-a-l/kdeinit4.profile index 082045c62..f7235ea84 100644 --- a/etc/kdeinit4.profile +++ b/etc/profile-a-l/kdeinit4.profile | |||
@@ -13,6 +13,7 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | 17 | ||
17 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
18 | 19 | ||
diff --git a/etc/kdenlive.profile b/etc/profile-a-l/kdenlive.profile index 361109127..9ca33b68e 100644 --- a/etc/kdenlive.profile +++ b/etc/profile-a-l/kdenlive.profile | |||
@@ -11,6 +11,7 @@ ignore noexec ${HOME} | |||
11 | noblacklist ${HOME}/.cache/kdenlive | 11 | noblacklist ${HOME}/.cache/kdenlive |
12 | noblacklist ${HOME}/.config/kdenliverc | 12 | noblacklist ${HOME}/.config/kdenliverc |
13 | noblacklist ${HOME}/.local/share/kdenlive | 13 | noblacklist ${HOME}/.local/share/kdenlive |
14 | noblacklist ${HOME}/.local/share/kxmlgui5/kdenlive | ||
14 | 15 | ||
15 | include disable-common.inc | 16 | include disable-common.inc |
16 | include disable-devel.inc | 17 | include disable-devel.inc |
@@ -22,7 +23,6 @@ include disable-programs.inc | |||
22 | apparmor | 23 | apparmor |
23 | caps.drop all | 24 | caps.drop all |
24 | # net none | 25 | # net none |
25 | # nodbus | ||
26 | nodvd | 26 | nodvd |
27 | nogroups | 27 | nogroups |
28 | nonewprivs | 28 | nonewprivs |
@@ -36,3 +36,6 @@ shell none | |||
36 | private-bin dbus-launch,dvdauthor,ffmpeg,ffplay,ffprobe,genisoimage,kdeinit4,kdeinit4_shutdown,kdeinit4_wrapper,kdeinit5,kdeinit5_shutdown,kdeinit5_wrapper,kdenlive,kdenlive_render,kshell4,kshell5,melt,mlt-melt,vlc,xine | 36 | private-bin dbus-launch,dvdauthor,ffmpeg,ffplay,ffprobe,genisoimage,kdeinit4,kdeinit4_shutdown,kdeinit4_wrapper,kdeinit5,kdeinit5_shutdown,kdeinit5_wrapper,kdenlive,kdenlive_render,kshell4,kshell5,melt,mlt-melt,vlc,xine |
37 | private-dev | 37 | private-dev |
38 | # private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,X11,xdg | 38 | # private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,X11,xdg |
39 | |||
40 | # dbus-user none | ||
41 | # dbus-system none | ||
diff --git a/etc/keepass.profile b/etc/profile-a-l/keepass.profile index 9852f8a79..9852f8a79 100644 --- a/etc/keepass.profile +++ b/etc/profile-a-l/keepass.profile | |||
diff --git a/etc/keepass2.profile b/etc/profile-a-l/keepass2.profile index aef236ccc..aef236ccc 100644 --- a/etc/keepass2.profile +++ b/etc/profile-a-l/keepass2.profile | |||
diff --git a/etc/keepassx.profile b/etc/profile-a-l/keepassx.profile index 44e9c67bb..b8239e140 100644 --- a/etc/keepassx.profile +++ b/etc/profile-a-l/keepassx.profile | |||
@@ -26,7 +26,6 @@ caps.drop all | |||
26 | machine-id | 26 | machine-id |
27 | net none | 27 | net none |
28 | no3d | 28 | no3d |
29 | nodbus | ||
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
@@ -45,4 +44,7 @@ private-dev | |||
45 | private-etc alternatives,fonts,machine-id | 44 | private-etc alternatives,fonts,machine-id |
46 | private-tmp | 45 | private-tmp |
47 | 46 | ||
47 | dbus-user none | ||
48 | dbus-system none | ||
49 | |||
48 | memory-deny-write-execute | 50 | memory-deny-write-execute |
diff --git a/etc/keepassx2.profile b/etc/profile-a-l/keepassx2.profile index fdd27e9f9..fdd27e9f9 100644 --- a/etc/keepassx2.profile +++ b/etc/profile-a-l/keepassx2.profile | |||
diff --git a/etc/keepassxc-cli.profile b/etc/profile-a-l/keepassxc-cli.profile index 925609384..925609384 100644 --- a/etc/keepassxc-cli.profile +++ b/etc/profile-a-l/keepassxc-cli.profile | |||
diff --git a/etc/keepassxc-proxy.profile b/etc/profile-a-l/keepassxc-proxy.profile index b2b6763ee..b2b6763ee 100644 --- a/etc/keepassxc-proxy.profile +++ b/etc/profile-a-l/keepassxc-proxy.profile | |||
diff --git a/etc/profile-a-l/keepassxc.profile b/etc/profile-a-l/keepassxc.profile new file mode 100644 index 000000000..e8fc4e632 --- /dev/null +++ b/etc/profile-a-l/keepassxc.profile | |||
@@ -0,0 +1,81 @@ | |||
1 | # Firejail profile for keepassxc | ||
2 | # Description: Cross Platform Password Manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include keepassxc.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/*.kdb | ||
10 | noblacklist ${HOME}/*.kdbx | ||
11 | noblacklist ${HOME}/.cache/keepassxc | ||
12 | noblacklist ${HOME}/.config/keepassxc | ||
13 | noblacklist ${HOME}/.keepassxc | ||
14 | # 2.2.4 needs this path when compiled with "Native messaging browser extension" | ||
15 | noblacklist ${HOME}/.mozilla | ||
16 | noblacklist ${DOCUMENTS} | ||
17 | |||
18 | include disable-common.inc | ||
19 | include disable-devel.inc | ||
20 | include disable-exec.inc | ||
21 | include disable-interpreters.inc | ||
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | ||
24 | include disable-shell.inc | ||
25 | include disable-xdg.inc | ||
26 | |||
27 | # You can enable whitelisting for keepassxc by uncommenting (or adding to you keepassxc.local) the following lines. | ||
28 | # If you do so, you MUST store your database under ${HOME}/Documents/KeePassXC/foo.kdbx | ||
29 | #mkdir ${HOME}/Documents/KeePassXC | ||
30 | #whitelist ${HOME}/Documents/KeePassXC | ||
31 | # Needed for KeePassXC-Browser | ||
32 | #mkfile ${HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json | ||
33 | #whitelist ${HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json | ||
34 | #mkdir ${HOME}/.cache/keepassxc | ||
35 | #mkdir ${HOME}/.config/keepassxc | ||
36 | #whitelist ${HOME}/.cache/keepassxc | ||
37 | #whitelist ${HOME}/.config/keepassxc | ||
38 | #include whitelist-common.inc | ||
39 | |||
40 | whitelist /usr/share/keepassxc | ||
41 | include whitelist-usr-share-common.inc | ||
42 | include whitelist-var-common.inc | ||
43 | |||
44 | caps.drop all | ||
45 | machine-id | ||
46 | net none | ||
47 | no3d | ||
48 | nodvd | ||
49 | nogroups | ||
50 | nonewprivs | ||
51 | noroot | ||
52 | nosound | ||
53 | notv | ||
54 | nou2f | ||
55 | novideo | ||
56 | protocol unix,netlink | ||
57 | seccomp | ||
58 | shell none | ||
59 | tracelog | ||
60 | |||
61 | private-bin keepassxc,keepassxc-cli,keepassxc-proxy | ||
62 | private-dev | ||
63 | private-etc alternatives,fonts,ld.so.cache,machine-id | ||
64 | private-tmp | ||
65 | |||
66 | dbus-user filter | ||
67 | #dbus-user.own org.keepassxc.KeePassXC | ||
68 | dbus-user.talk com.canonical.Unity.Session | ||
69 | dbus-user.talk org.freedesktop.ScreenSaver | ||
70 | dbus-user.talk org.freedesktop.login1.Manager | ||
71 | dbus-user.talk org.freedesktop.login1.Session | ||
72 | dbus-user.talk org.gnome.ScreenSaver | ||
73 | dbus-user.talk org.gnome.SessionManager | ||
74 | dbus-user.talk org.gnome.SessionManager.Presence | ||
75 | # Uncomment or add to your keepassxc.local to allow Notifications. | ||
76 | #dbus-user.talk org.freedesktop.Notifications | ||
77 | #dbus-user.talk org.kde.StatusNotifierWatcher | ||
78 | dbus-system none | ||
79 | |||
80 | # Mutex is stored in /tmp by default, which is broken by private-tmp | ||
81 | join-or-start keepassxc | ||
diff --git a/etc/kfind.profile b/etc/profile-a-l/kfind.profile index ee4c35825..ed815676a 100644 --- a/etc/kfind.profile +++ b/etc/profile-a-l/kfind.profile | |||
@@ -27,7 +27,6 @@ machine-id | |||
27 | # net none | 27 | # net none |
28 | netfilter | 28 | netfilter |
29 | no3d | 29 | no3d |
30 | # nodbus | ||
31 | nodvd | 30 | nodvd |
32 | nogroups | 31 | nogroups |
33 | nonewprivs | 32 | nonewprivs |
@@ -43,3 +42,6 @@ shell none | |||
43 | # private-bin kbuildsycoca4,kdeinit4,kfind | 42 | # private-bin kbuildsycoca4,kdeinit4,kfind |
44 | private-dev | 43 | private-dev |
45 | private-tmp | 44 | private-tmp |
45 | |||
46 | # dbus-user none | ||
47 | # dbus-system none | ||
diff --git a/etc/kget.profile b/etc/profile-a-l/kget.profile index 485edc1a4..5990d0752 100644 --- a/etc/kget.profile +++ b/etc/profile-a-l/kget.profile | |||
@@ -12,6 +12,7 @@ noblacklist ${HOME}/.kde/share/config/kgetrc | |||
12 | noblacklist ${HOME}/.kde4/share/apps/kget | 12 | noblacklist ${HOME}/.kde4/share/apps/kget |
13 | noblacklist ${HOME}/.kde4/share/config/kgetrc | 13 | noblacklist ${HOME}/.kde4/share/config/kgetrc |
14 | noblacklist ${HOME}/.local/share/kget | 14 | noblacklist ${HOME}/.local/share/kget |
15 | noblacklist ${HOME}/.local/share/kxmlgui5/kget | ||
15 | 16 | ||
16 | include disable-common.inc | 17 | include disable-common.inc |
17 | include disable-devel.inc | 18 | include disable-devel.inc |
diff --git a/etc/kid3-cli.profile b/etc/profile-a-l/kid3-cli.profile index bee62b5d9..bee62b5d9 100644 --- a/etc/kid3-cli.profile +++ b/etc/profile-a-l/kid3-cli.profile | |||
diff --git a/etc/kid3-qt.profile b/etc/profile-a-l/kid3-qt.profile index 9bcede077..9bcede077 100644 --- a/etc/kid3-qt.profile +++ b/etc/profile-a-l/kid3-qt.profile | |||
diff --git a/etc/kid3.profile b/etc/profile-a-l/kid3.profile index 01064feb5..aa2e0ad1e 100644 --- a/etc/kid3.profile +++ b/etc/profile-a-l/kid3.profile | |||
@@ -8,6 +8,7 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${MUSIC} | 9 | noblacklist ${MUSIC} |
10 | noblacklist ${HOME}/.config/kid3rc | 10 | noblacklist ${HOME}/.config/kid3rc |
11 | noblacklist ${HOME}/.local/share/kxmlgui5/kid3 | ||
11 | 12 | ||
12 | include disable-common.inc | 13 | include disable-common.inc |
13 | include disable-devel.inc | 14 | include disable-devel.inc |
@@ -22,7 +23,6 @@ include whitelist-var-common.inc | |||
22 | apparmor | 23 | apparmor |
23 | caps.drop all | 24 | caps.drop all |
24 | netfilter | 25 | netfilter |
25 | nodbus | ||
26 | nodvd | 26 | nodvd |
27 | nogroups | 27 | nogroups |
28 | nonewprivs | 28 | nonewprivs |
@@ -42,4 +42,7 @@ private-tmp | |||
42 | private-opt none | 42 | private-opt none |
43 | private-srv none | 43 | private-srv none |
44 | 44 | ||
45 | dbus-user none | ||
46 | dbus-system none | ||
47 | |||
45 | memory-deny-write-execute | 48 | memory-deny-write-execute |
diff --git a/etc/kino.profile b/etc/profile-a-l/kino.profile index 9e8d61391..b3ade0dd9 100644 --- a/etc/kino.profile +++ b/etc/profile-a-l/kino.profile | |||
@@ -16,6 +16,9 @@ include disable-interpreters.inc | |||
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | 18 | ||
19 | include whitelist-var-common.inc | ||
20 | |||
21 | apparmor | ||
19 | caps.drop all | 22 | caps.drop all |
20 | netfilter | 23 | netfilter |
21 | nogroups | 24 | nogroups |
diff --git a/etc/kiwix-desktop.profile b/etc/profile-a-l/kiwix-desktop.profile index 8b7b12882..d222d6d24 100644 --- a/etc/kiwix-desktop.profile +++ b/etc/profile-a-l/kiwix-desktop.profile | |||
@@ -29,7 +29,6 @@ caps.drop all | |||
29 | ipc-namespace | 29 | ipc-namespace |
30 | netfilter | 30 | netfilter |
31 | # no3d | 31 | # no3d |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -47,3 +46,6 @@ private-cache | |||
47 | private-dev | 46 | private-dev |
48 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,machine-id,pki,pulse,resolv.conf,ssl | 47 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,machine-id,pki,pulse,resolv.conf,ssl |
49 | private-tmp | 48 | private-tmp |
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/klatexformula.profile b/etc/profile-a-l/klatexformula.profile index d584f6a56..10b689ce5 100644 --- a/etc/klatexformula.profile +++ b/etc/profile-a-l/klatexformula.profile | |||
@@ -24,7 +24,6 @@ apparmor | |||
24 | caps.drop all | 24 | caps.drop all |
25 | machine-id | 25 | machine-id |
26 | net none | 26 | net none |
27 | nodbus | ||
28 | nodvd | 27 | nodvd |
29 | nogroups | 28 | nogroups |
30 | nonewprivs | 29 | nonewprivs |
@@ -41,3 +40,6 @@ tracelog | |||
41 | private-cache | 40 | private-cache |
42 | private-dev | 41 | private-dev |
43 | private-tmp | 42 | private-tmp |
43 | |||
44 | dbus-user none | ||
45 | dbus-system none | ||
diff --git a/etc/klatexformula_cmdl.profile b/etc/profile-a-l/klatexformula_cmdl.profile index 9137963c4..9137963c4 100644 --- a/etc/klatexformula_cmdl.profile +++ b/etc/profile-a-l/klatexformula_cmdl.profile | |||
diff --git a/etc/klavaro.profile b/etc/profile-a-l/klavaro.profile index b6b538557..c03d75098 100644 --- a/etc/klavaro.profile +++ b/etc/profile-a-l/klavaro.profile | |||
@@ -29,7 +29,6 @@ caps.drop all | |||
29 | machine-id | 29 | machine-id |
30 | net none | 30 | net none |
31 | no3d | 31 | no3d |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -50,3 +49,6 @@ private-etc alternatives,fonts | |||
50 | private-tmp | 49 | private-tmp |
51 | private-opt none | 50 | private-opt none |
52 | private-srv none | 51 | private-srv none |
52 | |||
53 | dbus-user none | ||
54 | dbus-system none | ||
diff --git a/etc/kmail.profile b/etc/profile-a-l/kmail.profile index 198b05a11..ab4ff10b9 100644 --- a/etc/kmail.profile +++ b/etc/profile-a-l/kmail.profile | |||
@@ -25,6 +25,8 @@ noblacklist ${HOME}/.local/share/apps/korganizer | |||
25 | noblacklist ${HOME}/.local/share/contacts | 25 | noblacklist ${HOME}/.local/share/contacts |
26 | noblacklist ${HOME}/.local/share/emailidentities | 26 | noblacklist ${HOME}/.local/share/emailidentities |
27 | noblacklist ${HOME}/.local/share/kmail2 | 27 | noblacklist ${HOME}/.local/share/kmail2 |
28 | noblacklist ${HOME}/.local/share/kxmlgui5/kmail | ||
29 | noblacklist ${HOME}/.local/share/kxmlgui5/kmail2 | ||
28 | noblacklist ${HOME}/.local/share/local-mail | 30 | noblacklist ${HOME}/.local/share/local-mail |
29 | noblacklist ${HOME}/.local/share/notes | 31 | noblacklist ${HOME}/.local/share/notes |
30 | noblacklist /tmp/akonadi-* | 32 | noblacklist /tmp/akonadi-* |
diff --git a/etc/profile-a-l/kmplayer.profile b/etc/profile-a-l/kmplayer.profile new file mode 100644 index 000000000..7eabde61d --- /dev/null +++ b/etc/profile-a-l/kmplayer.profile | |||
@@ -0,0 +1,41 @@ | |||
1 | # Firejail profile for mplayer | ||
2 | # Description: mplayer KDE GUI (movie player) | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include kmplayer.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/kmplayerrc | ||
10 | noblacklist ${HOME}/.kde/share/config/kmplayerrc | ||
11 | noblacklist ${HOME}/.local/share/kmplayer | ||
12 | noblacklist ${MUSIC} | ||
13 | noblacklist ${VIDEOS} | ||
14 | |||
15 | include disable-common.inc | ||
16 | include disable-devel.inc | ||
17 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | ||
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | |||
26 | apparmor | ||
27 | caps.drop all | ||
28 | netfilter | ||
29 | nogroups | ||
30 | nonewprivs | ||
31 | noroot | ||
32 | nou2f | ||
33 | protocol unix,inet,inet6,netlink | ||
34 | seccomp | ||
35 | shell none | ||
36 | |||
37 | # private-bin kmplayer,mplayer | ||
38 | private-cache | ||
39 | private-dev | ||
40 | private-tmp | ||
41 | |||
diff --git a/etc/knotes.profile b/etc/profile-a-l/knotes.profile index ababfcdb1..f155d0ad6 100644 --- a/etc/knotes.profile +++ b/etc/profile-a-l/knotes.profile | |||
@@ -12,6 +12,7 @@ include knotes.local | |||
12 | 12 | ||
13 | noblacklist ${HOME}/.config/knotesrc | 13 | noblacklist ${HOME}/.config/knotesrc |
14 | noblacklist ${HOME}/.local/share/knotes | 14 | noblacklist ${HOME}/.local/share/knotes |
15 | noblacklist ${HOME}/.local/share/kxmlgui5/knotes | ||
15 | 16 | ||
16 | # Redirect | 17 | # Redirect |
17 | include kmail.profile | 18 | include kmail.profile |
diff --git a/etc/kodi.profile b/etc/profile-a-l/kodi.profile index 86afe46b5..63cae6231 100644 --- a/etc/kodi.profile +++ b/etc/profile-a-l/kodi.profile | |||
@@ -33,6 +33,7 @@ caps.drop all | |||
33 | netfilter | 33 | netfilter |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
36 | # Seems to cause issues with Nvidia drivers sometimes (#3501) | ||
36 | noroot | 37 | noroot |
37 | nou2f | 38 | nou2f |
38 | protocol unix,inet,inet6,netlink | 39 | protocol unix,inet,inet6,netlink |
diff --git a/etc/konversation.profile b/etc/profile-a-l/konversation.profile index dd3e9617f..4dd929c6b 100644 --- a/etc/konversation.profile +++ b/etc/profile-a-l/konversation.profile | |||
@@ -7,8 +7,10 @@ include konversation.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.config/konversationrc | 9 | noblacklist ${HOME}/.config/konversationrc |
10 | noblacklist ${HOME}/.config/konversation.notifyrc | ||
10 | noblacklist ${HOME}/.kde/share/config/konversationrc | 11 | noblacklist ${HOME}/.kde/share/config/konversationrc |
11 | noblacklist ${HOME}/.kde4/share/config/konversationrc | 12 | noblacklist ${HOME}/.kde4/share/config/konversationrc |
13 | noblacklist ${HOME}/.local/share/kxmlgui5/konversation | ||
12 | 14 | ||
13 | include disable-common.inc | 15 | include disable-common.inc |
14 | include disable-devel.inc | 16 | include disable-devel.inc |
@@ -16,6 +18,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 22 | include disable-xdg.inc |
20 | 23 | ||
21 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
diff --git a/etc/kopete.profile b/etc/profile-a-l/kopete.profile index e0bdce059..a5269373d 100644 --- a/etc/kopete.profile +++ b/etc/profile-a-l/kopete.profile | |||
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.kde/share/apps/kopete | |||
10 | noblacklist ${HOME}/.kde/share/config/kopeterc | 10 | noblacklist ${HOME}/.kde/share/config/kopeterc |
11 | noblacklist ${HOME}/.kde4/share/apps/kopete | 11 | noblacklist ${HOME}/.kde4/share/apps/kopete |
12 | noblacklist ${HOME}/.kde4/share/config/kopeterc | 12 | noblacklist ${HOME}/.kde4/share/config/kopeterc |
13 | noblacklist ${HOME}/.local/share/kxmlgui5/kopete | ||
13 | 14 | ||
14 | include disable-common.inc | 15 | include disable-common.inc |
15 | include disable-devel.inc | 16 | include disable-devel.inc |
diff --git a/etc/krita.profile b/etc/profile-a-l/krita.profile index 49c36274a..be9921478 100644 --- a/etc/krita.profile +++ b/etc/profile-a-l/krita.profile | |||
@@ -31,7 +31,6 @@ caps.drop all | |||
31 | ipc-namespace | 31 | ipc-namespace |
32 | # net none | 32 | # net none |
33 | netfilter | 33 | netfilter |
34 | # nodbus | ||
35 | nodvd | 34 | nodvd |
36 | nogroups | 35 | nogroups |
37 | nonewprivs | 36 | nonewprivs |
@@ -47,3 +46,6 @@ shell none | |||
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-tmp | 48 | private-tmp |
49 | |||
50 | # dbus-user none | ||
51 | # dbus-system none | ||
diff --git a/etc/krunner.profile b/etc/profile-a-l/krunner.profile index c64113c15..c64113c15 100644 --- a/etc/krunner.profile +++ b/etc/profile-a-l/krunner.profile | |||
diff --git a/etc/ktorrent.profile b/etc/profile-a-l/ktorrent.profile index 2eb46a7e8..b55e00f22 100644 --- a/etc/ktorrent.profile +++ b/etc/profile-a-l/ktorrent.profile | |||
@@ -12,6 +12,7 @@ noblacklist ${HOME}/.kde/share/config/ktorrentrc | |||
12 | noblacklist ${HOME}/.kde4/share/apps/ktorrent | 12 | noblacklist ${HOME}/.kde4/share/apps/ktorrent |
13 | noblacklist ${HOME}/.kde4/share/config/ktorrentrc | 13 | noblacklist ${HOME}/.kde4/share/config/ktorrentrc |
14 | noblacklist ${HOME}/.local/share/ktorrent | 14 | noblacklist ${HOME}/.local/share/ktorrent |
15 | noblacklist ${HOME}/.local/share/kxmlgui5/ktorrent | ||
15 | 16 | ||
16 | include disable-common.inc | 17 | include disable-common.inc |
17 | include disable-devel.inc | 18 | include disable-devel.inc |
@@ -19,10 +20,12 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 21 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-shell.inc | ||
22 | 24 | ||
23 | mkdir ${HOME}/.kde/share/apps/ktorrent | 25 | mkdir ${HOME}/.kde/share/apps/ktorrent |
24 | mkdir ${HOME}/.kde4/share/apps/ktorrent | 26 | mkdir ${HOME}/.kde4/share/apps/ktorrent |
25 | mkdir ${HOME}/.local/share/ktorrent | 27 | mkdir ${HOME}/.local/share/ktorrent |
28 | mkdir ${HOME}/.local/share/kxmlgui5/ktorrent | ||
26 | mkfile ${HOME}/.config/ktorrentrc | 29 | mkfile ${HOME}/.config/ktorrentrc |
27 | mkfile ${HOME}/.kde/share/config/ktorrentrc | 30 | mkfile ${HOME}/.kde/share/config/ktorrentrc |
28 | mkfile ${HOME}/.kde4/share/config/ktorrentrc | 31 | mkfile ${HOME}/.kde4/share/config/ktorrentrc |
@@ -33,6 +36,7 @@ whitelist ${HOME}/.kde/share/config/ktorrentrc | |||
33 | whitelist ${HOME}/.kde4/share/apps/ktorrent | 36 | whitelist ${HOME}/.kde4/share/apps/ktorrent |
34 | whitelist ${HOME}/.kde4/share/config/ktorrentrc | 37 | whitelist ${HOME}/.kde4/share/config/ktorrentrc |
35 | whitelist ${HOME}/.local/share/ktorrent | 38 | whitelist ${HOME}/.local/share/ktorrent |
39 | whitelist ${HOME}/.local/share/kxmlgui5/ktorrent | ||
36 | include whitelist-common.inc | 40 | include whitelist-common.inc |
37 | include whitelist-var-common.inc | 41 | include whitelist-var-common.inc |
38 | 42 | ||
diff --git a/etc/ktouch.profile b/etc/profile-a-l/ktouch.profile index 446bc50ee..8d8bcdd7d 100644 --- a/etc/ktouch.profile +++ b/etc/profile-a-l/ktouch.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | mkfile ${HOME}/.config/ktouch2rc | 21 | mkfile ${HOME}/.config/ktouch2rc |
@@ -28,7 +29,6 @@ apparmor | |||
28 | caps.drop all | 29 | caps.drop all |
29 | machine-id | 30 | machine-id |
30 | net none | 31 | net none |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -48,3 +48,6 @@ private-cache | |||
48 | private-dev | 48 | private-dev |
49 | private-etc alternatives,fonts,kde5rc,machine-id | 49 | private-etc alternatives,fonts,kde5rc,machine-id |
50 | private-tmp | 50 | private-tmp |
51 | |||
52 | dbus-user none | ||
53 | dbus-system none | ||
diff --git a/etc/kwin_x11.profile b/etc/profile-a-l/kwin_x11.profile index d512dd100..316a93d30 100644 --- a/etc/kwin_x11.profile +++ b/etc/profile-a-l/kwin_x11.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
diff --git a/etc/kwrite.profile b/etc/profile-a-l/kwrite.profile index 31ac19039..4ff8efa70 100644 --- a/etc/kwrite.profile +++ b/etc/profile-a-l/kwrite.profile | |||
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.config/katesyntaxhighlightingrc | |||
13 | noblacklist ${HOME}/.config/katevirc | 13 | noblacklist ${HOME}/.config/katevirc |
14 | noblacklist ${HOME}/.config/kwriterc | 14 | noblacklist ${HOME}/.config/kwriterc |
15 | noblacklist ${HOME}/.local/share/kwrite | 15 | noblacklist ${HOME}/.local/share/kwrite |
16 | noblacklist ${HOME}/.local/share/kxmlgui5/kwrite | ||
16 | noblacklist ${DOCUMENTS} | 17 | noblacklist ${DOCUMENTS} |
17 | 18 | ||
18 | include disable-common.inc | 19 | include disable-common.inc |
@@ -21,6 +22,7 @@ include disable-exec.inc | |||
21 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | 23 | include disable-passwdmgr.inc |
23 | include disable-programs.inc | 24 | include disable-programs.inc |
25 | include disable-shell.inc | ||
24 | include disable-xdg.inc | 26 | include disable-xdg.inc |
25 | 27 | ||
26 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
@@ -29,7 +31,6 @@ apparmor | |||
29 | caps.drop all | 31 | caps.drop all |
30 | # net none | 32 | # net none |
31 | netfilter | 33 | netfilter |
32 | # nodbus | ||
33 | nodvd | 34 | nodvd |
34 | nogroups | 35 | nogroups |
35 | nonewprivs | 36 | nonewprivs |
@@ -48,5 +49,7 @@ private-dev | |||
48 | private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,pulse,xdg | 49 | private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,pulse,xdg |
49 | private-tmp | 50 | private-tmp |
50 | 51 | ||
52 | # dbus-user none | ||
53 | # dbus-system none | ||
51 | 54 | ||
52 | join-or-start kwrite | 55 | join-or-start kwrite |
diff --git a/etc/latex-common.profile b/etc/profile-a-l/latex-common.profile index 712ada722..b090be726 100644 --- a/etc/latex-common.profile +++ b/etc/profile-a-l/latex-common.profile | |||
@@ -14,12 +14,12 @@ include disable-passwdmgr.inc | |||
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | 15 | ||
16 | whitelist /var/lib | 16 | whitelist /var/lib |
17 | include whitelist-runuser-common.inc | ||
17 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
20 | net none | 21 | net none |
21 | no3d | 22 | no3d |
22 | nodbus | ||
23 | nodvd | 23 | nodvd |
24 | nogroups | 24 | nogroups |
25 | nonewprivs | 25 | nonewprivs |
@@ -37,3 +37,5 @@ private-cache | |||
37 | private-dev | 37 | private-dev |
38 | private-tmp | 38 | private-tmp |
39 | 39 | ||
40 | dbus-user none | ||
41 | dbus-system none | ||
diff --git a/etc/latex.profile b/etc/profile-a-l/latex.profile index 2230dd570..2230dd570 100644 --- a/etc/latex.profile +++ b/etc/profile-a-l/latex.profile | |||
diff --git a/etc/lbunzip2.profile b/etc/profile-a-l/lbunzip2.profile index 338d8c8bb..338d8c8bb 100644 --- a/etc/lbunzip2.profile +++ b/etc/profile-a-l/lbunzip2.profile | |||
diff --git a/etc/lbzcat.profile b/etc/profile-a-l/lbzcat.profile index 338d8c8bb..338d8c8bb 100644 --- a/etc/lbzcat.profile +++ b/etc/profile-a-l/lbzcat.profile | |||
diff --git a/etc/lbzip2.profile b/etc/profile-a-l/lbzip2.profile index 338d8c8bb..338d8c8bb 100644 --- a/etc/lbzip2.profile +++ b/etc/profile-a-l/lbzip2.profile | |||
diff --git a/etc/leafpad.profile b/etc/profile-a-l/leafpad.profile index 56a792c8e..eb23b200b 100644 --- a/etc/leafpad.profile +++ b/etc/profile-a-l/leafpad.profile | |||
@@ -14,11 +14,13 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
19 | 20 | ||
21 | apparmor | ||
20 | caps.drop all | 22 | caps.drop all |
21 | netfilter | 23 | net none |
22 | no3d | 24 | no3d |
23 | nodvd | 25 | nodvd |
24 | nogroups | 26 | nogroups |
diff --git a/etc/less.profile b/etc/profile-a-l/less.profile index 00624e0f1..de6fa67d1 100644 --- a/etc/less.profile +++ b/etc/profile-a-l/less.profile | |||
@@ -8,6 +8,7 @@ include less.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | noblacklist ${HOME}/.lesshst | 13 | noblacklist ${HOME}/.lesshst |
13 | 14 | ||
@@ -22,7 +23,6 @@ ipc-namespace | |||
22 | machine-id | 23 | machine-id |
23 | net none | 24 | net none |
24 | no3d | 25 | no3d |
25 | nodbus | ||
26 | nodvd | 26 | nodvd |
27 | nonewprivs | 27 | nonewprivs |
28 | #noroot | 28 | #noroot |
@@ -44,6 +44,9 @@ private-cache | |||
44 | private-dev | 44 | private-dev |
45 | writable-var-log | 45 | writable-var-log |
46 | 46 | ||
47 | dbus-user none | ||
48 | dbus-system none | ||
49 | |||
47 | memory-deny-write-execute | 50 | memory-deny-write-execute |
48 | read-only ${HOME} | 51 | read-only ${HOME} |
49 | read-write ${HOME}/.lesshst | 52 | read-write ${HOME}/.lesshst |
diff --git a/etc/libreoffice.profile b/etc/profile-a-l/libreoffice.profile index aa113883e..f9c92f6f6 100644 --- a/etc/libreoffice.profile +++ b/etc/profile-a-l/libreoffice.profile | |||
@@ -46,4 +46,6 @@ tracelog | |||
46 | private-dev | 46 | private-dev |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-system none | ||
50 | |||
49 | join-or-start libreoffice | 51 | join-or-start libreoffice |
diff --git a/etc/liferea.profile b/etc/profile-a-l/liferea.profile index 7cfd4fc10..7cfd4fc10 100644 --- a/etc/liferea.profile +++ b/etc/profile-a-l/liferea.profile | |||
diff --git a/etc/profile-a-l/lightsoff.profile b/etc/profile-a-l/lightsoff.profile new file mode 100644 index 000000000..c065c44a9 --- /dev/null +++ b/etc/profile-a-l/lightsoff.profile | |||
@@ -0,0 +1,16 @@ | |||
1 | # Firejail profile for lightsoff | ||
2 | # Description: GNOME Lightsoff game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include lightsoff.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | whitelist /usr/share/lightsoff | ||
10 | |||
11 | private-bin lightsoff | ||
12 | |||
13 | dbus-user.own org.gnome.LightsOff | ||
14 | |||
15 | # Redirect | ||
16 | include gnome_games-common.profile | ||
diff --git a/etc/lincity-ng.profile b/etc/profile-a-l/lincity-ng.profile index b55ac9a15..91bd12d0d 100644 --- a/etc/lincity-ng.profile +++ b/etc/profile-a-l/lincity-ng.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.lincity-ng | 20 | mkdir ${HOME}/.lincity-ng |
@@ -21,10 +22,10 @@ whitelist ${HOME}/.lincity-ng | |||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
25 | apparmor | ||
24 | caps.drop all | 26 | caps.drop all |
25 | ipc-namespace | 27 | ipc-namespace |
26 | net none | 28 | net none |
27 | nodbus | ||
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
@@ -42,3 +43,6 @@ private-bin lincity-ng | |||
42 | private-cache | 43 | private-cache |
43 | private-dev | 44 | private-dev |
44 | private-tmp | 45 | private-tmp |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/links.profile b/etc/profile-a-l/links.profile index a31001c87..b2f94d3cf 100644 --- a/etc/links.profile +++ b/etc/profile-a-l/links.profile | |||
@@ -24,6 +24,7 @@ include disable-xdg.inc | |||
24 | mkdir ${HOME}/.links | 24 | mkdir ${HOME}/.links |
25 | whitelist ${HOME}/.links | 25 | whitelist ${HOME}/.links |
26 | whitelist ${DOWNLOADS} | 26 | whitelist ${DOWNLOADS} |
27 | include whitelist-runuser-common.inc | ||
27 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
28 | 29 | ||
29 | caps.drop all | 30 | caps.drop all |
diff --git a/etc/linphone.profile b/etc/profile-a-l/linphone.profile index dc156b298..dc156b298 100644 --- a/etc/linphone.profile +++ b/etc/profile-a-l/linphone.profile | |||
diff --git a/etc/lmms.profile b/etc/profile-a-l/lmms.profile index 98ddd03e5..afe1ad635 100644 --- a/etc/lmms.profile +++ b/etc/profile-a-l/lmms.profile | |||
@@ -22,7 +22,6 @@ caps.drop all | |||
22 | ipc-namespace | 22 | ipc-namespace |
23 | net none | 23 | net none |
24 | no3d | 24 | no3d |
25 | nodbus | ||
26 | nodvd | 25 | nodvd |
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
@@ -37,3 +36,5 @@ shell none | |||
37 | private-dev | 36 | private-dev |
38 | private-tmp | 37 | private-tmp |
39 | 38 | ||
39 | dbus-user none | ||
40 | dbus-system none | ||
diff --git a/etc/lobase.profile b/etc/profile-a-l/lobase.profile index 8348a57fe..8348a57fe 100644 --- a/etc/lobase.profile +++ b/etc/profile-a-l/lobase.profile | |||
diff --git a/etc/localc.profile b/etc/profile-a-l/localc.profile index 8348a57fe..8348a57fe 100644 --- a/etc/localc.profile +++ b/etc/profile-a-l/localc.profile | |||
diff --git a/etc/lodraw.profile b/etc/profile-a-l/lodraw.profile index 8348a57fe..8348a57fe 100644 --- a/etc/lodraw.profile +++ b/etc/profile-a-l/lodraw.profile | |||
diff --git a/etc/loffice.profile b/etc/profile-a-l/loffice.profile index 8348a57fe..8348a57fe 100644 --- a/etc/loffice.profile +++ b/etc/profile-a-l/loffice.profile | |||
diff --git a/etc/lofromtemplate.profile b/etc/profile-a-l/lofromtemplate.profile index 8348a57fe..8348a57fe 100644 --- a/etc/lofromtemplate.profile +++ b/etc/profile-a-l/lofromtemplate.profile | |||
diff --git a/etc/loimpress.profile b/etc/profile-a-l/loimpress.profile index 8348a57fe..8348a57fe 100644 --- a/etc/loimpress.profile +++ b/etc/profile-a-l/loimpress.profile | |||
diff --git a/etc/lollypop.profile b/etc/profile-a-l/lollypop.profile index 1ce83822d..1ce83822d 100644 --- a/etc/lollypop.profile +++ b/etc/profile-a-l/lollypop.profile | |||
diff --git a/etc/lomath.profile b/etc/profile-a-l/lomath.profile index 8348a57fe..8348a57fe 100644 --- a/etc/lomath.profile +++ b/etc/profile-a-l/lomath.profile | |||
diff --git a/etc/loweb.profile b/etc/profile-a-l/loweb.profile index 8348a57fe..8348a57fe 100644 --- a/etc/loweb.profile +++ b/etc/profile-a-l/loweb.profile | |||
diff --git a/etc/lowriter.profile b/etc/profile-a-l/lowriter.profile index 8348a57fe..8348a57fe 100644 --- a/etc/lowriter.profile +++ b/etc/profile-a-l/lowriter.profile | |||
diff --git a/etc/lrunzip.profile b/etc/profile-a-l/lrunzip.profile index c010cbd96..c010cbd96 100644 --- a/etc/lrunzip.profile +++ b/etc/profile-a-l/lrunzip.profile | |||
diff --git a/etc/lrz.profile b/etc/profile-a-l/lrz.profile index 8077be945..8077be945 100644 --- a/etc/lrz.profile +++ b/etc/profile-a-l/lrz.profile | |||
diff --git a/etc/lrzcat.profile b/etc/profile-a-l/lrzcat.profile index d05ee7aae..d05ee7aae 100644 --- a/etc/lrzcat.profile +++ b/etc/profile-a-l/lrzcat.profile | |||
diff --git a/etc/lrzip.profile b/etc/profile-a-l/lrzip.profile index 3767767f6..3767767f6 100644 --- a/etc/lrzip.profile +++ b/etc/profile-a-l/lrzip.profile | |||
diff --git a/etc/lrztar.profile b/etc/profile-a-l/lrztar.profile index 673e9f62e..673e9f62e 100644 --- a/etc/lrztar.profile +++ b/etc/profile-a-l/lrztar.profile | |||
diff --git a/etc/lrzuntar.profile b/etc/profile-a-l/lrzuntar.profile index 245d1c669..245d1c669 100644 --- a/etc/lrzuntar.profile +++ b/etc/profile-a-l/lrzuntar.profile | |||
diff --git a/etc/lugaru.profile b/etc/profile-a-l/lugaru.profile index d81441572..cd8f0e529 100644 --- a/etc/lugaru.profile +++ b/etc/profile-a-l/lugaru.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | mkdir ${HOME}/.config/lugaru | 23 | mkdir ${HOME}/.config/lugaru |
@@ -29,7 +30,6 @@ include whitelist-var-common.inc | |||
29 | caps.drop all | 30 | caps.drop all |
30 | ipc-namespace | 31 | ipc-namespace |
31 | net none | 32 | net none |
32 | nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -47,3 +47,6 @@ private-bin lugaru | |||
47 | private-cache | 47 | private-cache |
48 | private-dev | 48 | private-dev |
49 | private-tmp | 49 | private-tmp |
50 | |||
51 | dbus-user none | ||
52 | dbus-system none | ||
diff --git a/etc/luminance-hdr.profile b/etc/profile-a-l/luminance-hdr.profile index 2b0feaa17..2b0feaa17 100644 --- a/etc/luminance-hdr.profile +++ b/etc/profile-a-l/luminance-hdr.profile | |||
diff --git a/etc/lximage-qt.profile b/etc/profile-a-l/lximage-qt.profile index 74adb7a67..a33ddab78 100644 --- a/etc/lximage-qt.profile +++ b/etc/profile-a-l/lximage-qt.profile | |||
@@ -14,9 +14,11 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include whitelist-var-common.inc | ||
17 | 18 | ||
19 | apparmor | ||
18 | caps.drop all | 20 | caps.drop all |
19 | netfilter | 21 | net none |
20 | no3d | 22 | no3d |
21 | nodvd | 23 | nodvd |
22 | nogroups | 24 | nogroups |
diff --git a/etc/lxmusic.profile b/etc/profile-a-l/lxmusic.profile index e1a37343e..9094f4377 100644 --- a/etc/lxmusic.profile +++ b/etc/profile-a-l/lxmusic.profile | |||
@@ -20,6 +20,7 @@ include disable-xdg.inc | |||
20 | 20 | ||
21 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
22 | 22 | ||
23 | apparmor | ||
23 | caps.drop all | 24 | caps.drop all |
24 | netfilter | 25 | netfilter |
25 | no3d | 26 | no3d |
diff --git a/etc/lynx.profile b/etc/profile-a-l/lynx.profile index fb6fe94ec..dbd0a61e5 100644 --- a/etc/lynx.profile +++ b/etc/profile-a-l/lynx.profile | |||
@@ -16,6 +16,8 @@ include disable-passwdmgr.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | 17 | include disable-xdg.inc |
18 | 18 | ||
19 | include whitelist-runuser-common.inc | ||
20 | |||
19 | caps.drop all | 21 | caps.drop all |
20 | netfilter | 22 | netfilter |
21 | no3d | 23 | no3d |
diff --git a/etc/profile-a-l/lyx.profile b/etc/profile-a-l/lyx.profile new file mode 100644 index 000000000..b2c0afbe7 --- /dev/null +++ b/etc/profile-a-l/lyx.profile | |||
@@ -0,0 +1,33 @@ | |||
1 | # Firejail profile for lyx | ||
2 | # Description: Open source document processor based on LaTeX typsetting | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include lyx.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore private-tmp | ||
10 | |||
11 | noblacklist ${HOME}/.config/LyX | ||
12 | noblacklist ${HOME}/.lyx | ||
13 | |||
14 | include allow-lua.inc | ||
15 | include allow-perl.inc | ||
16 | include allow-python2.inc | ||
17 | include allow-python3.inc | ||
18 | |||
19 | whitelist /usr/share/lyx | ||
20 | whitelist /usr/share/texinfo | ||
21 | whitelist /usr/share/texlive | ||
22 | whitelist /usr/share/texmf-dist | ||
23 | whitelist /usr/share/tlpkg | ||
24 | include whitelist-usr-share-common.inc | ||
25 | |||
26 | apparmor | ||
27 | machine-id | ||
28 | |||
29 | # private-bin atril,dvilualatex,env,latex,lua*,luatex,lyx,lyxclient,okular,pdf2latex,pdflatex,pdftex,perl*,python*,qpdf,qpdfview,sh,tex2lyx,texmf,xelatex | ||
30 | private-etc alternatives,dconf,fonts,gtk-2.0,gtk-3.0,locale,locale.alias,locale.conf,lyx,mime.types,passwd,texmf,X11,xdg | ||
31 | |||
32 | # Redirect | ||
33 | include latex-common.profile | ||
diff --git a/etc/lzcat.profile b/etc/profile-a-l/lzcat.profile index f7410b928..d9c72407f 100644 --- a/etc/lzcat.profile +++ b/etc/profile-a-l/lzcat.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzcmp.profile b/etc/profile-a-l/lzcmp.profile index f7410b928..d9c72407f 100644 --- a/etc/lzcmp.profile +++ b/etc/profile-a-l/lzcmp.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzdiff.profile b/etc/profile-a-l/lzdiff.profile index f7410b928..f7410b928 100644 --- a/etc/lzdiff.profile +++ b/etc/profile-a-l/lzdiff.profile | |||
diff --git a/etc/lzegrep.profile b/etc/profile-a-l/lzegrep.profile index f7410b928..d9c72407f 100644 --- a/etc/lzegrep.profile +++ b/etc/profile-a-l/lzegrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzfgrep.profile b/etc/profile-a-l/lzfgrep.profile index f7410b928..d9c72407f 100644 --- a/etc/lzfgrep.profile +++ b/etc/profile-a-l/lzfgrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzgrep.profile b/etc/profile-a-l/lzgrep.profile index f7410b928..d9c72407f 100644 --- a/etc/lzgrep.profile +++ b/etc/profile-a-l/lzgrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzip.profile b/etc/profile-a-l/lzip.profile index f7410b928..d9c72407f 100644 --- a/etc/lzip.profile +++ b/etc/profile-a-l/lzip.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzless.profile b/etc/profile-a-l/lzless.profile index f7410b928..d9c72407f 100644 --- a/etc/lzless.profile +++ b/etc/profile-a-l/lzless.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzma.profile b/etc/profile-a-l/lzma.profile index f7410b928..d9c72407f 100644 --- a/etc/lzma.profile +++ b/etc/profile-a-l/lzma.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzmadec.profile b/etc/profile-a-l/lzmadec.profile index 0c5ec1b09..0c5ec1b09 100644 --- a/etc/lzmadec.profile +++ b/etc/profile-a-l/lzmadec.profile | |||
diff --git a/etc/lzmainfo.profile b/etc/profile-a-l/lzmainfo.profile index f7410b928..d9c72407f 100644 --- a/etc/lzmainfo.profile +++ b/etc/profile-a-l/lzmainfo.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzmore.profile b/etc/profile-a-l/lzmore.profile index f7410b928..d9c72407f 100644 --- a/etc/lzmore.profile +++ b/etc/profile-a-l/lzmore.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/Maelstrom.profile b/etc/profile-m-z/Maelstrom.profile index cee49111e..77bce4179 100644 --- a/etc/Maelstrom.profile +++ b/etc/profile-m-z/Maelstrom.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | whitelist /var/lib/games | 20 | whitelist /var/lib/games |
@@ -23,7 +24,6 @@ include whitelist-var-common.inc | |||
23 | caps.drop all | 24 | caps.drop all |
24 | ipc-namespace | 25 | ipc-namespace |
25 | net none | 26 | net none |
26 | nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | #nonewprivs | 29 | #nonewprivs |
@@ -41,3 +41,6 @@ private-bin Maelstrom | |||
41 | private-cache | 41 | private-cache |
42 | private-dev | 42 | private-dev |
43 | private-tmp | 43 | private-tmp |
44 | |||
45 | dbus-user none | ||
46 | dbus-system none | ||
diff --git a/etc/Maps.profile b/etc/profile-m-z/Maps.profile index c52d2f2da..c52d2f2da 100644 --- a/etc/Maps.profile +++ b/etc/profile-m-z/Maps.profile | |||
diff --git a/etc/Mathematica.profile b/etc/profile-m-z/Mathematica.profile index c2734b1c1..c2734b1c1 100644 --- a/etc/Mathematica.profile +++ b/etc/profile-m-z/Mathematica.profile | |||
diff --git a/etc/Natron.profile b/etc/profile-m-z/Natron.profile index 42c22bf67..42c22bf67 100644 --- a/etc/Natron.profile +++ b/etc/profile-m-z/Natron.profile | |||
diff --git a/etc/PPSSPPQt.profile b/etc/profile-m-z/PPSSPPQt.profile index c5592f99c..c5592f99c 100644 --- a/etc/PPSSPPQt.profile +++ b/etc/profile-m-z/PPSSPPQt.profile | |||
diff --git a/etc/QMediathekView.profile b/etc/profile-m-z/QMediathekView.profile index b9ddd80c4..589dcfeb6 100644 --- a/etc/QMediathekView.profile +++ b/etc/profile-m-z/QMediathekView.profile | |||
@@ -25,6 +25,7 @@ include disable-exec.inc | |||
25 | include disable-interpreters.inc | 25 | include disable-interpreters.inc |
26 | include disable-passwdmgr.inc | 26 | include disable-passwdmgr.inc |
27 | include disable-programs.inc | 27 | include disable-programs.inc |
28 | include disable-shell.inc | ||
28 | include disable-xdg.inc | 29 | include disable-xdg.inc |
29 | 30 | ||
30 | whitelist /usr/share/qtchooser | 31 | whitelist /usr/share/qtchooser |
@@ -34,7 +35,6 @@ include whitelist-var-common.inc | |||
34 | caps.drop all | 35 | caps.drop all |
35 | netfilter | 36 | netfilter |
36 | # no3d | 37 | # no3d |
37 | # nodbus | ||
38 | nodvd | 38 | nodvd |
39 | nogroups | 39 | nogroups |
40 | nonewprivs | 40 | nonewprivs |
@@ -53,4 +53,7 @@ private-cache | |||
53 | private-dev | 53 | private-dev |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
56 | # dbus-user none | ||
57 | # dbus-system none | ||
58 | |||
56 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 59 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/QOwnNotes.profile b/etc/profile-m-z/QOwnNotes.profile index 8157cdff4..e2dcf17e0 100644 --- a/etc/QOwnNotes.profile +++ b/etc/profile-m-z/QOwnNotes.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | mkdir ${HOME}/Nextcloud/Notes | 23 | mkdir ${HOME}/Nextcloud/Notes |
diff --git a/etc/profile-m-z/Screenshot.profile b/etc/profile-m-z/Screenshot.profile new file mode 100644 index 000000000..d4b083736 --- /dev/null +++ b/etc/profile-m-z/Screenshot.profile | |||
@@ -0,0 +1,6 @@ | |||
1 | # Firejail profile for gnome-screenshot | ||
2 | # This file is overwritten after every install/update | ||
3 | |||
4 | # Temporary fix for https://github.com/netblue30/firejail/issues/2624 | ||
5 | # Redirect | ||
6 | include gnome-screenshot.profile | ||
diff --git a/etc/Telegram.profile b/etc/profile-m-z/Telegram.profile index 310e0237e..310e0237e 100644 --- a/etc/Telegram.profile +++ b/etc/profile-m-z/Telegram.profile | |||
diff --git a/etc/profile-m-z/Thunar.profile b/etc/profile-m-z/Thunar.profile new file mode 100644 index 000000000..28acb414b --- /dev/null +++ b/etc/profile-m-z/Thunar.profile | |||
@@ -0,0 +1,12 @@ | |||
1 | # Firejail profile for Thunar | ||
2 | # Description: File Manager for Xfce | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include Thunar.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Put 'ignore noroot' in your pcmanfm.local if you use MPV+Vulkan (see issue #3012) | ||
10 | |||
11 | # Redirect | ||
12 | include file-manager-common.profile | ||
diff --git a/etc/Viber.profile b/etc/profile-m-z/Viber.profile index 925e130de..3195e39fa 100644 --- a/etc/Viber.profile +++ b/etc/profile-m-z/Viber.profile | |||
@@ -6,6 +6,7 @@ include Viber.local | |||
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | noblacklist ${HOME}/.ViberPC | 8 | noblacklist ${HOME}/.ViberPC |
9 | noblacklist ${PATH}/dig | ||
9 | 10 | ||
10 | include disable-common.inc | 11 | include disable-common.inc |
11 | include disable-devel.inc | 12 | include disable-devel.inc |
diff --git a/etc/VirtualBox.profile b/etc/profile-m-z/VirtualBox.profile index 4c99ae9a3..4c99ae9a3 100644 --- a/etc/VirtualBox.profile +++ b/etc/profile-m-z/VirtualBox.profile | |||
diff --git a/etc/XMind.profile b/etc/profile-m-z/XMind.profile index 7e7c0c3cd..7e7c0c3cd 100644 --- a/etc/XMind.profile +++ b/etc/profile-m-z/XMind.profile | |||
diff --git a/etc/Xephyr.profile b/etc/profile-m-z/Xephyr.profile index ab5fdf942..ab5fdf942 100644 --- a/etc/Xephyr.profile +++ b/etc/profile-m-z/Xephyr.profile | |||
diff --git a/etc/Xvfb.profile b/etc/profile-m-z/Xvfb.profile index 937d02d60..937d02d60 100644 --- a/etc/Xvfb.profile +++ b/etc/profile-m-z/Xvfb.profile | |||
diff --git a/etc/profile-m-z/ZeGrapher.profile b/etc/profile-m-z/ZeGrapher.profile new file mode 100644 index 000000000..02c5a043d --- /dev/null +++ b/etc/profile-m-z/ZeGrapher.profile | |||
@@ -0,0 +1,48 @@ | |||
1 | # Firejail profile for ZeGrapher | ||
2 | # Description: Free and opensource math graphing software | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ZeGrapher.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/ZeGrapher Project | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | |||
19 | whitelist /usr/share/ZeGrapher | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | machine-id | ||
27 | net none | ||
28 | nodvd | ||
29 | nogroups | ||
30 | nonewprivs | ||
31 | noroot | ||
32 | nosound | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix,netlink | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | disable-mnt | ||
42 | private-bin ZeGrapher | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-tmp | ||
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/macrofusion.profile b/etc/profile-m-z/macrofusion.profile index 94d90780b..2e0071b47 100644 --- a/etc/macrofusion.profile +++ b/etc/profile-m-z/macrofusion.profile | |||
@@ -18,12 +18,12 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
23 | caps.drop all | 24 | caps.drop all |
24 | ipc-namespace | 25 | ipc-namespace |
25 | net none | 26 | net none |
26 | nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -41,3 +41,5 @@ private-cache | |||
41 | private-dev | 41 | private-dev |
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
diff --git a/etc/profile-m-z/magicor.profile b/etc/profile-m-z/magicor.profile new file mode 100644 index 000000000..d26aed0bb --- /dev/null +++ b/etc/profile-m-z/magicor.profile | |||
@@ -0,0 +1,52 @@ | |||
1 | # Firejail profile for magicor | ||
2 | # Description: Push ice blocks around to extinguish all fires | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include magicor.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.magicor | ||
10 | |||
11 | # Allow python (blacklisted by disable-interpreters.inc) | ||
12 | include allow-python2.inc | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-shell.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | mkdir ${HOME}/.magicor | ||
24 | whitelist ${HOME}/.magicor | ||
25 | whitelist /usr/share/magicor | ||
26 | include whitelist-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | net none | ||
33 | nodvd | ||
34 | nogroups | ||
35 | nonewprivs | ||
36 | notv | ||
37 | nou2f | ||
38 | novideo | ||
39 | protocol unix | ||
40 | seccomp | ||
41 | shell none | ||
42 | tracelog | ||
43 | |||
44 | disable-mnt | ||
45 | private-bin magicor,python2* | ||
46 | private-cache | ||
47 | private-dev | ||
48 | private-etc machine-id | ||
49 | private-tmp | ||
50 | |||
51 | dbus-user none | ||
52 | dbus-system none | ||
diff --git a/etc/makepkg.profile b/etc/profile-m-z/makepkg.profile index 513fcae55..513fcae55 100644 --- a/etc/makepkg.profile +++ b/etc/profile-m-z/makepkg.profile | |||
diff --git a/etc/manaplus.profile b/etc/profile-m-z/manaplus.profile index 93d409bf8..eba77c8f2 100644 --- a/etc/manaplus.profile +++ b/etc/profile-m-z/manaplus.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | mkdir ${HOME}/.config/mana | 21 | mkdir ${HOME}/.config/mana |
@@ -28,7 +29,6 @@ include whitelist-var-common.inc | |||
28 | caps.drop all | 29 | caps.drop all |
29 | ipc-namespace | 30 | ipc-namespace |
30 | netfilter | 31 | netfilter |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -46,3 +46,6 @@ private-bin manaplus | |||
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-tmp | 48 | private-tmp |
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/masterpdfeditor.profile b/etc/profile-m-z/masterpdfeditor.profile index e4da0c66a..e4da0c66a 100644 --- a/etc/masterpdfeditor.profile +++ b/etc/profile-m-z/masterpdfeditor.profile | |||
diff --git a/etc/masterpdfeditor4.profile b/etc/profile-m-z/masterpdfeditor4.profile index 84e78171f..84e78171f 100644 --- a/etc/masterpdfeditor4.profile +++ b/etc/profile-m-z/masterpdfeditor4.profile | |||
diff --git a/etc/masterpdfeditor5.profile b/etc/profile-m-z/masterpdfeditor5.profile index 057d343dd..057d343dd 100644 --- a/etc/masterpdfeditor5.profile +++ b/etc/profile-m-z/masterpdfeditor5.profile | |||
diff --git a/etc/mate-calc.profile b/etc/profile-m-z/mate-calc.profile index 2f6020ad3..ce418d68f 100644 --- a/etc/mate-calc.profile +++ b/etc/profile-m-z/mate-calc.profile | |||
@@ -22,11 +22,12 @@ whitelist ${HOME}/.cache/mate-calc | |||
22 | whitelist ${HOME}/.config/caja | 22 | whitelist ${HOME}/.config/caja |
23 | whitelist ${HOME}/.config/mate-menu | 23 | whitelist ${HOME}/.config/mate-menu |
24 | include whitelist-common.inc | 24 | include whitelist-common.inc |
25 | include whitelist-var-common.inc | ||
25 | 26 | ||
27 | apparmor | ||
26 | caps.drop all | 28 | caps.drop all |
27 | net none | 29 | net none |
28 | no3d | 30 | no3d |
29 | nodbus | ||
30 | nodvd | 31 | nodvd |
31 | nogroups | 32 | nogroups |
32 | nonewprivs | 33 | nonewprivs |
@@ -46,4 +47,7 @@ private-dev | |||
46 | private-opt none | 47 | private-opt none |
47 | private-tmp | 48 | private-tmp |
48 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
49 | memory-deny-write-execute | 53 | memory-deny-write-execute |
diff --git a/etc/mate-calculator.profile b/etc/profile-m-z/mate-calculator.profile index bb438f5f0..bb438f5f0 100644 --- a/etc/mate-calculator.profile +++ b/etc/profile-m-z/mate-calculator.profile | |||
diff --git a/etc/mate-color-select.profile b/etc/profile-m-z/mate-color-select.profile index f1a7ca18f..b6dc643d4 100644 --- a/etc/mate-color-select.profile +++ b/etc/profile-m-z/mate-color-select.profile | |||
@@ -11,6 +11,7 @@ include disable-exec.inc | |||
11 | include disable-interpreters.inc | 11 | include disable-interpreters.inc |
12 | include disable-passwdmgr.inc | 12 | include disable-passwdmgr.inc |
13 | include disable-programs.inc | 13 | include disable-programs.inc |
14 | include disable-shell.inc | ||
14 | 15 | ||
15 | include whitelist-common.inc | 16 | include whitelist-common.inc |
16 | 17 | ||
diff --git a/etc/mate-dictionary.profile b/etc/profile-m-z/mate-dictionary.profile index 49a776766..2267bbb50 100644 --- a/etc/mate-dictionary.profile +++ b/etc/profile-m-z/mate-dictionary.profile | |||
@@ -13,11 +13,13 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | 17 | ||
17 | mkdir ${HOME}/.config/mate/mate-dictionary | 18 | mkdir ${HOME}/.config/mate/mate-dictionary |
18 | whitelist ${HOME}/.config/mate/mate-dictionary | 19 | whitelist ${HOME}/.config/mate/mate-dictionary |
19 | include whitelist-common.inc | 20 | include whitelist-common.inc |
20 | 21 | ||
22 | apparmor | ||
21 | caps.drop all | 23 | caps.drop all |
22 | netfilter | 24 | netfilter |
23 | no3d | 25 | no3d |
diff --git a/etc/mathematica.profile b/etc/profile-m-z/mathematica.profile index 964060350..964060350 100644 --- a/etc/mathematica.profile +++ b/etc/profile-m-z/mathematica.profile | |||
diff --git a/etc/profile-m-z/mattermost-desktop.profile b/etc/profile-m-z/mattermost-desktop.profile new file mode 100644 index 000000000..e4487c8aa --- /dev/null +++ b/etc/profile-m-z/mattermost-desktop.profile | |||
@@ -0,0 +1,46 @@ | |||
1 | # Firejail profile for mattermost-desktop | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include mattermost-desktop.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | noblacklist ${HOME}/.config/Mattermost | ||
9 | |||
10 | include disable-common.inc | ||
11 | include disable-devel.inc | ||
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-shell.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.config/Mattermost | ||
20 | whitelist ${DOWNLOADS} | ||
21 | whitelist ${HOME}/.config/Mattermost | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | caps.keep sys_admin,sys_chroot | ||
28 | netfilter | ||
29 | nodvd | ||
30 | nogroups | ||
31 | notv | ||
32 | nou2f | ||
33 | novideo | ||
34 | shell none | ||
35 | |||
36 | disable-mnt | ||
37 | private-cache | ||
38 | private-dev | ||
39 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl | ||
40 | private-tmp | ||
41 | |||
42 | # Not tested | ||
43 | #dbus-user filter | ||
44 | #dbus-user.own com.mattermost.Desktop | ||
45 | #dbus-user.talk org.freedesktop.Notifications | ||
46 | #dbus-system none | ||
diff --git a/etc/mcabber.profile b/etc/profile-m-z/mcabber.profile index 134a6ae63..b63de6c3e 100644 --- a/etc/mcabber.profile +++ b/etc/profile-m-z/mcabber.profile | |||
@@ -14,6 +14,7 @@ include disable-devel.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | caps.drop all | 19 | caps.drop all |
19 | netfilter | 20 | netfilter |
diff --git a/etc/mediainfo.profile b/etc/profile-m-z/mediainfo.profile index 40ae663fc..be7c8cbca 100644 --- a/etc/mediainfo.profile +++ b/etc/profile-m-z/mediainfo.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | include whitelist-usr-share-common.inc | 19 | include whitelist-usr-share-common.inc |
19 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
@@ -24,7 +25,6 @@ ipc-namespace | |||
24 | machine-id | 25 | machine-id |
25 | net none | 26 | net none |
26 | no3d | 27 | no3d |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -45,4 +45,7 @@ private-dev | |||
45 | private-etc alternatives | 45 | private-etc alternatives |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
48 | memory-deny-write-execute | 51 | memory-deny-write-execute |
diff --git a/etc/mediathekview.profile b/etc/profile-m-z/mediathekview.profile index 95cd673c6..95cd673c6 100644 --- a/etc/mediathekview.profile +++ b/etc/profile-m-z/mediathekview.profile | |||
diff --git a/etc/megaglest.profile b/etc/profile-m-z/megaglest.profile index 08eae6dfc..19f9edf05 100644 --- a/etc/megaglest.profile +++ b/etc/profile-m-z/megaglest.profile | |||
@@ -18,13 +18,16 @@ include disable-xdg.inc | |||
18 | 18 | ||
19 | mkdir ${HOME}/.megaglest | 19 | mkdir ${HOME}/.megaglest |
20 | whitelist ${HOME}/.megaglest | 20 | whitelist ${HOME}/.megaglest |
21 | whitelist /usr/share/megaglest | ||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
23 | 26 | ||
27 | apparmor | ||
24 | caps.drop all | 28 | caps.drop all |
25 | ipc-namespace | 29 | ipc-namespace |
26 | netfilter | 30 | netfilter |
27 | nodbus | ||
28 | nodvd | 31 | nodvd |
29 | nogroups | 32 | nogroups |
30 | nonewprivs | 33 | nonewprivs |
@@ -42,3 +45,6 @@ private-bin megaglest,megaglest_editor,megaglest_g3dviewer | |||
42 | private-cache | 45 | private-cache |
43 | private-dev | 46 | private-dev |
44 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/megaglest_editor.profile b/etc/profile-m-z/megaglest_editor.profile index 02aad8084..02aad8084 100644 --- a/etc/megaglest_editor.profile +++ b/etc/profile-m-z/megaglest_editor.profile | |||
diff --git a/etc/meld.profile b/etc/profile-m-z/meld.profile index 9a320c13d..385700648 100644 --- a/etc/meld.profile +++ b/etc/profile-m-z/meld.profile | |||
@@ -35,6 +35,9 @@ include disable-interpreters.inc | |||
35 | include disable-passwdmgr.inc | 35 | include disable-passwdmgr.inc |
36 | # Uncomment the next line (or put it into your meld.local) if you don't need to compare files in disable-programs.inc. | 36 | # Uncomment the next line (or put it into your meld.local) if you don't need to compare files in disable-programs.inc. |
37 | #include disable-programs.inc | 37 | #include disable-programs.inc |
38 | include disable-shell.inc | ||
39 | |||
40 | include whitelist-runuser-common.inc | ||
38 | 41 | ||
39 | # Uncomment the next lines (or put it into your meld.local) if you don't need to compare files in /usr/share. | 42 | # Uncomment the next lines (or put it into your meld.local) if you don't need to compare files in /usr/share. |
40 | #whitelist /usr/share/meld | 43 | #whitelist /usr/share/meld |
@@ -67,6 +70,7 @@ private-cache | |||
67 | private-dev | 70 | private-dev |
68 | # Uncomment the next line (or put it into your meld.local) if you don't need to compare in /etc. | 71 | # Uncomment the next line (or put it into your meld.local) if you don't need to compare in /etc. |
69 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,ssl,subversion | 72 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,ssl,subversion |
73 | # Comment the next line (or add 'ignore private-tmp to your meld.local') if you want to use it as a difftool (#3551) | ||
70 | private-tmp | 74 | private-tmp |
71 | 75 | ||
72 | read-only ${HOME}/.ssh | 76 | read-only ${HOME}/.ssh |
diff --git a/etc/mencoder.profile b/etc/profile-m-z/mencoder.profile index ad5ce436a..caf238785 100644 --- a/etc/mencoder.profile +++ b/etc/profile-m-z/mencoder.profile | |||
@@ -18,7 +18,6 @@ ipc-namespace | |||
18 | machine-id | 18 | machine-id |
19 | net none | 19 | net none |
20 | no3d | 20 | no3d |
21 | nodbus | ||
22 | nosound | 21 | nosound |
23 | notv | 22 | notv |
24 | protocol unix | 23 | protocol unix |
@@ -27,6 +26,9 @@ x11 none | |||
27 | 26 | ||
28 | private-bin mencoder | 27 | private-bin mencoder |
29 | 28 | ||
29 | dbus-user none | ||
30 | dbus-system none | ||
31 | |||
30 | memory-deny-write-execute | 32 | memory-deny-write-execute |
31 | 33 | ||
32 | # Redirect | 34 | # Redirect |
diff --git a/etc/mendeleydesktop.profile b/etc/profile-m-z/mendeleydesktop.profile index 1f02ff5c0..6022b110a 100644 --- a/etc/mendeleydesktop.profile +++ b/etc/profile-m-z/mendeleydesktop.profile | |||
@@ -29,7 +29,6 @@ include whitelist-var-common.inc | |||
29 | 29 | ||
30 | caps.drop all | 30 | caps.drop all |
31 | netfilter | 31 | netfilter |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -47,3 +46,5 @@ private-bin cat,env,gconftool-2,ln,mendeleydesktop,python*,sh,update-desktop-dat | |||
47 | private-dev | 46 | private-dev |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/meteo-qt.profile b/etc/profile-m-z/meteo-qt.profile index 4437d86ea..c8b0a0ff1 100644 --- a/etc/meteo-qt.profile +++ b/etc/profile-m-z/meteo-qt.profile | |||
@@ -18,6 +18,7 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
23 | mkdir ${HOME}/.config/meteo-qt | 24 | mkdir ${HOME}/.config/meteo-qt |
@@ -28,7 +29,6 @@ include whitelist-var-common.inc | |||
28 | 29 | ||
29 | caps.drop all | 30 | caps.drop all |
30 | netfilter | 31 | netfilter |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -48,4 +48,7 @@ private-cache | |||
48 | private-dev | 48 | private-dev |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | dbus-user none | ||
52 | dbus-system none | ||
53 | |||
51 | memory-deny-write-execute | 54 | memory-deny-write-execute |
diff --git a/etc/midori.profile b/etc/profile-m-z/midori.profile index e11e2acaa..e15259608 100644 --- a/etc/midori.profile +++ b/etc/profile-m-z/midori.profile | |||
@@ -48,7 +48,9 @@ whitelist ${HOME}/.local/share/webkitgtk | |||
48 | whitelist ${HOME}/.pki | 48 | whitelist ${HOME}/.pki |
49 | whitelist ${HOME}/.local/share/pki | 49 | whitelist ${HOME}/.local/share/pki |
50 | include whitelist-common.inc | 50 | include whitelist-common.inc |
51 | include whitelist-var-common.inc | ||
51 | 52 | ||
53 | apparmor | ||
52 | caps.drop all | 54 | caps.drop all |
53 | netfilter | 55 | netfilter |
54 | nodvd | 56 | nodvd |
@@ -60,3 +62,4 @@ seccomp | |||
60 | tracelog | 62 | tracelog |
61 | 63 | ||
62 | disable-mnt | 64 | disable-mnt |
65 | private-tmp | ||
diff --git a/etc/min.profile b/etc/profile-m-z/min.profile index 7f3aeab44..7f3aeab44 100644 --- a/etc/min.profile +++ b/etc/profile-m-z/min.profile | |||
diff --git a/etc/profile-m-z/mindless.profile b/etc/profile-m-z/mindless.profile new file mode 100644 index 000000000..6108c0b69 --- /dev/null +++ b/etc/profile-m-z/mindless.profile | |||
@@ -0,0 +1,51 @@ | |||
1 | # Firejail profile for mindless | ||
2 | # Description: figure out the secret code | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include mindless.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | whitelist /usr/share/mindless | ||
19 | include whitelist-usr-share-common.inc | ||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
23 | caps.drop all | ||
24 | machine-id | ||
25 | net none | ||
26 | no3d | ||
27 | nodvd | ||
28 | nogroups | ||
29 | nonewprivs | ||
30 | noroot | ||
31 | nosound | ||
32 | notv | ||
33 | nou2f | ||
34 | novideo | ||
35 | protocol unix | ||
36 | seccomp | ||
37 | shell none | ||
38 | tracelog | ||
39 | |||
40 | disable-mnt | ||
41 | private | ||
42 | private-bin mindless | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc fonts | ||
46 | private-tmp | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
51 | memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/minecraft-launcher.profile b/etc/profile-m-z/minecraft-launcher.profile new file mode 100644 index 000000000..8c7d18c58 --- /dev/null +++ b/etc/profile-m-z/minecraft-launcher.profile | |||
@@ -0,0 +1,58 @@ | |||
1 | # Firejail profile for minecraft-launcher | ||
2 | # Description: Official Minecraft launcher from Mojang | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include minecraft-launcher.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # On some distros executable may be in '/opt/minecraft-launcher/', if so, run 'firejail /opt/minecraft-launcher/minecraft-launcher' to start it. | ||
10 | |||
11 | ignore noexec ${HOME} | ||
12 | |||
13 | noblacklist ${HOME}/.minecraft | ||
14 | |||
15 | include allow-java.inc | ||
16 | |||
17 | include disable-common.inc | ||
18 | include disable-devel.inc | ||
19 | include disable-exec.inc | ||
20 | include disable-interpreters.inc | ||
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | ||
23 | include disable-shell.inc | ||
24 | include disable-xdg.inc | ||
25 | |||
26 | mkdir ${HOME}/.minecraft | ||
27 | whitelist ${HOME}/.minecraft | ||
28 | include whitelist-common.inc | ||
29 | include whitelist-runuser-common.inc | ||
30 | include whitelist-usr-share-common.inc | ||
31 | include whitelist-var-common.inc | ||
32 | |||
33 | apparmor | ||
34 | caps.drop all | ||
35 | netfilter | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix,inet,inet6,netlink | ||
44 | seccomp | ||
45 | shell none | ||
46 | tracelog | ||
47 | |||
48 | disable-mnt | ||
49 | private-bin java,java-config,minecraft-launcher | ||
50 | private-cache | ||
51 | private-dev | ||
52 | # If multiplayer or realms break add your own java folder from /etc or comment the line below. | ||
53 | private-etc alternatives,asound.conf,ati,ca-certificates,crypto-policies,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,java-10-openjdk,java-11-openjdk,java-12-openjdk,java-13-openjdk,java-14-openjdk,java-7-openjdk,java-8-openjdk,java-9-openjdk,java-openjdk,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,login.defs,machine-id,mime.types,nvidia,passwd,pki,pulse,resolv.conf,selinux,services,ssl,timezone,X11,xdg | ||
54 | private-opt minecraft-launcher | ||
55 | private-tmp | ||
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/minetest.profile b/etc/profile-m-z/minetest.profile index 0439a1ccc..1da430ce6 100644 --- a/etc/minetest.profile +++ b/etc/profile-m-z/minetest.profile | |||
@@ -6,6 +6,9 @@ include minetest.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # In order to save in-game screenshots to a persistent location edit ~/.minetest/minetest.conf: | ||
10 | # screenshot_path = /home/<USER>/.minetest/screenshots | ||
11 | |||
9 | noblacklist ${HOME}/.cache/minetest | 12 | noblacklist ${HOME}/.cache/minetest |
10 | noblacklist ${HOME}/.minetest | 13 | noblacklist ${HOME}/.minetest |
11 | 14 | ||
@@ -15,19 +18,22 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 22 | include disable-xdg.inc |
19 | 23 | ||
20 | mkdir ${HOME}/.cache/minetest | 24 | mkdir ${HOME}/.cache/minetest |
21 | mkdir ${HOME}/.minetest | 25 | mkdir ${HOME}/.minetest |
22 | whitelist ${HOME}/.cache/minetest | 26 | whitelist ${HOME}/.cache/minetest |
23 | whitelist ${HOME}/.minetest | 27 | whitelist ${HOME}/.minetest |
28 | whitelist /usr/share/minetest | ||
24 | include whitelist-common.inc | 29 | include whitelist-common.inc |
30 | include whitelist-runuser-common.inc | ||
31 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | 32 | include whitelist-var-common.inc |
26 | 33 | ||
27 | caps.drop all | 34 | caps.drop all |
28 | ipc-namespace | 35 | ipc-namespace |
29 | netfilter | 36 | netfilter |
30 | nodbus | ||
31 | nodvd | 37 | nodvd |
32 | nogroups | 38 | nogroups |
33 | nonewprivs | 39 | nonewprivs |
@@ -47,3 +53,6 @@ private-dev | |||
47 | # private-etc needs to be updated, see #1702 | 53 | # private-etc needs to be updated, see #1702 |
48 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl | 54 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl |
49 | private-tmp | 55 | private-tmp |
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/profile-m-z/minitube.profile b/etc/profile-m-z/minitube.profile new file mode 100644 index 000000000..2c70978a9 --- /dev/null +++ b/etc/profile-m-z/minitube.profile | |||
@@ -0,0 +1,61 @@ | |||
1 | # Firejail profile for minitube | ||
2 | # Description: Native Youtube viewer for Linux | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include minitube.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${PICTURES} | ||
10 | noblacklist ${HOME}/.cache/Flavio Tordini | ||
11 | noblacklist ${HOME}/.config/Flavio Tordini | ||
12 | noblacklist ${HOME}/.local/share/Flavio Tordini | ||
13 | |||
14 | include allow-lua.inc | ||
15 | |||
16 | include disable-common.inc | ||
17 | include disable-devel.inc | ||
18 | include disable-exec.inc | ||
19 | include disable-interpreters.inc | ||
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | ||
22 | include disable-shell.inc | ||
23 | include disable-xdg.inc | ||
24 | |||
25 | mkdir ${HOME}/.cache/Flavio Tordini | ||
26 | mkdir ${HOME}/.config/Flavio Tordini | ||
27 | mkdir ${HOME}/.local/share/Flavio Tordini | ||
28 | whitelist ${PICTURES} | ||
29 | whitelist ${HOME}/.cache/Flavio Tordini | ||
30 | whitelist ${HOME}/.config/Flavio Tordini | ||
31 | whitelist ${HOME}/.local/share/Flavio Tordini | ||
32 | whitelist /usr/share/minitube | ||
33 | include whitelist-common.inc | ||
34 | include whitelist-runuser-common.inc | ||
35 | include whitelist-usr-share-common.inc | ||
36 | include whitelist-var-common.inc | ||
37 | |||
38 | apparmor | ||
39 | caps.drop all | ||
40 | netfilter | ||
41 | nodvd | ||
42 | nogroups | ||
43 | nonewprivs | ||
44 | noroot | ||
45 | notv | ||
46 | nou2f | ||
47 | novideo | ||
48 | protocol unix,inet,inet6,netlink | ||
49 | seccomp | ||
50 | shell none | ||
51 | tracelog | ||
52 | |||
53 | disable-mnt | ||
54 | private-bin minitube | ||
55 | private-cache | ||
56 | private-dev | ||
57 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
58 | private-tmp | ||
59 | |||
60 | dbus-user none | ||
61 | dbus-system none | ||
diff --git a/etc/profile-m-z/mirrormagic.profile b/etc/profile-m-z/mirrormagic.profile new file mode 100644 index 000000000..ded84bf7e --- /dev/null +++ b/etc/profile-m-z/mirrormagic.profile | |||
@@ -0,0 +1,51 @@ | |||
1 | # Firejail profile for mirrormagic | ||
2 | # Description: Puzzle game where you steer a beam of light using mirrors | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include mirrormagic.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.mirrormagic | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.mirrormagic | ||
21 | whitelist ${HOME}/.mirrormagic | ||
22 | whitelist /usr/share/mirrormagic | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix,netlink | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private | ||
44 | private-bin mirrormagic | ||
45 | private-cache | ||
46 | private-dev | ||
47 | private-etc machine-id | ||
48 | private-tmp | ||
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/profile-m-z/mocp.profile b/etc/profile-m-z/mocp.profile new file mode 100644 index 000000000..6fc7a4d67 --- /dev/null +++ b/etc/profile-m-z/mocp.profile | |||
@@ -0,0 +1,53 @@ | |||
1 | # Firejail profile for mocp | ||
2 | # Description: A powerful & easy to use console audio player | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include mocp.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.moc | ||
11 | noblacklist ${MUSIC} | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-runuser-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | |||
25 | apparmor | ||
26 | caps.drop all | ||
27 | ipc-namespace | ||
28 | netfilter | ||
29 | no3d | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix,inet,inet6,netlink | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | private-bin mocp | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,machine-id,pki,pulse,resolv.conf,ssl | ||
46 | private-tmp | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
51 | memory-deny-write-execute | ||
52 | read-only ${HOME} | ||
53 | read-write ${HOME}/.moc | ||
diff --git a/etc/mousepad.profile b/etc/profile-m-z/mousepad.profile index 20370a5b5..5f15b71e2 100644 --- a/etc/mousepad.profile +++ b/etc/profile-m-z/mousepad.profile | |||
@@ -14,11 +14,13 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
19 | 20 | ||
21 | apparmor | ||
20 | caps.drop all | 22 | caps.drop all |
21 | netfilter | 23 | net none |
22 | nodvd | 24 | nodvd |
23 | nogroups | 25 | nogroups |
24 | nonewprivs | 26 | nonewprivs |
diff --git a/etc/mp3splt-gtk.profile b/etc/profile-m-z/mp3splt-gtk.profile index e0936476b..3481a4a82 100644 --- a/etc/mp3splt-gtk.profile +++ b/etc/profile-m-z/mp3splt-gtk.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
19 | 20 | ||
@@ -21,7 +22,6 @@ apparmor | |||
21 | caps.drop all | 22 | caps.drop all |
22 | net none | 23 | net none |
23 | no3d | 24 | no3d |
24 | nodbus | ||
25 | nodvd | 25 | nodvd |
26 | nogroups | 26 | nogroups |
27 | nonewprivs | 27 | nonewprivs |
@@ -39,3 +39,6 @@ private-cache | |||
39 | private-dev | 39 | private-dev |
40 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-3.0,machine-id,openal,pulse | 40 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-3.0,machine-id,openal,pulse |
41 | private-tmp | 41 | private-tmp |
42 | |||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/mp3splt.profile b/etc/profile-m-z/mp3splt.profile index 7754d276b..c65754a03 100644 --- a/etc/mp3splt.profile +++ b/etc/profile-m-z/mp3splt.profile | |||
@@ -26,7 +26,6 @@ ipc-namespace | |||
26 | machine-id | 26 | machine-id |
27 | net none | 27 | net none |
28 | no3d | 28 | no3d |
29 | nodbus | ||
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
@@ -49,3 +48,6 @@ private-etc alternatives | |||
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | memory-deny-write-execute | 50 | memory-deny-write-execute |
51 | |||
52 | dbus-user none | ||
53 | dbus-system none | ||
diff --git a/etc/mp3wrap.profile b/etc/profile-m-z/mp3wrap.profile index 9e48f7807..9e48f7807 100644 --- a/etc/mp3wrap.profile +++ b/etc/profile-m-z/mp3wrap.profile | |||
diff --git a/etc/mpDris2.profile b/etc/profile-m-z/mpDris2.profile index fd0351db0..4ba1dfbd6 100644 --- a/etc/mpDris2.profile +++ b/etc/profile-m-z/mpDris2.profile | |||
@@ -20,6 +20,7 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 21 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-shell.inc | ||
23 | include disable-xdg.inc | 24 | include disable-xdg.inc |
24 | 25 | ||
25 | whitelist ${MUSIC} | 26 | whitelist ${MUSIC} |
diff --git a/etc/mpd.profile b/etc/profile-m-z/mpd.profile index 3fda87a48..3fda87a48 100644 --- a/etc/mpd.profile +++ b/etc/profile-m-z/mpd.profile | |||
diff --git a/etc/mpg123-alsa.profile b/etc/profile-m-z/mpg123-alsa.profile index 378435af1..378435af1 100644 --- a/etc/mpg123-alsa.profile +++ b/etc/profile-m-z/mpg123-alsa.profile | |||
diff --git a/etc/mpg123-id3dump.profile b/etc/profile-m-z/mpg123-id3dump.profile index 370a57b3c..370a57b3c 100644 --- a/etc/mpg123-id3dump.profile +++ b/etc/profile-m-z/mpg123-id3dump.profile | |||
diff --git a/etc/mpg123-jack.profile b/etc/profile-m-z/mpg123-jack.profile index e36a2e5b3..e36a2e5b3 100644 --- a/etc/mpg123-jack.profile +++ b/etc/profile-m-z/mpg123-jack.profile | |||
diff --git a/etc/mpg123-nas.profile b/etc/profile-m-z/mpg123-nas.profile index cdbf0b1d2..cdbf0b1d2 100644 --- a/etc/mpg123-nas.profile +++ b/etc/profile-m-z/mpg123-nas.profile | |||
diff --git a/etc/mpg123-openal.profile b/etc/profile-m-z/mpg123-openal.profile index e5585feaa..e5585feaa 100644 --- a/etc/mpg123-openal.profile +++ b/etc/profile-m-z/mpg123-openal.profile | |||
diff --git a/etc/mpg123-oss.profile b/etc/profile-m-z/mpg123-oss.profile index dcb92ecd6..dcb92ecd6 100644 --- a/etc/mpg123-oss.profile +++ b/etc/profile-m-z/mpg123-oss.profile | |||
diff --git a/etc/mpg123-portaudio.profile b/etc/profile-m-z/mpg123-portaudio.profile index 319843504..319843504 100644 --- a/etc/mpg123-portaudio.profile +++ b/etc/profile-m-z/mpg123-portaudio.profile | |||
diff --git a/etc/mpg123-pulse.profile b/etc/profile-m-z/mpg123-pulse.profile index 31063a96b..31063a96b 100644 --- a/etc/mpg123-pulse.profile +++ b/etc/profile-m-z/mpg123-pulse.profile | |||
diff --git a/etc/mpg123-strip.profile b/etc/profile-m-z/mpg123-strip.profile index 62de57c22..62de57c22 100644 --- a/etc/mpg123-strip.profile +++ b/etc/profile-m-z/mpg123-strip.profile | |||
diff --git a/etc/mpg123.bin.profile b/etc/profile-m-z/mpg123.bin.profile index 0a01d0829..0a01d0829 100644 --- a/etc/mpg123.bin.profile +++ b/etc/profile-m-z/mpg123.bin.profile | |||
diff --git a/etc/mpg123.profile b/etc/profile-m-z/mpg123.profile index 6dfeb4586..b1ab81c1e 100644 --- a/etc/mpg123.profile +++ b/etc/profile-m-z/mpg123.profile | |||
@@ -1,13 +1,13 @@ | |||
1 | # Firejail profile for mpg123 | 1 | # Firejail profile for mpg123 |
2 | # Description: MPEG audio player/decoder | 2 | # Description: MPEG audio player/decoder |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include mpg123.local | 6 | include mpg123.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
7 | include globals.local | 8 | include globals.local |
8 | 9 | ||
9 | noblacklist ${MUSIC} | 10 | noblacklist ${MUSIC} |
10 | noblacklist ${VIDEOS} | ||
11 | 11 | ||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
@@ -23,17 +23,23 @@ include whitelist-var-common.inc | |||
23 | apparmor | 23 | apparmor |
24 | caps.drop all | 24 | caps.drop all |
25 | netfilter | 25 | netfilter |
26 | nodbus | 26 | no3d |
27 | nogroups | 27 | nogroups |
28 | nonewprivs | 28 | nonewprivs |
29 | noroot | 29 | noroot |
30 | notv | ||
30 | nou2f | 31 | nou2f |
32 | novideo | ||
31 | protocol unix,inet,inet6,netlink | 33 | protocol unix,inet,inet6,netlink |
32 | seccomp | 34 | seccomp |
33 | shell none | 35 | shell none |
36 | tracelog | ||
34 | 37 | ||
35 | #private-bin mpg123* | 38 | #private-bin mpg123* |
36 | private-dev | 39 | private-dev |
37 | private-tmp | 40 | private-tmp |
38 | 41 | ||
42 | dbus-user none | ||
43 | dbus-system none | ||
44 | |||
39 | memory-deny-write-execute | 45 | memory-deny-write-execute |
diff --git a/etc/mplayer.profile b/etc/profile-m-z/mplayer.profile index 9ab4f8c7f..cd25d6c0b 100644 --- a/etc/mplayer.profile +++ b/etc/profile-m-z/mplayer.profile | |||
@@ -21,7 +21,9 @@ include disable-xdg.inc | |||
21 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | apparmor | ||
24 | caps.drop all | 25 | caps.drop all |
26 | # net none - mplayer can be used for streaming. | ||
25 | netfilter | 27 | netfilter |
26 | # nogroups | 28 | # nogroups |
27 | nonewprivs | 29 | nonewprivs |
diff --git a/etc/mpsyt.profile b/etc/profile-m-z/mpsyt.profile index 546755ecb..e0c6ff1c8 100644 --- a/etc/mpsyt.profile +++ b/etc/profile-m-z/mpsyt.profile | |||
@@ -26,6 +26,7 @@ include disable-exec.inc | |||
26 | include disable-interpreters.inc | 26 | include disable-interpreters.inc |
27 | include disable-passwdmgr.inc | 27 | include disable-passwdmgr.inc |
28 | include disable-programs.inc | 28 | include disable-programs.inc |
29 | include disable-shell.inc | ||
29 | include disable-xdg.inc | 30 | include disable-xdg.inc |
30 | 31 | ||
31 | mkdir ${HOME}/.config/mps-youtube | 32 | mkdir ${HOME}/.config/mps-youtube |
@@ -48,7 +49,6 @@ include whitelist-var-common.inc | |||
48 | apparmor | 49 | apparmor |
49 | caps.drop all | 50 | caps.drop all |
50 | netfilter | 51 | netfilter |
51 | nodbus | ||
52 | nodvd | 52 | nodvd |
53 | # Seems to cause issues with Nvidia drivers sometimes | 53 | # Seems to cause issues with Nvidia drivers sometimes |
54 | nogroups | 54 | nogroups |
@@ -67,3 +67,5 @@ private-bin env,ffmpeg,mplayer,mpsyt,mpv,python*,youtube-dl | |||
67 | private-dev | 67 | private-dev |
68 | private-tmp | 68 | private-tmp |
69 | 69 | ||
70 | dbus-user none | ||
71 | dbus-system none | ||
diff --git a/etc/mpv.profile b/etc/profile-m-z/mpv.profile index 56cd66199..2fc027257 100644 --- a/etc/mpv.profile +++ b/etc/profile-m-z/mpv.profile | |||
@@ -11,6 +11,8 @@ noblacklist ${HOME}/.config/mpv | |||
11 | noblacklist ${HOME}/.config/youtube-dl | 11 | noblacklist ${HOME}/.config/youtube-dl |
12 | noblacklist ${HOME}/.netrc | 12 | noblacklist ${HOME}/.netrc |
13 | 13 | ||
14 | # Allow lua (blacklisted by disable-interpreters.inc) | ||
15 | include allow-lua.inc | ||
14 | # Allow python (blacklisted by disable-interpreters.inc) | 16 | # Allow python (blacklisted by disable-interpreters.inc) |
15 | include allow-python2.inc | 17 | include allow-python2.inc |
16 | include allow-python3.inc | 18 | include allow-python3.inc |
@@ -25,8 +27,11 @@ include disable-exec.inc | |||
25 | include disable-interpreters.inc | 27 | include disable-interpreters.inc |
26 | include disable-passwdmgr.inc | 28 | include disable-passwdmgr.inc |
27 | include disable-programs.inc | 29 | include disable-programs.inc |
30 | include disable-shell.inc | ||
28 | include disable-xdg.inc | 31 | include disable-xdg.inc |
29 | 32 | ||
33 | whitelist /usr/share/lua | ||
34 | whitelist /usr/share/lua* | ||
30 | whitelist /usr/share/vulkan | 35 | whitelist /usr/share/vulkan |
31 | include whitelist-usr-share-common.inc | 36 | include whitelist-usr-share-common.inc |
32 | include whitelist-var-common.inc | 37 | include whitelist-var-common.inc |
@@ -34,8 +39,7 @@ include whitelist-var-common.inc | |||
34 | apparmor | 39 | apparmor |
35 | caps.drop all | 40 | caps.drop all |
36 | netfilter | 41 | netfilter |
37 | nodbus | 42 | # nogroups seems to cause issues with Nvidia drivers sometimes |
38 | # Seems to cause issues with Nvidia drivers sometimes | ||
39 | nogroups | 43 | nogroups |
40 | nonewprivs | 44 | nonewprivs |
41 | noroot | 45 | noroot |
@@ -46,6 +50,9 @@ shell none | |||
46 | tracelog | 50 | tracelog |
47 | 51 | ||
48 | private-bin env,mpv,python*,youtube-dl | 52 | private-bin env,mpv,python*,youtube-dl |
49 | # Causes slow OSD, see #2838 | 53 | # private-cache causes slow OSD, see #2838 |
50 | #private-cache | 54 | #private-cache |
51 | private-dev | 55 | private-dev |
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/profile-m-z/mrrescue.profile b/etc/profile-m-z/mrrescue.profile new file mode 100644 index 000000000..f02a4f357 --- /dev/null +++ b/etc/profile-m-z/mrrescue.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for mrrescue | ||
2 | # Description: Arcade-style fire fighting game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include mrrescue.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/love | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.local/share/love | ||
20 | whitelist ${HOME}/.local/share/love | ||
21 | whitelist /usr/share/mrrescue | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | |||
26 | apparmor | ||
27 | caps.drop all | ||
28 | net none | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix,netlink | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | disable-mnt | ||
42 | private-bin love,mrrescue,sh | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc machine-id | ||
46 | private-tmp | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/ms-excel.profile b/etc/profile-m-z/ms-excel.profile index db24e8f9b..db24e8f9b 100644 --- a/etc/ms-excel.profile +++ b/etc/profile-m-z/ms-excel.profile | |||
diff --git a/etc/ms-office.profile b/etc/profile-m-z/ms-office.profile index 3bc674134..a6892d698 100644 --- a/etc/ms-office.profile +++ b/etc/profile-m-z/ms-office.profile | |||
@@ -21,7 +21,6 @@ include disable-programs.inc | |||
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | netfilter | 23 | netfilter |
24 | nodbus | ||
25 | nodvd | 24 | nodvd |
26 | nogroups | 25 | nogroups |
27 | nonewprivs | 26 | nonewprivs |
@@ -40,3 +39,5 @@ private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl | |||
40 | private-dev | 39 | private-dev |
41 | private-tmp | 40 | private-tmp |
42 | 41 | ||
42 | dbus-user none | ||
43 | dbus-system none | ||
diff --git a/etc/ms-onenote.profile b/etc/profile-m-z/ms-onenote.profile index 9ea0637bd..9ea0637bd 100644 --- a/etc/ms-onenote.profile +++ b/etc/profile-m-z/ms-onenote.profile | |||
diff --git a/etc/ms-outlook.profile b/etc/profile-m-z/ms-outlook.profile index fc3e7c009..fc3e7c009 100644 --- a/etc/ms-outlook.profile +++ b/etc/profile-m-z/ms-outlook.profile | |||
diff --git a/etc/ms-powerpoint.profile b/etc/profile-m-z/ms-powerpoint.profile index dadcd5b1e..dadcd5b1e 100644 --- a/etc/ms-powerpoint.profile +++ b/etc/profile-m-z/ms-powerpoint.profile | |||
diff --git a/etc/ms-skype.profile b/etc/profile-m-z/ms-skype.profile index df1618361..df1618361 100644 --- a/etc/ms-skype.profile +++ b/etc/profile-m-z/ms-skype.profile | |||
diff --git a/etc/ms-word.profile b/etc/profile-m-z/ms-word.profile index 5a617a893..5a617a893 100644 --- a/etc/ms-word.profile +++ b/etc/profile-m-z/ms-word.profile | |||
diff --git a/etc/profile-m-z/mtpaint.profile b/etc/profile-m-z/mtpaint.profile new file mode 100644 index 000000000..cfd00e8ae --- /dev/null +++ b/etc/profile-m-z/mtpaint.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for mtpaint | ||
2 | # Description: Simple painting and editing program | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include mtpaint.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${PICTURES} | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | machine-id | ||
27 | net none | ||
28 | nodvd | ||
29 | no3d | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin mtpaint | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-tmp | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/multimc.profile b/etc/profile-m-z/multimc.profile index 338f494c9..338f494c9 100644 --- a/etc/multimc.profile +++ b/etc/profile-m-z/multimc.profile | |||
diff --git a/etc/multimc5.profile b/etc/profile-m-z/multimc5.profile index 475307418..475307418 100644 --- a/etc/multimc5.profile +++ b/etc/profile-m-z/multimc5.profile | |||
diff --git a/etc/mumble.profile b/etc/profile-m-z/mumble.profile index 94ccbad0c..0c4efc3d3 100644 --- a/etc/mumble.profile +++ b/etc/profile-m-z/mumble.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | 20 | ||
20 | mkdir ${HOME}/.config/Mumble | 21 | mkdir ${HOME}/.config/Mumble |
21 | mkdir ${HOME}/.local/share/data/Mumble | 22 | mkdir ${HOME}/.local/share/data/Mumble |
@@ -34,7 +35,7 @@ nogroups | |||
34 | nonewprivs | 35 | nonewprivs |
35 | noroot | 36 | noroot |
36 | notv | 37 | notv |
37 | protocol unix,inet,inet6 | 38 | protocol unix,inet,inet6,netlink |
38 | seccomp | 39 | seccomp |
39 | shell none | 40 | shell none |
40 | tracelog | 41 | tracelog |
diff --git a/etc/mupdf-gl.profile b/etc/profile-m-z/mupdf-gl.profile index be94a9083..be94a9083 100644 --- a/etc/mupdf-gl.profile +++ b/etc/profile-m-z/mupdf-gl.profile | |||
diff --git a/etc/mupdf-x11-curl.profile b/etc/profile-m-z/mupdf-x11-curl.profile index a04d386a2..a04d386a2 100644 --- a/etc/mupdf-x11-curl.profile +++ b/etc/profile-m-z/mupdf-x11-curl.profile | |||
diff --git a/etc/mupdf-x11.profile b/etc/profile-m-z/mupdf-x11.profile index 256201d0c..256201d0c 100644 --- a/etc/mupdf-x11.profile +++ b/etc/profile-m-z/mupdf-x11.profile | |||
diff --git a/etc/mupdf.profile b/etc/profile-m-z/mupdf.profile index 43afbc859..a3e56170a 100644 --- a/etc/mupdf.profile +++ b/etc/profile-m-z/mupdf.profile | |||
@@ -18,10 +18,10 @@ include disable-xdg.inc | |||
18 | 18 | ||
19 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
20 | 20 | ||
21 | apparmor | ||
21 | caps.drop all | 22 | caps.drop all |
22 | machine-id | 23 | machine-id |
23 | net none | 24 | net none |
24 | nodbus | ||
25 | nodvd | 25 | nodvd |
26 | nogroups | 26 | nogroups |
27 | nonewprivs | 27 | nonewprivs |
@@ -38,3 +38,6 @@ tracelog | |||
38 | private-dev | 38 | private-dev |
39 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload | 39 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload |
40 | private-tmp | 40 | private-tmp |
41 | |||
42 | dbus-user none | ||
43 | dbus-system none | ||
diff --git a/etc/mupen64plus.profile b/etc/profile-m-z/mupen64plus.profile index e131f5319..00983a8f3 100644 --- a/etc/mupen64plus.profile +++ b/etc/profile-m-z/mupen64plus.profile | |||
@@ -24,10 +24,12 @@ include whitelist-common.inc | |||
24 | 24 | ||
25 | caps.drop all | 25 | caps.drop all |
26 | net none | 26 | net none |
27 | nodbus | ||
28 | nodvd | 27 | nodvd |
29 | nonewprivs | 28 | nonewprivs |
30 | noroot | 29 | noroot |
31 | notv | 30 | notv |
32 | novideo | 31 | novideo |
33 | seccomp | 32 | seccomp |
33 | |||
34 | dbus-user none | ||
35 | dbus-system none | ||
diff --git a/etc/muraster.profile b/etc/profile-m-z/muraster.profile index 90e3f2050..90e3f2050 100644 --- a/etc/muraster.profile +++ b/etc/profile-m-z/muraster.profile | |||
diff --git a/etc/musescore.profile b/etc/profile-m-z/musescore.profile index b3693c956..679e82ae8 100644 --- a/etc/musescore.profile +++ b/etc/profile-m-z/musescore.profile | |||
@@ -23,6 +23,7 @@ include disable-xdg.inc | |||
23 | 23 | ||
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
25 | 25 | ||
26 | apparmor | ||
26 | caps.drop all | 27 | caps.drop all |
27 | netfilter | 28 | netfilter |
28 | no3d | 29 | no3d |
diff --git a/etc/musixmatch.profile b/etc/profile-m-z/musixmatch.profile index a6b85a8e4..a6b85a8e4 100644 --- a/etc/musixmatch.profile +++ b/etc/profile-m-z/musixmatch.profile | |||
diff --git a/etc/mutool.profile b/etc/profile-m-z/mutool.profile index e61f4665d..e61f4665d 100644 --- a/etc/mutool.profile +++ b/etc/profile-m-z/mutool.profile | |||
diff --git a/etc/mutt.profile b/etc/profile-m-z/mutt.profile index 1fc412955..1ce12f54f 100644 --- a/etc/mutt.profile +++ b/etc/profile-m-z/mutt.profile | |||
@@ -40,6 +40,8 @@ include disable-interpreters.inc | |||
40 | include disable-passwdmgr.inc | 40 | include disable-passwdmgr.inc |
41 | include disable-programs.inc | 41 | include disable-programs.inc |
42 | 42 | ||
43 | include whitelist-runuser-common.inc | ||
44 | |||
43 | caps.drop all | 45 | caps.drop all |
44 | netfilter | 46 | netfilter |
45 | no3d | 47 | no3d |
@@ -57,3 +59,4 @@ shell none | |||
57 | 59 | ||
58 | private-dev | 60 | private-dev |
59 | writable-run-user | 61 | writable-run-user |
62 | writable-var | ||
diff --git a/etc/mypaint-ora-thumbnailer.profile b/etc/profile-m-z/mypaint-ora-thumbnailer.profile index 59b3024ed..59b3024ed 100644 --- a/etc/mypaint-ora-thumbnailer.profile +++ b/etc/profile-m-z/mypaint-ora-thumbnailer.profile | |||
diff --git a/etc/mypaint.profile b/etc/profile-m-z/mypaint.profile index d75651d78..c592e8477 100644 --- a/etc/mypaint.profile +++ b/etc/profile-m-z/mypaint.profile | |||
@@ -28,7 +28,6 @@ caps.drop all | |||
28 | machine-id | 28 | machine-id |
29 | net none | 29 | net none |
30 | no3d | 30 | no3d |
31 | nodbus | ||
32 | nodvd | 31 | nodvd |
33 | nogroups | 32 | nogroups |
34 | nonewprivs | 33 | nonewprivs |
@@ -47,3 +46,5 @@ private-dev | |||
47 | private-etc alternatives,dconf,fonts,gtk-3.0 | 46 | private-etc alternatives,dconf,fonts,gtk-3.0 |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/nano.profile b/etc/profile-m-z/nano.profile index bc8c3dde0..2a4625896 100644 --- a/etc/nano.profile +++ b/etc/profile-m-z/nano.profile | |||
@@ -28,7 +28,6 @@ ipc-namespace | |||
28 | machine-id | 28 | machine-id |
29 | net none | 29 | net none |
30 | no3d | 30 | no3d |
31 | nodbus | ||
32 | nodvd | 31 | nodvd |
33 | nogroups | 32 | nogroups |
34 | nonewprivs | 33 | nonewprivs |
@@ -50,4 +49,7 @@ private-dev | |||
50 | # Comment the next line if you want to edit files in /etc directly | 49 | # Comment the next line if you want to edit files in /etc directly |
51 | private-etc alternatives,nanorc | 50 | private-etc alternatives,nanorc |
52 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
53 | memory-deny-write-execute | 55 | memory-deny-write-execute |
diff --git a/etc/natron.profile b/etc/profile-m-z/natron.profile index 7ad217b72..5bf152f84 100644 --- a/etc/natron.profile +++ b/etc/profile-m-z/natron.profile | |||
@@ -22,7 +22,6 @@ include disable-programs.inc | |||
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | net none | 24 | net none |
25 | nodbus | ||
26 | nodvd | 25 | nodvd |
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
@@ -34,3 +33,6 @@ seccomp | |||
34 | shell none | 33 | shell none |
35 | 34 | ||
36 | private-bin natron,Natron,NatronRenderer | 35 | private-bin natron,Natron,NatronRenderer |
36 | |||
37 | dbus-user none | ||
38 | dbus-system none | ||
diff --git a/etc/profile-m-z/nautilus.profile b/etc/profile-m-z/nautilus.profile new file mode 100644 index 000000000..e54bea228 --- /dev/null +++ b/etc/profile-m-z/nautilus.profile | |||
@@ -0,0 +1,15 @@ | |||
1 | # Firejail profile for nautilus | ||
2 | # Description: File manager and graphical shell for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nautilus.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Nautilus is started by systemd on most systems. Therefore it is not firejailed by default. Since there | ||
10 | # is already a nautilus process running on gnome desktops firejail will have no effect. | ||
11 | |||
12 | # Put 'ignore noroot' in your nautilus.local if you use MPV+Vulkan (see issue #3012) | ||
13 | |||
14 | # Redirect | ||
15 | include file-manager-common.profile | ||
diff --git a/etc/ncdu.profile b/etc/profile-m-z/ncdu.profile index 9fda6ebe0..651804bf1 100644 --- a/etc/ncdu.profile +++ b/etc/profile-m-z/ncdu.profile | |||
@@ -12,7 +12,6 @@ include disable-exec.inc | |||
12 | 12 | ||
13 | caps.drop all | 13 | caps.drop all |
14 | ipc-namespace | 14 | ipc-namespace |
15 | nodbus | ||
16 | net none | 15 | net none |
17 | no3d | 16 | no3d |
18 | nodvd | 17 | nodvd |
@@ -31,4 +30,7 @@ x11 none | |||
31 | private-dev | 30 | private-dev |
32 | # private-tmp | 31 | # private-tmp |
33 | 32 | ||
33 | dbus-user none | ||
34 | dbus-system none | ||
35 | |||
34 | memory-deny-write-execute | 36 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/nemo.profile b/etc/profile-m-z/nemo.profile new file mode 100644 index 000000000..1b3333e8c --- /dev/null +++ b/etc/profile-m-z/nemo.profile | |||
@@ -0,0 +1,12 @@ | |||
1 | # Firejail profile for nemo | ||
2 | # Description: File manager and graphical shell for Cinnamon | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nemo.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Put 'ignore noroot' in your nemo.local if you use MPV+Vulkan (see issue #3012) | ||
10 | |||
11 | # Redirect | ||
12 | include file-manager-common.profile | ||
diff --git a/etc/netactview.profile b/etc/profile-m-z/netactview.profile index 0618caf68..fd73cea89 100644 --- a/etc/netactview.profile +++ b/etc/profile-m-z/netactview.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkfile ${HOME}/.netactview | 20 | mkfile ${HOME}/.netactview |
@@ -29,7 +30,6 @@ ipc-namespace | |||
29 | machine-id | 30 | machine-id |
30 | netfilter | 31 | netfilter |
31 | no3d | 32 | no3d |
32 | nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -49,4 +49,7 @@ private-etc alternatives,fonts | |||
49 | private-lib | 49 | private-lib |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
52 | memory-deny-write-execute | 55 | memory-deny-write-execute |
diff --git a/etc/nethack-vultures.profile b/etc/profile-m-z/nethack-vultures.profile index 079f44ee7..4daa8054b 100644 --- a/etc/nethack-vultures.profile +++ b/etc/profile-m-z/nethack-vultures.profile | |||
@@ -24,7 +24,6 @@ include whitelist-var-common.inc | |||
24 | caps.drop all | 24 | caps.drop all |
25 | ipc-namespace | 25 | ipc-namespace |
26 | net none | 26 | net none |
27 | nodbus | ||
28 | nodvd | 27 | nodvd |
29 | nogroups | 28 | nogroups |
30 | #nonewprivs | 29 | #nonewprivs |
@@ -41,3 +40,6 @@ private-cache | |||
41 | private-dev | 40 | private-dev |
42 | private-tmp | 41 | private-tmp |
43 | writable-var | 42 | writable-var |
43 | |||
44 | dbus-user none | ||
45 | dbus-system none | ||
diff --git a/etc/nethack.profile b/etc/profile-m-z/nethack.profile index 3df632451..c8c927db2 100644 --- a/etc/nethack.profile +++ b/etc/profile-m-z/nethack.profile | |||
@@ -23,7 +23,6 @@ caps.drop all | |||
23 | ipc-namespace | 23 | ipc-namespace |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | #nonewprivs | 28 | #nonewprivs |
@@ -42,4 +41,7 @@ private-dev | |||
42 | private-tmp | 41 | private-tmp |
43 | writable-var | 42 | writable-var |
44 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
46 | |||
45 | #memory-deny-write-execute | 47 | #memory-deny-write-execute |
diff --git a/etc/netsurf.profile b/etc/profile-m-z/netsurf.profile index 0ddb7bbbe..0ddb7bbbe 100644 --- a/etc/netsurf.profile +++ b/etc/profile-m-z/netsurf.profile | |||
diff --git a/etc/neverball.profile b/etc/profile-m-z/neverball.profile index 84c634549..84c634549 100644 --- a/etc/neverball.profile +++ b/etc/profile-m-z/neverball.profile | |||
diff --git a/etc/neverputt.profile b/etc/profile-m-z/neverputt.profile index d370d1218..d370d1218 100644 --- a/etc/neverputt.profile +++ b/etc/profile-m-z/neverputt.profile | |||
diff --git a/etc/newsbeuter.profile b/etc/profile-m-z/newsbeuter.profile index 059c2156d..85581a2f0 100644 --- a/etc/newsbeuter.profile +++ b/etc/profile-m-z/newsbeuter.profile | |||
@@ -1,4 +1,4 @@ | |||
1 | # Firejail profile for Newsboat | 1 | # Firejail profile for Newsbeuter |
2 | # Description: Text based Atom/RSS feed reader | 2 | # Description: Text based Atom/RSS feed reader |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
diff --git a/etc/newsboat.profile b/etc/profile-m-z/newsboat.profile index e063abe53..a7bac6286 100644 --- a/etc/newsboat.profile +++ b/etc/profile-m-z/newsboat.profile | |||
@@ -19,13 +19,13 @@ include disable-xdg.inc | |||
19 | mkdir ${HOME}/.newsboat | 19 | mkdir ${HOME}/.newsboat |
20 | whitelist ${HOME}/.newsboat | 20 | whitelist ${HOME}/.newsboat |
21 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-runuser-common.inc | ||
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | netfilter | 27 | netfilter |
27 | no3d | 28 | no3d |
28 | nodbus | ||
29 | nodvd | 29 | nodvd |
30 | nogroups | 30 | nogroups |
31 | nonewprivs | 31 | nonewprivs |
@@ -44,4 +44,7 @@ private-dev | |||
44 | private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl,terminfo | 44 | private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl,terminfo |
45 | private-tmp | 45 | private-tmp |
46 | 46 | ||
47 | dbus-user none | ||
48 | dbus-system none | ||
49 | |||
47 | memory-deny-write-execute | 50 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/newsflash.profile b/etc/profile-m-z/newsflash.profile new file mode 100644 index 000000000..d0ac83baf --- /dev/null +++ b/etc/profile-m-z/newsflash.profile | |||
@@ -0,0 +1,60 @@ | |||
1 | # Firejail profile for newsflash | ||
2 | # Description: Modern feed reader | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include newsflash.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/NewsFlashGTK | ||
10 | noblacklist ${HOME}/.config/news-flash | ||
11 | noblacklist ${HOME}/.local/share/news-flash | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | mkdir ${HOME}/.cache/NewsFlashGTK | ||
23 | mkdir ${HOME}/.config/news-flash | ||
24 | mkdir ${HOME}/.local/share/news-flash | ||
25 | whitelist ${HOME}/.cache/NewsFlashGTK | ||
26 | whitelist ${HOME}/.config/news-flash | ||
27 | whitelist ${HOME}/.local/share/news-flash | ||
28 | include whitelist-common.inc | ||
29 | include whitelist-runuser-common.inc | ||
30 | include whitelist-usr-share-common.inc | ||
31 | include whitelist-var-common.inc | ||
32 | |||
33 | apparmor | ||
34 | caps.drop all | ||
35 | machine-id | ||
36 | netfilter | ||
37 | nodvd | ||
38 | nogroups | ||
39 | nonewprivs | ||
40 | noroot | ||
41 | nosound | ||
42 | notv | ||
43 | nou2f | ||
44 | novideo | ||
45 | protocol unix,inet,inet6 | ||
46 | seccomp | ||
47 | shell none | ||
48 | tracelog | ||
49 | |||
50 | disable-mnt | ||
51 | private-bin com.gitlab.newsflash,newsflash | ||
52 | private-cache | ||
53 | private-dev | ||
54 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pango,pki,resolv.conf,ssl,X11 | ||
55 | private-tmp | ||
56 | |||
57 | dbus-user none | ||
58 | #dbus-user.own com.gitlab.newsflash | ||
59 | #dbus-user.talk org.freedesktop.Notifications | ||
60 | dbus-system none | ||
diff --git a/etc/nheko.profile b/etc/profile-m-z/nheko.profile index 119b30239..701098f4b 100644 --- a/etc/nheko.profile +++ b/etc/profile-m-z/nheko.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | mkdir ${HOME}/.config/nheko | 20 | mkdir ${HOME}/.config/nheko |
20 | mkdir ${HOME}/.cache/nheko/nheko | 21 | mkdir ${HOME}/.cache/nheko/nheko |
diff --git a/etc/profile-m-z/nicotine.profile b/etc/profile-m-z/nicotine.profile new file mode 100644 index 000000000..6c363345e --- /dev/null +++ b/etc/profile-m-z/nicotine.profile | |||
@@ -0,0 +1,56 @@ | |||
1 | # Firejail profile for Nicotine Plus | ||
2 | # Description: Soulseek music-sharing client | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nicotine.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.nicotine | ||
10 | |||
11 | include allow-python2.inc | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | mkdir ${HOME}/.nicotine | ||
23 | whitelist ${DOWNLOADS} | ||
24 | whitelist ${HOME}/.nicotine | ||
25 | whitelist /usr/share/GeoIP | ||
26 | include whitelist-common.inc | ||
27 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
29 | include whitelist-var-common.inc | ||
30 | |||
31 | apparmor | ||
32 | caps.drop all | ||
33 | #ipc-namespace | ||
34 | netfilter | ||
35 | no3d | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | nosound | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix,inet,inet6 | ||
45 | seccomp | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | disable-mnt | ||
50 | private-bin nicotine,python2* | ||
51 | private-cache | ||
52 | private-dev | ||
53 | private-tmp | ||
54 | |||
55 | dbus-user none | ||
56 | dbus-system none | ||
diff --git a/etc/nitroshare-cli.profile b/etc/profile-m-z/nitroshare-cli.profile index d9cb2edc5..d9cb2edc5 100644 --- a/etc/nitroshare-cli.profile +++ b/etc/profile-m-z/nitroshare-cli.profile | |||
diff --git a/etc/nitroshare-nmh.profile b/etc/profile-m-z/nitroshare-nmh.profile index d9cb2edc5..d9cb2edc5 100644 --- a/etc/nitroshare-nmh.profile +++ b/etc/profile-m-z/nitroshare-nmh.profile | |||
diff --git a/etc/nitroshare-send.profile b/etc/profile-m-z/nitroshare-send.profile index d9cb2edc5..d9cb2edc5 100644 --- a/etc/nitroshare-send.profile +++ b/etc/profile-m-z/nitroshare-send.profile | |||
diff --git a/etc/nitroshare-ui.profile b/etc/profile-m-z/nitroshare-ui.profile index d9cb2edc5..d9cb2edc5 100644 --- a/etc/nitroshare-ui.profile +++ b/etc/profile-m-z/nitroshare-ui.profile | |||
diff --git a/etc/nitroshare.profile b/etc/profile-m-z/nitroshare.profile index dfa64cff9..1743a771e 100644 --- a/etc/nitroshare.profile +++ b/etc/profile-m-z/nitroshare.profile | |||
@@ -26,7 +26,6 @@ include whitelist-var-common.inc | |||
26 | caps.drop all | 26 | caps.drop all |
27 | netfilter | 27 | netfilter |
28 | no3d | 28 | no3d |
29 | # nodbus | ||
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
@@ -47,4 +46,7 @@ private-etc alternatives,ca-certificates,dconf,fonts,hostname,hosts,ld.so.cache, | |||
47 | # private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare | 46 | # private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
49 | # dbus-user none | ||
50 | # dbus-system none | ||
51 | |||
50 | # memory-deny-write-execute | 52 | # memory-deny-write-execute |
diff --git a/etc/nomacs.profile b/etc/profile-m-z/nomacs.profile index 7a7ff504a..d081c9cb7 100644 --- a/etc/nomacs.profile +++ b/etc/profile-m-z/nomacs.profile | |||
@@ -43,5 +43,3 @@ private-cache | |||
43 | private-dev | 43 | private-dev |
44 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,login.defs,machine-id,pki,resolv.conf,ssl | 44 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,login.defs,machine-id,pki,resolv.conf,ssl |
45 | private-tmp | 45 | private-tmp |
46 | |||
47 | memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/nslookup.profile b/etc/profile-m-z/nslookup.profile new file mode 100644 index 000000000..a8e0ddd89 --- /dev/null +++ b/etc/profile-m-z/nslookup.profile | |||
@@ -0,0 +1,56 @@ | |||
1 | # Firejail profile for nslookup | ||
2 | # Description: DNS lookup utility | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include nslookup.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist /tmp/.X11-unix | ||
11 | blacklist ${RUNUSER}/wayland-* | ||
12 | blacklist ${RUNUSER} | ||
13 | |||
14 | noblacklist ${PATH}/nslookup | ||
15 | |||
16 | include disable-common.inc | ||
17 | include disable-devel.inc | ||
18 | include disable-exec.inc | ||
19 | include disable-interpreters.inc | ||
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | ||
22 | include disable-xdg.inc | ||
23 | |||
24 | whitelist ${HOME}/.nslookuprc | ||
25 | include whitelist-common.inc | ||
26 | include whitelist-usr-share-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | apparmor | ||
30 | caps.drop all | ||
31 | ipc-namespace | ||
32 | machine-id | ||
33 | netfilter | ||
34 | no3d | ||
35 | nodvd | ||
36 | nogroups | ||
37 | nonewprivs | ||
38 | noroot | ||
39 | nosound | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix,inet,inet6 | ||
44 | seccomp | ||
45 | shell none | ||
46 | tracelog | ||
47 | |||
48 | disable-mnt | ||
49 | private-bin bash,nslookup,sh | ||
50 | private-dev | ||
51 | private-tmp | ||
52 | |||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
56 | memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/nuclear.profile b/etc/profile-m-z/nuclear.profile new file mode 100644 index 000000000..1b97eda9b --- /dev/null +++ b/etc/profile-m-z/nuclear.profile | |||
@@ -0,0 +1,40 @@ | |||
1 | # Firejail profile for nuclear | ||
2 | # Description: Stream music from Youtube,Soundcloud,Jamendo | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nuclear.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore dbus-user | ||
10 | |||
11 | noblacklist ${HOME}/.config/nuclear | ||
12 | |||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-shell.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.config/nuclear | ||
20 | whitelist ${HOME}/.config/nuclear | ||
21 | include whitelist-common.inc | ||
22 | include whitelist-runuser-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | |||
26 | no3d | ||
27 | nou2f | ||
28 | novideo | ||
29 | shell none | ||
30 | |||
31 | disable-mnt | ||
32 | # private-bin nuclear | ||
33 | private-cache | ||
34 | private-dev | ||
35 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
36 | private-opt nuclear | ||
37 | private-tmp | ||
38 | |||
39 | # Redirect | ||
40 | include electron.profile | ||
diff --git a/etc/nylas.profile b/etc/profile-m-z/nylas.profile index c959eb991..c959eb991 100644 --- a/etc/nylas.profile +++ b/etc/profile-m-z/nylas.profile | |||
diff --git a/etc/nyx.profile b/etc/profile-m-z/nyx.profile index c4475c75c..9e27dafab 100644 --- a/etc/nyx.profile +++ b/etc/profile-m-z/nyx.profile | |||
@@ -18,6 +18,7 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
23 | mkdir ${HOME}/.nyx | 24 | mkdir ${HOME}/.nyx |
@@ -28,7 +29,6 @@ include whitelist-var-common.inc | |||
28 | caps.drop all | 29 | caps.drop all |
29 | netfilter | 30 | netfilter |
30 | no3d | 31 | no3d |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -50,3 +50,5 @@ private-opt none | |||
50 | private-srv none | 50 | private-srv none |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
diff --git a/etc/obs.profile b/etc/profile-m-z/obs.profile index 4277bdab3..4277bdab3 100644 --- a/etc/obs.profile +++ b/etc/profile-m-z/obs.profile | |||
diff --git a/etc/ocenaudio.profile b/etc/profile-m-z/ocenaudio.profile index a523a6c56..ae18cfff9 100644 --- a/etc/ocenaudio.profile +++ b/etc/profile-m-z/ocenaudio.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
@@ -29,8 +30,6 @@ ipc-namespace | |||
29 | #net none | 30 | #net none |
30 | netfilter | 31 | netfilter |
31 | no3d | 32 | no3d |
32 | # nodbus - breaks preferences, comment (or put 'ignore nodbus' in your oceanaudio.local) when needed | ||
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nogroups | 34 | nogroups |
36 | nonewprivs | 35 | nonewprivs |
@@ -49,4 +48,8 @@ private-dev | |||
49 | private-etc alternatives,asound.conf,fonts,ld.so.cache,pulse | 48 | private-etc alternatives,asound.conf,fonts,ld.so.cache,pulse |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
51 | # breaks preferences | ||
52 | # dbus-user none | ||
53 | # dbus-system none | ||
54 | |||
52 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 55 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/odt2txt.profile b/etc/profile-m-z/odt2txt.profile index c0c5b671c..6201b6fba 100644 --- a/etc/odt2txt.profile +++ b/etc/profile-m-z/odt2txt.profile | |||
@@ -15,12 +15,12 @@ include disable-devel.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | caps.drop all | 21 | caps.drop all |
21 | net none | 22 | net none |
22 | no3d | 23 | no3d |
23 | nodbus | ||
24 | nodvd | 24 | nodvd |
25 | nogroups | 25 | nogroups |
26 | nonewprivs | 26 | nonewprivs |
@@ -40,4 +40,8 @@ private-cache | |||
40 | private-dev | 40 | private-dev |
41 | private-etc alternatives | 41 | private-etc alternatives |
42 | private-tmp | 42 | private-tmp |
43 | |||
44 | dbus-user none | ||
45 | dbus-system none | ||
46 | |||
43 | read-only ${HOME} | 47 | read-only ${HOME} |
diff --git a/etc/oggsplt.profile b/etc/profile-m-z/oggsplt.profile index 5aedadde9..5aedadde9 100644 --- a/etc/oggsplt.profile +++ b/etc/profile-m-z/oggsplt.profile | |||
diff --git a/etc/okular.profile b/etc/profile-m-z/okular.profile index 9debd86ff..36723ca29 100644 --- a/etc/okular.profile +++ b/etc/profile-m-z/okular.profile | |||
@@ -15,6 +15,7 @@ noblacklist ${HOME}/.kde/share/config/okularrc | |||
15 | noblacklist ${HOME}/.kde4/share/apps/okular | 15 | noblacklist ${HOME}/.kde4/share/apps/okular |
16 | noblacklist ${HOME}/.kde4/share/config/okularpartrc | 16 | noblacklist ${HOME}/.kde4/share/config/okularpartrc |
17 | noblacklist ${HOME}/.kde4/share/config/okularrc | 17 | noblacklist ${HOME}/.kde4/share/config/okularrc |
18 | noblacklist ${HOME}/.local/share/kxmlgui5/okular | ||
18 | noblacklist ${HOME}/.local/share/okular | 19 | noblacklist ${HOME}/.local/share/okular |
19 | noblacklist ${DOCUMENTS} | 20 | noblacklist ${DOCUMENTS} |
20 | 21 | ||
@@ -24,9 +25,11 @@ include disable-exec.inc | |||
24 | include disable-interpreters.inc | 25 | include disable-interpreters.inc |
25 | include disable-passwdmgr.inc | 26 | include disable-passwdmgr.inc |
26 | include disable-programs.inc | 27 | include disable-programs.inc |
28 | include disable-shell.inc | ||
27 | include disable-xdg.inc | 29 | include disable-xdg.inc |
28 | 30 | ||
29 | whitelist /usr/share/config.kcfg | 31 | whitelist /usr/share/config.kcfg |
32 | whitelist /usr/share/kxmlgui5/okular | ||
30 | whitelist /usr/share/okular | 33 | whitelist /usr/share/okular |
31 | whitelist /usr/share/poppler | 34 | whitelist /usr/share/poppler |
32 | include whitelist-usr-share-common.inc | 35 | include whitelist-usr-share-common.inc |
@@ -37,7 +40,6 @@ caps.drop all | |||
37 | machine-id | 40 | machine-id |
38 | # net none | 41 | # net none |
39 | netfilter | 42 | netfilter |
40 | # nodbus | ||
41 | nodvd | 43 | nodvd |
42 | nogroups | 44 | nogroups |
43 | nonewprivs | 45 | nonewprivs |
@@ -56,6 +58,9 @@ private-dev | |||
56 | private-etc alternatives,cups,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,xdg | 58 | private-etc alternatives,cups,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,xdg |
57 | # private-tmp - on KDE we need access to the real /tmp for data exchange with email clients | 59 | # private-tmp - on KDE we need access to the real /tmp for data exchange with email clients |
58 | 60 | ||
61 | # dbus-user none | ||
62 | # dbus-system none | ||
63 | |||
59 | # memory-deny-write-execute | 64 | # memory-deny-write-execute |
60 | 65 | ||
61 | join-or-start okular | 66 | join-or-start okular |
diff --git a/etc/onionshare-gui.profile b/etc/profile-m-z/onionshare-gui.profile index 5bfcd0527..5bfcd0527 100644 --- a/etc/onionshare-gui.profile +++ b/etc/profile-m-z/onionshare-gui.profile | |||
diff --git a/etc/ooffice.profile b/etc/profile-m-z/ooffice.profile index 8348a57fe..8348a57fe 100644 --- a/etc/ooffice.profile +++ b/etc/profile-m-z/ooffice.profile | |||
diff --git a/etc/ooviewdoc.profile b/etc/profile-m-z/ooviewdoc.profile index 8348a57fe..8348a57fe 100644 --- a/etc/ooviewdoc.profile +++ b/etc/profile-m-z/ooviewdoc.profile | |||
diff --git a/etc/open-invaders.profile b/etc/profile-m-z/open-invaders.profile index 5925ccc09..e18599d1d 100644 --- a/etc/open-invaders.profile +++ b/etc/profile-m-z/open-invaders.profile | |||
@@ -10,17 +10,20 @@ noblacklist ${HOME}/.openinvaders | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
16 | 18 | ||
17 | mkdir ${HOME}/.openinvaders | 19 | mkdir ${HOME}/.openinvaders |
18 | whitelist ${HOME}/.openinvaders | 20 | whitelist ${HOME}/.openinvaders |
19 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | ||
20 | 23 | ||
24 | apparmor | ||
21 | caps.drop all | 25 | caps.drop all |
22 | net none | 26 | net none |
23 | nodbus | ||
24 | nodvd | 27 | nodvd |
25 | nogroups | 28 | nogroups |
26 | nonewprivs | 29 | nonewprivs |
@@ -32,6 +35,9 @@ protocol unix,netlink | |||
32 | seccomp | 35 | seccomp |
33 | shell none | 36 | shell none |
34 | 37 | ||
35 | # private-bin open-invaders | 38 | private-bin open-invaders |
36 | private-dev | 39 | private-dev |
37 | private-tmp | 40 | private-tmp |
41 | |||
42 | dbus-user none | ||
43 | dbus-system none | ||
diff --git a/etc/openarena.profile b/etc/profile-m-z/openarena.profile index c83e78e2c..45682fc31 100644 --- a/etc/openarena.profile +++ b/etc/profile-m-z/openarena.profile | |||
@@ -16,28 +16,35 @@ include disable-passwdmgr.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | 17 | include disable-xdg.inc |
18 | 18 | ||
19 | mkdir ${HOME}/.openarena | ||
20 | whitelist ${HOME}/.openarena | ||
21 | whitelist /usr/share/openarena | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.in | ||
19 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
20 | 26 | ||
21 | apparmor | 27 | apparmor |
22 | caps.drop all | 28 | caps.drop all |
23 | # ipc-namespace | 29 | netfilter |
24 | # netfilter | 30 | nodvd |
25 | # nodbus | 31 | nogroups |
26 | # nodvd | ||
27 | # nogroups | ||
28 | nonewprivs | 32 | nonewprivs |
29 | noroot | 33 | noroot |
30 | notv | 34 | notv |
31 | # nou2f | 35 | nou2f |
32 | novideo | 36 | novideo |
33 | protocol unix,inet,inet6,netlink | 37 | protocol unix,inet,inet6,netlink |
34 | seccomp | 38 | seccomp |
35 | shell none | 39 | shell none |
36 | # tracelog | 40 | tracelog |
37 | 41 | ||
38 | # disable-mnt | 42 | disable-mnt |
39 | # private-bin openarena | 43 | private-bin bash,cut,glxinfo,grep,head,openarena,openarena_ded,quake3,zenity |
40 | private-cache | 44 | private-cache |
41 | private-dev | 45 | private-dev |
42 | # private-etc drirc,machine-id,openal,passwd,selinux,udev,xdg | 46 | private-etc drirc,machine-id,openal,passwd,selinux,udev,xdg |
43 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/profile-m-z/openarena_ded.profile b/etc/profile-m-z/openarena_ded.profile new file mode 100644 index 000000000..c529e7e11 --- /dev/null +++ b/etc/profile-m-z/openarena_ded.profile | |||
@@ -0,0 +1,5 @@ | |||
1 | # Firejail profile alias for openarena | ||
2 | # This file is overwritten after every install/update | ||
3 | |||
4 | # Redirect | ||
5 | include openarena.profile | ||
diff --git a/etc/openbox.profile b/etc/profile-m-z/openbox.profile index 1fb93c79c..1fb93c79c 100644 --- a/etc/openbox.profile +++ b/etc/profile-m-z/openbox.profile | |||
diff --git a/etc/opencity.profile b/etc/profile-m-z/opencity.profile index 6a27c8095..cb8a511ad 100644 --- a/etc/opencity.profile +++ b/etc/profile-m-z/opencity.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.opencity | 20 | mkdir ${HOME}/.opencity |
@@ -21,10 +22,10 @@ whitelist ${HOME}/.opencity | |||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
25 | apparmor | ||
24 | caps.drop all | 26 | caps.drop all |
25 | ipc-namespace | 27 | ipc-namespace |
26 | net none | 28 | net none |
27 | nodbus | ||
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
@@ -42,3 +43,6 @@ private-bin opencity | |||
42 | private-cache | 43 | private-cache |
43 | private-dev | 44 | private-dev |
44 | private-tmp | 45 | private-tmp |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/openclonk.profile b/etc/profile-m-z/openclonk.profile index da60006b3..a6760617c 100644 --- a/etc/openclonk.profile +++ b/etc/profile-m-z/openclonk.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.clonk | 20 | mkdir ${HOME}/.clonk |
@@ -21,10 +22,11 @@ whitelist ${HOME}/.clonk | |||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
25 | apparmor | ||
24 | caps.drop all | 26 | caps.drop all |
25 | ipc-namespace | 27 | ipc-namespace |
26 | net none | 28 | # net none - networked game |
27 | nodbus | 29 | netfilter |
28 | nodvd | 30 | nodvd |
29 | nogroups | 31 | nogroups |
30 | nonewprivs | 32 | nonewprivs |
@@ -42,3 +44,6 @@ private-bin c4group,openclonk | |||
42 | private-cache | 44 | private-cache |
43 | private-dev | 45 | private-dev |
44 | private-tmp | 46 | private-tmp |
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/openoffice.org.profile b/etc/profile-m-z/openoffice.org.profile index 8348a57fe..8348a57fe 100644 --- a/etc/openoffice.org.profile +++ b/etc/profile-m-z/openoffice.org.profile | |||
diff --git a/etc/openshot-qt.profile b/etc/profile-m-z/openshot-qt.profile index 2f886d2ac..2f886d2ac 100644 --- a/etc/openshot-qt.profile +++ b/etc/profile-m-z/openshot-qt.profile | |||
diff --git a/etc/openshot.profile b/etc/profile-m-z/openshot.profile index 9d0b4c4c9..e1839c724 100644 --- a/etc/openshot.profile +++ b/etc/profile-m-z/openshot.profile | |||
@@ -23,9 +23,7 @@ include whitelist-var-common.inc | |||
23 | 23 | ||
24 | apparmor | 24 | apparmor |
25 | caps.drop all | 25 | caps.drop all |
26 | #net none | 26 | net none |
27 | netfilter | ||
28 | nodbus | ||
29 | nodvd | 27 | nodvd |
30 | nogroups | 28 | nogroups |
31 | nonewprivs | 29 | nonewprivs |
@@ -40,3 +38,5 @@ tracelog | |||
40 | private-dev | 38 | private-dev |
41 | private-tmp | 39 | private-tmp |
42 | 40 | ||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/openttd.profile b/etc/profile-m-z/openttd.profile index 5de4d325d..b71883d68 100644 --- a/etc/openttd.profile +++ b/etc/profile-m-z/openttd.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.openttd | 20 | mkdir ${HOME}/.openttd |
@@ -21,10 +22,10 @@ whitelist ${HOME}/.openttd | |||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
25 | apparmor | ||
24 | caps.drop all | 26 | caps.drop all |
25 | ipc-namespace | 27 | ipc-namespace |
26 | netfilter | 28 | net none |
27 | nodbus | ||
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
@@ -42,3 +43,6 @@ private-bin openttd | |||
42 | private-cache | 43 | private-cache |
43 | private-dev | 44 | private-dev |
44 | private-tmp | 45 | private-tmp |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/opera-beta.profile b/etc/profile-m-z/opera-beta.profile index 8658d30c6..8658d30c6 100644 --- a/etc/opera-beta.profile +++ b/etc/profile-m-z/opera-beta.profile | |||
diff --git a/etc/opera.profile b/etc/profile-m-z/opera.profile index b342b3961..b342b3961 100644 --- a/etc/opera.profile +++ b/etc/profile-m-z/opera.profile | |||
diff --git a/etc/orage.profile b/etc/profile-m-z/orage.profile index 4e12892d6..4e12892d6 100644 --- a/etc/orage.profile +++ b/etc/profile-m-z/orage.profile | |||
diff --git a/etc/profile-m-z/org.gnome.NautilusPreviewer.profile b/etc/profile-m-z/org.gnome.NautilusPreviewer.profile new file mode 100644 index 000000000..eb75add58 --- /dev/null +++ b/etc/profile-m-z/org.gnome.NautilusPreviewer.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile alias for sushi | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include org.gnome.NautilusPreviewer.local | ||
5 | # Persistent global definitions | ||
6 | # added by included profile | ||
7 | #include globals.local | ||
8 | |||
9 | # Redirect | ||
10 | include sushi.profile | ||
diff --git a/etc/ostrichriders.profile b/etc/profile-m-z/ostrichriders.profile index bef784126..cc44d5a48 100644 --- a/etc/ostrichriders.profile +++ b/etc/profile-m-z/ostrichriders.profile | |||
@@ -14,17 +14,19 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.ostrichriders | 20 | mkdir ${HOME}/.ostrichriders |
20 | whitelist ${HOME}/.ostrichriders | 21 | whitelist ${HOME}/.ostrichriders |
22 | whitelist /usr/share/ostrichriders | ||
21 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
23 | 26 | ||
24 | caps.drop all | 27 | caps.drop all |
25 | ipc-namespace | 28 | ipc-namespace |
26 | net none | 29 | net none |
27 | nodbus | ||
28 | nodvd | 30 | nodvd |
29 | nogroups | 31 | nogroups |
30 | nonewprivs | 32 | nonewprivs |
@@ -43,3 +45,6 @@ private-cache | |||
43 | # private-dev should be commented for controllers | 45 | # private-dev should be commented for controllers |
44 | private-dev | 46 | private-dev |
45 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/profile-m-z/otter-browser.profile b/etc/profile-m-z/otter-browser.profile new file mode 100644 index 000000000..652b6b7cb --- /dev/null +++ b/etc/profile-m-z/otter-browser.profile | |||
@@ -0,0 +1,59 @@ | |||
1 | # Firejail profile for otter-browser | ||
2 | # Description: Lightweight web browser based on Qt5 | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include otter-browser.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ?BROWSER_ALLOW_DRM: ignore noexec ${HOME} | ||
10 | |||
11 | noblacklist ${HOME}/.cache/Otter | ||
12 | noblacklist ${HOME}/.config/otter | ||
13 | noblacklist ${HOME}/.pki | ||
14 | noblacklist ${HOME}/.local/share/pki | ||
15 | |||
16 | include disable-common.inc | ||
17 | include disable-devel.inc | ||
18 | include disable-exec.inc | ||
19 | include disable-interpreters.inc | ||
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | ||
22 | include disable-xdg.inc | ||
23 | |||
24 | mkdir ${HOME}/.cache/Otter | ||
25 | mkdir ${HOME}/.config/otter | ||
26 | mkdir ${HOME}/.pki | ||
27 | mkdir ${HOME}/.local/share/pki | ||
28 | whitelist ${DOWNLOADS} | ||
29 | whitelist ${HOME}/.cache/Otter | ||
30 | whitelist ${HOME}/.config/otter | ||
31 | whitelist ${HOME}/.pki | ||
32 | whitelist ${HOME}/.local/share/pki | ||
33 | whitelist /usr/share/otter-browser | ||
34 | include whitelist-common.inc | ||
35 | include whitelist-runuser-common.inc | ||
36 | include whitelist-usr-share-common.inc | ||
37 | include whitelist-var-common.inc | ||
38 | |||
39 | apparmor | ||
40 | caps.drop all | ||
41 | netfilter | ||
42 | nodvd | ||
43 | nogroups | ||
44 | nonewprivs | ||
45 | noroot | ||
46 | notv | ||
47 | ?BROWSER_DISABLE_U2F: nou2f | ||
48 | protocol unix,inet,inet6,netlink | ||
49 | seccomp !chroot | ||
50 | shell none | ||
51 | |||
52 | disable-mnt | ||
53 | private-bin bash,otter-browser,sh,which | ||
54 | private-cache | ||
55 | ?BROWSER_DISABLE_U2F: private-dev | ||
56 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
57 | private-tmp | ||
58 | |||
59 | dbus-system none | ||
diff --git a/etc/out123.profile b/etc/profile-m-z/out123.profile index 4754c05ba..4754c05ba 100644 --- a/etc/out123.profile +++ b/etc/profile-m-z/out123.profile | |||
diff --git a/etc/p7zip.profile b/etc/profile-m-z/p7zip.profile index 652fac7bd..652fac7bd 100644 --- a/etc/p7zip.profile +++ b/etc/profile-m-z/p7zip.profile | |||
diff --git a/etc/palemoon.profile b/etc/profile-m-z/palemoon.profile index acb2ce176..acb2ce176 100644 --- a/etc/palemoon.profile +++ b/etc/profile-m-z/palemoon.profile | |||
diff --git a/etc/pandoc.profile b/etc/profile-m-z/pandoc.profile index 9a8d82a96..9ee7e75b4 100644 --- a/etc/pandoc.profile +++ b/etc/profile-m-z/pandoc.profile | |||
@@ -8,6 +8,7 @@ include pandoc.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | noblacklist ${DOCUMENTS} | 13 | noblacklist ${DOCUMENTS} |
13 | 14 | ||
@@ -17,6 +18,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 22 | include disable-xdg.inc |
21 | 23 | ||
22 | # breaks pdf output | 24 | # breaks pdf output |
@@ -28,7 +30,6 @@ ipc-namespace | |||
28 | machine-id | 30 | machine-id |
29 | net none | 31 | net none |
30 | no3d | 32 | no3d |
31 | nodbus | ||
32 | nodvd | 33 | nodvd |
33 | nogroups | 34 | nogroups |
34 | nonewprivs | 35 | nonewprivs |
@@ -47,7 +48,10 @@ disable-mnt | |||
47 | private-bin context,latex,mktexfmt,pandoc,pdflatex,pdfroff,prince,weasyprint,wkhtmltopdf | 48 | private-bin context,latex,mktexfmt,pandoc,pdflatex,pdfroff,prince,weasyprint,wkhtmltopdf |
48 | private-cache | 49 | private-cache |
49 | private-dev | 50 | private-dev |
50 | private-etc alternatives,texlive | 51 | private-etc alternatives,texlive,texmf |
51 | private-tmp | 52 | private-tmp |
52 | 53 | ||
54 | dbus-user none | ||
55 | dbus-system none | ||
56 | |||
53 | memory-deny-write-execute | 57 | memory-deny-write-execute |
diff --git a/etc/parole.profile b/etc/profile-m-z/parole.profile index e7a0694ed..0a4422a73 100644 --- a/etc/parole.profile +++ b/etc/profile-m-z/parole.profile | |||
@@ -14,6 +14,7 @@ include disable-devel.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/patch.profile b/etc/profile-m-z/patch.profile index 4a3365378..8663fb453 100644 --- a/etc/patch.profile +++ b/etc/profile-m-z/patch.profile | |||
@@ -8,6 +8,7 @@ include patch.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | noblacklist ${DOCUMENTS} | 13 | noblacklist ${DOCUMENTS} |
13 | 14 | ||
@@ -16,6 +17,7 @@ include disable-devel.inc | |||
16 | include disable-exec.inc | 17 | include disable-exec.inc |
17 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 21 | include disable-xdg.inc |
20 | 22 | ||
21 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
@@ -25,7 +27,6 @@ caps.drop all | |||
25 | ipc-namespace | 27 | ipc-namespace |
26 | net none | 28 | net none |
27 | no3d | 29 | no3d |
28 | nodbus | ||
29 | nodvd | 30 | nodvd |
30 | nogroups | 31 | nogroups |
31 | nonewprivs | 32 | nonewprivs |
@@ -44,4 +45,7 @@ private-bin patch,red | |||
44 | private-dev | 45 | private-dev |
45 | private-lib libfakeroot | 46 | private-lib libfakeroot |
46 | 47 | ||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
47 | memory-deny-write-execute | 51 | memory-deny-write-execute |
diff --git a/etc/pavucontrol-qt.profile b/etc/profile-m-z/pavucontrol-qt.profile index f96ba14d2..f96ba14d2 100644 --- a/etc/pavucontrol-qt.profile +++ b/etc/profile-m-z/pavucontrol-qt.profile | |||
diff --git a/etc/pavucontrol.profile b/etc/profile-m-z/pavucontrol.profile index 0ae9f08af..f7d3576da 100644 --- a/etc/pavucontrol.profile +++ b/etc/profile-m-z/pavucontrol.profile | |||
@@ -29,7 +29,6 @@ apparmor | |||
29 | caps.drop all | 29 | caps.drop all |
30 | netfilter | 30 | netfilter |
31 | no3d | 31 | no3d |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -50,5 +49,8 @@ private-etc alternatives,asound.conf,avahi,fonts,machine-id,pulse | |||
50 | private-lib | 49 | private-lib |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
53 | # mdwe is broken under Wayland, but works under Xorg. | 55 | # mdwe is broken under Wayland, but works under Xorg. |
54 | #memory-deny-write-execute | 56 | #memory-deny-write-execute |
diff --git a/etc/profile-m-z/pcmanfm.profile b/etc/profile-m-z/pcmanfm.profile new file mode 100644 index 000000000..5718ab164 --- /dev/null +++ b/etc/profile-m-z/pcmanfm.profile | |||
@@ -0,0 +1,12 @@ | |||
1 | # Firejail profile for pcmanfm | ||
2 | # Description: Extremely fast and lightweight file manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include pcmanfm.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Put 'ignore noroot' in your pcmanfm.local if you use MPV+Vulkan (see issue #3012) | ||
10 | |||
11 | # Redirect | ||
12 | include file-manager-common.profile | ||
diff --git a/etc/pdfchain.profile b/etc/profile-m-z/pdfchain.profile index 98a9f1840..4b6da4d6f 100644 --- a/etc/pdfchain.profile +++ b/etc/profile-m-z/pdfchain.profile | |||
@@ -21,7 +21,6 @@ caps.drop all | |||
21 | ipc-namespace | 21 | ipc-namespace |
22 | net none | 22 | net none |
23 | no3d | 23 | no3d |
24 | nodbus | ||
25 | nogroups | 24 | nogroups |
26 | nonewprivs | 25 | nonewprivs |
27 | noroot | 26 | noroot |
@@ -38,4 +37,7 @@ private-dev | |||
38 | private-etc alternatives,dconf,fonts,gtk-3.0,xdg | 37 | private-etc alternatives,dconf,fonts,gtk-3.0,xdg |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
40 | dbus-user none | ||
41 | dbus-system none | ||
42 | |||
41 | memory-deny-write-execute | 43 | memory-deny-write-execute |
diff --git a/etc/pdflatex.profile b/etc/profile-m-z/pdflatex.profile index caf980d4d..caf980d4d 100644 --- a/etc/pdflatex.profile +++ b/etc/profile-m-z/pdflatex.profile | |||
diff --git a/etc/pdfmod.profile b/etc/profile-m-z/pdfmod.profile index 177070e83..fb3c42526 100644 --- a/etc/pdfmod.profile +++ b/etc/profile-m-z/pdfmod.profile | |||
@@ -25,7 +25,6 @@ ipc-namespace | |||
25 | machine-id | 25 | machine-id |
26 | net none | 26 | net none |
27 | no3d | 27 | no3d |
28 | nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -41,3 +40,5 @@ shell none | |||
41 | private-dev | 40 | private-dev |
42 | private-tmp | 41 | private-tmp |
43 | 42 | ||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/pdfsam.profile b/etc/profile-m-z/pdfsam.profile index 48f424190..2f4227159 100644 --- a/etc/pdfsam.profile +++ b/etc/profile-m-z/pdfsam.profile | |||
@@ -23,7 +23,6 @@ caps.drop all | |||
23 | machine-id | 23 | machine-id |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -41,3 +40,5 @@ private-cache | |||
41 | private-dev | 40 | private-dev |
42 | private-tmp | 41 | private-tmp |
43 | 42 | ||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/pdftotext.profile b/etc/profile-m-z/pdftotext.profile index 73ebf4615..eee42424f 100644 --- a/etc/pdftotext.profile +++ b/etc/profile-m-z/pdftotext.profile | |||
@@ -7,6 +7,7 @@ include pdftotext.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | blacklist ${RUNUSER}/wayland-* | 9 | blacklist ${RUNUSER}/wayland-* |
10 | blacklist ${RUNUSER} | ||
10 | 11 | ||
11 | noblacklist ${DOCUMENTS} | 12 | noblacklist ${DOCUMENTS} |
12 | 13 | ||
@@ -15,6 +16,7 @@ include disable-devel.inc | |||
15 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 20 | include disable-xdg.inc |
19 | 21 | ||
20 | whitelist ${DOCUMENTS} | 22 | whitelist ${DOCUMENTS} |
@@ -28,7 +30,6 @@ ipc-namespace | |||
28 | machine-id | 30 | machine-id |
29 | net none | 31 | net none |
30 | no3d | 32 | no3d |
31 | nodbus | ||
32 | nodvd | 33 | nodvd |
33 | nogroups | 34 | nogroups |
34 | nonewprivs | 35 | nonewprivs |
@@ -48,3 +49,6 @@ private-cache | |||
48 | private-dev | 49 | private-dev |
49 | private-etc alternatives | 50 | private-etc alternatives |
50 | private-tmp | 51 | private-tmp |
52 | |||
53 | dbus-user none | ||
54 | dbus-system none | ||
diff --git a/etc/peek.profile b/etc/profile-m-z/peek.profile index 8cbff0c64..66fdd6496 100644 --- a/etc/peek.profile +++ b/etc/profile-m-z/peek.profile | |||
@@ -20,7 +20,6 @@ include disable-xdg.inc | |||
20 | caps.drop all | 20 | caps.drop all |
21 | net none | 21 | net none |
22 | no3d | 22 | no3d |
23 | nodbus | ||
24 | nodvd | 23 | nodvd |
25 | nogroups | 24 | nogroups |
26 | nonewprivs | 25 | nonewprivs |
@@ -38,4 +37,7 @@ shell none | |||
38 | private-dev | 37 | private-dev |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
40 | dbus-user none | ||
41 | dbus-system none | ||
42 | |||
41 | memory-deny-write-execute | 43 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/penguin-command.profile b/etc/profile-m-z/penguin-command.profile new file mode 100644 index 000000000..db0d84496 --- /dev/null +++ b/etc/profile-m-z/penguin-command.profile | |||
@@ -0,0 +1,42 @@ | |||
1 | # Firejail profile for open-invaders | ||
2 | # Description: Space Invaders clone | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include penguin-command.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.penguin-command | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | |||
19 | whitelist ${HOME}/.penguin-command | ||
20 | include whitelist-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | net none | ||
26 | nodvd | ||
27 | nogroups | ||
28 | nonewprivs | ||
29 | noroot | ||
30 | notv | ||
31 | nou2f | ||
32 | novideo | ||
33 | protocol unix,netlink | ||
34 | seccomp | ||
35 | shell none | ||
36 | |||
37 | private-bin penguin-command | ||
38 | private-dev | ||
39 | private-tmp | ||
40 | |||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/picard.profile b/etc/profile-m-z/picard.profile index 15fc7a454..15fc7a454 100644 --- a/etc/picard.profile +++ b/etc/profile-m-z/picard.profile | |||
diff --git a/etc/pidgin.profile b/etc/profile-m-z/pidgin.profile index 2e4215744..2e4215744 100644 --- a/etc/pidgin.profile +++ b/etc/profile-m-z/pidgin.profile | |||
diff --git a/etc/ping.profile b/etc/profile-m-z/ping.profile index 5f68ee011..3ef8ad64a 100644 --- a/etc/ping.profile +++ b/etc/profile-m-z/ping.profile | |||
@@ -7,6 +7,10 @@ include ping.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist /tmp/.X11-unix | ||
11 | blacklist ${RUNUSER}/wayland-* | ||
12 | blacklist ${RUNUSER} | ||
13 | |||
10 | include disable-common.inc | 14 | include disable-common.inc |
11 | include disable-devel.inc | 15 | include disable-devel.inc |
12 | include disable-exec.inc | 16 | include disable-exec.inc |
@@ -19,6 +23,7 @@ include whitelist-common.inc | |||
19 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
21 | 25 | ||
26 | apparmor | ||
22 | caps.keep net_raw | 27 | caps.keep net_raw |
23 | ipc-namespace | 28 | ipc-namespace |
24 | #net tun0 | 29 | #net tun0 |
diff --git a/etc/pingus.profile b/etc/profile-m-z/pingus.profile index a3adc55a2..ebfd236aa 100644 --- a/etc/pingus.profile +++ b/etc/profile-m-z/pingus.profile | |||
@@ -10,17 +10,23 @@ noblacklist ${HOME}/.pingus | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | ||
16 | 18 | ||
17 | mkdir ${HOME}/.pingus | 19 | mkdir ${HOME}/.pingus |
18 | whitelist ${HOME}/.pingus | 20 | whitelist ${HOME}/.pingus |
21 | whitelist /usr/share/pingus | ||
19 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
20 | 26 | ||
27 | apparmor | ||
21 | caps.drop all | 28 | caps.drop all |
22 | net none | 29 | net none |
23 | nodbus | ||
24 | nodvd | 30 | nodvd |
25 | nogroups | 31 | nogroups |
26 | nonewprivs | 32 | nonewprivs |
@@ -31,7 +37,14 @@ novideo | |||
31 | protocol unix,netlink | 37 | protocol unix,netlink |
32 | seccomp | 38 | seccomp |
33 | shell none | 39 | shell none |
40 | tracelog | ||
34 | 41 | ||
35 | # private-bin pingus | 42 | disable-mnt |
43 | private-bin pingus,pingus.bin,sh | ||
44 | private-cache | ||
36 | private-dev | 45 | private-dev |
46 | private-etc machine-id | ||
37 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/pinta.profile b/etc/profile-m-z/pinta.profile index 8151bc98f..7d94972c4 100644 --- a/etc/pinta.profile +++ b/etc/profile-m-z/pinta.profile | |||
@@ -21,7 +21,6 @@ include disable-xdg.inc | |||
21 | caps.drop all | 21 | caps.drop all |
22 | ipc-namespace | 22 | ipc-namespace |
23 | net none | 23 | net none |
24 | nodbus | ||
25 | nodvd | 24 | nodvd |
26 | nogroups | 25 | nogroups |
27 | nonewprivs | 26 | nonewprivs |
@@ -38,3 +37,5 @@ private-dev | |||
38 | private-cache | 37 | private-cache |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
40 | dbus-user none | ||
41 | dbus-system none | ||
diff --git a/etc/pioneer.profile b/etc/profile-m-z/pioneer.profile index c5b936617..5f329195b 100644 --- a/etc/pioneer.profile +++ b/etc/profile-m-z/pioneer.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.pioneer | 20 | mkdir ${HOME}/.pioneer |
@@ -24,7 +25,6 @@ include whitelist-var-common.inc | |||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | net none | 27 | net none |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -42,3 +42,6 @@ private-bin modelcompiler,pioneer,savegamedump | |||
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/pithos.profile b/etc/profile-m-z/pithos.profile index ad56ce525..0864dd0bc 100644 --- a/etc/pithos.profile +++ b/etc/profile-m-z/pithos.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
diff --git a/etc/pitivi.profile b/etc/profile-m-z/pitivi.profile index 89a6a020b..c722e29b4 100644 --- a/etc/pitivi.profile +++ b/etc/profile-m-z/pitivi.profile | |||
@@ -6,7 +6,6 @@ include pitivi.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | |||
10 | noblacklist ${HOME}/.config/pitivi | 9 | noblacklist ${HOME}/.config/pitivi |
11 | 10 | ||
12 | # Allow python (blacklisted by disable-interpreters.inc) | 11 | # Allow python (blacklisted by disable-interpreters.inc) |
@@ -20,11 +19,13 @@ include disable-interpreters.inc | |||
20 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | 21 | ||
22 | include whitelist-runuser-common.inc | ||
23 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
24 | 24 | ||
25 | apparmor | ||
25 | caps.drop all | 26 | caps.drop all |
26 | ipc-namespace | 27 | ipc-namespace |
27 | netfilter | 28 | net none |
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
diff --git a/etc/pix.profile b/etc/profile-m-z/pix.profile index 9864ed718..a2c35beb5 100644 --- a/etc/pix.profile +++ b/etc/profile-m-z/pix.profile | |||
@@ -15,6 +15,7 @@ include disable-devel.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
20 | nodvd | 21 | nodvd |
diff --git a/etc/planmaker18.profile b/etc/profile-m-z/planmaker18.profile index 4cf1efb7f..2ba8e86c0 100644 --- a/etc/planmaker18.profile +++ b/etc/profile-m-z/planmaker18.profile | |||
@@ -7,4 +7,4 @@ include planmaker18.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/planmaker18free.profile b/etc/profile-m-z/planmaker18free.profile index bb85f1fc7..d0bce44f5 100644 --- a/etc/planmaker18free.profile +++ b/etc/profile-m-z/planmaker18free.profile | |||
@@ -7,4 +7,4 @@ include planmaker18free.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/playonlinux.profile b/etc/profile-m-z/playonlinux.profile index 03091af6d..03091af6d 100644 --- a/etc/playonlinux.profile +++ b/etc/profile-m-z/playonlinux.profile | |||
diff --git a/etc/pluma.profile b/etc/profile-m-z/pluma.profile index dadfcc44e..5303eae8a 100644 --- a/etc/pluma.profile +++ b/etc/profile-m-z/pluma.profile | |||
@@ -18,6 +18,7 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | 22 | ||
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
@@ -26,7 +27,6 @@ caps.drop all | |||
26 | machine-id | 27 | machine-id |
27 | # net none - makes settings immutable | 28 | # net none - makes settings immutable |
28 | no3d | 29 | no3d |
29 | # nodbus - makes settings immutable | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -45,6 +45,10 @@ private-dev | |||
45 | private-lib aspell,gconv,libgspell-1.so.*,libreadline.so.*,libtinfo.so.*,pluma | 45 | private-lib aspell,gconv,libgspell-1.so.*,libreadline.so.*,libtinfo.so.*,pluma |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # makes settings immutable | ||
49 | # dbus-user none | ||
50 | # dbus-system none | ||
51 | |||
48 | memory-deny-write-execute | 52 | memory-deny-write-execute |
49 | 53 | ||
50 | join-or-start pluma | 54 | join-or-start pluma |
diff --git a/etc/profile-m-z/plv.profile b/etc/profile-m-z/plv.profile new file mode 100644 index 000000000..7ff59ea77 --- /dev/null +++ b/etc/profile-m-z/plv.profile | |||
@@ -0,0 +1,59 @@ | |||
1 | # Firejail profile for plv | ||
2 | # Description: Inspect pacman log files | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include plv.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/PacmanLogViewer | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.config/PacmanLogViewer | ||
20 | whitelist ${HOME}/.config/PacmanLogViewer | ||
21 | whitelist /var/log/pacman* | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | ipc-namespace | ||
30 | machine-id | ||
31 | net none | ||
32 | no3d | ||
33 | nodvd | ||
34 | nogroups | ||
35 | nonewprivs | ||
36 | noroot | ||
37 | nosound | ||
38 | notv | ||
39 | nou2f | ||
40 | novideo | ||
41 | seccomp | ||
42 | shell none | ||
43 | tracelog | ||
44 | |||
45 | disable-mnt | ||
46 | private-bin plv | ||
47 | private-cache | ||
48 | private-dev | ||
49 | private-etc alternatives,fonts | ||
50 | private-opt none | ||
51 | private-tmp | ||
52 | writable-var-log | ||
53 | |||
54 | dbus-user none | ||
55 | dbus-system none | ||
56 | |||
57 | #memory-deny-write-execute - breaks opening file-chooser | ||
58 | read-only ${HOME} | ||
59 | read-write ${HOME}/.config/PacmanLogViewer | ||
diff --git a/etc/pngquant.profile b/etc/profile-m-z/pngquant.profile index f9ce43c4c..83905b108 100644 --- a/etc/pngquant.profile +++ b/etc/profile-m-z/pngquant.profile | |||
@@ -15,7 +15,10 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
19 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
20 | 23 | ||
21 | apparmor | 24 | apparmor |
@@ -24,7 +27,6 @@ ipc-namespace | |||
24 | machine-id | 27 | machine-id |
25 | net none | 28 | net none |
26 | no3d | 29 | no3d |
27 | nodbus | ||
28 | nodvd | 30 | nodvd |
29 | nogroups | 31 | nogroups |
30 | nonewprivs | 32 | nonewprivs |
@@ -46,4 +48,7 @@ private-dev | |||
46 | private-etc alternatives | 48 | private-etc alternatives |
47 | private-tmp | 49 | private-tmp |
48 | 50 | ||
51 | dbus-user none | ||
52 | dbus-system none | ||
53 | |||
49 | memory-deny-write-execute | 54 | memory-deny-write-execute |
diff --git a/etc/polari.profile b/etc/profile-m-z/polari.profile index 939e2537e..87a53775f 100644 --- a/etc/polari.profile +++ b/etc/profile-m-z/polari.profile | |||
@@ -28,6 +28,7 @@ whitelist ${HOME}/.local/share/TpLogger | |||
28 | whitelist ${HOME}/.local/share/telepathy | 28 | whitelist ${HOME}/.local/share/telepathy |
29 | whitelist ${HOME}/.purple | 29 | whitelist ${HOME}/.purple |
30 | include whitelist-common.inc | 30 | include whitelist-common.inc |
31 | include whitelist-runuser-common.inc | ||
31 | 32 | ||
32 | caps.drop all | 33 | caps.drop all |
33 | netfilter | 34 | netfilter |
diff --git a/etc/ppsspp.profile b/etc/profile-m-z/ppsspp.profile index 970290002..c62e53151 100644 --- a/etc/ppsspp.profile +++ b/etc/profile-m-z/ppsspp.profile | |||
@@ -21,9 +21,7 @@ include whitelist-var-common.inc | |||
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | ipc-namespace | 23 | ipc-namespace |
24 | netfilter | ||
25 | net none | 24 | net none |
26 | nodbus | ||
27 | nodvd | 25 | nodvd |
28 | nogroups | 26 | nogroups |
29 | nonewprivs | 27 | nonewprivs |
@@ -40,3 +38,5 @@ private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts | |||
40 | private-opt ppsspp | 38 | private-opt ppsspp |
41 | private-tmp | 39 | private-tmp |
42 | 40 | ||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/pragha.profile b/etc/profile-m-z/pragha.profile index 019c1a547..019c1a547 100644 --- a/etc/pragha.profile +++ b/etc/profile-m-z/pragha.profile | |||
diff --git a/etc/presentations18.profile b/etc/profile-m-z/presentations18.profile index ac844d1af..d4f531060 100644 --- a/etc/presentations18.profile +++ b/etc/profile-m-z/presentations18.profile | |||
@@ -7,4 +7,5 @@ include presentations18.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
11 | |||
diff --git a/etc/presentations18free.profile b/etc/profile-m-z/presentations18free.profile index 218747224..e2319f13f 100644 --- a/etc/presentations18free.profile +++ b/etc/profile-m-z/presentations18free.profile | |||
@@ -7,4 +7,4 @@ include presentations18free.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/profanity.profile b/etc/profile-m-z/profanity.profile index 6ca9314e9..a02bcd826 100644 --- a/etc/profanity.profile +++ b/etc/profile-m-z/profanity.profile | |||
@@ -20,6 +20,7 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 21 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-shell.inc | ||
23 | include disable-xdg.inc | 24 | include disable-xdg.inc |
24 | 25 | ||
25 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
@@ -28,7 +29,6 @@ include whitelist-var-common.inc | |||
28 | caps.drop all | 29 | caps.drop all |
29 | netfilter | 30 | netfilter |
30 | no3d | 31 | no3d |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -47,4 +47,7 @@ private-dev | |||
47 | private-etc alternatives,ca-certificates,crypto-policies,localtime,mime.types,nsswitch.conf,pki,resolv.conf,ssl | 47 | private-etc alternatives,ca-certificates,crypto-policies,localtime,mime.types,nsswitch.conf,pki,resolv.conf,ssl |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
50 | memory-deny-write-execute | 53 | memory-deny-write-execute |
diff --git a/etc/psi-plus.profile b/etc/profile-m-z/psi-plus.profile index 16fffe517..16fffe517 100644 --- a/etc/psi-plus.profile +++ b/etc/profile-m-z/psi-plus.profile | |||
diff --git a/etc/pybitmessage.profile b/etc/profile-m-z/pybitmessage.profile index 034c144c7..034c144c7 100644 --- a/etc/pybitmessage.profile +++ b/etc/profile-m-z/pybitmessage.profile | |||
diff --git a/etc/pycharm-community.profile b/etc/profile-m-z/pycharm-community.profile index 9ee426a95..9ee426a95 100644 --- a/etc/pycharm-community.profile +++ b/etc/profile-m-z/pycharm-community.profile | |||
diff --git a/etc/pycharm-professional.profile b/etc/profile-m-z/pycharm-professional.profile index a14d0268b..a14d0268b 100644 --- a/etc/pycharm-professional.profile +++ b/etc/profile-m-z/pycharm-professional.profile | |||
diff --git a/etc/pzstd.profile b/etc/profile-m-z/pzstd.profile index ce9af3286..ce9af3286 100644 --- a/etc/pzstd.profile +++ b/etc/profile-m-z/pzstd.profile | |||
diff --git a/etc/qbittorrent.profile b/etc/profile-m-z/qbittorrent.profile index fe9caec77..81ec1bc6b 100644 --- a/etc/qbittorrent.profile +++ b/etc/profile-m-z/qbittorrent.profile | |||
@@ -21,6 +21,7 @@ include disable-exec.inc | |||
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | 22 | include disable-passwdmgr.inc |
23 | include disable-programs.inc | 23 | include disable-programs.inc |
24 | include disable-shell.inc | ||
24 | 25 | ||
25 | mkdir ${HOME}/.cache/qBittorrent | 26 | mkdir ${HOME}/.cache/qBittorrent |
26 | mkdir ${HOME}/.config/qBittorrent | 27 | mkdir ${HOME}/.config/qBittorrent |
@@ -38,7 +39,6 @@ apparmor | |||
38 | caps.drop all | 39 | caps.drop all |
39 | machine-id | 40 | machine-id |
40 | netfilter | 41 | netfilter |
41 | nodbus | ||
42 | nodvd | 42 | nodvd |
43 | nogroups | 43 | nogroups |
44 | nonewprivs | 44 | nonewprivs |
@@ -56,4 +56,7 @@ private-dev | |||
56 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssl,X11,xdg | 56 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssl,X11,xdg |
57 | private-tmp | 57 | private-tmp |
58 | 58 | ||
59 | dbus-user none | ||
60 | dbus-system none | ||
61 | |||
59 | # memory-deny-write-execute - problems on Arch, see #1690 on GitHub repo | 62 | # memory-deny-write-execute - problems on Arch, see #1690 on GitHub repo |
diff --git a/etc/qemu-launcher.profile b/etc/profile-m-z/qemu-launcher.profile index ac60384fd..ac60384fd 100644 --- a/etc/qemu-launcher.profile +++ b/etc/profile-m-z/qemu-launcher.profile | |||
diff --git a/etc/qemu-system-x86_64.profile b/etc/profile-m-z/qemu-system-x86_64.profile index d7d7905dd..d7d7905dd 100644 --- a/etc/qemu-system-x86_64.profile +++ b/etc/profile-m-z/qemu-system-x86_64.profile | |||
diff --git a/etc/qgis.profile b/etc/profile-m-z/qgis.profile index 88ed0cd81..eee538383 100644 --- a/etc/qgis.profile +++ b/etc/profile-m-z/qgis.profile | |||
@@ -35,7 +35,6 @@ include whitelist-var-common.inc | |||
35 | caps.drop all | 35 | caps.drop all |
36 | netfilter | 36 | netfilter |
37 | machine-id | 37 | machine-id |
38 | nodbus | ||
39 | nodvd | 38 | nodvd |
40 | nogroups | 39 | nogroups |
41 | nonewprivs | 40 | nonewprivs |
@@ -55,3 +54,6 @@ private-cache | |||
55 | private-dev | 54 | private-dev |
56 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,QGIS,QGIS.conf,resolv.conf,ssl,Trolltech.conf | 55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,QGIS,QGIS.conf,resolv.conf,ssl,Trolltech.conf |
57 | private-tmp | 56 | private-tmp |
57 | |||
58 | dbus-user none | ||
59 | dbus-system none | ||
diff --git a/etc/qlipper.profile b/etc/profile-m-z/qlipper.profile index fb9dca48f..fb9dca48f 100644 --- a/etc/qlipper.profile +++ b/etc/profile-m-z/qlipper.profile | |||
diff --git a/etc/qmmp.profile b/etc/profile-m-z/qmmp.profile index b69bbdef1..e1f679417 100644 --- a/etc/qmmp.profile +++ b/etc/profile-m-z/qmmp.profile | |||
@@ -14,12 +14,12 @@ include disable-devel.inc | |||
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
20 | netfilter | 21 | netfilter |
21 | # no3d | 22 | # no3d |
22 | nodbus | ||
23 | nogroups | 23 | nogroups |
24 | nonewprivs | 24 | nonewprivs |
25 | noroot | 25 | noroot |
@@ -35,3 +35,5 @@ private-bin bzip2,gzip,qmmp,tar,unzip | |||
35 | private-dev | 35 | private-dev |
36 | private-tmp | 36 | private-tmp |
37 | 37 | ||
38 | dbus-user none | ||
39 | dbus-system none | ||
diff --git a/etc/qpdfview.profile b/etc/profile-m-z/qpdfview.profile index 863f57ba4..80e34334a 100644 --- a/etc/qpdfview.profile +++ b/etc/profile-m-z/qpdfview.profile | |||
@@ -16,14 +16,14 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
22 | 23 | ||
24 | apparmor | ||
23 | caps.drop all | 25 | caps.drop all |
24 | machine-id | 26 | machine-id |
25 | # needs D-Bus when started from a file manager | ||
26 | #nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -40,3 +40,7 @@ tracelog | |||
40 | private-bin qpdfview | 40 | private-bin qpdfview |
41 | private-dev | 41 | private-dev |
42 | private-tmp | 42 | private-tmp |
43 | |||
44 | # needs D-Bus when started from a file manager | ||
45 | # dbus-user none | ||
46 | # dbus-system none | ||
diff --git a/etc/qt-faststart.profile b/etc/profile-m-z/qt-faststart.profile index 2cdff33a6..2cdff33a6 100644 --- a/etc/qt-faststart.profile +++ b/etc/profile-m-z/qt-faststart.profile | |||
diff --git a/etc/qtox.profile b/etc/profile-m-z/qtox.profile index cb2a78920..eb8e3e314 100644 --- a/etc/qtox.profile +++ b/etc/profile-m-z/qtox.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | mkdir ${HOME}/.config/tox | 21 | mkdir ${HOME}/.config/tox |
@@ -27,7 +28,6 @@ apparmor | |||
27 | caps.drop all | 28 | caps.drop all |
28 | ipc-namespace | 29 | ipc-namespace |
29 | netfilter | 30 | netfilter |
30 | nodbus | ||
31 | nodvd | 31 | nodvd |
32 | nogroups | 32 | nogroups |
33 | nonewprivs | 33 | nonewprivs |
@@ -46,4 +46,7 @@ private-dev | |||
46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl | 46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
49 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 52 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/profile-m-z/quadrapassel.profile b/etc/profile-m-z/quadrapassel.profile new file mode 100644 index 000000000..91e0d9d0d --- /dev/null +++ b/etc/profile-m-z/quadrapassel.profile | |||
@@ -0,0 +1,20 @@ | |||
1 | # Firejail profile for quadrapassel | ||
2 | # Description: Tetris-like game for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include quadrapassel.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/quadrapassel | ||
10 | |||
11 | mkdir ${HOME}/.local/share/quadrapassel | ||
12 | whitelist ${HOME}/.local/share/quadrapassel | ||
13 | whitelist /usr/share/quadrapassel | ||
14 | |||
15 | private-bin quadrapassel | ||
16 | |||
17 | dbus-user.own org.gnome.Quadrapassel | ||
18 | |||
19 | # Redirect | ||
20 | include gnome_games-common.profile | ||
diff --git a/etc/quassel.profile b/etc/profile-m-z/quassel.profile index c65089e20..c65089e20 100644 --- a/etc/quassel.profile +++ b/etc/profile-m-z/quassel.profile | |||
diff --git a/etc/quiterss.profile b/etc/profile-m-z/quiterss.profile index 8dbdffdc8..366cff4ed 100644 --- a/etc/quiterss.profile +++ b/etc/profile-m-z/quiterss.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | 21 | ||
21 | mkdir ${HOME}/.cache/QuiteRss | 22 | mkdir ${HOME}/.cache/QuiteRss |
22 | mkdir ${HOME}/.config/QuiteRss | 23 | mkdir ${HOME}/.config/QuiteRss |
diff --git a/etc/qupzilla.profile b/etc/profile-m-z/qupzilla.profile index 7aa71c848..7aa71c848 100644 --- a/etc/qupzilla.profile +++ b/etc/profile-m-z/qupzilla.profile | |||
diff --git a/etc/qutebrowser.profile b/etc/profile-m-z/qutebrowser.profile index fc910b589..fc910b589 100644 --- a/etc/qutebrowser.profile +++ b/etc/profile-m-z/qutebrowser.profile | |||
diff --git a/etc/rambox.profile b/etc/profile-m-z/rambox.profile index 6f7f37aaf..ffa2022ee 100644 --- a/etc/rambox.profile +++ b/etc/profile-m-z/rambox.profile | |||
@@ -1,4 +1,5 @@ | |||
1 | # Firejail profile for rambox | 1 | # Firejail profile for rambox |
2 | # Description: Free and Open Source messaging and emailing app that combines common web applications into one (Electron-based) | ||
2 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
3 | # Persistent local customizations | 4 | # Persistent local customizations |
4 | include rambox.local | 5 | include rambox.local |
@@ -31,5 +32,7 @@ nonewprivs | |||
31 | noroot | 32 | noroot |
32 | notv | 33 | notv |
33 | protocol unix,inet,inet6,netlink | 34 | protocol unix,inet,inet6,netlink |
34 | seccomp | 35 | # electron-based application, needing chroot |
36 | #seccomp | ||
37 | seccomp !chroot | ||
35 | # tracelog | 38 | # tracelog |
diff --git a/etc/profile-m-z/ranger.profile b/etc/profile-m-z/ranger.profile new file mode 100644 index 000000000..8b3fe97d8 --- /dev/null +++ b/etc/profile-m-z/ranger.profile | |||
@@ -0,0 +1,12 @@ | |||
1 | # Firejail profile for ranger | ||
2 | # Description: File manager with an ncurses frontend written in Python | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ranger.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Put 'ignore noroot' in your ranger.local if you use MPV+Vulkan (see issue #3012) | ||
10 | |||
11 | # Redirect | ||
12 | include file-manager-common.profile | ||
diff --git a/etc/redeclipse.profile b/etc/profile-m-z/redeclipse.profile index bb1ad56d3..bb1ad56d3 100644 --- a/etc/redeclipse.profile +++ b/etc/profile-m-z/redeclipse.profile | |||
diff --git a/etc/redshift.profile b/etc/profile-m-z/redshift.profile index 0f6d34ed0..298ab1902 100644 --- a/etc/redshift.profile +++ b/etc/profile-m-z/redshift.profile | |||
@@ -29,7 +29,6 @@ ipc-namespace | |||
29 | machine-id | 29 | machine-id |
30 | netfilter | 30 | netfilter |
31 | no3d | 31 | no3d |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -48,4 +47,7 @@ private-cache | |||
48 | private-dev | 47 | private-dev |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
51 | memory-deny-write-execute | 53 | memory-deny-write-execute |
diff --git a/etc/regextester.profile b/etc/profile-m-z/regextester.profile index e30748946..6fb0d4b5f 100644 --- a/etc/regextester.profile +++ b/etc/profile-m-z/regextester.profile | |||
@@ -12,6 +12,7 @@ include disable-exec.inc | |||
12 | include disable-passwdmgr.inc | 12 | include disable-passwdmgr.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | whitelist /usr/share/com.github.artemanufrij.regextester | 18 | whitelist /usr/share/com.github.artemanufrij.regextester |
@@ -26,7 +27,6 @@ ipc-namespace | |||
26 | machine-id | 27 | machine-id |
27 | net none | 28 | net none |
28 | no3d | 29 | no3d |
29 | # nodbus - makes settings immutable | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -48,6 +48,10 @@ private-etc alternatives,fonts | |||
48 | private-lib libgranite.so.* | 48 | private-lib libgranite.so.* |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | # makes settings immutable | ||
52 | # dbus-user none | ||
53 | # dbus-system none | ||
54 | |||
51 | memory-deny-write-execute | 55 | memory-deny-write-execute |
52 | 56 | ||
53 | # never write anything | 57 | # never write anything |
diff --git a/etc/remmina.profile b/etc/profile-m-z/remmina.profile index e85ceca13..6311c91df 100644 --- a/etc/remmina.profile +++ b/etc/profile-m-z/remmina.profile | |||
@@ -19,6 +19,7 @@ include disable-passwdmgr.inc | |||
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-xdg.inc | 20 | include disable-xdg.inc |
21 | 21 | ||
22 | include whitelist-runuser-common.inc | ||
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
24 | caps.drop all | 25 | caps.drop all |
diff --git a/etc/rhythmbox-client.profile b/etc/profile-m-z/rhythmbox-client.profile index 29e65d716..29e65d716 100644 --- a/etc/rhythmbox-client.profile +++ b/etc/profile-m-z/rhythmbox-client.profile | |||
diff --git a/etc/rhythmbox.profile b/etc/profile-m-z/rhythmbox.profile index ad8b1015e..b76f2b947 100644 --- a/etc/rhythmbox.profile +++ b/etc/profile-m-z/rhythmbox.profile | |||
@@ -20,25 +20,26 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 21 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-shell.inc | ||
23 | include disable-xdg.inc | 24 | include disable-xdg.inc |
24 | 25 | ||
25 | whitelist /usr/share/rhythmbox | 26 | whitelist /usr/share/rhythmbox |
26 | whitelist /usr/share/lua | 27 | whitelist /usr/share/lua |
27 | whitelist /usr/share/libquvi-scripts | 28 | whitelist /usr/share/libquvi-scripts |
29 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | 30 | include whitelist-usr-share-common.inc |
29 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
30 | 32 | ||
31 | # apparmor - makes settings immutable | 33 | apparmor |
32 | caps.drop all | 34 | caps.drop all |
33 | netfilter | 35 | netfilter |
34 | # nodbus - makes settings immutable | ||
35 | nogroups | 36 | nogroups |
36 | nonewprivs | 37 | nonewprivs |
37 | noroot | 38 | noroot |
38 | notv | 39 | notv |
39 | nou2f | 40 | nou2f |
40 | novideo | 41 | novideo |
41 | protocol unix,inet,inet6 | 42 | protocol unix,inet,inet6,netlink |
42 | seccomp | 43 | seccomp |
43 | shell none | 44 | shell none |
44 | tracelog | 45 | tracelog |
@@ -46,3 +47,13 @@ tracelog | |||
46 | private-bin rhythmbox,rhythmbox-client | 47 | private-bin rhythmbox,rhythmbox-client |
47 | private-dev | 48 | private-dev |
48 | private-tmp | 49 | private-tmp |
50 | |||
51 | dbus-user filter | ||
52 | dbus-user.own org.gnome.Rhythmbox3 | ||
53 | dbus-user.own org.mpris.MediaPlayer2.rhythmbox | ||
54 | dbus-user.own org.gnome.UPnP.MediaServer2.Rhythmbox | ||
55 | dbus-user.talk ca.desrt.dconf | ||
56 | dbus-user.talk org.freedesktop.Notifications | ||
57 | dbus-system none | ||
58 | dbus-system filter | ||
59 | dbus-system.talk org.freedesktop.Avahi | ||
diff --git a/etc/ricochet.profile b/etc/profile-m-z/ricochet.profile index 1b8fbbc97..86e3fbfb5 100644 --- a/etc/ricochet.profile +++ b/etc/profile-m-z/ricochet.profile | |||
@@ -13,6 +13,7 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | 17 | ||
17 | mkdir ${HOME}/.local/share/Ricochet | 18 | mkdir ${HOME}/.local/share/Ricochet |
18 | whitelist ${DOWNLOADS} | 19 | whitelist ${DOWNLOADS} |
diff --git a/etc/riot-desktop.profile b/etc/profile-m-z/riot-desktop.profile index 4372fabe1..4372fabe1 100644 --- a/etc/riot-desktop.profile +++ b/etc/profile-m-z/riot-desktop.profile | |||
diff --git a/etc/riot-web.profile b/etc/profile-m-z/riot-web.profile index b930adf2b..b930adf2b 100644 --- a/etc/riot-web.profile +++ b/etc/profile-m-z/riot-web.profile | |||
diff --git a/etc/profile-m-z/ripperx.profile b/etc/profile-m-z/ripperx.profile new file mode 100644 index 000000000..cf6daada5 --- /dev/null +++ b/etc/profile-m-z/ripperx.profile | |||
@@ -0,0 +1,43 @@ | |||
1 | # Firejail profile for mpv | ||
2 | # Description: Graphical audio CD ripper and encoder | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ripperx.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.ripperXrc | ||
10 | noblacklist ${MUSIC} | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | netfilter | ||
26 | no3d | ||
27 | nogroups | ||
28 | nonewprivs | ||
29 | noroot | ||
30 | nou2f | ||
31 | notv | ||
32 | novideo | ||
33 | protocol unix,inet,inet6 | ||
34 | seccomp | ||
35 | shell none | ||
36 | tracelog | ||
37 | |||
38 | private-cache | ||
39 | private-dev | ||
40 | private-tmp | ||
41 | |||
42 | dbus-user none | ||
43 | dbus-system none | ||
diff --git a/etc/ristretto.profile b/etc/profile-m-z/ristretto.profile index 8fcbb203c..a1cbdf16c 100644 --- a/etc/ristretto.profile +++ b/etc/profile-m-z/ristretto.profile | |||
@@ -17,7 +17,11 @@ include disable-interpreters.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
20 | caps.drop all | 23 | caps.drop all |
24 | net none | ||
21 | netfilter | 25 | netfilter |
22 | no3d | 26 | no3d |
23 | nodvd | 27 | nodvd |
diff --git a/etc/rnano.profile b/etc/profile-m-z/rnano.profile index d9048982a..d9048982a 100644 --- a/etc/rnano.profile +++ b/etc/profile-m-z/rnano.profile | |||
diff --git a/etc/rocketchat.profile b/etc/profile-m-z/rocketchat.profile index a574e4e8b..a574e4e8b 100644 --- a/etc/rocketchat.profile +++ b/etc/profile-m-z/rocketchat.profile | |||
diff --git a/etc/rsync-download_only.profile b/etc/profile-m-z/rsync-download_only.profile index 84147f0a5..95deed119 100644 --- a/etc/rsync-download_only.profile +++ b/etc/profile-m-z/rsync-download_only.profile | |||
@@ -14,6 +14,7 @@ include globals.local | |||
14 | 14 | ||
15 | blacklist /tmp/.X11-unix | 15 | blacklist /tmp/.X11-unix |
16 | blacklist ${RUNUSER}/wayland-* | 16 | blacklist ${RUNUSER}/wayland-* |
17 | blacklist ${RUNUSER} | ||
17 | 18 | ||
18 | include disable-common.inc | 19 | include disable-common.inc |
19 | include disable-devel.inc | 20 | include disable-devel.inc |
@@ -21,6 +22,7 @@ include disable-exec.inc | |||
21 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | 23 | include disable-passwdmgr.inc |
23 | include disable-programs.inc | 24 | include disable-programs.inc |
25 | include disable-shell.inc | ||
24 | include disable-xdg.inc | 26 | include disable-xdg.inc |
25 | 27 | ||
26 | # Uncomment or add to rsync.local to enable extra hardening | 28 | # Uncomment or add to rsync.local to enable extra hardening |
@@ -32,7 +34,6 @@ ipc-namespace | |||
32 | machine-id | 34 | machine-id |
33 | netfilter | 35 | netfilter |
34 | no3d | 36 | no3d |
35 | nodbus | ||
36 | nodvd | 37 | nodvd |
37 | nogroups | 38 | nogroups |
38 | nonewprivs | 39 | nonewprivs |
@@ -53,4 +54,7 @@ private-dev | |||
53 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | 54 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl |
54 | private-tmp | 55 | private-tmp |
55 | 56 | ||
57 | dbus-user none | ||
58 | dbus-system none | ||
59 | |||
56 | memory-deny-write-execute | 60 | memory-deny-write-execute |
diff --git a/etc/rtorrent.profile b/etc/profile-m-z/rtorrent.profile index 0b4d6e1b1..308c1c802 100644 --- a/etc/rtorrent.profile +++ b/etc/profile-m-z/rtorrent.profile | |||
@@ -12,6 +12,7 @@ include disable-devel.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | 16 | ||
16 | caps.drop all | 17 | caps.drop all |
17 | machine-id | 18 | machine-id |
diff --git a/etc/rtv.profile b/etc/profile-m-z/rtv.profile index af4b7e94b..14740e05f 100644 --- a/etc/rtv.profile +++ b/etc/profile-m-z/rtv.profile | |||
@@ -35,7 +35,6 @@ caps.drop all | |||
35 | machine-id | 35 | machine-id |
36 | netfilter | 36 | netfilter |
37 | no3d | 37 | no3d |
38 | nodbus | ||
39 | nodvd | 38 | nodvd |
40 | nogroups | 39 | nogroups |
41 | nonewprivs | 40 | nonewprivs |
@@ -54,3 +53,6 @@ private-bin python*,rtv,sh,xdg-settings | |||
54 | private-cache | 53 | private-cache |
55 | private-dev | 54 | private-dev |
56 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,terminfo,xdg | 55 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,terminfo,xdg |
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/runenpass.sh.profile b/etc/profile-m-z/runenpass.sh.profile index 64432c171..64432c171 100644 --- a/etc/runenpass.sh.profile +++ b/etc/profile-m-z/runenpass.sh.profile | |||
diff --git a/etc/rview.profile b/etc/profile-m-z/rview.profile index fb72a00de..fb72a00de 100644 --- a/etc/rview.profile +++ b/etc/profile-m-z/rview.profile | |||
diff --git a/etc/rvim.profile b/etc/profile-m-z/rvim.profile index 7c6465d3c..7c6465d3c 100644 --- a/etc/rvim.profile +++ b/etc/profile-m-z/rvim.profile | |||
diff --git a/etc/sayonara.profile b/etc/profile-m-z/sayonara.profile index 8f0544f33..6557c0c42 100644 --- a/etc/sayonara.profile +++ b/etc/profile-m-z/sayonara.profile | |||
@@ -13,6 +13,7 @@ include disable-devel.inc | |||
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | include disable-xdg.inc | 17 | include disable-xdg.inc |
17 | 18 | ||
18 | caps.drop all | 19 | caps.drop all |
diff --git a/etc/scallion.profile b/etc/profile-m-z/scallion.profile index dee9e1f40..0f67d4d09 100644 --- a/etc/scallion.profile +++ b/etc/profile-m-z/scallion.profile | |||
@@ -23,7 +23,6 @@ include whitelist-var-common.inc | |||
23 | caps.drop all | 23 | caps.drop all |
24 | ipc-namespace | 24 | ipc-namespace |
25 | net none | 25 | net none |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -40,3 +39,6 @@ disable-mnt | |||
40 | private | 39 | private |
41 | private-dev | 40 | private-dev |
42 | private-tmp | 41 | private-tmp |
42 | |||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/profile-m-z/scorched3d-wrapper.profile b/etc/profile-m-z/scorched3d-wrapper.profile new file mode 100644 index 000000000..507d0827e --- /dev/null +++ b/etc/profile-m-z/scorched3d-wrapper.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile for scorched3d | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include scorched3d-wrapper.local | ||
5 | |||
6 | whitelist /usr/share/opengl-games-utils | ||
7 | private-bin basename,bash,cut,glxinfo,grep,head,sed,zenity | ||
8 | |||
9 | # Redirect | ||
10 | include scorched3d.profile | ||
diff --git a/etc/scorched3d.profile b/etc/profile-m-z/scorched3d.profile index e94d436cf..6a1003c33 100644 --- a/etc/scorched3d.profile +++ b/etc/profile-m-z/scorched3d.profile | |||
@@ -18,13 +18,15 @@ include disable-xdg.inc | |||
18 | 18 | ||
19 | mkdir ${HOME}/.scorched3d | 19 | mkdir ${HOME}/.scorched3d |
20 | whitelist ${HOME}/.scorched3d | 20 | whitelist ${HOME}/.scorched3d |
21 | whitelist /usr/share/scorched3d | ||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
23 | 26 | ||
24 | caps.drop all | 27 | caps.drop all |
25 | ipc-namespace | 28 | ipc-namespace |
26 | netfilter | 29 | netfilter |
27 | nodbus | ||
28 | nodvd | 30 | nodvd |
29 | nogroups | 31 | nogroups |
30 | nonewprivs | 32 | nonewprivs |
@@ -42,3 +44,6 @@ private-bin scorched3d,scorched3d-wrapper,scorched3dc,scorched3ds | |||
42 | private-cache | 44 | private-cache |
43 | private-dev | 45 | private-dev |
44 | private-tmp | 46 | private-tmp |
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/profile-m-z/scorchwentbonkers.profile b/etc/profile-m-z/scorchwentbonkers.profile new file mode 100644 index 000000000..484ebc38e --- /dev/null +++ b/etc/profile-m-z/scorchwentbonkers.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for scorchwentbonkers | ||
2 | # Description: Realtime remake of Scorched Earth | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include scorchwentbonkers.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.swb.ini | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.swb.ini | ||
21 | whitelist ${HOME}/.swb.ini | ||
22 | whitelist /usr/share/scorchwentbonkers | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin scorchwentbonkers | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc alsa,asound.conf,machine-id,pulse | ||
47 | private-tmp | ||
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/scp.profile b/etc/profile-m-z/scp.profile index 287b8029a..287b8029a 100644 --- a/etc/scp.profile +++ b/etc/profile-m-z/scp.profile | |||
diff --git a/etc/scribus.profile b/etc/profile-m-z/scribus.profile index e20cd1b5a..22cd10737 100644 --- a/etc/scribus.profile +++ b/etc/profile-m-z/scribus.profile | |||
@@ -40,9 +40,9 @@ include disable-xdg.inc | |||
40 | 40 | ||
41 | include whitelist-var-common.inc | 41 | include whitelist-var-common.inc |
42 | 42 | ||
43 | apparmor | ||
43 | caps.drop all | 44 | caps.drop all |
44 | net none | 45 | net none |
45 | nodbus | ||
46 | nodvd | 46 | nodvd |
47 | nogroups | 47 | nogroups |
48 | nonewprivs | 48 | nonewprivs |
@@ -60,3 +60,5 @@ tracelog | |||
60 | private-dev | 60 | private-dev |
61 | private-tmp | 61 | private-tmp |
62 | 62 | ||
63 | dbus-user none | ||
64 | dbus-system none | ||
diff --git a/etc/sdat2img.profile b/etc/profile-m-z/sdat2img.profile index a367acad5..8d16cd07f 100644 --- a/etc/sdat2img.profile +++ b/etc/profile-m-z/sdat2img.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
@@ -23,7 +24,6 @@ include whitelist-var-common.inc | |||
23 | caps.drop all | 24 | caps.drop all |
24 | net none | 25 | net none |
25 | no3d | 26 | no3d |
26 | nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -40,3 +40,5 @@ private-bin env,python*,sdat2img | |||
40 | private-cache | 40 | private-cache |
41 | private-dev | 41 | private-dev |
42 | 42 | ||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/profile-m-z/seahorse-adventures.profile b/etc/profile-m-z/seahorse-adventures.profile new file mode 100644 index 000000000..cb2e5ef91 --- /dev/null +++ b/etc/profile-m-z/seahorse-adventures.profile | |||
@@ -0,0 +1,51 @@ | |||
1 | # Firejail profile for seahorse-adventures | ||
2 | # Description: Help barbie the seahorse float on bubbles to the moon | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include seahorse-adventures.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Allow python (blacklisted by disable-interpreters.inc) | ||
10 | include allow-python2.inc | ||
11 | include allow-python3.inc | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | whitelist /usr/share/seahorse-adventures | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private | ||
44 | private-bin python*,seahorse-adventures | ||
45 | private-cache | ||
46 | private-dev | ||
47 | private-etc machine-id | ||
48 | private-tmp | ||
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/seahorse-daemon.profile b/etc/profile-m-z/seahorse-daemon.profile index 6410da4d8..6410da4d8 100644 --- a/etc/seahorse-daemon.profile +++ b/etc/profile-m-z/seahorse-daemon.profile | |||
diff --git a/etc/seahorse-tool.profile b/etc/profile-m-z/seahorse-tool.profile index 96ff74edf..96ff74edf 100644 --- a/etc/seahorse-tool.profile +++ b/etc/profile-m-z/seahorse-tool.profile | |||
diff --git a/etc/seahorse.profile b/etc/profile-m-z/seahorse.profile index 5a742d05f..85d86d646 100644 --- a/etc/seahorse.profile +++ b/etc/profile-m-z/seahorse.profile | |||
@@ -31,7 +31,10 @@ whitelist /usr/share/gnupg | |||
31 | whitelist /usr/share/gnupg2 | 31 | whitelist /usr/share/gnupg2 |
32 | whitelist /usr/share/seahorse | 32 | whitelist /usr/share/seahorse |
33 | whitelist /usr/share/seahorse-nautilus | 33 | whitelist /usr/share/seahorse-nautilus |
34 | whitelist ${RUNUSER}/gnupg | ||
35 | whitelist ${RUNUSER}/keyring | ||
34 | #include whitelist-common.inc | 36 | #include whitelist-common.inc |
37 | include whitelist-runuser-common.inc | ||
35 | include whitelist-usr-share-common.inc | 38 | include whitelist-usr-share-common.inc |
36 | include whitelist-var-common.inc | 39 | include whitelist-var-common.inc |
37 | 40 | ||
@@ -58,3 +61,8 @@ private-cache | |||
58 | private-dev | 61 | private-dev |
59 | private-etc ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssh,ssl,X11 | 62 | private-etc ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssh,ssl,X11 |
60 | writable-run-user | 63 | writable-run-user |
64 | |||
65 | dbus-user filter | ||
66 | dbus-user.own org.gnome.seahorse.Application | ||
67 | dbus-user.talk org.freedesktop.secrets | ||
68 | dbus-system none | ||
diff --git a/etc/seamonkey-bin.profile b/etc/profile-m-z/seamonkey-bin.profile index 532294950..532294950 100644 --- a/etc/seamonkey-bin.profile +++ b/etc/profile-m-z/seamonkey-bin.profile | |||
diff --git a/etc/seamonkey.profile b/etc/profile-m-z/seamonkey.profile index 807effbeb..807effbeb 100644 --- a/etc/seamonkey.profile +++ b/etc/profile-m-z/seamonkey.profile | |||
diff --git a/etc/secret-tool.profile b/etc/profile-m-z/secret-tool.profile index 70d9a5b1d..99ba11d30 100644 --- a/etc/secret-tool.profile +++ b/etc/profile-m-z/secret-tool.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for secret-tool | 1 | # Firejail profile for secret-tool |
2 | # Description: Library for storing and retrieving passwords and other secrets | 2 | # Description: Library for storing and retrieving passwords and other secrets |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include secret-tool.local | 6 | include secret-tool.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
diff --git a/etc/server.profile b/etc/profile-m-z/server.profile index ce318a828..5bc4735ae 100644 --- a/etc/server.profile +++ b/etc/profile-m-z/server.profile | |||
@@ -1,4 +1,27 @@ | |||
1 | # Firejail profile for server | 1 | # Generic Firejail profile for servers started as root |
2 | # | ||
3 | # This profile is used as a default when starting the sandbox as root. | ||
4 | # Example: | ||
5 | # | ||
6 | # $ sudo firejail | ||
7 | # [sudo] password for netblue: | ||
8 | # Reading profile /etc/firejail/server.profile | ||
9 | # Reading profile /etc/firejail/disable-common.inc | ||
10 | # Reading profile /etc/firejail/disable-passwdmgr.inc | ||
11 | # Reading profile /etc/firejail/disable-programs.inc | ||
12 | # | ||
13 | # ** Note: you can use --noprofile to disable server.profile ** | ||
14 | # | ||
15 | # Parent pid 5347, child pid 5348 | ||
16 | # The new log directory is /proc/5348/root/var/log | ||
17 | # Child process initialized in 64.43 ms | ||
18 | # root@debian:~# | ||
19 | # | ||
20 | # Customize the profile as usual. Examples: unbound.profile, fdns.profile. | ||
21 | # All the rules for regular user profiles apply with the exception of | ||
22 | # /usr/local/bin symlink redirection and firecfg tool. The redirection is disabled | ||
23 | # by default for root user. | ||
24 | |||
2 | # This file is overwritten after every install/update | 25 | # This file is overwritten after every install/update |
3 | # Persistent local customizations | 26 | # Persistent local customizations |
4 | include server.local | 27 | include server.local |
@@ -28,7 +51,6 @@ caps | |||
28 | # ipc-namespace | 51 | # ipc-namespace |
29 | # netfilter /etc/firejail/webserver.net | 52 | # netfilter /etc/firejail/webserver.net |
30 | no3d | 53 | no3d |
31 | # nodbus | ||
32 | nodvd | 54 | nodvd |
33 | # nogroups | 55 | # nogroups |
34 | # nonewprivs | 56 | # nonewprivs |
@@ -49,4 +71,7 @@ private-dev | |||
49 | # private-lib | 71 | # private-lib |
50 | private-tmp | 72 | private-tmp |
51 | 73 | ||
74 | # dbus-user none | ||
75 | # dbus-system none | ||
76 | |||
52 | # memory-deny-write-execute | 77 | # memory-deny-write-execute |
diff --git a/etc/sftp.profile b/etc/profile-m-z/sftp.profile index 66dc2a57b..66dc2a57b 100644 --- a/etc/sftp.profile +++ b/etc/profile-m-z/sftp.profile | |||
diff --git a/etc/shellcheck.profile b/etc/profile-m-z/shellcheck.profile index f8744bdf8..6cd70c2ea 100644 --- a/etc/shellcheck.profile +++ b/etc/profile-m-z/shellcheck.profile | |||
@@ -8,6 +8,7 @@ include shellcheck.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | noblacklist ${DOCUMENTS} | 13 | noblacklist ${DOCUMENTS} |
13 | 14 | ||
@@ -23,12 +24,12 @@ whitelist /usr/share/shellcheck | |||
23 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
27 | apparmor | ||
26 | caps.drop all | 28 | caps.drop all |
27 | ipc-namespace | 29 | ipc-namespace |
28 | machine-id | 30 | machine-id |
29 | net none | 31 | net none |
30 | no3d | 32 | no3d |
31 | nodbus | ||
32 | nodvd | 33 | nodvd |
33 | nogroups | 34 | nogroups |
34 | nonewprivs | 35 | nonewprivs |
@@ -47,4 +48,7 @@ private-cache | |||
47 | private-dev | 48 | private-dev |
48 | private-tmp | 49 | private-tmp |
49 | 50 | ||
51 | dbus-user none | ||
52 | dbus-system none | ||
53 | |||
50 | memory-deny-write-execute | 54 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/shortwave.profile b/etc/profile-m-z/shortwave.profile new file mode 100644 index 000000000..ee2314833 --- /dev/null +++ b/etc/profile-m-z/shortwave.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for shortwave | ||
2 | # Description: Listen to internet radio | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include shortwave.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/Shortwave | ||
10 | noblacklist ${HOME}/.local/share/Shortwave | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.cache/Shortwave | ||
21 | mkdir ${HOME}/.local/share/Shortwave | ||
22 | whitelist ${HOME}/.cache/Shortwave | ||
23 | whitelist ${HOME}/.local/share/Shortwave | ||
24 | whitelist /usr/share/shortwave | ||
25 | include whitelist-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | netfilter | ||
33 | nodvd | ||
34 | nogroups | ||
35 | nonewprivs | ||
36 | noroot | ||
37 | notv | ||
38 | nou2f | ||
39 | novideo | ||
40 | protocol unix,inet,inet6 | ||
41 | seccomp | ||
42 | shell none | ||
43 | tracelog | ||
44 | |||
45 | disable-mnt | ||
46 | private-bin shortwave | ||
47 | private-cache | ||
48 | private-dev | ||
49 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gconf,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,ssl,X11,xdg | ||
50 | private-tmp | ||
diff --git a/etc/shotcut.profile b/etc/profile-m-z/shotcut.profile index 072cc2c0d..bec0bfbb0 100644 --- a/etc/shotcut.profile +++ b/etc/profile-m-z/shotcut.profile | |||
@@ -19,7 +19,6 @@ include disable-programs.inc | |||
19 | 19 | ||
20 | caps.drop all | 20 | caps.drop all |
21 | net none | 21 | net none |
22 | nodbus | ||
23 | nodvd | 22 | nodvd |
24 | nogroups | 23 | nogroups |
25 | nonewprivs | 24 | nonewprivs |
@@ -34,3 +33,6 @@ tracelog | |||
34 | #private-bin melt,nice,qmelt,shotcut | 33 | #private-bin melt,nice,qmelt,shotcut |
35 | private-cache | 34 | private-cache |
36 | private-dev | 35 | private-dev |
36 | |||
37 | dbus-user none | ||
38 | dbus-system none | ||
diff --git a/etc/signal-cli.profile b/etc/profile-m-z/signal-cli.profile index 6a2f5c434..6a2f5c434 100644 --- a/etc/signal-cli.profile +++ b/etc/profile-m-z/signal-cli.profile | |||
diff --git a/etc/signal-desktop.profile b/etc/profile-m-z/signal-desktop.profile index f810a37ec..b51a86e7d 100644 --- a/etc/signal-desktop.profile +++ b/etc/profile-m-z/signal-desktop.profile | |||
@@ -9,6 +9,11 @@ ignore noexec /tmp | |||
9 | 9 | ||
10 | noblacklist ${HOME}/.config/Signal | 10 | noblacklist ${HOME}/.config/Signal |
11 | 11 | ||
12 | # These lines are needed to allow Firefox to open links | ||
13 | noblacklist ${HOME}/.mozilla | ||
14 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | ||
15 | read-only ${HOME}/.mozilla/firefox/profiles.ini | ||
16 | |||
12 | include disable-common.inc | 17 | include disable-common.inc |
13 | include disable-devel.inc | 18 | include disable-devel.inc |
14 | include disable-exec.inc | 19 | include disable-exec.inc |
@@ -22,14 +27,20 @@ whitelist ${HOME}/.config/Signal | |||
22 | include whitelist-common.inc | 27 | include whitelist-common.inc |
23 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
24 | 29 | ||
30 | apparmor | ||
25 | caps.keep sys_admin,sys_chroot | 31 | caps.keep sys_admin,sys_chroot |
26 | netfilter | 32 | netfilter |
27 | nodvd | 33 | nodvd |
28 | nogroups | 34 | nogroups |
29 | notv | 35 | notv |
30 | nou2f | 36 | nou2f |
37 | novideo | ||
31 | shell none | 38 | shell none |
32 | 39 | ||
33 | disable-mnt | 40 | disable-mnt |
34 | private-dev | 41 | private-dev |
42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl | ||
35 | private-tmp | 43 | private-tmp |
44 | |||
45 | dbus-user none | ||
46 | dbus-system none | ||
diff --git a/etc/silentarmy.profile b/etc/profile-m-z/silentarmy.profile index cfc33d074..220035ee7 100644 --- a/etc/silentarmy.profile +++ b/etc/profile-m-z/silentarmy.profile | |||
@@ -12,6 +12,7 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
diff --git a/etc/simple-scan.profile b/etc/profile-m-z/simple-scan.profile index 40fe8c566..17920677b 100644 --- a/etc/simple-scan.profile +++ b/etc/profile-m-z/simple-scan.profile | |||
@@ -16,6 +16,7 @@ include disable-passwdmgr.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | 17 | include disable-xdg.inc |
18 | 18 | ||
19 | whitelist /usr/share/hplip | ||
19 | whitelist /usr/share/simple-scan | 20 | whitelist /usr/share/simple-scan |
20 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
21 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
diff --git a/etc/simplescreenrecorder.profile b/etc/profile-m-z/simplescreenrecorder.profile index edcc2a0f4..edcc2a0f4 100644 --- a/etc/simplescreenrecorder.profile +++ b/etc/profile-m-z/simplescreenrecorder.profile | |||
diff --git a/etc/simutrans.profile b/etc/profile-m-z/simutrans.profile index c6f5f70b0..1b81f2ea1 100644 --- a/etc/simutrans.profile +++ b/etc/profile-m-z/simutrans.profile | |||
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.simutrans | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
@@ -17,10 +18,11 @@ include disable-programs.inc | |||
17 | mkdir ${HOME}/.simutrans | 18 | mkdir ${HOME}/.simutrans |
18 | whitelist ${HOME}/.simutrans | 19 | whitelist ${HOME}/.simutrans |
19 | include whitelist-common.inc | 20 | include whitelist-common.inc |
21 | include whitelist-var-common.inc | ||
20 | 22 | ||
23 | apparmor | ||
21 | caps.drop all | 24 | caps.drop all |
22 | net none | 25 | net none |
23 | nodbus | ||
24 | nodvd | 26 | nodvd |
25 | nogroups | 27 | nogroups |
26 | nonewprivs | 28 | nonewprivs |
@@ -35,3 +37,6 @@ shell none | |||
35 | # private-bin simutrans | 37 | # private-bin simutrans |
36 | private-dev | 38 | private-dev |
37 | private-tmp | 39 | private-tmp |
40 | |||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/skanlite.profile b/etc/profile-m-z/skanlite.profile index 6f9bfd201..093a61398 100644 --- a/etc/skanlite.profile +++ b/etc/profile-m-z/skanlite.profile | |||
@@ -17,7 +17,6 @@ include disable-xdg.inc | |||
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | netfilter | 19 | netfilter |
20 | # nodbus | ||
21 | nodvd | 20 | nodvd |
22 | nogroups | 21 | nogroups |
23 | nonewprivs | 22 | nonewprivs |
@@ -33,3 +32,6 @@ shell none | |||
33 | # private-bin kbuildsycoca4,kdeinit4,skanlite | 32 | # private-bin kbuildsycoca4,kdeinit4,skanlite |
34 | # private-dev | 33 | # private-dev |
35 | # private-tmp | 34 | # private-tmp |
35 | |||
36 | # dbus-user none | ||
37 | # dbus-system none | ||
diff --git a/etc/skypeforlinux.profile b/etc/profile-m-z/skypeforlinux.profile index 341c25a95..341c25a95 100644 --- a/etc/skypeforlinux.profile +++ b/etc/profile-m-z/skypeforlinux.profile | |||
diff --git a/etc/slack.profile b/etc/profile-m-z/slack.profile index 54069f657..8ab3edd63 100644 --- a/etc/slack.profile +++ b/etc/profile-m-z/slack.profile | |||
@@ -12,6 +12,7 @@ include disable-devel.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | 16 | ||
16 | mkdir ${HOME}/.config/Slack | 17 | mkdir ${HOME}/.config/Slack |
17 | whitelist ${HOME}/.config/Slack | 18 | whitelist ${HOME}/.config/Slack |
@@ -19,16 +20,12 @@ whitelist ${DOWNLOADS} | |||
19 | include whitelist-common.inc | 20 | include whitelist-common.inc |
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
22 | caps.drop all | 23 | caps.keep sys_admin,sys_chroot |
23 | netfilter | 24 | netfilter |
24 | nodvd | 25 | nodvd |
25 | nogroups | 26 | nogroups |
26 | nonewprivs | ||
27 | noroot | ||
28 | notv | 27 | notv |
29 | nou2f | 28 | nou2f |
30 | protocol unix,inet,inet6,netlink | ||
31 | seccomp | ||
32 | shell none | 29 | shell none |
33 | 30 | ||
34 | disable-mnt | 31 | disable-mnt |
@@ -36,4 +33,3 @@ private-bin locale,slack | |||
36 | private-cache | 33 | private-cache |
37 | private-dev | 34 | private-dev |
38 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fedora-release,fonts,group,ld.so.cache,ld.so.conf,localtime,machine-id,os-release,passwd,pki,pulse,redhat-release,resolv.conf,ssl,system-release,system-release-cpe | 35 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fedora-release,fonts,group,ld.so.cache,ld.so.conf,localtime,machine-id,os-release,passwd,pki,pulse,redhat-release,resolv.conf,ssl,system-release,system-release-cpe |
39 | private-tmp | ||
diff --git a/etc/slashem.profile b/etc/profile-m-z/slashem.profile index 8c84180d7..ca0516e65 100644 --- a/etc/slashem.profile +++ b/etc/profile-m-z/slashem.profile | |||
@@ -23,7 +23,6 @@ caps.drop all | |||
23 | ipc-namespace | 23 | ipc-namespace |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | #nonewprivs | 28 | #nonewprivs |
@@ -42,4 +41,7 @@ private-dev | |||
42 | private-tmp | 41 | private-tmp |
43 | writable-var | 42 | writable-var |
44 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
46 | |||
45 | #memory-deny-write-execute | 47 | #memory-deny-write-execute |
diff --git a/etc/smplayer.profile b/etc/profile-m-z/smplayer.profile index 395888c8a..3fb6fc349 100644 --- a/etc/smplayer.profile +++ b/etc/profile-m-z/smplayer.profile | |||
@@ -23,6 +23,7 @@ include disable-exec.inc | |||
23 | include disable-interpreters.inc | 23 | include disable-interpreters.inc |
24 | include disable-passwdmgr.inc | 24 | include disable-passwdmgr.inc |
25 | include disable-programs.inc | 25 | include disable-programs.inc |
26 | include disable-shell.inc | ||
26 | include disable-xdg.inc | 27 | include disable-xdg.inc |
27 | 28 | ||
28 | whitelist /usr/share/smplayer | 29 | whitelist /usr/share/smplayer |
@@ -32,7 +33,6 @@ include whitelist-var-common.inc | |||
32 | apparmor | 33 | apparmor |
33 | caps.drop all | 34 | caps.drop all |
34 | netfilter | 35 | netfilter |
35 | # nodbus - problems with KDE | ||
36 | # nogroups | 36 | # nogroups |
37 | nonewprivs | 37 | nonewprivs |
38 | noroot | 38 | noroot |
@@ -45,3 +45,6 @@ private-bin env,mplayer,mpv,python*,smplayer,smtube,youtube-dl | |||
45 | private-dev | 45 | private-dev |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # problems with KDE | ||
49 | # dbus-user none | ||
50 | # dbus-system none | ||
diff --git a/etc/smtube.profile b/etc/profile-m-z/smtube.profile index 98e0229ce..79bc02979 100644 --- a/etc/smtube.profile +++ b/etc/profile-m-z/smtube.profile | |||
@@ -28,6 +28,7 @@ whitelist /usr/share/smtube | |||
28 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
29 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
30 | 30 | ||
31 | apparmor | ||
31 | caps.drop all | 32 | caps.drop all |
32 | netfilter | 33 | netfilter |
33 | nodvd | 34 | nodvd |
diff --git a/etc/snox.profile b/etc/profile-m-z/snox.profile index 3b3fd1ae1..3b3fd1ae1 100644 --- a/etc/snox.profile +++ b/etc/profile-m-z/snox.profile | |||
diff --git a/etc/soffice.profile b/etc/profile-m-z/soffice.profile index 8348a57fe..8348a57fe 100644 --- a/etc/soffice.profile +++ b/etc/profile-m-z/soffice.profile | |||
diff --git a/etc/sol.profile b/etc/profile-m-z/sol.profile index ea1620b31..44fb8cfe2 100644 --- a/etc/sol.profile +++ b/etc/profile-m-z/sol.profile | |||
@@ -11,17 +11,18 @@ include disable-exec.inc | |||
11 | include disable-interpreters.inc | 11 | include disable-interpreters.inc |
12 | include disable-passwdmgr.inc | 12 | include disable-passwdmgr.inc |
13 | include disable-programs.inc | 13 | include disable-programs.inc |
14 | include disable-shell.inc | ||
14 | include disable-xdg.inc | 15 | include disable-xdg.inc |
15 | 16 | ||
16 | # all necessary files in $HOME are in whitelist-common.inc | 17 | # all necessary files in $HOME are in whitelist-common.inc |
17 | include whitelist-common.inc | 18 | include whitelist-common.inc |
18 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
19 | 20 | ||
21 | apparmor | ||
20 | caps.drop all | 22 | caps.drop all |
21 | ipc-namespace | 23 | ipc-namespace |
22 | net none | 24 | net none |
23 | # no3d | 25 | # no3d |
24 | nodbus | ||
25 | nodvd | 26 | nodvd |
26 | nogroups | 27 | nogroups |
27 | nonewprivs | 28 | nonewprivs |
@@ -40,4 +41,7 @@ private-cache | |||
40 | private-dev | 41 | private-dev |
41 | private-tmp | 42 | private-tmp |
42 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
46 | |||
43 | # memory-deny-write-execute | 47 | # memory-deny-write-execute |
diff --git a/etc/profile-m-z/sound-juicer.profile b/etc/profile-m-z/sound-juicer.profile new file mode 100644 index 000000000..b9f3768be --- /dev/null +++ b/etc/profile-m-z/sound-juicer.profile | |||
@@ -0,0 +1,43 @@ | |||
1 | # Firejail profile for mpv | ||
2 | # Description: Graphical audio CD ripper and encoder | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include sound-juicer.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/sound-juicer | ||
10 | noblacklist ${MUSIC} | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
23 | caps.drop all | ||
24 | netfilter | ||
25 | no3d | ||
26 | nogroups | ||
27 | nonewprivs | ||
28 | noroot | ||
29 | nosound | ||
30 | nou2f | ||
31 | notv | ||
32 | novideo | ||
33 | protocol unix,inet,inet6,netlink | ||
34 | seccomp | ||
35 | shell none | ||
36 | tracelog | ||
37 | |||
38 | private-cache | ||
39 | private-dev | ||
40 | private-tmp | ||
41 | |||
42 | # dbus-user none | ||
43 | # dbus-system none | ||
diff --git a/etc/soundconverter.profile b/etc/profile-m-z/soundconverter.profile index bdd6eb7f5..bdd6eb7f5 100644 --- a/etc/soundconverter.profile +++ b/etc/profile-m-z/soundconverter.profile | |||
diff --git a/etc/spectre-meltdown-checker.profile b/etc/profile-m-z/spectre-meltdown-checker.profile index e27df4cc8..a0b99abcf 100644 --- a/etc/spectre-meltdown-checker.profile +++ b/etc/profile-m-z/spectre-meltdown-checker.profile | |||
@@ -31,7 +31,6 @@ caps.keep sys_rawio | |||
31 | ipc-namespace | 31 | ipc-namespace |
32 | net none | 32 | net none |
33 | no3d | 33 | no3d |
34 | nodbus | ||
35 | nodvd | 34 | nodvd |
36 | nogroups | 35 | nogroups |
37 | nonewprivs | 36 | nonewprivs |
@@ -49,4 +48,7 @@ private-bin awk,bzip2,cat,coreos-install,cpucontrol,cut,dd,dirname,dmesg,dnf,ech | |||
49 | private-cache | 48 | private-cache |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
51 | dbus-user none | ||
52 | dbus-system none | ||
53 | |||
52 | memory-deny-write-execute | 54 | memory-deny-write-execute |
diff --git a/etc/spotify.profile b/etc/profile-m-z/spotify.profile index 59692f1d6..1a34cb86d 100644 --- a/etc/spotify.profile +++ b/etc/profile-m-z/spotify.profile | |||
@@ -29,7 +29,6 @@ include whitelist-var-common.inc | |||
29 | 29 | ||
30 | caps.drop all | 30 | caps.drop all |
31 | netfilter | 31 | netfilter |
32 | #nodbus - dbus needed for MPRIS | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -50,3 +49,6 @@ private-opt spotify | |||
50 | private-srv none | 49 | private-srv none |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
52 | # dbus needed for MPRIS | ||
53 | # dbus-user none | ||
54 | # dbus-system none | ||
diff --git a/etc/sqlitebrowser.profile b/etc/profile-m-z/sqlitebrowser.profile index 94bb4d3f2..cdb20b4e0 100644 --- a/etc/sqlitebrowser.profile +++ b/etc/profile-m-z/sqlitebrowser.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
@@ -24,7 +25,6 @@ apparmor | |||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | netfilter | 27 | netfilter |
27 | # nodbus - breaks proxy creation | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -43,4 +43,8 @@ private-dev | |||
43 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,machine-id,passwd,pki,ssl | 43 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,machine-id,passwd,pki,ssl |
44 | private-tmp | 44 | private-tmp |
45 | 45 | ||
46 | # breaks proxy creation | ||
47 | # dbus-user none | ||
48 | # dbus-system none | ||
49 | |||
46 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 50 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/ssh-agent.profile b/etc/profile-m-z/ssh-agent.profile index cf509852a..01b63d3ce 100644 --- a/etc/ssh-agent.profile +++ b/etc/profile-m-z/ssh-agent.profile | |||
@@ -22,7 +22,6 @@ include whitelist-usr-share-common.inc | |||
22 | caps.drop all | 22 | caps.drop all |
23 | netfilter | 23 | netfilter |
24 | no3d | 24 | no3d |
25 | nodbus | ||
26 | nodvd | 25 | nodvd |
27 | nonewprivs | 26 | nonewprivs |
28 | noroot | 27 | noroot |
@@ -34,3 +33,6 @@ shell none | |||
34 | tracelog | 33 | tracelog |
35 | 34 | ||
36 | writable-run-user | 35 | writable-run-user |
36 | |||
37 | dbus-user none | ||
38 | dbus-system none | ||
diff --git a/etc/ssh.profile b/etc/profile-m-z/ssh.profile index 1551c3fb6..5d3458c29 100644 --- a/etc/ssh.profile +++ b/etc/profile-m-z/ssh.profile | |||
@@ -12,19 +12,22 @@ noblacklist /tmp/ssh-* | |||
12 | noblacklist ${HOME}/.ssh | 12 | noblacklist ${HOME}/.ssh |
13 | # nc can be used as ProxyCommand, e.g. when using tor | 13 | # nc can be used as ProxyCommand, e.g. when using tor |
14 | noblacklist ${PATH}/nc | 14 | noblacklist ${PATH}/nc |
15 | noblacklist ${PATH}/ncat | ||
15 | 16 | ||
16 | include disable-common.inc | 17 | include disable-common.inc |
17 | include disable-exec.inc | 18 | include disable-exec.inc |
18 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 20 | include disable-programs.inc |
20 | 21 | ||
22 | whitelist ${RUNUSER}/keyring/ssh | ||
23 | whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh | ||
21 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
25 | include whitelist-runuser-common.inc | ||
22 | 26 | ||
23 | caps.drop all | 27 | caps.drop all |
24 | ipc-namespace | 28 | ipc-namespace |
25 | netfilter | 29 | netfilter |
26 | no3d | 30 | no3d |
27 | nodbus | ||
28 | nodvd | 31 | nodvd |
29 | nogroups | 32 | nogroups |
30 | nonewprivs | 33 | nonewprivs |
@@ -43,4 +46,7 @@ private-dev | |||
43 | # private-tmp # Breaks when exiting | 46 | # private-tmp # Breaks when exiting |
44 | writable-run-user | 47 | writable-run-user |
45 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
46 | memory-deny-write-execute | 52 | memory-deny-write-execute |
diff --git a/etc/standardnotes-desktop.profile b/etc/profile-m-z/standardnotes-desktop.profile index a402aca5a..1292b806b 100644 --- a/etc/standardnotes-desktop.profile +++ b/etc/profile-m-z/standardnotes-desktop.profile | |||
@@ -25,7 +25,6 @@ apparmor | |||
25 | caps.drop all | 25 | caps.drop all |
26 | machine-id | 26 | machine-id |
27 | netfilter | 27 | netfilter |
28 | nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -41,3 +40,5 @@ private-dev | |||
41 | private-tmp | 40 | private-tmp |
42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,pki,resolv.conf,ssl,xdg | 41 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,pki,resolv.conf,ssl,xdg |
43 | 42 | ||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/start-tor-browser.desktop.profile b/etc/profile-m-z/start-tor-browser.desktop.profile index 2f73c9fee..2f73c9fee 100644 --- a/etc/start-tor-browser.desktop.profile +++ b/etc/profile-m-z/start-tor-browser.desktop.profile | |||
diff --git a/etc/start-tor-browser.profile b/etc/profile-m-z/start-tor-browser.profile index f9daf8f09..b62b19101 100644 --- a/etc/start-tor-browser.profile +++ b/etc/profile-m-z/start-tor-browser.profile | |||
@@ -19,7 +19,6 @@ include whitelist-var-common.inc | |||
19 | 19 | ||
20 | caps.drop all | 20 | caps.drop all |
21 | netfilter | 21 | netfilter |
22 | nodbus | ||
23 | nodvd | 22 | nodvd |
24 | nogroups | 23 | nogroups |
25 | nonewprivs | 24 | nonewprivs |
@@ -38,3 +37,6 @@ private-bin bash,cat,cp,cut,dirname,env,getconf,gpg,grep,gxmessage,id,kdialog,ln | |||
38 | private-dev | 37 | private-dev |
39 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl | 38 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
40 | private-tmp | 39 | private-tmp |
40 | |||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/steam-native.profile b/etc/profile-m-z/steam-native.profile index 47608ad28..47608ad28 100644 --- a/etc/steam-native.profile +++ b/etc/profile-m-z/steam-native.profile | |||
diff --git a/etc/profile-m-z/steam-runtime.profile b/etc/profile-m-z/steam-runtime.profile new file mode 100644 index 000000000..47608ad28 --- /dev/null +++ b/etc/profile-m-z/steam-runtime.profile | |||
@@ -0,0 +1,5 @@ | |||
1 | # Firejail profile alias for steam | ||
2 | # This file is overwritten after every install/update | ||
3 | |||
4 | # Redirect | ||
5 | include steam.profile | ||
diff --git a/etc/steam.profile b/etc/profile-m-z/steam.profile index bc90af837..7292f189c 100644 --- a/etc/steam.profile +++ b/etc/profile-m-z/steam.profile | |||
@@ -10,12 +10,17 @@ noblacklist ${HOME}/.killingfloor | |||
10 | noblacklist ${HOME}/.local/share/3909/PapersPlease | 10 | noblacklist ${HOME}/.local/share/3909/PapersPlease |
11 | noblacklist ${HOME}/.local/share/aspyr-media | 11 | noblacklist ${HOME}/.local/share/aspyr-media |
12 | noblacklist ${HOME}/.local/share/cdprojektred | 12 | noblacklist ${HOME}/.local/share/cdprojektred |
13 | noblacklist ${HOME}/.local/share/FasterThanLight | ||
13 | noblacklist ${HOME}/.local/share/feral-interactive | 14 | noblacklist ${HOME}/.local/share/feral-interactive |
15 | noblacklist ${HOME}/.local/share/IntoTheBreach | ||
16 | noblacklist ${HOME}/.local/share/Paradox Interactive | ||
14 | noblacklist ${HOME}/.local/share/Steam | 17 | noblacklist ${HOME}/.local/share/Steam |
15 | noblacklist ${HOME}/.local/share/SuperHexagon | 18 | noblacklist ${HOME}/.local/share/SuperHexagon |
16 | noblacklist ${HOME}/.local/share/Terraria | 19 | noblacklist ${HOME}/.local/share/Terraria |
17 | noblacklist ${HOME}/.local/share/vpltd | 20 | noblacklist ${HOME}/.local/share/vpltd |
18 | noblacklist ${HOME}/.local/share/vulkan | 21 | noblacklist ${HOME}/.local/share/vulkan |
22 | noblacklist ${HOME}/.mbwarband | ||
23 | noblacklist ${HOME}/.paradoxinteractive | ||
19 | noblacklist ${HOME}/.steam | 24 | noblacklist ${HOME}/.steam |
20 | noblacklist ${HOME}/.steampath | 25 | noblacklist ${HOME}/.steampath |
21 | noblacklist ${HOME}/.steampid | 26 | noblacklist ${HOME}/.steampid |
@@ -27,8 +32,8 @@ noblacklist /usr/sbin | |||
27 | include allow-java.inc | 32 | include allow-java.inc |
28 | 33 | ||
29 | # Allow python (blacklisted by disable-interpreters.inc) | 34 | # Allow python (blacklisted by disable-interpreters.inc) |
30 | include allow-python2.inc | 35 | include allow-python2.inc |
31 | include allow-python3.inc | 36 | include allow-python3.inc |
32 | 37 | ||
33 | include disable-common.inc | 38 | include disable-common.inc |
34 | include disable-devel.inc | 39 | include disable-devel.inc |
@@ -36,16 +41,52 @@ include disable-interpreters.inc | |||
36 | include disable-passwdmgr.inc | 41 | include disable-passwdmgr.inc |
37 | include disable-programs.inc | 42 | include disable-programs.inc |
38 | 43 | ||
44 | mkdir ${HOME}/.config/unity3d | ||
45 | mkdir ${HOME}/.killingfloor | ||
46 | mkdir ${HOME}/.local/share/3909/PapersPlease | ||
47 | mkdir ${HOME}/.local/share/aspyr-media | ||
48 | mkdir ${HOME}/.local/share/cdprojektred | ||
49 | mkdir ${HOME}/.local/share/FasterThanLight | ||
50 | mkdir ${HOME}/.local/share/feral-interactive | ||
51 | mkdir ${HOME}/.local/share/IntoTheBreach | ||
52 | mkdir ${HOME}/.local/share/Paradox Interactive | ||
53 | mkdir ${HOME}/.local/share/Steam | ||
54 | mkdir ${HOME}/.local/share/SuperHexagon | ||
55 | mkdir ${HOME}/.local/share/Terraria | ||
56 | mkdir ${HOME}/.local/share/vpltd | ||
57 | mkdir ${HOME}/.local/share/vulkan | ||
58 | mkdir ${HOME}/.mbwarband | ||
59 | mkdir ${HOME}/.paradoxinteractive | ||
60 | mkdir ${HOME}/.steam | ||
61 | mkfile ${HOME}/.steampath | ||
62 | mkfile ${HOME}/.steampid | ||
63 | whitelist ${HOME}/.config/unity3d | ||
64 | whitelist ${HOME}/.killingfloor | ||
65 | whitelist ${HOME}/.local/share/3909/PapersPlease | ||
66 | whitelist ${HOME}/.local/share/aspyr-media | ||
67 | whitelist ${HOME}/.local/share/cdprojektred | ||
68 | whitelist ${HOME}/.local/share/FasterThanLight | ||
69 | whitelist ${HOME}/.local/share/feral-interactive | ||
70 | whitelist ${HOME}/.local/share/IntoTheBreach | ||
71 | whitelist ${HOME}/.local/share/Paradox Interactive | ||
72 | whitelist ${HOME}/.local/share/Steam | ||
73 | whitelist ${HOME}/.local/share/SuperHexagon | ||
74 | whitelist ${HOME}/.local/share/Terraria | ||
75 | whitelist ${HOME}/.local/share/vpltd | ||
76 | whitelist ${HOME}/.local/share/vulkan | ||
77 | whitelist ${HOME}/.mbwarband | ||
78 | whitelist ${HOME}/.paradoxinteractive | ||
79 | whitelist ${HOME}/.steam | ||
80 | whitelist ${HOME}/.steampath | ||
81 | whitelist ${HOME}/.steampid | ||
82 | include whitelist-common.inc | ||
39 | include whitelist-var-common.inc | 83 | include whitelist-var-common.inc |
40 | 84 | ||
41 | # allow-debuggers needed for running some games with proton | ||
42 | allow-debuggers | ||
43 | caps.drop all | 85 | caps.drop all |
44 | #ipc-namespace | 86 | #ipc-namespace |
45 | netfilter | 87 | netfilter |
46 | # nodbus disabled as it breaks appindicator support | ||
47 | #nodbus | ||
48 | nodvd | 88 | nodvd |
89 | # nVidia users may need to comment / ignore nogroups and noroot | ||
49 | nogroups | 90 | nogroups |
50 | nonewprivs | 91 | nonewprivs |
51 | noroot | 92 | noroot |
@@ -54,11 +95,11 @@ nou2f | |||
54 | # novideo should be commented for VR | 95 | # novideo should be commented for VR |
55 | novideo | 96 | novideo |
56 | protocol unix,inet,inet6,netlink | 97 | protocol unix,inet,inet6,netlink |
57 | # seccomp cause sometimes issues (see #2860, #2951), | 98 | # seccomp sometimes causes issues (see #2951, #3267), |
58 | # comment it or add 'ignore seccomp' to steam.local if so. | 99 | # comment it or add 'ignore seccomp' to steam.local if so. |
59 | seccomp | 100 | seccomp !ptrace |
60 | shell none | 101 | shell none |
61 | # tracelog disabled as it breaks integrated browser | 102 | # tracelog breaks integrated browser |
62 | #tracelog | 103 | #tracelog |
63 | 104 | ||
64 | # private-bin is disabled while in testing, but has been tested working with multiple games | 105 | # private-bin is disabled while in testing, but has been tested working with multiple games |
@@ -71,5 +112,9 @@ shell none | |||
71 | # private-dev should be commented for controllers | 112 | # private-dev should be commented for controllers |
72 | private-dev | 113 | private-dev |
73 | # private-etc breaks a small selection of games on some systems, comment to support those | 114 | # private-etc breaks a small selection of games on some systems, comment to support those |
74 | private-etc alternatives,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,lsb-release,machine-id,mime.types,nvidia,os-release,passwd,pki,pulse,resolv.conf,services,ssl | 115 | private-etc alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,lsb-release,machine-id,mime.types,nvidia,os-release,passwd,pki,pulse,resolv.conf,services,ssl |
75 | private-tmp | 116 | private-tmp |
117 | |||
118 | # breaks appindicator support | ||
119 | # dbus-user none | ||
120 | # dbus-system none | ||
diff --git a/etc/stellarium.profile b/etc/profile-m-z/stellarium.profile index d6df2e0ad..3f93fe591 100644 --- a/etc/stellarium.profile +++ b/etc/profile-m-z/stellarium.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | mkdir ${HOME}/.config/stellarium | 20 | mkdir ${HOME}/.config/stellarium |
20 | mkdir ${HOME}/.stellarium | 21 | mkdir ${HOME}/.stellarium |
diff --git a/etc/profile-m-z/strawberry.profile b/etc/profile-m-z/strawberry.profile new file mode 100644 index 000000000..cd36c0d41 --- /dev/null +++ b/etc/profile-m-z/strawberry.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for strawberry | ||
2 | # Description: A music player and music collection organizer | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include strawberry.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/strawberry | ||
10 | noblacklist ${HOME}/.config/strawberry | ||
11 | noblacklist ${HOME}/.local/share/strawberry | ||
12 | noblacklist ${MUSIC} | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | include whitelist-runuser-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | |||
26 | apparmor | ||
27 | caps.drop all | ||
28 | netfilter | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix,inet,inet6,netlink | ||
37 | # blacklisting of ioprio_set system calls breaks strawberry | ||
38 | seccomp !ioprio_set | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin strawberry,strawberry-tagreader | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,nsswitch.conf,pki,resolv.conf,ssl | ||
47 | private-tmp | ||
48 | |||
49 | dbus-system none | ||
diff --git a/etc/strings.profile b/etc/profile-m-z/strings.profile index 7dc453b1f..426b2dc1c 100644 --- a/etc/strings.profile +++ b/etc/profile-m-z/strings.profile | |||
@@ -8,6 +8,7 @@ include strings.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | #include disable-common.inc | 13 | #include disable-common.inc |
13 | include disable-devel.inc | 14 | include disable-devel.inc |
@@ -15,6 +16,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
17 | #include disable-programs.inc | 18 | #include disable-programs.inc |
19 | include disable-shell.inc | ||
18 | #include disable-xdg.inc | 20 | #include disable-xdg.inc |
19 | 21 | ||
20 | #include whitelist-usr-share-common.inc | 22 | #include whitelist-usr-share-common.inc |
@@ -26,7 +28,6 @@ ipc-namespace | |||
26 | machine-id | 28 | machine-id |
27 | net none | 29 | net none |
28 | no3d | 30 | no3d |
29 | nodbus | ||
30 | nodvd | 31 | nodvd |
31 | nogroups | 32 | nogroups |
32 | nonewprivs | 33 | nonewprivs |
@@ -49,5 +50,8 @@ private-dev | |||
49 | #private-lib libfakeroot | 50 | #private-lib libfakeroot |
50 | private-tmp | 51 | private-tmp |
51 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
52 | memory-deny-write-execute | 56 | memory-deny-write-execute |
53 | read-only ${HOME} | 57 | read-only ${HOME} |
diff --git a/etc/studio.sh.profile b/etc/profile-m-z/studio.sh.profile index 79e879f36..79e879f36 100644 --- a/etc/studio.sh.profile +++ b/etc/profile-m-z/studio.sh.profile | |||
diff --git a/etc/subdownloader.profile b/etc/profile-m-z/subdownloader.profile index f6165f139..428af3737 100644 --- a/etc/subdownloader.profile +++ b/etc/profile-m-z/subdownloader.profile | |||
@@ -30,7 +30,6 @@ ipc-namespace | |||
30 | machine-id | 30 | machine-id |
31 | netfilter | 31 | netfilter |
32 | no3d | 32 | no3d |
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nogroups | 34 | nogroups |
36 | nonewprivs | 35 | nonewprivs |
@@ -48,4 +47,7 @@ private-dev | |||
48 | private-etc alternatives,fonts | 47 | private-etc alternatives,fonts |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
51 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 53 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/supertux2.profile b/etc/profile-m-z/supertux2.profile index 4c64ee766..ceaae8fbf 100644 --- a/etc/supertux2.profile +++ b/etc/profile-m-z/supertux2.profile | |||
@@ -10,18 +10,23 @@ noblacklist ${HOME}/.local/share/supertux2 | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | ||
16 | 18 | ||
17 | mkdir ${HOME}/.local/share/supertux2 | 19 | mkdir ${HOME}/.local/share/supertux2 |
18 | whitelist ${HOME}/.local/share/supertux2 | 20 | whitelist ${HOME}/.local/share/supertux2 |
21 | whitelist /usr/share/supertux2 | ||
19 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
20 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
21 | 26 | ||
27 | apparmor | ||
22 | caps.drop all | 28 | caps.drop all |
23 | net none | 29 | net none |
24 | nodbus | ||
25 | nodvd | 30 | nodvd |
26 | nogroups | 31 | nogroups |
27 | nonewprivs | 32 | nonewprivs |
@@ -32,8 +37,12 @@ novideo | |||
32 | protocol unix,netlink | 37 | protocol unix,netlink |
33 | seccomp | 38 | seccomp |
34 | shell none | 39 | shell none |
40 | tracelog | ||
35 | 41 | ||
36 | disable-mnt | 42 | disable-mnt |
37 | # private-bin supertux2 | 43 | # private-bin supertux2 |
38 | private-dev | 44 | private-dev |
39 | private-tmp | 45 | private-tmp |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/supertuxkart.profile b/etc/profile-m-z/supertuxkart.profile index 2975a61ed..ce69c8b4b 100644 --- a/etc/supertuxkart.profile +++ b/etc/profile-m-z/supertuxkart.profile | |||
@@ -13,10 +13,11 @@ noblacklist ${HOME}/.local/share/supertuxkart | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 20 | include disable-xdg.inc |
19 | include disable-interpreters.inc | ||
20 | 21 | ||
21 | mkdir ${HOME}/.config/supertuxkart | 22 | mkdir ${HOME}/.config/supertuxkart |
22 | mkdir ${HOME}/.cache/supertuxkart | 23 | mkdir ${HOME}/.cache/supertuxkart |
@@ -32,7 +33,6 @@ include whitelist-var-common.inc | |||
32 | apparmor | 33 | apparmor |
33 | caps.drop all | 34 | caps.drop all |
34 | netfilter | 35 | netfilter |
35 | nodbus | ||
36 | nodvd | 36 | nodvd |
37 | nogroups | 37 | nogroups |
38 | nonewprivs | 38 | nonewprivs |
@@ -54,3 +54,5 @@ private-tmp | |||
54 | private-opt none | 54 | private-opt none |
55 | private-srv none | 55 | private-srv none |
56 | 56 | ||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/surf.profile b/etc/profile-m-z/surf.profile index d4c6d9afc..5ad82601d 100644 --- a/etc/surf.profile +++ b/etc/profile-m-z/surf.profile | |||
@@ -34,6 +34,6 @@ tracelog | |||
34 | disable-mnt | 34 | disable-mnt |
35 | private-bin bash,curl,dmenu,ls,printf,sed,sh,sleep,st,stterm,surf,xargs,xprop | 35 | private-bin bash,curl,dmenu,ls,printf,sed,sh,sleep,st,stterm,surf,xargs,xprop |
36 | private-dev | 36 | private-dev |
37 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,passwd,pki,resolv.conf,ssl | 37 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,resolv.conf,ssl |
38 | private-tmp | 38 | private-tmp |
39 | 39 | ||
diff --git a/etc/profile-m-z/sushi.profile b/etc/profile-m-z/sushi.profile new file mode 100644 index 000000000..68abd8c94 --- /dev/null +++ b/etc/profile-m-z/sushi.profile | |||
@@ -0,0 +1,48 @@ | |||
1 | # Firejail profile for sushi | ||
2 | # Description: A quick previewer for Nautilus | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include sushi.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Allow gjs (blacklisted by disable-interpreters.inc) | ||
10 | include allow-gjs.inc | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | # include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | |||
20 | include whitelist-runuser-common.inc | ||
21 | |||
22 | apparmor | ||
23 | caps.drop all | ||
24 | net none | ||
25 | nodvd | ||
26 | nogroups | ||
27 | nonewprivs | ||
28 | noroot | ||
29 | notv | ||
30 | nou2f | ||
31 | novideo | ||
32 | protocol unix | ||
33 | seccomp | ||
34 | shell none | ||
35 | tracelog | ||
36 | |||
37 | private-bin gjs,sushi | ||
38 | private-dev | ||
39 | private-tmp | ||
40 | |||
41 | dbus-system none | ||
42 | |||
43 | read-only / | ||
44 | read-only /mnt | ||
45 | read-only /media | ||
46 | read-only /run/mount | ||
47 | read-only /run/media | ||
48 | read-only ${HOME} | ||
diff --git a/etc/profile-m-z/swell-foop.profile b/etc/profile-m-z/swell-foop.profile new file mode 100644 index 000000000..9efae815d --- /dev/null +++ b/etc/profile-m-z/swell-foop.profile | |||
@@ -0,0 +1,21 @@ | |||
1 | # Firejail profile for swell-foop | ||
2 | # Description: GNOME colored tiles puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include swell-foop.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/swell-foop | ||
10 | |||
11 | mkdir ${HOME}/.local/share/swell-foop | ||
12 | whitelist ${HOME}/.local/share/swell-foop | ||
13 | |||
14 | whitelist /usr/share/swell-foop | ||
15 | |||
16 | private-bin swell-foop | ||
17 | |||
18 | dbus-user.own org.gnome.SwellFoop | ||
19 | |||
20 | # Redirect | ||
21 | include gnome_games-common.profile | ||
diff --git a/etc/sylpheed.profile b/etc/profile-m-z/sylpheed.profile index 4344fe73a..4344fe73a 100644 --- a/etc/sylpheed.profile +++ b/etc/profile-m-z/sylpheed.profile | |||
diff --git a/etc/synfigstudio.profile b/etc/profile-m-z/synfigstudio.profile index 30b0ad762..a83080cc3 100644 --- a/etc/synfigstudio.profile +++ b/etc/profile-m-z/synfigstudio.profile | |||
@@ -18,7 +18,6 @@ include disable-programs.inc | |||
18 | 18 | ||
19 | caps.drop all | 19 | caps.drop all |
20 | net none | 20 | net none |
21 | nodbus | ||
22 | nodvd | 21 | nodvd |
23 | nogroups | 22 | nogroups |
24 | nonewprivs | 23 | nonewprivs |
@@ -36,3 +35,5 @@ private-cache | |||
36 | private-dev | 35 | private-dev |
37 | private-tmp | 36 | private-tmp |
38 | 37 | ||
38 | dbus-user none | ||
39 | dbus-system none | ||
diff --git a/etc/sysprof-cli.profile b/etc/profile-m-z/sysprof-cli.profile index 935c7e9ca..8f4de130b 100644 --- a/etc/sysprof-cli.profile +++ b/etc/profile-m-z/sysprof-cli.profile | |||
@@ -7,12 +7,13 @@ include sysprof-cli.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | nodbus | ||
11 | |||
12 | # There is no GUI help menu to break in the CLI version | 10 | # There is no GUI help menu to break in the CLI version |
13 | private-bin sysprof-cli | 11 | private-bin sysprof-cli |
14 | private-lib | 12 | private-lib |
15 | 13 | ||
14 | dbus-user none | ||
15 | dbus-system none | ||
16 | |||
16 | memory-deny-write-execute | 17 | memory-deny-write-execute |
17 | 18 | ||
18 | # Redirect | 19 | # Redirect |
diff --git a/etc/sysprof.profile b/etc/profile-m-z/sysprof.profile index 9761629d2..ad3346285 100644 --- a/etc/sysprof.profile +++ b/etc/profile-m-z/sysprof.profile | |||
@@ -23,7 +23,6 @@ ipc-namespace | |||
23 | machine-id | 23 | machine-id |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | # nodbus - makes settings immutable | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -46,4 +45,8 @@ private-etc alternatives,fonts,ld.so.cache,machine-id,ssl | |||
46 | #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so | 45 | #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
48 | # makes settings immutable | ||
49 | # dbus-user none | ||
50 | # dbus-system none | ||
51 | |||
49 | # memory-deny-write-execute - Breaks GUI on Arch | 52 | # memory-deny-write-execute - Breaks GUI on Arch |
diff --git a/etc/tar.profile b/etc/profile-m-z/tar.profile index 0858dcb26..3a7405305 100644 --- a/etc/tar.profile +++ b/etc/profile-m-z/tar.profile | |||
@@ -26,7 +26,6 @@ ipc-namespace | |||
26 | machine-id | 26 | machine-id |
27 | net none | 27 | net none |
28 | no3d | 28 | no3d |
29 | nodbus | ||
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
@@ -50,4 +49,7 @@ private-lib libfakeroot | |||
50 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) | 49 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) |
51 | writable-var | 50 | writable-var |
52 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
53 | memory-deny-write-execute | 55 | memory-deny-write-execute |
diff --git a/etc/tb-starter-wrapper.profile b/etc/profile-m-z/tb-starter-wrapper.profile index ffe9605b6..ffe9605b6 100644 --- a/etc/tb-starter-wrapper.profile +++ b/etc/profile-m-z/tb-starter-wrapper.profile | |||
diff --git a/etc/tcpdump.profile b/etc/profile-m-z/tcpdump.profile index 3c46dfdcb..881fbf49e 100644 --- a/etc/tcpdump.profile +++ b/etc/profile-m-z/tcpdump.profile | |||
@@ -19,6 +19,7 @@ include disable-xdg.inc | |||
19 | 19 | ||
20 | include whitelist-common.inc | 20 | include whitelist-common.inc |
21 | 21 | ||
22 | apparmor | ||
22 | caps.keep net_raw | 23 | caps.keep net_raw |
23 | ipc-namespace | 24 | ipc-namespace |
24 | #net tun0 | 25 | #net tun0 |
diff --git a/etc/teams-for-linux.profile b/etc/profile-m-z/teams-for-linux.profile index 882d8d0f3..a13c92bc3 100644 --- a/etc/teams-for-linux.profile +++ b/etc/profile-m-z/teams-for-linux.profile | |||
@@ -7,7 +7,8 @@ include teams-for-linux.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | ignore nodbus | 10 | ignore dbus-user none |
11 | ignore dbus-system none | ||
11 | 12 | ||
12 | noblacklist ${HOME}/.config/teams-for-linux | 13 | noblacklist ${HOME}/.config/teams-for-linux |
13 | 14 | ||
diff --git a/etc/teams.profile b/etc/profile-m-z/teams.profile index 8b60a941e..bd7faa80a 100644 --- a/etc/teams.profile +++ b/etc/profile-m-z/teams.profile | |||
@@ -1,14 +1,17 @@ | |||
1 | # Firejail profile for teams | 1 | # Firejail profile for teams |
2 | # Description: Official Microsoft Teams client for Linux using Electron. | 2 | # Description: Official Microsoft Teams client for Linux using Electron. |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Known issues: | ||
5 | # * if Teams crashes on startup try using "ignore apparmor" in your local config | ||
6 | # Persistent local customizations | 4 | # Persistent local customizations |
7 | include teams.local | 5 | include teams.local |
8 | # Persistent global definitions | 6 | # Persistent global definitions |
9 | # added by included profile | 7 | # added by included profile |
10 | #include globals.local | 8 | #include globals.local |
11 | 9 | ||
10 | # see #3404 | ||
11 | ignore apparmor | ||
12 | ignore dbus-user none | ||
13 | ignore dbus-system none | ||
14 | |||
12 | noblacklist ${HOME}/.config/teams | 15 | noblacklist ${HOME}/.config/teams |
13 | noblacklist ${HOME}/.config/Microsoft | 16 | noblacklist ${HOME}/.config/Microsoft |
14 | 17 | ||
@@ -30,7 +33,6 @@ tracelog | |||
30 | disable-mnt | 33 | disable-mnt |
31 | private-cache | 34 | private-cache |
32 | private-dev | 35 | private-dev |
33 | private-tmp | ||
34 | 36 | ||
35 | # Redirect | 37 | # Redirect |
36 | include electron.profile | 38 | include electron.profile |
diff --git a/etc/teamspeak3.profile b/etc/profile-m-z/teamspeak3.profile index c1c666f58..c1c666f58 100644 --- a/etc/teamspeak3.profile +++ b/etc/profile-m-z/teamspeak3.profile | |||
diff --git a/etc/teeworlds.profile b/etc/profile-m-z/teeworlds.profile index 782f337d3..c0d62bec2 100644 --- a/etc/teeworlds.profile +++ b/etc/profile-m-z/teeworlds.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.teeworlds | 20 | mkdir ${HOME}/.teeworlds |
@@ -24,7 +25,6 @@ include whitelist-var-common.inc | |||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | netfilter | 27 | netfilter |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -42,3 +42,6 @@ private-bin teeworlds | |||
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/telegram-desktop.profile b/etc/profile-m-z/telegram-desktop.profile index 0cfa7114b..0cfa7114b 100644 --- a/etc/telegram-desktop.profile +++ b/etc/profile-m-z/telegram-desktop.profile | |||
diff --git a/etc/telegram.profile b/etc/profile-m-z/telegram.profile index e3af5600a..8e0741458 100644 --- a/etc/telegram.profile +++ b/etc/profile-m-z/telegram.profile | |||
@@ -25,5 +25,5 @@ seccomp | |||
25 | 25 | ||
26 | disable-mnt | 26 | disable-mnt |
27 | private-cache | 27 | private-cache |
28 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl | ||
28 | private-tmp | 29 | private-tmp |
29 | |||
diff --git a/etc/terasology.profile b/etc/profile-m-z/terasology.profile index 9a8426435..36ce6d469 100644 --- a/etc/terasology.profile +++ b/etc/profile-m-z/terasology.profile | |||
@@ -28,8 +28,6 @@ include whitelist-common.inc | |||
28 | caps.drop all | 28 | caps.drop all |
29 | ipc-namespace | 29 | ipc-namespace |
30 | net none | 30 | net none |
31 | netfilter | ||
32 | nodbus | ||
33 | nodvd | 31 | nodvd |
34 | nogroups | 32 | nogroups |
35 | nonewprivs | 33 | nonewprivs |
@@ -45,3 +43,6 @@ disable-mnt | |||
45 | private-dev | 43 | private-dev |
46 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,java-7-openjdk,java-8-openjdk,ld.so.cache,ld.so.preload,localtime,lsb-release,machine-id,mime.types,passwd,pki,pulse,resolv.conf,ssl | 44 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,java-7-openjdk,java-8-openjdk,ld.so.cache,ld.so.preload,localtime,lsb-release,machine-id,mime.types,passwd,pki,pulse,resolv.conf,ssl |
47 | private-tmp | 45 | private-tmp |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/tex.profile b/etc/profile-m-z/tex.profile index f56c3038e..f56c3038e 100644 --- a/etc/tex.profile +++ b/etc/profile-m-z/tex.profile | |||
diff --git a/etc/textmaker18.profile b/etc/profile-m-z/textmaker18.profile index 8284df791..d28947394 100644 --- a/etc/textmaker18.profile +++ b/etc/profile-m-z/textmaker18.profile | |||
@@ -7,4 +7,5 @@ include textmaker18.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
11 | |||
diff --git a/etc/textmaker18free.profile b/etc/profile-m-z/textmaker18free.profile index ad945ca55..7b4fd5b08 100644 --- a/etc/textmaker18free.profile +++ b/etc/profile-m-z/textmaker18free.profile | |||
@@ -7,4 +7,5 @@ include textmaker18free.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
11 | |||
diff --git a/etc/thunar.profile b/etc/profile-m-z/thunar.profile index 19993016a..19993016a 100644 --- a/etc/thunar.profile +++ b/etc/profile-m-z/thunar.profile | |||
diff --git a/etc/thunderbird-beta.profile b/etc/profile-m-z/thunderbird-beta.profile index 6450e40d6..6450e40d6 100644 --- a/etc/thunderbird-beta.profile +++ b/etc/profile-m-z/thunderbird-beta.profile | |||
diff --git a/etc/thunderbird-wayland.profile b/etc/profile-m-z/thunderbird-wayland.profile index 9fbb80d29..9fbb80d29 100644 --- a/etc/thunderbird-wayland.profile +++ b/etc/profile-m-z/thunderbird-wayland.profile | |||
diff --git a/etc/thunderbird.profile b/etc/profile-m-z/thunderbird.profile index 6e888c163..6e4bb50d4 100644 --- a/etc/thunderbird.profile +++ b/etc/profile-m-z/thunderbird.profile | |||
@@ -7,22 +7,22 @@ include thunderbird.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # writable-run-user and dbus are needed by enigmail | 9 | # writable-run-user and dbus are needed by enigmail |
10 | ignore nodbus | 10 | ignore dbus-user none |
11 | ignore dbus-system none | ||
11 | writable-run-user | 12 | writable-run-user |
12 | 13 | ||
13 | # If you want to read local mail stored in /var/mail, add the following to thunderbird.local: | 14 | # If you want to read local mail stored in /var/mail edit /etc/apparmor.d/firejail-default accordingly |
15 | # and add the following to thunderbird.local: | ||
14 | #noblacklist /var/mail | 16 | #noblacklist /var/mail |
15 | #noblacklist /var/spool/mail | 17 | #noblacklist /var/spool/mail |
16 | #whitelist /var/mail | 18 | #whitelist /var/mail |
17 | #whitelist /var/spool/mail | 19 | #whitelist /var/spool/mail |
18 | #writable-var | 20 | #writable-var |
19 | 21 | ||
20 | # Uncomment the next 4 lines or put them in your thunderbird.local to | 22 | # These lines are needed to allow Firefox to load your profile when clicking a link in an email |
21 | # allow Firefox to load your profile when clicking a link in an email | 23 | noblacklist ${HOME}/.mozilla |
22 | #noblacklist ${HOME}/.cache/mozilla | 24 | whitelist ${HOME}/.mozilla/firefox/profiles.ini |
23 | #noblacklist ${HOME}/.mozilla | 25 | read-only ${HOME}/.mozilla/firefox/profiles.ini |
24 | #whitelist ${HOME}/.cache/mozilla/firefox | ||
25 | #whitelist ${HOME}/.mozilla | ||
26 | 26 | ||
27 | noblacklist ${HOME}/.cache/thunderbird | 27 | noblacklist ${HOME}/.cache/thunderbird |
28 | noblacklist ${HOME}/.gnupg | 28 | noblacklist ${HOME}/.gnupg |
@@ -47,6 +47,7 @@ whitelist ${HOME}/.thunderbird | |||
47 | 47 | ||
48 | whitelist /usr/share/gnupg | 48 | whitelist /usr/share/gnupg |
49 | whitelist /usr/share/mozilla | 49 | whitelist /usr/share/mozilla |
50 | whitelist /usr/share/thunderbird | ||
50 | whitelist /usr/share/webext | 51 | whitelist /usr/share/webext |
51 | include whitelist-usr-share-common.inc | 52 | include whitelist-usr-share-common.inc |
52 | 53 | ||
diff --git a/etc/tilp.profile b/etc/profile-m-z/tilp.profile index 4d38d5184..dd4a372c4 100644 --- a/etc/tilp.profile +++ b/etc/profile-m-z/tilp.profile | |||
@@ -13,6 +13,7 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | 17 | ||
17 | caps.drop all | 18 | caps.drop all |
18 | net none | 19 | net none |
diff --git a/etc/tor-browser-ar.profile b/etc/profile-m-z/tor-browser-ar.profile index 612b2d01b..612b2d01b 100644 --- a/etc/tor-browser-ar.profile +++ b/etc/profile-m-z/tor-browser-ar.profile | |||
diff --git a/etc/tor-browser-ca.profile b/etc/profile-m-z/tor-browser-ca.profile index db70a7109..db70a7109 100644 --- a/etc/tor-browser-ca.profile +++ b/etc/profile-m-z/tor-browser-ca.profile | |||
diff --git a/etc/tor-browser-cs.profile b/etc/profile-m-z/tor-browser-cs.profile index 77b271b68..77b271b68 100644 --- a/etc/tor-browser-cs.profile +++ b/etc/profile-m-z/tor-browser-cs.profile | |||
diff --git a/etc/tor-browser-da.profile b/etc/profile-m-z/tor-browser-da.profile index 3b9fff9a4..3b9fff9a4 100644 --- a/etc/tor-browser-da.profile +++ b/etc/profile-m-z/tor-browser-da.profile | |||
diff --git a/etc/tor-browser-de.profile b/etc/profile-m-z/tor-browser-de.profile index 3b4f7f94f..3b4f7f94f 100644 --- a/etc/tor-browser-de.profile +++ b/etc/profile-m-z/tor-browser-de.profile | |||
diff --git a/etc/tor-browser-el.profile b/etc/profile-m-z/tor-browser-el.profile index b978b6042..b978b6042 100644 --- a/etc/tor-browser-el.profile +++ b/etc/profile-m-z/tor-browser-el.profile | |||
diff --git a/etc/tor-browser-en-us.profile b/etc/profile-m-z/tor-browser-en-us.profile index db56dda1b..db56dda1b 100644 --- a/etc/tor-browser-en-us.profile +++ b/etc/profile-m-z/tor-browser-en-us.profile | |||
diff --git a/etc/tor-browser-en.profile b/etc/profile-m-z/tor-browser-en.profile index ad4110c0e..ad4110c0e 100644 --- a/etc/tor-browser-en.profile +++ b/etc/profile-m-z/tor-browser-en.profile | |||
diff --git a/etc/tor-browser-es-es.profile b/etc/profile-m-z/tor-browser-es-es.profile index 1aa586658..1aa586658 100644 --- a/etc/tor-browser-es-es.profile +++ b/etc/profile-m-z/tor-browser-es-es.profile | |||
diff --git a/etc/tor-browser-es.profile b/etc/profile-m-z/tor-browser-es.profile index a386e3387..a386e3387 100644 --- a/etc/tor-browser-es.profile +++ b/etc/profile-m-z/tor-browser-es.profile | |||
diff --git a/etc/tor-browser-fa.profile b/etc/profile-m-z/tor-browser-fa.profile index 7f847a7c2..7f847a7c2 100644 --- a/etc/tor-browser-fa.profile +++ b/etc/profile-m-z/tor-browser-fa.profile | |||
diff --git a/etc/tor-browser-fr.profile b/etc/profile-m-z/tor-browser-fr.profile index bce470ec8..bce470ec8 100644 --- a/etc/tor-browser-fr.profile +++ b/etc/profile-m-z/tor-browser-fr.profile | |||
diff --git a/etc/tor-browser-ga-ie.profile b/etc/profile-m-z/tor-browser-ga-ie.profile index 994897a87..994897a87 100644 --- a/etc/tor-browser-ga-ie.profile +++ b/etc/profile-m-z/tor-browser-ga-ie.profile | |||
diff --git a/etc/tor-browser-he.profile b/etc/profile-m-z/tor-browser-he.profile index 6367b4c0a..6367b4c0a 100644 --- a/etc/tor-browser-he.profile +++ b/etc/profile-m-z/tor-browser-he.profile | |||
diff --git a/etc/tor-browser-hu.profile b/etc/profile-m-z/tor-browser-hu.profile index 68e79833e..68e79833e 100644 --- a/etc/tor-browser-hu.profile +++ b/etc/profile-m-z/tor-browser-hu.profile | |||
diff --git a/etc/tor-browser-id.profile b/etc/profile-m-z/tor-browser-id.profile index 85b455ba2..85b455ba2 100644 --- a/etc/tor-browser-id.profile +++ b/etc/profile-m-z/tor-browser-id.profile | |||
diff --git a/etc/tor-browser-is.profile b/etc/profile-m-z/tor-browser-is.profile index 48e88db71..48e88db71 100644 --- a/etc/tor-browser-is.profile +++ b/etc/profile-m-z/tor-browser-is.profile | |||
diff --git a/etc/tor-browser-it.profile b/etc/profile-m-z/tor-browser-it.profile index 3c239ca29..3c239ca29 100644 --- a/etc/tor-browser-it.profile +++ b/etc/profile-m-z/tor-browser-it.profile | |||
diff --git a/etc/tor-browser-ja.profile b/etc/profile-m-z/tor-browser-ja.profile index c52e0f64e..c52e0f64e 100644 --- a/etc/tor-browser-ja.profile +++ b/etc/profile-m-z/tor-browser-ja.profile | |||
diff --git a/etc/tor-browser-ka.profile b/etc/profile-m-z/tor-browser-ka.profile index 173b85e5c..173b85e5c 100644 --- a/etc/tor-browser-ka.profile +++ b/etc/profile-m-z/tor-browser-ka.profile | |||
diff --git a/etc/tor-browser-ko.profile b/etc/profile-m-z/tor-browser-ko.profile index 8faa5afa1..8faa5afa1 100644 --- a/etc/tor-browser-ko.profile +++ b/etc/profile-m-z/tor-browser-ko.profile | |||
diff --git a/etc/tor-browser-nb.profile b/etc/profile-m-z/tor-browser-nb.profile index d1352dd80..d1352dd80 100644 --- a/etc/tor-browser-nb.profile +++ b/etc/profile-m-z/tor-browser-nb.profile | |||
diff --git a/etc/tor-browser-nl.profile b/etc/profile-m-z/tor-browser-nl.profile index d4443cca2..d4443cca2 100644 --- a/etc/tor-browser-nl.profile +++ b/etc/profile-m-z/tor-browser-nl.profile | |||
diff --git a/etc/tor-browser-pl.profile b/etc/profile-m-z/tor-browser-pl.profile index 08ddd4ae7..08ddd4ae7 100644 --- a/etc/tor-browser-pl.profile +++ b/etc/profile-m-z/tor-browser-pl.profile | |||
diff --git a/etc/tor-browser-pt-br.profile b/etc/profile-m-z/tor-browser-pt-br.profile index 9942a3fe8..9942a3fe8 100644 --- a/etc/tor-browser-pt-br.profile +++ b/etc/profile-m-z/tor-browser-pt-br.profile | |||
diff --git a/etc/tor-browser-ru.profile b/etc/profile-m-z/tor-browser-ru.profile index 6294f8ca0..6294f8ca0 100644 --- a/etc/tor-browser-ru.profile +++ b/etc/profile-m-z/tor-browser-ru.profile | |||
diff --git a/etc/tor-browser-sv-se.profile b/etc/profile-m-z/tor-browser-sv-se.profile index c8544262f..c8544262f 100644 --- a/etc/tor-browser-sv-se.profile +++ b/etc/profile-m-z/tor-browser-sv-se.profile | |||
diff --git a/etc/tor-browser-tr.profile b/etc/profile-m-z/tor-browser-tr.profile index 2343fa8de..2343fa8de 100644 --- a/etc/tor-browser-tr.profile +++ b/etc/profile-m-z/tor-browser-tr.profile | |||
diff --git a/etc/tor-browser-vi.profile b/etc/profile-m-z/tor-browser-vi.profile index 734c38698..734c38698 100644 --- a/etc/tor-browser-vi.profile +++ b/etc/profile-m-z/tor-browser-vi.profile | |||
diff --git a/etc/tor-browser-zh-cn.profile b/etc/profile-m-z/tor-browser-zh-cn.profile index 21e813e45..21e813e45 100644 --- a/etc/tor-browser-zh-cn.profile +++ b/etc/profile-m-z/tor-browser-zh-cn.profile | |||
diff --git a/etc/tor-browser-zh-tw.profile b/etc/profile-m-z/tor-browser-zh-tw.profile index 6fe09c6c1..6fe09c6c1 100644 --- a/etc/tor-browser-zh-tw.profile +++ b/etc/profile-m-z/tor-browser-zh-tw.profile | |||
diff --git a/etc/tor-browser.profile b/etc/profile-m-z/tor-browser.profile index 0cd84abf5..0cd84abf5 100644 --- a/etc/tor-browser.profile +++ b/etc/profile-m-z/tor-browser.profile | |||
diff --git a/etc/tor-browser_ar.profile b/etc/profile-m-z/tor-browser_ar.profile index 1e1f5ce35..1e1f5ce35 100644 --- a/etc/tor-browser_ar.profile +++ b/etc/profile-m-z/tor-browser_ar.profile | |||
diff --git a/etc/tor-browser_ca.profile b/etc/profile-m-z/tor-browser_ca.profile index e114b6051..e114b6051 100644 --- a/etc/tor-browser_ca.profile +++ b/etc/profile-m-z/tor-browser_ca.profile | |||
diff --git a/etc/tor-browser_cs.profile b/etc/profile-m-z/tor-browser_cs.profile index 498068bc6..498068bc6 100644 --- a/etc/tor-browser_cs.profile +++ b/etc/profile-m-z/tor-browser_cs.profile | |||
diff --git a/etc/tor-browser_da.profile b/etc/profile-m-z/tor-browser_da.profile index 5c25c03c8..5c25c03c8 100644 --- a/etc/tor-browser_da.profile +++ b/etc/profile-m-z/tor-browser_da.profile | |||
diff --git a/etc/tor-browser_de.profile b/etc/profile-m-z/tor-browser_de.profile index d530e7dbe..d530e7dbe 100644 --- a/etc/tor-browser_de.profile +++ b/etc/profile-m-z/tor-browser_de.profile | |||
diff --git a/etc/tor-browser_el.profile b/etc/profile-m-z/tor-browser_el.profile index 67d5ab440..67d5ab440 100644 --- a/etc/tor-browser_el.profile +++ b/etc/profile-m-z/tor-browser_el.profile | |||
diff --git a/etc/tor-browser_en-US.profile b/etc/profile-m-z/tor-browser_en-US.profile index b298ab2b8..b298ab2b8 100644 --- a/etc/tor-browser_en-US.profile +++ b/etc/profile-m-z/tor-browser_en-US.profile | |||
diff --git a/etc/tor-browser_en.profile b/etc/profile-m-z/tor-browser_en.profile index 6bb0616b1..6bb0616b1 100644 --- a/etc/tor-browser_en.profile +++ b/etc/profile-m-z/tor-browser_en.profile | |||
diff --git a/etc/tor-browser_es-ES.profile b/etc/profile-m-z/tor-browser_es-ES.profile index 78f57ffe5..78f57ffe5 100644 --- a/etc/tor-browser_es-ES.profile +++ b/etc/profile-m-z/tor-browser_es-ES.profile | |||
diff --git a/etc/tor-browser_es.profile b/etc/profile-m-z/tor-browser_es.profile index ea34a07c9..ea34a07c9 100644 --- a/etc/tor-browser_es.profile +++ b/etc/profile-m-z/tor-browser_es.profile | |||
diff --git a/etc/tor-browser_fa.profile b/etc/profile-m-z/tor-browser_fa.profile index fbc416ce5..fbc416ce5 100644 --- a/etc/tor-browser_fa.profile +++ b/etc/profile-m-z/tor-browser_fa.profile | |||
diff --git a/etc/tor-browser_fr.profile b/etc/profile-m-z/tor-browser_fr.profile index caea6db5b..caea6db5b 100644 --- a/etc/tor-browser_fr.profile +++ b/etc/profile-m-z/tor-browser_fr.profile | |||
diff --git a/etc/tor-browser_ga-IE.profile b/etc/profile-m-z/tor-browser_ga-IE.profile index 6342daebf..6342daebf 100644 --- a/etc/tor-browser_ga-IE.profile +++ b/etc/profile-m-z/tor-browser_ga-IE.profile | |||
diff --git a/etc/tor-browser_he.profile b/etc/profile-m-z/tor-browser_he.profile index cc4150620..cc4150620 100644 --- a/etc/tor-browser_he.profile +++ b/etc/profile-m-z/tor-browser_he.profile | |||
diff --git a/etc/tor-browser_hu.profile b/etc/profile-m-z/tor-browser_hu.profile index 952a0b68a..952a0b68a 100644 --- a/etc/tor-browser_hu.profile +++ b/etc/profile-m-z/tor-browser_hu.profile | |||
diff --git a/etc/tor-browser_id.profile b/etc/profile-m-z/tor-browser_id.profile index a006b27c0..a006b27c0 100644 --- a/etc/tor-browser_id.profile +++ b/etc/profile-m-z/tor-browser_id.profile | |||
diff --git a/etc/tor-browser_is.profile b/etc/profile-m-z/tor-browser_is.profile index 038e0fabb..038e0fabb 100644 --- a/etc/tor-browser_is.profile +++ b/etc/profile-m-z/tor-browser_is.profile | |||
diff --git a/etc/tor-browser_it.profile b/etc/profile-m-z/tor-browser_it.profile index 3d2566994..3d2566994 100644 --- a/etc/tor-browser_it.profile +++ b/etc/profile-m-z/tor-browser_it.profile | |||
diff --git a/etc/tor-browser_ja.profile b/etc/profile-m-z/tor-browser_ja.profile index 08c942bcd..08c942bcd 100644 --- a/etc/tor-browser_ja.profile +++ b/etc/profile-m-z/tor-browser_ja.profile | |||
diff --git a/etc/tor-browser_ka.profile b/etc/profile-m-z/tor-browser_ka.profile index 97664be4d..97664be4d 100644 --- a/etc/tor-browser_ka.profile +++ b/etc/profile-m-z/tor-browser_ka.profile | |||
diff --git a/etc/tor-browser_ko.profile b/etc/profile-m-z/tor-browser_ko.profile index 98cf1e3e1..98cf1e3e1 100644 --- a/etc/tor-browser_ko.profile +++ b/etc/profile-m-z/tor-browser_ko.profile | |||
diff --git a/etc/tor-browser_nb.profile b/etc/profile-m-z/tor-browser_nb.profile index 6df840573..6df840573 100644 --- a/etc/tor-browser_nb.profile +++ b/etc/profile-m-z/tor-browser_nb.profile | |||
diff --git a/etc/tor-browser_nl.profile b/etc/profile-m-z/tor-browser_nl.profile index 3f545f888..3f545f888 100644 --- a/etc/tor-browser_nl.profile +++ b/etc/profile-m-z/tor-browser_nl.profile | |||
diff --git a/etc/tor-browser_pl.profile b/etc/profile-m-z/tor-browser_pl.profile index 4e04dc027..4e04dc027 100644 --- a/etc/tor-browser_pl.profile +++ b/etc/profile-m-z/tor-browser_pl.profile | |||
diff --git a/etc/tor-browser_pt-BR.profile b/etc/profile-m-z/tor-browser_pt-BR.profile index 7f864886c..7f864886c 100644 --- a/etc/tor-browser_pt-BR.profile +++ b/etc/profile-m-z/tor-browser_pt-BR.profile | |||
diff --git a/etc/tor-browser_ru.profile b/etc/profile-m-z/tor-browser_ru.profile index 2fae6fbe7..2fae6fbe7 100644 --- a/etc/tor-browser_ru.profile +++ b/etc/profile-m-z/tor-browser_ru.profile | |||
diff --git a/etc/tor-browser_sv-SE.profile b/etc/profile-m-z/tor-browser_sv-SE.profile index 2157f8d2b..2157f8d2b 100644 --- a/etc/tor-browser_sv-SE.profile +++ b/etc/profile-m-z/tor-browser_sv-SE.profile | |||
diff --git a/etc/tor-browser_tr.profile b/etc/profile-m-z/tor-browser_tr.profile index 20ac246ca..20ac246ca 100644 --- a/etc/tor-browser_tr.profile +++ b/etc/profile-m-z/tor-browser_tr.profile | |||
diff --git a/etc/tor-browser_vi.profile b/etc/profile-m-z/tor-browser_vi.profile index 4faa06ff6..4faa06ff6 100644 --- a/etc/tor-browser_vi.profile +++ b/etc/profile-m-z/tor-browser_vi.profile | |||
diff --git a/etc/tor-browser_zh-CN.profile b/etc/profile-m-z/tor-browser_zh-CN.profile index e4d8215e6..e4d8215e6 100644 --- a/etc/tor-browser_zh-CN.profile +++ b/etc/profile-m-z/tor-browser_zh-CN.profile | |||
diff --git a/etc/tor-browser_zh-TW.profile b/etc/profile-m-z/tor-browser_zh-TW.profile index 8a28015a6..8a28015a6 100644 --- a/etc/tor-browser_zh-TW.profile +++ b/etc/profile-m-z/tor-browser_zh-TW.profile | |||
diff --git a/etc/tor.profile b/etc/profile-m-z/tor.profile index 13d071635..13d071635 100644 --- a/etc/tor.profile +++ b/etc/profile-m-z/tor.profile | |||
diff --git a/etc/torbrowser-launcher.profile b/etc/profile-m-z/torbrowser-launcher.profile index 72bdf9fa1..6bcc51f4d 100644 --- a/etc/torbrowser-launcher.profile +++ b/etc/profile-m-z/torbrowser-launcher.profile | |||
@@ -12,8 +12,8 @@ noblacklist ${HOME}/.config/torbrowser | |||
12 | noblacklist ${HOME}/.local/share/torbrowser | 12 | noblacklist ${HOME}/.local/share/torbrowser |
13 | 13 | ||
14 | # Allow python (blacklisted by disable-interpreters.inc) | 14 | # Allow python (blacklisted by disable-interpreters.inc) |
15 | include allow-python2.inc | 15 | include allow-python2.inc |
16 | include allow-python3.inc | 16 | include allow-python3.inc |
17 | 17 | ||
18 | include disable-common.inc | 18 | include disable-common.inc |
19 | include disable-devel.inc | 19 | include disable-devel.inc |
@@ -33,7 +33,6 @@ include whitelist-var-common.inc | |||
33 | 33 | ||
34 | caps.drop all | 34 | caps.drop all |
35 | netfilter | 35 | netfilter |
36 | nodbus | ||
37 | nodvd | 36 | nodvd |
38 | nogroups | 37 | nogroups |
39 | nonewprivs | 38 | nonewprivs |
@@ -52,3 +51,6 @@ private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog, | |||
52 | private-dev | 51 | private-dev |
53 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl | 52 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
54 | private-tmp | 53 | private-tmp |
54 | |||
55 | dbus-user none | ||
56 | dbus-system none | ||
diff --git a/etc/torcs.profile b/etc/profile-m-z/torcs.profile index d9c59b276..1ed78934e 100644 --- a/etc/torcs.profile +++ b/etc/profile-m-z/torcs.profile | |||
@@ -18,13 +18,15 @@ include disable-xdg.inc | |||
18 | 18 | ||
19 | mkdir ${HOME}/.torcs | 19 | mkdir ${HOME}/.torcs |
20 | whitelist ${HOME}/.torcs | 20 | whitelist ${HOME}/.torcs |
21 | whitelist /usr/share/games/torcs | ||
22 | whitelist /var/games/torcs | ||
21 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
23 | 26 | ||
24 | caps.drop all | 27 | caps.drop all |
25 | ipc-namespace | 28 | ipc-namespace |
26 | net none | 29 | net none |
27 | nodbus | ||
28 | nodvd | 30 | nodvd |
29 | nogroups | 31 | nogroups |
30 | nonewprivs | 32 | nonewprivs |
@@ -38,6 +40,10 @@ shell none | |||
38 | tracelog | 40 | tracelog |
39 | 41 | ||
40 | disable-mnt | 42 | disable-mnt |
43 | private-bin bash,chmod,cp,mkdir,rm,torcs | ||
41 | private-cache | 44 | private-cache |
42 | private-dev | 45 | private-dev |
43 | private-tmp | 46 | private-tmp |
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/totem.profile b/etc/profile-m-z/totem.profile index 5b74709e3..b8f4ca765 100644 --- a/etc/totem.profile +++ b/etc/profile-m-z/totem.profile | |||
@@ -9,9 +9,13 @@ include globals.local | |||
9 | # Allow lua (required for youtube video) | 9 | # Allow lua (required for youtube video) |
10 | include allow-lua.inc | 10 | include allow-lua.inc |
11 | 11 | ||
12 | # Allow python (blacklisted by disable-interpreters.inc) | ||
13 | include allow-python3.inc | ||
14 | |||
12 | noblacklist ${HOME}/.config/totem | 15 | noblacklist ${HOME}/.config/totem |
13 | noblacklist ${HOME}/.local/share/totem | 16 | noblacklist ${HOME}/.local/share/totem |
14 | noblacklist ${MUSIC} | 17 | noblacklist ${MUSIC} |
18 | noblacklist ${PICTURES} | ||
15 | noblacklist ${VIDEOS} | 19 | noblacklist ${VIDEOS} |
16 | 20 | ||
17 | include disable-common.inc | 21 | include disable-common.inc |
@@ -20,6 +24,7 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 25 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 26 | include disable-programs.inc |
27 | include disable-shell.inc | ||
23 | include disable-xdg.inc | 28 | include disable-xdg.inc |
24 | 29 | ||
25 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
@@ -27,7 +32,6 @@ include whitelist-var-common.inc | |||
27 | # apparmor - makes settings immutable | 32 | # apparmor - makes settings immutable |
28 | caps.drop all | 33 | caps.drop all |
29 | netfilter | 34 | netfilter |
30 | # nodbus - makes settings immutable | ||
31 | nogroups | 35 | nogroups |
32 | nonewprivs | 36 | nonewprivs |
33 | noroot | 37 | noroot |
@@ -35,6 +39,7 @@ nou2f | |||
35 | protocol unix,inet,inet6 | 39 | protocol unix,inet,inet6 |
36 | seccomp | 40 | seccomp |
37 | shell none | 41 | shell none |
42 | tracelog | ||
38 | 43 | ||
39 | private-bin totem | 44 | private-bin totem |
40 | # totem needs access to ~/.cache/tracker or it exits | 45 | # totem needs access to ~/.cache/tracker or it exits |
@@ -43,3 +48,6 @@ private-dev | |||
43 | # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl | 48 | # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl |
44 | private-tmp | 49 | private-tmp |
45 | 50 | ||
51 | # makes settings immutable | ||
52 | # dbus-user none | ||
53 | # dbus-system none | ||
diff --git a/etc/tracker.profile b/etc/profile-m-z/tracker.profile index d47185b1d..87c5de076 100644 --- a/etc/tracker.profile +++ b/etc/profile-m-z/tracker.profile | |||
@@ -16,6 +16,9 @@ include disable-devel.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
20 | |||
21 | include whitelist-runuser-common.inc | ||
19 | 22 | ||
20 | caps.drop all | 23 | caps.drop all |
21 | netfilter | 24 | netfilter |
diff --git a/etc/transgui.profile b/etc/profile-m-z/transgui.profile index 567e2ab30..c31055cdc 100644 --- a/etc/transgui.profile +++ b/etc/profile-m-z/transgui.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.config/transgui | 20 | mkdir ${HOME}/.config/transgui |
@@ -28,7 +29,6 @@ caps.drop all | |||
28 | ipc-namespace | 29 | ipc-namespace |
29 | machine-id | 30 | machine-id |
30 | netfilter | 31 | netfilter |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -49,4 +49,7 @@ private-etc alternatives,fonts | |||
49 | private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.* | 49 | private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.* |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
52 | memory-deny-write-execute | 55 | memory-deny-write-execute |
diff --git a/etc/transmission-cli.profile b/etc/profile-m-z/transmission-cli.profile index 486be5fe6..486be5fe6 100644 --- a/etc/transmission-cli.profile +++ b/etc/profile-m-z/transmission-cli.profile | |||
diff --git a/etc/transmission-common.profile b/etc/profile-m-z/transmission-common.profile index b9f49c4a4..9d2e8e990 100644 --- a/etc/transmission-common.profile +++ b/etc/profile-m-z/transmission-common.profile | |||
@@ -30,7 +30,6 @@ apparmor | |||
30 | caps.drop all | 30 | caps.drop all |
31 | machine-id | 31 | machine-id |
32 | netfilter | 32 | netfilter |
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nonewprivs | 34 | nonewprivs |
36 | noroot | 35 | noroot |
@@ -48,4 +47,7 @@ private-dev | |||
48 | private-lib | 47 | private-lib |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
51 | memory-deny-write-execute | 53 | memory-deny-write-execute |
diff --git a/etc/transmission-create.profile b/etc/profile-m-z/transmission-create.profile index 8220b7887..8220b7887 100644 --- a/etc/transmission-create.profile +++ b/etc/profile-m-z/transmission-create.profile | |||
diff --git a/etc/transmission-daemon.profile b/etc/profile-m-z/transmission-daemon.profile index 1841b8ed0..363c685e0 100644 --- a/etc/transmission-daemon.profile +++ b/etc/profile-m-z/transmission-daemon.profile | |||
@@ -7,6 +7,8 @@ include transmission-daemon.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | ignore caps.drop all | ||
11 | |||
10 | mkdir ${HOME}/.config/transmission-daemon | 12 | mkdir ${HOME}/.config/transmission-daemon |
11 | whitelist ${HOME}/.config/transmission-daemon | 13 | whitelist ${HOME}/.config/transmission-daemon |
12 | whitelist /var/lib/transmission | 14 | whitelist /var/lib/transmission |
diff --git a/etc/transmission-edit.profile b/etc/profile-m-z/transmission-edit.profile index df381b5cd..df381b5cd 100644 --- a/etc/transmission-edit.profile +++ b/etc/profile-m-z/transmission-edit.profile | |||
diff --git a/etc/transmission-gtk.profile b/etc/profile-m-z/transmission-gtk.profile index 01bdeb4ef..03111ec56 100644 --- a/etc/transmission-gtk.profile +++ b/etc/profile-m-z/transmission-gtk.profile | |||
@@ -7,7 +7,10 @@ include transmission-gtk.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | include whitelist-runuser-common.inc | ||
11 | |||
10 | private-bin transmission-gtk | 12 | private-bin transmission-gtk |
13 | private-cache | ||
11 | 14 | ||
12 | ignore memory-deny-write-execute | 15 | ignore memory-deny-write-execute |
13 | 16 | ||
diff --git a/etc/transmission-qt.profile b/etc/profile-m-z/transmission-qt.profile index 94f3c3a20..94f3c3a20 100644 --- a/etc/transmission-qt.profile +++ b/etc/profile-m-z/transmission-qt.profile | |||
diff --git a/etc/transmission-remote-cli.profile b/etc/profile-m-z/transmission-remote-cli.profile index 8b3a966c1..7b9285e66 100644 --- a/etc/transmission-remote-cli.profile +++ b/etc/profile-m-z/transmission-remote-cli.profile | |||
@@ -8,8 +8,8 @@ include transmission-remote-cli.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | # Allow python (blacklisted by disable-interpreters.inc) | 10 | # Allow python (blacklisted by disable-interpreters.inc) |
11 | include allow-python2.inc | 11 | include allow-python2.inc |
12 | include allow-python3.inc | 12 | include allow-python3.inc |
13 | 13 | ||
14 | private-bin python*,transmission-remote-cli | 14 | private-bin python*,transmission-remote-cli |
15 | 15 | ||
diff --git a/etc/transmission-remote-gtk.profile b/etc/profile-m-z/transmission-remote-gtk.profile index a6400e2c0..a6400e2c0 100644 --- a/etc/transmission-remote-gtk.profile +++ b/etc/profile-m-z/transmission-remote-gtk.profile | |||
diff --git a/etc/transmission-remote.profile b/etc/profile-m-z/transmission-remote.profile index fee4999e6..fee4999e6 100644 --- a/etc/transmission-remote.profile +++ b/etc/profile-m-z/transmission-remote.profile | |||
diff --git a/etc/transmission-show.profile b/etc/profile-m-z/transmission-show.profile index 5a3c83f58..5a3c83f58 100644 --- a/etc/transmission-show.profile +++ b/etc/profile-m-z/transmission-show.profile | |||
diff --git a/etc/tremulous.profile b/etc/profile-m-z/tremulous.profile index e148298ae..67463a999 100644 --- a/etc/tremulous.profile +++ b/etc/profile-m-z/tremulous.profile | |||
@@ -14,17 +14,20 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.tremulous | 20 | mkdir ${HOME}/.tremulous |
20 | whitelist ${HOME}/.tremulous | 21 | whitelist ${HOME}/.tremulous |
22 | whitelist /usr/share/tremulous | ||
21 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
23 | 27 | ||
24 | caps.drop all | 28 | caps.drop all |
25 | ipc-namespace | 29 | ipc-namespace |
26 | netfilter | 30 | netfilter |
27 | nodbus | ||
28 | nodvd | 31 | nodvd |
29 | nogroups | 32 | nogroups |
30 | nonewprivs | 33 | nonewprivs |
@@ -42,3 +45,6 @@ private-bin tremded,tremulous,tremulous-wrapper | |||
42 | private-cache | 45 | private-cache |
43 | private-dev | 46 | private-dev |
44 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/truecraft.profile b/etc/profile-m-z/truecraft.profile index e76d52219..e76d52219 100644 --- a/etc/truecraft.profile +++ b/etc/profile-m-z/truecraft.profile | |||
diff --git a/etc/profile-m-z/ts3client_runscript.sh.profile b/etc/profile-m-z/ts3client_runscript.sh.profile new file mode 100644 index 000000000..8d4675454 --- /dev/null +++ b/etc/profile-m-z/ts3client_runscript.sh.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile alias for teamspeak3 | ||
2 | # Description: TeamSpeak is software for quality voice communication via the Internet | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ts3client_runscript.sh.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | ignore noexec ${HOME} | ||
11 | |||
12 | noblacklist ${HOME}/TeamSpeak3-Client-linux_x86 | ||
13 | noblacklist ${HOME}/TeamSpeak3-Client-linux_amd64 | ||
14 | |||
15 | whitelist ${HOME}/TeamSpeak3-Client-linux_x86 | ||
16 | whitelist ${HOME}/TeamSpeak3-Client-linux_amd64 | ||
17 | |||
18 | # Redirect | ||
19 | include teamspeak3.profile | ||
diff --git a/etc/tshark.profile b/etc/profile-m-z/tshark.profile index 22ced5d8a..684a9491d 100644 --- a/etc/tshark.profile +++ b/etc/profile-m-z/tshark.profile | |||
@@ -16,9 +16,11 @@ include disable-xdg.inc | |||
16 | 16 | ||
17 | whitelist /usr/share/wireshark | 17 | whitelist /usr/share/wireshark |
18 | include whitelist-common.inc | 18 | include whitelist-common.inc |
19 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
23 | apparmor | ||
22 | #caps.keep net_raw | 24 | #caps.keep net_raw |
23 | caps.keep dac_override,net_admin,net_raw | 25 | caps.keep dac_override,net_admin,net_raw |
24 | ipc-namespace | 26 | ipc-namespace |
diff --git a/etc/tuxguitar.profile b/etc/profile-m-z/tuxguitar.profile index ae868a022..d2b13d9ee 100644 --- a/etc/tuxguitar.profile +++ b/etc/profile-m-z/tuxguitar.profile | |||
@@ -15,6 +15,7 @@ include allow-java.inc | |||
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 21 | include disable-programs.inc |
@@ -22,6 +23,7 @@ include disable-xdg.inc | |||
22 | 23 | ||
23 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
24 | 25 | ||
26 | apparmor | ||
25 | caps.drop all | 27 | caps.drop all |
26 | netfilter | 28 | netfilter |
27 | no3d | 29 | no3d |
diff --git a/etc/tvbrowser.profile b/etc/profile-m-z/tvbrowser.profile index 6e028b086..d3dcbfe53 100644 --- a/etc/tvbrowser.profile +++ b/etc/profile-m-z/tvbrowser.profile | |||
@@ -32,7 +32,6 @@ include whitelist-var-common.inc | |||
32 | caps.drop all | 32 | caps.drop all |
33 | netfilter | 33 | netfilter |
34 | no3d | 34 | no3d |
35 | nodbus | ||
36 | nodvd | 35 | nodvd |
37 | nogroups | 36 | nogroups |
38 | nonewprivs | 37 | nonewprivs |
@@ -49,3 +48,6 @@ disable-mnt | |||
49 | private-cache | 48 | private-cache |
50 | private-dev | 49 | private-dev |
51 | private-tmp | 50 | private-tmp |
51 | |||
52 | dbus-user none | ||
53 | dbus-system none | ||
diff --git a/etc/udiskie.profile b/etc/profile-m-z/udiskie.profile index 265f6429d..265f6429d 100644 --- a/etc/udiskie.profile +++ b/etc/profile-m-z/udiskie.profile | |||
diff --git a/etc/uefitool.profile b/etc/profile-m-z/uefitool.profile index 8ab0e9a26..8807b0b2c 100644 --- a/etc/uefitool.profile +++ b/etc/profile-m-z/uefitool.profile | |||
@@ -19,7 +19,6 @@ caps.drop all | |||
19 | ipc-namespace | 19 | ipc-namespace |
20 | net none | 20 | net none |
21 | no3d | 21 | no3d |
22 | nodbus | ||
23 | nodvd | 22 | nodvd |
24 | nogroups | 23 | nogroups |
25 | nonewprivs | 24 | nonewprivs |
@@ -36,3 +35,5 @@ private-cache | |||
36 | private-dev | 35 | private-dev |
37 | private-tmp | 36 | private-tmp |
38 | 37 | ||
38 | dbus-user none | ||
39 | dbus-system none | ||
diff --git a/etc/uget-gtk.profile b/etc/profile-m-z/uget-gtk.profile index 8a2e83a1a..c8f28444f 100644 --- a/etc/uget-gtk.profile +++ b/etc/profile-m-z/uget-gtk.profile | |||
@@ -11,6 +11,7 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-programs.inc | 13 | include disable-programs.inc |
14 | include disable-shell.inc | ||
14 | 15 | ||
15 | mkdir ${HOME}/.config/uGet | 16 | mkdir ${HOME}/.config/uGet |
16 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
diff --git a/etc/unbound.profile b/etc/profile-m-z/unbound.profile index 36533a762..714a3f2f4 100644 --- a/etc/unbound.profile +++ b/etc/profile-m-z/unbound.profile | |||
@@ -30,7 +30,6 @@ ipc-namespace | |||
30 | machine-id | 30 | machine-id |
31 | netfilter | 31 | netfilter |
32 | no3d | 32 | no3d |
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nonewprivs | 34 | nonewprivs |
36 | nosound | 35 | nosound |
@@ -46,5 +45,8 @@ private-dev | |||
46 | private-tmp | 45 | private-tmp |
47 | writable-var | 46 | writable-var |
48 | 47 | ||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
49 | # mdwe can break modules/plugins | 51 | # mdwe can break modules/plugins |
50 | memory-deny-write-execute | 52 | memory-deny-write-execute |
diff --git a/etc/uncompress.profile b/etc/profile-m-z/uncompress.profile index f659d8e87..f659d8e87 100644 --- a/etc/uncompress.profile +++ b/etc/profile-m-z/uncompress.profile | |||
diff --git a/etc/unf.profile b/etc/profile-m-z/unf.profile index b8eccf4dc..bcd256ba3 100644 --- a/etc/unf.profile +++ b/etc/profile-m-z/unf.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | whitelist ${DOWNLOADS} | 21 | whitelist ${DOWNLOADS} |
@@ -29,7 +30,6 @@ ipc-namespace | |||
29 | machine-id | 30 | machine-id |
30 | net none | 31 | net none |
31 | no3d | 32 | no3d |
32 | nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -53,4 +53,7 @@ private-etc alternatives | |||
53 | private-lib gcc/*/*/libgcc_s.so.* | 53 | private-lib gcc/*/*/libgcc_s.so.* |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
56 | dbus-user none | ||
57 | dbus-system none | ||
58 | |||
56 | memory-deny-write-execute | 59 | memory-deny-write-execute |
diff --git a/etc/unknown-horizons.profile b/etc/profile-m-z/unknown-horizons.profile index 7223ea2e1..7dc13e284 100644 --- a/etc/unknown-horizons.profile +++ b/etc/profile-m-z/unknown-horizons.profile | |||
@@ -9,13 +9,19 @@ include globals.local | |||
9 | noblacklist ${HOME}/.unknown-horizons | 9 | noblacklist ${HOME}/.unknown-horizons |
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-exec.inc | ||
12 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
13 | include disable-programs.inc | 14 | include disable-programs.inc |
14 | 15 | ||
15 | mkdir ${HOME}/.unknown-horizons | 16 | mkdir ${HOME}/.unknown-horizons |
16 | whitelist ${HOME}/.unknown-horizons | 17 | whitelist ${HOME}/.unknown-horizons |
17 | include whitelist-common.inc | 18 | include whitelist-common.inc |
19 | include whitelist-runuser-common.inc | ||
20 | whitelist /usr/share/unknown-horizons | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
18 | 23 | ||
24 | apparmor | ||
19 | caps.drop all | 25 | caps.drop all |
20 | nodvd | 26 | nodvd |
21 | nogroups | 27 | nogroups |
@@ -28,7 +34,11 @@ protocol unix,inet,inet6,netlink | |||
28 | seccomp | 34 | seccomp |
29 | shell none | 35 | shell none |
30 | 36 | ||
37 | disable-mnt | ||
31 | # private-bin unknown-horizons | 38 | # private-bin unknown-horizons |
32 | private-dev | 39 | private-dev |
33 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl | 40 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl |
34 | private-tmp | 41 | private-tmp |
42 | |||
43 | # doesn't work - maybe all Tcl/Tk programs have this problem | ||
44 | # memory-deny-write-execute | ||
diff --git a/etc/unlzma.profile b/etc/profile-m-z/unlzma.profile index f7410b928..d9c72407f 100644 --- a/etc/unlzma.profile +++ b/etc/profile-m-z/unlzma.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/unrar.profile b/etc/profile-m-z/unrar.profile index bf28746b0..e07a6fc93 100644 --- a/etc/unrar.profile +++ b/etc/profile-m-z/unrar.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
20 | hostname unrar | 21 | hostname unrar |
@@ -22,7 +23,6 @@ ipc-namespace | |||
22 | machine-id | 23 | machine-id |
23 | net none | 24 | net none |
24 | no3d | 25 | no3d |
25 | nodbus | ||
26 | nodvd | 26 | nodvd |
27 | #nogroups | 27 | #nogroups |
28 | nonewprivs | 28 | nonewprivs |
@@ -41,3 +41,6 @@ private-bin unrar | |||
41 | private-dev | 41 | private-dev |
42 | private-etc alternatives,group,localtime,passwd | 42 | private-etc alternatives,group,localtime,passwd |
43 | private-tmp | 43 | private-tmp |
44 | |||
45 | dbus-user none | ||
46 | dbus-system none | ||
diff --git a/etc/unxz.profile b/etc/profile-m-z/unxz.profile index f7410b928..d9c72407f 100644 --- a/etc/unxz.profile +++ b/etc/profile-m-z/unxz.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/unzip.profile b/etc/profile-m-z/unzip.profile index 7882f2b63..e08511c12 100644 --- a/etc/unzip.profile +++ b/etc/profile-m-z/unzip.profile | |||
@@ -18,6 +18,7 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | 22 | ||
22 | caps.drop all | 23 | caps.drop all |
23 | hostname unzip | 24 | hostname unzip |
@@ -25,7 +26,6 @@ ipc-namespace | |||
25 | machine-id | 26 | machine-id |
26 | net none | 27 | net none |
27 | no3d | 28 | no3d |
28 | nodbus | ||
29 | nodvd | 29 | nodvd |
30 | #nogroups | 30 | #nogroups |
31 | nonewprivs | 31 | nonewprivs |
@@ -43,3 +43,6 @@ x11 none | |||
43 | private-bin unzip | 43 | private-bin unzip |
44 | private-dev | 44 | private-dev |
45 | private-etc alternatives,group,localtime,passwd | 45 | private-etc alternatives,group,localtime,passwd |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/unzstd.profile b/etc/profile-m-z/unzstd.profile index ce9af3286..ce9af3286 100644 --- a/etc/unzstd.profile +++ b/etc/profile-m-z/unzstd.profile | |||
diff --git a/etc/utox.profile b/etc/profile-m-z/utox.profile index 9877ea889..cd4374004 100644 --- a/etc/utox.profile +++ b/etc/profile-m-z/utox.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | mkdir ${HOME}/.config/tox | 21 | mkdir ${HOME}/.config/tox |
diff --git a/etc/uudeview.profile b/etc/profile-m-z/uudeview.profile index bd2ee01d5..f60c134e0 100644 --- a/etc/uudeview.profile +++ b/etc/profile-m-z/uudeview.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
20 | 21 | ||
@@ -23,7 +24,6 @@ hostname uudeview | |||
23 | ipc-namespace | 24 | ipc-namespace |
24 | machine-id | 25 | machine-id |
25 | net none | 26 | net none |
26 | nodbus | ||
27 | nodvd | 27 | nodvd |
28 | #nogroups | 28 | #nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -42,3 +42,6 @@ private-bin uudeview | |||
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-etc alternatives,ld.so.preload | 44 | private-etc alternatives,ld.so.preload |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/uzbl-browser.profile b/etc/profile-m-z/uzbl-browser.profile index d4e54235b..41487a8f2 100644 --- a/etc/uzbl-browser.profile +++ b/etc/profile-m-z/uzbl-browser.profile | |||
@@ -10,8 +10,8 @@ noblacklist ${HOME}/.gnupg | |||
10 | noblacklist ${HOME}/.local/share/uzbl | 10 | noblacklist ${HOME}/.local/share/uzbl |
11 | 11 | ||
12 | # Allow python (blacklisted by disable-interpreters.inc) | 12 | # Allow python (blacklisted by disable-interpreters.inc) |
13 | include allow-python2.inc | 13 | include allow-python2.inc |
14 | include allow-python3.inc | 14 | include allow-python3.inc |
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | 17 | include disable-devel.inc |
diff --git a/etc/viewnior.profile b/etc/profile-m-z/viewnior.profile index 9f57b2971..83727d42b 100644 --- a/etc/viewnior.profile +++ b/etc/profile-m-z/viewnior.profile | |||
@@ -18,6 +18,7 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | 22 | ||
22 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
23 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
@@ -26,7 +27,6 @@ apparmor | |||
26 | caps.drop all | 27 | caps.drop all |
27 | net none | 28 | net none |
28 | no3d | 29 | no3d |
29 | nodbus | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -46,4 +46,7 @@ private-dev | |||
46 | private-etc alternatives,fonts,machine-id | 46 | private-etc alternatives,fonts,machine-id |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
49 | #memory-deny-write-execute - breaks on Arch (see issues #1803 and #1808) | 52 | #memory-deny-write-execute - breaks on Arch (see issues #1803 and #1808) |
diff --git a/etc/viking.profile b/etc/profile-m-z/viking.profile index 5b6228a94..5b6228a94 100644 --- a/etc/viking.profile +++ b/etc/profile-m-z/viking.profile | |||
diff --git a/etc/vim.profile b/etc/profile-m-z/vim.profile index d27a9a633..e9a474239 100644 --- a/etc/vim.profile +++ b/etc/profile-m-z/vim.profile | |||
@@ -17,6 +17,8 @@ include disable-common.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-runuser-common.inc | ||
21 | |||
20 | caps.drop all | 22 | caps.drop all |
21 | netfilter | 23 | netfilter |
22 | nodvd | 24 | nodvd |
diff --git a/etc/vimcat.profile b/etc/profile-m-z/vimcat.profile index 73b76b5ab..73b76b5ab 100644 --- a/etc/vimcat.profile +++ b/etc/profile-m-z/vimcat.profile | |||
diff --git a/etc/vimdiff.profile b/etc/profile-m-z/vimdiff.profile index f09faf1d6..f09faf1d6 100644 --- a/etc/vimdiff.profile +++ b/etc/profile-m-z/vimdiff.profile | |||
diff --git a/etc/vimpager.profile b/etc/profile-m-z/vimpager.profile index af7703752..af7703752 100644 --- a/etc/vimpager.profile +++ b/etc/profile-m-z/vimpager.profile | |||
diff --git a/etc/vimtutor.profile b/etc/profile-m-z/vimtutor.profile index b9584cc49..b9584cc49 100644 --- a/etc/vimtutor.profile +++ b/etc/profile-m-z/vimtutor.profile | |||
diff --git a/etc/virtualbox.profile b/etc/profile-m-z/virtualbox.profile index c0dbc9116..12bef5d1f 100644 --- a/etc/virtualbox.profile +++ b/etc/profile-m-z/virtualbox.profile | |||
@@ -14,9 +14,12 @@ noblacklist /usr/lib/virtualbox | |||
14 | noblacklist /usr/lib64/virtualbox | 14 | noblacklist /usr/lib64/virtualbox |
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | ||
17 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | ||
18 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-xdg.inc | ||
20 | 23 | ||
21 | mkdir ${HOME}/.config/VirtualBox | 24 | mkdir ${HOME}/.config/VirtualBox |
22 | mkdir ${HOME}/VirtualBox VMs | 25 | mkdir ${HOME}/VirtualBox VMs |
@@ -24,9 +27,23 @@ whitelist ${HOME}/.config/VirtualBox | |||
24 | whitelist ${HOME}/VirtualBox VMs | 27 | whitelist ${HOME}/VirtualBox VMs |
25 | whitelist ${DOWNLOADS} | 28 | whitelist ${DOWNLOADS} |
26 | include whitelist-common.inc | 29 | include whitelist-common.inc |
30 | include whitelist-runuser-common.inc | ||
31 | include whitelist-usr-share-common.inc | ||
27 | include whitelist-var-common.inc | 32 | include whitelist-var-common.inc |
28 | 33 | ||
29 | caps.keep net_raw,sys_admin,sys_nice | 34 | # For host-only network sys_admin is needed. See https://github.com/netblue30/firejail/issues/2868#issuecomment-518647630 |
35 | |||
36 | caps.keep net_raw,sys_nice | ||
30 | netfilter | 37 | netfilter |
31 | nodvd | 38 | nodvd |
39 | #nogroups | ||
32 | notv | 40 | notv |
41 | shell none | ||
42 | tracelog | ||
43 | |||
44 | #disable-mnt | ||
45 | private-cache | ||
46 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/vivaldi-beta.profile b/etc/profile-m-z/vivaldi-beta.profile index 5de5682a3..5de5682a3 100644 --- a/etc/vivaldi-beta.profile +++ b/etc/profile-m-z/vivaldi-beta.profile | |||
diff --git a/etc/vivaldi-snapshot.profile b/etc/profile-m-z/vivaldi-snapshot.profile index ea4a4009f..ea4a4009f 100644 --- a/etc/vivaldi-snapshot.profile +++ b/etc/profile-m-z/vivaldi-snapshot.profile | |||
diff --git a/etc/vivaldi-stable.profile b/etc/profile-m-z/vivaldi-stable.profile index 5de5682a3..5de5682a3 100644 --- a/etc/vivaldi-stable.profile +++ b/etc/profile-m-z/vivaldi-stable.profile | |||
diff --git a/etc/vivaldi.profile b/etc/profile-m-z/vivaldi.profile index 2185b90ec..096ce8a72 100644 --- a/etc/vivaldi.profile +++ b/etc/profile-m-z/vivaldi.profile | |||
@@ -23,8 +23,9 @@ whitelist ${HOME}/.cache/vivaldi | |||
23 | whitelist ${HOME}/.config/vivaldi | 23 | whitelist ${HOME}/.config/vivaldi |
24 | whitelist ${HOME}/.local/lib/vivaldi | 24 | whitelist ${HOME}/.local/lib/vivaldi |
25 | 25 | ||
26 | # nodbus breaks vivaldi sync | 26 | # breaks vivaldi sync |
27 | ignore nodbus | 27 | ignore dbus-user none |
28 | ignore dbus-system none | ||
28 | 29 | ||
29 | # Redirect | 30 | # Redirect |
30 | include chromium-common.profile | 31 | include chromium-common.profile |
diff --git a/etc/vlc.profile b/etc/profile-m-z/vlc.profile index 572758f28..0069ebeae 100644 --- a/etc/vlc.profile +++ b/etc/profile-m-z/vlc.profile | |||
@@ -25,7 +25,6 @@ include whitelist-var-common.inc | |||
25 | #apparmor - on Ubuntu 18.04 it refuses to start without dbus access | 25 | #apparmor - on Ubuntu 18.04 it refuses to start without dbus access |
26 | caps.drop all | 26 | caps.drop all |
27 | netfilter | 27 | netfilter |
28 | #nodbus - dbus needed for MPRIS | ||
29 | nogroups | 28 | nogroups |
30 | nonewprivs | 29 | nonewprivs |
31 | noroot | 30 | noroot |
@@ -38,5 +37,9 @@ private-bin cvlc,nvlc,qvlc,rvlc,svlc,vlc | |||
38 | private-dev | 37 | private-dev |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
40 | # dbus needed for MPRIS | ||
41 | # dbus-user none | ||
42 | # dbus-system none | ||
43 | |||
41 | # mdwe is disabled due to breaking hardware accelerated decoding | 44 | # mdwe is disabled due to breaking hardware accelerated decoding |
42 | #memory-deny-write-execute | 45 | #memory-deny-write-execute |
diff --git a/etc/profile-m-z/vmware.profile b/etc/profile-m-z/vmware.profile new file mode 100644 index 000000000..720b69773 --- /dev/null +++ b/etc/profile-m-z/vmware.profile | |||
@@ -0,0 +1,39 @@ | |||
1 | # Firejail profile for vmware | ||
2 | # Description: The industry standard for running multiple operating systems as virtual machines on a single Linux PC. | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include vmware.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/vmware | ||
10 | noblacklist ${HOME}/.vmware | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.cache/vmware | ||
21 | mkdir ${HOME}/.vmware | ||
22 | whitelist ${HOME}/.cache/vmware | ||
23 | whitelist ${HOME}/.vmware | ||
24 | include whitelist-common.inc | ||
25 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | caps.keep chown,net_raw,sys_nice,sys_rawio | ||
30 | netfilter | ||
31 | nogroups | ||
32 | notv | ||
33 | shell none | ||
34 | tracelog | ||
35 | |||
36 | #disable-mnt | ||
37 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl,vmware,vmware-installer,vmware-vix | ||
38 | dbus-user none | ||
39 | dbus-system none | ||
diff --git a/etc/vscodium.profile b/etc/profile-m-z/vscodium.profile index b4728fb72..b4728fb72 100644 --- a/etc/vscodium.profile +++ b/etc/profile-m-z/vscodium.profile | |||
diff --git a/etc/vulturesclaw.profile b/etc/profile-m-z/vulturesclaw.profile index 2e9078a7b..2e9078a7b 100644 --- a/etc/vulturesclaw.profile +++ b/etc/profile-m-z/vulturesclaw.profile | |||
diff --git a/etc/vultureseye.profile b/etc/profile-m-z/vultureseye.profile index 44c263cfc..44c263cfc 100644 --- a/etc/vultureseye.profile +++ b/etc/profile-m-z/vultureseye.profile | |||
diff --git a/etc/vym.profile b/etc/profile-m-z/vym.profile index fbb53943c..fbb53943c 100644 --- a/etc/vym.profile +++ b/etc/profile-m-z/vym.profile | |||
diff --git a/etc/w3m.profile b/etc/profile-m-z/w3m.profile index 97465baa1..bd33edd6a 100644 --- a/etc/w3m.profile +++ b/etc/profile-m-z/w3m.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for w3m | 1 | # Firejail profile for w3m |
2 | # Description: WWW browsable pager with excellent tables/frames support | 2 | # Description: WWW browsable pager with excellent tables/frames support |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include w3m.local | 6 | include w3m.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
@@ -20,6 +21,8 @@ include disable-passwdmgr.inc | |||
20 | include disable-programs.inc | 21 | include disable-programs.inc |
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
24 | include whitelist-runuser-common.inc | ||
25 | |||
23 | caps.drop all | 26 | caps.drop all |
24 | netfilter | 27 | netfilter |
25 | no3d | 28 | no3d |
diff --git a/etc/profile-m-z/warmux.profile b/etc/profile-m-z/warmux.profile new file mode 100644 index 000000000..aaef652fd --- /dev/null +++ b/etc/profile-m-z/warmux.profile | |||
@@ -0,0 +1,56 @@ | |||
1 | # Firejail profile for warmux | ||
2 | # Description: a convivial mass murder game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include warmux.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/wormux | ||
10 | noblacklist ${HOME}/.local/share/wormux | ||
11 | noblacklist ${HOME}/.wormux | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | mkdir ${HOME}/.config/wormux | ||
23 | mkdir ${HOME}/.local/share/wormux | ||
24 | mkdir ${HOME}/.wormux | ||
25 | whitelist ${HOME}/.config/wormux | ||
26 | whitelist ${HOME}/.local/share/wormux | ||
27 | whitelist ${HOME}/.wormux | ||
28 | whitelist /usr/share/warmux | ||
29 | include whitelist-common.inc | ||
30 | include whitelist-usr-share-common.inc | ||
31 | include whitelist-var-common.inc | ||
32 | |||
33 | apparmor | ||
34 | caps.drop all | ||
35 | netfilter | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix,inet,inet6 | ||
44 | seccomp | ||
45 | shell none | ||
46 | tracelog | ||
47 | |||
48 | disable-mnt | ||
49 | private-bin warmux | ||
50 | private-cache | ||
51 | private-dev | ||
52 | private-etc ca-certificates,crypto-policies,host.conf,hostname,hosts,machine-id,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | ||
53 | private-tmp | ||
54 | |||
55 | dbus-user none | ||
56 | dbus-system none | ||
diff --git a/etc/warsow.profile b/etc/profile-m-z/warsow.profile index e884ab07a..d8cd5557e 100644 --- a/etc/warsow.profile +++ b/etc/profile-m-z/warsow.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | mkdir ${HOME}/.cache/warsow-2.1 | 23 | mkdir ${HOME}/.cache/warsow-2.1 |
@@ -29,7 +30,6 @@ include whitelist-var-common.inc | |||
29 | caps.drop all | 30 | caps.drop all |
30 | ipc-namespace | 31 | ipc-namespace |
31 | netfilter | 32 | netfilter |
32 | nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -47,3 +47,6 @@ private-bin warsow | |||
47 | private-cache | 47 | private-cache |
48 | private-dev | 48 | private-dev |
49 | private-tmp | 49 | private-tmp |
50 | |||
51 | dbus-user none | ||
52 | dbus-system none | ||
diff --git a/etc/warzone2100.profile b/etc/profile-m-z/warzone2100.profile index e65e0a0c3..369c9cc1d 100644 --- a/etc/warzone2100.profile +++ b/etc/profile-m-z/warzone2100.profile | |||
@@ -14,14 +14,19 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | # mkdir ${HOME}/.warzone2100-3.1 | 19 | # mkdir ${HOME}/.warzone2100-3.1 |
19 | # mkdir ${HOME}/.warzone2100-3.2 | 20 | # mkdir ${HOME}/.warzone2100-3.2 |
20 | whitelist ${HOME}/.warzone2100-3.1 | 21 | whitelist ${HOME}/.warzone2100-3.1 |
21 | whitelist ${HOME}/.warzone2100-3.2 | 22 | whitelist ${HOME}/.warzone2100-3.2 |
23 | whitelist /usr/share/games | ||
22 | include whitelist-common.inc | 24 | include whitelist-common.inc |
25 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
24 | 28 | ||
29 | apparmor | ||
25 | caps.drop all | 30 | caps.drop all |
26 | netfilter | 31 | netfilter |
27 | nodvd | 32 | nodvd |
diff --git a/etc/waterfox-classic.profile b/etc/profile-m-z/waterfox-classic.profile index 6c7e18a46..6c7e18a46 100644 --- a/etc/waterfox-classic.profile +++ b/etc/profile-m-z/waterfox-classic.profile | |||
diff --git a/etc/waterfox-current.profile b/etc/profile-m-z/waterfox-current.profile index 5e12a6fe3..5e12a6fe3 100644 --- a/etc/waterfox-current.profile +++ b/etc/profile-m-z/waterfox-current.profile | |||
diff --git a/etc/waterfox.profile b/etc/profile-m-z/waterfox.profile index c6c940fa3..c6c940fa3 100644 --- a/etc/waterfox.profile +++ b/etc/profile-m-z/waterfox.profile | |||
diff --git a/etc/webstorm.profile b/etc/profile-m-z/webstorm.profile index fc4e8e571..fc4e8e571 100644 --- a/etc/webstorm.profile +++ b/etc/profile-m-z/webstorm.profile | |||
diff --git a/etc/webui-aria2.profile b/etc/profile-m-z/webui-aria2.profile index 0cd1e05ab..8928f8116 100644 --- a/etc/webui-aria2.profile +++ b/etc/profile-m-z/webui-aria2.profile | |||
@@ -18,7 +18,6 @@ include disable-xdg.inc | |||
18 | 18 | ||
19 | caps.drop all | 19 | caps.drop all |
20 | netfilter | 20 | netfilter |
21 | nodbus | ||
22 | nodvd | 21 | nodvd |
23 | nogroups | 22 | nogroups |
24 | nonewprivs | 23 | nonewprivs |
@@ -35,3 +34,5 @@ private-cache | |||
35 | private-dev | 34 | private-dev |
36 | private-tmp | 35 | private-tmp |
37 | 36 | ||
37 | dbus-user none | ||
38 | dbus-system none | ||
diff --git a/etc/weechat-curses.profile b/etc/profile-m-z/weechat-curses.profile index 4719b9788..4719b9788 100644 --- a/etc/weechat-curses.profile +++ b/etc/profile-m-z/weechat-curses.profile | |||
diff --git a/etc/weechat.profile b/etc/profile-m-z/weechat.profile index 800724054..800724054 100644 --- a/etc/weechat.profile +++ b/etc/profile-m-z/weechat.profile | |||
diff --git a/etc/wesnoth.profile b/etc/profile-m-z/wesnoth.profile index 934edfce9..934edfce9 100644 --- a/etc/wesnoth.profile +++ b/etc/profile-m-z/wesnoth.profile | |||
diff --git a/etc/wget.profile b/etc/profile-m-z/wget.profile index 401926e2d..cdb8f0b93 100644 --- a/etc/wget.profile +++ b/etc/profile-m-z/wget.profile | |||
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.wgetrc | |||
13 | 13 | ||
14 | blacklist /tmp/.X11-unix | 14 | blacklist /tmp/.X11-unix |
15 | blacklist ${RUNUSER}/wayland-* | 15 | blacklist ${RUNUSER}/wayland-* |
16 | blacklist ${RUNUSER} | ||
16 | 17 | ||
17 | include disable-common.inc | 18 | include disable-common.inc |
18 | include disable-devel.inc | 19 | include disable-devel.inc |
@@ -20,16 +21,17 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 22 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 23 | include disable-programs.inc |
24 | include disable-shell.inc | ||
23 | # depending on workflow you can uncomment the below or put 'include disable-xdg.inc' in your wget.local | 25 | # depending on workflow you can uncomment the below or put 'include disable-xdg.inc' in your wget.local |
24 | #include disable-xdg.inc | 26 | #include disable-xdg.inc |
25 | 27 | ||
26 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
28 | 30 | ||
31 | apparmor | ||
29 | caps.drop all | 32 | caps.drop all |
30 | ipc-namespace | 33 | ipc-namespace |
31 | machine-id | 34 | machine-id |
32 | nodbus | ||
33 | netfilter | 35 | netfilter |
34 | no3d | 36 | no3d |
35 | nodvd | 37 | nodvd |
@@ -52,4 +54,7 @@ private-dev | |||
52 | #private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl,wgetrc | 54 | #private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl,wgetrc |
53 | #private-tmp | 55 | #private-tmp |
54 | 56 | ||
57 | dbus-user none | ||
58 | dbus-system none | ||
59 | |||
55 | memory-deny-write-execute | 60 | memory-deny-write-execute |
diff --git a/etc/whalebird.profile b/etc/profile-m-z/whalebird.profile index 2e24dd8e0..187c49ed8 100644 --- a/etc/whalebird.profile +++ b/etc/profile-m-z/whalebird.profile | |||
@@ -7,7 +7,8 @@ include whalebird.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | ignore nodbus | 10 | ignore dbus-user none |
11 | ignore dbus-system none | ||
11 | 12 | ||
12 | noblacklist ${HOME}/.config/Whalebird | 13 | noblacklist ${HOME}/.config/Whalebird |
13 | 14 | ||
diff --git a/etc/whois.profile b/etc/profile-m-z/whois.profile index 0e60e18ab..2af1379e0 100644 --- a/etc/whois.profile +++ b/etc/profile-m-z/whois.profile | |||
@@ -9,6 +9,7 @@ include globals.local | |||
9 | 9 | ||
10 | blacklist /tmp/.X11-unix | 10 | blacklist /tmp/.X11-unix |
11 | blacklist ${RUNUSER}/wayland-* | 11 | blacklist ${RUNUSER}/wayland-* |
12 | blacklist ${RUNUSER} | ||
12 | 13 | ||
13 | include disable-common.inc | 14 | include disable-common.inc |
14 | include disable-devel.inc | 15 | include disable-devel.inc |
@@ -21,13 +22,13 @@ include disable-xdg.inc | |||
21 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
25 | apparmor | ||
24 | caps.drop all | 26 | caps.drop all |
25 | hostname whois | 27 | hostname whois |
26 | ipc-namespace | 28 | ipc-namespace |
27 | machine-id | 29 | machine-id |
28 | netfilter | 30 | netfilter |
29 | no3d | 31 | no3d |
30 | nodbus | ||
31 | nodvd | 32 | nodvd |
32 | nogroups | 33 | nogroups |
33 | nonewprivs | 34 | nonewprivs |
@@ -50,4 +51,7 @@ private-etc alternatives,hosts,jwhois.conf,resolv.conf,services,whois.conf | |||
50 | private-lib gconv | 51 | private-lib gconv |
51 | private-tmp | 52 | private-tmp |
52 | 53 | ||
54 | dbus-user none | ||
55 | dbus-system none | ||
56 | |||
53 | memory-deny-write-execute | 57 | memory-deny-write-execute |
diff --git a/etc/widelands.profile b/etc/profile-m-z/widelands.profile index c6b5f27da..f18878554 100644 --- a/etc/widelands.profile +++ b/etc/profile-m-z/widelands.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.widelands | 20 | mkdir ${HOME}/.widelands |
@@ -21,10 +22,10 @@ whitelist ${HOME}/.widelands | |||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
25 | apparmor | ||
24 | caps.drop all | 26 | caps.drop all |
25 | ipc-namespace | 27 | ipc-namespace |
26 | netfilter | 28 | netfilter |
27 | nodbus | ||
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
@@ -42,3 +43,6 @@ private-bin widelands | |||
42 | private-cache | 43 | private-cache |
43 | private-dev | 44 | private-dev |
44 | private-tmp | 45 | private-tmp |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/wine.profile b/etc/profile-m-z/wine.profile index 901340052..901340052 100644 --- a/etc/wine.profile +++ b/etc/profile-m-z/wine.profile | |||
diff --git a/etc/wire-desktop.profile b/etc/profile-m-z/wire-desktop.profile index 3c783322b..8f6014dc3 100644 --- a/etc/wire-desktop.profile +++ b/etc/profile-m-z/wire-desktop.profile | |||
@@ -9,8 +9,8 @@ include wire-desktop.local | |||
9 | 9 | ||
10 | # Debian/Ubuntu use /opt/Wire. As that is not in PATH by default, run `firejail /opt/Wire/wire-desktop` to start it. | 10 | # Debian/Ubuntu use /opt/Wire. As that is not in PATH by default, run `firejail /opt/Wire/wire-desktop` to start it. |
11 | 11 | ||
12 | ignore caps.drop all | 12 | ignore dbus-user none |
13 | ignore nodbus | 13 | ignore dbus-system none |
14 | 14 | ||
15 | noblacklist ${HOME}/.config/Wire | 15 | noblacklist ${HOME}/.config/Wire |
16 | 16 | ||
@@ -21,12 +21,13 @@ mkdir ${HOME}/.config/Wire | |||
21 | whitelist ${HOME}/.config/Wire | 21 | whitelist ${HOME}/.config/Wire |
22 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | 23 | ||
24 | caps.keep sys_admin,sys_chroot | ||
25 | nou2f | 24 | nou2f |
25 | ignore seccomp | ||
26 | seccomp !chroot | ||
26 | shell none | 27 | shell none |
27 | 28 | ||
28 | disable-mnt | 29 | disable-mnt |
29 | private-bin bash,electron,electron4,env,sh,wire-desktop | 30 | private-bin bash,electron,electron4,electron6,env,sh,wire-desktop |
30 | private-dev | 31 | private-dev |
31 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl | 32 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl |
32 | private-tmp | 33 | private-tmp |
diff --git a/etc/wireshark-gtk.profile b/etc/profile-m-z/wireshark-gtk.profile index 3e2e1807e..3e2e1807e 100644 --- a/etc/wireshark-gtk.profile +++ b/etc/profile-m-z/wireshark-gtk.profile | |||
diff --git a/etc/wireshark-qt.profile b/etc/profile-m-z/wireshark-qt.profile index 3e2e1807e..3e2e1807e 100644 --- a/etc/wireshark-qt.profile +++ b/etc/profile-m-z/wireshark-qt.profile | |||
diff --git a/etc/wireshark.profile b/etc/profile-m-z/wireshark.profile index d73e2e279..a30cb43d5 100644 --- a/etc/wireshark.profile +++ b/etc/profile-m-z/wireshark.profile | |||
@@ -47,4 +47,3 @@ tracelog | |||
47 | private-dev | 47 | private-dev |
48 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,ssl | 48 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,ssl |
49 | private-tmp | 49 | private-tmp |
50 | |||
diff --git a/etc/profile-m-z/wordwarvi.profile b/etc/profile-m-z/wordwarvi.profile new file mode 100644 index 000000000..da1210bb8 --- /dev/null +++ b/etc/profile-m-z/wordwarvi.profile | |||
@@ -0,0 +1,52 @@ | |||
1 | # Firejail profile for wordwarvi | ||
2 | # Description: Old school '80's style side scrolling space shoot'em up game. | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include wordwarvi.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.wordwarvi | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.wordwarvi | ||
21 | whitelist ${HOME}/.wordwarvi | ||
22 | whitelist /usr/share/wordwarvi | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | no3d | ||
31 | nodvd | ||
32 | nogroups | ||
33 | nonewprivs | ||
34 | noroot | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix | ||
39 | seccomp | ||
40 | shell none | ||
41 | tracelog | ||
42 | |||
43 | disable-mnt | ||
44 | private | ||
45 | private-bin wordwarvi | ||
46 | private-cache | ||
47 | private-dev | ||
48 | private-etc alsa,asound.conf,machine-id,pulse | ||
49 | private-tmp | ||
50 | |||
51 | dbus-user none | ||
52 | dbus-system none | ||
diff --git a/etc/wpp.profile b/etc/profile-m-z/wpp.profile index a219397a9..a219397a9 100644 --- a/etc/wpp.profile +++ b/etc/profile-m-z/wpp.profile | |||
diff --git a/etc/wps.profile b/etc/profile-m-z/wps.profile index 47bba2dda..6e4a313e3 100644 --- a/etc/wps.profile +++ b/etc/profile-m-z/wps.profile | |||
@@ -27,7 +27,6 @@ machine-id | |||
27 | #net none | 27 | #net none |
28 | netfilter | 28 | netfilter |
29 | no3d | 29 | no3d |
30 | nodbus | ||
31 | nodvd | 30 | nodvd |
32 | nogroups | 31 | nogroups |
33 | nonewprivs | 32 | nonewprivs |
@@ -45,3 +44,6 @@ tracelog | |||
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-tmp | 46 | private-tmp |
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/wpspdf.profile b/etc/profile-m-z/wpspdf.profile index 82080acbc..82080acbc 100644 --- a/etc/wpspdf.profile +++ b/etc/profile-m-z/wpspdf.profile | |||
diff --git a/etc/x-terminal-emulator.profile b/etc/profile-m-z/x-terminal-emulator.profile index e21b74030..fe0781336 100644 --- a/etc/x-terminal-emulator.profile +++ b/etc/profile-m-z/x-terminal-emulator.profile | |||
@@ -8,8 +8,6 @@ include globals.local | |||
8 | caps.drop all | 8 | caps.drop all |
9 | ipc-namespace | 9 | ipc-namespace |
10 | net none | 10 | net none |
11 | netfilter | ||
12 | nodbus | ||
13 | nogroups | 11 | nogroups |
14 | noroot | 12 | noroot |
15 | nou2f | 13 | nou2f |
@@ -18,4 +16,7 @@ seccomp | |||
18 | 16 | ||
19 | private-dev | 17 | private-dev |
20 | 18 | ||
19 | dbus-user none | ||
20 | dbus-system none | ||
21 | |||
21 | noexec /tmp | 22 | noexec /tmp |
diff --git a/etc/profile-m-z/x2goclient.profile b/etc/profile-m-z/x2goclient.profile new file mode 100644 index 000000000..bc9603835 --- /dev/null +++ b/etc/profile-m-z/x2goclient.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for x2goclient | ||
2 | # Description: Graphical client for X2Go remote desktop system | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include x2goclient.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.ssh | ||
10 | noblacklist ${HOME}/.x2go | ||
11 | noblacklist ${HOME}/.x2goclient | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | |||
20 | apparmor | ||
21 | caps.drop all | ||
22 | ipc-namespace | ||
23 | netfilter | ||
24 | #no3d | ||
25 | nodvd | ||
26 | nogroups | ||
27 | nonewprivs | ||
28 | noroot | ||
29 | notv | ||
30 | nou2f | ||
31 | novideo | ||
32 | protocol unix,inet,inet6 | ||
33 | seccomp | ||
34 | shell none | ||
35 | tracelog | ||
36 | |||
37 | #private-bin nxproxy,x2goclient | ||
38 | private-cache | ||
39 | private-dev | ||
40 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,X11,xdg | ||
41 | #private-lib | ||
42 | private-opt none | ||
43 | private-srv none | ||
44 | private-tmp | ||
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
48 | |||
49 | #memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/xbill.profile b/etc/profile-m-z/xbill.profile new file mode 100644 index 000000000..cdfebfb29 --- /dev/null +++ b/etc/profile-m-z/xbill.profile | |||
@@ -0,0 +1,54 @@ | |||
1 | # Firejail profile for xbill | ||
2 | # Description: save your computers from Wingdows [TM] virus | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include xbill.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | whitelist /usr/share/xbill | ||
19 | whitelist /var/games/xbill/scores | ||
20 | include whitelist-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | machine-id | ||
27 | net none | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private | ||
44 | private-bin xbill | ||
45 | private-cache | ||
46 | private-dev | ||
47 | private-etc none | ||
48 | private-tmp | ||
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
53 | memory-deny-write-execute | ||
54 | read-only ${HOME} | ||
diff --git a/etc/xcalc.profile b/etc/profile-m-z/xcalc.profile index 0ad423d30..56ce01498 100644 --- a/etc/xcalc.profile +++ b/etc/profile-m-z/xcalc.profile | |||
@@ -11,15 +11,15 @@ include disable-exec.inc | |||
11 | include disable-interpreters.inc | 11 | include disable-interpreters.inc |
12 | include disable-passwdmgr.inc | 12 | include disable-passwdmgr.inc |
13 | include disable-programs.inc | 13 | include disable-programs.inc |
14 | include disable-shell.inc | ||
14 | include disable-xdg.inc | 15 | include disable-xdg.inc |
15 | 16 | ||
16 | include whitelist-var-common.inc | 17 | include whitelist-var-common.inc |
17 | 18 | ||
19 | apparmor | ||
18 | caps.drop all | 20 | caps.drop all |
19 | net none | 21 | net none |
20 | netfilter | ||
21 | no3d | 22 | no3d |
22 | nodbus | ||
23 | nodvd | 23 | nodvd |
24 | nogroups | 24 | nogroups |
25 | nonewprivs | 25 | nonewprivs |
@@ -39,3 +39,5 @@ private-dev | |||
39 | private-lib | 39 | private-lib |
40 | private-tmp | 40 | private-tmp |
41 | 41 | ||
42 | dbus-user none | ||
43 | dbus-system none | ||
diff --git a/etc/xchat.profile b/etc/profile-m-z/xchat.profile index a94444aab..a94444aab 100644 --- a/etc/xchat.profile +++ b/etc/profile-m-z/xchat.profile | |||
diff --git a/etc/xed.profile b/etc/profile-m-z/xed.profile index a67230e51..b114f9ab5 100644 --- a/etc/xed.profile +++ b/etc/profile-m-z/xed.profile | |||
@@ -11,8 +11,8 @@ noblacklist ${HOME}/.python_history | |||
11 | noblacklist ${HOME}/.pythonhist | 11 | noblacklist ${HOME}/.pythonhist |
12 | 12 | ||
13 | # Allow python (blacklisted by disable-interpreters.inc) | 13 | # Allow python (blacklisted by disable-interpreters.inc) |
14 | include allow-python2.inc | 14 | include allow-python2.inc |
15 | include allow-python3.inc | 15 | include allow-python3.inc |
16 | 16 | ||
17 | include disable-common.inc | 17 | include disable-common.inc |
18 | include disable-devel.inc | 18 | include disable-devel.inc |
@@ -20,6 +20,7 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 21 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-shell.inc | ||
23 | 24 | ||
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
@@ -28,7 +29,6 @@ caps.drop all | |||
28 | machine-id | 29 | machine-id |
29 | # net none - makes settings immutable | 30 | # net none - makes settings immutable |
30 | no3d | 31 | no3d |
31 | # nodbus - makes settings immutable | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -46,5 +46,9 @@ private-bin xed | |||
46 | private-dev | 46 | private-dev |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | # makes settings immutable | ||
50 | # dbus-user none | ||
51 | # dbus-system none | ||
52 | |||
49 | # xed uses python plugins, memory-deny-write-execute breaks python | 53 | # xed uses python plugins, memory-deny-write-execute breaks python |
50 | # memory-deny-write-execute | 54 | # memory-deny-write-execute |
diff --git a/etc/xfburn.profile b/etc/profile-m-z/xfburn.profile index cd9561e74..cd9561e74 100644 --- a/etc/xfburn.profile +++ b/etc/profile-m-z/xfburn.profile | |||
diff --git a/etc/xfce4-dict.profile b/etc/profile-m-z/xfce4-dict.profile index bc499bd30..a3e0c4633 100644 --- a/etc/xfce4-dict.profile +++ b/etc/profile-m-z/xfce4-dict.profile | |||
@@ -15,6 +15,9 @@ include disable-interpreters.inc | |||
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | 17 | ||
18 | include whitelist-var-common.inc | ||
19 | |||
20 | apparmor | ||
18 | caps.drop all | 21 | caps.drop all |
19 | netfilter | 22 | netfilter |
20 | no3d | 23 | no3d |
diff --git a/etc/xfce4-mixer.profile b/etc/profile-m-z/xfce4-mixer.profile index 6ef85f318..6ff4a1103 100644 --- a/etc/xfce4-mixer.profile +++ b/etc/profile-m-z/xfce4-mixer.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkfile ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml | 20 | mkfile ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml |
@@ -29,7 +30,6 @@ caps.drop all | |||
29 | ipc-namespace | 30 | ipc-namespace |
30 | netfilter | 31 | netfilter |
31 | no3d | 32 | no3d |
32 | # nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -48,4 +48,7 @@ private-dev | |||
48 | private-etc alternatives,asound.conf,fonts,machine-id,pulse | 48 | private-etc alternatives,asound.conf,fonts,machine-id,pulse |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | # dbus-user none | ||
52 | # dbus-system none | ||
53 | |||
51 | memory-deny-write-execute | 54 | memory-deny-write-execute |
diff --git a/etc/xfce4-notes.profile b/etc/profile-m-z/xfce4-notes.profile index 4dad1bf7a..c3d0930ff 100644 --- a/etc/xfce4-notes.profile +++ b/etc/profile-m-z/xfce4-notes.profile | |||
@@ -17,6 +17,9 @@ include disable-interpreters.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
20 | caps.drop all | 23 | caps.drop all |
21 | netfilter | 24 | netfilter |
22 | no3d | 25 | no3d |
diff --git a/etc/profile-m-z/xfce4-screenshooter.profile b/etc/profile-m-z/xfce4-screenshooter.profile new file mode 100644 index 000000000..b760b44dd --- /dev/null +++ b/etc/profile-m-z/xfce4-screenshooter.profile | |||
@@ -0,0 +1,51 @@ | |||
1 | # Firejail profile for xfce4-screenshooter | ||
2 | # Description: Xfce screenshot tool | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include xfce4-screenshooter.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${PICTURES} | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | whitelist /usr/share/xfce4 | ||
21 | include whitelist-runuser-common.inc | ||
22 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | |||
25 | apparmor | ||
26 | caps.drop all | ||
27 | machine-id | ||
28 | netfilter | ||
29 | no3d | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix,inet,inet6 | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin xfce4-screenshooter,xfconf-query | ||
44 | private-dev | ||
45 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,pki,resolv.conf,ssl | ||
46 | private-tmp | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
51 | memory-deny-write-execute | ||
diff --git a/etc/xiphos.profile b/etc/profile-m-z/xiphos.profile index 7114f0469..188589df3 100644 --- a/etc/xiphos.profile +++ b/etc/profile-m-z/xiphos.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | 21 | ||
21 | mkdir ${HOME}/.sword | 22 | mkdir ${HOME}/.sword |
22 | mkdir ${HOME}/.xiphos | 23 | mkdir ${HOME}/.xiphos |
diff --git a/etc/xlinks.profile b/etc/profile-m-z/xlinks.profile index 7987af280..7987af280 100644 --- a/etc/xlinks.profile +++ b/etc/profile-m-z/xlinks.profile | |||
diff --git a/etc/xmms.profile b/etc/profile-m-z/xmms.profile index 7a11e1244..9391f68de 100644 --- a/etc/xmms.profile +++ b/etc/profile-m-z/xmms.profile | |||
@@ -13,6 +13,7 @@ include disable-devel.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | include disable-xdg.inc | 17 | include disable-xdg.inc |
17 | 18 | ||
18 | caps.drop all | 19 | caps.drop all |
diff --git a/etc/xmr-stak.profile b/etc/profile-m-z/xmr-stak.profile index c6ba9bd9d..3278e295d 100644 --- a/etc/xmr-stak.profile +++ b/etc/profile-m-z/xmr-stak.profile | |||
@@ -13,6 +13,7 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | include disable-xdg.inc | 17 | include disable-xdg.inc |
17 | 18 | ||
18 | mkdir ${HOME}/.xmr-stak | 19 | mkdir ${HOME}/.xmr-stak |
diff --git a/etc/xonotic-glx.profile b/etc/profile-m-z/xonotic-glx.profile index abb91e1ec..abb91e1ec 100644 --- a/etc/xonotic-glx.profile +++ b/etc/profile-m-z/xonotic-glx.profile | |||
diff --git a/etc/profile-m-z/xonotic-sdl-wrapper.profile b/etc/profile-m-z/xonotic-sdl-wrapper.profile new file mode 100644 index 000000000..6f0c7cf4c --- /dev/null +++ b/etc/profile-m-z/xonotic-sdl-wrapper.profile | |||
@@ -0,0 +1,6 @@ | |||
1 | # Firejail profile alias for xonotic | ||
2 | # This file is overwritten after every install/update | ||
3 | include xonotic-sdl-wrapper.local | ||
4 | |||
5 | # Redirect | ||
6 | include xonotic.profile | ||
diff --git a/etc/xonotic-sdl.profile b/etc/profile-m-z/xonotic-sdl.profile index abb91e1ec..abb91e1ec 100644 --- a/etc/xonotic-sdl.profile +++ b/etc/profile-m-z/xonotic-sdl.profile | |||
diff --git a/etc/xonotic.profile b/etc/profile-m-z/xonotic.profile index f4f828eda..aa8cc7d0e 100644 --- a/etc/xonotic.profile +++ b/etc/profile-m-z/xonotic.profile | |||
@@ -14,15 +14,19 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | ||
17 | 18 | ||
18 | mkdir ${HOME}/.xonotic | 19 | mkdir ${HOME}/.xonotic |
19 | whitelist ${HOME}/.xonotic | 20 | whitelist ${HOME}/.xonotic |
21 | whitelist /usr/share/xonotic | ||
20 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
22 | 26 | ||
27 | apparmor | ||
23 | caps.drop all | 28 | caps.drop all |
24 | netfilter | 29 | netfilter |
25 | nodbus | ||
26 | nodvd | 30 | nodvd |
27 | nogroups | 31 | nogroups |
28 | nonewprivs | 32 | nonewprivs |
@@ -33,10 +37,17 @@ novideo | |||
33 | protocol unix,inet,inet6 | 37 | protocol unix,inet,inet6 |
34 | seccomp | 38 | seccomp |
35 | shell none | 39 | shell none |
40 | tracelog | ||
36 | 41 | ||
37 | disable-mnt | 42 | disable-mnt |
38 | private-bin bash,blind-id,darkplaces-glx,darkplaces-sdl,dirname,grep,ldd,netstat,ps,readlink,sh,uname,xonotic,xonotic-glx,xonotic-linux32-dedicated,xonotic-linux32-glx,xonotic-linux32-sdl,xonotic-linux64-dedicated,xonotic-linux64-glx,xonotic-linux64-sdl,xonotic-sdl | 43 | private-cache |
44 | private-bin basename,bash,blind-id,cut,darkplaces-glx,darkplaces-sdl,dirname,glxinfo,grep,head,ldd,netstat,ps,readlink,sed,sh,uname,xonotic,xonotic-glx,xonotic-linux32-dedicated,xonotic-linux32-glx,xonotic-linux32-sdl,xonotic-linux64-dedicated,xonotic-linux64-glx,xonotic-linux64-sdl,xonotic-sdl,xonotic-sdl-wrapper,zenity | ||
39 | private-dev | 45 | private-dev |
40 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl | 46 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl |
41 | private-tmp | 47 | private-tmp |
42 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
52 | read-only ${HOME} | ||
53 | read-write ${HOME}/.xonotic | ||
diff --git a/etc/profile-m-z/xournal.profile b/etc/profile-m-z/xournal.profile new file mode 100644 index 000000000..b842b5307 --- /dev/null +++ b/etc/profile-m-z/xournal.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for xournal | ||
2 | # Description: Note taking and PDF editing | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include xournal.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${DOCUMENTS} | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | whitelist /usr/share/xournal | ||
21 | whitelist /usr/share/poppler | ||
22 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | |||
25 | caps.drop all | ||
26 | machine-id | ||
27 | net none | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | private-bin xournal | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc alternatives,fonts,group,machine-id,passwd | ||
46 | # TODO should use private-lib | ||
47 | private-tmp | ||
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/xpdf.profile b/etc/profile-m-z/xpdf.profile index 8c405ba1d..cdffe4eb7 100644 --- a/etc/xpdf.profile +++ b/etc/profile-m-z/xpdf.profile | |||
@@ -19,11 +19,11 @@ include disable-xdg.inc | |||
19 | 19 | ||
20 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
21 | 21 | ||
22 | apparmor | ||
22 | caps.drop all | 23 | caps.drop all |
23 | machine-id | 24 | machine-id |
24 | net none | 25 | net none |
25 | no3d | 26 | no3d |
26 | nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -39,3 +39,7 @@ shell none | |||
39 | private-dev | 39 | private-dev |
40 | private-tmp | 40 | private-tmp |
41 | 41 | ||
42 | dbus-user none | ||
43 | dbus-system none | ||
44 | |||
45 | memory-deny-write-execute | ||
diff --git a/etc/xplayer-audio-preview.profile b/etc/profile-m-z/xplayer-audio-preview.profile index 0559b8183..0559b8183 100644 --- a/etc/xplayer-audio-preview.profile +++ b/etc/profile-m-z/xplayer-audio-preview.profile | |||
diff --git a/etc/xplayer-video-thumbnailer.profile b/etc/profile-m-z/xplayer-video-thumbnailer.profile index 6b2878476..6b2878476 100644 --- a/etc/xplayer-video-thumbnailer.profile +++ b/etc/profile-m-z/xplayer-video-thumbnailer.profile | |||
diff --git a/etc/xplayer.profile b/etc/profile-m-z/xplayer.profile index 325ce7627..28df73ea5 100644 --- a/etc/xplayer.profile +++ b/etc/profile-m-z/xplayer.profile | |||
@@ -11,8 +11,8 @@ noblacklist ${MUSIC} | |||
11 | noblacklist ${VIDEOS} | 11 | noblacklist ${VIDEOS} |
12 | 12 | ||
13 | # Allow python (blacklisted by disable-interpreters.inc) | 13 | # Allow python (blacklisted by disable-interpreters.inc) |
14 | include allow-python2.inc | 14 | include allow-python2.inc |
15 | include allow-python3.inc | 15 | include allow-python3.inc |
16 | 16 | ||
17 | include disable-common.inc | 17 | include disable-common.inc |
18 | include disable-devel.inc | 18 | include disable-devel.inc |
@@ -27,7 +27,6 @@ include whitelist-var-common.inc | |||
27 | # apparmor - makes settings immutable | 27 | # apparmor - makes settings immutable |
28 | caps.drop all | 28 | caps.drop all |
29 | netfilter | 29 | netfilter |
30 | # nodbus - makes settings immutable | ||
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
33 | noroot | 32 | noroot |
@@ -42,3 +41,6 @@ private-dev | |||
42 | # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl | 41 | # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl |
43 | private-tmp | 42 | private-tmp |
44 | 43 | ||
44 | # makes settings immutable | ||
45 | # dbus-user none | ||
46 | # dbus-system none | ||
diff --git a/etc/xpra.profile b/etc/profile-m-z/xpra.profile index 1033a7471..1033a7471 100644 --- a/etc/xpra.profile +++ b/etc/profile-m-z/xpra.profile | |||
diff --git a/etc/xreader-previewer.profile b/etc/profile-m-z/xreader-previewer.profile index 6e1dcb5d2..6e1dcb5d2 100644 --- a/etc/xreader-previewer.profile +++ b/etc/profile-m-z/xreader-previewer.profile | |||
diff --git a/etc/xreader-thumbnailer.profile b/etc/profile-m-z/xreader-thumbnailer.profile index a6925fcde..a6925fcde 100644 --- a/etc/xreader-thumbnailer.profile +++ b/etc/profile-m-z/xreader-thumbnailer.profile | |||
diff --git a/etc/xreader.profile b/etc/profile-m-z/xreader.profile index 643c5a317..643c5a317 100644 --- a/etc/xreader.profile +++ b/etc/profile-m-z/xreader.profile | |||
diff --git a/etc/xviewer.profile b/etc/profile-m-z/xviewer.profile index b09bf8ab1..0ac0f665e 100644 --- a/etc/xviewer.profile +++ b/etc/profile-m-z/xviewer.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | 20 | ||
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
@@ -23,7 +24,6 @@ include whitelist-var-common.inc | |||
23 | caps.drop all | 24 | caps.drop all |
24 | # net none - makes settings immutable | 25 | # net none - makes settings immutable |
25 | no3d | 26 | no3d |
26 | # nodbus - makes settings immutable | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -42,4 +42,8 @@ private-dev | |||
42 | private-lib | 42 | private-lib |
43 | private-tmp | 43 | private-tmp |
44 | 44 | ||
45 | # makes settings immutable | ||
46 | # dbus-user none | ||
47 | # dbus-system none | ||
48 | |||
45 | memory-deny-write-execute | 49 | memory-deny-write-execute |
diff --git a/etc/xxd.profile b/etc/profile-m-z/xxd.profile index 569f194d3..864e8ce9c 100644 --- a/etc/xxd.profile +++ b/etc/profile-m-z/xxd.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for xxd | 1 | # Firejail profile for xxd |
2 | # Description: Tool to make (or reverse) a hex dump | 2 | # Description: Tool to make (or reverse) a hex dump |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include xxd.local | 6 | include xxd.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
@@ -8,4 +9,4 @@ include xxd.local | |||
8 | #include globals.local | 9 | #include globals.local |
9 | 10 | ||
10 | # Redirect | 11 | # Redirect |
11 | include vim.profile | 12 | include cpio.profile |
diff --git a/etc/xz.profile b/etc/profile-m-z/xz.profile index f7410b928..d9c72407f 100644 --- a/etc/xz.profile +++ b/etc/profile-m-z/xz.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzcat.profile b/etc/profile-m-z/xzcat.profile index f7410b928..d9c72407f 100644 --- a/etc/xzcat.profile +++ b/etc/profile-m-z/xzcat.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzcmp.profile b/etc/profile-m-z/xzcmp.profile index f7410b928..d9c72407f 100644 --- a/etc/xzcmp.profile +++ b/etc/profile-m-z/xzcmp.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzdec.profile b/etc/profile-m-z/xzdec.profile index ca6aaf1d5..542363b57 100644 --- a/etc/xzdec.profile +++ b/etc/profile-m-z/xzdec.profile | |||
@@ -21,7 +21,6 @@ ipc-namespace | |||
21 | machine-id | 21 | machine-id |
22 | net none | 22 | net none |
23 | no3d | 23 | no3d |
24 | nodbus | ||
25 | nodvd | 24 | nodvd |
26 | #nogroups | 25 | #nogroups |
27 | nonewprivs | 26 | nonewprivs |
@@ -37,3 +36,6 @@ tracelog | |||
37 | x11 none | 36 | x11 none |
38 | 37 | ||
39 | private-dev | 38 | private-dev |
39 | |||
40 | dbus-user none | ||
41 | dbus-system none | ||
diff --git a/etc/xzdiff.profile b/etc/profile-m-z/xzdiff.profile index f7410b928..d9c72407f 100644 --- a/etc/xzdiff.profile +++ b/etc/profile-m-z/xzdiff.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzegrep.profile b/etc/profile-m-z/xzegrep.profile index f7410b928..d9c72407f 100644 --- a/etc/xzegrep.profile +++ b/etc/profile-m-z/xzegrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzfgrep.profile b/etc/profile-m-z/xzfgrep.profile index f7410b928..d9c72407f 100644 --- a/etc/xzfgrep.profile +++ b/etc/profile-m-z/xzfgrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzgrep.profile b/etc/profile-m-z/xzgrep.profile index f7410b928..f7410b928 100644 --- a/etc/xzgrep.profile +++ b/etc/profile-m-z/xzgrep.profile | |||
diff --git a/etc/xzless.profile b/etc/profile-m-z/xzless.profile index f7410b928..f7410b928 100644 --- a/etc/xzless.profile +++ b/etc/profile-m-z/xzless.profile | |||
diff --git a/etc/xzmore.profile b/etc/profile-m-z/xzmore.profile index f7410b928..d9c72407f 100644 --- a/etc/xzmore.profile +++ b/etc/profile-m-z/xzmore.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/yandex-browser.profile b/etc/profile-m-z/yandex-browser.profile index 680bef677..680bef677 100644 --- a/etc/yandex-browser.profile +++ b/etc/profile-m-z/yandex-browser.profile | |||
diff --git a/etc/yelp.profile b/etc/profile-m-z/yelp.profile index acd483209..fd95ceb04 100644 --- a/etc/yelp.profile +++ b/etc/profile-m-z/yelp.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.config/yelp | 20 | mkdir ${HOME}/.config/yelp |
@@ -21,8 +22,10 @@ whitelist ${HOME}/.config/yelp | |||
21 | whitelist /usr/share/doc | 22 | whitelist /usr/share/doc |
22 | whitelist /usr/share/help | 23 | whitelist /usr/share/help |
23 | whitelist /usr/share/yelp | 24 | whitelist /usr/share/yelp |
25 | whitelist /usr/share/yelp-tools | ||
24 | whitelist /usr/share/yelp-xsl | 26 | whitelist /usr/share/yelp-xsl |
25 | include whitelist-common.inc | 27 | include whitelist-common.inc |
28 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | 29 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
28 | 31 | ||
@@ -48,6 +51,8 @@ private-dev | |||
48 | private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,gtk-3.0,machine-id,openal,os-release,pulse,sgml,xml | 51 | private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,gtk-3.0,machine-id,openal,os-release,pulse,sgml,xml |
49 | private-tmp | 52 | private-tmp |
50 | 53 | ||
54 | dbus-system none | ||
55 | |||
51 | # read-only ${HOME} breaks some not necesarry featrues, comment it if | 56 | # read-only ${HOME} breaks some not necesarry featrues, comment it if |
52 | # you need them or put 'ignore read-only ${HOME}' into your yelp.local. | 57 | # you need them or put 'ignore read-only ${HOME}' into your yelp.local. |
53 | # broken features: | 58 | # broken features: |
diff --git a/etc/youtube-dl.profile b/etc/profile-m-z/youtube-dl.profile index 19effef47..db3535f78 100644 --- a/etc/youtube-dl.profile +++ b/etc/profile-m-z/youtube-dl.profile | |||
@@ -22,6 +22,7 @@ include allow-python3.inc | |||
22 | 22 | ||
23 | blacklist /tmp/.X11-unix | 23 | blacklist /tmp/.X11-unix |
24 | blacklist ${RUNUSER}/wayland-* | 24 | blacklist ${RUNUSER}/wayland-* |
25 | blacklist ${RUNUSER} | ||
25 | 26 | ||
26 | include disable-common.inc | 27 | include disable-common.inc |
27 | include disable-devel.inc | 28 | include disable-devel.inc |
@@ -29,6 +30,7 @@ include disable-exec.inc | |||
29 | include disable-interpreters.inc | 30 | include disable-interpreters.inc |
30 | include disable-passwdmgr.inc | 31 | include disable-passwdmgr.inc |
31 | include disable-programs.inc | 32 | include disable-programs.inc |
33 | include disable-shell.inc | ||
32 | include disable-xdg.inc | 34 | include disable-xdg.inc |
33 | 35 | ||
34 | include whitelist-usr-share-common.inc | 36 | include whitelist-usr-share-common.inc |
@@ -40,7 +42,6 @@ ipc-namespace | |||
40 | machine-id | 42 | machine-id |
41 | netfilter | 43 | netfilter |
42 | no3d | 44 | no3d |
43 | nodbus | ||
44 | nodvd | 45 | nodvd |
45 | nogroups | 46 | nogroups |
46 | nonewprivs | 47 | nonewprivs |
@@ -60,4 +61,7 @@ private-dev | |||
60 | private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,ld.so.cache,mime.types,pki,resolv.conf,ssl,youtube-dl.conf | 61 | private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,ld.so.cache,mime.types,pki,resolv.conf,ssl,youtube-dl.conf |
61 | private-tmp | 62 | private-tmp |
62 | 63 | ||
64 | dbus-user none | ||
65 | dbus-system none | ||
66 | |||
63 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 67 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/profile-m-z/youtube-viewer.profile b/etc/profile-m-z/youtube-viewer.profile new file mode 100644 index 000000000..513cb0f6e --- /dev/null +++ b/etc/profile-m-z/youtube-viewer.profile | |||
@@ -0,0 +1,57 @@ | |||
1 | # Firejail profile for youtube-viewer | ||
2 | # Description: Trizen's CLI Youtube viewer with login support | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include youtube-viewer.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist /tmp/.X11-unix | ||
11 | blacklist ${RUNUSER}/wayland-* | ||
12 | blacklist ${RUNUSER} | ||
13 | |||
14 | noblacklist ${HOME}/.config/youtube-viewer | ||
15 | |||
16 | include allow-perl.inc | ||
17 | include allow-python2.inc | ||
18 | include allow-python3.inc | ||
19 | |||
20 | include disable-common.inc | ||
21 | include disable-devel.inc | ||
22 | include disable-exec.inc | ||
23 | include disable-interpreters.inc | ||
24 | include disable-passwdmgr.inc | ||
25 | include disable-programs.inc | ||
26 | include disable-xdg.inc | ||
27 | |||
28 | mkdir ${HOME}/.config/youtube-viewer | ||
29 | whitelist ${HOME}/.config/youtube-viewer | ||
30 | include whitelist-common.inc | ||
31 | include whitelist-usr-share-common.inc | ||
32 | include whitelist-var-common.inc | ||
33 | |||
34 | apparmor | ||
35 | caps.drop all | ||
36 | netfilter | ||
37 | nodvd | ||
38 | nogroups | ||
39 | nonewprivs | ||
40 | noroot | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix,inet,inet6 | ||
45 | seccomp | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | disable-mnt | ||
50 | # private-bin ffmpeg,ffprobe,firefox,gtk-youtube-viewer,gtk2-youtube-viewer,gtk3-youtube-viewer,mpv,python*,smplayer,sh,which,vlc,youtube-dl,youtube-viewer | ||
51 | private-cache | ||
52 | private-dev | ||
53 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg | ||
54 | private-tmp | ||
55 | |||
56 | dbus-user none | ||
57 | dbus-system none \ No newline at end of file | ||
diff --git a/etc/zaproxy.profile b/etc/profile-m-z/zaproxy.profile index 6228ff3bd..6228ff3bd 100644 --- a/etc/zaproxy.profile +++ b/etc/profile-m-z/zaproxy.profile | |||
diff --git a/etc/zart.profile b/etc/profile-m-z/zart.profile index 347bed8b6..ca35e3b51 100644 --- a/etc/zart.profile +++ b/etc/profile-m-z/zart.profile | |||
@@ -15,12 +15,12 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | caps.drop all | 21 | caps.drop all |
21 | ipc-namespace | 22 | ipc-namespace |
22 | net none | 23 | net none |
23 | nodbus | ||
24 | nodvd | 24 | nodvd |
25 | nogroups | 25 | nogroups |
26 | nonewprivs | 26 | nonewprivs |
@@ -34,3 +34,5 @@ shell none | |||
34 | private-bin ffmpeg,ffplay,ffprobe,melt,zart | 34 | private-bin ffmpeg,ffplay,ffprobe,melt,zart |
35 | private-dev | 35 | private-dev |
36 | 36 | ||
37 | dbus-user none | ||
38 | dbus-system none | ||
diff --git a/etc/zathura.profile b/etc/profile-m-z/zathura.profile index 703c8edd4..5274e5b42 100644 --- a/etc/zathura.profile +++ b/etc/profile-m-z/zathura.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | mkdir ${HOME}/.config/zathura | 22 | mkdir ${HOME}/.config/zathura |
@@ -25,11 +26,11 @@ whitelist /usr/share/zathura | |||
25 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
27 | 28 | ||
29 | apparmor | ||
28 | caps.drop all | 30 | caps.drop all |
29 | ipc-namespace | 31 | ipc-namespace |
30 | machine-id | 32 | machine-id |
31 | net none | 33 | net none |
32 | nodbus | ||
33 | nodvd | 34 | nodvd |
34 | nogroups | 35 | nogroups |
35 | nonewprivs | 36 | nonewprivs |
@@ -47,9 +48,13 @@ private-bin zathura | |||
47 | private-cache | 48 | private-cache |
48 | private-dev | 49 | private-dev |
49 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id | 50 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id |
50 | private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,libarchive.so.*,libdjvulibre.so.*,libgirara-gtk*,libpoppler-glib.so.*,libspectre.so.*,zathura | 51 | # private-lib has problems on Debian 10 |
52 | #private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,libarchive.so.*,libdjvulibre.so.*,libgirara-gtk*,libpoppler-glib.so.*,libspectre.so.*,zathura | ||
51 | private-tmp | 53 | private-tmp |
52 | 54 | ||
55 | dbus-user none | ||
56 | dbus-system none | ||
57 | |||
53 | read-only ${HOME} | 58 | read-only ${HOME} |
54 | read-write ${HOME}/.config/zathura | 59 | read-write ${HOME}/.config/zathura |
55 | read-write ${HOME}/.local/share/zathura | 60 | read-write ${HOME}/.local/share/zathura |
diff --git a/etc/zcat.profile b/etc/profile-m-z/zcat.profile index 12932ea92..bbac50712 100644 --- a/etc/zcat.profile +++ b/etc/profile-m-z/zcat.profile | |||
@@ -7,5 +7,8 @@ include zcat.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | # Allow running kernel config check | ||
11 | noblacklist /proc/config.gz | ||
12 | |||
10 | # Redirect | 13 | # Redirect |
11 | include gzip.profile | 14 | include gzip.profile |
diff --git a/etc/zcmp.profile b/etc/profile-m-z/zcmp.profile index 795cdae2a..795cdae2a 100644 --- a/etc/zcmp.profile +++ b/etc/profile-m-z/zcmp.profile | |||
diff --git a/etc/zdiff.profile b/etc/profile-m-z/zdiff.profile index 1e75e38fe..1e75e38fe 100644 --- a/etc/zdiff.profile +++ b/etc/profile-m-z/zdiff.profile | |||
diff --git a/etc/zeal.profile b/etc/profile-m-z/zeal.profile index f0fa29aa3..2d0d944fd 100644 --- a/etc/zeal.profile +++ b/etc/profile-m-z/zeal.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for zeal | 1 | # Firejail profile for zeal |
2 | # Description: Offline documentation browser | 2 | # Description: Offline API documentation browser |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include zeal.local | 5 | include zeal.local |
@@ -16,13 +16,15 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | mkdir ${HOME}/.config/Zeal | ||
22 | mkdir ${HOME}/.cache/Zeal | 22 | mkdir ${HOME}/.cache/Zeal |
23 | mkdir ${HOME}/.config/qt5ct | ||
24 | mkdir ${HOME}/.config/Zeal | ||
23 | mkdir ${HOME}/.local/share/Zeal | 25 | mkdir ${HOME}/.local/share/Zeal |
24 | whitelist ${HOME}/.config/Zeal | ||
25 | whitelist ${HOME}/.cache/Zeal | 26 | whitelist ${HOME}/.cache/Zeal |
27 | whitelist ${HOME}/.config/Zeal | ||
26 | whitelist ${HOME}/.local/share/Zeal | 28 | whitelist ${HOME}/.local/share/Zeal |
27 | include whitelist-common.inc | 29 | include whitelist-common.inc |
28 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
@@ -32,7 +34,6 @@ caps.drop all | |||
32 | machine-id | 34 | machine-id |
33 | netfilter | 35 | netfilter |
34 | no3d | 36 | no3d |
35 | nodbus | ||
36 | nodvd | 37 | nodvd |
37 | nogroups | 38 | nogroups |
38 | nonewprivs | 39 | nonewprivs |
@@ -41,7 +42,7 @@ nosound | |||
41 | notv | 42 | notv |
42 | nou2f | 43 | nou2f |
43 | novideo | 44 | novideo |
44 | protocol unix,inet,inet6 | 45 | protocol unix,inet,inet6,netlink |
45 | seccomp | 46 | seccomp |
46 | shell none | 47 | shell none |
47 | tracelog | 48 | tracelog |
@@ -53,4 +54,7 @@ private-dev | |||
53 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssl,Trolltech.conf,X11,xdg | 54 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssl,Trolltech.conf,X11,xdg |
54 | private-tmp | 55 | private-tmp |
55 | 56 | ||
56 | memory-deny-write-execute | 57 | dbus-user none |
58 | dbus-system none | ||
59 | |||
60 | # memory-deny-write-execute - breaks on Arch | ||
diff --git a/etc/zegrep.profile b/etc/profile-m-z/zegrep.profile index 54dc6b2a0..54dc6b2a0 100644 --- a/etc/zegrep.profile +++ b/etc/profile-m-z/zegrep.profile | |||
diff --git a/etc/zfgrep.profile b/etc/profile-m-z/zfgrep.profile index 73b22f2e8..73b22f2e8 100644 --- a/etc/zfgrep.profile +++ b/etc/profile-m-z/zfgrep.profile | |||
diff --git a/etc/zforce.profile b/etc/profile-m-z/zforce.profile index d62e57065..d62e57065 100644 --- a/etc/zforce.profile +++ b/etc/profile-m-z/zforce.profile | |||
diff --git a/etc/zgrep.profile b/etc/profile-m-z/zgrep.profile index b39a58420..0e7151400 100644 --- a/etc/zgrep.profile +++ b/etc/profile-m-z/zgrep.profile | |||
@@ -7,5 +7,8 @@ include zgrep.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | # Allow running kernel config check | ||
11 | noblacklist /proc/config.gz | ||
12 | |||
10 | # Redirect | 13 | # Redirect |
11 | include gzip.profile | 14 | include gzip.profile |
diff --git a/etc/zless.profile b/etc/profile-m-z/zless.profile index 0a26cda1f..0a26cda1f 100644 --- a/etc/zless.profile +++ b/etc/profile-m-z/zless.profile | |||
diff --git a/etc/zmore.profile b/etc/profile-m-z/zmore.profile index 3a8f63562..3a8f63562 100644 --- a/etc/zmore.profile +++ b/etc/profile-m-z/zmore.profile | |||
diff --git a/etc/znew.profile b/etc/profile-m-z/znew.profile index a8593e58e..a8593e58e 100644 --- a/etc/znew.profile +++ b/etc/profile-m-z/znew.profile | |||
diff --git a/etc/zoom.profile b/etc/profile-m-z/zoom.profile index 6d312aff6..b3125ee50 100644 --- a/etc/zoom.profile +++ b/etc/profile-m-z/zoom.profile | |||
@@ -10,8 +10,11 @@ noblacklist ${HOME}/.zoom | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | ||
15 | 18 | ||
16 | mkdir ${HOME}/.cache/zoom | 19 | mkdir ${HOME}/.cache/zoom |
17 | mkfile ${HOME}/.config/zoomus.conf | 20 | mkfile ${HOME}/.config/zoomus.conf |
@@ -20,14 +23,25 @@ whitelist ${HOME}/.cache/zoom | |||
20 | whitelist ${HOME}/.config/zoomus.conf | 23 | whitelist ${HOME}/.config/zoomus.conf |
21 | whitelist ${HOME}/.zoom | 24 | whitelist ${HOME}/.zoom |
22 | include whitelist-common.inc | 25 | include whitelist-common.inc |
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
23 | 29 | ||
24 | caps.drop all | 30 | caps.drop all |
25 | netfilter | 31 | netfilter |
26 | nodvd | 32 | nodvd |
33 | nogroups | ||
27 | nonewprivs | 34 | nonewprivs |
28 | noroot | 35 | noroot |
29 | notv | 36 | notv |
30 | protocol unix,inet,inet6 | 37 | nou2f |
31 | seccomp | 38 | protocol unix,inet,inet6,netlink |
39 | seccomp !chroot | ||
40 | shell none | ||
41 | tracelog | ||
32 | 42 | ||
43 | disable-mnt | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl | ||
33 | private-tmp | 47 | private-tmp |
diff --git a/etc/zpaq.profile b/etc/profile-m-z/zpaq.profile index 80329ecfd..80329ecfd 100644 --- a/etc/zpaq.profile +++ b/etc/profile-m-z/zpaq.profile | |||
diff --git a/etc/zstd.profile b/etc/profile-m-z/zstd.profile index 93b849568..be27c10e1 100644 --- a/etc/zstd.profile +++ b/etc/profile-m-z/zstd.profile | |||
@@ -23,7 +23,6 @@ ipc-namespace | |||
23 | machine-id | 23 | machine-id |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
diff --git a/etc/zstdcat.profile b/etc/profile-m-z/zstdcat.profile index ce9af3286..ce9af3286 100644 --- a/etc/zstdcat.profile +++ b/etc/profile-m-z/zstdcat.profile | |||
diff --git a/etc/zstdgrep.profile b/etc/profile-m-z/zstdgrep.profile index ce9af3286..ce9af3286 100644 --- a/etc/zstdgrep.profile +++ b/etc/profile-m-z/zstdgrep.profile | |||
diff --git a/etc/zstdless.profile b/etc/profile-m-z/zstdless.profile index ce9af3286..ce9af3286 100644 --- a/etc/zstdless.profile +++ b/etc/profile-m-z/zstdless.profile | |||
diff --git a/etc/zstdmt.profile b/etc/profile-m-z/zstdmt.profile index ce9af3286..ce9af3286 100644 --- a/etc/zstdmt.profile +++ b/etc/profile-m-z/zstdmt.profile | |||
diff --git a/etc/zulip.profile b/etc/profile-m-z/zulip.profile index 999c2f77a..993f2a64b 100644 --- a/etc/zulip.profile +++ b/etc/profile-m-z/zulip.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | mkdir ${HOME}/.config/Zulip | 22 | mkdir ${HOME}/.config/Zulip |
diff --git a/etc/ranger.profile b/etc/ranger.profile deleted file mode 100644 index bcf39095b..000000000 --- a/etc/ranger.profile +++ /dev/null | |||
@@ -1,42 +0,0 @@ | |||
1 | # Firejail profile for ranger | ||
2 | # Description: File manager with an ncurses frontend written in Python | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ranger.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/nano | ||
10 | noblacklist ${HOME}/.config/ranger | ||
11 | noblacklist ${HOME}/.nanorc | ||
12 | |||
13 | # Allow python (blacklisted by disable-interpreters.inc) | ||
14 | include allow-python2.inc | ||
15 | include allow-python3.inc | ||
16 | |||
17 | # Allow perl | ||
18 | include allow-perl.inc | ||
19 | |||
20 | include disable-common.inc | ||
21 | include disable-devel.inc | ||
22 | include disable-interpreters.inc | ||
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | ||
25 | |||
26 | allusers | ||
27 | caps.drop all | ||
28 | net none | ||
29 | nodbus | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | nosound | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix | ||
39 | seccomp | ||
40 | #x11 none | ||
41 | |||
42 | private-dev | ||
diff --git a/etc/templates/profile.template b/etc/templates/profile.template index 0362b82af..02d9fa076 100644 --- a/etc/templates/profile.template +++ b/etc/templates/profile.template | |||
@@ -27,11 +27,13 @@ | |||
27 | # ALLOW INCLUDES | 27 | # ALLOW INCLUDES |
28 | # BLACKLISTS | 28 | # BLACKLISTS |
29 | # DISABLE INCLUDES | 29 | # DISABLE INCLUDES |
30 | # NOWHITELISTS | ||
30 | # MKDIRS | 31 | # MKDIRS |
31 | # WHITELISTS | 32 | # WHITELISTS |
32 | # WHITELIST INCLUDES | 33 | # WHITELIST INCLUDES |
33 | # OPTIONS (caps*, net*, no*, protocol, seccomp*, shell none, tracelog) | 34 | # OPTIONS (caps*, net*, no*, protocol, seccomp*, shell none, tracelog) |
34 | # PRIVATE OPTIONS (disable-mnt, private-*, writable-*) | 35 | # PRIVATE OPTIONS (disable-mnt, private-*, writable-*) |
36 | # DBUS FILTER | ||
35 | # SPECIAL OPTIONS (mdwx, noexec, read-only, join-or-start) | 37 | # SPECIAL OPTIONS (mdwx, noexec, read-only, join-or-start) |
36 | # REDIRECT INCLUDES | 38 | # REDIRECT INCLUDES |
37 | # | 39 | # |
@@ -62,6 +64,8 @@ include globals.local | |||
62 | #blacklist /tmp/.X11-unix | 64 | #blacklist /tmp/.X11-unix |
63 | # Disable Wayland | 65 | # Disable Wayland |
64 | #blacklist ${RUNUSER}/wayland-* | 66 | #blacklist ${RUNUSER}/wayland-* |
67 | # Disable RUNUSER (cli only) | ||
68 | #blacklist ${RUNUSER} | ||
65 | 69 | ||
66 | # It is common practice to add files/dirs containing program-specific configuration | 70 | # It is common practice to add files/dirs containing program-specific configuration |
67 | # (often ${HOME}/PROGRAMNAME or ${HOME}/.config/PROGRAMNAME) into disable-programs.inc | 71 | # (often ${HOME}/PROGRAMNAME or ${HOME}/.config/PROGRAMNAME) into disable-programs.inc |
@@ -105,6 +109,7 @@ include globals.local | |||
105 | #include disable-interpreters.inc | 109 | #include disable-interpreters.inc |
106 | #include disable-passwdmgr.inc | 110 | #include disable-passwdmgr.inc |
107 | #include disable-programs.inc | 111 | #include disable-programs.inc |
112 | #include disable-shell.inc | ||
108 | #include disable-xdg.inc | 113 | #include disable-xdg.inc |
109 | 114 | ||
110 | # This section often mirrors noblacklist section above. The idea is | 115 | # This section often mirrors noblacklist section above. The idea is |
@@ -116,6 +121,7 @@ include globals.local | |||
116 | ##mkfile PATH | 121 | ##mkfile PATH |
117 | #whitelist PATH | 122 | #whitelist PATH |
118 | #include whitelist-common.inc | 123 | #include whitelist-common.inc |
124 | #include whitelist-runuser-common.inc | ||
119 | #include whitelist-usr-share-common.inc | 125 | #include whitelist-usr-share-common.inc |
120 | #include whitelist-var-common.inc | 126 | #include whitelist-var-common.inc |
121 | 127 | ||
@@ -132,7 +138,7 @@ include globals.local | |||
132 | #net none | 138 | #net none |
133 | #netfilter | 139 | #netfilter |
134 | #no3d | 140 | #no3d |
135 | #nodbus | 141 | ##nodbus (deprecated, use 'dbus-user none' and 'dbus-system none', see below) |
136 | #nodvd | 142 | #nodvd |
137 | #nogroups | 143 | #nogroups |
138 | #nonewprivs | 144 | #nonewprivs |
@@ -182,6 +188,22 @@ include globals.local | |||
182 | ##writable-var | 188 | ##writable-var |
183 | ##writable-var-log | 189 | ##writable-var-log |
184 | 190 | ||
191 | # Since 0.9.63 also a more granular regulation of dbus is supported. | ||
192 | # To get the dbus-addresses to which an application needs access to. | ||
193 | # You can look at flatpak if the application is also distriputed via flatpak: | ||
194 | # flatpak remote-info --show-metadata flathub <APP-ID> | ||
195 | # Notes: | ||
196 | # - flatpak implicitly allows an app to own <APP-ID> on the session bus | ||
197 | # - In order to make dconf work (if it is used by the app) you need to allow | ||
198 | # 'ca.desrt.dconf' even if it is not allowed by flatpak. | ||
199 | # Notes and Policiy about addresses can be found at | ||
200 | # <https://github.com/netblue30/firejail/wiki/Restrict-D-Bus> | ||
201 | #dbus-user filter | ||
202 | #dbus-user.own com.github.netblue30.firejail | ||
203 | #dbus-user.talk ca.desrt.dconf | ||
204 | #dbus-user.talk org.freedesktop.Notifications | ||
205 | #dbus-system none | ||
206 | |||
185 | ##env VAR=VALUE | 207 | ##env VAR=VALUE |
186 | #memory-deny-write-execute | 208 | #memory-deny-write-execute |
187 | ##noexec PATH | 209 | ##noexec PATH |