diff options
Diffstat (limited to 'etc')
35 files changed, 135 insertions, 16 deletions
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc index 03daaa9a6..65159b951 100644 --- a/etc/inc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -168,8 +168,10 @@ blacklist ${HOME}/.local/share/systemd | |||
168 | blacklist ${PATH}/systemctl | 168 | blacklist ${PATH}/systemctl |
169 | blacklist ${PATH}/systemd-run | 169 | blacklist ${PATH}/systemd-run |
170 | blacklist ${RUNUSER}/systemd | 170 | blacklist ${RUNUSER}/systemd |
171 | blacklist /etc/credstore* | ||
171 | blacklist /etc/systemd/network | 172 | blacklist /etc/systemd/network |
172 | blacklist /etc/systemd/system | 173 | blacklist /etc/systemd/system |
174 | blacklist /run/credentials | ||
173 | blacklist /var/lib/systemd | 175 | blacklist /var/lib/systemd |
174 | # creates problems on Arch where /etc/resolv.conf is a symlink to /var/run/systemd/resolve/resolv.conf | 176 | # creates problems on Arch where /etc/resolv.conf is a symlink to /var/run/systemd/resolve/resolv.conf |
175 | #blacklist /var/run/systemd | 177 | #blacklist /var/run/systemd |
@@ -450,6 +452,9 @@ blacklist ${HOME}/.vaults | |||
450 | blacklist /run/timeshift | 452 | blacklist /run/timeshift |
451 | blacklist /var/backup | 453 | blacklist /var/backup |
452 | 454 | ||
455 | # dm-crypt / LUKS | ||
456 | blacklist /crypto_keyfile.bin | ||
457 | |||
453 | # Remove environment variables with auth tokens. | 458 | # Remove environment variables with auth tokens. |
454 | # Note however that the sandbox might still have access to the | 459 | # Note however that the sandbox might still have access to the |
455 | # files where these variables are set. | 460 | # files where these variables are set. |
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 2a7e1a898..3eb6c03d5 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -605,6 +605,7 @@ blacklist ${HOME}/.config/rpcs3 | |||
605 | blacklist ${HOME}/.config/rtv | 605 | blacklist ${HOME}/.config/rtv |
606 | blacklist ${HOME}/.config/scribus | 606 | blacklist ${HOME}/.config/scribus |
607 | blacklist ${HOME}/.config/scribusrc | 607 | blacklist ${HOME}/.config/scribusrc |
608 | blacklist ${HOME}/.config/sendgmail | ||
608 | blacklist ${HOME}/.config/sinew.in | 609 | blacklist ${HOME}/.config/sinew.in |
609 | blacklist ${HOME}/.config/sink | 610 | blacklist ${HOME}/.config/sink |
610 | blacklist ${HOME}/.config/skypeforlinux | 611 | blacklist ${HOME}/.config/skypeforlinux |
@@ -1108,6 +1109,7 @@ blacklist ${HOME}/.sbt | |||
1108 | blacklist ${HOME}/.scorched3d | 1109 | blacklist ${HOME}/.scorched3d |
1109 | blacklist ${HOME}/.scribus | 1110 | blacklist ${HOME}/.scribus |
1110 | blacklist ${HOME}/.scribusrc | 1111 | blacklist ${HOME}/.scribusrc |
1112 | blacklist ${HOME}/.sendgmail.* | ||
1111 | blacklist ${HOME}/.simutrans | 1113 | blacklist ${HOME}/.simutrans |
1112 | blacklist ${HOME}/.smartgit/*/passwords | 1114 | blacklist ${HOME}/.smartgit/*/passwords |
1113 | blacklist ${HOME}/.ssr | 1115 | blacklist ${HOME}/.ssr |
diff --git a/etc/inc/whitelist-usr-share-common.inc b/etc/inc/whitelist-usr-share-common.inc index bb0bcd050..dcf941004 100644 --- a/etc/inc/whitelist-usr-share-common.inc +++ b/etc/inc/whitelist-usr-share-common.inc | |||
@@ -29,6 +29,7 @@ whitelist /usr/share/gtk-engines | |||
29 | whitelist /usr/share/gtksourceview-3.0 | 29 | whitelist /usr/share/gtksourceview-3.0 |
30 | whitelist /usr/share/gtksourceview-4 | 30 | whitelist /usr/share/gtksourceview-4 |
31 | whitelist /usr/share/hunspell | 31 | whitelist /usr/share/hunspell |
32 | whitelist /usr/share/hyphen | ||
32 | whitelist /usr/share/hwdata | 33 | whitelist /usr/share/hwdata |
33 | whitelist /usr/share/icons | 34 | whitelist /usr/share/icons |
34 | whitelist /usr/share/icu | 35 | whitelist /usr/share/icu |
diff --git a/etc/profile-a-l/apostrophe.profile b/etc/profile-a-l/apostrophe.profile index 4ad6ac6bc..0655c2e6f 100644 --- a/etc/profile-a-l/apostrophe.profile +++ b/etc/profile-a-l/apostrophe.profile | |||
@@ -35,7 +35,6 @@ whitelist /usr/share/apostrophe | |||
35 | whitelist /usr/share/texlive | 35 | whitelist /usr/share/texlive |
36 | whitelist /usr/share/texmf | 36 | whitelist /usr/share/texmf |
37 | whitelist /usr/share/pandoc-* | 37 | whitelist /usr/share/pandoc-* |
38 | whitelist /usr/share/perl5 | ||
39 | include whitelist-runuser-common.inc | 38 | include whitelist-runuser-common.inc |
40 | include whitelist-usr-share-common.inc | 39 | include whitelist-usr-share-common.inc |
41 | include whitelist-var-common.inc | 40 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/archiver-common.profile b/etc/profile-a-l/archiver-common.profile index b0f83aa32..ef875c5b7 100644 --- a/etc/profile-a-l/archiver-common.profile +++ b/etc/profile-a-l/archiver-common.profile | |||
@@ -44,6 +44,7 @@ x11 none | |||
44 | 44 | ||
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-etc | ||
47 | 48 | ||
48 | dbus-user none | 49 | dbus-user none |
49 | dbus-system none | 50 | dbus-system none |
diff --git a/etc/profile-a-l/audacity.profile b/etc/profile-a-l/audacity.profile index 371054728..c2a482b61 100644 --- a/etc/profile-a-l/audacity.profile +++ b/etc/profile-a-l/audacity.profile | |||
@@ -50,6 +50,7 @@ tracelog | |||
50 | 50 | ||
51 | private-bin audacity | 51 | private-bin audacity |
52 | private-dev | 52 | private-dev |
53 | private-etc @x11 | ||
53 | private-tmp | 54 | private-tmp |
54 | 55 | ||
55 | # problems on Fedora 27 | 56 | # problems on Fedora 27 |
diff --git a/etc/profile-a-l/bibtex.profile b/etc/profile-a-l/bibtex.profile index e868dcbab..5f12d61f1 100644 --- a/etc/profile-a-l/bibtex.profile +++ b/etc/profile-a-l/bibtex.profile | |||
@@ -9,4 +9,3 @@ private-bin bibtex | |||
9 | 9 | ||
10 | # Redirect | 10 | # Redirect |
11 | include latex-common.profile | 11 | include latex-common.profile |
12 | |||
diff --git a/etc/profile-a-l/com.github.johnfactotum.Foliate.profile b/etc/profile-a-l/com.github.johnfactotum.Foliate.profile index f4533b537..6177b52c0 100644 --- a/etc/profile-a-l/com.github.johnfactotum.Foliate.profile +++ b/etc/profile-a-l/com.github.johnfactotum.Foliate.profile | |||
@@ -2,7 +2,7 @@ | |||
2 | # Description: Simple and modern GTK eBook reader | 2 | # Description: Simple and modern GTK eBook reader |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include foliate.local | 5 | include com.github.johnfactotum.Foliate.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
@@ -28,7 +28,6 @@ whitelist ${HOME}/.local/share/com.github.johnfactotum.Foliate | |||
28 | whitelist ${DOCUMENTS} | 28 | whitelist ${DOCUMENTS} |
29 | whitelist ${DOWNLOADS} | 29 | whitelist ${DOWNLOADS} |
30 | whitelist /usr/share/com.github.johnfactotum.Foliate | 30 | whitelist /usr/share/com.github.johnfactotum.Foliate |
31 | whitelist /usr/share/hyphen | ||
32 | include whitelist-common.inc | 31 | include whitelist-common.inc |
33 | include whitelist-usr-share-common.inc | 32 | include whitelist-usr-share-common.inc |
34 | include whitelist-var-common.inc | 33 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/dosbox.profile b/etc/profile-a-l/dosbox.profile index 1edbb7ca0..882709808 100644 --- a/etc/profile-a-l/dosbox.profile +++ b/etc/profile-a-l/dosbox.profile | |||
@@ -37,6 +37,7 @@ tracelog | |||
37 | 37 | ||
38 | private-bin dosbox | 38 | private-bin dosbox |
39 | private-dev | 39 | private-dev |
40 | private-etc @games | ||
40 | private-tmp | 41 | private-tmp |
41 | 42 | ||
42 | dbus-user none | 43 | dbus-user none |
diff --git a/etc/profile-a-l/electron-hardened.inc.profile b/etc/profile-a-l/electron-hardened.inc.profile index eacf5cebe..a9e1756d9 100644 --- a/etc/profile-a-l/electron-hardened.inc.profile +++ b/etc/profile-a-l/electron-hardened.inc.profile | |||
@@ -7,4 +7,4 @@ include electron-hardened.inc.local | |||
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include chrome-common-hardened.inc.profile | 10 | include chromium-common-hardened.inc.profile |
diff --git a/etc/profile-a-l/etr.profile b/etc/profile-a-l/etr.profile index 7d27f12c9..5b9892af3 100644 --- a/etc/profile-a-l/etr.profile +++ b/etc/profile-a-l/etr.profile | |||
@@ -49,6 +49,7 @@ private-bin etr | |||
49 | private-cache | 49 | private-cache |
50 | private-dev | 50 | private-dev |
51 | # private-etc alternatives,drirc,machine-id,openal,passwd | 51 | # private-etc alternatives,drirc,machine-id,openal,passwd |
52 | private-etc @games,@x11 | ||
52 | private-tmp | 53 | private-tmp |
53 | 54 | ||
54 | dbus-user none | 55 | dbus-user none |
diff --git a/etc/profile-a-l/fix-qdf.profile b/etc/profile-a-l/fix-qdf.profile new file mode 100644 index 000000000..2dbb44e1d --- /dev/null +++ b/etc/profile-a-l/fix-qdf.profile | |||
@@ -0,0 +1,13 @@ | |||
1 | # Firejail profile for fix-qdf | ||
2 | # This file is overwritten after every install/update | ||
3 | quiet | ||
4 | # Persistent local customizations | ||
5 | include fix-qdf.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | private-bin fix-qdf | ||
11 | |||
12 | # Redirect | ||
13 | include qpdf.profile | ||
diff --git a/etc/profile-a-l/frozen-bubble.profile b/etc/profile-a-l/frozen-bubble.profile index 86a8a8fc6..f162a4a31 100644 --- a/etc/profile-a-l/frozen-bubble.profile +++ b/etc/profile-a-l/frozen-bubble.profile | |||
@@ -22,6 +22,7 @@ mkdir ${HOME}/.frozen-bubble | |||
22 | whitelist ${HOME}/.frozen-bubble | 22 | whitelist ${HOME}/.frozen-bubble |
23 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | 24 | include whitelist-runuser-common.inc |
25 | whitelist /usr/share/games | ||
25 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
27 | 28 | ||
@@ -42,6 +43,7 @@ tracelog | |||
42 | disable-mnt | 43 | disable-mnt |
43 | # private-bin frozen-bubble | 44 | # private-bin frozen-bubble |
44 | private-dev | 45 | private-dev |
46 | private-etc @games,@x11 | ||
45 | private-tmp | 47 | private-tmp |
46 | 48 | ||
47 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-a-l/gimp.profile b/etc/profile-a-l/gimp.profile index 717519112..6f350f8ac 100644 --- a/etc/profile-a-l/gimp.profile +++ b/etc/profile-a-l/gimp.profile | |||
@@ -59,7 +59,7 @@ seccomp !mbind | |||
59 | tracelog | 59 | tracelog |
60 | 60 | ||
61 | private-dev | 61 | private-dev |
62 | private-etc @tls-ca,@x11,python* | 62 | private-etc @x11,python* |
63 | private-tmp | 63 | private-tmp |
64 | 64 | ||
65 | dbus-user none | 65 | dbus-user none |
diff --git a/etc/profile-a-l/gnome-calculator.profile b/etc/profile-a-l/gnome-calculator.profile index 3926146ff..e5c6022e8 100644 --- a/etc/profile-a-l/gnome-calculator.profile +++ b/etc/profile-a-l/gnome-calculator.profile | |||
@@ -45,6 +45,7 @@ disable-mnt | |||
45 | private-bin gnome-calculator | 45 | private-bin gnome-calculator |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc @x11 | ||
48 | #private-lib gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.*,libgnutls.so.*,libproxy.so.*,librsvg-2.so.*,libxml2.so.* | 49 | #private-lib gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.*,libgnutls.so.*,libproxy.so.*,librsvg-2.so.*,libxml2.so.* |
49 | private-tmp | 50 | private-tmp |
50 | 51 | ||
diff --git a/etc/profile-a-l/hasher-common.profile b/etc/profile-a-l/hasher-common.profile index fd8246aae..96e69d6cf 100644 --- a/etc/profile-a-l/hasher-common.profile +++ b/etc/profile-a-l/hasher-common.profile | |||
@@ -48,6 +48,7 @@ x11 none | |||
48 | # Add the next line to your hasher-common.local if you don't need to hash files in ~/.cache. | 48 | # Add the next line to your hasher-common.local if you don't need to hash files in ~/.cache. |
49 | #private-cache | 49 | #private-cache |
50 | private-dev | 50 | private-dev |
51 | private-etc | ||
51 | # Add the next line to your hasher-common.local if you don't need to hash files in /tmp. | 52 | # Add the next line to your hasher-common.local if you don't need to hash files in /tmp. |
52 | #private-tmp | 53 | #private-tmp |
53 | 54 | ||
diff --git a/etc/profile-a-l/iagno.profile b/etc/profile-a-l/iagno.profile index e16f3f1d5..82cba7887 100644 --- a/etc/profile-a-l/iagno.profile +++ b/etc/profile-a-l/iagno.profile | |||
@@ -13,6 +13,13 @@ include disable-interpreters.inc | |||
13 | include disable-programs.inc | 13 | include disable-programs.inc |
14 | include disable-shell.inc | 14 | include disable-shell.inc |
15 | 15 | ||
16 | whitelist ${HOME}/.local/share/glib-2.0/schemas | ||
17 | include whitelist-common.inc | ||
18 | |||
19 | include whitelist-runuser-common.inc | ||
20 | whitelist /usr/share/iagno | ||
21 | whitelist /usr/share/gdm | ||
22 | include whitelist-usr-share-common.inc | ||
16 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
17 | 24 | ||
18 | apparmor | 25 | apparmor |
@@ -28,11 +35,12 @@ nou2f | |||
28 | novideo | 35 | novideo |
29 | protocol unix | 36 | protocol unix |
30 | seccomp | 37 | seccomp |
38 | seccomp.block-secondary | ||
31 | 39 | ||
32 | disable-mnt | 40 | disable-mnt |
33 | private | ||
34 | private-bin iagno | 41 | private-bin iagno |
35 | private-dev | 42 | private-dev |
43 | private-etc @x11,gconf | ||
36 | private-tmp | 44 | private-tmp |
37 | 45 | ||
38 | # dbus-user none | 46 | # dbus-user none |
diff --git a/etc/profile-a-l/kdiff3.profile b/etc/profile-a-l/kdiff3.profile index e0b3eadfd..d9e4480f5 100644 --- a/etc/profile-a-l/kdiff3.profile +++ b/etc/profile-a-l/kdiff3.profile | |||
@@ -52,6 +52,7 @@ disable-mnt | |||
52 | private-bin kdiff3 | 52 | private-bin kdiff3 |
53 | private-cache | 53 | private-cache |
54 | private-dev | 54 | private-dev |
55 | private-etc @x11 | ||
55 | 56 | ||
56 | dbus-user none | 57 | dbus-user none |
57 | dbus-system none | 58 | dbus-system none |
diff --git a/etc/profile-a-l/latex.profile b/etc/profile-a-l/latex.profile index 2230dd570..f6e625d35 100644 --- a/etc/profile-a-l/latex.profile +++ b/etc/profile-a-l/latex.profile | |||
@@ -9,4 +9,3 @@ private-bin latex | |||
9 | 9 | ||
10 | # Redirect | 10 | # Redirect |
11 | include latex-common.profile | 11 | include latex-common.profile |
12 | |||
diff --git a/etc/profile-a-l/libreoffice.profile b/etc/profile-a-l/libreoffice.profile index 518928876..d7144d8c3 100644 --- a/etc/profile-a-l/libreoffice.profile +++ b/etc/profile-a-l/libreoffice.profile | |||
@@ -50,6 +50,7 @@ tracelog | |||
50 | #private-bin libreoffice,sh,uname,dirname,grep,sed,basename,ls | 50 | #private-bin libreoffice,sh,uname,dirname,grep,sed,basename,ls |
51 | private-cache | 51 | private-cache |
52 | private-dev | 52 | private-dev |
53 | private-etc @tls-ca,@x11,cups,gnupg,libreoffice,papersize,ssh | ||
53 | private-tmp | 54 | private-tmp |
54 | 55 | ||
55 | dbus-system none | 56 | dbus-system none |
diff --git a/etc/profile-m-z/open-invaders.profile b/etc/profile-m-z/open-invaders.profile index f6b070ab3..498a4f6c8 100644 --- a/etc/profile-m-z/open-invaders.profile +++ b/etc/profile-m-z/open-invaders.profile | |||
@@ -35,6 +35,7 @@ seccomp | |||
35 | 35 | ||
36 | private-bin open-invaders | 36 | private-bin open-invaders |
37 | private-dev | 37 | private-dev |
38 | private-etc @x11 | ||
38 | private-tmp | 39 | private-tmp |
39 | 40 | ||
40 | dbus-user none | 41 | dbus-user none |
diff --git a/etc/profile-m-z/pdflatex.profile b/etc/profile-m-z/pdflatex.profile index caf980d4d..ddf6d0990 100644 --- a/etc/profile-m-z/pdflatex.profile +++ b/etc/profile-m-z/pdflatex.profile | |||
@@ -9,4 +9,3 @@ private-bin pdflatex | |||
9 | 9 | ||
10 | # Redirect | 10 | # Redirect |
11 | include latex-common.profile | 11 | include latex-common.profile |
12 | |||
diff --git a/etc/profile-m-z/presentations18.profile b/etc/profile-m-z/presentations18.profile index 65d684c40..ac844d1af 100644 --- a/etc/profile-m-z/presentations18.profile +++ b/etc/profile-m-z/presentations18.profile | |||
@@ -8,4 +8,3 @@ include globals.local | |||
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.profile |
11 | |||
diff --git a/etc/profile-m-z/qpdf.profile b/etc/profile-m-z/qpdf.profile new file mode 100644 index 000000000..0c1e09e92 --- /dev/null +++ b/etc/profile-m-z/qpdf.profile | |||
@@ -0,0 +1,68 @@ | |||
1 | # Firejail profile for qpdf | ||
2 | # Description: A Content-Preserving PDF Transformation System | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include qpdf.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist ${RUNUSER}/wayland-* | ||
11 | |||
12 | noblacklist ${DOCUMENTS} | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-proc.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-shell.inc | ||
21 | include disable-X11.inc | ||
22 | include disable-xdg.inc | ||
23 | |||
24 | whitelist ${DOCUMENTS} | ||
25 | whitelist ${DOWNLOADS} | ||
26 | include whitelist-common.inc | ||
27 | include whitelist-run-common.inc | ||
28 | include whitelist-runuser-common.inc | ||
29 | include whitelist-usr-share-common.inc | ||
30 | include whitelist-var-common.inc | ||
31 | |||
32 | apparmor | ||
33 | caps.drop all | ||
34 | hostname qpdf | ||
35 | ipc-namespace | ||
36 | machine-id | ||
37 | net none | ||
38 | no3d | ||
39 | nodvd | ||
40 | nogroups | ||
41 | noinput | ||
42 | nonewprivs | ||
43 | noprinters | ||
44 | noroot | ||
45 | nosound | ||
46 | notv | ||
47 | nou2f | ||
48 | novideo | ||
49 | # block the socket syscall to simulate an be empty protocol line, see #639 | ||
50 | seccomp socket | ||
51 | tracelog | ||
52 | x11 none | ||
53 | |||
54 | private-bin qpdf | ||
55 | private-cache | ||
56 | private-dev | ||
57 | private-etc | ||
58 | private-lib libqpdf.so.* | ||
59 | #private-tmp # breaks on Arch Linux | ||
60 | |||
61 | dbus-user none | ||
62 | dbus-system none | ||
63 | |||
64 | memory-deny-write-execute | ||
65 | restrict-namespaces | ||
66 | read-only ${HOME} | ||
67 | read-write ${DOCUMENTS} | ||
68 | read-write ${DOWNLOADS} | ||
diff --git a/etc/profile-m-z/qutebrowser.profile b/etc/profile-m-z/qutebrowser.profile index e83484ae5..0d35dbbad 100644 --- a/etc/profile-m-z/qutebrowser.profile +++ b/etc/profile-m-z/qutebrowser.profile | |||
@@ -18,6 +18,8 @@ include allow-bin-sh.inc | |||
18 | include allow-python2.inc | 18 | include allow-python2.inc |
19 | include allow-python3.inc | 19 | include allow-python3.inc |
20 | 20 | ||
21 | ignore noexec ${HOME} | ||
22 | |||
21 | include disable-common.inc | 23 | include disable-common.inc |
22 | include disable-devel.inc | 24 | include disable-devel.inc |
23 | include disable-exec.inc | 25 | include disable-exec.inc |
@@ -41,7 +43,7 @@ include whitelist-runuser-common.inc | |||
41 | include whitelist-usr-share-common.inc | 43 | include whitelist-usr-share-common.inc |
42 | include whitelist-var-common.inc | 44 | include whitelist-var-common.inc |
43 | 45 | ||
44 | apparmor | 46 | #apparmor # breaks userscripts under ${HOME}, see #5639 |
45 | caps.drop all | 47 | caps.drop all |
46 | netfilter | 48 | netfilter |
47 | nodvd | 49 | nodvd |
diff --git a/etc/profile-m-z/rhythmbox.profile b/etc/profile-m-z/rhythmbox.profile index dccd93429..77c032a53 100644 --- a/etc/profile-m-z/rhythmbox.profile +++ b/etc/profile-m-z/rhythmbox.profile | |||
@@ -51,6 +51,7 @@ tracelog | |||
51 | private-bin rhythmbox,rhythmbox-client | 51 | private-bin rhythmbox,rhythmbox-client |
52 | private-cache | 52 | private-cache |
53 | private-dev | 53 | private-dev |
54 | private-etc @tls-ca,@x11,python* | ||
54 | private-tmp | 55 | private-tmp |
55 | 56 | ||
56 | dbus-user filter | 57 | dbus-user filter |
diff --git a/etc/profile-m-z/rpcs3.profile b/etc/profile-m-z/rpcs3.profile index 186e31b46..405ab818d 100644 --- a/etc/profile-m-z/rpcs3.profile +++ b/etc/profile-m-z/rpcs3.profile | |||
@@ -2,7 +2,7 @@ | |||
2 | # Description: RPCS3 emulator | 2 | # Description: RPCS3 emulator |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include rpcs3.local | 5 | include rpcs3.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
diff --git a/etc/profile-m-z/simutrans.profile b/etc/profile-m-z/simutrans.profile index 6ba735556..f88ae65c8 100644 --- a/etc/profile-m-z/simutrans.profile +++ b/etc/profile-m-z/simutrans.profile | |||
@@ -35,6 +35,7 @@ seccomp | |||
35 | 35 | ||
36 | # private-bin simutrans | 36 | # private-bin simutrans |
37 | private-dev | 37 | private-dev |
38 | private-etc @games,@x11 | ||
38 | private-tmp | 39 | private-tmp |
39 | 40 | ||
40 | dbus-user none | 41 | dbus-user none |
diff --git a/etc/profile-m-z/tex.profile b/etc/profile-m-z/tex.profile index f56c3038e..c850cf5c3 100644 --- a/etc/profile-m-z/tex.profile +++ b/etc/profile-m-z/tex.profile | |||
@@ -9,4 +9,3 @@ private-bin tex | |||
9 | 9 | ||
10 | # Redirect | 10 | # Redirect |
11 | include latex-common.profile | 11 | include latex-common.profile |
12 | |||
diff --git a/etc/profile-m-z/textmaker18.profile b/etc/profile-m-z/textmaker18.profile index e5a4b6454..8284df791 100644 --- a/etc/profile-m-z/textmaker18.profile +++ b/etc/profile-m-z/textmaker18.profile | |||
@@ -8,4 +8,3 @@ include globals.local | |||
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.profile |
11 | |||
diff --git a/etc/profile-m-z/textmaker18free.profile b/etc/profile-m-z/textmaker18free.profile index 0e918bf0a..ad945ca55 100644 --- a/etc/profile-m-z/textmaker18free.profile +++ b/etc/profile-m-z/textmaker18free.profile | |||
@@ -8,4 +8,3 @@ include globals.local | |||
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.profile |
11 | |||
diff --git a/etc/profile-m-z/totem.profile b/etc/profile-m-z/totem.profile index e21d37040..a4cb49171 100644 --- a/etc/profile-m-z/totem.profile +++ b/etc/profile-m-z/totem.profile | |||
@@ -51,7 +51,7 @@ private-bin totem | |||
51 | # totem needs access to ~/.cache/tracker or it exits | 51 | # totem needs access to ~/.cache/tracker or it exits |
52 | #private-cache | 52 | #private-cache |
53 | private-dev | 53 | private-dev |
54 | # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl | 54 | private-etc @tls-ca,@x11,python* |
55 | private-tmp | 55 | private-tmp |
56 | 56 | ||
57 | # makes settings immutable | 57 | # makes settings immutable |
diff --git a/etc/profile-m-z/transmission-cli.profile b/etc/profile-m-z/transmission-cli.profile index edb4db8aa..5c0690b1d 100644 --- a/etc/profile-m-z/transmission-cli.profile +++ b/etc/profile-m-z/transmission-cli.profile | |||
@@ -7,6 +7,8 @@ include transmission-cli.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | whitelist /usr/share/transmission | ||
11 | |||
10 | private-bin transmission-cli | 12 | private-bin transmission-cli |
11 | private-etc @tls-ca | 13 | private-etc @tls-ca |
12 | 14 | ||
diff --git a/etc/profile-m-z/transmission-common.profile b/etc/profile-m-z/transmission-common.profile index 0a9029c97..d80eb708b 100644 --- a/etc/profile-m-z/transmission-common.profile +++ b/etc/profile-m-z/transmission-common.profile | |||
@@ -44,6 +44,7 @@ tracelog | |||
44 | 44 | ||
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-etc @tls-ca,@x11 | ||
47 | private-tmp | 48 | private-tmp |
48 | 49 | ||
49 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-m-z/zlib-flate.profile b/etc/profile-m-z/zlib-flate.profile new file mode 100644 index 000000000..48a2c9845 --- /dev/null +++ b/etc/profile-m-z/zlib-flate.profile | |||
@@ -0,0 +1,13 @@ | |||
1 | # Firejail profile for zlib-flate | ||
2 | # This file is overwritten after every install/update | ||
3 | quiet | ||
4 | # Persistent local customizations | ||
5 | include zlib-flate.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | private-bin zlib-flate | ||
11 | |||
12 | # Redirect | ||
13 | include qpdf.profile | ||