diff options
Diffstat (limited to 'etc')
-rw-r--r-- | etc/inc/disable-programs.inc | 4 | ||||
-rw-r--r-- | etc/profile-a-l/audio-recorder.profile | 7 | ||||
-rw-r--r-- | etc/profile-a-l/discord-common.profile | 1 | ||||
-rw-r--r-- | etc/profile-a-l/firefox.profile | 8 | ||||
-rw-r--r-- | etc/profile-m-z/regextester.profile | 11 | ||||
-rw-r--r-- | etc/profile-m-z/steam.profile | 18 | ||||
-rw-r--r-- | etc/profile-m-z/xfce4-mixer.profile | 2 |
7 files changed, 38 insertions, 13 deletions
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index cc0c69df2..cbc8ef6d2 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -139,6 +139,7 @@ blacklist ${HOME}/.config/Rambox | |||
139 | blacklist ${HOME}/.config/Riot | 139 | blacklist ${HOME}/.config/Riot |
140 | blacklist ${HOME}/.config/Rocket.Chat | 140 | blacklist ${HOME}/.config/Rocket.Chat |
141 | blacklist ${HOME}/.config/RogueLegacy | 141 | blacklist ${HOME}/.config/RogueLegacy |
142 | blacklist ${HOME}/.config/RogueLegacyStorageContainer | ||
142 | blacklist ${HOME}/.config/Signal | 143 | blacklist ${HOME}/.config/Signal |
143 | blacklist ${HOME}/.config/Sinew Software Systems | 144 | blacklist ${HOME}/.config/Sinew Software Systems |
144 | blacklist ${HOME}/.config/Slack | 145 | blacklist ${HOME}/.config/Slack |
@@ -616,7 +617,8 @@ blacklist ${HOME}/.local/share/QGIS | |||
616 | blacklist ${HOME}/.local/share/QMediathekView | 617 | blacklist ${HOME}/.local/share/QMediathekView |
617 | blacklist ${HOME}/.local/share/QuiteRss | 618 | blacklist ${HOME}/.local/share/QuiteRss |
618 | blacklist ${HOME}/.local/share/Ricochet | 619 | blacklist ${HOME}/.local/share/Ricochet |
619 | blacklist ${HOME}/.local/share/RogueLegacy* | 620 | blacklist ${HOME}/.local/share/RogueLegacy |
621 | blacklist ${HOME}/.local/share/RogueLegacyStorageContainer | ||
620 | blacklist ${HOME}/.local/share/Shortwave | 622 | blacklist ${HOME}/.local/share/Shortwave |
621 | blacklist ${HOME}/.local/share/Steam | 623 | blacklist ${HOME}/.local/share/Steam |
622 | blacklist ${HOME}/.local/share/SteamWorldDig | 624 | blacklist ${HOME}/.local/share/SteamWorldDig |
diff --git a/etc/profile-a-l/audio-recorder.profile b/etc/profile-a-l/audio-recorder.profile index b2ed3b030..2c7fdc812 100644 --- a/etc/profile-a-l/audio-recorder.profile +++ b/etc/profile-a-l/audio-recorder.profile | |||
@@ -20,6 +20,7 @@ include disable-xdg.inc | |||
20 | whitelist ${MUSIC} | 20 | whitelist ${MUSIC} |
21 | whitelist ${DOWNLOADS} | 21 | whitelist ${DOWNLOADS} |
22 | whitelist /usr/share/audio-recorder | 22 | whitelist /usr/share/audio-recorder |
23 | whitelist /usr/share/gstreamer-1.0 | ||
23 | include whitelist-common.inc | 24 | include whitelist-common.inc |
24 | include whitelist-usr-share-common.inc | 25 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
@@ -44,7 +45,11 @@ tracelog | |||
44 | disable-mnt | 45 | disable-mnt |
45 | # private-bin audio-recorder | 46 | # private-bin audio-recorder |
46 | private-cache | 47 | private-cache |
47 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload |
48 | private-tmp | 49 | private-tmp |
49 | 50 | ||
51 | dbus-user filter | ||
52 | dbus-user.talk ca.desrt.dconf | ||
53 | dbus-system none | ||
54 | |||
50 | # memory-deny-write-execute - breaks on Arch | 55 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/profile-a-l/discord-common.profile b/etc/profile-a-l/discord-common.profile index b583f1a1d..b83e626d9 100644 --- a/etc/profile-a-l/discord-common.profile +++ b/etc/profile-a-l/discord-common.profile | |||
@@ -18,6 +18,7 @@ ignore dbus-user none | |||
18 | ignore dbus-system none | 18 | ignore dbus-system none |
19 | 19 | ||
20 | ignore noexec ${HOME} | 20 | ignore noexec ${HOME} |
21 | ignore novideo | ||
21 | 22 | ||
22 | whitelist ${HOME}/.config/BetterDiscord | 23 | whitelist ${HOME}/.config/BetterDiscord |
23 | whitelist ${HOME}/.local/share/betterdiscordctl | 24 | whitelist ${HOME}/.local/share/betterdiscordctl |
diff --git a/etc/profile-a-l/firefox.profile b/etc/profile-a-l/firefox.profile index cefba93d4..b22a78458 100644 --- a/etc/profile-a-l/firefox.profile +++ b/etc/profile-a-l/firefox.profile | |||
@@ -6,6 +6,14 @@ include firefox.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # NOTE: sandboxing web browsers is as important as it is complex. Users might be | ||
10 | # interested in creating custom profiles depending on use case (e.g. one for | ||
11 | # general browsing, another for banking, ...). Consult our FAQ/issue tracker for more | ||
12 | # info. Here are a few links to get you going. | ||
13 | # https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#firefox-doesnt-open-in-a-new-sandbox-instead-it-opens-a-new-tab-in-an-existing-firefox-instance | ||
14 | # https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#how-do-i-run-two-instances-of-firefox | ||
15 | # https://github.com/netblue30/firejail/issues/4206#issuecomment-824806968 | ||
16 | |||
9 | noblacklist ${HOME}/.cache/mozilla | 17 | noblacklist ${HOME}/.cache/mozilla |
10 | noblacklist ${HOME}/.mozilla | 18 | noblacklist ${HOME}/.mozilla |
11 | 19 | ||
diff --git a/etc/profile-m-z/regextester.profile b/etc/profile-m-z/regextester.profile index 6fb0d4b5f..bab2badb5 100644 --- a/etc/profile-m-z/regextester.profile +++ b/etc/profile-m-z/regextester.profile | |||
@@ -16,9 +16,8 @@ include disable-shell.inc | |||
16 | include disable-xdg.inc | 16 | include disable-xdg.inc |
17 | 17 | ||
18 | whitelist /usr/share/com.github.artemanufrij.regextester | 18 | whitelist /usr/share/com.github.artemanufrij.regextester |
19 | include whitelist-usr-share-common.inc | ||
20 | |||
21 | include whitelist-common.inc | 19 | include whitelist-common.inc |
20 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
23 | 22 | ||
24 | apparmor | 23 | apparmor |
@@ -48,11 +47,9 @@ private-etc alternatives,fonts | |||
48 | private-lib libgranite.so.* | 47 | private-lib libgranite.so.* |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | # makes settings immutable | 50 | dbus-user filter |
52 | # dbus-user none | 51 | dbus-user.talk ca.desrt.dconf |
53 | # dbus-system none | 52 | dbus-system none |
54 | |||
55 | memory-deny-write-execute | ||
56 | 53 | ||
57 | # never write anything | 54 | # never write anything |
58 | read-only ${HOME} | 55 | read-only ${HOME} |
diff --git a/etc/profile-m-z/steam.profile b/etc/profile-m-z/steam.profile index 0bcbe6da2..922823f98 100644 --- a/etc/profile-m-z/steam.profile +++ b/etc/profile-m-z/steam.profile | |||
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/Epic | |||
10 | noblacklist ${HOME}/.config/Loop_Hero | 10 | noblacklist ${HOME}/.config/Loop_Hero |
11 | noblacklist ${HOME}/.config/ModTheSpire | 11 | noblacklist ${HOME}/.config/ModTheSpire |
12 | noblacklist ${HOME}/.config/RogueLegacy | 12 | noblacklist ${HOME}/.config/RogueLegacy |
13 | noblacklist ${HOME}/.config/RogueLegacyStorageContainer | ||
13 | noblacklist ${HOME}/.killingfloor | 14 | noblacklist ${HOME}/.killingfloor |
14 | noblacklist ${HOME}/.klei | 15 | noblacklist ${HOME}/.klei |
15 | noblacklist ${HOME}/.local/share/3909/PapersPlease | 16 | noblacklist ${HOME}/.local/share/3909/PapersPlease |
@@ -22,7 +23,8 @@ noblacklist ${HOME}/.local/share/feral-interactive | |||
22 | noblacklist ${HOME}/.local/share/IntoTheBreach | 23 | noblacklist ${HOME}/.local/share/IntoTheBreach |
23 | noblacklist ${HOME}/.local/share/Paradox Interactive | 24 | noblacklist ${HOME}/.local/share/Paradox Interactive |
24 | noblacklist ${HOME}/.local/share/PillarsOfEternity | 25 | noblacklist ${HOME}/.local/share/PillarsOfEternity |
25 | noblacklist ${HOME}/.local/share/RogueLegacy* | 26 | noblacklist ${HOME}/.local/share/RogueLegacy |
27 | noblacklist ${HOME}/.local/share/RogueLegacyStorageContainer | ||
26 | noblacklist ${HOME}/.local/share/Steam | 28 | noblacklist ${HOME}/.local/share/Steam |
27 | noblacklist ${HOME}/.local/share/SteamWorldDig | 29 | noblacklist ${HOME}/.local/share/SteamWorldDig |
28 | noblacklist ${HOME}/.local/share/SteamWorld Dig 2 | 30 | noblacklist ${HOME}/.local/share/SteamWorld Dig 2 |
@@ -69,7 +71,7 @@ mkdir ${HOME}/.local/share/feral-interactive | |||
69 | mkdir ${HOME}/.local/share/IntoTheBreach | 71 | mkdir ${HOME}/.local/share/IntoTheBreach |
70 | mkdir ${HOME}/.local/share/Paradox Interactive | 72 | mkdir ${HOME}/.local/share/Paradox Interactive |
71 | mkdir ${HOME}/.local/share/PillarsOfEternity | 73 | mkdir ${HOME}/.local/share/PillarsOfEternity |
72 | mkdir ${HOME}/.local/share/RogueLegacy* | 74 | mkdir ${HOME}/.local/share/RogueLegacy |
73 | mkdir ${HOME}/.local/share/Steam | 75 | mkdir ${HOME}/.local/share/Steam |
74 | mkdir ${HOME}/.local/share/SteamWorldDig | 76 | mkdir ${HOME}/.local/share/SteamWorldDig |
75 | mkdir ${HOME}/.local/share/SteamWorld Dig 2 | 77 | mkdir ${HOME}/.local/share/SteamWorld Dig 2 |
@@ -86,6 +88,7 @@ whitelist ${HOME}/.config/Epic | |||
86 | whitelist ${HOME}/.config/Loop_Hero | 88 | whitelist ${HOME}/.config/Loop_Hero |
87 | whitelist ${HOME}/.config/ModTheSpire | 89 | whitelist ${HOME}/.config/ModTheSpire |
88 | whitelist ${HOME}/.config/RogueLegacy | 90 | whitelist ${HOME}/.config/RogueLegacy |
91 | whitelist ${HOME}/.config/RogueLegacyStorageContainer | ||
89 | whitelist ${HOME}/.config/unity3d | 92 | whitelist ${HOME}/.config/unity3d |
90 | whitelist ${HOME}/.killingfloor | 93 | whitelist ${HOME}/.killingfloor |
91 | whitelist ${HOME}/.klei | 94 | whitelist ${HOME}/.klei |
@@ -99,7 +102,8 @@ whitelist ${HOME}/.local/share/feral-interactive | |||
99 | whitelist ${HOME}/.local/share/IntoTheBreach | 102 | whitelist ${HOME}/.local/share/IntoTheBreach |
100 | whitelist ${HOME}/.local/share/Paradox Interactive | 103 | whitelist ${HOME}/.local/share/Paradox Interactive |
101 | whitelist ${HOME}/.local/share/PillarsOfEternity | 104 | whitelist ${HOME}/.local/share/PillarsOfEternity |
102 | whitelist ${HOME}/.local/share/RogueLegacy* | 105 | whitelist ${HOME}/.local/share/RogueLegacy |
106 | whitelist ${HOME}/.local/share/RogueLegacyStorageContainer | ||
103 | whitelist ${HOME}/.local/share/Steam | 107 | whitelist ${HOME}/.local/share/Steam |
104 | whitelist ${HOME}/.local/share/SteamWorldDig | 108 | whitelist ${HOME}/.local/share/SteamWorldDig |
105 | whitelist ${HOME}/.local/share/SteamWorld Dig 2 | 109 | whitelist ${HOME}/.local/share/SteamWorld Dig 2 |
@@ -115,6 +119,14 @@ whitelist ${HOME}/.steampid | |||
115 | include whitelist-common.inc | 119 | include whitelist-common.inc |
116 | include whitelist-var-common.inc | 120 | include whitelist-var-common.inc |
117 | 121 | ||
122 | # Note: The following were intentionally left out as they are alternative | ||
123 | # (i.e.: unnecessary and/or legacy) paths whose existence may potentially | ||
124 | # clobber other paths (see #4225). If you use any, either add the entry to | ||
125 | # steam.local or move the contents to a path listed above (or open an issue if | ||
126 | # it's missing above). | ||
127 | #mkdir ${HOME}/.config/RogueLegacyStorageContainer | ||
128 | #mkdir ${HOME}/.local/share/RogueLegacyStorageContainer | ||
129 | |||
118 | caps.drop all | 130 | caps.drop all |
119 | #ipc-namespace | 131 | #ipc-namespace |
120 | netfilter | 132 | netfilter |
diff --git a/etc/profile-m-z/xfce4-mixer.profile b/etc/profile-m-z/xfce4-mixer.profile index 78cb2862c..d9d1cd393 100644 --- a/etc/profile-m-z/xfce4-mixer.profile +++ b/etc/profile-m-z/xfce4-mixer.profile | |||
@@ -19,7 +19,7 @@ include disable-xdg.inc | |||
19 | 19 | ||
20 | mkfile ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml | 20 | mkfile ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml |
21 | whitelist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml | 21 | whitelist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml |
22 | whitelist /usr/share/gstreamer | 22 | whitelist /usr/share/gstreamer-* |
23 | whitelist /usr/share/xfce4 | 23 | whitelist /usr/share/xfce4 |
24 | whitelist /usr/share/xfce4-mixer | 24 | whitelist /usr/share/xfce4-mixer |
25 | include whitelist-common.inc | 25 | include whitelist-common.inc |