8 files changed, 47 insertions, 5 deletions

diff --git a/etc/net/nolocal.net b/etc/net/nolocal.net
index 0eb9f9784..a37b18599 100644
--- a/etc/net/nolocal.net
+++ b/etc/net/nolocal.net
@@ -20,8 +20,8 @@
 
 # allow ping etc.
 -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
--A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
 -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
+-A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
 
 # accept dns requests going out to a server on the local network
 -A OUTPUT -p udp --dport 53 -j ACCEPT
diff --git a/etc/net/nolocal6.net b/etc/net/nolocal6.net
index 5a6678d03..5a66f0bbc 100644
--- a/etc/net/nolocal6.net
+++ b/etc/net/nolocal6.net
@@ -20,8 +20,8 @@
 
 # allow ping etc.
 -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type destination-unreachable -j ACCEPT
--A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type time-exceeded -j ACCEPT
 -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT
+-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type echo-reply -j ACCEPT
 # required for ipv6
 -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type router-solicitation -j ACCEPT
 -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type neighbour-solicitation -j ACCEPT
diff --git a/etc/profile-a-l/cinelerra-gg b/etc/profile-a-l/cinelerra-gg
new file mode 100644
index 000000000..ccb9fe04b
--- /dev/null
+++ b/etc/profile-a-l/cinelerra-gg
@@ -0,0 +1,10 @@
+# Firejail profile alias for cin
+# This file is overwritten after every install/update
+# Persistent local customizations
+include cinelerra-gg.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+# Redirect
+include cin.profile
diff --git a/etc/profile-a-l/deluge.profile b/etc/profile-a-l/deluge.profile
index fddd613e2..d8a27da62 100644
--- a/etc/profile-a-l/deluge.profile
+++ b/etc/profile-a-l/deluge.profile
@@ -36,7 +36,7 @@ nosound
 notv
 nou2f
 novideo
-protocol unix,inet,inet6
+protocol unix,inet,inet6,netlink
 seccomp
 
 # deluge is using python on Debian
diff --git a/etc/profile-a-l/freetube.profile b/etc/profile-a-l/freetube.profile
index cb00ce11b..bcde18b36 100644
--- a/etc/profile-a-l/freetube.profile
+++ b/etc/profile-a-l/freetube.profile
@@ -6,6 +6,8 @@ include freetube.local
 # Persistent global definitions
 include globals.local
 
+ignore dbus-user none
+
 noblacklist ${HOME}/.config/FreeTube
 
 include allow-bin-sh.inc
@@ -18,5 +20,9 @@ whitelist ${HOME}/.config/FreeTube
 private-bin electron,electron[0-9],electron[0-9][0-9],freetube,sh
 private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg
 
+dbus-user filter
+dbus-user.own org.mpris.MediaPlayer2.chromium.*
+dbus-user.own org.mpris.MediaPlayer2.freetube
+
 # Redirect
 include electron.profile
diff --git a/etc/profile-a-l/godot3.profile b/etc/profile-a-l/godot3.profile
new file mode 100644
index 000000000..90d1b15b7
--- /dev/null
+++ b/etc/profile-a-l/godot3.profile
@@ -0,0 +1,11 @@
+# Firejail profile for godot
+# Description: multi-platform 2D and 3D game engine with a feature-rich editor
+# This file is overwritten after every install/update
+# Persistent local customizations
+include godot3.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+# Redirect
+include godot.profile
diff --git a/etc/profile-m-z/nicotine.profile b/etc/profile-m-z/nicotine.profile
index bb2a41457..22c8b1782 100644
--- a/etc/profile-m-z/nicotine.profile
+++ b/etc/profile-m-z/nicotine.profile
@@ -8,8 +8,12 @@ include globals.local
 
 noblacklist ${HOME}/.nicotine
 
+# Allow /bin/sh (blacklisted by disable-shell.inc)
+include allow-bin-sh.inc
+
 # Allow python (blacklisted by disable-interpreters.inc)
 include allow-python2.inc
+include allow-python3.inc
 
 include disable-common.inc
 include disable-devel.inc
@@ -37,6 +41,7 @@ nodvd
 nogroups
 noinput
 nonewprivs
+noprinters
 noroot
 nosound
 notv
@@ -47,7 +52,7 @@ seccomp
 tracelog
 
 disable-mnt
-private-bin nicotine,python2*
+#private-bin nicotine,python2*
 private-cache
 private-dev
 private-tmp
diff --git a/etc/profile-m-z/youtube-viewers-common.profile b/etc/profile-m-z/youtube-viewers-common.profile
index 8582e2462..28c219377 100644
--- a/etc/profile-m-z/youtube-viewers-common.profile
+++ b/etc/profile-m-z/youtube-viewers-common.profile
@@ -19,6 +19,13 @@ include allow-perl.inc
 include allow-python2.inc
 include allow-python3.inc
 
+# The lines below are needed to find the default Firefox profile name, to allow
+# opening links in an existing instance of Firefox (note that it still fails if
+# there isn't a Firefox instance running with the default profile; see #5352)
+noblacklist ${HOME}/.mozilla
+whitelist ${HOME}/.mozilla/firefox/profiles.ini
+read-only ${HOME}/.mozilla/firefox/profiles.ini
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
@@ -55,5 +62,8 @@ private-dev
 private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg
 private-tmp
 
-dbus-user none
+dbus-user filter
+# allow D-Bus communication with firefox for opening links
+dbus-user.talk org.mozilla.*
+
 dbus-system none