aboutsummaryrefslogtreecommitdiffstats
path: root/etc
diff options
context:
space:
mode:
Diffstat (limited to 'etc')
-rw-r--r--etc/firejail.config22
-rw-r--r--etc/inc/disable-programs.inc12
-rw-r--r--etc/profile-a-l/alpine.profile104
-rw-r--r--etc/profile-a-l/alpinef.profile14
-rw-r--r--etc/profile-a-l/cargo.profile1
-rw-r--r--etc/profile-a-l/chromium-common.profile3
-rw-r--r--etc/profile-a-l/ddgr.profile13
-rw-r--r--etc/profile-a-l/firefox.profile3
-rw-r--r--etc/profile-a-l/googler-common.profile62
-rw-r--r--etc/profile-a-l/googler.profile13
-rw-r--r--etc/profile-a-l/librewolf.profile3
-rw-r--r--etc/profile-m-z/mcomix.profile74
-rw-r--r--etc/profile-m-z/minecraft-launcher.profile1
-rw-r--r--etc/profile-m-z/qcomicbook.profile68
-rw-r--r--etc/profile-m-z/rtin.profile8
-rw-r--r--etc/profile-m-z/tin.profile69
-rw-r--r--etc/profile-m-z/tuxguitar.profile6
-rw-r--r--etc/profile-m-z/w3m.profile24
-rw-r--r--etc/profile-m-z/weechat.profile1
-rw-r--r--etc/profile-m-z/zathura.profile3
-rw-r--r--etc/templates/profile.template2
21 files changed, 491 insertions, 15 deletions
diff --git a/etc/firejail.config b/etc/firejail.config
index 4b59f8955..43db49422 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -35,11 +35,6 @@
35# cannot be overridden by --noblacklist or --ignore. 35# cannot be overridden by --noblacklist or --ignore.
36# disable-mnt no 36# disable-mnt no
37 37
38# Set the limit for file copy in several --private-* options. The size is set
39# in megabytes. By default we allow up to 500MB.
40# Note: the files are copied in RAM.
41# file-copy-limit 500
42
43# Enable or disable file transfer support, default enabled. 38# Enable or disable file transfer support, default enabled.
44# file-transfer yes 39# file-transfer yes
45 40
@@ -77,18 +72,35 @@
77# Enable or disable overlayfs features, default enabled. 72# Enable or disable overlayfs features, default enabled.
78# overlayfs yes 73# overlayfs yes
79 74
75# Set the limit for file copy in several --private-* options. The size is set
76# in megabytes. By default we allow up to 500MB.
77# Note: the files are copied in RAM.
78# file-copy-limit 500
79
80# Enable or disable private-bin feature, default enabled.
81# private-bin yes
82
80# Remove /usr/local directories from private-bin list, default disabled. 83# Remove /usr/local directories from private-bin list, default disabled.
81# private-bin-no-local no 84# private-bin-no-local no
82 85
83# Enable or disable private-cache feature, default enabled 86# Enable or disable private-cache feature, default enabled
84# private-cache yes 87# private-cache yes
85 88
89# Enable or disable private-etc feature, default enabled.
90# private-etc yes
91
86# Enable or disable private-home feature, default enabled 92# Enable or disable private-home feature, default enabled
87# private-home yes 93# private-home yes
88 94
89# Enable or disable private-lib feature, default enabled 95# Enable or disable private-lib feature, default enabled
90# private-lib yes 96# private-lib yes
91 97
98# Enable or disable private-opt feature, default enabled.
99# private-opt yes
100
101# Enable or disable private-srv feature, default enabled.
102# private-srv yes
103
92# Enable --quiet as default every time the sandbox is started. Default disabled. 104# Enable --quiet as default every time the sandbox is started. Default disabled.
93# quiet-by-default no 105# quiet-by-default no
94 106
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index 18d1978fc..0e575e5eb 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -39,6 +39,8 @@ blacklist ${HOME}/.WebStorm*
39blacklist ${HOME}/.Wolfram Research 39blacklist ${HOME}/.Wolfram Research
40blacklist ${HOME}/.ZAP 40blacklist ${HOME}/.ZAP
41blacklist ${HOME}/.abook 41blacklist ${HOME}/.abook
42blacklist ${HOME}/.addressbook
43blacklist ${HOME}/.alpine-smime
42blacklist ${HOME}/.aMule 44blacklist ${HOME}/.aMule
43blacklist ${HOME}/.android 45blacklist ${HOME}/.android
44blacklist ${HOME}/.anydesk 46blacklist ${HOME}/.anydesk
@@ -810,6 +812,7 @@ blacklist ${HOME}/.netactview
810blacklist ${HOME}/.neverball 812blacklist ${HOME}/.neverball
811blacklist ${HOME}/.newsbeuter 813blacklist ${HOME}/.newsbeuter
812blacklist ${HOME}/.newsboat 814blacklist ${HOME}/.newsboat
815blacklist ${HOME}/.newsrc
813blacklist ${HOME}/.nicotine 816blacklist ${HOME}/.nicotine
814blacklist ${HOME}/.node-gyp 817blacklist ${HOME}/.node-gyp
815blacklist ${HOME}/.npm 818blacklist ${HOME}/.npm
@@ -830,6 +833,14 @@ blacklist ${HOME}/.paradoxinteractive
830blacklist ${HOME}/.parallelrealities/blobwars 833blacklist ${HOME}/.parallelrealities/blobwars
831blacklist ${HOME}/.pcsxr 834blacklist ${HOME}/.pcsxr
832blacklist ${HOME}/.penguin-command 835blacklist ${HOME}/.penguin-command
836blacklist ${HOME}/.pine-crash
837blacklist ${HOME}/.pine-debug1
838blacklist ${HOME}/.pine-debug2
839blacklist ${HOME}/.pine-debug3
840blacklist ${HOME}/.pine-debug4
841blacklist ${HOME}/.pine-interrupted-mail
842blacklist ${HOME}/.pinerc
843blacklist ${HOME}/.pinercex
833blacklist ${HOME}/.pingus 844blacklist ${HOME}/.pingus
834blacklist ${HOME}/.pioneer 845blacklist ${HOME}/.pioneer
835blacklist ${HOME}/.purple 846blacklist ${HOME}/.purple
@@ -867,6 +878,7 @@ blacklist ${HOME}/.teeworlds
867blacklist ${HOME}/.texlive20* 878blacklist ${HOME}/.texlive20*
868blacklist ${HOME}/.thunderbird 879blacklist ${HOME}/.thunderbird
869blacklist ${HOME}/.tilp 880blacklist ${HOME}/.tilp
881blacklist ${HOME}/.tin
870blacklist ${HOME}/.tooling 882blacklist ${HOME}/.tooling
871blacklist ${HOME}/.tor-browser* 883blacklist ${HOME}/.tor-browser*
872blacklist ${HOME}/.torcs 884blacklist ${HOME}/.torcs
diff --git a/etc/profile-a-l/alpine.profile b/etc/profile-a-l/alpine.profile
new file mode 100644
index 000000000..0b5cf0df0
--- /dev/null
+++ b/etc/profile-a-l/alpine.profile
@@ -0,0 +1,104 @@
1# Firejail profile for alpine
2# Description: Text-based email and newsgroups reader
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include alpine.local
7# Persistent global definitions
8include globals.local
9
10# Workaround for bug https://github.com/netblue30/firejail/issues/2747
11# firejail --private-bin=sh --include='${CFG}/allow-bin-sh.inc' --profile=alpine sh -c '(alpine)'
12
13noblacklist /var/mail
14noblacklist /var/spool/mail
15noblacklist ${DOCUMENTS}
16noblacklist ${HOME}/.addressbook
17noblacklist ${HOME}/.alpine-smime
18noblacklist ${HOME}/.mailcap
19noblacklist ${HOME}/.mh_profile
20noblacklist ${HOME}/.mime.types
21noblacklist ${HOME}/.newsrc
22noblacklist ${HOME}/.pine-crash
23noblacklist ${HOME}/.pine-debug1
24noblacklist ${HOME}/.pine-debug2
25noblacklist ${HOME}/.pine-debug3
26noblacklist ${HOME}/.pine-debug4
27noblacklist ${HOME}/.pine-interrupted-mail
28noblacklist ${HOME}/.pinerc
29noblacklist ${HOME}/.pinercex
30noblacklist ${HOME}/.signature
31noblacklist ${HOME}/mail
32
33blacklist /tmp/.X11-unix
34blacklist ${RUNUSER}/wayland-*
35
36include disable-common.inc
37include disable-devel.inc
38include disable-exec.inc
39include disable-interpreters.inc
40include disable-passwdmgr.inc
41include disable-programs.inc
42include disable-shell.inc
43include disable-xdg.inc
44
45#whitelist ${DOCUMENTS}
46#whitelist ${DOWNLOADS}
47#whitelist ${HOME}/.addressbook
48#whitelist ${HOME}/.alpine-smime
49#whitelist ${HOME}/.mailcap
50#whitelist ${HOME}/.mh_profile
51#whitelist ${HOME}/.mime.types
52#whitelist ${HOME}/.newsrc
53#whitelist ${HOME}/.pine-crash
54#whitelist ${HOME}/.pine-interrupted-mail
55#whitelist ${HOME}/.pinerc
56#whitelist ${HOME}/.pinercex
57#whitelist ${HOME}/.pine-debug1
58#whitelist ${HOME}/.pine-debug2
59#whitelist ${HOME}/.pine-debug3
60#whitelist ${HOME}/.pine-debug4
61#whitelist ${HOME}/.signature
62#whitelist ${HOME}/mail
63whitelist /var/mail
64whitelist /var/spool/mail
65#include whitelist-common.inc
66include whitelist-runuser-common.inc
67include whitelist-usr-share-common.inc
68include whitelist-var-common.inc
69
70apparmor
71caps.drop all
72ipc-namespace
73machine-id
74netfilter
75no3d
76nodvd
77nogroups
78noinput
79nonewprivs
80noroot
81nosound
82notv
83nou2f
84novideo
85protocol unix,inet,inet6
86seccomp
87seccomp.block-secondary
88shell none
89tracelog
90
91disable-mnt
92private-bin alpine
93private-cache
94private-dev
95private-etc alternatives,c-client.cf,ca-certificates,crypto-policies,host.conf,hostname,hosts,krb5.keytab,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mailcap,mime.types,nsswitch.conf,passwd,pine.conf,pinerc.fixed,pki,protocols,resolv.conf,rpc,services,ssl,terminfo,xdg
96private-tmp
97writable-run-user
98writable-var
99
100dbus-user none
101dbus-system none
102
103memory-deny-write-execute
104read-only ${HOME}/.signature
diff --git a/etc/profile-a-l/alpinef.profile b/etc/profile-a-l/alpinef.profile
new file mode 100644
index 000000000..97b97fe5f
--- /dev/null
+++ b/etc/profile-a-l/alpinef.profile
@@ -0,0 +1,14 @@
1# Firejail profile for alpinef
2# Description: Text-based email and newsgroups reader using function keys
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include alpinef.local
7# Persistent global definitions
8# added by included profile
9#include globals.local
10
11private-bin alpinef
12
13# Redirect
14include alpine.profile
diff --git a/etc/profile-a-l/cargo.profile b/etc/profile-a-l/cargo.profile
index 043fd6718..7cf04c550 100644
--- a/etc/profile-a-l/cargo.profile
+++ b/etc/profile-a-l/cargo.profile
@@ -34,6 +34,7 @@ include disable-xdg.inc
34#whitelist ${HOME}/.cargo 34#whitelist ${HOME}/.cargo
35#whitelist ${HOME}/.rustup 35#whitelist ${HOME}/.rustup
36#include whitelist-common.inc 36#include whitelist-common.inc
37whitelist /usr/share/pkgconfig
37include whitelist-runuser-common.inc 38include whitelist-runuser-common.inc
38include whitelist-usr-share-common.inc 39include whitelist-usr-share-common.inc
39include whitelist-var-common.inc 40include whitelist-var-common.inc
diff --git a/etc/profile-a-l/chromium-common.profile b/etc/profile-a-l/chromium-common.profile
index f7493aa82..b0e0254d4 100644
--- a/etc/profile-a-l/chromium-common.profile
+++ b/etc/profile-a-l/chromium-common.profile
@@ -37,8 +37,9 @@ include whitelist-var-common.inc
37# Add the next line to your chromium-common.local if your kernel allows unprivileged userns clone. 37# Add the next line to your chromium-common.local if your kernel allows unprivileged userns clone.
38#include chromium-common-hardened.inc.profile 38#include chromium-common-hardened.inc.profile
39 39
40# Add the next line to your chromium-common.local to allow screen sharing under wayland. 40# Add the next two lines to your chromium-common.local to allow screen sharing under wayland.
41#whitelist ${RUNUSER}/pipewire-0 41#whitelist ${RUNUSER}/pipewire-0
42#whitelist /usr/share/pipewire/client.conf
42 43
43apparmor 44apparmor
44caps.keep sys_admin,sys_chroot 45caps.keep sys_admin,sys_chroot
diff --git a/etc/profile-a-l/ddgr.profile b/etc/profile-a-l/ddgr.profile
new file mode 100644
index 000000000..b1d41ddf7
--- /dev/null
+++ b/etc/profile-a-l/ddgr.profile
@@ -0,0 +1,13 @@
1# Firejail profile for ddgr
2# Description: Search DuckDuckGo from your terminal
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include ddgr.local
7# Persistent global definitions
8include globals.local
9
10private-bin ddgr
11
12# Redirect
13include googler-common.profile
diff --git a/etc/profile-a-l/firefox.profile b/etc/profile-a-l/firefox.profile
index 7874c882f..3ad67734d 100644
--- a/etc/profile-a-l/firefox.profile
+++ b/etc/profile-a-l/firefox.profile
@@ -56,8 +56,9 @@ dbus-user.own org.mpris.MediaPlayer2.firefox.*
56#dbus-user.own org.mpris.MediaPlayer2.plasma-browser-integration 56#dbus-user.own org.mpris.MediaPlayer2.plasma-browser-integration
57#dbus-user.talk org.kde.JobViewServer 57#dbus-user.talk org.kde.JobViewServer
58#dbus-user.talk org.kde.kuiserver 58#dbus-user.talk org.kde.kuiserver
59# Add the next two lines to your firefox.local to allow screen sharing under wayland. 59# Add the next three lines to your firefox.local to allow screen sharing under wayland.
60#whitelist ${RUNUSER}/pipewire-0 60#whitelist ${RUNUSER}/pipewire-0
61#whitelist /usr/share/pipewire/client.conf
61#dbus-user.talk org.freedesktop.portal.* 62#dbus-user.talk org.freedesktop.portal.*
62# Add the next line to your firefox.local if screen sharing sharing still does not work 63# Add the next line to your firefox.local if screen sharing sharing still does not work
63# with the above lines (might depend on the portal implementation). 64# with the above lines (might depend on the portal implementation).
diff --git a/etc/profile-a-l/googler-common.profile b/etc/profile-a-l/googler-common.profile
new file mode 100644
index 000000000..2d0bce52b
--- /dev/null
+++ b/etc/profile-a-l/googler-common.profile
@@ -0,0 +1,62 @@
1# Firejail profile for googler clones
2# Description: common profile for googler clones
3# This file is overwritten after every install/update
4# Persistent local customizations
5include googler-common.local
6# Persistent global definitions
7# added by caller profile
8#include globals.local
9
10blacklist /tmp/.X11-unix
11blacklist ${RUNUSER}
12
13noblacklist ${HOME}/.w3m
14
15# Allow /bin/sh (blacklisted by disable-shell.inc)
16include allow-bin-sh.inc
17# Allow python (blacklisted by disable-interpreters.inc)
18include allow-python3.inc
19
20include disable-common.inc
21include disable-devel.inc
22include disable-exec.inc
23include disable-interpreters.inc
24include disable-passwdmgr.inc
25include disable-programs.inc
26include disable-shell.inc
27include disable-xdg.inc
28
29whitelist ${HOME}/.w3m
30include whitelist-usr-share-common.inc
31include whitelist-var-common.inc
32
33apparmor
34caps.drop all
35ipc-namespace
36machine-id
37netfilter
38no3d
39nodvd
40nogroups
41noinput
42nonewprivs
43noroot
44nosound
45notv
46nou2f
47novideo
48protocol unix,inet,inet6
49seccomp
50seccomp.block-secondary
51shell none
52tracelog
53
54disable-mnt
55private-bin env,python3*,sh,w3m
56private-cache
57private-dev
58private-etc ca-certificates,crypto-policies,host.conf,hostname,hosts,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl
59private-tmp
60
61dbus-user none
62dbus-system none
diff --git a/etc/profile-a-l/googler.profile b/etc/profile-a-l/googler.profile
new file mode 100644
index 000000000..9d67006f6
--- /dev/null
+++ b/etc/profile-a-l/googler.profile
@@ -0,0 +1,13 @@
1# Firejail profile for googler
2# Description: Search Google from your terminal
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include googler.local
7# Persistent global definitions
8include globals.local
9
10private-bin googler
11
12# Redirect
13include googler-common.profile
diff --git a/etc/profile-a-l/librewolf.profile b/etc/profile-a-l/librewolf.profile
index 8e3e58f19..da047357a 100644
--- a/etc/profile-a-l/librewolf.profile
+++ b/etc/profile-a-l/librewolf.profile
@@ -44,8 +44,9 @@ dbus-user filter
44#dbus-user.own org.mpris.MediaPlayer2.plasma-browser-integration 44#dbus-user.own org.mpris.MediaPlayer2.plasma-browser-integration
45#dbus-user.talk org.kde.JobViewServer 45#dbus-user.talk org.kde.JobViewServer
46#dbus-user.talk org.kde.kuiserver 46#dbus-user.talk org.kde.kuiserver
47# Add the next lines to your librewolf.local to allow screensharing under Wayland. 47# Add the next three lines to your librewolf.local to allow screensharing under Wayland.
48#whitelist ${RUNUSER}/pipewire-0 48#whitelist ${RUNUSER}/pipewire-0
49#whitelist /usr/share/pipewire/client.conf
49#dbus-user.talk org.freedesktop.portal.* 50#dbus-user.talk org.freedesktop.portal.*
50# Also add the next line to your librewolf.local if screensharing does not work with 51# Also add the next line to your librewolf.local if screensharing does not work with
51# the above lines (depends on the portal implementation). 52# the above lines (depends on the portal implementation).
diff --git a/etc/profile-m-z/mcomix.profile b/etc/profile-m-z/mcomix.profile
new file mode 100644
index 000000000..fcd1e24e5
--- /dev/null
+++ b/etc/profile-m-z/mcomix.profile
@@ -0,0 +1,74 @@
1# Firejail profile for mcomix
2# Description: A comic book and manga viewer in python
3# This file is overwritten after every install/update
4# Persistent local customizations
5include mcomix.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.config/mcomix
10noblacklist ${HOME}/.local/share/mcomix
11noblacklist ${DOCUMENTS}
12
13# Allow /bin/sh (blacklisted by disable-shell.inc)
14include allow-bin-sh.inc
15
16# Allow python (blacklisted by disable-interpreters.inc)
17# mcomix <= 1.2 uses python2
18include allow-python2.inc
19include allow-python3.inc
20
21include disable-common.inc
22include disable-devel.inc
23include disable-exec.inc
24include disable-interpreters.inc
25include disable-passwdmgr.inc
26include disable-programs.inc
27include disable-shell.inc
28include disable-write-mnt.inc
29include disable-xdg.inc
30
31mkdir ${HOME}/.config/mcomix
32mkdir ${HOME}/.local/share/mcomix
33whitelist /usr/share/mcomix
34include whitelist-usr-share-common.inc
35include whitelist-var-common.inc
36include whitelist-runuser-common.inc
37
38apparmor
39caps.drop all
40machine-id
41net none
42nodvd
43nogroups
44noinput
45nonewprivs
46noroot
47nosound
48notv
49nou2f
50novideo
51protocol unix
52seccomp
53seccomp.block-secondary
54shell none
55tracelog
56
57# mcomix <= 1.2 uses python2
58private-bin 7z,lha,mcomix,mutool,python*,rar,sh,unrar,unzip
59private-cache
60private-dev
61# mcomix <= 1.2 uses gtk-2.0
62private-etc alternatives,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,pango,passwd,X11,xdg
63private-tmp
64
65dbus-user none
66dbus-system none
67
68read-only ${HOME}
69read-write ${HOME}/.config/mcomix
70read-write ${HOME}/.local/share/mcomix
71#to allow ${HOME}/.local/share/recently-used.xbel
72read-write ${HOME}/.local/share
73# used by mcomix <= 1.2, tip, make a symbolic link to .cache/thumbnails
74read-write ${HOME}/.thumbnails
diff --git a/etc/profile-m-z/minecraft-launcher.profile b/etc/profile-m-z/minecraft-launcher.profile
index 2536d0b38..1028e374a 100644
--- a/etc/profile-m-z/minecraft-launcher.profile
+++ b/etc/profile-m-z/minecraft-launcher.profile
@@ -31,7 +31,6 @@ include whitelist-runuser-common.inc
31include whitelist-usr-share-common.inc 31include whitelist-usr-share-common.inc
32include whitelist-var-common.inc 32include whitelist-var-common.inc
33 33
34apparmor
35caps.drop all 34caps.drop all
36netfilter 35netfilter
37nodvd 36nodvd
diff --git a/etc/profile-m-z/qcomicbook.profile b/etc/profile-m-z/qcomicbook.profile
new file mode 100644
index 000000000..0e52d7fc4
--- /dev/null
+++ b/etc/profile-m-z/qcomicbook.profile
@@ -0,0 +1,68 @@
1# Firejail profile for qcomicbook
2# Description: A comic book and manga viewer in QT
3# This file is overwritten after every install/update
4# Persistent local customizations
5include qcomicbook.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.cache/PawelStolowski
10noblacklist ${HOME}/.config/PawelStolowski
11noblacklist ${HOME}/.local/share/PawelStolowski
12noblacklist ${DOCUMENTS}
13
14# Allow /bin/sh (blacklisted by disable-shell.inc)
15include allow-bin-sh.inc
16
17include disable-common.inc
18include disable-devel.inc
19include disable-exec.inc
20include disable-interpreters.inc
21include disable-passwdmgr.inc
22include disable-programs.inc
23include disable-shell.inc
24include disable-write-mnt.inc
25include disable-xdg.inc
26
27mkdir ${HOME}/.cache/PawelStolowski
28mkdir ${HOME}/.config/PawelStolowski
29mkdir ${HOME}/.local/share/PawelStolowski
30whitelist /usr/share/qcomicbook
31include whitelist-runuser-common.inc
32include whitelist-usr-share-common.inc
33include whitelist-var-common.inc
34
35apparmor
36caps.drop all
37machine-id
38net none
39nodvd
40nogroups
41noinput
42nonewprivs
43noroot
44nosound
45notv
46nou2f
47novideo
48protocol unix
49seccomp
50seccomp.block-secondary
51shell none
52tracelog
53
54private-bin 7z,7zr,qcomicbook,rar,sh,tar,unace,unrar,unzip
55private-cache
56private-dev
57private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,pango,passwd,Trolltech.conf,X11,xdg
58private-tmp
59
60dbus-user none
61dbus-system none
62
63read-only ${HOME}
64read-write ${HOME}/.cache/PawelStolowski
65read-write ${HOME}/.config/PawelStolowski
66read-write ${HOME}/.local/share/PawelStolowski
67#to allow ${HOME}/.local/share/recently-used.xbel
68read-write ${HOME}/.local/share
diff --git a/etc/profile-m-z/rtin.profile b/etc/profile-m-z/rtin.profile
new file mode 100644
index 000000000..cd84ce05e
--- /dev/null
+++ b/etc/profile-m-z/rtin.profile
@@ -0,0 +1,8 @@
1# Firejail profile for rtin
2# Description: ncurses-based Usenet newsreader
3# symlink to tin, same as `tin -r`
4# This file is overwritten after every install/update
5# Persistent local customizations
6include rtin.local
7
8include tin.profile
diff --git a/etc/profile-m-z/tin.profile b/etc/profile-m-z/tin.profile
new file mode 100644
index 000000000..e0ed3090a
--- /dev/null
+++ b/etc/profile-m-z/tin.profile
@@ -0,0 +1,69 @@
1# Firejail profile for tin
2# Description: ncurses-based Usenet newsreader
3# This file is overwritten after every install/update
4# Persistent local customizations
5include tin.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.newsrc
10noblacklist ${HOME}/.tin
11
12blacklist /tmp/.X11-unix
13blacklist ${RUNUSER}
14blacklist /usr/libexec
15
16include disable-common.inc
17include disable-devel.inc
18include disable-exec.inc
19include disable-interpreters.inc
20include disable-passwdmgr.inc
21include disable-programs.inc
22include disable-shell.inc
23include disable-xdg.inc
24
25mkdir ${HOME}/.tin
26mkfile ${HOME}/.newsrc
27# Note: files/directories directly in ${HOME} can't be whitelisted, as
28# tin saves .newsrc by renaming a temporary file, which is not possible for
29# bind-mounted files.
30#whitelist ${HOME}/.newsrc
31#whitelist ${HOME}/.tin
32#include whitelist-common.inc
33include whitelist-runuser-common.inc
34include whitelist-usr-share-common.inc
35include whitelist-var-common.inc
36
37apparmor
38caps.drop all
39ipc-namespace
40machine-id
41netfilter
42no3d
43nodvd
44nogroups
45noinput
46nonewprivs
47noroot
48nosound
49notv
50nou2f
51novideo
52protocol inet,inet6
53seccomp
54seccomp.block-secondary
55shell none
56tracelog
57
58disable-mnt
59private-bin rtin,tin
60private-cache
61private-dev
62private-etc passwd,resolv.conf,terminfo,tin
63private-lib terminfo
64private-tmp
65
66dbus-user none
67dbus-system none
68
69memory-deny-write-execute
diff --git a/etc/profile-m-z/tuxguitar.profile b/etc/profile-m-z/tuxguitar.profile
index d0bcbe79f..3cd496412 100644
--- a/etc/profile-m-z/tuxguitar.profile
+++ b/etc/profile-m-z/tuxguitar.profile
@@ -6,6 +6,9 @@ include tuxguitar.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9# tuxguitar fails to launch
10ignore noexec ${HOME}
11
9noblacklist ${HOME}/.tuxguitar* 12noblacklist ${HOME}/.tuxguitar*
10noblacklist ${DOCUMENTS} 13noblacklist ${DOCUMENTS}
11noblacklist ${MUSIC} 14noblacklist ${MUSIC}
@@ -41,6 +44,3 @@ tracelog
41 44
42private-dev 45private-dev
43private-tmp 46private-tmp
44
45# noexec ${HOME} - tuxguitar may fail to launch
46noexec /tmp
diff --git a/etc/profile-m-z/w3m.profile b/etc/profile-m-z/w3m.profile
index 131213ed2..69b2c6c59 100644
--- a/etc/profile-m-z/w3m.profile
+++ b/etc/profile-m-z/w3m.profile
@@ -17,18 +17,32 @@ noblacklist ${HOME}/.w3m
17blacklist /tmp/.X11-unix 17blacklist /tmp/.X11-unix
18blacklist ${RUNUSER}/wayland-* 18blacklist ${RUNUSER}/wayland-*
19 19
20# Allow /bin/sh (blacklisted by disable-shell.inc)
21include allow-bin-sh.inc
22
23# Allow perl (blacklisted by disable-interpreters.inc)
20include allow-perl.inc 24include allow-perl.inc
21 25
22include disable-common.inc 26include disable-common.inc
23include disable-devel.inc 27include disable-devel.inc
28include disable-exec.inc
24include disable-interpreters.inc 29include disable-interpreters.inc
25include disable-passwdmgr.inc 30include disable-passwdmgr.inc
26include disable-programs.inc 31include disable-programs.inc
32include disable-shell.inc
27include disable-xdg.inc 33include disable-xdg.inc
28 34
35mkdir ${HOME}/.w3m
36whitelist /usr/share/w3m
37whitelist ${DOWNLOADS}
38whitelist ${HOME}/.w3m
29include whitelist-runuser-common.inc 39include whitelist-runuser-common.inc
40include whitelist-usr-share-common.inc
41include whitelist-var-common.inc
30 42
31caps.drop all 43caps.drop all
44ipc-namespace
45machine-id
32netfilter 46netfilter
33no3d 47no3d
34nodvd 48nodvd
@@ -45,8 +59,14 @@ seccomp
45shell none 59shell none
46tracelog 60tracelog
47 61
48# private-bin w3m 62disable-mnt
63private-bin perl,sh,w3m
49private-cache 64private-cache
50private-dev 65private-dev
51private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl 66private-etc alternatives,ca-certificates,crypto-policies,mailcap,nsswitch.conf,pki,resolv.conf,ssl
52private-tmp 67private-tmp
68
69dbus-user none
70dbus-system none
71
72memory-deny-write-execute
diff --git a/etc/profile-m-z/weechat.profile b/etc/profile-m-z/weechat.profile
index 3a93d2ec7..76935212f 100644
--- a/etc/profile-m-z/weechat.profile
+++ b/etc/profile-m-z/weechat.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.weechat
11include disable-common.inc 11include disable-common.inc
12include disable-programs.inc 12include disable-programs.inc
13 13
14whitelist /usr/share/weechat
14include whitelist-usr-share-common.inc 15include whitelist-usr-share-common.inc
15include whitelist-var-common.inc 16include whitelist-var-common.inc
16 17
diff --git a/etc/profile-m-z/zathura.profile b/etc/profile-m-z/zathura.profile
index a39729685..d0e68c980 100644
--- a/etc/profile-m-z/zathura.profile
+++ b/etc/profile-m-z/zathura.profile
@@ -17,12 +17,14 @@ include disable-interpreters.inc
17include disable-passwdmgr.inc 17include disable-passwdmgr.inc
18include disable-programs.inc 18include disable-programs.inc
19include disable-shell.inc 19include disable-shell.inc
20include disable-write-mnt.inc
20include disable-xdg.inc 21include disable-xdg.inc
21 22
22mkdir ${HOME}/.config/zathura 23mkdir ${HOME}/.config/zathura
23mkdir ${HOME}/.local/share/zathura 24mkdir ${HOME}/.local/share/zathura
24whitelist /usr/share/doc 25whitelist /usr/share/doc
25whitelist /usr/share/zathura 26whitelist /usr/share/zathura
27include whitelist-runuser-common.inc
26include whitelist-usr-share-common.inc 28include whitelist-usr-share-common.inc
27include whitelist-var-common.inc 29include whitelist-var-common.inc
28 30
@@ -41,6 +43,7 @@ nou2f
41novideo 43novideo
42protocol unix 44protocol unix
43seccomp 45seccomp
46seccomp.block-secondary
44shell none 47shell none
45tracelog 48tracelog
46 49
diff --git a/etc/templates/profile.template b/etc/templates/profile.template
index 61e9c9fd8..18e4e8bce 100644
--- a/etc/templates/profile.template
+++ b/etc/templates/profile.template
@@ -192,7 +192,7 @@ include globals.local
192# GUI: fonts,pango,X11 192# GUI: fonts,pango,X11
193# GTK: dconf,gconf,gtk-2.0,gtk-3.0 193# GTK: dconf,gconf,gtk-2.0,gtk-3.0
194# KDE: kde4rc,kde5rc 194# KDE: kde4rc,kde5rc
195# Networking: ca-certificates,crypto-policies,host.conf,hostname,hosts,nsswitch.conf,pki,protocols,resolv.conf,services,rpc,ssl 195# Networking: ca-certificates,crypto-policies,host.conf,hostname,hosts,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl
196# Extra: gai.conf,proxychains.conf 196# Extra: gai.conf,proxychains.conf
197# Qt: Trolltech.conf 197# Qt: Trolltech.conf
198##private-lib LIBS 198##private-lib LIBS
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-05 06:30:17 +0000