8 files changed, 77 insertions, 52 deletions

diff --git a/etc/inc/landlock-common.inc b/etc/inc/landlock-common.inc
index ebe9f98dc..694d447b5 100644
--- a/etc/inc/landlock-common.inc
+++ b/etc/inc/landlock-common.inc
@@ -4,7 +4,7 @@ include landlock-common.local
 
 landlock.read /          # whole system read
 landlock.read /proc
-landlock.special /       # sockets etc.
+landlock.makeipc /       # sockets etc.
 
 # write access
 landlock.write ${HOME}
diff --git a/etc/profile-a-l/crawl.profile b/etc/profile-a-l/crawl.profile
index 7df7b4480..9545fb8bc 100644
--- a/etc/profile-a-l/crawl.profile
+++ b/etc/profile-a-l/crawl.profile
@@ -8,6 +8,9 @@ include globals.local
 
 noblacklist ${HOME}/.crawl
 
+# Allow lua (blacklisted by disable-interpreters.inc)
+include allow-lua.inc
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
diff --git a/etc/profile-a-l/enchant-lsmod-2.profile b/etc/profile-a-l/enchant-lsmod-2.profile
index a7199955e..3fe9e94c0 100644
--- a/etc/profile-a-l/enchant-lsmod-2.profile
+++ b/etc/profile-a-l/enchant-lsmod-2.profile
@@ -7,4 +7,4 @@ include enchant-lsmod-2.local
 #include globals.local
 
 # Redirect
-include enchant.profile
+include enchant-2.profile
diff --git a/etc/profile-a-l/geeqie.profile b/etc/profile-a-l/geeqie.profile
index 6cd28f25d..beffb28e3 100644
--- a/etc/profile-a-l/geeqie.profile
+++ b/etc/profile-a-l/geeqie.profile
@@ -10,6 +10,9 @@ noblacklist ${HOME}/.cache/geeqie
 noblacklist ${HOME}/.config/geeqie
 noblacklist ${HOME}/.local/share/geeqie
 
+# Allow lua (blacklisted by disable-interpreters.inc)
+include allow-lua.inc
+
 # Allow perl (blacklisted by disable-interpreters.inc)
 include allow-perl.inc
 
diff --git a/etc/profile-a-l/gnome-keyring-daemon.profile b/etc/profile-a-l/gnome-keyring-daemon.profile
new file mode 100644
index 000000000..41ea136a6
--- /dev/null
+++ b/etc/profile-a-l/gnome-keyring-daemon.profile
@@ -0,0 +1,62 @@
+# Firejail profile for gnome-keyring-daemon
+# Description: Stores passwords and encryption keys
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include gnome-keyring-daemon.local
+# Persistent global definitions
+include globals.local
+
+blacklist /tmp/.X11-unix
+blacklist ${RUNUSER}/wayland-*
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-programs.inc
+#include disable-X11.inc # x11 none
+include disable-xdg.inc
+
+whitelist ${RUNUSER}/gnupg
+whitelist ${RUNUSER}/keyring
+whitelist /usr/share/gnupg
+whitelist /usr/share/gnupg2
+include whitelist-common.inc
+include whitelist-runuser-common.inc
+include whitelist-usr-share-common.inc
+include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+ipc-namespace
+machine-id
+netfilter
+no3d
+nodvd
+nogroups
+noinput
+nonewprivs
+noroot
+nosound
+notv
+nou2f
+novideo
+protocol unix,inet,inet6
+seccomp
+seccomp.block-secondary
+tracelog
+x11 none
+
+disable-mnt
+#private-bin gnome-keyrin*,secret-tool
+private-cache
+private-dev
+#private-lib alternatives,gnome-keyring,libsecret-1.so.*,pkcs11,security
+private-tmp
+
+#dbus-user none
+dbus-system none
+
+memory-deny-write-execute
+restrict-namespaces
diff --git a/etc/profile-a-l/gnome-keyring.profile b/etc/profile-a-l/gnome-keyring.profile
index aa0a7f4cc..287c6dcf9 100644
--- a/etc/profile-a-l/gnome-keyring.profile
+++ b/etc/profile-a-l/gnome-keyring.profile
@@ -1,62 +1,17 @@
 # Firejail profile for gnome-keyring
 # Description: Stores passwords and encryption keys
 # This file is overwritten after every install/update
-quiet
 # Persistent local customizations
 include gnome-keyring.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 noblacklist ${HOME}/.gnupg
 
-include disable-common.inc
-include disable-devel.inc
-include disable-exec.inc
-include disable-interpreters.inc
-include disable-programs.inc
-include disable-xdg.inc
-
 mkdir ${HOME}/.gnupg
 whitelist ${HOME}/.gnupg
 whitelist ${DOWNLOADS}
-whitelist ${RUNUSER}/gnupg
-whitelist ${RUNUSER}/keyring
-whitelist /usr/share/gnupg
-whitelist /usr/share/gnupg2
-include whitelist-common.inc
-include whitelist-runuser-common.inc
-include whitelist-usr-share-common.inc
-include whitelist-var-common.inc
-
-apparmor
-caps.drop all
-ipc-namespace
-machine-id
-netfilter
-no3d
-nodvd
-nogroups
-noinput
-nonewprivs
-noroot
-nosound
-notv
-nou2f
-novideo
-protocol unix,inet,inet6
-seccomp
-seccomp.block-secondary
-tracelog
-
-disable-mnt
-#private-bin gnome-keyrin*,secret-tool
-private-cache
-private-dev
-#private-lib alternatives,gnome-keyring,libsecret-1.so.*,pkcs11,security
-private-tmp
-
-#dbus-user none
-dbus-system none
 
-memory-deny-write-execute
-restrict-namespaces
+# Redirect
+include gnome-keyring-daemon.profile
diff --git a/etc/profile-m-z/tesseract.profile b/etc/profile-m-z/tesseract.profile
index c0293406d..5d2ea4ae6 100644
--- a/etc/profile-m-z/tesseract.profile
+++ b/etc/profile-m-z/tesseract.profile
@@ -1,6 +1,7 @@
 # Firejail profile for tesseract
 # Description: An OCR program
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include tesseract.local
 # Persistent global definitions
diff --git a/etc/templates/profile.template b/etc/templates/profile.template
index 8882c9012..0e6a5734e 100644
--- a/etc/templates/profile.template
+++ b/etc/templates/profile.template
@@ -140,7 +140,8 @@ include globals.local
 # Landlock commands
 ##landlock.read PATH
 ##landlock.write PATH
-##landlock.special PATH
+##landlock.makeipc PATH
+##landlock.makedev PATH
 ##landlock.execute PATH
 #include landlock-common.inc