diff options
Diffstat (limited to 'etc')
-rw-r--r-- | etc/profile-a-l/brave.profile | 2 | ||||
-rw-r--r-- | etc/profile-a-l/email-common.profile | 2 | ||||
-rw-r--r-- | etc/profile-a-l/evince.profile | 13 | ||||
-rw-r--r-- | etc/profile-a-l/lutris.profile | 3 | ||||
-rw-r--r-- | etc/profile-m-z/nicotine.profile | 7 | ||||
-rw-r--r-- | etc/profile-m-z/whalebird.profile | 3 | ||||
-rw-r--r-- | etc/profile-m-z/youtube-viewers-common.profile | 12 |
7 files changed, 30 insertions, 12 deletions
diff --git a/etc/profile-a-l/brave.profile b/etc/profile-a-l/brave.profile index 09548c761..071a279b0 100644 --- a/etc/profile-a-l/brave.profile +++ b/etc/profile-a-l/brave.profile | |||
@@ -13,6 +13,8 @@ ignore noexec /tmp | |||
13 | # you will need to uncomment the 'brave + tor' rule in /etc/apparmor.d/local/firejail-default. | 13 | # you will need to uncomment the 'brave + tor' rule in /etc/apparmor.d/local/firejail-default. |
14 | # Alternatively you can add 'ignore apparmor' to your brave.local. | 14 | # Alternatively you can add 'ignore apparmor' to your brave.local. |
15 | ignore noexec ${HOME} | 15 | ignore noexec ${HOME} |
16 | # Causes slow starts (#4604) | ||
17 | ignore private-cache | ||
16 | 18 | ||
17 | noblacklist ${HOME}/.cache/BraveSoftware | 19 | noblacklist ${HOME}/.cache/BraveSoftware |
18 | noblacklist ${HOME}/.config/BraveSoftware | 20 | noblacklist ${HOME}/.config/BraveSoftware |
diff --git a/etc/profile-a-l/email-common.profile b/etc/profile-a-l/email-common.profile index 2b26b3727..89c44bf76 100644 --- a/etc/profile-a-l/email-common.profile +++ b/etc/profile-a-l/email-common.profile | |||
@@ -65,7 +65,7 @@ tracelog | |||
65 | # disable-mnt | 65 | # disable-mnt |
66 | private-cache | 66 | private-cache |
67 | private-dev | 67 | private-dev |
68 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,machine-id,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg | 68 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,localtime,machine-id,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg |
69 | private-tmp | 69 | private-tmp |
70 | # encrypting and signing email | 70 | # encrypting and signing email |
71 | writable-run-user | 71 | writable-run-user |
diff --git a/etc/profile-a-l/evince.profile b/etc/profile-a-l/evince.profile index 21bf7eabf..eec9f86db 100644 --- a/etc/profile-a-l/evince.profile +++ b/etc/profile-a-l/evince.profile | |||
@@ -6,9 +6,9 @@ include evince.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # WARNING: using bookmarks possibly exposes information, including file history from other programs. | 9 | # WARNING: This exposes information like file history from other programs. |
10 | # Add the next line to your evince.local if you need bookmarks support. This also needs additional dbus-user filtering (see below). | 10 | # You can add a blacklist for it in your evince.local for additional hardening if you can live with some restrictions. |
11 | #noblacklist ${HOME}/.local/share/gvfs-metadata | 11 | noblacklist ${HOME}/.local/share/gvfs-metadata |
12 | 12 | ||
13 | noblacklist ${HOME}/.config/evince | 13 | noblacklist ${HOME}/.config/evince |
14 | noblacklist ${DOCUMENTS} | 14 | noblacklist ${DOCUMENTS} |
@@ -59,9 +59,8 @@ private-etc alternatives,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd | |||
59 | private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libarchive.so.*,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* | 59 | private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libarchive.so.*,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* |
60 | private-tmp | 60 | private-tmp |
61 | 61 | ||
62 | # dbus-user filtering might break two-page-view on some systems | ||
63 | dbus-user filter | 62 | dbus-user filter |
64 | # Add the next two lines to your evince.local if you need bookmarks support. | 63 | dbus-user.talk ca.desrt.dconf |
65 | #dbus-user.talk org.gtk.vfs.Daemon | 64 | dbus-user.talk org.gtk.vfs.Daemon |
66 | #dbus-user.talk org.gtk.vfs.Metadata | 65 | dbus-user.talk org.gtk.vfs.Metadata |
67 | dbus-system none | 66 | dbus-system none |
diff --git a/etc/profile-a-l/lutris.profile b/etc/profile-a-l/lutris.profile index 0562cf430..80cecd056 100644 --- a/etc/profile-a-l/lutris.profile +++ b/etc/profile-a-l/lutris.profile | |||
@@ -69,7 +69,8 @@ notv | |||
69 | nou2f | 69 | nou2f |
70 | novideo | 70 | novideo |
71 | protocol unix,inet,inet6,netlink | 71 | protocol unix,inet,inet6,netlink |
72 | seccomp | 72 | seccomp !modify_ldt |
73 | seccomp.32 !modify_ldt | ||
73 | 74 | ||
74 | # Add the next line to your lutris.local if you do not need controller support. | 75 | # Add the next line to your lutris.local if you do not need controller support. |
75 | #private-dev | 76 | #private-dev |
diff --git a/etc/profile-m-z/nicotine.profile b/etc/profile-m-z/nicotine.profile index bb2a41457..22c8b1782 100644 --- a/etc/profile-m-z/nicotine.profile +++ b/etc/profile-m-z/nicotine.profile | |||
@@ -8,8 +8,12 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.nicotine | 9 | noblacklist ${HOME}/.nicotine |
10 | 10 | ||
11 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
12 | include allow-bin-sh.inc | ||
13 | |||
11 | # Allow python (blacklisted by disable-interpreters.inc) | 14 | # Allow python (blacklisted by disable-interpreters.inc) |
12 | include allow-python2.inc | 15 | include allow-python2.inc |
16 | include allow-python3.inc | ||
13 | 17 | ||
14 | include disable-common.inc | 18 | include disable-common.inc |
15 | include disable-devel.inc | 19 | include disable-devel.inc |
@@ -37,6 +41,7 @@ nodvd | |||
37 | nogroups | 41 | nogroups |
38 | noinput | 42 | noinput |
39 | nonewprivs | 43 | nonewprivs |
44 | noprinters | ||
40 | noroot | 45 | noroot |
41 | nosound | 46 | nosound |
42 | notv | 47 | notv |
@@ -47,7 +52,7 @@ seccomp | |||
47 | tracelog | 52 | tracelog |
48 | 53 | ||
49 | disable-mnt | 54 | disable-mnt |
50 | private-bin nicotine,python2* | 55 | #private-bin nicotine,python2* |
51 | private-cache | 56 | private-cache |
52 | private-dev | 57 | private-dev |
53 | private-tmp | 58 | private-tmp |
diff --git a/etc/profile-m-z/whalebird.profile b/etc/profile-m-z/whalebird.profile index 92ebebdae..8a9614fb0 100644 --- a/etc/profile-m-z/whalebird.profile +++ b/etc/profile-m-z/whalebird.profile | |||
@@ -10,6 +10,7 @@ include globals.local | |||
10 | ignore include whitelist-runuser-common.inc | 10 | ignore include whitelist-runuser-common.inc |
11 | ignore include whitelist-usr-share-common.inc | 11 | ignore include whitelist-usr-share-common.inc |
12 | 12 | ||
13 | ignore apparmor | ||
13 | ignore dbus-user none | 14 | ignore dbus-user none |
14 | ignore dbus-system none | 15 | ignore dbus-system none |
15 | 16 | ||
@@ -21,7 +22,7 @@ whitelist ${HOME}/.config/Whalebird | |||
21 | no3d | 22 | no3d |
22 | 23 | ||
23 | private-bin electron,electron[0-9],electron[0-9][0-9],whalebird | 24 | private-bin electron,electron[0-9],electron[0-9][0-9],whalebird |
24 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id | 25 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl |
25 | 26 | ||
26 | # Redirect | 27 | # Redirect |
27 | include electron.profile | 28 | include electron.profile |
diff --git a/etc/profile-m-z/youtube-viewers-common.profile b/etc/profile-m-z/youtube-viewers-common.profile index 8582e2462..28c219377 100644 --- a/etc/profile-m-z/youtube-viewers-common.profile +++ b/etc/profile-m-z/youtube-viewers-common.profile | |||
@@ -19,6 +19,13 @@ include allow-perl.inc | |||
19 | include allow-python2.inc | 19 | include allow-python2.inc |
20 | include allow-python3.inc | 20 | include allow-python3.inc |
21 | 21 | ||
22 | # The lines below are needed to find the default Firefox profile name, to allow | ||
23 | # opening links in an existing instance of Firefox (note that it still fails if | ||
24 | # there isn't a Firefox instance running with the default profile; see #5352) | ||
25 | noblacklist ${HOME}/.mozilla | ||
26 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | ||
27 | read-only ${HOME}/.mozilla/firefox/profiles.ini | ||
28 | |||
22 | include disable-common.inc | 29 | include disable-common.inc |
23 | include disable-devel.inc | 30 | include disable-devel.inc |
24 | include disable-exec.inc | 31 | include disable-exec.inc |
@@ -55,5 +62,8 @@ private-dev | |||
55 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg | 62 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg |
56 | private-tmp | 63 | private-tmp |
57 | 64 | ||
58 | dbus-user none | 65 | dbus-user filter |
66 | # allow D-Bus communication with firefox for opening links | ||
67 | dbus-user.talk org.mozilla.* | ||
68 | |||
59 | dbus-system none | 69 | dbus-system none |