diff options
Diffstat (limited to 'etc')
33 files changed, 214 insertions, 79 deletions
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc index 65159b951..5f4233363 100644 --- a/etc/inc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -556,6 +556,7 @@ blacklist ${PATH}/ss | |||
556 | blacklist ${PATH}/traceroute | 556 | blacklist ${PATH}/traceroute |
557 | 557 | ||
558 | # other SUID binaries | 558 | # other SUID binaries |
559 | blacklist /opt/microsoft/msedge*/msedge-sandbox | ||
559 | blacklist /usr/lib/virtualbox | 560 | blacklist /usr/lib/virtualbox |
560 | blacklist /usr/lib64/virtualbox | 561 | blacklist /usr/lib64/virtualbox |
561 | 562 | ||
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 40c123968..c7e2f2ca9 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -320,6 +320,7 @@ blacklist ${HOME}/.config/PacmanLogViewer | |||
320 | blacklist ${HOME}/.config/PawelStolowski | 320 | blacklist ${HOME}/.config/PawelStolowski |
321 | blacklist ${HOME}/.config/Philipp Schmieder | 321 | blacklist ${HOME}/.config/Philipp Schmieder |
322 | blacklist ${HOME}/.config/Pinta | 322 | blacklist ${HOME}/.config/Pinta |
323 | blacklist ${HOME}/.config/Postman | ||
323 | blacklist ${HOME}/.config/QGIS | 324 | blacklist ${HOME}/.config/QGIS |
324 | blacklist ${HOME}/.config/QMediathekView | 325 | blacklist ${HOME}/.config/QMediathekView |
325 | blacklist ${HOME}/.config/QQ | 326 | blacklist ${HOME}/.config/QQ |
@@ -412,6 +413,7 @@ blacklist ${HOME}/.config/digikam | |||
412 | blacklist ${HOME}/.config/digikamrc | 413 | blacklist ${HOME}/.config/digikamrc |
413 | blacklist ${HOME}/.config/discord | 414 | blacklist ${HOME}/.config/discord |
414 | blacklist ${HOME}/.config/discordcanary | 415 | blacklist ${HOME}/.config/discordcanary |
416 | blacklist ${HOME}/.config/discordptb | ||
415 | blacklist ${HOME}/.config/dkl | 417 | blacklist ${HOME}/.config/dkl |
416 | blacklist ${HOME}/.config/dnox | 418 | blacklist ${HOME}/.config/dnox |
417 | blacklist ${HOME}/.config/dolphin-emu | 419 | blacklist ${HOME}/.config/dolphin-emu |
@@ -479,6 +481,7 @@ blacklist ${HOME}/.config/inox | |||
479 | blacklist ${HOME}/.config/iridium | 481 | blacklist ${HOME}/.config/iridium |
480 | blacklist ${HOME}/.config/itch | 482 | blacklist ${HOME}/.config/itch |
481 | blacklist ${HOME}/.config/jami | 483 | blacklist ${HOME}/.config/jami |
484 | blacklist ${HOME}/.config/jami.net | ||
482 | blacklist ${HOME}/.config/jd-gui.cfg | 485 | blacklist ${HOME}/.config/jd-gui.cfg |
483 | blacklist ${HOME}/.config/jgit | 486 | blacklist ${HOME}/.config/jgit |
484 | blacklist ${HOME}/.config/k3brc | 487 | blacklist ${HOME}/.config/k3brc |
@@ -1182,6 +1185,7 @@ blacklist ${HOME}/Arduino | |||
1182 | blacklist ${HOME}/Monero/wallets | 1185 | blacklist ${HOME}/Monero/wallets |
1183 | blacklist ${HOME}/Nextcloud | 1186 | blacklist ${HOME}/Nextcloud |
1184 | blacklist ${HOME}/Nextcloud/Notes | 1187 | blacklist ${HOME}/Nextcloud/Notes |
1188 | blacklist ${HOME}/Postman | ||
1185 | blacklist ${HOME}/Seafile/.seafile-data | 1189 | blacklist ${HOME}/Seafile/.seafile-data |
1186 | blacklist ${HOME}/SoftMaker | 1190 | blacklist ${HOME}/SoftMaker |
1187 | blacklist ${HOME}/Standard Notes Backups | 1191 | blacklist ${HOME}/Standard Notes Backups |
diff --git a/etc/profile-a-l/DiscordPTB.profile b/etc/profile-a-l/DiscordPTB.profile new file mode 100644 index 000000000..4570f0103 --- /dev/null +++ b/etc/profile-a-l/DiscordPTB.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile for DiscordPTB | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include DiscordPTB.local | ||
5 | # Persistent global definitions | ||
6 | # added by included profile | ||
7 | #include globals.local | ||
8 | |||
9 | # Redirect | ||
10 | include discord-ptb.profile | ||
diff --git a/etc/profile-a-l/agetpkg.profile b/etc/profile-a-l/agetpkg.profile index 7a36302f1..9ebbf1cb0 100644 --- a/etc/profile-a-l/agetpkg.profile +++ b/etc/profile-a-l/agetpkg.profile | |||
@@ -28,7 +28,6 @@ include whitelist-usr-share-common.inc | |||
28 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
29 | 29 | ||
30 | caps.drop all | 30 | caps.drop all |
31 | hostname agetpkg | ||
32 | ipc-namespace | 31 | ipc-namespace |
33 | machine-id | 32 | machine-id |
34 | netfilter | 33 | netfilter |
diff --git a/etc/profile-a-l/ani-cli.profile b/etc/profile-a-l/ani-cli.profile index 270dffaed..231b5bca0 100644 --- a/etc/profile-a-l/ani-cli.profile +++ b/etc/profile-a-l/ani-cli.profile | |||
@@ -30,7 +30,7 @@ noprinters | |||
30 | notv | 30 | notv |
31 | 31 | ||
32 | disable-mnt | 32 | disable-mnt |
33 | private-bin ani-cli,aria2c,cat,cp,curl,cut,ffmpeg,fzf,grep,head,mkdir,mv,nl,sed,sh,sort,tput,tr,uname,wc | 33 | private-bin ani-cli,aria2c,cat,cp,curl,cut,ffmpeg,fzf,grep,head,mkdir,mv,nl,nohup,patch,sed,sh,sort,tail,tput,tr,uname,wc |
34 | #private-cache | 34 | #private-cache |
35 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg | 35 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg |
36 | private-tmp | 36 | private-tmp |
diff --git a/etc/profile-a-l/archiver-common.profile b/etc/profile-a-l/archiver-common.profile index ef875c5b7..487e0c5f8 100644 --- a/etc/profile-a-l/archiver-common.profile +++ b/etc/profile-a-l/archiver-common.profile | |||
@@ -23,7 +23,6 @@ include disable-shell.inc | |||
23 | 23 | ||
24 | apparmor | 24 | apparmor |
25 | caps.drop all | 25 | caps.drop all |
26 | hostname archiver | ||
27 | ipc-namespace | 26 | ipc-namespace |
28 | machine-id | 27 | machine-id |
29 | net none | 28 | net none |
diff --git a/etc/profile-a-l/chafa.profile b/etc/profile-a-l/chafa.profile index 72f79681d..f21a34f36 100644 --- a/etc/profile-a-l/chafa.profile +++ b/etc/profile-a-l/chafa.profile | |||
@@ -39,6 +39,7 @@ nosound | |||
39 | notv | 39 | notv |
40 | nou2f | 40 | nou2f |
41 | novideo | 41 | novideo |
42 | # block socket syscall to simulate empty protocol option (see #639) | ||
42 | seccomp socket | 43 | seccomp socket |
43 | seccomp.block-secondary | 44 | seccomp.block-secondary |
44 | tracelog | 45 | tracelog |
diff --git a/etc/profile-a-l/discord-ptb.profile b/etc/profile-a-l/discord-ptb.profile new file mode 100644 index 000000000..c39c0d843 --- /dev/null +++ b/etc/profile-a-l/discord-ptb.profile | |||
@@ -0,0 +1,17 @@ | |||
1 | # Firejail profile for discord-ptb | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include discord-ptb.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | noblacklist ${HOME}/.config/discordptb | ||
9 | |||
10 | mkdir ${HOME}/.config/discordptb | ||
11 | whitelist ${HOME}/.config/discordptb | ||
12 | |||
13 | private-bin discord-ptb,DiscordPTB | ||
14 | private-opt discord-ptb,DiscordPTB | ||
15 | |||
16 | # Redirect | ||
17 | include discord-common.profile | ||
diff --git a/etc/profile-a-l/engrampa.profile b/etc/profile-a-l/engrampa.profile index 1118c3bf0..e1d107dc7 100644 --- a/etc/profile-a-l/engrampa.profile +++ b/etc/profile-a-l/engrampa.profile | |||
@@ -10,18 +10,21 @@ include disable-common.inc | |||
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-proc.inc | ||
13 | include disable-programs.inc | 14 | include disable-programs.inc |
14 | 15 | ||
15 | include whitelist-var-common.inc | 16 | include whitelist-var-common.inc |
16 | 17 | ||
17 | apparmor | 18 | apparmor |
18 | caps.drop all | 19 | caps.drop all |
20 | machine-id | ||
19 | net none | 21 | net none |
20 | no3d | 22 | no3d |
21 | nodvd | 23 | nodvd |
22 | nogroups | 24 | nogroups |
23 | noinput | 25 | noinput |
24 | nonewprivs | 26 | nonewprivs |
27 | noprinters | ||
25 | noroot | 28 | noroot |
26 | nosound | 29 | nosound |
27 | notv | 30 | notv |
@@ -29,6 +32,7 @@ nou2f | |||
29 | novideo | 32 | novideo |
30 | protocol unix | 33 | protocol unix |
31 | seccomp | 34 | seccomp |
35 | seccomp.block-secondary | ||
32 | tracelog | 36 | tracelog |
33 | 37 | ||
34 | # private-bin engrampa | 38 | # private-bin engrampa |
diff --git a/etc/profile-a-l/file-roller.profile b/etc/profile-a-l/file-roller.profile index 4f39bec55..78e2751b3 100644 --- a/etc/profile-a-l/file-roller.profile +++ b/etc/profile-a-l/file-roller.profile | |||
@@ -29,6 +29,7 @@ nodvd | |||
29 | nogroups | 29 | nogroups |
30 | noinput | 30 | noinput |
31 | nonewprivs | 31 | nonewprivs |
32 | noprinters | ||
32 | noroot | 33 | noroot |
33 | nosound | 34 | nosound |
34 | notv | 35 | notv |
@@ -45,6 +46,10 @@ private-dev | |||
45 | private-etc @x11 | 46 | private-etc @x11 |
46 | # private-tmp | 47 | # private-tmp |
47 | 48 | ||
49 | dbus-user filter | ||
50 | dbus-user.own org.gnome.ArchiveManager1 | ||
51 | dbus-user.own org.gnome.FileRoller | ||
52 | dbus-user.talk ca.desrt.dconf | ||
48 | dbus-system none | 53 | dbus-system none |
49 | 54 | ||
50 | restrict-namespaces | 55 | restrict-namespaces |
diff --git a/etc/profile-a-l/file.profile b/etc/profile-a-l/file.profile index a5fd05bc7..78f1327c5 100644 --- a/etc/profile-a-l/file.profile +++ b/etc/profile-a-l/file.profile | |||
@@ -15,7 +15,6 @@ include disable-programs.inc | |||
15 | 15 | ||
16 | apparmor | 16 | apparmor |
17 | caps.drop all | 17 | caps.drop all |
18 | hostname file | ||
19 | ipc-namespace | 18 | ipc-namespace |
20 | machine-id | 19 | machine-id |
21 | net none | 20 | net none |
diff --git a/etc/profile-a-l/galculator.profile b/etc/profile-a-l/galculator.profile index 96ded592d..44d62cc86 100644 --- a/etc/profile-a-l/galculator.profile +++ b/etc/profile-a-l/galculator.profile | |||
@@ -23,7 +23,6 @@ include whitelist-var-common.inc | |||
23 | 23 | ||
24 | apparmor | 24 | apparmor |
25 | caps.drop all | 25 | caps.drop all |
26 | #hostname galculator - breaks Arch Linux | ||
27 | #ipc-namespace | 26 | #ipc-namespace |
28 | net none | 27 | net none |
29 | nodvd | 28 | nodvd |
diff --git a/etc/profile-a-l/gallery-dl.profile b/etc/profile-a-l/gallery-dl.profile index 9c8200dc4..9643820e7 100644 --- a/etc/profile-a-l/gallery-dl.profile +++ b/etc/profile-a-l/gallery-dl.profile | |||
@@ -15,4 +15,4 @@ private-bin gallery-dl | |||
15 | private-etc gallery-dl.conf | 15 | private-etc gallery-dl.conf |
16 | 16 | ||
17 | # Redirect | 17 | # Redirect |
18 | include youtube-dl.profile | 18 | include yt-dlp.profile |
diff --git a/etc/profile-a-l/gdu.profile b/etc/profile-a-l/gdu.profile index 4eb94edf4..4066a1ebf 100644 --- a/etc/profile-a-l/gdu.profile +++ b/etc/profile-a-l/gdu.profile | |||
@@ -26,7 +26,7 @@ nosound | |||
26 | notv | 26 | notv |
27 | nou2f | 27 | nou2f |
28 | novideo | 28 | novideo |
29 | # block the socket syscall to simulate an be empty protocol line, see #639 | 29 | # block socket syscall to simulate empty protocol option (see #639) |
30 | seccomp socket | 30 | seccomp socket |
31 | seccomp.block-secondary | 31 | seccomp.block-secondary |
32 | x11 none | 32 | x11 none |
diff --git a/etc/profile-a-l/geekbench.profile b/etc/profile-a-l/geekbench.profile index 3a929774a..e8d4c013f 100644 --- a/etc/profile-a-l/geekbench.profile +++ b/etc/profile-a-l/geekbench.profile | |||
@@ -25,7 +25,6 @@ include whitelist-var-common.inc | |||
25 | 25 | ||
26 | apparmor | 26 | apparmor |
27 | caps.drop all | 27 | caps.drop all |
28 | hostname geekbench | ||
29 | ipc-namespace | 28 | ipc-namespace |
30 | machine-id | 29 | machine-id |
31 | netfilter | 30 | netfilter |
diff --git a/etc/profile-a-l/jami.profile b/etc/profile-a-l/jami.profile new file mode 100644 index 000000000..deff54bcd --- /dev/null +++ b/etc/profile-a-l/jami.profile | |||
@@ -0,0 +1,18 @@ | |||
1 | # Firejail profile for jami | ||
2 | # Description: An encrypted peer-to-peer messenger | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include jami.local | ||
6 | # Persistent global definitions | ||
7 | # added by caller profile | ||
8 | #include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.config/jami.net | ||
11 | |||
12 | mkdir ${HOME}/.config/jami.net | ||
13 | mkdir ${HOME}/Videos/Jami | ||
14 | whitelist ${HOME}/.config/jami.net | ||
15 | whitelist ${HOME}/Videos/Jami | ||
16 | |||
17 | # Redirect | ||
18 | include jami-gnome.profile | ||
diff --git a/etc/profile-a-l/keepassxc.profile b/etc/profile-a-l/keepassxc.profile index f7959ca81..4e8c8e449 100644 --- a/etc/profile-a-l/keepassxc.profile +++ b/etc/profile-a-l/keepassxc.profile | |||
@@ -93,6 +93,7 @@ private-etc | |||
93 | private-tmp | 93 | private-tmp |
94 | 94 | ||
95 | dbus-user filter | 95 | dbus-user filter |
96 | dbus-user.own org.freedesktop.secrets | ||
96 | dbus-user.own org.keepassxc.KeePassXC.* | 97 | dbus-user.own org.keepassxc.KeePassXC.* |
97 | dbus-user.talk com.canonical.Unity | 98 | dbus-user.talk com.canonical.Unity |
98 | dbus-user.talk org.freedesktop.ScreenSaver | 99 | dbus-user.talk org.freedesktop.ScreenSaver |
diff --git a/etc/profile-m-z/Postman.profile b/etc/profile-m-z/Postman.profile new file mode 100644 index 000000000..d08acf60b --- /dev/null +++ b/etc/profile-m-z/Postman.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile for Postman | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include Postman.local | ||
5 | # Persistent global definitions | ||
6 | # added by included profile | ||
7 | #include globals.local | ||
8 | |||
9 | # Redirect | ||
10 | include postman.profile | ||
diff --git a/etc/profile-m-z/mdr.profile b/etc/profile-m-z/mdr.profile index d3b3c6d48..7b83d61e1 100644 --- a/etc/profile-m-z/mdr.profile +++ b/etc/profile-m-z/mdr.profile | |||
@@ -21,7 +21,6 @@ include whitelist-var-common.inc | |||
21 | 21 | ||
22 | apparmor | 22 | apparmor |
23 | caps.drop all | 23 | caps.drop all |
24 | hostname mdr | ||
25 | ipc-namespace | 24 | ipc-namespace |
26 | machine-id | 25 | machine-id |
27 | net none | 26 | net none |
diff --git a/etc/profile-m-z/microsoft-edge-beta.profile b/etc/profile-m-z/microsoft-edge-beta.profile index 63844ad70..6843c11c7 100644 --- a/etc/profile-m-z/microsoft-edge-beta.profile +++ b/etc/profile-m-z/microsoft-edge-beta.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for Microsoft Edge Beta | 1 | # Firejail profile for Microsoft Edge Beta |
2 | # Description: Web browser from Microsoft,beta channel | 2 | # Description: Web browser from Microsoft, beta channel |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include microsoft-edge-beta.local | 5 | include microsoft-edge-beta.local |
@@ -8,6 +8,7 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.cache/microsoft-edge-beta | 9 | noblacklist ${HOME}/.cache/microsoft-edge-beta |
10 | noblacklist ${HOME}/.config/microsoft-edge-beta | 10 | noblacklist ${HOME}/.config/microsoft-edge-beta |
11 | noblacklist /opt/microsoft/msedge-beta/msedge-sandbox | ||
11 | 12 | ||
12 | mkdir ${HOME}/.cache/microsoft-edge-beta | 13 | mkdir ${HOME}/.cache/microsoft-edge-beta |
13 | mkdir ${HOME}/.config/microsoft-edge-beta | 14 | mkdir ${HOME}/.config/microsoft-edge-beta |
@@ -15,6 +16,8 @@ whitelist ${HOME}/.cache/microsoft-edge-beta | |||
15 | whitelist ${HOME}/.config/microsoft-edge-beta | 16 | whitelist ${HOME}/.config/microsoft-edge-beta |
16 | 17 | ||
17 | whitelist /opt/microsoft/msedge-beta | 18 | whitelist /opt/microsoft/msedge-beta |
19 | # private-opt might break the file-copy-limit, see #5307 | ||
20 | #private-opt microsoft | ||
18 | 21 | ||
19 | # Redirect | 22 | # Redirect |
20 | include chromium-common.profile | 23 | include chromium-common.profile |
diff --git a/etc/profile-m-z/microsoft-edge-dev.profile b/etc/profile-m-z/microsoft-edge-dev.profile index b01fd7c25..b9cdaf98b 100644 --- a/etc/profile-m-z/microsoft-edge-dev.profile +++ b/etc/profile-m-z/microsoft-edge-dev.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for Microsoft Edge Dev | 1 | # Firejail profile for Microsoft Edge Dev |
2 | # Description: Web browser from Microsoft,dev channel | 2 | # Description: Web browser from Microsoft, dev channel |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include microsoft-edge-dev.local | 5 | include microsoft-edge-dev.local |
@@ -8,6 +8,7 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.cache/microsoft-edge-dev | 9 | noblacklist ${HOME}/.cache/microsoft-edge-dev |
10 | noblacklist ${HOME}/.config/microsoft-edge-dev | 10 | noblacklist ${HOME}/.config/microsoft-edge-dev |
11 | noblacklist /opt/microsoft/msedge-dev/msedge-sandbox | ||
11 | 12 | ||
12 | mkdir ${HOME}/.cache/microsoft-edge-dev | 13 | mkdir ${HOME}/.cache/microsoft-edge-dev |
13 | mkdir ${HOME}/.config/microsoft-edge-dev | 14 | mkdir ${HOME}/.config/microsoft-edge-dev |
@@ -15,6 +16,8 @@ whitelist ${HOME}/.cache/microsoft-edge-dev | |||
15 | whitelist ${HOME}/.config/microsoft-edge-dev | 16 | whitelist ${HOME}/.config/microsoft-edge-dev |
16 | 17 | ||
17 | whitelist /opt/microsoft/msedge-dev | 18 | whitelist /opt/microsoft/msedge-dev |
19 | # private-opt might break file-copy-limit, see #5307 | ||
20 | #private-opt microsoft | ||
18 | 21 | ||
19 | # Redirect | 22 | # Redirect |
20 | include chromium-common.profile | 23 | include chromium-common.profile |
diff --git a/etc/profile-m-z/microsoft-edge-stable.profile b/etc/profile-m-z/microsoft-edge-stable.profile new file mode 100644 index 000000000..c5b2b4301 --- /dev/null +++ b/etc/profile-m-z/microsoft-edge-stable.profile | |||
@@ -0,0 +1,11 @@ | |||
1 | # Firejail profile for Microsoft Edge Stable | ||
2 | # Description: Web browser from Microsoft, stable channel | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include microsoft-edge-stable.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | # Redirect | ||
11 | include microsoft-edge.profile | ||
diff --git a/etc/profile-m-z/microsoft-edge.profile b/etc/profile-m-z/microsoft-edge.profile index 4cd8c85a5..ededb9cbd 100644 --- a/etc/profile-m-z/microsoft-edge.profile +++ b/etc/profile-m-z/microsoft-edge.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for Microsoft Edge | 1 | # Firejail profile for Microsoft Edge |
2 | # Description: Web browser from Microsoft,stable channel | 2 | # Description: Web browser from Microsoft, stable channel |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include microsoft-edge.local | 5 | include microsoft-edge.local |
@@ -8,6 +8,7 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.cache/microsoft-edge | 9 | noblacklist ${HOME}/.cache/microsoft-edge |
10 | noblacklist ${HOME}/.config/microsoft-edge | 10 | noblacklist ${HOME}/.config/microsoft-edge |
11 | noblacklist /opt/microsoft/msedge/msedge-sandbox | ||
11 | 12 | ||
12 | mkdir ${HOME}/.cache/microsoft-edge | 13 | mkdir ${HOME}/.cache/microsoft-edge |
13 | mkdir ${HOME}/.config/microsoft-edge | 14 | mkdir ${HOME}/.config/microsoft-edge |
@@ -15,6 +16,8 @@ whitelist ${HOME}/.cache/microsoft-edge | |||
15 | whitelist ${HOME}/.config/microsoft-edge | 16 | whitelist ${HOME}/.config/microsoft-edge |
16 | 17 | ||
17 | whitelist /opt/microsoft/msedge | 18 | whitelist /opt/microsoft/msedge |
19 | # private-opt might break default file-copy-limit, see #5307 | ||
20 | #private-opt microsoft | ||
18 | 21 | ||
19 | # Redirect | 22 | # Redirect |
20 | include chromium-common.profile | 23 | include chromium-common.profile |
diff --git a/etc/profile-m-z/pngquant.profile b/etc/profile-m-z/pngquant.profile index 34199a08d..481bade92 100644 --- a/etc/profile-m-z/pngquant.profile +++ b/etc/profile-m-z/pngquant.profile | |||
@@ -38,7 +38,7 @@ nosound | |||
38 | notv | 38 | notv |
39 | nou2f | 39 | nou2f |
40 | novideo | 40 | novideo |
41 | # block the socket syscall to simulate an be empty protocol line, see #639 | 41 | # block socket syscall to simulate empty protocol option (see #639) |
42 | seccomp socket | 42 | seccomp socket |
43 | tracelog | 43 | tracelog |
44 | x11 none | 44 | x11 none |
diff --git a/etc/profile-m-z/postman.profile b/etc/profile-m-z/postman.profile new file mode 100644 index 000000000..c8f00584d --- /dev/null +++ b/etc/profile-m-z/postman.profile | |||
@@ -0,0 +1,28 @@ | |||
1 | # Firejail profile for postman | ||
2 | # Description: API testing platform | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include postman.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/Postman | ||
10 | noblacklist ${HOME}/Postman | ||
11 | |||
12 | mkdir ${HOME}/.config/Postman | ||
13 | mkdir ${HOME}/Postman | ||
14 | whitelist ${HOME}/.config/Postman | ||
15 | whitelist ${HOME}/Postman | ||
16 | include whitelist-run-common.inc | ||
17 | |||
18 | protocol unix,inet,inet6,netlink | ||
19 | |||
20 | private-bin electron,electron[0-9],electron[0-9][0-9],locale,node,Postman,postman,sh | ||
21 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,nsswitch.conf,pki,resolv.conf,ssl | ||
22 | # private-opt breaks file-copy-limit, use a whitelist instead of draining RAM | ||
23 | # https://github.com/netblue30/firejail/discussions/5307 | ||
24 | #private-opt postman | ||
25 | whitelist /opt/postman | ||
26 | |||
27 | # Redirect | ||
28 | include electron-common.profile | ||
diff --git a/etc/profile-m-z/qpdf.profile b/etc/profile-m-z/qpdf.profile index 0c1e09e92..edec7cf0a 100644 --- a/etc/profile-m-z/qpdf.profile +++ b/etc/profile-m-z/qpdf.profile | |||
@@ -31,7 +31,6 @@ include whitelist-var-common.inc | |||
31 | 31 | ||
32 | apparmor | 32 | apparmor |
33 | caps.drop all | 33 | caps.drop all |
34 | hostname qpdf | ||
35 | ipc-namespace | 34 | ipc-namespace |
36 | machine-id | 35 | machine-id |
37 | net none | 36 | net none |
@@ -46,7 +45,7 @@ nosound | |||
46 | notv | 45 | notv |
47 | nou2f | 46 | nou2f |
48 | novideo | 47 | novideo |
49 | # block the socket syscall to simulate an be empty protocol line, see #639 | 48 | # block socket syscall to simulate empty protocol option (see #639) |
50 | seccomp socket | 49 | seccomp socket |
51 | tracelog | 50 | tracelog |
52 | x11 none | 51 | x11 none |
diff --git a/etc/profile-m-z/tesseract.profile b/etc/profile-m-z/tesseract.profile index 54568b7d3..5babfb8d2 100644 --- a/etc/profile-m-z/tesseract.profile +++ b/etc/profile-m-z/tesseract.profile | |||
@@ -31,7 +31,6 @@ include whitelist-var-common.inc | |||
31 | 31 | ||
32 | apparmor | 32 | apparmor |
33 | caps.drop all | 33 | caps.drop all |
34 | hostname tesseract | ||
35 | ipc-namespace | 34 | ipc-namespace |
36 | machine-id | 35 | machine-id |
37 | net none | 36 | net none |
diff --git a/etc/profile-m-z/tutanota-desktop.profile b/etc/profile-m-z/tutanota-desktop.profile index 4af8b9292..4793e9dbb 100644 --- a/etc/profile-m-z/tutanota-desktop.profile +++ b/etc/profile-m-z/tutanota-desktop.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for tutanota-desktop | 1 | # Firejail profile for tutanota-desktop |
2 | # Description: Encrypted email client | 2 | # Description: Official desktop client for the Tutanota E2E encrypted email provider |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include tutanota-desktop.local | 5 | include tutanota-desktop.local |
@@ -9,8 +9,13 @@ include globals.local | |||
9 | noblacklist ${HOME}/.config/tuta_integration | 9 | noblacklist ${HOME}/.config/tuta_integration |
10 | noblacklist ${HOME}/.config/tutanota-desktop | 10 | noblacklist ${HOME}/.config/tutanota-desktop |
11 | 11 | ||
12 | ignore dbus-user none | ||
13 | ignore disable-mnt | ||
12 | ignore noexec /tmp | 14 | ignore noexec /tmp |
13 | 15 | ||
16 | # sh is needed to allow Firefox to open links | ||
17 | include allow-bin-sh.inc | ||
18 | |||
14 | include disable-shell.inc | 19 | include disable-shell.inc |
15 | 20 | ||
16 | mkdir ${HOME}/.config/tuta_integration | 21 | mkdir ${HOME}/.config/tuta_integration |
@@ -18,14 +23,26 @@ mkdir ${HOME}/.config/tutanota-desktop | |||
18 | whitelist ${HOME}/.config/tuta_integration | 23 | whitelist ${HOME}/.config/tuta_integration |
19 | whitelist ${HOME}/.config/tutanota-desktop | 24 | whitelist ${HOME}/.config/tutanota-desktop |
20 | 25 | ||
21 | # These lines are needed to allow Firefox to open links | 26 | # The lines below are needed to find the default Firefox profile name, to allow |
27 | # opening links in an existing instance of Firefox (note that it still fails if | ||
28 | # there isn't a Firefox instance running with the default profile; see #5352) | ||
22 | noblacklist ${HOME}/.mozilla | 29 | noblacklist ${HOME}/.mozilla |
23 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | 30 | whitelist ${HOME}/.mozilla/firefox/profiles.ini |
24 | read-only ${HOME}/.mozilla/firefox/profiles.ini | 31 | read-only ${HOME}/.mozilla/firefox/profiles.ini |
25 | 32 | ||
33 | machine-id | ||
34 | nosound | ||
35 | |||
26 | ?HAS_APPIMAGE: ignore private-dev | 36 | ?HAS_APPIMAGE: ignore private-dev |
27 | private-etc @tls-ca | 37 | private-etc @tls-ca |
28 | private-opt tutanota-desktop | 38 | private-opt tutanota-desktop |
29 | 39 | ||
40 | dbus-user filter | ||
41 | dbus-user.talk org.freedesktop.Notifications | ||
42 | dbus-user.talk org.freedesktop.secrets | ||
43 | dbus-user.talk org.gnome.keyring.SystemPrompter | ||
44 | # allow D-Bus communication with firefox for opening links | ||
45 | dbus-user.talk org.mozilla.* | ||
46 | |||
30 | # Redirect | 47 | # Redirect |
31 | include electron-common.profile | 48 | include electron-common.profile |
diff --git a/etc/profile-m-z/unf.profile b/etc/profile-m-z/unf.profile index aac99aed5..cdfd72a5b 100644 --- a/etc/profile-m-z/unf.profile +++ b/etc/profile-m-z/unf.profile | |||
@@ -24,7 +24,6 @@ include whitelist-var-common.inc | |||
24 | 24 | ||
25 | apparmor | 25 | apparmor |
26 | caps.drop all | 26 | caps.drop all |
27 | hostname unf | ||
28 | ipc-namespace | 27 | ipc-namespace |
29 | machine-id | 28 | machine-id |
30 | net none | 29 | net none |
diff --git a/etc/profile-m-z/uudeview.profile b/etc/profile-m-z/uudeview.profile index a6d2a65e9..9a9915669 100644 --- a/etc/profile-m-z/uudeview.profile +++ b/etc/profile-m-z/uudeview.profile | |||
@@ -19,7 +19,6 @@ include disable-shell.inc | |||
19 | include whitelist-usr-share-common.inc | 19 | include whitelist-usr-share-common.inc |
20 | 20 | ||
21 | caps.drop all | 21 | caps.drop all |
22 | hostname uudeview | ||
23 | ipc-namespace | 22 | ipc-namespace |
24 | machine-id | 23 | machine-id |
25 | net none | 24 | net none |
diff --git a/etc/profile-m-z/whois.profile b/etc/profile-m-z/whois.profile index 8958564ef..8265e1ff8 100644 --- a/etc/profile-m-z/whois.profile +++ b/etc/profile-m-z/whois.profile | |||
@@ -22,7 +22,6 @@ include whitelist-var-common.inc | |||
22 | 22 | ||
23 | apparmor | 23 | apparmor |
24 | caps.drop all | 24 | caps.drop all |
25 | hostname whois | ||
26 | ipc-namespace | 25 | ipc-namespace |
27 | machine-id | 26 | machine-id |
28 | netfilter | 27 | netfilter |
diff --git a/etc/profile-m-z/youtube-dl.profile b/etc/profile-m-z/youtube-dl.profile index 8376b4989..9e81d745d 100644 --- a/etc/profile-m-z/youtube-dl.profile +++ b/etc/profile-m-z/youtube-dl.profile | |||
@@ -5,63 +5,17 @@ quiet | |||
5 | # Persistent local customizations | 5 | # Persistent local customizations |
6 | include youtube-dl.local | 6 | include youtube-dl.local |
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | # added by included profile |
9 | 9 | #include globals.local | |
10 | # breaks when installed under ${HOME} via `pip install --user` (see #2833) | ||
11 | ignore noexec ${HOME} | ||
12 | 10 | ||
13 | noblacklist ${HOME}/.cache/youtube-dl | 11 | noblacklist ${HOME}/.cache/youtube-dl |
14 | noblacklist ${HOME}/.config/youtube-dl | 12 | noblacklist ${HOME}/.config/youtube-dl |
15 | noblacklist ${HOME}/.netrc | ||
16 | noblacklist ${MUSIC} | ||
17 | noblacklist ${VIDEOS} | ||
18 | 13 | ||
19 | # Allow python (blacklisted by disable-interpreters.inc) | 14 | # Allow python (blacklisted by disable-interpreters.inc) |
20 | include allow-python2.inc | 15 | include allow-python2.inc |
21 | include allow-python3.inc | ||
22 | |||
23 | blacklist /tmp/.X11-unix | ||
24 | blacklist ${RUNUSER} | ||
25 | |||
26 | include disable-common.inc | ||
27 | include disable-devel.inc | ||
28 | include disable-exec.inc | ||
29 | include disable-interpreters.inc | ||
30 | include disable-programs.inc | ||
31 | include disable-shell.inc | ||
32 | include disable-xdg.inc | ||
33 | |||
34 | include whitelist-usr-share-common.inc | ||
35 | include whitelist-var-common.inc | ||
36 | |||
37 | apparmor | ||
38 | caps.drop all | ||
39 | ipc-namespace | ||
40 | machine-id | ||
41 | netfilter | ||
42 | no3d | ||
43 | nodvd | ||
44 | nogroups | ||
45 | noinput | ||
46 | nonewprivs | ||
47 | noroot | ||
48 | nosound | ||
49 | notv | ||
50 | nou2f | ||
51 | novideo | ||
52 | protocol unix,inet,inet6 | ||
53 | seccomp | ||
54 | seccomp.block-secondary | ||
55 | tracelog | ||
56 | |||
57 | private-bin env,ffmpeg,python*,youtube-dl | ||
58 | private-cache | ||
59 | private-dev | ||
60 | private-etc @tls-ca,mime.types,youtube-dl.conf | ||
61 | private-tmp | ||
62 | 16 | ||
63 | dbus-user none | 17 | private-bin youtube-dl |
64 | dbus-system none | 18 | private-etc youtube-dl.conf |
65 | 19 | ||
66 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 20 | # Redirect |
67 | restrict-namespaces | 21 | include yt-dlp.profile |
diff --git a/etc/profile-m-z/yt-dlp.profile b/etc/profile-m-z/yt-dlp.profile index 49d4b3b56..97f9e620a 100644 --- a/etc/profile-m-z/yt-dlp.profile +++ b/etc/profile-m-z/yt-dlp.profile | |||
@@ -5,17 +5,73 @@ quiet | |||
5 | # Persistent local customizations | 5 | # Persistent local customizations |
6 | include yt-dlp.local | 6 | include yt-dlp.local |
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | # added by included profile | 8 | include globals.local |
9 | #include globals.local | 9 | |
10 | # If you installed via pip under ${HOME} | ||
11 | # add 'ignore noexec ${HOME}' in yt-dlp.local. | ||
12 | # AppArmor needs to allow it too, | ||
13 | # add 'ignore apparmor' in yt-dlp.local | ||
14 | # OR in /etc/apparmor.d/local/firejail-default add: | ||
15 | # 'owner @HOME/.local/bin/** ix,' | ||
16 | # 'owner @HOME/.local/lib/python*/** ix,' | ||
17 | # then run the command | ||
18 | # 'sudo apparmor_parser -r /etc/apparmor.d/firejail-default' | ||
10 | 19 | ||
11 | noblacklist ${HOME}/.cache/yt-dlp | 20 | noblacklist ${HOME}/.cache/yt-dlp |
12 | noblacklist ${HOME}/.config/yt-dlp | 21 | noblacklist ${HOME}/.config/yt-dlp |
13 | noblacklist ${HOME}/.config/yt-dlp.conf | 22 | noblacklist ${HOME}/.config/yt-dlp.conf |
14 | noblacklist ${HOME}/yt-dlp.conf | 23 | noblacklist ${HOME}/yt-dlp.conf |
15 | noblacklist ${HOME}/yt-dlp.conf.txt | 24 | noblacklist ${HOME}/yt-dlp.conf.txt |
25 | noblacklist ${HOME}/.netrc | ||
26 | noblacklist ${MUSIC} | ||
27 | noblacklist ${VIDEOS} | ||
28 | |||
29 | # Allow python (blacklisted by disable-interpreters.inc) | ||
30 | include allow-python3.inc | ||
31 | |||
32 | blacklist /tmp/.X11-unix | ||
33 | blacklist ${RUNUSER} | ||
34 | |||
35 | include disable-common.inc | ||
36 | include disable-devel.inc | ||
37 | include disable-exec.inc | ||
38 | include disable-interpreters.inc | ||
39 | include disable-programs.inc | ||
40 | include disable-shell.inc | ||
41 | include disable-xdg.inc | ||
42 | |||
43 | include whitelist-usr-share-common.inc | ||
44 | include whitelist-var-common.inc | ||
45 | |||
46 | apparmor | ||
47 | caps.drop all | ||
48 | ipc-namespace | ||
49 | machine-id | ||
50 | netfilter | ||
51 | no3d | ||
52 | nodvd | ||
53 | nogroups | ||
54 | noinput | ||
55 | nonewprivs | ||
56 | noroot | ||
57 | nosound | ||
58 | notv | ||
59 | nou2f | ||
60 | novideo | ||
61 | protocol unix,inet,inet6 | ||
62 | seccomp | ||
63 | seccomp.block-secondary | ||
64 | tracelog | ||
65 | |||
66 | private-bin env,ffmpeg,ffprobe,python*,yt-dlp | ||
67 | private-cache | ||
68 | private-dev | ||
69 | private-etc @tls-ca,mime.types,yt-dlp.conf | ||
70 | private-tmp | ||
71 | |||
72 | dbus-user none | ||
73 | dbus-system none | ||
16 | 74 | ||
17 | private-bin ffprobe,yt-dlp | 75 | memory-deny-write-execute |
18 | private-etc yt-dlp.conf | ||
19 | 76 | ||
20 | # Redirect | 77 | restrict-namespaces |
21 | include youtube-dl.profile | ||