43 files changed, 244 insertions, 54 deletions

diff --git a/etc/QMediathekView.profile b/etc/QMediathekView.profile
index b750a135e..ae863b73d 100644
--- a/etc/QMediathekView.profile
+++ b/etc/QMediathekView.profile
@@ -52,4 +52,4 @@ private-dev
 # private-lib
 private-tmp
 
-# memory-deny-write-execute - breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/aria2c.profile b/etc/aria2c.profile
index 583250983..b952ac8a6 100644
--- a/etc/aria2c.profile
+++ b/etc/aria2c.profile
@@ -35,7 +35,8 @@ shell none
 
 # disable-mnt
 private-bin aria2c,gzip
-private-cache
+# Uncomment the next line (or put 'private-cache' in your aria2c.local) if you don't use Lutris/winetricks (see issue #2772)
+#private-cache
 private-dev
 private-etc alternatives,ca-certificates,resolv.conf,ssl
 private-lib libreadline.so.*
diff --git a/etc/artha.profile b/etc/artha.profile
index 2660c4e10..f886921cb 100644
--- a/etc/artha.profile
+++ b/etc/artha.profile
@@ -16,6 +16,13 @@ include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
+mkdir ${HOME}/.config/artha.conf
+mkdir ${HOME}/.config/enchant
+whitelist ${HOME}/.config/artha.conf
+whitelist ${HOME}/.config/enchant
+include whitelist-common.inc
+include whitelist-var-common.inc
+
 apparmor
 caps.drop all
 ipc-namespace
diff --git a/etc/authenticator.profile b/etc/authenticator.profile
index 39546112e..4887299ec 100644
--- a/etc/authenticator.profile
+++ b/etc/authenticator.profile
@@ -43,4 +43,4 @@ private-dev
 private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,pki,resolv.conf,ssl
 private-tmp
 
-# memory-deny-write-execute - breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/autokey-common.profile b/etc/autokey-common.profile
index 47396fe43..bd50a2dfb 100644
--- a/etc/autokey-common.profile
+++ b/etc/autokey-common.profile
@@ -38,4 +38,4 @@ private-cache
 private-dev
 private-tmp
 
-# memory-deny-write-execute - Breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/baobab.profile b/etc/baobab.profile
index 893865edd..d2980f75c 100644
--- a/etc/baobab.profile
+++ b/etc/baobab.profile
@@ -33,4 +33,4 @@ private-bin baobab
 private-dev
 private-tmp
 
-#memory-deny-write-execute - breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/bitwarden.profile b/etc/bitwarden.profile
index 550830157..a5538bacc 100644
--- a/etc/bitwarden.profile
+++ b/etc/bitwarden.profile
@@ -51,4 +51,4 @@ private-etc alternatives,ca-certificates,crypto-policies,fonts,hosts,nsswitch.co
 private-opt Bitwarden
 private-tmp
 
-#memory-deny-write-execute - breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/clawsker.profile b/etc/clawsker.profile
index 95f15398a..f8c05a55b 100644
--- a/etc/clawsker.profile
+++ b/etc/clawsker.profile
@@ -47,4 +47,4 @@ private-etc alternatives,fonts
 private-lib girepository-1.*,libdbus-glib-1.so.*,libetpan.so.*,libgirepository-1.*,libgtk-x11-2.0.so.*,libstartup-notification-1.so.*,perl*
 private-tmp
 
-# memory-deny-write-execute - breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/clipit.profile b/etc/clipit.profile
index 6e4d3fbaf..44cda0665 100644
--- a/etc/clipit.profile
+++ b/etc/clipit.profile
@@ -17,6 +17,13 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+mkdir ${HOME}/.config/clipit
+mkdir ${HOME}/.local/share/clipit
+whitelist ${HOME}/.config/clipit
+whitelist ${HOME}/.local/share/clipit
+include whitelist-common.inc
+include whitelist-var-common.inc
+
 apparmor
 caps.drop all
 ipc-namespace
diff --git a/etc/d-feet.profile b/etc/d-feet.profile
index 30749ab40..e06769601 100644
--- a/etc/d-feet.profile
+++ b/etc/d-feet.profile
@@ -49,4 +49,4 @@ private-dev
 private-etc alternatives,dbus-1,fonts,machine-id
 private-tmp
 
-# memory-deny-write-execute - Breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/devhelp.profile b/etc/devhelp.profile
index 4e618b7ea..60bebb0c9 100644
--- a/etc/devhelp.profile
+++ b/etc/devhelp.profile
@@ -41,6 +41,6 @@ private-dev
 private-etc alternatives,dconf,fonts,ld.so.cache,machine-id,ssl
 private-tmp
 
-# memory-deny-write-execute - Breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue 1803)
 
 read-only ${HOME}
diff --git a/etc/devilspie.profile b/etc/devilspie.profile
index 2d100c4b0..ca617983d 100644
--- a/etc/devilspie.profile
+++ b/etc/devilspie.profile
@@ -16,6 +16,11 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+mkdir ${HOME}/.devilspie
+whitelist ${HOME}/.devilspie
+include whitelist-common.inc
+include whitelist-var-common.inc
+
 apparmor
 caps.drop all
 ipc-namespace
diff --git a/etc/devilspie2.profile b/etc/devilspie2.profile
index 9d67ee76e..74b0dc939 100644
--- a/etc/devilspie2.profile
+++ b/etc/devilspie2.profile
@@ -19,6 +19,11 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+mkdir ${HOME}/.config/devilspie2
+whitelist ${HOME}/.config/devilspie2
+include whitelist-common.inc
+include whitelist-var-common.inc
+
 apparmor
 caps.drop all
 ipc-namespace
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 356c8209c..fb7e02d0b 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -239,6 +239,7 @@ blacklist ${HOME}/.config/nano
 blacklist ${HOME}/.config/nautilus
 blacklist ${HOME}/.config/nemo
 blacklist ${HOME}/.config/netsurf
+blacklist ${HOME}/.config/newsbeuter
 blacklist ${HOME}/.config/nheko
 blacklist ${HOME}/.config/NitroShare
 blacklist ${HOME}/.config/nomacs
@@ -574,6 +575,7 @@ blacklist ${HOME}/.multimc5
 blacklist ${HOME}/.nanorc
 blacklist ${HOME}/.netactview
 blacklist ${HOME}/.neverball
+blacklist ${HOME}/.newsbeuter
 blacklist ${HOME}/.newsboat
 blacklist ${HOME}/.nv
 blacklist ${HOME}/.nylas-mail
diff --git a/etc/enpass.profile b/etc/enpass.profile
index 99d3eac85..68113e294 100644
--- a/etc/enpass.profile
+++ b/etc/enpass.profile
@@ -59,4 +59,4 @@ private-dev
 private-opt Enpass
 private-tmp
 
-#memory-deny-write-execute - breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/eo-common.profile b/etc/eo-common.profile
index ad18e10c4..2a65de5e1 100644
--- a/etc/eo-common.profile
+++ b/etc/eo-common.profile
@@ -44,4 +44,4 @@ private-etc alternatives,dconf,fonts,gtk-3.0
 private-lib eog,eom,gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.*
 private-tmp
 
-#memory-deny-write-execute - breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/exfalso.profile b/etc/exfalso.profile
index 978629452..b5eda059f 100644
--- a/etc/exfalso.profile
+++ b/etc/exfalso.profile
@@ -13,6 +13,9 @@ noblacklist ${MUSIC}
 include allow-python2.inc
 include allow-python3.inc
 
+whitelist ${DOWNLOADS}
+whitelist ${MUSIC}
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -21,6 +24,11 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+mkdir ${HOME}/.quodlibet
+whitelist ${HOME}/.quodlibet
+include whitelist-common.inc
+include whitelist-var-common.inc
+
 caps.drop all
 machine-id
 netfilter
@@ -45,4 +53,4 @@ private-etc alternatives,fonts,group,passwd
 private-lib libatk-1.0.so.*,libgdk-3.so.*,libgdk_pixbuf-2.0.so.*,libgirepository-1.0.so.*,libgstreamer-1.0.so.*,libgtk-3.so.*,libgtksourceview-3.0.so.*,libpango-1.0.so.*,libpython*,libreadline.so.*,libsoup-2.4.so.*,libssl.so.1.*,python2*,python3*
 private-tmp
 
-# memory-deny-write-execute - Breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/firefox-common-addons.inc b/etc/firefox-common-addons.inc
index 7d9e512b2..0b95c555b 100644
--- a/etc/firefox-common-addons.inc
+++ b/etc/firefox-common-addons.inc
@@ -43,8 +43,10 @@ whitelist ${HOME}/.lastpass
 whitelist ${HOME}/.local/share/kget
 whitelist ${HOME}/.local/share/okular
 whitelist ${HOME}/.local/share/qpdfview
+whitelist ${HOME}/.local/share/tridactyl
 whitelist ${HOME}/.pentadactyl
 whitelist ${HOME}/.pentadactylrc
+whitelist ${HOME}/.tridactylrc
 whitelist ${HOME}/.vimperator
 whitelist ${HOME}/.vimperatorrc
 whitelist ${HOME}/.wine-pipelight
diff --git a/etc/font-manager.profile b/etc/font-manager.profile
index a1280124a..1699e5cfc 100644
--- a/etc/font-manager.profile
+++ b/etc/font-manager.profile
@@ -50,4 +50,4 @@ private-bin font-manager,python*,yelp
 private-dev
 private-tmp
 
-#memory-deny-write-execute - Breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/geekbench.profile b/etc/geekbench.profile
index a4c33b46f..8d7dbd48e 100644
--- a/etc/geekbench.profile
+++ b/etc/geekbench.profile
@@ -46,6 +46,6 @@ private-lib libstdc++.so.*
 private-opt none
 private-tmp
 
-# memory-deny-write-execute - Breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
 
 read-only ${HOME}
diff --git a/etc/godot.profile b/etc/godot.profile
index f2b365455..2baf09b1d 100644
--- a/etc/godot.profile
+++ b/etc/godot.profile
@@ -35,8 +35,8 @@ seccomp
 shell none
 tracelog
 
-disable-mnt
-private-bin godot
+
+# private-bin godot
 private-cache
 private-dev
 private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,machine-id,nsswitch.conf,openal,pki,pulse,resolv.conf,ssl
diff --git a/etc/keepassxc-cli.profile b/etc/keepassxc-cli.profile
new file mode 100644
index 000000000..6f657e7de
--- /dev/null
+++ b/etc/keepassxc-cli.profile
@@ -0,0 +1,12 @@
+# Firejail profile for keepassxc-cli
+# Description: command line interface for KeePassXC
+# This file is overwritten after every install/update
+# Persistent local customizations
+include keepassxc-cli.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+
+# Redirect
+include keepassxc.profile
diff --git a/etc/keepassxc-proxy.profile b/etc/keepassxc-proxy.profile
new file mode 100644
index 000000000..79666aee2
--- /dev/null
+++ b/etc/keepassxc-proxy.profile
@@ -0,0 +1,11 @@
+# Firejail profile for keepassxc-cli
+# This file is overwritten after every install/update
+# Persistent local customizations
+include keepassxc-proxy.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+
+# Redirect
+include keepassxc.profile
diff --git a/etc/keepassxc.profile b/etc/keepassxc.profile
index c1adfd516..6ef02ad47 100644
--- a/etc/keepassxc.profile
+++ b/etc/keepassxc.profile
@@ -37,11 +37,11 @@ nosound
 notv
 nou2f
 novideo
-protocol netlink,unix
+protocol unix,netlink
 seccomp
 shell none
 
-private-bin keepassxc,keepassxc-proxy
+private-bin keepassxc,keepassxc-cli,keepassxc-proxy
 private-dev
 private-etc alternatives,fonts,ld.so.cache,machine-id
 private-tmp
diff --git a/etc/meld.profile b/etc/meld.profile
index 321b92cd5..4a9f64421 100644
--- a/etc/meld.profile
+++ b/etc/meld.profile
@@ -6,11 +6,11 @@ include meld.local
 # Persistent global definitions
 include globals.local
 
-# If you want to use meld as git-mergetool (and may some other VCS integrations) you need
-# to bypass firejail, you can do this by removing the symlink or call it by its absolut path
+# If you want to use meld as git-mergetool (and maybe some other VCS integrations) you need
+# to bypass firejail, you can do this by removing the symlink or calling it by its absolute path
 # Removing the symlink:
 #  sudo rm /usr/local/bin/meld
-# Calling by its absolut path (example for git-mergetoll):
+# Calling by its absolute path (example for git-mergetool):
 #  git config --global mergetool.meld.cmd /usr/bin/meld
 
 noblacklist ${HOME}/.config/git
diff --git a/etc/mpDris2.profile b/etc/mpDris2.profile
index db2bb6a93..eb49b52ab 100644
--- a/etc/mpDris2.profile
+++ b/etc/mpDris2.profile
@@ -12,6 +12,8 @@ noblacklist ${HOME}/.config/mpDris2
 include allow-python2.inc
 include allow-python3.inc
 
+noblacklist ${MUSIC}
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -20,6 +22,12 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist ${MUSIC}
+
+mkdir ${HOME}/.config/mpDris2
+whitelist ${HOME}/.config/mpDris2
+include whitelist-var-common.inc
+
 caps.drop all
 machine-id
 netfilter
@@ -43,6 +51,6 @@ private-etc alternatives,hosts,nsswitch.conf
 private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotify.so.*,libpython*,python2*,python3*
 private-tmp
 
-# memory-deny-write-execute - Breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
 
 read-only ${HOME}
diff --git a/etc/mpsyt.profile b/etc/mpsyt.profile
index d87241070..f0309da9a 100644
--- a/etc/mpsyt.profile
+++ b/etc/mpsyt.profile
@@ -6,18 +6,19 @@ include mpsyt.local
 # Persistent global definitions
 include globals.local
 
+noblacklist ${HOME}/.config/mps-youtube
 noblacklist ${HOME}/.config/mpv
 noblacklist ${HOME}/.mplayer
-noblacklist ${HOME}/.config/mps-youtube
 noblacklist ${HOME}/.netrc
 noblacklist ${HOME}/mps
-noblacklist ${MUSIC}
-noblacklist ${VIDEOS}
 
 # Allow python (blacklisted by disable-interpreters.inc)
 include allow-python2.inc
 include allow-python3.inc
 
+noblacklist ${MUSIC}
+noblacklist ${VIDEOS}
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -27,14 +28,17 @@ include disable-programs.inc
 include disable-xdg.inc
 
 mkdir ${HOME}/.config/mps-youtube
+mkdir ${HOME}/.config/mpv
+mkdir ${HOME}/.mplayer
+mkdir ${HOME}/mps
+whitelist ${HOME}/.config/mps-youtube
 whitelist ${HOME}/.config/mpv
 whitelist ${HOME}/.mplayer
-whitelist ${HOME}/.config/mps-youtube
 whitelist ${HOME}/.netrc
 whitelist ${HOME}/mps
+whitelist ${DOWNLOADS}
 whitelist ${MUSIC}
 whitelist ${VIDEOS}
-whitelist ${DOWNLOADS}
 include whitelist-common.inc
 include whitelist-var-common.inc
 
diff --git a/etc/mpv.profile b/etc/mpv.profile
index 5aa9e7e74..07a6ba42b 100644
--- a/etc/mpv.profile
+++ b/etc/mpv.profile
@@ -9,13 +9,14 @@ include globals.local
 
 noblacklist ${HOME}/.config/mpv
 noblacklist ${HOME}/.netrc
-noblacklist ${MUSIC}
-noblacklist ${VIDEOS}
 
 # Allow python (blacklisted by disable-interpreters.inc)
 include allow-python2.inc
 include allow-python3.inc
 
+noblacklist ${MUSIC}
+noblacklist ${VIDEOS}
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
diff --git a/etc/newsbeuter.profile b/etc/newsbeuter.profile
new file mode 100644
index 000000000..059c2156d
--- /dev/null
+++ b/etc/newsbeuter.profile
@@ -0,0 +1,21 @@
+# Firejail profile for Newsboat
+# Description: Text based Atom/RSS feed reader
+# This file is overwritten after every install/update
+# Persistent local customizations
+include newsbeuter.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+noblacklist ${HOME}/.config/newsbeuter
+noblacklist ${HOME}/.newsbeuter
+
+mkdir ${HOME}/.config/newsbeuter
+mkdir ${HOME}/.newsbeuter
+whitelist ${HOME}/.config/newsbeuter
+whitelist ${HOME}/.newsbeuter
+
+private-bin newsbeuter
+
+# Redirect
+include newsboat.profile
diff --git a/etc/ocenaudio.profile b/etc/ocenaudio.profile
index b2249f63b..ea89a259f 100644
--- a/etc/ocenaudio.profile
+++ b/etc/ocenaudio.profile
@@ -45,4 +45,4 @@ private-dev
 private-etc alternatives,asound.conf,fonts,ld.so.cache,pulse
 private-tmp
 
-# memory-deny-write-execute - breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/pavucontrol.profile b/etc/pavucontrol.profile
index 18b9b7fc6..3fd4f3668 100644
--- a/etc/pavucontrol.profile
+++ b/etc/pavucontrol.profile
@@ -16,6 +16,9 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+mkdir ${HOME}/.config/pavucontrol.ini
+whitelist ${HOME}/.config/pavucontrol.ini
+include whitelist-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/pdftotext.profile b/etc/pdftotext.profile
index 85e28372e..87d7a87f1 100644
--- a/etc/pdftotext.profile
+++ b/etc/pdftotext.profile
@@ -16,6 +16,8 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist ${DOCUMENTS}
+whitelist ${DOWNLOADS}
 include whitelist-var-common.inc
 
 caps.drop all
diff --git a/etc/qtox.profile b/etc/qtox.profile
index 4a731b45a..c3e8fb95c 100644
--- a/etc/qtox.profile
+++ b/etc/qtox.profile
@@ -45,4 +45,4 @@ private-dev
 private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl
 private-tmp
 
-memory-deny-write-execute
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/redshift.profile b/etc/redshift.profile
index e60877172..0f6d34ed0 100644
--- a/etc/redshift.profile
+++ b/etc/redshift.profile
@@ -18,6 +18,9 @@ include disable-interpreters.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+mkdir ${HOME}/.config/redshift
+whitelist ${HOME}/.config/redshift
+whitelist ${HOME}/.config/redshift.conf
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/seahorse.profile b/etc/seahorse.profile
index 7baae2603..be63f9382 100644
--- a/etc/seahorse.profile
+++ b/etc/seahorse.profile
@@ -6,24 +6,10 @@ include seahorse.local
 # Persistent global definitions
 include globals.local
 
-# dconf
 noblacklist ${HOME}/.config/dconf
-whitelist ${HOME}/.config/dconf
-
-# gpg
-mkdir ${HOME}/.gnupg
 noblacklist ${HOME}/.gnupg
-whitelist ${HOME}/.gnupg
-
-# ssh
-whitelist /etc/ld.so.preload
-noblacklist /etc/ssh
-whitelist /etc/ssh
-noblacklist /tmp/ssh-*
-whitelist /tmp/ssh-*
-mkdir ${HOME}/.ssh
 noblacklist ${HOME}/.ssh
-whitelist ${HOME}/.ssh
+noblacklist /tmp/ssh-*
 
 include disable-common.inc
 include disable-devel.inc
@@ -33,6 +19,13 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+mkdir ${HOME}/.config/dconf
+mkdir ${HOME}/.gnupg
+mkdir ${HOME}/.ssh
+whitelist ${HOME}/.config/dconf
+whitelist ${HOME}/.gnupg
+whitelist ${HOME}/.ssh
+whitelist /tmp/ssh-*
 include whitelist-common.inc
 include whitelist-var-common.inc
 
@@ -57,5 +50,6 @@ tracelog
 disable-mnt
 private-cache
 private-dev
+private-etc ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,hostname,host.conf,hosts,ld.so.preload,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssh,ssl,X11
 
 writable-run-user
diff --git a/etc/smplayer.profile b/etc/smplayer.profile
index 9b824604a..f83caee8a 100644
--- a/etc/smplayer.profile
+++ b/etc/smplayer.profile
@@ -8,13 +8,14 @@ include globals.local
 
 noblacklist ${HOME}/.config/smplayer
 noblacklist ${HOME}/.mplayer
-noblacklist ${MUSIC}
-noblacklist ${VIDEOS}
 
 # Allow python (blacklisted by disable-interpreters.inc)
 include allow-python2.inc
 include allow-python3.inc
 
+noblacklist ${MUSIC}
+noblacklist ${VIDEOS}
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
diff --git a/etc/soundconverter.profile b/etc/soundconverter.profile
index d875146de..efd600eb2 100644
--- a/etc/soundconverter.profile
+++ b/etc/soundconverter.profile
@@ -6,12 +6,12 @@ include soundconverter.local
 # Persistent global definitions
 include globals.local
 
-noblacklist ${MUSIC}
-
 # Allow python (blacklisted by disable-interpreters.inc)
 include allow-python2.inc
 include allow-python3.inc
 
+noblacklist ${MUSIC}
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -20,6 +20,9 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist ${DOWNLOADS}
+whitelist ${MUSIC}
+include whitelist-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/subdownloader.profile b/etc/subdownloader.profile
index b55300c88..d0176a657 100644
--- a/etc/subdownloader.profile
+++ b/etc/subdownloader.profile
@@ -40,4 +40,4 @@ private-dev
 private-etc alternatives,fonts
 private-tmp
 
-# memory-deny-write-execute - Breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)
diff --git a/etc/tcpdump.profile b/etc/tcpdump.profile
new file mode 100644
index 000000000..7713ac6c0
--- /dev/null
+++ b/etc/tcpdump.profile
@@ -0,0 +1,44 @@
+# Firejail profile for tcpdump
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include tcpdump.local
+# Persistent global definitions
+include globals.local
+
+noblacklist /sbin
+noblacklist /usr/sbin
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include disable-xdg.inc
+include whitelist-common.inc
+
+caps.keep net_raw
+ipc-namespace
+#net tun0
+netfilter
+no3d
+nodvd
+#nogroups
+nonewprivs
+#noroot
+nosound
+notv
+nou2f
+novideo
+
+protocol unix,inet,inet6,netlink,packet
+seccomp
+
+disable-mnt
+#private
+#private-bin tcpdump
+private-dev
+#private-etc
+private-tmp
+
+memory-deny-write-execute
diff --git a/etc/totem.profile b/etc/totem.profile
index f541d3cc2..9e6684824 100644
--- a/etc/totem.profile
+++ b/etc/totem.profile
@@ -6,6 +6,9 @@ include totem.local
 # Persistent global definitions
 include globals.local
 
+# Allow lua (required for youtube video)
+include allow-lua.inc
+
 noblacklist ${HOME}/.config/totem
 noblacklist ${HOME}/.local/share/totem
 noblacklist ${MUSIC}
diff --git a/etc/tshark.profile b/etc/tshark.profile
new file mode 100644
index 000000000..52ee228a3
--- /dev/null
+++ b/etc/tshark.profile
@@ -0,0 +1,44 @@
+# Firejail profile for tshark
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include tshark.local
+# Persistent global definitions
+include globals.local
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include disable-xdg.inc
+include whitelist-common.inc
+
+#caps.keep net_raw
+caps.keep dac_override,net_admin,net_raw
+ipc-namespace
+#net tun0
+netfilter
+no3d
+nodvd
+# nogroups - breaks network traffic capture for unprivileged users
+# nonewprivs - breaks network traffic capture for unprivileged users
+# noroot
+nosound
+notv
+nou2f
+novideo
+
+#protocol unix,inet,inet6,netlink,packet
+#seccomp
+
+disable-mnt
+#private
+private-cache
+#private-bin tshark
+private-dev
+#private-etc
+private-tmp
+
+# memory-deny-write-execute
diff --git a/etc/viewnior.profile b/etc/viewnior.profile
index 943719e75..e238db8ce 100644
--- a/etc/viewnior.profile
+++ b/etc/viewnior.profile
@@ -43,5 +43,4 @@ private-dev
 private-etc alternatives,fonts,machine-id
 private-tmp
 
-# memory-deny-write-executes breaks on Arch - see issue #1808
-#memory-deny-write-execute
+#memory-deny-write-execute - breaks on Arch (see issues #1803 and #1808)
diff --git a/etc/youtube-dl.profile b/etc/youtube-dl.profile
index 190c972c0..28b5f2376 100644
--- a/etc/youtube-dl.profile
+++ b/etc/youtube-dl.profile
@@ -55,4 +55,4 @@ private-dev
 private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,mime.types,pki,resolv.conf,ssl,youtube-dl.conf
 private-tmp
 
-# memory-deny-write-execute - breaks on Arch
+#memory-deny-write-execute - breaks on Arch (see issue #1803)