diff options
Diffstat (limited to 'etc')
-rw-r--r-- | etc/apparmor/firejail-local | 6 | ||||
-rw-r--r-- | etc/inc/disable-programs.inc | 6 | ||||
-rw-r--r-- | etc/profile-a-l/DiscordPTB.profile | 10 | ||||
-rw-r--r-- | etc/profile-a-l/ani-cli.profile | 41 | ||||
-rw-r--r-- | etc/profile-a-l/discord-ptb.profile | 17 | ||||
-rw-r--r-- | etc/profile-a-l/email-common.profile | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lobster.profile | 41 | ||||
-rw-r--r-- | etc/profile-m-z/mpv.profile | 14 | ||||
-rw-r--r-- | etc/profile-m-z/porn-cli.profile | 14 |
9 files changed, 141 insertions, 9 deletions
diff --git a/etc/apparmor/firejail-local b/etc/apparmor/firejail-local index e7236b0bc..557204d75 100644 --- a/etc/apparmor/firejail-local +++ b/etc/apparmor/firejail-local | |||
@@ -1,12 +1,12 @@ | |||
1 | # Site-specific additions and overrides for 'firejail-default'. | 1 | # Site-specific additions and overrides for 'firejail-default'. |
2 | # For more details, please see /etc/apparmor.d/local/README. | 2 | # For more details, please see /etc/apparmor.d/local/README. |
3 | 3 | ||
4 | # Here are some examples to allow running programs from home directory. | 4 | # Here are some examples to allow running programs from your home directory. |
5 | # Don't enable all of these, just pick a specific one or write a custom rule | 5 | # Don't enable all of these, just pick a specific one or write a custom rule |
6 | # instead as done below for torbrowser-launcher. | 6 | # instead as done below for torbrowser-launcher. |
7 | #owner @HOME/** ix, | 7 | #owner @HOME/** ix, |
8 | #owner @HOME/bin/** ix | 8 | #owner @HOME/bin/** ix, |
9 | #owner @HOME/.local/bin/** ix | 9 | #owner @HOME/.local/bin/** ix, |
10 | 10 | ||
11 | # Uncomment to opt-in to apparmor for brave + ipfs | 11 | # Uncomment to opt-in to apparmor for brave + ipfs |
12 | #owner @{HOME}/.config/BraveSoftware/Brave-Browser/oecghfpdmkjlhnfpmmjegjacfimiafjp/*/** ix, | 12 | #owner @{HOME}/.config/BraveSoftware/Brave-Browser/oecghfpdmkjlhnfpmmjegjacfimiafjp/*/** ix, |
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 3eb6c03d5..71b513935 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -51,6 +51,7 @@ blacklist ${HOME}/.bibletime | |||
51 | blacklist ${HOME}/.bitcoin | 51 | blacklist ${HOME}/.bitcoin |
52 | blacklist ${HOME}/.blobby | 52 | blacklist ${HOME}/.blobby |
53 | blacklist ${HOME}/.bogofilter | 53 | blacklist ${HOME}/.bogofilter |
54 | blacklist ${HOME}/.bsfilter | ||
54 | blacklist ${HOME}/.bundle | 55 | blacklist ${HOME}/.bundle |
55 | blacklist ${HOME}/.bzf | 56 | blacklist ${HOME}/.bzf |
56 | blacklist ${HOME}/.cache/0ad | 57 | blacklist ${HOME}/.cache/0ad |
@@ -83,6 +84,7 @@ blacklist ${HOME}/.cache/Tox | |||
83 | blacklist ${HOME}/.cache/Zeal | 84 | blacklist ${HOME}/.cache/Zeal |
84 | blacklist ${HOME}/.cache/agenda | 85 | blacklist ${HOME}/.cache/agenda |
85 | blacklist ${HOME}/.cache/akonadi* | 86 | blacklist ${HOME}/.cache/akonadi* |
87 | blacklist ${HOME}/.cache/ani-cli | ||
86 | blacklist ${HOME}/.cache/atril | 88 | blacklist ${HOME}/.cache/atril |
87 | blacklist ${HOME}/.cache/attic | 89 | blacklist ${HOME}/.cache/attic |
88 | blacklist ${HOME}/.cache/audacity | 90 | blacklist ${HOME}/.cache/audacity |
@@ -410,6 +412,7 @@ blacklist ${HOME}/.config/digikam | |||
410 | blacklist ${HOME}/.config/digikamrc | 412 | blacklist ${HOME}/.config/digikamrc |
411 | blacklist ${HOME}/.config/discord | 413 | blacklist ${HOME}/.config/discord |
412 | blacklist ${HOME}/.config/discordcanary | 414 | blacklist ${HOME}/.config/discordcanary |
415 | blacklist ${HOME}/.config/discordptb | ||
413 | blacklist ${HOME}/.config/dkl | 416 | blacklist ${HOME}/.config/dkl |
414 | blacklist ${HOME}/.config/dnox | 417 | blacklist ${HOME}/.config/dnox |
415 | blacklist ${HOME}/.config/dolphin-emu | 418 | blacklist ${HOME}/.config/dolphin-emu |
@@ -517,6 +520,7 @@ blacklist ${HOME}/.config/leafpad | |||
517 | blacklist ${HOME}/.config/libreoffice | 520 | blacklist ${HOME}/.config/libreoffice |
518 | blacklist ${HOME}/.config/liferea | 521 | blacklist ${HOME}/.config/liferea |
519 | blacklist ${HOME}/.config/linphone | 522 | blacklist ${HOME}/.config/linphone |
523 | blacklist ${HOME}/.config/lobster | ||
520 | blacklist ${HOME}/.config/lugaru | 524 | blacklist ${HOME}/.config/lugaru |
521 | blacklist ${HOME}/.config/lutris | 525 | blacklist ${HOME}/.config/lutris |
522 | blacklist ${HOME}/.config/lximage-qt | 526 | blacklist ${HOME}/.config/lximage-qt |
@@ -952,6 +956,7 @@ blacklist ${HOME}/.local/share/kwrite | |||
952 | blacklist ${HOME}/.local/share/kxmlgui5/* | 956 | blacklist ${HOME}/.local/share/kxmlgui5/* |
953 | blacklist ${HOME}/.local/share/liferea | 957 | blacklist ${HOME}/.local/share/liferea |
954 | blacklist ${HOME}/.local/share/linphone | 958 | blacklist ${HOME}/.local/share/linphone |
959 | blacklist ${HOME}/.local/share/lobster | ||
955 | blacklist ${HOME}/.local/share/local-mail | 960 | blacklist ${HOME}/.local/share/local-mail |
956 | blacklist ${HOME}/.local/share/lollypop | 961 | blacklist ${HOME}/.local/share/lollypop |
957 | blacklist ${HOME}/.local/share/love | 962 | blacklist ${HOME}/.local/share/love |
@@ -1027,6 +1032,7 @@ blacklist ${HOME}/.local/share/wormux | |||
1027 | blacklist ${HOME}/.local/share/xplayer | 1032 | blacklist ${HOME}/.local/share/xplayer |
1028 | blacklist ${HOME}/.local/share/xreader | 1033 | blacklist ${HOME}/.local/share/xreader |
1029 | blacklist ${HOME}/.local/share/zathura | 1034 | blacklist ${HOME}/.local/share/zathura |
1035 | blacklist ${HOME}/.local/state/ani-cli | ||
1030 | blacklist ${HOME}/.local/state/audacity | 1036 | blacklist ${HOME}/.local/state/audacity |
1031 | blacklist ${HOME}/.local/state/pipewire | 1037 | blacklist ${HOME}/.local/state/pipewire |
1032 | blacklist ${HOME}/.lv2 | 1038 | blacklist ${HOME}/.lv2 |
diff --git a/etc/profile-a-l/DiscordPTB.profile b/etc/profile-a-l/DiscordPTB.profile new file mode 100644 index 000000000..4570f0103 --- /dev/null +++ b/etc/profile-a-l/DiscordPTB.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile for DiscordPTB | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include DiscordPTB.local | ||
5 | # Persistent global definitions | ||
6 | # added by included profile | ||
7 | #include globals.local | ||
8 | |||
9 | # Redirect | ||
10 | include discord-ptb.profile | ||
diff --git a/etc/profile-a-l/ani-cli.profile b/etc/profile-a-l/ani-cli.profile new file mode 100644 index 000000000..270dffaed --- /dev/null +++ b/etc/profile-a-l/ani-cli.profile | |||
@@ -0,0 +1,41 @@ | |||
1 | # Firejail profile for ani-cli | ||
2 | # Description: Shell script to watch Anime from the terminal | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include ani-cli.local | ||
7 | # Persistent global definitions | ||
8 | # added by included profile | ||
9 | #include globals.local | ||
10 | |||
11 | noblacklist ${HOME}/.cache/ani-cli | ||
12 | noblacklist ${HOME}/.local/state/ani-cli | ||
13 | |||
14 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
15 | include allow-bin-sh.inc | ||
16 | |||
17 | include disable-proc.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.cache/ani-cli | ||
21 | mkdir ${HOME}/.local/state/ani-cli | ||
22 | whitelist ${HOME}/.cache/ani-cli | ||
23 | whitelist ${HOME}/.local/state/ani-cli | ||
24 | include whitelist-run-common.inc | ||
25 | include whitelist-runuser-common.inc | ||
26 | |||
27 | #machine-id | ||
28 | nodvd | ||
29 | noprinters | ||
30 | notv | ||
31 | |||
32 | disable-mnt | ||
33 | private-bin ani-cli,aria2c,cat,cp,curl,cut,ffmpeg,fzf,grep,head,mkdir,mv,nl,sed,sh,sort,tput,tr,uname,wc | ||
34 | #private-cache | ||
35 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg | ||
36 | private-tmp | ||
37 | |||
38 | read-only ${HOME}/.config/mpv | ||
39 | |||
40 | # Redirect | ||
41 | include mpv.profile | ||
diff --git a/etc/profile-a-l/discord-ptb.profile b/etc/profile-a-l/discord-ptb.profile new file mode 100644 index 000000000..c39c0d843 --- /dev/null +++ b/etc/profile-a-l/discord-ptb.profile | |||
@@ -0,0 +1,17 @@ | |||
1 | # Firejail profile for discord-ptb | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include discord-ptb.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | noblacklist ${HOME}/.config/discordptb | ||
9 | |||
10 | mkdir ${HOME}/.config/discordptb | ||
11 | whitelist ${HOME}/.config/discordptb | ||
12 | |||
13 | private-bin discord-ptb,DiscordPTB | ||
14 | private-opt discord-ptb,DiscordPTB | ||
15 | |||
16 | # Redirect | ||
17 | include discord-common.profile | ||
diff --git a/etc/profile-a-l/email-common.profile b/etc/profile-a-l/email-common.profile index 86442d441..0a44a62a3 100644 --- a/etc/profile-a-l/email-common.profile +++ b/etc/profile-a-l/email-common.profile | |||
@@ -8,6 +8,7 @@ include email-common.local | |||
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | noblacklist ${HOME}/.bogofilter | 10 | noblacklist ${HOME}/.bogofilter |
11 | noblacklist ${HOME}/.bsfilter | ||
11 | noblacklist ${HOME}/.gnupg | 12 | noblacklist ${HOME}/.gnupg |
12 | noblacklist ${HOME}/.mozilla | 13 | noblacklist ${HOME}/.mozilla |
13 | noblacklist ${HOME}/.signature | 14 | noblacklist ${HOME}/.signature |
diff --git a/etc/profile-a-l/lobster.profile b/etc/profile-a-l/lobster.profile new file mode 100644 index 000000000..01928c775 --- /dev/null +++ b/etc/profile-a-l/lobster.profile | |||
@@ -0,0 +1,41 @@ | |||
1 | # Firejail profile for lobster | ||
2 | # Description: Shell script to watch Movies/Webseries/Shows from the terminal | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include lobster.local | ||
7 | # Persistent global definitions | ||
8 | # added by included profile | ||
9 | #include globals.local | ||
10 | |||
11 | noblacklist ${HOME}/.config/lobster | ||
12 | noblacklist ${HOME}/.local/share/lobster | ||
13 | |||
14 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
15 | include allow-bin-sh.inc | ||
16 | |||
17 | include disable-proc.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.config/lobster | ||
21 | mkdir ${HOME}/.local/share/lobster | ||
22 | whitelist ${HOME}/.config/lobster | ||
23 | whitelist ${HOME}/.local/share/lobster | ||
24 | include whitelist-run-common.inc | ||
25 | include whitelist-runuser-common.inc | ||
26 | |||
27 | #machine-id | ||
28 | nodvd | ||
29 | noprinters | ||
30 | notv | ||
31 | |||
32 | disable-mnt | ||
33 | private-bin curl,cut,fzf,grep,head,lobster,mv,patch,rm,sed,sh,tail,tput,tr,uname | ||
34 | #private-cache | ||
35 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg | ||
36 | private-tmp | ||
37 | |||
38 | read-only ${HOME}/.config/mpv | ||
39 | |||
40 | # Redirect | ||
41 | include mpv.profile | ||
diff --git a/etc/profile-m-z/mpv.profile b/etc/profile-m-z/mpv.profile index c9706999a..9dcc9dec3 100644 --- a/etc/profile-m-z/mpv.profile +++ b/etc/profile-m-z/mpv.profile | |||
@@ -11,13 +11,13 @@ include globals.local | |||
11 | # edit ~/.config/mpv/foobar.conf: | 11 | # edit ~/.config/mpv/foobar.conf: |
12 | # screenshot-directory=~/Pictures | 12 | # screenshot-directory=~/Pictures |
13 | 13 | ||
14 | # Mpv has a powerful lua-API, some off these lua-scripts interact | 14 | # mpv has a powerful Lua API and some of the Lua scripts interact with |
15 | # with external resources which are blocked by firejail. In such cases | 15 | # external resources which are blocked by firejail. In such cases you need to |
16 | # you need to allow these resources by | 16 | # allow these resources by: |
17 | # - adding additional binaries to private-bin | 17 | # - noblacklisting additional paths |
18 | # - whitelisting additional paths | 18 | # - whitelisting additional paths |
19 | # - noblacklisting paths | 19 | # - adding additional binaries to private-bin |
20 | # - weaking the dbus-policy | 20 | # - changing/weakening the D-Bus policy |
21 | # - ... | 21 | # - ... |
22 | # | 22 | # |
23 | # Often these scripts require a shell: | 23 | # Often these scripts require a shell: |
@@ -79,6 +79,8 @@ seccomp | |||
79 | seccomp.block-secondary | 79 | seccomp.block-secondary |
80 | tracelog | 80 | tracelog |
81 | 81 | ||
82 | # mpv links to libluajit, so no need to reference "lua*" in private-bin: | ||
83 | # https://github.com/netblue30/firejail/pull/5711#discussion_r1125622615 | ||
82 | private-bin env,mpv,python*,waf,youtube-dl,yt-dlp | 84 | private-bin env,mpv,python*,waf,youtube-dl,yt-dlp |
83 | # private-cache causes slow OSD, see #2838 | 85 | # private-cache causes slow OSD, see #2838 |
84 | #private-cache | 86 | #private-cache |
diff --git a/etc/profile-m-z/porn-cli.profile b/etc/profile-m-z/porn-cli.profile new file mode 100644 index 000000000..f33ff439c --- /dev/null +++ b/etc/profile-m-z/porn-cli.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for porn-cli | ||
2 | # Description: Python script for watching porn via the terminal | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include porn-cli.local | ||
7 | # Persistent global definitions | ||
8 | # added by included profile | ||
9 | #include globals.local | ||
10 | |||
11 | private-bin porn-cli | ||
12 | |||
13 | # Redirect | ||
14 | include mov-cli.profile | ||