aboutsummaryrefslogtreecommitdiffstats
path: root/etc
diff options
context:
space:
mode:
Diffstat (limited to 'etc')
-rw-r--r--etc/firejail.config3
-rw-r--r--etc/inc/allow-common-devel.inc5
-rw-r--r--etc/inc/allow-ruby.inc1
-rw-r--r--etc/inc/disable-interpreters.inc1
-rw-r--r--etc/inc/disable-proc.inc82
-rw-r--r--etc/inc/disable-programs.inc4
-rw-r--r--etc/inc/whitelist-run-common.inc1
-rw-r--r--etc/profile-a-l/Books.profile5
-rw-r--r--etc/profile-a-l/alienarena.profile1
-rw-r--r--etc/profile-a-l/amarok.profile2
-rw-r--r--etc/profile-a-l/amule.profile1
-rw-r--r--etc/profile-a-l/blobwars.profile2
-rw-r--r--etc/profile-a-l/build-systems-common.profile66
-rw-r--r--etc/profile-a-l/bundle.profile23
-rw-r--r--etc/profile-a-l/cargo.profile56
-rw-r--r--etc/profile-a-l/cmake.profile13
-rw-r--r--etc/profile-a-l/codium.profile10
-rw-r--r--etc/profile-a-l/flameshot.profile4
-rw-r--r--etc/profile-a-l/frozen-bubble.profile1
-rw-r--r--etc/profile-a-l/funnyboat.profile1
-rw-r--r--etc/profile-a-l/gl-117.profile1
-rw-r--r--etc/profile-a-l/glaxium.profile1
-rw-r--r--etc/profile-a-l/imv.profile57
-rw-r--r--etc/profile-a-l/jumpnbump-menu.profile2
-rw-r--r--etc/profile-a-l/jumpnbump.profile1
-rw-r--r--etc/profile-a-l/keepassxc.profile5
-rw-r--r--etc/profile-m-z/make.profile13
-rw-r--r--etc/profile-m-z/meson.profile14
-rw-r--r--etc/profile-m-z/mrrescue.profile1
-rw-r--r--etc/profile-m-z/neochat.profile2
-rw-r--r--etc/profile-m-z/nextcloud.profile3
-rw-r--r--etc/profile-m-z/nheko.profile3
-rw-r--r--etc/profile-m-z/open-invaders.profile1
-rw-r--r--etc/profile-m-z/openclonk.profile1
-rw-r--r--etc/profile-m-z/pip.profile18
-rw-r--r--etc/profile-m-z/retroarch.profile54
-rw-r--r--etc/profile-m-z/spectral.profile8
-rw-r--r--etc/profile-m-z/supertux2.profile1
-rw-r--r--etc/profile-m-z/teeworlds.profile1
-rw-r--r--etc/profile-m-z/telegram.profile2
-rw-r--r--etc/profile-m-z/torbrowser.profile26
-rw-r--r--etc/profile-m-z/torcs.profile1
-rw-r--r--etc/profile-m-z/tremulous.profile5
-rw-r--r--etc/profile-m-z/vscodium.profile4
-rw-r--r--etc/profile-m-z/warsow.profile8
-rw-r--r--etc/profile-m-z/xonotic.profile1
-rw-r--r--etc/templates/profile.template1
47 files changed, 426 insertions, 91 deletions
diff --git a/etc/firejail.config b/etc/firejail.config
index aec152b85..7912b746c 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -2,6 +2,9 @@
2# keyword-argument pairs, one per line. Most features are enabled by default. 2# keyword-argument pairs, one per line. Most features are enabled by default.
3# Use 'yes' or 'no' as configuration values. 3# Use 'yes' or 'no' as configuration values.
4 4
5# Allow programs to display a tray icon
6# allow-tray no
7
5# Enable AppArmor functionality, default enabled. 8# Enable AppArmor functionality, default enabled.
6# apparmor yes 9# apparmor yes
7 10
diff --git a/etc/inc/allow-common-devel.inc b/etc/inc/allow-common-devel.inc
index 011bbe226..4e460fc10 100644
--- a/etc/inc/allow-common-devel.inc
+++ b/etc/inc/allow-common-devel.inc
@@ -27,5 +27,8 @@ noblacklist ${HOME}/.python-history
27noblacklist ${HOME}/.python_history 27noblacklist ${HOME}/.python_history
28noblacklist ${HOME}/.pythonhist 28noblacklist ${HOME}/.pythonhist
29 29
30# Ruby
31noblacklist ${HOME}/.bundle
32
30# Rust 33# Rust
31noblacklist ${HOME}/.cargo/* 34noblacklist ${HOME}/.cargo
diff --git a/etc/inc/allow-ruby.inc b/etc/inc/allow-ruby.inc
index a8c701219..00276cac7 100644
--- a/etc/inc/allow-ruby.inc
+++ b/etc/inc/allow-ruby.inc
@@ -4,3 +4,4 @@ include allow-ruby.local
4 4
5noblacklist ${PATH}/ruby 5noblacklist ${PATH}/ruby
6noblacklist /usr/lib/ruby 6noblacklist /usr/lib/ruby
7noblacklist /usr/lib64/ruby
diff --git a/etc/inc/disable-interpreters.inc b/etc/inc/disable-interpreters.inc
index 5d8a236fb..804869e2a 100644
--- a/etc/inc/disable-interpreters.inc
+++ b/etc/inc/disable-interpreters.inc
@@ -48,6 +48,7 @@ blacklist /usr/share/php*
48# Ruby 48# Ruby
49blacklist ${PATH}/ruby 49blacklist ${PATH}/ruby
50blacklist /usr/lib/ruby 50blacklist /usr/lib/ruby
51blacklist /usr/lib64/ruby
51 52
52# Programs using python: deluge, firefox addons, filezilla, cherrytree, xchat, hexchat, libreoffice, scribus 53# Programs using python: deluge, firefox addons, filezilla, cherrytree, xchat, hexchat, libreoffice, scribus
53# Python 2 54# Python 2
diff --git a/etc/inc/disable-proc.inc b/etc/inc/disable-proc.inc
new file mode 100644
index 000000000..81a8883f3
--- /dev/null
+++ b/etc/inc/disable-proc.inc
@@ -0,0 +1,82 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include disable-proc.local
4
5blacklist /proc/acpi
6blacklist /proc/asound
7blacklist /proc/bootconfig
8blacklist /proc/buddyinfo
9blacklist /proc/cgroups
10blacklist /proc/cmdline
11blacklist /proc/config.gz
12blacklist /proc/consoles
13#blacklist /proc/cpuinfo
14blacklist /proc/crypto
15blacklist /proc/devices
16blacklist /proc/diskstats
17blacklist /proc/dma
18#blacklist /proc/driver
19blacklist /proc/dynamic_debug
20blacklist /proc/execdomains
21blacklist /proc/fb
22#blacklist /proc/filesystems
23blacklist /proc/fs
24blacklist /proc/i8k
25blacklist /proc/interrupts
26blacklist /proc/iomem
27blacklist /proc/ioports
28blacklist /proc/irq
29blacklist /proc/kallsyms
30blacklist /proc/kcore
31blacklist /proc/keys
32blacklist /proc/key-users
33blacklist /proc/kmsg
34blacklist /proc/kpagecgroup
35blacklist /proc/kpagecount
36blacklist /proc/kpageflags
37blacklist /proc/latency_stats
38#blacklist /proc/loadavg
39blacklist /proc/locks
40blacklist /proc/mdstat
41#blacklist /proc/meminfo
42blacklist /proc/misc
43#blacklist /proc/modules
44#blacklist /proc/mounts
45blacklist /proc/mtrr
46#blacklist /proc/net
47blacklist /proc/partitions
48blacklist /proc/pressure
49blacklist /proc/sched_debug
50blacklist /proc/schedstat
51blacklist /proc/scsi
52#blacklist /proc/self
53blacklist /proc/slabinfo
54blacklist /proc/softirqs
55blacklist /proc/spl
56#blacklist /proc/stat
57blacklist /proc/swaps
58#blacklist /proc/sys
59blacklist /proc/sysrq-trigger
60blacklist /proc/sysvipc
61#blacklist /proc/thread-self
62blacklist /proc/timer_list
63blacklist /proc/tty
64#blacklist /proc/uptime
65#blacklist /proc/version
66blacklist /proc/version_signature
67blacklist /proc/vmallocinfo
68#blacklist /proc/vmstat
69#blacklist /proc/zoneinfo
70
71blacklist /proc/sys/abi
72blacklist /proc/sys/crypto
73blacklist /proc/sys/debug
74blacklist /proc/sys/dev
75blacklist /proc/sys/fs
76blacklist /proc/sys/net
77blacklist /proc/sys/user
78blacklist /proc/sys/vm
79
80noblacklist /proc/sys/kernel/osrelease
81noblacklist /proc/sys/kernel/yama
82blacklist /proc/sys/*/*
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index 511d8730e..6734e220a 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -49,8 +49,9 @@ blacklist ${HOME}/.bibletime
49blacklist ${HOME}/.bitcoin 49blacklist ${HOME}/.bitcoin
50blacklist ${HOME}/.blobby 50blacklist ${HOME}/.blobby
51blacklist ${HOME}/.bogofilter 51blacklist ${HOME}/.bogofilter
52blacklist ${HOME}/.bundle
52blacklist ${HOME}/.bzf 53blacklist ${HOME}/.bzf
53blacklist ${HOME}/.cargo/* 54blacklist ${HOME}/.cargo
54blacklist ${HOME}/.claws-mail 55blacklist ${HOME}/.claws-mail
55blacklist ${HOME}/.cliqz 56blacklist ${HOME}/.cliqz
56blacklist ${HOME}/.clion* 57blacklist ${HOME}/.clion*
@@ -142,6 +143,7 @@ blacklist ${HOME}/.config/SubDownloader
142blacklist ${HOME}/.config/Thunar 143blacklist ${HOME}/.config/Thunar
143blacklist ${HOME}/.config/Twitch 144blacklist ${HOME}/.config/Twitch
144blacklist ${HOME}/.config/Unknown Organization 145blacklist ${HOME}/.config/Unknown Organization
146blacklist ${HOME}/.config/VSCodium
145blacklist ${HOME}/.config/VirtualBox 147blacklist ${HOME}/.config/VirtualBox
146blacklist ${HOME}/.config/Whalebird 148blacklist ${HOME}/.config/Whalebird
147blacklist ${HOME}/.config/Wire 149blacklist ${HOME}/.config/Wire
diff --git a/etc/inc/whitelist-run-common.inc b/etc/inc/whitelist-run-common.inc
index 224d21064..0d87657a9 100644
--- a/etc/inc/whitelist-run-common.inc
+++ b/etc/inc/whitelist-run-common.inc
@@ -7,5 +7,6 @@ whitelist /run/cups/cups.sock
7whitelist /run/dbus/system_bus_socket 7whitelist /run/dbus/system_bus_socket
8whitelist /run/media 8whitelist /run/media
9whitelist /run/resolvconf/resolv.conf 9whitelist /run/resolvconf/resolv.conf
10whitelist /run/shm
10whitelist /run/systemd/resolve/resolv.conf 11whitelist /run/systemd/resolve/resolv.conf
11whitelist /run/systemd/resolve/stub-resolv.conf 12whitelist /run/systemd/resolve/stub-resolv.conf
diff --git a/etc/profile-a-l/Books.profile b/etc/profile-a-l/Books.profile
index 76fd21d32..a256e942f 100644
--- a/etc/profile-a-l/Books.profile
+++ b/etc/profile-a-l/Books.profile
@@ -1,5 +1,10 @@
1# Firejail profile for gnome-books 1# Firejail profile for gnome-books
2# This file is overwritten after every install/update 2# This file is overwritten after every install/update
3# Persistent local customizations
4include Books.local
5# Persistent global definitions
6# added by included profile
7#include globals.local
3 8
4 9
5# Temporary fix for https://github.com/netblue30/firejail/issues/2624 10# Temporary fix for https://github.com/netblue30/firejail/issues/2624
diff --git a/etc/profile-a-l/alienarena.profile b/etc/profile-a-l/alienarena.profile
index 62857a3e2..68512e37b 100644
--- a/etc/profile-a-l/alienarena.profile
+++ b/etc/profile-a-l/alienarena.profile
@@ -29,7 +29,6 @@ caps.drop all
29netfilter 29netfilter
30nodvd 30nodvd
31nogroups 31nogroups
32noinput
33nonewprivs 32nonewprivs
34noroot 33noroot
35notv 34notv
diff --git a/etc/profile-a-l/amarok.profile b/etc/profile-a-l/amarok.profile
index e7b78f7d0..7d8ec481d 100644
--- a/etc/profile-a-l/amarok.profile
+++ b/etc/profile-a-l/amarok.profile
@@ -39,7 +39,7 @@ dbus-user.own org.kde.amarok
39dbus-user.own org.mpris.amarok 39dbus-user.own org.mpris.amarok
40dbus-user.own org.mpris.MediaPlayer2.amarok 40dbus-user.own org.mpris.MediaPlayer2.amarok
41dbus-user.talk org.freedesktop.Notifications 41dbus-user.talk org.freedesktop.Notifications
42dbus-user.talk org.kde.StatusNotifierWatcher 42?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
43# If you're not on kde-plasma add the next lines to your amarok.local. 43# If you're not on kde-plasma add the next lines to your amarok.local.
44#dbus-user.own org.kde.kded 44#dbus-user.own org.kde.kded
45#dbus-user.own org.kde.klauncher 45#dbus-user.own org.kde.klauncher
diff --git a/etc/profile-a-l/amule.profile b/etc/profile-a-l/amule.profile
index 3ce05c5bc..e82c145d1 100644
--- a/etc/profile-a-l/amule.profile
+++ b/etc/profile-a-l/amule.profile
@@ -32,6 +32,7 @@ nosound
32notv 32notv
33nou2f 33nou2f
34novideo 34novideo
35# Add netlink protocol to use UPnP
35protocol unix,inet,inet6 36protocol unix,inet,inet6
36seccomp 37seccomp
37shell none 38shell none
diff --git a/etc/profile-a-l/blobwars.profile b/etc/profile-a-l/blobwars.profile
index 683a7858b..66f38b358 100644
--- a/etc/profile-a-l/blobwars.profile
+++ b/etc/profile-a-l/blobwars.profile
@@ -19,6 +19,7 @@ include disable-xdg.inc
19mkdir ${HOME}/.parallelrealities/blobwars 19mkdir ${HOME}/.parallelrealities/blobwars
20whitelist ${HOME}/.parallelrealities/blobwars 20whitelist ${HOME}/.parallelrealities/blobwars
21whitelist /usr/share/blobwars 21whitelist /usr/share/blobwars
22whitelist /usr/share/games/blobwars
22include whitelist-common.inc 23include whitelist-common.inc
23include whitelist-usr-share-common.inc 24include whitelist-usr-share-common.inc
24include whitelist-var-common.inc 25include whitelist-var-common.inc
@@ -28,7 +29,6 @@ caps.drop all
28net none 29net none
29nodvd 30nodvd
30nogroups 31nogroups
31noinput
32nonewprivs 32nonewprivs
33noroot 33noroot
34notv 34notv
diff --git a/etc/profile-a-l/build-systems-common.profile b/etc/profile-a-l/build-systems-common.profile
new file mode 100644
index 000000000..1b199d612
--- /dev/null
+++ b/etc/profile-a-l/build-systems-common.profile
@@ -0,0 +1,66 @@
1# Firejail profile for build-systems-common
2# This file is overwritten after every install/update
3# Persistent local customizations
4include build-systems-common.local
5# Persistent global definitions
6# added by caller profile
7#include globals.local
8
9ignore noexec ${HOME}
10ignore noexec /tmp
11
12# Allow /bin/sh (blacklisted by disable-shell.inc)
13include allow-bin-sh.inc
14
15# Allows files commonly used by IDEs
16include allow-common-devel.inc
17
18# Allow ssh (blacklisted by disable-common.inc)
19#include allow-ssh.inc
20
21blacklist ${RUNUSER}
22
23include disable-common.inc
24include disable-exec.inc
25include disable-interpreters.inc
26include disable-programs.inc
27include disable-shell.inc
28include disable-X11.inc
29include disable-xdg.inc
30
31#whitelist ${HOME}/Projects
32#include whitelist-common.inc
33
34whitelist /usr/share/pkgconfig
35include whitelist-run-common.inc
36include whitelist-usr-share-common.inc
37include whitelist-var-common.inc
38
39caps.drop all
40ipc-namespace
41machine-id
42# net none
43netfilter
44no3d
45nodvd
46nogroups
47noinput
48nonewprivs
49noroot
50nosound
51notv
52nou2f
53novideo
54protocol unix,inet,inet6
55seccomp
56seccomp.block-secondary
57shell none
58tracelog
59
60disable-mnt
61private-cache
62private-dev
63private-tmp
64
65dbus-user none
66dbus-system none
diff --git a/etc/profile-a-l/bundle.profile b/etc/profile-a-l/bundle.profile
new file mode 100644
index 000000000..bb82022b1
--- /dev/null
+++ b/etc/profile-a-l/bundle.profile
@@ -0,0 +1,23 @@
1# Firejail profile for bundle
2# Description: Ruby Dependency Management
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include bundle.local
7# Persistent global definitions
8include globals.local
9
10noblacklist ${HOME}/.bundle
11
12# Allow ruby (blacklisted by disable-interpreters.inc)
13include allow-ruby.inc
14
15#whitelist ${HOME}/.bundle
16#whitelist ${HOME}/.gem
17#whitelist ${HOME}/.local/share/gem
18whitelist /usr/share/gems
19whitelist /usr/share/ruby
20whitelist /usr/share/rubygems
21
22# Redirect
23include build-systems-common.profile
diff --git a/etc/profile-a-l/cargo.profile b/etc/profile-a-l/cargo.profile
index ff46cd429..4c8afd895 100644
--- a/etc/profile-a-l/cargo.profile
+++ b/etc/profile-a-l/cargo.profile
@@ -7,66 +7,18 @@ include cargo.local
7# Persistent global definitions 7# Persistent global definitions
8include globals.local 8include globals.local
9 9
10ignore noexec ${HOME} 10ignore read-only ${HOME}/.cargo/bin
11ignore noexec /tmp
12
13blacklist /tmp/.X11-unix
14blacklist ${RUNUSER}
15 11
16noblacklist ${HOME}/.cargo/credentials 12noblacklist ${HOME}/.cargo/credentials
17noblacklist ${HOME}/.cargo/credentials.toml 13noblacklist ${HOME}/.cargo/credentials.toml
18 14
19# Allows files commonly used by IDEs
20include allow-common-devel.inc
21
22# Allow ssh (blacklisted by disable-common.inc)
23#include allow-ssh.inc
24
25include disable-common.inc
26include disable-exec.inc
27include disable-interpreters.inc
28include disable-programs.inc
29include disable-xdg.inc
30
31#mkdir ${HOME}/.cargo
32#whitelist ${HOME}/YOUR_CARGO_PROJECTS
33#whitelist ${HOME}/.cargo 15#whitelist ${HOME}/.cargo
34#whitelist ${HOME}/.rustup 16#whitelist ${HOME}/.rustup
35#include whitelist-common.inc
36whitelist /usr/share/pkgconfig
37include whitelist-runuser-common.inc
38include whitelist-usr-share-common.inc
39include whitelist-var-common.inc
40 17
41caps.drop all
42ipc-namespace
43machine-id
44netfilter
45no3d
46nodvd
47nogroups
48noinput
49nonewprivs
50noroot
51nosound
52notv
53nou2f
54novideo
55protocol unix,inet,inet6
56seccomp
57seccomp.block-secondary
58shell none
59tracelog
60
61disable-mnt
62#private-bin cargo,rustc 18#private-bin cargo,rustc
63private-cache
64private-dev
65private-etc alternatives,ca-certificates,crypto-policies,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,magic,magic.mgc,nsswitch.conf,passwd,pki,protocols,resolv.conf,rpc,services,ssl 19private-etc alternatives,ca-certificates,crypto-policies,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,magic,magic.mgc,nsswitch.conf,passwd,pki,protocols,resolv.conf,rpc,services,ssl
66private-tmp
67
68dbus-user none
69dbus-system none
70 20
71memory-deny-write-execute 21memory-deny-write-execute
72read-write ${HOME}/.cargo/bin 22
23# Redirect
24include build-systems-common.profile
diff --git a/etc/profile-a-l/cmake.profile b/etc/profile-a-l/cmake.profile
new file mode 100644
index 000000000..26cc2a00a
--- /dev/null
+++ b/etc/profile-a-l/cmake.profile
@@ -0,0 +1,13 @@
1# Firejail profile for cargo
2# Description: The Rust package manager
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include cargo.local
7# Persistent global definitions
8include globals.local
9
10memory-deny-write-execute
11
12# Redirect
13include build-systems-common.profile
diff --git a/etc/profile-a-l/codium.profile b/etc/profile-a-l/codium.profile
new file mode 100644
index 000000000..9ff87ed8a
--- /dev/null
+++ b/etc/profile-a-l/codium.profile
@@ -0,0 +1,10 @@
1# Firejail profile alias for VSCodium
2# This file is overwritten after every install/update
3# Persistent local customizations
4include codium.local
5# Persistent global definitions
6# added by included profile
7#include globals.local
8
9# Redirect
10include vscodium.profile
diff --git a/etc/profile-a-l/flameshot.profile b/etc/profile-a-l/flameshot.profile
index 5c7bc03d8..862ef6ab6 100644
--- a/etc/profile-a-l/flameshot.profile
+++ b/etc/profile-a-l/flameshot.profile
@@ -63,6 +63,6 @@ dbus-user.talk org.freedesktop.Notifications
63dbus-user.talk org.freedesktop.portal.Desktop 63dbus-user.talk org.freedesktop.portal.Desktop
64dbus-user.talk org.gnome.Shell 64dbus-user.talk org.gnome.Shell
65dbus-user.talk org.kde.KWin 65dbus-user.talk org.kde.KWin
66dbus-user.talk org.kde.StatusNotifierWatcher 66?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
67dbus-user.own org.kde.* 67?ALLOW_TRAY: dbus-user.own org.kde.*
68dbus-system none 68dbus-system none
diff --git a/etc/profile-a-l/frozen-bubble.profile b/etc/profile-a-l/frozen-bubble.profile
index bb35c9447..88943760a 100644
--- a/etc/profile-a-l/frozen-bubble.profile
+++ b/etc/profile-a-l/frozen-bubble.profile
@@ -30,7 +30,6 @@ caps.drop all
30net none 30net none
31nodvd 31nodvd
32nogroups 32nogroups
33noinput
34nonewprivs 33nonewprivs
35noroot 34noroot
36notv 35notv
diff --git a/etc/profile-a-l/funnyboat.profile b/etc/profile-a-l/funnyboat.profile
index 1009f345b..4a08fca9b 100644
--- a/etc/profile-a-l/funnyboat.profile
+++ b/etc/profile-a-l/funnyboat.profile
@@ -35,7 +35,6 @@ ipc-namespace
35netfilter 35netfilter
36nodvd 36nodvd
37nogroups 37nogroups
38noinput
39nonewprivs 38nonewprivs
40noroot 39noroot
41notv 40notv
diff --git a/etc/profile-a-l/gl-117.profile b/etc/profile-a-l/gl-117.profile
index 35d969e6d..edb85048b 100644
--- a/etc/profile-a-l/gl-117.profile
+++ b/etc/profile-a-l/gl-117.profile
@@ -29,7 +29,6 @@ caps.drop all
29net none 29net none
30nodvd 30nodvd
31nogroups 31nogroups
32noinput
33nonewprivs 32nonewprivs
34noroot 33noroot
35notv 34notv
diff --git a/etc/profile-a-l/glaxium.profile b/etc/profile-a-l/glaxium.profile
index dec0daef2..b5f98b411 100644
--- a/etc/profile-a-l/glaxium.profile
+++ b/etc/profile-a-l/glaxium.profile
@@ -29,7 +29,6 @@ caps.drop all
29net none 29net none
30nodvd 30nodvd
31nogroups 31nogroups
32noinput
33nonewprivs 32nonewprivs
34noroot 33noroot
35notv 34notv
diff --git a/etc/profile-a-l/imv.profile b/etc/profile-a-l/imv.profile
new file mode 100644
index 000000000..65e7537bf
--- /dev/null
+++ b/etc/profile-a-l/imv.profile
@@ -0,0 +1,57 @@
1# Firejail profile for imv
2# Description: imv is an image viewer.
3# This file is overwritten after every install/update
4# Persistent local customizations
5include imv.local
6# Persistent global definitions
7include globals.local
8
9include allow-bin-sh.inc
10
11blacklist /usr/libexec
12
13include disable-common.inc
14include disable-devel.inc
15include disable-exec.inc
16include disable-interpreters.inc
17include disable-programs.inc
18include disable-shell.inc
19include disable-write-mnt.inc
20# Users may want to view images in ${HOME}
21#include disable-xdg.inc
22
23# Users may want to view images in ${HOME}
24#include whitelist-common.inc
25include whitelist-run-common.inc
26include whitelist-runuser-common.inc
27# Users may want to view images in /usr/share
28#include whitelist-usr-share-common.inc
29include whitelist-var-common.inc
30
31apparmor
32caps.drop all
33net none
34nodvd
35nogroups
36noinput
37nonewprivs
38noroot
39nosound
40notv
41nou2f
42novideo
43protocol unix
44seccomp
45seccomp.block-secondary
46shell none
47tracelog
48
49private-bin imv,imv-wayland,imv-x11,sh
50private-cache
51private-dev
52private-tmp
53
54dbus-user none
55dbus-system none
56
57read-only ${HOME}
diff --git a/etc/profile-a-l/jumpnbump-menu.profile b/etc/profile-a-l/jumpnbump-menu.profile
index 8d391b90f..59d762f55 100644
--- a/etc/profile-a-l/jumpnbump-menu.profile
+++ b/etc/profile-a-l/jumpnbump-menu.profile
@@ -10,7 +10,7 @@ include jumpnbump-menu.local
10# Allow python (blacklisted by disable-interpreters.inc) 10# Allow python (blacklisted by disable-interpreters.inc)
11include allow-python3.inc 11include allow-python3.inc
12 12
13private-bin jumpnbump-menu,python3* 13private-bin env,jumpnbump-menu,python3*
14 14
15# Redirect 15# Redirect
16include jumpnbump.profile 16include jumpnbump.profile
diff --git a/etc/profile-a-l/jumpnbump.profile b/etc/profile-a-l/jumpnbump.profile
index b9bc8f219..9726ff6fe 100644
--- a/etc/profile-a-l/jumpnbump.profile
+++ b/etc/profile-a-l/jumpnbump.profile
@@ -27,7 +27,6 @@ caps.drop all
27net none 27net none
28nodvd 28nodvd
29nogroups 29nogroups
30noinput
31nonewprivs 30nonewprivs
32noroot 31noroot
33notv 32notv
diff --git a/etc/profile-a-l/keepassxc.profile b/etc/profile-a-l/keepassxc.profile
index 0f3e6605b..45a707071 100644
--- a/etc/profile-a-l/keepassxc.profile
+++ b/etc/profile-a-l/keepassxc.profile
@@ -98,11 +98,10 @@ dbus-user.talk org.freedesktop.ScreenSaver
98dbus-user.talk org.gnome.ScreenSaver 98dbus-user.talk org.gnome.ScreenSaver
99dbus-user.talk org.gnome.SessionManager 99dbus-user.talk org.gnome.SessionManager
100dbus-user.talk org.xfce.ScreenSaver 100dbus-user.talk org.xfce.ScreenSaver
101?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
102?ALLOW_TRAY: dbus-user.own org.kde.*
101# Add the next line to your keepassxc.local to allow notifications. 103# Add the next line to your keepassxc.local to allow notifications.
102#dbus-user.talk org.freedesktop.Notifications 104#dbus-user.talk org.freedesktop.Notifications
103# Add the next line to your keepassxc.local to allow the tray menu.
104#dbus-user.talk org.kde.StatusNotifierWatcher
105#dbus-user.own org.kde.*
106dbus-system filter 105dbus-system filter
107dbus-system.talk org.freedesktop.login1 106dbus-system.talk org.freedesktop.login1
108 107
diff --git a/etc/profile-m-z/make.profile b/etc/profile-m-z/make.profile
new file mode 100644
index 000000000..7e9638fe4
--- /dev/null
+++ b/etc/profile-m-z/make.profile
@@ -0,0 +1,13 @@
1# Firejail profile for make
2# Description: GNU make utility to maintain groups of programs
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include make.local
7# Persistent global definitions
8include globals.local
9
10memory-deny-write-execute
11
12# Redirect
13include build-systems-common.profile
diff --git a/etc/profile-m-z/meson.profile b/etc/profile-m-z/meson.profile
new file mode 100644
index 000000000..b4909a9d8
--- /dev/null
+++ b/etc/profile-m-z/meson.profile
@@ -0,0 +1,14 @@
1# Firejail profile for meson
2# Description: A high productivity build system
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include meson.local
7# Persistent global definitions
8include globals.local
9
10# Allow python3 (blacklisted by disable-interpreters.inc)
11include allow-python3.inc
12
13# Redirect
14include build-systems-common.profile
diff --git a/etc/profile-m-z/mrrescue.profile b/etc/profile-m-z/mrrescue.profile
index 16dc97d0c..5b5902563 100644
--- a/etc/profile-m-z/mrrescue.profile
+++ b/etc/profile-m-z/mrrescue.profile
@@ -37,7 +37,6 @@ caps.drop all
37net none 37net none
38nodvd 38nodvd
39nogroups 39nogroups
40noinput
41nonewprivs 40nonewprivs
42noroot 41noroot
43notv 42notv
diff --git a/etc/profile-m-z/neochat.profile b/etc/profile-m-z/neochat.profile
index 58cc716d9..0f55b674f 100644
--- a/etc/profile-m-z/neochat.profile
+++ b/etc/profile-m-z/neochat.profile
@@ -60,6 +60,6 @@ private-tmp
60dbus-user filter 60dbus-user filter
61dbus-user.own org.kde.neochat 61dbus-user.own org.kde.neochat
62dbus-user.talk org.freedesktop.Notifications 62dbus-user.talk org.freedesktop.Notifications
63dbus-user.talk org.kde.StatusNotifierWatcher 63?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
64dbus-user.talk org.kde.kwalletd5 64dbus-user.talk org.kde.kwalletd5
65dbus-system none 65dbus-system none
diff --git a/etc/profile-m-z/nextcloud.profile b/etc/profile-m-z/nextcloud.profile
index d0eef9704..354d3351e 100644
--- a/etc/profile-m-z/nextcloud.profile
+++ b/etc/profile-m-z/nextcloud.profile
@@ -67,6 +67,5 @@ private-tmp
67 67
68dbus-user filter 68dbus-user filter
69dbus-user.talk org.freedesktop.secrets 69dbus-user.talk org.freedesktop.secrets
70# Add the next line to your nextcloud.local for tray icon support 70?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
71#dbus-user.talk org.kde.StatusNotifierWatcher
72dbus-system none 71dbus-system none
diff --git a/etc/profile-m-z/nheko.profile b/etc/profile-m-z/nheko.profile
index 2f305dae9..89a146a09 100644
--- a/etc/profile-m-z/nheko.profile
+++ b/etc/profile-m-z/nheko.profile
@@ -53,8 +53,7 @@ private-tmp
53 53
54dbus-user filter 54dbus-user filter
55dbus-user.talk org.freedesktop.secrets 55dbus-user.talk org.freedesktop.secrets
56?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
56# Add the next line to your nheko.local to enable notification support. 57# Add the next line to your nheko.local to enable notification support.
57#dbus-user.talk org.freedesktop.Notifications 58#dbus-user.talk org.freedesktop.Notifications
58# Add the next line to your nheko.local to enable tray icon support.
59#dbus-user.talk org.kde.StatusNotifierWatcher
60dbus-system none 59dbus-system none
diff --git a/etc/profile-m-z/open-invaders.profile b/etc/profile-m-z/open-invaders.profile
index 12c7ea3d0..c2c22f42d 100644
--- a/etc/profile-m-z/open-invaders.profile
+++ b/etc/profile-m-z/open-invaders.profile
@@ -25,7 +25,6 @@ caps.drop all
25net none 25net none
26nodvd 26nodvd
27nogroups 27nogroups
28noinput
29nonewprivs 28nonewprivs
30noroot 29noroot
31notv 30notv
diff --git a/etc/profile-m-z/openclonk.profile b/etc/profile-m-z/openclonk.profile
index 253465991..68362cbc8 100644
--- a/etc/profile-m-z/openclonk.profile
+++ b/etc/profile-m-z/openclonk.profile
@@ -28,7 +28,6 @@ ipc-namespace
28netfilter 28netfilter
29nodvd 29nodvd
30nogroups 30nogroups
31noinput
32nonewprivs 31nonewprivs
33noroot 32noroot
34notv 33notv
diff --git a/etc/profile-m-z/pip.profile b/etc/profile-m-z/pip.profile
new file mode 100644
index 000000000..a0926371f
--- /dev/null
+++ b/etc/profile-m-z/pip.profile
@@ -0,0 +1,18 @@
1# Firejail profile for pip
2# Description: package manager for Python packages
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include meson.local
7# Persistent global definitions
8include globals.local
9
10ignore read-only ${HOME}/.local/lib
11
12# Allow python3 (blacklisted by disable-interpreters.inc)
13include allow-python3.inc
14
15#whitelist ${HOME}/.local/lib/python*
16
17# Redirect
18include build-systems-common.profile
diff --git a/etc/profile-m-z/retroarch.profile b/etc/profile-m-z/retroarch.profile
new file mode 100644
index 000000000..1887a9b72
--- /dev/null
+++ b/etc/profile-m-z/retroarch.profile
@@ -0,0 +1,54 @@
1# Firejail profile for retroarch
2# Description: retroarch is a frontend to libretro emulator cores.
3# This file is overwritten after every install/update
4# Persistent local customizations
5include retroarch.local
6# Persistent global definitions
7include globals.local
8
9blacklist /usr/libexec
10
11include disable-common.inc
12include disable-devel.inc
13include disable-exec.inc
14include disable-interpreters.inc
15include disable-programs.inc
16include disable-shell.inc
17include disable-xdg.inc
18
19mkdir ${HOME}/.config/retroarch
20whitelist ${HOME}/.config/retroarch
21whitelist /run/udev
22whitelist /usr/share/retroarch
23whitelist /usr/share/libretro
24include whitelist-common.inc
25include whitelist-run-common.inc
26include whitelist-runuser-common.inc
27include whitelist-usr-share-common.inc
28include whitelist-var-common.inc
29
30apparmor
31caps.drop all
32netfilter
33nodvd
34nogroups
35nonewprivs
36noroot
37notv
38nou2f
39# If you need access to cameras, add `ignore novideo` to retroarch.local
40novideo
41protocol unix,inet,inet6,netlink
42seccomp
43seccomp.block-secondary
44shell none
45tracelog
46
47disable-mnt
48private-bin retroarch
49private-cache
50private-dev
51private-tmp
52
53dbus-user none
54dbus-system none
diff --git a/etc/profile-m-z/spectral.profile b/etc/profile-m-z/spectral.profile
index 5f17b73dc..3f7f68009 100644
--- a/etc/profile-m-z/spectral.profile
+++ b/etc/profile-m-z/spectral.profile
@@ -49,10 +49,8 @@ private-dev
49private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg 49private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg
50private-tmp 50private-tmp
51 51
52dbus-user none 52dbus-user filter
53# Add the next lines to your spectral.local to enable notification support. 53?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
54#ignore dbus-user none 54# Add the next line to your spectral.local to enable notification support.
55#dbus-user filter
56#dbus-user.talk org.freedesktop.Notifications 55#dbus-user.talk org.freedesktop.Notifications
57#dbus-user.talk org.kde.StatusNotifierWatcher
58dbus-system none 56dbus-system none
diff --git a/etc/profile-m-z/supertux2.profile b/etc/profile-m-z/supertux2.profile
index 323849e35..d48065c4b 100644
--- a/etc/profile-m-z/supertux2.profile
+++ b/etc/profile-m-z/supertux2.profile
@@ -30,7 +30,6 @@ caps.drop all
30net none 30net none
31nodvd 31nodvd
32nogroups 32nogroups
33noinput
34nonewprivs 33nonewprivs
35noroot 34noroot
36notv 35notv
diff --git a/etc/profile-m-z/teeworlds.profile b/etc/profile-m-z/teeworlds.profile
index df54fb9ba..d0fb0d43e 100644
--- a/etc/profile-m-z/teeworlds.profile
+++ b/etc/profile-m-z/teeworlds.profile
@@ -26,7 +26,6 @@ ipc-namespace
26netfilter 26netfilter
27nodvd 27nodvd
28nogroups 28nogroups
29noinput
30nonewprivs 29nonewprivs
31noroot 30noroot
32notv 31notv
diff --git a/etc/profile-m-z/telegram.profile b/etc/profile-m-z/telegram.profile
index fd4b82524..dc1f77664 100644
--- a/etc/profile-m-z/telegram.profile
+++ b/etc/profile-m-z/telegram.profile
@@ -50,7 +50,7 @@ private-tmp
50dbus-user filter 50dbus-user filter
51dbus-user.own org.telegram.desktop.* 51dbus-user.own org.telegram.desktop.*
52dbus-user.talk org.freedesktop.Notifications 52dbus-user.talk org.freedesktop.Notifications
53dbus-user.talk org.kde.StatusNotifierWatcher 53?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
54dbus-user.talk org.gnome.Mutter.IdleMonitor 54dbus-user.talk org.gnome.Mutter.IdleMonitor
55dbus-user.talk org.freedesktop.ScreenSaver 55dbus-user.talk org.freedesktop.ScreenSaver
56dbus-system none 56dbus-system none
diff --git a/etc/profile-m-z/torbrowser.profile b/etc/profile-m-z/torbrowser.profile
new file mode 100644
index 000000000..fc579b973
--- /dev/null
+++ b/etc/profile-m-z/torbrowser.profile
@@ -0,0 +1,26 @@
1# Firejail profile for torbrowser
2# Description: This profile was tested with www-client/torbrowser::torbrowser
3# on Gentoo Linux.
4# This file is overwritten after every install/update
5# Persistent local customizations
6include torbrowser.local
7# Persistent global definitions
8include globals.local
9
10ignore dbus-user none
11
12noblacklist ${HOME}/.cache/mozilla
13noblacklist ${HOME}/.mozilla
14
15blacklist /usr/libexec
16
17mkdir ${HOME}/.cache/mozilla/torbrowser
18mkdir ${HOME}/.mozilla
19whitelist ${HOME}/.cache/mozilla/torbrowser
20whitelist ${HOME}/.mozilla
21include whitelist-usr-share-common.inc
22
23dbus-user filter
24dbus-user.own org.mozilla.torbrowser.*
25
26include firefox-common.profile
diff --git a/etc/profile-m-z/torcs.profile b/etc/profile-m-z/torcs.profile
index a7ebaf2af..19e586db4 100644
--- a/etc/profile-m-z/torcs.profile
+++ b/etc/profile-m-z/torcs.profile
@@ -28,7 +28,6 @@ ipc-namespace
28net none 28net none
29nodvd 29nodvd
30nogroups 30nogroups
31noinput
32nonewprivs 31nonewprivs
33noroot 32noroot
34notv 33notv
diff --git a/etc/profile-m-z/tremulous.profile b/etc/profile-m-z/tremulous.profile
index 4e16df553..96541ae25 100644
--- a/etc/profile-m-z/tremulous.profile
+++ b/etc/profile-m-z/tremulous.profile
@@ -8,6 +8,9 @@ include globals.local
8 8
9noblacklist ${HOME}/.tremulous 9noblacklist ${HOME}/.tremulous
10 10
11# Allow /bin/sh (blacklisted by disable-shell.inc)
12include allow-bin-sh.inc
13
11include disable-common.inc 14include disable-common.inc
12include disable-devel.inc 15include disable-devel.inc
13include disable-exec.inc 16include disable-exec.inc
@@ -41,7 +44,7 @@ shell none
41tracelog 44tracelog
42 45
43disable-mnt 46disable-mnt
44private-bin tremded,tremulous,tremulous-wrapper 47private-bin env,sh,tremded,tremulous,tremulous-wrapper
45private-cache 48private-cache
46private-dev 49private-dev
47private-tmp 50private-tmp
diff --git a/etc/profile-m-z/vscodium.profile b/etc/profile-m-z/vscodium.profile
index a4a4fb7d8..9c0a887b2 100644
--- a/etc/profile-m-z/vscodium.profile
+++ b/etc/profile-m-z/vscodium.profile
@@ -1,4 +1,4 @@
1# Firejail profile alias for Visual Studio Code 1# Firejail profile alias for VSCodium
2# This file is overwritten after every install/update 2# This file is overwritten after every install/update
3# Persistent local customizations 3# Persistent local customizations
4include vscodium.local 4include vscodium.local
@@ -7,6 +7,8 @@ include vscodium.local
7#include globals.local 7#include globals.local
8 8
9noblacklist ${HOME}/.VSCodium 9noblacklist ${HOME}/.VSCodium
10noblacklist ${HOME}/.config/VSCodium
11noblacklist ${HOME}/.vscode-oss
10 12
11# Redirect 13# Redirect
12include code.profile 14include code.profile
diff --git a/etc/profile-m-z/warsow.profile b/etc/profile-m-z/warsow.profile
index 5659ec69c..2f818b733 100644
--- a/etc/profile-m-z/warsow.profile
+++ b/etc/profile-m-z/warsow.profile
@@ -11,6 +11,9 @@ ignore noexec ${HOME}
11noblacklist ${HOME}/.cache/warsow-2.1 11noblacklist ${HOME}/.cache/warsow-2.1
12noblacklist ${HOME}/.local/share/warsow-2.1 12noblacklist ${HOME}/.local/share/warsow-2.1
13 13
14# Allow /bin/sh (blacklisted by disable-shell.inc)
15include allow-bin-sh.inc
16
14include disable-common.inc 17include disable-common.inc
15include disable-devel.inc 18include disable-devel.inc
16include disable-exec.inc 19include disable-exec.inc
@@ -34,19 +37,18 @@ ipc-namespace
34netfilter 37netfilter
35nodvd 38nodvd
36nogroups 39nogroups
37noinput
38nonewprivs 40nonewprivs
39noroot 41noroot
40notv 42notv
41nou2f 43nou2f
42novideo 44novideo
43protocol unix,inet,inet6 45protocol unix,inet,inet6,netlink
44seccomp 46seccomp
45shell none 47shell none
46tracelog 48tracelog
47 49
48disable-mnt 50disable-mnt
49private-bin warsow 51private-bin basename,bash,dirname,sed,sh,uname,warsow
50private-cache 52private-cache
51private-dev 53private-dev
52private-tmp 54private-tmp
diff --git a/etc/profile-m-z/xonotic.profile b/etc/profile-m-z/xonotic.profile
index 6ffe9ece9..7c2b38d1d 100644
--- a/etc/profile-m-z/xonotic.profile
+++ b/etc/profile-m-z/xonotic.profile
@@ -32,7 +32,6 @@ caps.drop all
32netfilter 32netfilter
33nodvd 33nodvd
34nogroups 34nogroups
35noinput
36nonewprivs 35nonewprivs
37noroot 36noroot
38notv 37notv
diff --git a/etc/templates/profile.template b/etc/templates/profile.template
index 7628313e0..44197b547 100644
--- a/etc/templates/profile.template
+++ b/etc/templates/profile.template
@@ -116,6 +116,7 @@ include globals.local
116#include disable-devel.inc 116#include disable-devel.inc
117#include disable-exec.inc 117#include disable-exec.inc
118#include disable-interpreters.inc 118#include disable-interpreters.inc
119#include disable-proc.inc
119#include disable-programs.inc 120#include disable-programs.inc
120#include disable-shell.inc 121#include disable-shell.inc
121#include disable-write-mnt.inc 122#include disable-write-mnt.inc
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-03 00:43:13 +0000