diff options
Diffstat (limited to 'etc')
65 files changed, 1509 insertions, 82 deletions
diff --git a/etc/apparmor/firejail-default b/etc/apparmor/firejail-default index 68e20d9b9..e396ae7d9 100644 --- a/etc/apparmor/firejail-default +++ b/etc/apparmor/firejail-default | |||
@@ -2,6 +2,10 @@ | |||
2 | # Generic Firejail AppArmor profile | 2 | # Generic Firejail AppArmor profile |
3 | ######################################### | 3 | ######################################### |
4 | 4 | ||
5 | # AppArmor 3.0 uses the @{run} variable in <abstractions/dbus-strict> | ||
6 | # and <abstractions/dbus-session-strict>. | ||
7 | #include <tunables/global> | ||
8 | |||
5 | ########## | 9 | ########## |
6 | # A simple PID declaration based on Ubuntu's @{pid} | 10 | # A simple PID declaration based on Ubuntu's @{pid} |
7 | # Ubuntu keeps it under tunables/kernelvars and include it via tunables/global. | 11 | # Ubuntu keeps it under tunables/kernelvars and include it via tunables/global. |
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc index c7516ab42..b2be4270e 100644 --- a/etc/inc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -472,14 +472,9 @@ blacklist /.snapshots | |||
472 | # flatpak | 472 | # flatpak |
473 | blacklist ${HOME}/.cache/flatpak | 473 | blacklist ${HOME}/.cache/flatpak |
474 | blacklist ${HOME}/.config/flatpak | 474 | blacklist ${HOME}/.config/flatpak |
475 | blacklist ${HOME}/.local/share/flatpak/app | 475 | noblacklist ${HOME}/.local/share/flatpak/exports |
476 | blacklist ${HOME}/.local/share/flatpak/appstream | ||
477 | blacklist ${HOME}/.local/share/flatpak/db | ||
478 | read-only ${HOME}/.local/share/flatpak/exports | 476 | read-only ${HOME}/.local/share/flatpak/exports |
479 | blacklist ${HOME}/.local/share/flatpak/oci | 477 | blacklist ${HOME}/.local/share/flatpak/* |
480 | blacklist ${HOME}/.local/share/flatpak/overrides | ||
481 | blacklist ${HOME}/.local/share/flatpak/repo | ||
482 | blacklist ${HOME}/.local/share/flatpak/runtime | ||
483 | blacklist ${HOME}/.var | 478 | blacklist ${HOME}/.var |
484 | blacklist ${RUNUSER}/app | 479 | blacklist ${RUNUSER}/app |
485 | blacklist ${RUNUSER}/doc | 480 | blacklist ${RUNUSER}/doc |
@@ -487,7 +482,8 @@ blacklist ${RUNUSER}/.dbus-proxy | |||
487 | blacklist ${RUNUSER}/.flatpak | 482 | blacklist ${RUNUSER}/.flatpak |
488 | blacklist ${RUNUSER}/.flatpak-helper | 483 | blacklist ${RUNUSER}/.flatpak-helper |
489 | blacklist /usr/share/flatpak | 484 | blacklist /usr/share/flatpak |
490 | blacklist /var/lib/flatpak | 485 | noblacklist /var/lib/flatpak/exports |
486 | blacklist /var/lib/flatpak/* | ||
491 | # most of the time bwrap is SUID binary | 487 | # most of the time bwrap is SUID binary |
492 | blacklist ${PATH}/bwrap | 488 | blacklist ${PATH}/bwrap |
493 | 489 | ||
diff --git a/etc/inc/disable-devel.inc b/etc/inc/disable-devel.inc index e1ba13380..e74b1b40b 100644 --- a/etc/inc/disable-devel.inc +++ b/etc/inc/disable-devel.inc | |||
@@ -49,6 +49,7 @@ blacklist ${PATH}/openssl-1.0 | |||
49 | blacklist ${PATH}/rust-gdb | 49 | blacklist ${PATH}/rust-gdb |
50 | blacklist ${PATH}/rust-lldb | 50 | blacklist ${PATH}/rust-lldb |
51 | blacklist ${PATH}/rustc | 51 | blacklist ${PATH}/rustc |
52 | blacklist ${HOME}/.rustup | ||
52 | 53 | ||
53 | # tcc - Tiny C Compiler | 54 | # tcc - Tiny C Compiler |
54 | blacklist ${PATH}/tcc | 55 | blacklist ${PATH}/tcc |
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index e5dd9cb59..42d690c94 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -37,6 +37,7 @@ blacklist ${HOME}/.VirtualBox | |||
37 | blacklist ${HOME}/.WebStorm* | 37 | blacklist ${HOME}/.WebStorm* |
38 | blacklist ${HOME}/.Wolfram Research | 38 | blacklist ${HOME}/.Wolfram Research |
39 | blacklist ${HOME}/.ZAP | 39 | blacklist ${HOME}/.ZAP |
40 | blacklist ${HOME}/.abook | ||
40 | blacklist ${HOME}/.aMule | 41 | blacklist ${HOME}/.aMule |
41 | blacklist ${HOME}/.android | 42 | blacklist ${HOME}/.android |
42 | blacklist ${HOME}/.anydesk | 43 | blacklist ${HOME}/.anydesk |
@@ -49,6 +50,7 @@ blacklist ${HOME}/.asunder_album_title | |||
49 | blacklist ${HOME}/.atom | 50 | blacklist ${HOME}/.atom |
50 | blacklist ${HOME}/.attic | 51 | blacklist ${HOME}/.attic |
51 | blacklist ${HOME}/.audacity-data | 52 | blacklist ${HOME}/.audacity-data |
53 | blacklist ${HOME}/.balsa | ||
52 | blacklist ${HOME}/.bcast5 | 54 | blacklist ${HOME}/.bcast5 |
53 | blacklist ${HOME}/.bibletime | 55 | blacklist ${HOME}/.bibletime |
54 | blacklist ${HOME}/.bitcoin | 56 | blacklist ${HOME}/.bitcoin |
@@ -83,6 +85,7 @@ blacklist ${HOME}/.config/Debauchee/Barrier.conf | |||
83 | blacklist ${HOME}/.config/Dharkael | 85 | blacklist ${HOME}/.config/Dharkael |
84 | blacklist ${HOME}/.config/Element | 86 | blacklist ${HOME}/.config/Element |
85 | blacklist ${HOME}/.config/Element (Riot) | 87 | blacklist ${HOME}/.config/Element (Riot) |
88 | blacklist ${HOME}/.config/ENCOM | ||
86 | blacklist ${HOME}/.config/Enox | 89 | blacklist ${HOME}/.config/Enox |
87 | blacklist ${HOME}/.config/Ferdi | 90 | blacklist ${HOME}/.config/Ferdi |
88 | blacklist ${HOME}/.config/Flavio Tordini | 91 | blacklist ${HOME}/.config/Flavio Tordini |
@@ -122,6 +125,7 @@ blacklist ${HOME}/.config/QMediathekView | |||
122 | blacklist ${HOME}/.config/Qlipper | 125 | blacklist ${HOME}/.config/Qlipper |
123 | blacklist ${HOME}/.config/QuiteRss | 126 | blacklist ${HOME}/.config/QuiteRss |
124 | blacklist ${HOME}/.config/QuiteRssrc | 127 | blacklist ${HOME}/.config/QuiteRssrc |
128 | blacklist ${HOME}/.config/Quotient | ||
125 | blacklist ${HOME}/.config/Rambox | 129 | blacklist ${HOME}/.config/Rambox |
126 | blacklist ${HOME}/.config/Riot | 130 | blacklist ${HOME}/.config/Riot |
127 | blacklist ${HOME}/.config/Rocket.Chat | 131 | blacklist ${HOME}/.config/Rocket.Chat |
@@ -131,11 +135,14 @@ blacklist ${HOME}/.config/Slack | |||
131 | blacklist ${HOME}/.config/Standard Notes | 135 | blacklist ${HOME}/.config/Standard Notes |
132 | blacklist ${HOME}/.config/SubDownloader | 136 | blacklist ${HOME}/.config/SubDownloader |
133 | blacklist ${HOME}/.config/Thunar | 137 | blacklist ${HOME}/.config/Thunar |
138 | blacklist ${HOME}/.config/Twitch | ||
134 | blacklist ${HOME}/.config/Unknown Organization | 139 | blacklist ${HOME}/.config/Unknown Organization |
135 | blacklist ${HOME}/.config/VirtualBox | 140 | blacklist ${HOME}/.config/VirtualBox |
136 | blacklist ${HOME}/.config/Wire | 141 | blacklist ${HOME}/.config/Wire |
142 | blacklist ${HOME}/.config/Youtube | ||
137 | blacklist ${HOME}/.config/Zeal | 143 | blacklist ${HOME}/.config/Zeal |
138 | blacklist ${HOME}/.config/ZeGrapher Project | 144 | blacklist ${HOME}/.config/ZeGrapher Project |
145 | blacklist ${HOME}/.config/aacs | ||
139 | blacklist ${HOME}/.config/abiword | 146 | blacklist ${HOME}/.config/abiword |
140 | blacklist ${HOME}/.config/agenda | 147 | blacklist ${HOME}/.config/agenda |
141 | blacklist ${HOME}/.config/akonadi* | 148 | blacklist ${HOME}/.config/akonadi* |
@@ -203,10 +210,13 @@ blacklist ${HOME}/.config/emailidentities | |||
203 | blacklist ${HOME}/.config/enchant | 210 | blacklist ${HOME}/.config/enchant |
204 | blacklist ${HOME}/.config/eog | 211 | blacklist ${HOME}/.config/eog |
205 | blacklist ${HOME}/.config/epiphany | 212 | blacklist ${HOME}/.config/epiphany |
213 | blacklist ${HOME}/.config/equalx | ||
206 | blacklist ${HOME}/.config/evince | 214 | blacklist ${HOME}/.config/evince |
207 | blacklist ${HOME}/.config/evolution | 215 | blacklist ${HOME}/.config/evolution |
208 | blacklist ${HOME}/.config/falkon | 216 | blacklist ${HOME}/.config/falkon |
209 | blacklist ${HOME}/.config/filezilla | 217 | blacklist ${HOME}/.config/filezilla |
218 | blacklist ${HOME}/.config/flameshot | ||
219 | blacklist ${HOME}/.config/flaska.net | ||
210 | blacklist ${HOME}/.config/flowblade | 220 | blacklist ${HOME}/.config/flowblade |
211 | blacklist ${HOME}/.config/font-manager | 221 | blacklist ${HOME}/.config/font-manager |
212 | blacklist ${HOME}/.config/freecol | 222 | blacklist ${HOME}/.config/freecol |
@@ -214,6 +224,7 @@ blacklist ${HOME}/.config/gajim | |||
214 | blacklist ${HOME}/.config/galculator | 224 | blacklist ${HOME}/.config/galculator |
215 | blacklist ${HOME}/.config/gconf | 225 | blacklist ${HOME}/.config/gconf |
216 | blacklist ${HOME}/.config/geany | 226 | blacklist ${HOME}/.config/geany |
227 | blacklist ${HOME}/.config/geary | ||
217 | blacklist ${HOME}/.config/gedit | 228 | blacklist ${HOME}/.config/gedit |
218 | blacklist ${HOME}/.config/geeqie | 229 | blacklist ${HOME}/.config/geeqie |
219 | blacklist ${HOME}/.config/ghb | 230 | blacklist ${HOME}/.config/ghb |
@@ -258,6 +269,7 @@ blacklist ${HOME}/.config/katerc | |||
258 | blacklist ${HOME}/.config/kateschemarc | 269 | blacklist ${HOME}/.config/kateschemarc |
259 | blacklist ${HOME}/.config/katesyntaxhighlightingrc | 270 | blacklist ${HOME}/.config/katesyntaxhighlightingrc |
260 | blacklist ${HOME}/.config/katevirc | 271 | blacklist ${HOME}/.config/katevirc |
272 | blacklist ${HOME}/.config/kazam | ||
261 | blacklist ${HOME}/.config/kdeconnect | 273 | blacklist ${HOME}/.config/kdeconnect |
262 | blacklist ${HOME}/.config/kdenliverc | 274 | blacklist ${HOME}/.config/kdenliverc |
263 | blacklist ${HOME}/.config/kfindrc | 275 | blacklist ${HOME}/.config/kfindrc |
@@ -274,6 +286,7 @@ blacklist ${HOME}/.config/konversation.notifyrc | |||
274 | blacklist ${HOME}/.config/kritarc | 286 | blacklist ${HOME}/.config/kritarc |
275 | blacklist ${HOME}/.config/ktorrentrc | 287 | blacklist ${HOME}/.config/ktorrentrc |
276 | blacklist ${HOME}/.config/ktouch2rc | 288 | blacklist ${HOME}/.config/ktouch2rc |
289 | blacklist ${HOME}/.config/kube | ||
277 | blacklist ${HOME}/.config/kwriterc | 290 | blacklist ${HOME}/.config/kwriterc |
278 | blacklist ${HOME}/.config/leafpad | 291 | blacklist ${HOME}/.config/leafpad |
279 | blacklist ${HOME}/.config/libreoffice | 292 | blacklist ${HOME}/.config/libreoffice |
@@ -281,6 +294,7 @@ blacklist ${HOME}/.config/liferea | |||
281 | blacklist ${HOME}/.config/lugaru | 294 | blacklist ${HOME}/.config/lugaru |
282 | blacklist ${HOME}/.config/lximage-qt | 295 | blacklist ${HOME}/.config/lximage-qt |
283 | blacklist ${HOME}/.config/mailtransports | 296 | blacklist ${HOME}/.config/mailtransports |
297 | blacklist ${HOME}/.local/share/man | ||
284 | blacklist ${HOME}/.config/mana | 298 | blacklist ${HOME}/.config/mana |
285 | blacklist ${HOME}/.config/mate-calc | 299 | blacklist ${HOME}/.config/mate-calc |
286 | blacklist ${HOME}/.config/mate/eom | 300 | blacklist ${HOME}/.config/mate/eom |
@@ -291,6 +305,7 @@ blacklist ${HOME}/.config/menulibre.cfg | |||
291 | blacklist ${HOME}/.config/mfusion | 305 | blacklist ${HOME}/.config/mfusion |
292 | blacklist ${HOME}/.config/Microsoft | 306 | blacklist ${HOME}/.config/Microsoft |
293 | blacklist ${HOME}/.config/midori | 307 | blacklist ${HOME}/.config/midori |
308 | blacklist ${HOME}/.config/mirage | ||
294 | blacklist ${HOME}/.config/mono | 309 | blacklist ${HOME}/.config/mono |
295 | blacklist ${HOME}/.config/mpDris2 | 310 | blacklist ${HOME}/.config/mpDris2 |
296 | blacklist ${HOME}/.config/mpd | 311 | blacklist ${HOME}/.config/mpd |
@@ -312,6 +327,7 @@ blacklist ${HOME}/.config/nuclear | |||
312 | blacklist ${HOME}/.config/obs-studio | 327 | blacklist ${HOME}/.config/obs-studio |
313 | blacklist ${HOME}/.config/okularpartrc | 328 | blacklist ${HOME}/.config/okularpartrc |
314 | blacklist ${HOME}/.config/okularrc | 329 | blacklist ${HOME}/.config/okularrc |
330 | blacklist ${HOME}/.config/onboard | ||
315 | blacklist ${HOME}/.config/onionshare | 331 | blacklist ${HOME}/.config/onionshare |
316 | blacklist ${HOME}/.config/onlyoffice | 332 | blacklist ${HOME}/.config/onlyoffice |
317 | blacklist ${HOME}/.config/opera | 333 | blacklist ${HOME}/.config/opera |
@@ -331,6 +347,7 @@ blacklist ${HOME}/.config/pluma | |||
331 | blacklist ${HOME}/.config/ppsspp | 347 | blacklist ${HOME}/.config/ppsspp |
332 | blacklist ${HOME}/.config/pragha | 348 | blacklist ${HOME}/.config/pragha |
333 | blacklist ${HOME}/.config/profanity | 349 | blacklist ${HOME}/.config/profanity |
350 | blacklist ${HOME}/.config/psi | ||
334 | blacklist ${HOME}/.config/psi+ | 351 | blacklist ${HOME}/.config/psi+ |
335 | blacklist ${HOME}/.config/qBittorrent | 352 | blacklist ${HOME}/.config/qBittorrent |
336 | blacklist ${HOME}/.config/qBittorrentrc | 353 | blacklist ${HOME}/.config/qBittorrentrc |
@@ -346,10 +363,12 @@ blacklist ${HOME}/.config/rtv | |||
346 | blacklist ${HOME}/.config/scribus | 363 | blacklist ${HOME}/.config/scribus |
347 | blacklist ${HOME}/.config/scribusrc | 364 | blacklist ${HOME}/.config/scribusrc |
348 | blacklist ${HOME}/.config/sinew.in | 365 | blacklist ${HOME}/.config/sinew.in |
366 | blacklist ${HOME}/.config/sink | ||
349 | blacklist ${HOME}/.config/skypeforlinux | 367 | blacklist ${HOME}/.config/skypeforlinux |
350 | blacklist ${HOME}/.config/slimjet | 368 | blacklist ${HOME}/.config/slimjet |
351 | blacklist ${HOME}/.config/smplayer | 369 | blacklist ${HOME}/.config/smplayer |
352 | blacklist ${HOME}/.config/smtube | 370 | blacklist ${HOME}/.config/smtube |
371 | blacklist ${HOME}/.config/smuxi | ||
353 | blacklist ${HOME}/.config/snox | 372 | blacklist ${HOME}/.config/snox |
354 | blacklist ${HOME}/.config/sound-juicer | 373 | blacklist ${HOME}/.config/sound-juicer |
355 | blacklist ${HOME}/.config/specialmailcollectionsrc | 374 | blacklist ${HOME}/.config/specialmailcollectionsrc |
@@ -396,6 +415,8 @@ blacklist ${HOME}/.config/yandex-browser | |||
396 | blacklist ${HOME}/.config/yandex-browser-beta | 415 | blacklist ${HOME}/.config/yandex-browser-beta |
397 | blacklist ${HOME}/.config/yelp | 416 | blacklist ${HOME}/.config/yelp |
398 | blacklist ${HOME}/.config/youtube-dl | 417 | blacklist ${HOME}/.config/youtube-dl |
418 | blacklist ${HOME}/.config/youtubemusic-nativefier-040164 | ||
419 | blacklist ${HOME}/.config/youtube-music-desktop-app | ||
399 | blacklist ${HOME}/.config/youtube-viewer | 420 | blacklist ${HOME}/.config/youtube-viewer |
400 | blacklist ${HOME}/.config/zathura | 421 | blacklist ${HOME}/.config/zathura |
401 | blacklist ${HOME}/.config/zoomus.conf | 422 | blacklist ${HOME}/.config/zoomus.conf |
@@ -418,6 +439,7 @@ blacklist ${HOME}/.electrum* | |||
418 | blacklist ${HOME}/.elinks | 439 | blacklist ${HOME}/.elinks |
419 | blacklist ${HOME}/.emacs | 440 | blacklist ${HOME}/.emacs |
420 | blacklist ${HOME}/.emacs.d | 441 | blacklist ${HOME}/.emacs.d |
442 | blacklist ${HOME}/.equalx | ||
421 | blacklist ${HOME}/.ethereum | 443 | blacklist ${HOME}/.ethereum |
422 | blacklist ${HOME}/.etr | 444 | blacklist ${HOME}/.etr |
423 | blacklist ${HOME}/.filezilla | 445 | blacklist ${HOME}/.filezilla |
@@ -541,6 +563,7 @@ blacklist ${HOME}/.local/share/Kingsoft | |||
541 | blacklist ${HOME}/.local/share/Mendeley Ltd. | 563 | blacklist ${HOME}/.local/share/Mendeley Ltd. |
542 | blacklist ${HOME}/.local/share/Mumble | 564 | blacklist ${HOME}/.local/share/Mumble |
543 | blacklist ${HOME}/.local/share/PBE | 565 | blacklist ${HOME}/.local/share/PBE |
566 | blacklist ${HOME}/.local/share/Psi | ||
544 | blacklist ${HOME}/.local/share/QGIS | 567 | blacklist ${HOME}/.local/share/QGIS |
545 | blacklist ${HOME}/.local/share/QMediathekView | 568 | blacklist ${HOME}/.local/share/QMediathekView |
546 | blacklist ${HOME}/.local/share/QuiteRss | 569 | blacklist ${HOME}/.local/share/QuiteRss |
@@ -626,6 +649,7 @@ blacklist ${HOME}/.local/share/krita | |||
626 | blacklist ${HOME}/.local/share/ktorrent | 649 | blacklist ${HOME}/.local/share/ktorrent |
627 | blacklist ${HOME}/.local/share/ktorrentrc | 650 | blacklist ${HOME}/.local/share/ktorrentrc |
628 | blacklist ${HOME}/.local/share/ktouch | 651 | blacklist ${HOME}/.local/share/ktouch |
652 | blacklist ${HOME}/.local/share/kube | ||
629 | blacklist ${HOME}/.local/share/kwrite | 653 | blacklist ${HOME}/.local/share/kwrite |
630 | blacklist ${HOME}/.local/share/kxmlgui5/* | 654 | blacklist ${HOME}/.local/share/kxmlgui5/* |
631 | blacklist ${HOME}/.local/share/liferea | 655 | blacklist ${HOME}/.local/share/liferea |
@@ -637,6 +661,7 @@ blacklist ${HOME}/.local/share/mana | |||
637 | blacklist ${HOME}/.local/share/maps-places.json | 661 | blacklist ${HOME}/.local/share/maps-places.json |
638 | blacklist ${HOME}/.local/share/meld | 662 | blacklist ${HOME}/.local/share/meld |
639 | blacklist ${HOME}/.local/share/midori | 663 | blacklist ${HOME}/.local/share/midori |
664 | blacklist ${HOME}/.local/share/mirage | ||
640 | blacklist ${HOME}/.local/share/multimc | 665 | blacklist ${HOME}/.local/share/multimc |
641 | blacklist ${HOME}/.local/share/multimc5 | 666 | blacklist ${HOME}/.local/share/multimc5 |
642 | blacklist ${HOME}/.local/share/mupen64plus | 667 | blacklist ${HOME}/.local/share/mupen64plus |
@@ -657,6 +682,7 @@ blacklist ${HOME}/.local/share/Paradox Interactive | |||
657 | blacklist ${HOME}/.local/share/pix | 682 | blacklist ${HOME}/.local/share/pix |
658 | blacklist ${HOME}/.local/share/plasma_notes | 683 | blacklist ${HOME}/.local/share/plasma_notes |
659 | blacklist ${HOME}/.local/share/profanity | 684 | blacklist ${HOME}/.local/share/profanity |
685 | blacklist ${HOME}/.local/share/psi | ||
660 | blacklist ${HOME}/.local/share/psi+ | 686 | blacklist ${HOME}/.local/share/psi+ |
661 | blacklist ${HOME}/.local/share/quadrapassel | 687 | blacklist ${HOME}/.local/share/quadrapassel |
662 | blacklist ${HOME}/.local/share/qpdfview | 688 | blacklist ${HOME}/.local/share/qpdfview |
@@ -666,6 +692,8 @@ blacklist ${HOME}/.local/share/rhythmbox | |||
666 | blacklist ${HOME}/.local/share/rtv | 692 | blacklist ${HOME}/.local/share/rtv |
667 | blacklist ${HOME}/.local/share/scribus | 693 | blacklist ${HOME}/.local/share/scribus |
668 | blacklist ${HOME}/.local/share/signal-cli | 694 | blacklist ${HOME}/.local/share/signal-cli |
695 | blacklist ${HOME}/.local/share/sink | ||
696 | blacklist ${HOME}/.local/share/smuxi | ||
669 | blacklist ${HOME}/.local/share/spotify | 697 | blacklist ${HOME}/.local/share/spotify |
670 | blacklist ${HOME}/.local/share/steam | 698 | blacklist ${HOME}/.local/share/steam |
671 | blacklist ${HOME}/.local/share/strawberry | 699 | blacklist ${HOME}/.local/share/strawberry |
@@ -798,6 +826,7 @@ blacklist ${HOME}/.xmind | |||
798 | blacklist ${HOME}/.xmms | 826 | blacklist ${HOME}/.xmms |
799 | blacklist ${HOME}/.xmr-stak | 827 | blacklist ${HOME}/.xmr-stak |
800 | blacklist ${HOME}/.xonotic | 828 | blacklist ${HOME}/.xonotic |
829 | blacklist ${HOME}/.xournalpp | ||
801 | blacklist ${HOME}/.xpdfrc | 830 | blacklist ${HOME}/.xpdfrc |
802 | blacklist ${HOME}/.zoom | 831 | blacklist ${HOME}/.zoom |
803 | blacklist /tmp/akonadi-* | 832 | blacklist /tmp/akonadi-* |
@@ -815,6 +844,7 @@ blacklist ${HOME}/.cache/8pecxstudios | |||
815 | blacklist ${HOME}/.cache/Authenticator | 844 | blacklist ${HOME}/.cache/Authenticator |
816 | blacklist ${HOME}/.cache/BraveSoftware | 845 | blacklist ${HOME}/.cache/BraveSoftware |
817 | blacklist ${HOME}/.cache/Clementine | 846 | blacklist ${HOME}/.cache/Clementine |
847 | blacklist ${HOME}/.cache/ENCOM/Spectral | ||
818 | blacklist ${HOME}/.cache/Enox | 848 | blacklist ${HOME}/.cache/Enox |
819 | blacklist ${HOME}/.cache/Enpass | 849 | blacklist ${HOME}/.cache/Enpass |
820 | blacklist ${HOME}/.cache/Ferdi | 850 | blacklist ${HOME}/.cache/Ferdi |
@@ -824,7 +854,9 @@ blacklist ${HOME}/.cache/INRIA | |||
824 | blacklist ${HOME}/.cache/MusicBrainz | 854 | blacklist ${HOME}/.cache/MusicBrainz |
825 | blacklist ${HOME}/.cache/NewsFlashGTK | 855 | blacklist ${HOME}/.cache/NewsFlashGTK |
826 | blacklist ${HOME}/.cache/Otter | 856 | blacklist ${HOME}/.cache/Otter |
857 | blacklist ${HOME}/.cache/Psi | ||
827 | blacklist ${HOME}/.cache/QuiteRss | 858 | blacklist ${HOME}/.cache/QuiteRss |
859 | blacklist ${HOME}/.cache/Quotient/quaternion | ||
828 | blacklist ${HOME}/.cache/Shortwave | 860 | blacklist ${HOME}/.cache/Shortwave |
829 | blacklist ${HOME}/.cache/Tox | 861 | blacklist ${HOME}/.cache/Tox |
830 | blacklist ${HOME}/.cache/Zeal | 862 | blacklist ${HOME}/.cache/Zeal |
@@ -852,10 +884,13 @@ blacklist ${HOME}/.cache/epiphany | |||
852 | blacklist ${HOME}/.cache/evolution | 884 | blacklist ${HOME}/.cache/evolution |
853 | blacklist ${HOME}/.cache/falkon | 885 | blacklist ${HOME}/.cache/falkon |
854 | blacklist ${HOME}/.cache/feedreader | 886 | blacklist ${HOME}/.cache/feedreader |
887 | blacklist ${HOME}/.cache/flaska.net/trojita | ||
855 | blacklist ${HOME}/.cache/font-manager | 888 | blacklist ${HOME}/.cache/font-manager |
856 | blacklist ${HOME}/.cache/fossamail | 889 | blacklist ${HOME}/.cache/fossamail |
890 | blacklist ${HOME}/.cache/fractal | ||
857 | blacklist ${HOME}/.cache/freecol | 891 | blacklist ${HOME}/.cache/freecol |
858 | blacklist ${HOME}/.cache/gajim | 892 | blacklist ${HOME}/.cache/gajim |
893 | blacklist ${HOME}/.cache/geary | ||
859 | blacklist ${HOME}/.cache/gegl-0.4 | 894 | blacklist ${HOME}/.cache/gegl-0.4 |
860 | blacklist ${HOME}/.cache/geeqie | 895 | blacklist ${HOME}/.cache/geeqie |
861 | blacklist ${HOME}/.cache/gfeeds | 896 | blacklist ${HOME}/.cache/gfeeds |
@@ -889,12 +924,14 @@ blacklist ${HOME}/.cache/krunnerbookmarkrunnerfirefoxdbfile.sqlite* | |||
889 | blacklist ${HOME}/.cache/kscreenlocker_greet | 924 | blacklist ${HOME}/.cache/kscreenlocker_greet |
890 | blacklist ${HOME}/.cache/ksmserver-logout-greeter | 925 | blacklist ${HOME}/.cache/ksmserver-logout-greeter |
891 | blacklist ${HOME}/.cache/ksplashqml | 926 | blacklist ${HOME}/.cache/ksplashqml |
927 | blacklist ${HOME}/.cache/kube | ||
892 | blacklist ${HOME}/.cache/kwin | 928 | blacklist ${HOME}/.cache/kwin |
893 | blacklist ${HOME}/.cache/libgweather | 929 | blacklist ${HOME}/.cache/libgweather |
894 | blacklist ${HOME}/.cache/liferea | 930 | blacklist ${HOME}/.cache/liferea |
895 | blacklist ${HOME}/.cache/Mendeley Ltd. | 931 | blacklist ${HOME}/.cache/Mendeley Ltd. |
896 | blacklist ${HOME}/.cache/midori | 932 | blacklist ${HOME}/.cache/midori |
897 | blacklist ${HOME}/.cache/minetest | 933 | blacklist ${HOME}/.cache/minetest |
934 | blacklist ${HOME}/.cache/mirage | ||
898 | blacklist ${HOME}/.cache/moonchild productions/basilisk | 935 | blacklist ${HOME}/.cache/moonchild productions/basilisk |
899 | blacklist ${HOME}/.cache/moonchild productions/pale moon | 936 | blacklist ${HOME}/.cache/moonchild productions/pale moon |
900 | blacklist ${HOME}/.cache/mozilla | 937 | blacklist ${HOME}/.cache/mozilla |
@@ -920,12 +957,14 @@ blacklist ${HOME}/.cache/peek | |||
920 | blacklist ${HOME}/.cache/pip | 957 | blacklist ${HOME}/.cache/pip |
921 | blacklist ${HOME}/.cache/plasmashell | 958 | blacklist ${HOME}/.cache/plasmashell |
922 | blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite* | 959 | blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite* |
960 | blacklist ${HOME}/.cache/psi | ||
923 | blacklist ${HOME}/.cache/qBittorrent | 961 | blacklist ${HOME}/.cache/qBittorrent |
924 | blacklist ${HOME}/.cache/qupzilla | 962 | blacklist ${HOME}/.cache/qupzilla |
925 | blacklist ${HOME}/.cache/qutebrowser | 963 | blacklist ${HOME}/.cache/qutebrowser |
926 | blacklist ${HOME}/.cache/rhythmbox | 964 | blacklist ${HOME}/.cache/rhythmbox |
927 | blacklist ${HOME}/.cache/simple-scan | 965 | blacklist ${HOME}/.cache/simple-scan |
928 | blacklist ${HOME}/.cache/slimjet | 966 | blacklist ${HOME}/.cache/slimjet |
967 | blacklist ${HOME}/.cache/smuxi | ||
929 | blacklist ${HOME}/.cache/snox | 968 | blacklist ${HOME}/.cache/snox |
930 | blacklist ${HOME}/.cache/spotify | 969 | blacklist ${HOME}/.cache/spotify |
931 | blacklist ${HOME}/.cache/strawberry | 970 | blacklist ${HOME}/.cache/strawberry |
diff --git a/etc/inc/disable-write-mnt.inc b/etc/inc/disable-write-mnt.inc new file mode 100644 index 000000000..3990cf760 --- /dev/null +++ b/etc/inc/disable-write-mnt.inc | |||
@@ -0,0 +1,8 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include disable-write-mnt.local | ||
4 | |||
5 | read-only /mnt | ||
6 | read-only /media | ||
7 | read-only /run/mount | ||
8 | read-only /run/media | ||
diff --git a/etc/inc/whitelist-players.inc b/etc/inc/whitelist-players.inc new file mode 100644 index 000000000..0e473768b --- /dev/null +++ b/etc/inc/whitelist-players.inc | |||
@@ -0,0 +1,10 @@ | |||
1 | # Local customizations come here | ||
2 | include whitelist-players.local | ||
3 | |||
4 | # common whitelist for all media players | ||
5 | |||
6 | whitelist ${DESKTOP} | ||
7 | whitelist ${DOWNLOADS} | ||
8 | whitelist ${MUSIC} | ||
9 | whitelist ${PICTURES} | ||
10 | whitelist ${VIDEOS} | ||
diff --git a/etc/profile-a-l/balsa.profile b/etc/profile-a-l/balsa.profile new file mode 100644 index 000000000..a401ac592 --- /dev/null +++ b/etc/profile-a-l/balsa.profile | |||
@@ -0,0 +1,78 @@ | |||
1 | # Firejail profile for balsa | ||
2 | # Description: GNOME mail client | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include balsa.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.balsa | ||
10 | noblacklist ${HOME}/.gnupg | ||
11 | noblacklist ${HOME}/.mozilla | ||
12 | noblacklist ${HOME}/mail | ||
13 | noblacklist /var/mail | ||
14 | noblacklist /var/spool/mail | ||
15 | |||
16 | include disable-common.inc | ||
17 | include disable-devel.inc | ||
18 | include disable-exec.inc | ||
19 | include disable-interpreters.inc | ||
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | ||
22 | include disable-shell.inc | ||
23 | include disable-xdg.inc | ||
24 | |||
25 | mkdir ${HOME}/.balsa | ||
26 | mkdir ${HOME}/.gnupg | ||
27 | mkdir ${HOME}/mail | ||
28 | whitelist ${HOME}/.balsa | ||
29 | whitelist ${HOME}/.gnupg | ||
30 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | ||
31 | whitelist ${HOME}/mail | ||
32 | whitelist ${RUNUSER}/gnupg | ||
33 | whitelist /usr/share/balsa | ||
34 | whitelist /usr/share/gnupg | ||
35 | whitelist /usr/share/gnupg2 | ||
36 | whitelist /var/mail | ||
37 | whitelist /var/spool/mail | ||
38 | include whitelist-common.inc | ||
39 | include whitelist-runuser-common.inc | ||
40 | include whitelist-usr-share-common.inc | ||
41 | include whitelist-var-common.inc | ||
42 | |||
43 | apparmor | ||
44 | caps.drop all | ||
45 | netfilter | ||
46 | no3d | ||
47 | nodvd | ||
48 | nogroups | ||
49 | nonewprivs | ||
50 | noroot | ||
51 | nosound | ||
52 | notv | ||
53 | nou2f | ||
54 | novideo | ||
55 | protocol unix,inet,inet6 | ||
56 | seccomp | ||
57 | shell none | ||
58 | tracelog | ||
59 | |||
60 | # disable-mnt | ||
61 | # Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg | ||
62 | # Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile. | ||
63 | private-bin balsa,balsa-ab | ||
64 | private-cache | ||
65 | private-dev | ||
66 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,mailname,passwd,pki,resolv.conf,selinux,ssl,xdg | ||
67 | private-tmp | ||
68 | writable-run-user | ||
69 | writable-var | ||
70 | |||
71 | dbus-user filter | ||
72 | dbus-user.own org.desktop.Balsa | ||
73 | dbus-user.talk ca.desrt.dconf | ||
74 | dbus-user.talk org.freedesktop.secrets | ||
75 | dbus-user.talk org.freedesktop.Notifications | ||
76 | dbus-system none | ||
77 | |||
78 | read-only ${HOME}/.mozilla/firefox/profiles.ini | ||
diff --git a/etc/profile-a-l/celluloid.profile b/etc/profile-a-l/celluloid.profile index 54d3f742f..888367899 100644 --- a/etc/profile-a-l/celluloid.profile +++ b/etc/profile-a-l/celluloid.profile | |||
@@ -28,12 +28,8 @@ mkdir ${HOME}/.config/youtube-dl | |||
28 | whitelist ${HOME}/.config/celluloid | 28 | whitelist ${HOME}/.config/celluloid |
29 | whitelist ${HOME}/.config/gnome-mpv | 29 | whitelist ${HOME}/.config/gnome-mpv |
30 | whitelist ${HOME}/.config/youtube-dl | 30 | whitelist ${HOME}/.config/youtube-dl |
31 | whitelist ${DESKTOP} | ||
32 | whitelist ${DOWNLOADS} | ||
33 | whitelist ${MUSIC} | ||
34 | whitelist ${PICTURES} | ||
35 | whitelist ${VIDEOS} | ||
36 | include whitelist-common.inc | 31 | include whitelist-common.inc |
32 | include whitelist-players.inc | ||
37 | include whitelist-runuser-common.inc | 33 | include whitelist-runuser-common.inc |
38 | include whitelist-usr-share-common.inc | 34 | include whitelist-usr-share-common.inc |
39 | include whitelist-var-common.inc | 35 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/chromium-freeworld.profile b/etc/profile-a-l/chromium-freeworld.profile new file mode 100644 index 000000000..a1de85afa --- /dev/null +++ b/etc/profile-a-l/chromium-freeworld.profile | |||
@@ -0,0 +1,5 @@ | |||
1 | # Firejail profile for chromium-freeworld | ||
2 | # This file is overwritten after every install/update | ||
3 | |||
4 | # Redirect | ||
5 | include chromium.profile | ||
diff --git a/etc/profile-a-l/cola.profile b/etc/profile-a-l/cola.profile new file mode 100644 index 000000000..e5debfd82 --- /dev/null +++ b/etc/profile-a-l/cola.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile for cola | ||
2 | # Description: Linux native frontend for Git,alternative call for git-cola | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include cola.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Redirect | ||
10 | include git-cola.profile \ No newline at end of file | ||
diff --git a/etc/profile-a-l/dbus-send.profile b/etc/profile-a-l/dbus-send.profile new file mode 100644 index 000000000..76a14d99b --- /dev/null +++ b/etc/profile-a-l/dbus-send.profile | |||
@@ -0,0 +1,59 @@ | |||
1 | # Firejail profile for dbus-send | ||
2 | # Description: Send a message to a message bus | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include dbus-send.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist /tmp/.X11-unix | ||
11 | blacklist ${RUNUSER}/wayland-* | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-write-mnt.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | include whitelist-common.inc | ||
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
26 | include whitelist-var-common.inc | ||
27 | |||
28 | apparmor | ||
29 | caps.drop all | ||
30 | ipc-namespace | ||
31 | machine-id | ||
32 | # Breaks abstract sockets | ||
33 | #net none | ||
34 | netfilter | ||
35 | no3d | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | nosound | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix | ||
45 | seccomp | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | disable-mnt | ||
50 | private | ||
51 | private-bin dbus-send | ||
52 | private-cache | ||
53 | private-dev | ||
54 | private-etc alternatives,dbus-1 | ||
55 | private-lib libpcre2-8.so.0 | ||
56 | private-tmp | ||
57 | |||
58 | memory-deny-write-execute | ||
59 | read-only ${HOME} | ||
diff --git a/etc/profile-a-l/default.profile b/etc/profile-a-l/default.profile index 74314cf92..7eb7660dd 100644 --- a/etc/profile-a-l/default.profile +++ b/etc/profile-a-l/default.profile | |||
@@ -14,6 +14,7 @@ include disable-common.inc | |||
14 | # include disable-interpreters.inc | 14 | # include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | # include disable-write-mnt.inc | ||
17 | # include disable-xdg.inc | 18 | # include disable-xdg.inc |
18 | 19 | ||
19 | # include whitelist-common.inc | 20 | # include whitelist-common.inc |
diff --git a/etc/profile-a-l/electron-mail.profile b/etc/profile-a-l/electron-mail.profile index 39366470f..5957d4316 100644 --- a/etc/profile-a-l/electron-mail.profile +++ b/etc/profile-a-l/electron-mail.profile | |||
@@ -8,8 +8,6 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.config/electron-mail | 9 | noblacklist ${HOME}/.config/electron-mail |
10 | 10 | ||
11 | whitelist ${DOWNLOADS} | ||
12 | |||
13 | include disable-common.inc | 11 | include disable-common.inc |
14 | include disable-devel.inc | 12 | include disable-devel.inc |
15 | include disable-exec.inc | 13 | include disable-exec.inc |
@@ -21,8 +19,10 @@ include disable-xdg.inc | |||
21 | 19 | ||
22 | mkdir ${HOME}/.config/electron-mail | 20 | mkdir ${HOME}/.config/electron-mail |
23 | whitelist ${HOME}/.config/electron-mail | 21 | whitelist ${HOME}/.config/electron-mail |
22 | whitelist ${DOWNLOADS} | ||
24 | 23 | ||
25 | include whitelist-common.inc | 24 | include whitelist-common.inc |
25 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
28 | 28 | ||
@@ -45,12 +45,12 @@ shell none | |||
45 | private-bin electron-mail | 45 | private-bin electron-mail |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alternatives,fonts | 48 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,nsswitch.conf,pki,resolv.conf,selinux,ssl,xdg |
49 | private-opt ElectronMail | 49 | private-opt ElectronMail |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | # breaks tray functionality | 52 | # breaks tray functionality |
53 | # dbus-user none | 53 | # dbus-user none |
54 | # dbus-system none | 54 | dbus-system none |
55 | 55 | ||
56 | # memory-deny-write-execute - breaks on Arch | 56 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/profile-a-l/eo-common.profile b/etc/profile-a-l/eo-common.profile index 80c704c6b..e8b49a395 100644 --- a/etc/profile-a-l/eo-common.profile +++ b/etc/profile-a-l/eo-common.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-write-mnt.inc | ||
20 | 21 | ||
21 | include whitelist-runuser-common.inc | 22 | include whitelist-runuser-common.inc |
22 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-a-l/eog.profile b/etc/profile-a-l/eog.profile index 0d0153fc2..aabef65fc 100644 --- a/etc/profile-a-l/eog.profile +++ b/etc/profile-a-l/eog.profile | |||
@@ -15,9 +15,12 @@ whitelist /usr/share/eog | |||
15 | # or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eog.local | 15 | # or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eog.local |
16 | private-bin eog | 16 | private-bin eog |
17 | 17 | ||
18 | dbus-user filter | 18 | |
19 | dbus-user.own org.gnome.eog | 19 | # broken on Debian 10 (buster) running LXDE got the folowing error: |
20 | dbus-user.talk ca.desrt.dconf | 20 | # Failed to register: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: org.freedesktop.DBus.Error.ServiceUnknown |
21 | #dbus-user filter | ||
22 | #dbus-user.own org.gnome.eog | ||
23 | #dbus-user.talk ca.desrt.dconf | ||
21 | dbus-system none | 24 | dbus-system none |
22 | 25 | ||
23 | # Redirect | 26 | # Redirect |
diff --git a/etc/profile-a-l/equalx.profile b/etc/profile-a-l/equalx.profile new file mode 100644 index 000000000..58b053041 --- /dev/null +++ b/etc/profile-a-l/equalx.profile | |||
@@ -0,0 +1,63 @@ | |||
1 | # Firejail profile for equalx | ||
2 | # Description: A graphical editor for writing LaTeX equations | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include equalx.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/equalx | ||
10 | noblacklist ${HOME}/.equalx | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | mkdir ${HOME}/.config/equalx | ||
22 | mkdir ${HOME}/.equalx | ||
23 | whitelist ${HOME}/.config/equalx | ||
24 | whitelist ${HOME}/.equalx | ||
25 | whitelist /usr/share/poppler | ||
26 | whitelist /usr/share/ghostscript | ||
27 | whitelist /usr/share/texlive | ||
28 | whitelist /usr/share/equalx | ||
29 | whitelist /var/lib/texmf | ||
30 | include whitelist-common.inc | ||
31 | include whitelist-runuser-common.inc | ||
32 | include whitelist-usr-share-common.inc | ||
33 | include whitelist-var-common.inc | ||
34 | |||
35 | apparmor | ||
36 | caps.drop all | ||
37 | machine-id | ||
38 | net none | ||
39 | no3d | ||
40 | nodvd | ||
41 | nogroups | ||
42 | nonewprivs | ||
43 | noroot | ||
44 | nosound | ||
45 | notv | ||
46 | nou2f | ||
47 | novideo | ||
48 | protocol unix | ||
49 | seccomp | ||
50 | shell none | ||
51 | tracelog | ||
52 | |||
53 | disable-mnt | ||
54 | private-bin equalx,gs,pdflatex,pdftocairo | ||
55 | private-cache | ||
56 | private-dev | ||
57 | private-etc equalx,equalx.conf,fonts,gtk-2.0,latexmk.conf,machine-id,papersize,passwd,texlive,Trolltech.conf | ||
58 | private-tmp | ||
59 | |||
60 | dbus-user none | ||
61 | dbus-system none | ||
62 | |||
63 | memory-deny-write-execute | ||
diff --git a/etc/profile-a-l/fdns.profile b/etc/profile-a-l/fdns.profile index 179540806..31cb1776c 100644 --- a/etc/profile-a-l/fdns.profile +++ b/etc/profile-a-l/fdns.profile | |||
@@ -29,20 +29,20 @@ no3d | |||
29 | nodvd | 29 | nodvd |
30 | nogroups | 30 | nogroups |
31 | nonewprivs | 31 | nonewprivs |
32 | # noroot | 32 | noroot |
33 | nosound | 33 | nosound |
34 | notv | 34 | notv |
35 | nou2f | 35 | nou2f |
36 | novideo | 36 | novideo |
37 | protocol unix,inet,inet6 | 37 | protocol unix,inet,inet6,netlink |
38 | #seccomp | 38 | #seccomp |
39 | #shell none | 39 | #shell none |
40 | 40 | ||
41 | disable-mnt | 41 | disable-mnt |
42 | private | 42 | private |
43 | private-bin bash,fdns,sh | 43 | private-bin bash,fdns,sh |
44 | # private-cache | 44 | private-cache |
45 | private-dev | 45 | #private-dev |
46 | private-etc ca-certificates,crypto-policies,fdns,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pki,ssl | 46 | private-etc ca-certificates,crypto-policies,fdns,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pki,ssl |
47 | # private-lib | 47 | # private-lib |
48 | private-tmp | 48 | private-tmp |
diff --git a/etc/profile-a-l/firefox.profile b/etc/profile-a-l/firefox.profile index 337311ed8..ce2013c57 100644 --- a/etc/profile-a-l/firefox.profile +++ b/etc/profile-a-l/firefox.profile | |||
@@ -24,7 +24,7 @@ include whitelist-usr-share-common.inc | |||
24 | # firefox requires a shell to launch on Arch. | 24 | # firefox requires a shell to launch on Arch. |
25 | #private-bin bash,dbus-launch,dbus-send,env,firefox,sh,which | 25 | #private-bin bash,dbus-launch,dbus-send,env,firefox,sh,which |
26 | # Fedora use shell scripts to launch firefox, at least this is required | 26 | # Fedora use shell scripts to launch firefox, at least this is required |
27 | #private-bin basename,bash,cat,dirname,expr,false,firefox,firefox-wayland,ln,mkdir,pidof,rm,rmdir,sed,sh,tclsh,true,uname | 27 | #private-bin basename,bash,cat,dirname,expr,false,firefox,firefox-wayland,getenforce,ln,mkdir,pidof,restorecon,rm,rmdir,sed,sh,tclsh,true,uname |
28 | # private-etc must first be enabled in firefox-common.profile | 28 | # private-etc must first be enabled in firefox-common.profile |
29 | #private-etc firefox | 29 | #private-etc firefox |
30 | 30 | ||
diff --git a/etc/profile-a-l/flameshot.profile b/etc/profile-a-l/flameshot.profile index 7c41417ec..357354e70 100644 --- a/etc/profile-a-l/flameshot.profile +++ b/etc/profile-a-l/flameshot.profile | |||
@@ -9,6 +9,7 @@ include globals.local | |||
9 | 9 | ||
10 | noblacklist ${PICTURES} | 10 | noblacklist ${PICTURES} |
11 | noblacklist ${HOME}/.config/Dharkael | 11 | noblacklist ${HOME}/.config/Dharkael |
12 | noblacklist ${HOME}/.config/flameshot | ||
12 | 13 | ||
13 | include disable-common.inc | 14 | include disable-common.inc |
14 | include disable-devel.inc | 15 | include disable-devel.inc |
@@ -19,8 +20,11 @@ include disable-programs.inc | |||
19 | include disable-shell.inc | 20 | include disable-shell.inc |
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
23 | #mkdir ${HOME}/.config/Dharkael | ||
24 | #mkdir ${HOME}/.config/flameshot | ||
22 | #whitelist ${PICTURES} | 25 | #whitelist ${PICTURES} |
23 | #whitelist ${HOME}/.config/Dharkael | 26 | #whitelist ${HOME}/.config/Dharkael |
27 | #whitelist ${HOME}/.config/flameshot | ||
24 | whitelist /usr/share/flameshot | 28 | whitelist /usr/share/flameshot |
25 | #include whitelist-common.inc | 29 | #include whitelist-common.inc |
26 | include whitelist-runuser-common.inc | 30 | include whitelist-runuser-common.inc |
@@ -53,4 +57,5 @@ private-tmp | |||
53 | 57 | ||
54 | dbus-user filter | 58 | dbus-user filter |
55 | dbus-user.own org.dharkael.Flameshot | 59 | dbus-user.own org.dharkael.Flameshot |
60 | dbus-user.own org.flameshot.Flameshot | ||
56 | dbus-system none | 61 | dbus-system none |
diff --git a/etc/profile-a-l/fractal.profile b/etc/profile-a-l/fractal.profile new file mode 100644 index 000000000..ab907eb0d --- /dev/null +++ b/etc/profile-a-l/fractal.profile | |||
@@ -0,0 +1,54 @@ | |||
1 | # Firejail profile for fractal | ||
2 | # Description: Desktop client for Matrix | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include fractal.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/fractal | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.cache/fractal | ||
21 | whitelist ${HOME}/.cache/fractal | ||
22 | whitelist ${DOWNLOADS} | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
26 | include whitelist-var-common.inc | ||
27 | |||
28 | apparmor | ||
29 | caps.drop all | ||
30 | netfilter | ||
31 | nodvd | ||
32 | nogroups | ||
33 | nonewprivs | ||
34 | noroot | ||
35 | notv | ||
36 | nou2f | ||
37 | protocol unix,inet,inet6 | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin fractal | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
47 | private-tmp | ||
48 | |||
49 | dbus-user filter | ||
50 | dbus-user.own org.gnome.Fractal | ||
51 | dbus-user.talk ca.desrt.dconf | ||
52 | dbus-user.talk org.freedesktop.secrets | ||
53 | dbus-user.talk org.freedesktop.Notifications | ||
54 | dbus-system none | ||
diff --git a/etc/profile-a-l/geary.profile b/etc/profile-a-l/geary.profile index fa01d04b7..118ed62ca 100644 --- a/etc/profile-a-l/geary.profile +++ b/etc/profile-a-l/geary.profile | |||
@@ -10,24 +10,24 @@ include geary.local | |||
10 | # Users have Geary set to open a browser by clicking a link in an email | 10 | # Users have Geary set to open a browser by clicking a link in an email |
11 | # We are not allowed to blacklist browser-specific directories | 11 | # We are not allowed to blacklist browser-specific directories |
12 | 12 | ||
13 | ignore dbus-user none | 13 | ignore dbus-user filter |
14 | ignore dbus-system none | 14 | ignore dbus-system none |
15 | ignore private-tmp | 15 | ignore private-tmp |
16 | 16 | ||
17 | noblacklist ${HOME}/.gnupg | 17 | noblacklist ${HOME}/.cache/geary |
18 | noblacklist ${HOME}/.config/geary | ||
18 | noblacklist ${HOME}/.local/share/geary | 19 | noblacklist ${HOME}/.local/share/geary |
19 | 20 | ||
20 | mkdir ${HOME}/.gnupg | 21 | mkdir ${HOME}/.cache/geary |
21 | mkdir ${HOME}/.config/geary | 22 | mkdir ${HOME}/.config/geary |
22 | mkdir ${HOME}/.local/share/geary | 23 | mkdir ${HOME}/.local/share/geary |
23 | whitelist ${HOME}/.gnupg | 24 | whitelist ${HOME}/.cache/geary |
24 | whitelist ${HOME}/.config/geary | 25 | whitelist ${HOME}/.config/geary |
25 | whitelist ${HOME}/.local/share/geary | 26 | whitelist ${HOME}/.local/share/geary |
27 | whitelist /usr/share/geary | ||
26 | 28 | ||
27 | read-only ${HOME}/.config/mimeapps.list | 29 | read-only ${HOME}/.config/mimeapps.list |
28 | 30 | ||
29 | whitelist /usr/share/geary | ||
30 | |||
31 | # allow Mozilla browsers | 31 | # allow Mozilla browsers |
32 | # Redirect | 32 | # Redirect |
33 | include firefox.profile | 33 | include firefox.profile |
diff --git a/etc/profile-a-l/git-cola.profile b/etc/profile-a-l/git-cola.profile index 30e80f519..4708078dd 100644 --- a/etc/profile-a-l/git-cola.profile +++ b/etc/profile-a-l/git-cola.profile | |||
@@ -12,6 +12,7 @@ noblacklist ${HOME}/.gitconfig | |||
12 | noblacklist ${HOME}/.git-credentials | 12 | noblacklist ${HOME}/.git-credentials |
13 | noblacklist ${HOME}/.gnupg | 13 | noblacklist ${HOME}/.gnupg |
14 | noblacklist ${HOME}/.ssh | 14 | noblacklist ${HOME}/.ssh |
15 | noblacklist ${HOME}/.subversion | ||
15 | noblacklist ${HOME}/.config/git | 16 | noblacklist ${HOME}/.config/git |
16 | noblacklist ${HOME}/.config/git-cola | 17 | noblacklist ${HOME}/.config/git-cola |
17 | # Put your editor,diff viewer config path below and uncomment to load settings | 18 | # Put your editor,diff viewer config path below and uncomment to load settings |
@@ -28,7 +29,19 @@ include disable-passwdmgr.inc | |||
28 | include disable-programs.inc | 29 | include disable-programs.inc |
29 | include disable-xdg.inc | 30 | include disable-xdg.inc |
30 | 31 | ||
32 | whitelist ${RUNUSER}/gnupg | ||
33 | whitelist ${RUNUSER}/keyring | ||
34 | # Whitelist your editor, diff viewer, gnupg path below in /usr/share/ | ||
35 | whitelist /usr/share/git | ||
36 | whitelist /usr/share/git-cola | ||
37 | whitelist /usr/share/git-core | ||
38 | whitelist /usr/share/git-gui | ||
39 | whitelist /usr/share/gitk | ||
40 | whitelist /usr/share/gitweb | ||
41 | whitelist /usr/share/gnupg | ||
42 | whitelist /usr/share/gnupg2 | ||
31 | include whitelist-runuser-common.inc | 43 | include whitelist-runuser-common.inc |
44 | include whitelist-usr-share-common.inc | ||
32 | include whitelist-var-common.inc | 45 | include whitelist-var-common.inc |
33 | 46 | ||
34 | apparmor | 47 | apparmor |
@@ -49,18 +62,22 @@ seccomp | |||
49 | shell none | 62 | shell none |
50 | tracelog | 63 | tracelog |
51 | 64 | ||
52 | # private-bin atom,bash,colordiff,emacs,fldiff,geany,gedit,git,git gui,git-cola,git-dag,gitk,gpg,gvim,leafpad,meld,mousepad,nano,notepadqq,python*,sh,ssh,vim,vimdiff,which,xed | 65 | # Add your own diff viewer,editor,pinentry program |
66 | # pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg | ||
67 | private-bin basename,bash,cola,envsubst,gettext,git,git-cola,git-dag,git-gui,gitk,gpg,gpg-agent,nano,ps,python*,sh,ssh,ssh-agent,tclsh,tr,wc,which,xed | ||
53 | private-cache | 68 | private-cache |
54 | private-dev | 69 | private-dev |
55 | # Comment if you sign commits with GPG | 70 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gitconfig,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,localtime,login.defs,machine-id,mime.types,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssh,ssl,X11,xdg |
56 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,localtime,login.defs,machine-id,mime.types,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,X11,xdg | ||
57 | private-tmp | 71 | private-tmp |
72 | writable-run-user | ||
58 | 73 | ||
59 | dbus-user filter | 74 | # Breaks meld as diff viewer |
75 | # dbus-user filter | ||
60 | # Uncomment if you need keyring access | 76 | # Uncomment if you need keyring access |
61 | # dbus-user.talk org.freedesktop.secrets | 77 | # dbus-user.talk org.freedesktop.secrets |
62 | dbus-system none | 78 | dbus-system none |
63 | 79 | ||
64 | read-only ${HOME}/.ssh | ||
65 | read-only ${HOME}/.gnupg | ||
66 | read-only ${HOME}/.git-credentials | 80 | read-only ${HOME}/.git-credentials |
81 | |||
82 | # Comment if you need to allow hosts | ||
83 | read-only ${HOME}/.ssh | ||
diff --git a/etc/profile-a-l/gnome-builder.profile b/etc/profile-a-l/gnome-builder.profile index 7a684dd59..8f637902c 100644 --- a/etc/profile-a-l/gnome-builder.profile +++ b/etc/profile-a-l/gnome-builder.profile | |||
@@ -6,6 +6,8 @@ include gnome-builder.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.bash_history | ||
10 | |||
9 | noblacklist ${HOME}/.cache/gnome-builder | 11 | noblacklist ${HOME}/.cache/gnome-builder |
10 | noblacklist ${HOME}/.config/gnome-builder | 12 | noblacklist ${HOME}/.config/gnome-builder |
11 | noblacklist ${HOME}/.local/share/gnome-builder | 13 | noblacklist ${HOME}/.local/share/gnome-builder |
@@ -34,3 +36,5 @@ seccomp | |||
34 | shell none | 36 | shell none |
35 | 37 | ||
36 | private-dev | 38 | private-dev |
39 | |||
40 | read-write ${HOME}/.bash_history | ||
diff --git a/etc/profile-a-l/gnome-passwordsafe.profile b/etc/profile-a-l/gnome-passwordsafe.profile index 615be7873..ed430b654 100644 --- a/etc/profile-a-l/gnome-passwordsafe.profile +++ b/etc/profile-a-l/gnome-passwordsafe.profile | |||
@@ -52,3 +52,8 @@ private-cache | |||
52 | private-dev | 52 | private-dev |
53 | private-etc dconf,fonts,gtk-3.0,passwd | 53 | private-etc dconf,fonts,gtk-3.0,passwd |
54 | private-tmp | 54 | private-tmp |
55 | |||
56 | dbus-user filter | ||
57 | dbus-user.own org.gnome.PasswordSafe | ||
58 | dbus-user.talk ca.desrt.dconf | ||
59 | dbus-system none | ||
diff --git a/etc/profile-a-l/hedgewars.profile b/etc/profile-a-l/hedgewars.profile index 898a07a5f..8ac07d3da 100644 --- a/etc/profile-a-l/hedgewars.profile +++ b/etc/profile-a-l/hedgewars.profile | |||
@@ -8,6 +8,8 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.hedgewars | 9 | noblacklist ${HOME}/.hedgewars |
10 | 10 | ||
11 | include allow-lua.inc | ||
12 | |||
11 | include disable-common.inc | 13 | include disable-common.inc |
12 | include disable-devel.inc | 14 | include disable-devel.inc |
13 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
diff --git a/etc/profile-a-l/kazam.profile b/etc/profile-a-l/kazam.profile new file mode 100644 index 000000000..9899ff195 --- /dev/null +++ b/etc/profile-a-l/kazam.profile | |||
@@ -0,0 +1,54 @@ | |||
1 | # Firejail profile for kazam | ||
2 | # Description: Screen capture tool | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include kazam.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore noexec ${HOME} | ||
10 | |||
11 | noblacklist ${PICTURES} | ||
12 | noblacklist ${VIDEOS} | ||
13 | noblacklist ${HOME}/.config/kazam | ||
14 | |||
15 | include allow-python2.inc | ||
16 | include allow-python3.inc | ||
17 | |||
18 | include disable-common.inc | ||
19 | include disable-devel.inc | ||
20 | include disable-exec.inc | ||
21 | include disable-interpreters.inc | ||
22 | include disable-programs.inc | ||
23 | include disable-passwdmgr.inc | ||
24 | include disable-shell.inc | ||
25 | include disable-xdg.inc | ||
26 | |||
27 | whitelist /usr/share/kazam | ||
28 | include whitelist-runuser-common.inc | ||
29 | include whitelist-usr-share-common.inc | ||
30 | include whitelist-var-common.inc | ||
31 | |||
32 | apparmor | ||
33 | caps.drop all | ||
34 | net none | ||
35 | nodvd | ||
36 | nogroups | ||
37 | nonewprivs | ||
38 | noroot | ||
39 | notv | ||
40 | nou2f | ||
41 | novideo | ||
42 | protocol unix | ||
43 | seccomp | ||
44 | shell none | ||
45 | tracelog | ||
46 | |||
47 | disable-mnt | ||
48 | # private-bin kazam,python* | ||
49 | private-cache | ||
50 | private-dev | ||
51 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,machine-id,pulse,selinux,X11,xdg | ||
52 | private-tmp | ||
53 | |||
54 | dbus-system none | ||
diff --git a/etc/profile-a-l/kube.profile b/etc/profile-a-l/kube.profile new file mode 100644 index 000000000..cf3a69fd7 --- /dev/null +++ b/etc/profile-a-l/kube.profile | |||
@@ -0,0 +1,81 @@ | |||
1 | # Firejail profile for kube | ||
2 | # Description: Qt mail client | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include kube.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.gnupg | ||
10 | noblacklist ${HOME}/.mozilla | ||
11 | noblacklist ${HOME}/.cache/kube | ||
12 | noblacklist ${HOME}/.config/kube | ||
13 | noblacklist ${HOME}/.config/sink | ||
14 | noblacklist ${HOME}/.local/share/kube | ||
15 | noblacklist ${HOME}/.local/share/sink | ||
16 | |||
17 | include disable-common.inc | ||
18 | include disable-devel.inc | ||
19 | include disable-exec.inc | ||
20 | include disable-interpreters.inc | ||
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | ||
23 | include disable-shell.inc | ||
24 | include disable-xdg.inc | ||
25 | |||
26 | mkdir ${HOME}/.gnupg | ||
27 | mkdir ${HOME}/.cache/kube | ||
28 | mkdir ${HOME}/.config/kube | ||
29 | mkdir ${HOME}/.config/sink | ||
30 | mkdir ${HOME}/.local/share/kube | ||
31 | mkdir ${HOME}/.local/share/sink | ||
32 | whitelist ${HOME}/.gnupg | ||
33 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | ||
34 | whitelist ${HOME}/.cache/kube | ||
35 | whitelist ${HOME}/.config/kube | ||
36 | whitelist ${HOME}/.config/sink | ||
37 | whitelist ${HOME}/.local/share/kube | ||
38 | whitelist ${HOME}/.local/share/sink | ||
39 | whitelist ${RUNUSER}/gnupg | ||
40 | whitelist /usr/share/kube | ||
41 | whitelist /usr/share/gnupg | ||
42 | whitelist /usr/share/gnupg2 | ||
43 | include whitelist-common.inc | ||
44 | include whitelist-runuser-common.inc | ||
45 | include whitelist-usr-share-common.inc | ||
46 | include whitelist-var-common.inc | ||
47 | |||
48 | apparmor | ||
49 | caps.drop all | ||
50 | netfilter | ||
51 | no3d | ||
52 | nodvd | ||
53 | nogroups | ||
54 | nonewprivs | ||
55 | noroot | ||
56 | nosound | ||
57 | notv | ||
58 | nou2f | ||
59 | novideo | ||
60 | protocol unix,inet,inet6 | ||
61 | seccomp | ||
62 | shell none | ||
63 | tracelog | ||
64 | |||
65 | # disable-mnt | ||
66 | # Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg | ||
67 | # Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile. | ||
68 | private-bin kube,sink_synchronizer | ||
69 | private-cache | ||
70 | private-dev | ||
71 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gcrypt,gtk-2.0,gtk-3.0,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg | ||
72 | private-tmp | ||
73 | writable-run-user | ||
74 | |||
75 | dbus-user filter | ||
76 | dbus-user.talk ca.desrt.dconf | ||
77 | dbus-user.talk org.freedesktop.secrets | ||
78 | dbus-user.talk org.freedesktop.Notifications | ||
79 | dbus-system none | ||
80 | |||
81 | read-only ${HOME}/.mozilla/firefox/profiles.ini | ||
diff --git a/etc/profile-m-z/man.profile b/etc/profile-m-z/man.profile new file mode 100644 index 000000000..6f74e6da3 --- /dev/null +++ b/etc/profile-m-z/man.profile | |||
@@ -0,0 +1,65 @@ | |||
1 | # Firejail profile for man | ||
2 | # Description: manpage viewer | ||
3 | quiet | ||
4 | # This file is overwritten after every install/update | ||
5 | # Persistent local customizations | ||
6 | include man.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist ${RUNUSER} | ||
11 | |||
12 | noblacklist ${HOME}/.local/share/man | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | mkdir ${HOME}/.local/share/man | ||
23 | whitelist ${HOME}/.local/share/man | ||
24 | whitelist ${HOME}/.manpath | ||
25 | whitelist /usr/share/groff | ||
26 | whitelist /usr/share/info | ||
27 | whitelist /usr/share/lintian | ||
28 | whitelist /usr/share/locale | ||
29 | whitelist /usr/share/man | ||
30 | whitelist /var/cache/man | ||
31 | include whitelist-common.inc | ||
32 | include whitelist-usr-share-common.inc | ||
33 | include whitelist-var-common.inc | ||
34 | |||
35 | apparmor | ||
36 | caps.drop all | ||
37 | ipc-namespace | ||
38 | machine-id | ||
39 | net none | ||
40 | no3d | ||
41 | nodvd | ||
42 | nogroups | ||
43 | nonewprivs | ||
44 | noroot | ||
45 | nosound | ||
46 | notv | ||
47 | novideo | ||
48 | nou2f | ||
49 | protocol unix | ||
50 | seccomp | ||
51 | shell none | ||
52 | tracelog | ||
53 | x11 none | ||
54 | |||
55 | disable-mnt | ||
56 | private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim | ||
57 | private-cache | ||
58 | private-dev | ||
59 | private-etc alternatives,fonts,locale,locale.alias,locale.conf,man_db.conf,manpath.config,selinux,sysless,xdg | ||
60 | private-tmp | ||
61 | |||
62 | dbus-user none | ||
63 | dbus-system none | ||
64 | |||
65 | memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/menulibre.profile b/etc/profile-m-z/menulibre.profile new file mode 100644 index 000000000..3468bc22d --- /dev/null +++ b/etc/profile-m-z/menulibre.profile | |||
@@ -0,0 +1,62 @@ | |||
1 | # Firejail profile for menulibre | ||
2 | # Description: Create desktop and menu launchers easily | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include menulibre.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | include allow-python2.inc | ||
10 | include allow-python3.inc | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | # Whitelist your system icon directory,varies by distro | ||
21 | whitelist /usr/share/app-info | ||
22 | whitelist /usr/share/desktop-directories | ||
23 | whitelist /usr/share/icons | ||
24 | whitelist /usr/share/menulibre | ||
25 | whitelist /var/lib/app-info/icons | ||
26 | whitelist /var/lib/flatpak/exports/share/applications | ||
27 | whitelist /var/lib/flatpak/exports/share/icons | ||
28 | include whitelist-runuser-common.inc | ||
29 | include whitelist-usr-share-common.inc | ||
30 | include whitelist-var-common.inc | ||
31 | |||
32 | apparmor | ||
33 | caps.drop all | ||
34 | machine-id | ||
35 | net none | ||
36 | nodvd | ||
37 | no3d | ||
38 | nogroups | ||
39 | nonewprivs | ||
40 | noroot | ||
41 | nosound | ||
42 | notv | ||
43 | nou2f | ||
44 | novideo | ||
45 | protocol unix | ||
46 | seccomp | ||
47 | shell none | ||
48 | tracelog | ||
49 | |||
50 | disable-mnt | ||
51 | private-cache | ||
52 | private-dev | ||
53 | private-etc alternatives,dconf,fonts,gtk-3.0,locale.alias,locale.conf,mime.types,nsswitch.conf,passwd,pki,selinux,X11,xdg | ||
54 | private-tmp | ||
55 | |||
56 | dbus-user none | ||
57 | dbus-system none | ||
58 | |||
59 | read-write ${HOME}/.config/menus | ||
60 | read-write ${HOME}/.gnome/apps | ||
61 | read-write ${HOME}/.local/share/applications | ||
62 | read-write ${HOME}/.local/share/flatpak/exports | ||
diff --git a/etc/profile-m-z/minitube.profile b/etc/profile-m-z/minitube.profile index 2c70978a9..39ecc7127 100644 --- a/etc/profile-m-z/minitube.profile +++ b/etc/profile-m-z/minitube.profile | |||
@@ -46,7 +46,7 @@ notv | |||
46 | nou2f | 46 | nou2f |
47 | novideo | 47 | novideo |
48 | protocol unix,inet,inet6,netlink | 48 | protocol unix,inet,inet6,netlink |
49 | seccomp | 49 | seccomp !kcmp |
50 | shell none | 50 | shell none |
51 | tracelog | 51 | tracelog |
52 | 52 | ||
diff --git a/etc/profile-m-z/mirage.profile b/etc/profile-m-z/mirage.profile new file mode 100644 index 000000000..4a5f12aec --- /dev/null +++ b/etc/profile-m-z/mirage.profile | |||
@@ -0,0 +1,59 @@ | |||
1 | # Firejail profile for mirage | ||
2 | # Description: Desktop client for Matrix | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include mirage.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/mirage | ||
10 | noblacklist ${HOME}/.config/mirage | ||
11 | noblacklist ${HOME}/.local/share/mirage | ||
12 | |||
13 | include allow-python2.inc | ||
14 | include allow-python3.inc | ||
15 | |||
16 | include disable-common.inc | ||
17 | include disable-devel.inc | ||
18 | include disable-exec.inc | ||
19 | include disable-interpreters.inc | ||
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | ||
22 | include disable-shell.inc | ||
23 | include disable-xdg.inc | ||
24 | |||
25 | mkdir ${HOME}/.cache/mirage | ||
26 | mkdir ${HOME}/.config/mirage | ||
27 | mkdir ${HOME}/.local/share/mirage | ||
28 | whitelist ${HOME}/.cache/mirage | ||
29 | whitelist ${HOME}/.config/mirage | ||
30 | whitelist ${HOME}/.local/share/mirage | ||
31 | whitelist ${DOWNLOADS} | ||
32 | include whitelist-common.inc | ||
33 | include whitelist-runuser-common.inc | ||
34 | include whitelist-usr-share-common.inc | ||
35 | include whitelist-var-common.inc | ||
36 | |||
37 | apparmor | ||
38 | caps.drop all | ||
39 | netfilter | ||
40 | nodvd | ||
41 | nogroups | ||
42 | nonewprivs | ||
43 | noroot | ||
44 | notv | ||
45 | nou2f | ||
46 | protocol unix,inet,inet6 | ||
47 | seccomp | ||
48 | shell none | ||
49 | tracelog | ||
50 | |||
51 | disable-mnt | ||
52 | private-bin mirage | ||
53 | private-cache | ||
54 | private-dev | ||
55 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
56 | private-tmp | ||
57 | |||
58 | dbus-user none | ||
59 | dbus-system none | ||
diff --git a/etc/profile-m-z/mplayer.profile b/etc/profile-m-z/mplayer.profile index f4f862cb9..31a6caa9a 100644 --- a/etc/profile-m-z/mplayer.profile +++ b/etc/profile-m-z/mplayer.profile | |||
@@ -18,12 +18,8 @@ include disable-programs.inc | |||
18 | read-only ${DESKTOP} | 18 | read-only ${DESKTOP} |
19 | mkdir ${HOME}/.mplayer | 19 | mkdir ${HOME}/.mplayer |
20 | whitelist ${HOME}/.mplayer | 20 | whitelist ${HOME}/.mplayer |
21 | whitelist ${DESKTOP} | ||
22 | whitelist ${DOWNLOADS} | ||
23 | whitelist ${MUSIC} | ||
24 | whitelist ${PICTURES} | ||
25 | whitelist ${VIDEOS} | ||
26 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-players.inc | ||
27 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
28 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
29 | 25 | ||
diff --git a/etc/profile-m-z/mpsyt.profile b/etc/profile-m-z/mpsyt.profile index e0c6ff1c8..addeeac44 100644 --- a/etc/profile-m-z/mpsyt.profile +++ b/etc/profile-m-z/mpsyt.profile | |||
@@ -40,10 +40,8 @@ whitelist ${HOME}/.config/youtube-dl | |||
40 | whitelist ${HOME}/.mplayer | 40 | whitelist ${HOME}/.mplayer |
41 | whitelist ${HOME}/.netrc | 41 | whitelist ${HOME}/.netrc |
42 | whitelist ${HOME}/mps | 42 | whitelist ${HOME}/mps |
43 | whitelist ${DOWNLOADS} | ||
44 | whitelist ${MUSIC} | ||
45 | whitelist ${VIDEOS} | ||
46 | include whitelist-common.inc | 43 | include whitelist-common.inc |
44 | include whitelist-players.inc | ||
47 | include whitelist-var-common.inc | 45 | include whitelist-var-common.inc |
48 | 46 | ||
49 | apparmor | 47 | apparmor |
diff --git a/etc/profile-m-z/mpv.profile b/etc/profile-m-z/mpv.profile index 5ca684eb5..389b64535 100644 --- a/etc/profile-m-z/mpv.profile +++ b/etc/profile-m-z/mpv.profile | |||
@@ -11,6 +11,19 @@ include globals.local | |||
11 | # edit ~/.config/mpv/foobar.conf: | 11 | # edit ~/.config/mpv/foobar.conf: |
12 | # screenshot-directory=~/Pictures | 12 | # screenshot-directory=~/Pictures |
13 | 13 | ||
14 | # Mpv has a powerfull lua-API, some off these lua-scripts interact | ||
15 | # with external resources which are blocked by firejail. In such cases | ||
16 | # you need to allow these resources by | ||
17 | # - adding additional binaries to private-bin | ||
18 | # - whitelisting additional paths | ||
19 | # - noblacklisting paths | ||
20 | # - weaking the dbus-policy | ||
21 | # - ... | ||
22 | # | ||
23 | # Often these scripts require a shell: | ||
24 | #noblacklist ${PATH}/sh | ||
25 | #private-bin sh | ||
26 | |||
14 | noblacklist ${HOME}/.config/mpv | 27 | noblacklist ${HOME}/.config/mpv |
15 | noblacklist ${HOME}/.config/youtube-dl | 28 | noblacklist ${HOME}/.config/youtube-dl |
16 | noblacklist ${HOME}/.netrc | 29 | noblacklist ${HOME}/.netrc |
@@ -36,12 +49,8 @@ mkfile ${HOME}/.netrc | |||
36 | whitelist ${HOME}/.config/mpv | 49 | whitelist ${HOME}/.config/mpv |
37 | whitelist ${HOME}/.config/youtube-dl | 50 | whitelist ${HOME}/.config/youtube-dl |
38 | whitelist ${HOME}/.netrc | 51 | whitelist ${HOME}/.netrc |
39 | whitelist ${DESKTOP} | ||
40 | whitelist ${DOWNLOADS} | ||
41 | whitelist ${MUSIC} | ||
42 | whitelist ${PICTURES} | ||
43 | whitelist ${VIDEOS} | ||
44 | include whitelist-common.inc | 52 | include whitelist-common.inc |
53 | include whitelist-players.inc | ||
45 | whitelist /usr/share/lua | 54 | whitelist /usr/share/lua |
46 | whitelist /usr/share/lua* | 55 | whitelist /usr/share/lua* |
47 | whitelist /usr/share/vulkan | 56 | whitelist /usr/share/vulkan |
@@ -61,7 +70,7 @@ seccomp | |||
61 | shell none | 70 | shell none |
62 | tracelog | 71 | tracelog |
63 | 72 | ||
64 | private-bin env,mpv,python*,youtube-dl | 73 | private-bin env,mpv,python*,waf,youtube-dl |
65 | # private-cache causes slow OSD, see #2838 | 74 | # private-cache causes slow OSD, see #2838 |
66 | #private-cache | 75 | #private-cache |
67 | private-dev | 76 | private-dev |
diff --git a/etc/profile-m-z/musictube.profile b/etc/profile-m-z/musictube.profile new file mode 100644 index 000000000..955df698d --- /dev/null +++ b/etc/profile-m-z/musictube.profile | |||
@@ -0,0 +1,57 @@ | |||
1 | # Firejail profile for musictube | ||
2 | # Description: Stream music | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include musictube.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/Flavio Tordini | ||
10 | noblacklist ${HOME}/.config/Flavio Tordini | ||
11 | noblacklist ${HOME}/.local/share/Flavio Tordini | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | mkdir ${HOME}/.cache/Flavio Tordini | ||
23 | mkdir ${HOME}/.config/Flavio Tordini | ||
24 | mkdir ${HOME}/.local/share/Flavio Tordini | ||
25 | whitelist ${HOME}/.cache/Flavio Tordini | ||
26 | whitelist ${HOME}/.config/Flavio Tordini | ||
27 | whitelist ${HOME}/.local/share/Flavio Tordini | ||
28 | whitelist /usr/share/musictube | ||
29 | include whitelist-common.inc | ||
30 | include whitelist-runuser-common.inc | ||
31 | include whitelist-usr-share-common.inc | ||
32 | include whitelist-var-common.inc | ||
33 | |||
34 | apparmor | ||
35 | caps.drop all | ||
36 | netfilter | ||
37 | nodvd | ||
38 | nogroups | ||
39 | nonewprivs | ||
40 | noroot | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix,inet,inet6,netlink | ||
45 | seccomp | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | disable-mnt | ||
50 | private-bin musictube | ||
51 | private-cache | ||
52 | private-dev | ||
53 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
54 | private-tmp | ||
55 | |||
56 | dbus-user none | ||
57 | dbus-system none | ||
diff --git a/etc/profile-m-z/notify-send.profile b/etc/profile-m-z/notify-send.profile new file mode 100644 index 000000000..ff292f409 --- /dev/null +++ b/etc/profile-m-z/notify-send.profile | |||
@@ -0,0 +1,60 @@ | |||
1 | # Firejail profile for notify-send | ||
2 | # Description: a program to send desktop notifications | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include notify-send.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist ${RUNUSER}/wayland-* | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | include disable-write-mnt.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | include whitelist-common.inc | ||
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | ipc-namespace | ||
30 | machine-id | ||
31 | net none | ||
32 | no3d | ||
33 | nodvd | ||
34 | nogroups | ||
35 | nonewprivs | ||
36 | noroot | ||
37 | nosound | ||
38 | notv | ||
39 | nou2f | ||
40 | novideo | ||
41 | protocol unix | ||
42 | seccomp | ||
43 | shell none | ||
44 | tracelog | ||
45 | x11 none | ||
46 | |||
47 | disable-mnt | ||
48 | private | ||
49 | private-bin notify-send | ||
50 | private-cache | ||
51 | private-dev | ||
52 | private-etc none | ||
53 | private-tmp | ||
54 | |||
55 | dbus-user filter | ||
56 | dbus-user.talk org.freedesktop.Notifications | ||
57 | dbus-system none | ||
58 | |||
59 | memory-deny-write-execute | ||
60 | read-only ${HOME} | ||
diff --git a/etc/profile-m-z/onboard.profile b/etc/profile-m-z/onboard.profile new file mode 100644 index 000000000..3a235a677 --- /dev/null +++ b/etc/profile-m-z/onboard.profile | |||
@@ -0,0 +1,55 @@ | |||
1 | # Firejail profile for onboard | ||
2 | # Description: On-screen keyboard | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include onboard.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/onboard | ||
10 | |||
11 | include allow-python2.inc | ||
12 | include allow-python3.inc | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-passwdmgr.inc | ||
20 | include disable-shell.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | mkdir ${HOME}/.config/onboard | ||
24 | whitelist ${HOME}/.config/onboard | ||
25 | whitelist /usr/share/onboard | ||
26 | include whitelist-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-runuser-common.inc | ||
29 | include whitelist-var-common.inc | ||
30 | |||
31 | apparmor | ||
32 | caps.drop all | ||
33 | machine-id | ||
34 | net none | ||
35 | nodvd | ||
36 | no3d | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix | ||
44 | seccomp | ||
45 | shell none | ||
46 | tracelog | ||
47 | |||
48 | disable-mnt | ||
49 | private-cache | ||
50 | private-bin onboard,python*,tput | ||
51 | private-dev | ||
52 | private-etc alternatives,dbus-1,dconf,fonts,gtk-2.0,gtk-3.0,locale,locale.alias,locale.conf,mime.types,selinux,X11,xdg | ||
53 | private-tmp | ||
54 | |||
55 | dbus-system none | ||
diff --git a/etc/profile-m-z/openarena.profile b/etc/profile-m-z/openarena.profile index 45682fc31..88d5d0e1e 100644 --- a/etc/profile-m-z/openarena.profile +++ b/etc/profile-m-z/openarena.profile | |||
@@ -21,7 +21,7 @@ whitelist ${HOME}/.openarena | |||
21 | whitelist /usr/share/openarena | 21 | whitelist /usr/share/openarena |
22 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | 23 | include whitelist-runuser-common.inc |
24 | include whitelist-usr-share-common.in | 24 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
26 | 26 | ||
27 | apparmor | 27 | apparmor |
diff --git a/etc/profile-m-z/peek.profile b/etc/profile-m-z/peek.profile index 66fdd6496..28a7da404 100644 --- a/etc/profile-m-z/peek.profile +++ b/etc/profile-m-z/peek.profile | |||
@@ -17,7 +17,18 @@ include disable-passwdmgr.inc | |||
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-xdg.inc | 18 | include disable-xdg.inc |
19 | 19 | ||
20 | #mkdir ${HOME}/.cache/peek | ||
21 | #whitelist ${HOME}/.cache/peek | ||
22 | #whitelist ${PICTURES} | ||
23 | #whitelist ${VIDEOS} | ||
24 | #include whitelist-common.inc | ||
25 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | apparmor | ||
20 | caps.drop all | 30 | caps.drop all |
31 | machine-id | ||
21 | net none | 32 | net none |
22 | no3d | 33 | no3d |
23 | nodvd | 34 | nodvd |
@@ -31,13 +42,20 @@ novideo | |||
31 | protocol unix | 42 | protocol unix |
32 | seccomp | 43 | seccomp |
33 | shell none | 44 | shell none |
45 | tracelog | ||
34 | 46 | ||
35 | # private-bin breaks gif mode, mp4 and webm mode work fine however | 47 | disable-mnt |
36 | # private-bin convert,ffmpeg,peek | 48 | private-bin bash,convert,ffmpeg,firejail,fish,peek,sh,which,zsh |
37 | private-dev | 49 | private-dev |
50 | private-etc dconf,firejail,fonts,gtk-3.0,login.defs,pango,passwd,X11 | ||
38 | private-tmp | 51 | private-tmp |
39 | 52 | ||
40 | dbus-user none | 53 | dbus-user filter |
54 | dbus-user.own com.uploadedlobster.peek | ||
55 | dbus-user.talk ca.desrt.dconf | ||
56 | dbus-user.talk org.freedesktop.FileManager1 | ||
57 | dbus-user.talk org.freedesktop.Notifications | ||
58 | dbus-user.talk org.gnome.Shell.Screencast | ||
41 | dbus-system none | 59 | dbus-system none |
42 | 60 | ||
43 | memory-deny-write-execute | 61 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/pidgin.profile b/etc/profile-m-z/pidgin.profile index 2e4215744..e81e78ca7 100644 --- a/etc/profile-m-z/pidgin.profile +++ b/etc/profile-m-z/pidgin.profile | |||
@@ -21,6 +21,8 @@ include disable-xdg.inc | |||
21 | 21 | ||
22 | mkdir ${HOME}/.purple | 22 | mkdir ${HOME}/.purple |
23 | whitelist ${HOME}/.purple | 23 | whitelist ${HOME}/.purple |
24 | whitelist ${DOWNLOADS} | ||
25 | whitelist ${PICTURES} | ||
24 | include whitelist-common.inc | 26 | include whitelist-common.inc |
25 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/psi.profile b/etc/profile-m-z/psi.profile new file mode 100644 index 000000000..d3112ae95 --- /dev/null +++ b/etc/profile-m-z/psi.profile | |||
@@ -0,0 +1,78 @@ | |||
1 | # Firejail profile for psi | ||
2 | # Description: Native XMPP client with GPG support | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include psi.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Uncomment for GPG | ||
10 | # noblacklist ${HOME}/.gnupg | ||
11 | noblacklist ${HOME}/.cache/psi | ||
12 | noblacklist ${HOME}/.cache/Psi | ||
13 | noblacklist ${HOME}/.config/psi | ||
14 | noblacklist ${HOME}/.local/share/psi | ||
15 | noblacklist ${HOME}/.local/share/Psi | ||
16 | |||
17 | include disable-common.inc | ||
18 | include disable-devel.inc | ||
19 | include disable-exec.inc | ||
20 | include disable-interpreters.inc | ||
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | ||
23 | include disable-shell.inc | ||
24 | include disable-xdg.inc | ||
25 | |||
26 | # Uncomment for GPG | ||
27 | # mkdir ${HOME}/.gnupg | ||
28 | mkdir ${HOME}/.cache/psi | ||
29 | mkdir ${HOME}/.cache/Psi | ||
30 | mkdir ${HOME}/.config/psi | ||
31 | mkdir ${HOME}/.local/share/psi | ||
32 | mkdir ${HOME}/.local/share/Psi | ||
33 | # Uncomment for GPG | ||
34 | # whitelist ${HOME}/.gnupg | ||
35 | whitelist ${HOME}/.cache/psi | ||
36 | whitelist ${HOME}/.cache/Psi | ||
37 | whitelist ${HOME}/.config/psi | ||
38 | whitelist ${HOME}/.local/share/psi | ||
39 | whitelist ${HOME}/.local/share/Psi | ||
40 | whitelist ${DOWNLOADS} | ||
41 | # Uncomment for GPG | ||
42 | # whitelist /usr/share/gnupg | ||
43 | # whitelist /usr/share/gnupg2 | ||
44 | whitelist /usr/share/psi | ||
45 | # Uncomment for GPG | ||
46 | # whitelist ${RUNUSER}/gnupg | ||
47 | # whitelist ${RUNUSER}/keyring | ||
48 | include whitelist-common.inc | ||
49 | include whitelist-runuser-common.inc | ||
50 | include whitelist-usr-share-common.inc | ||
51 | include whitelist-var-common.inc | ||
52 | |||
53 | apparmor | ||
54 | caps.drop all | ||
55 | netfilter | ||
56 | nodvd | ||
57 | nogroups | ||
58 | nonewprivs | ||
59 | noroot | ||
60 | notv | ||
61 | novideo | ||
62 | nou2f | ||
63 | protocol unix,inet,inet6,netlink | ||
64 | seccomp !chroot | ||
65 | shell none | ||
66 | # breaks on Arch | ||
67 | # tracelog | ||
68 | |||
69 | disable-mnt | ||
70 | # Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for GPG | ||
71 | private-bin getopt,psi | ||
72 | private-cache | ||
73 | private-dev | ||
74 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,gcrypt,group,hostname,hosts,ld.so.cache,ld.so.conf,machine-id,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg | ||
75 | private-tmp | ||
76 | |||
77 | dbus-user none | ||
78 | dbus-system none | ||
diff --git a/etc/profile-m-z/qrencode.profile b/etc/profile-m-z/qrencode.profile new file mode 100644 index 000000000..5e49a342a --- /dev/null +++ b/etc/profile-m-z/qrencode.profile | |||
@@ -0,0 +1,58 @@ | |||
1 | # Firejail profile for qrencode | ||
2 | # Description: Encode input data in a QR Code and save as a PNG or EPS image. | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include qrencode.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist ${RUNUSER}/wayland-* | ||
11 | blacklist ${RUNUSER} | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-write-mnt.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | ipc-namespace | ||
30 | machine-id | ||
31 | net none | ||
32 | no3d | ||
33 | nodvd | ||
34 | nogroups | ||
35 | nonewprivs | ||
36 | noroot | ||
37 | nosound | ||
38 | notv | ||
39 | nou2f | ||
40 | novideo | ||
41 | protocol unix | ||
42 | seccomp | ||
43 | shell none | ||
44 | tracelog | ||
45 | x11 none | ||
46 | |||
47 | disable-mnt | ||
48 | private-bin qrencode | ||
49 | private-cache | ||
50 | private-dev | ||
51 | private-etc none | ||
52 | private-lib libpcre2-8.so.0 | ||
53 | private-tmp | ||
54 | |||
55 | dbus-user none | ||
56 | dbus-system none | ||
57 | |||
58 | memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/quaternion.profile b/etc/profile-m-z/quaternion.profile new file mode 100644 index 000000000..2133c74d3 --- /dev/null +++ b/etc/profile-m-z/quaternion.profile | |||
@@ -0,0 +1,54 @@ | |||
1 | # Firejail profile for quaternion | ||
2 | # Description: Desktop client for Matrix | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include quaternion.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/Quotient/quaternion | ||
10 | noblacklist ${HOME}/.config/Quotient | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | mkdir ${HOME}/.cache/Quotient/quaternion | ||
22 | mkdir ${HOME}/.config/Quotient | ||
23 | whitelist ${HOME}/.cache/Quotient/quaternion | ||
24 | whitelist ${HOME}/.config/Quotient | ||
25 | whitelist ${DOWNLOADS} | ||
26 | whitelist /usr/share/Quotient/quaternion | ||
27 | include whitelist-common.inc | ||
28 | include whitelist-runuser-common.inc | ||
29 | include whitelist-usr-share-common.inc | ||
30 | include whitelist-var-common.inc | ||
31 | |||
32 | apparmor | ||
33 | caps.drop all | ||
34 | netfilter | ||
35 | nodvd | ||
36 | nogroups | ||
37 | nonewprivs | ||
38 | noroot | ||
39 | notv | ||
40 | nou2f | ||
41 | protocol unix,inet,inet6,netlink | ||
42 | seccomp | ||
43 | shell none | ||
44 | tracelog | ||
45 | |||
46 | disable-mnt | ||
47 | private-bin quaternion | ||
48 | private-cache | ||
49 | private-dev | ||
50 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
51 | private-tmp | ||
52 | |||
53 | dbus-user none | ||
54 | dbus-system none | ||
diff --git a/etc/profile-m-z/redeclipse.profile b/etc/profile-m-z/redeclipse.profile index bb1ad56d3..a29205e14 100644 --- a/etc/profile-m-z/redeclipse.profile +++ b/etc/profile-m-z/redeclipse.profile | |||
@@ -14,10 +14,14 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | ||
17 | 18 | ||
18 | mkdir ${HOME}/.redeclipse | 19 | mkdir ${HOME}/.redeclipse |
19 | whitelist ${HOME}/.redeclipse | 20 | whitelist ${HOME}/.redeclipse |
21 | whitelist /usr/share/redeclipse | ||
20 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
22 | 26 | ||
23 | caps.drop all | 27 | caps.drop all |
@@ -32,8 +36,13 @@ novideo | |||
32 | protocol unix,inet,inet6 | 36 | protocol unix,inet,inet6 |
33 | seccomp | 37 | seccomp |
34 | shell none | 38 | shell none |
39 | tracelog | ||
35 | 40 | ||
36 | disable-mnt | 41 | disable-mnt |
42 | #private-bin redeclipse,sh,man | ||
43 | private-cache | ||
37 | private-dev | 44 | private-dev |
38 | private-tmp | 45 | private-tmp |
39 | 46 | ||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/profile-m-z/rhythmbox.profile b/etc/profile-m-z/rhythmbox.profile index b76f2b947..f906ec31d 100644 --- a/etc/profile-m-z/rhythmbox.profile +++ b/etc/profile-m-z/rhythmbox.profile | |||
@@ -14,6 +14,9 @@ noblacklist ${HOME}/.local/share/rhythmbox | |||
14 | include allow-python2.inc | 14 | include allow-python2.inc |
15 | include allow-python3.inc | 15 | include allow-python3.inc |
16 | 16 | ||
17 | # Allow lua (blacklisted by disable-interpreters.inc) | ||
18 | include allow-lua.inc | ||
19 | |||
17 | include disable-common.inc | 20 | include disable-common.inc |
18 | include disable-devel.inc | 21 | include disable-devel.inc |
19 | include disable-exec.inc | 22 | include disable-exec.inc |
@@ -26,6 +29,7 @@ include disable-xdg.inc | |||
26 | whitelist /usr/share/rhythmbox | 29 | whitelist /usr/share/rhythmbox |
27 | whitelist /usr/share/lua | 30 | whitelist /usr/share/lua |
28 | whitelist /usr/share/libquvi-scripts | 31 | whitelist /usr/share/libquvi-scripts |
32 | whitelist /usr/share/tracker | ||
29 | include whitelist-runuser-common.inc | 33 | include whitelist-runuser-common.inc |
30 | include whitelist-usr-share-common.inc | 34 | include whitelist-usr-share-common.inc |
31 | include whitelist-var-common.inc | 35 | include whitelist-var-common.inc |
@@ -54,6 +58,6 @@ dbus-user.own org.mpris.MediaPlayer2.rhythmbox | |||
54 | dbus-user.own org.gnome.UPnP.MediaServer2.Rhythmbox | 58 | dbus-user.own org.gnome.UPnP.MediaServer2.Rhythmbox |
55 | dbus-user.talk ca.desrt.dconf | 59 | dbus-user.talk ca.desrt.dconf |
56 | dbus-user.talk org.freedesktop.Notifications | 60 | dbus-user.talk org.freedesktop.Notifications |
57 | dbus-system none | 61 | dbus-user.talk org.gnome.SettingsDaemon.MediaKeys |
58 | dbus-system filter | 62 | dbus-system filter |
59 | dbus-system.talk org.freedesktop.Avahi | 63 | dbus-system.talk org.freedesktop.Avahi |
diff --git a/etc/profile-m-z/smplayer.profile b/etc/profile-m-z/smplayer.profile index 3fb6fc349..8ffc47ff6 100644 --- a/etc/profile-m-z/smplayer.profile +++ b/etc/profile-m-z/smplayer.profile | |||
@@ -10,7 +10,7 @@ noblacklist ${HOME}/.config/smplayer | |||
10 | noblacklist ${HOME}/.config/youtube-dl | 10 | noblacklist ${HOME}/.config/youtube-dl |
11 | noblacklist ${HOME}/.mplayer | 11 | noblacklist ${HOME}/.mplayer |
12 | 12 | ||
13 | # Allow python (blacklisted by disable-interpreters.inc) | 13 | include allow-lua.inc |
14 | include allow-python2.inc | 14 | include allow-python2.inc |
15 | include allow-python3.inc | 15 | include allow-python3.inc |
16 | 16 | ||
@@ -26,7 +26,9 @@ include disable-programs.inc | |||
26 | include disable-shell.inc | 26 | include disable-shell.inc |
27 | include disable-xdg.inc | 27 | include disable-xdg.inc |
28 | 28 | ||
29 | whitelist /usr/share/lua* | ||
29 | whitelist /usr/share/smplayer | 30 | whitelist /usr/share/smplayer |
31 | whitelist /usr/share/vulkan | ||
30 | include whitelist-usr-share-common.inc | 32 | include whitelist-usr-share-common.inc |
31 | include whitelist-var-common.inc | 33 | include whitelist-var-common.inc |
32 | 34 | ||
@@ -41,7 +43,7 @@ protocol unix,inet,inet6,netlink | |||
41 | seccomp | 43 | seccomp |
42 | shell none | 44 | shell none |
43 | 45 | ||
44 | private-bin env,mplayer,mpv,python*,smplayer,smtube,youtube-dl | 46 | private-bin env,mplayer,mpv,python*,smplayer,smtube,waf,youtube-dl |
45 | private-dev | 47 | private-dev |
46 | private-tmp | 48 | private-tmp |
47 | 49 | ||
diff --git a/etc/profile-m-z/smuxi-frontend-gnome.profile b/etc/profile-m-z/smuxi-frontend-gnome.profile new file mode 100644 index 000000000..541e5a1c4 --- /dev/null +++ b/etc/profile-m-z/smuxi-frontend-gnome.profile | |||
@@ -0,0 +1,55 @@ | |||
1 | # Firejail profile for smuxi-frontend-gnome | ||
2 | # Description: Multi protocol chat client with Twitter support | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include smuxi-frontend-gnome.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/smuxi | ||
10 | noblacklist ${HOME}/.config/smuxi | ||
11 | noblacklist ${HOME}/.local/share/smuxi | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | mkdir ${HOME}/.cache/smuxi | ||
22 | mkdir ${HOME}/.config/smuxi | ||
23 | mkdir ${HOME}/.local/share/smuxi | ||
24 | whitelist ${HOME}/.cache/smuxi | ||
25 | whitelist ${HOME}/.config/smuxi | ||
26 | whitelist ${HOME}/.local/share/smuxi | ||
27 | whitelist ${DOWNLOADS} | ||
28 | include whitelist-common.inc | ||
29 | include whitelist-runuser-common.inc | ||
30 | include whitelist-usr-share-common.inc | ||
31 | include whitelist-var-common.inc | ||
32 | |||
33 | apparmor | ||
34 | caps.drop all | ||
35 | netfilter | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | notv | ||
41 | nou2f | ||
42 | protocol unix,inet,inet6,netlink | ||
43 | seccomp | ||
44 | shell none | ||
45 | tracelog | ||
46 | |||
47 | disable-mnt | ||
48 | private-bin bash,mono,mono-sgen,sh,smuxi-frontend-gnome | ||
49 | private-cache | ||
50 | private-dev | ||
51 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.conf,machine-id,mono,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg | ||
52 | private-tmp | ||
53 | |||
54 | dbus-user none | ||
55 | dbus-system none | ||
diff --git a/etc/profile-m-z/spectral.profile b/etc/profile-m-z/spectral.profile new file mode 100644 index 000000000..d7f94e144 --- /dev/null +++ b/etc/profile-m-z/spectral.profile | |||
@@ -0,0 +1,53 @@ | |||
1 | # Firejail profile for spectral | ||
2 | # Description: Desktop client for Matrix | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include spectral.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/ENCOM/Spectral | ||
10 | noblacklist ${HOME}/.config/ENCOM | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | mkdir ${HOME}/.cache/ENCOM/Spectral | ||
22 | mkdir ${HOME}/.config/ENCOM | ||
23 | whitelist ${HOME}/.cache/ENCOM/Spectral | ||
24 | whitelist ${HOME}/.config/ENCOM | ||
25 | whitelist ${DOWNLOADS} | ||
26 | include whitelist-common.inc | ||
27 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
29 | include whitelist-var-common.inc | ||
30 | |||
31 | apparmor | ||
32 | caps.drop all | ||
33 | netfilter | ||
34 | nodvd | ||
35 | nogroups | ||
36 | nonewprivs | ||
37 | noroot | ||
38 | notv | ||
39 | nou2f | ||
40 | protocol unix,inet,inet6,netlink | ||
41 | seccomp | ||
42 | shell none | ||
43 | tracelog | ||
44 | |||
45 | disable-mnt | ||
46 | private-cache | ||
47 | private-bin spectral | ||
48 | private-dev | ||
49 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
50 | private-tmp | ||
51 | |||
52 | dbus-user none | ||
53 | dbus-system none | ||
diff --git a/etc/profile-m-z/supertuxkart.profile b/etc/profile-m-z/supertuxkart.profile index ce69c8b4b..40b996794 100644 --- a/etc/profile-m-z/supertuxkart.profile +++ b/etc/profile-m-z/supertuxkart.profile | |||
@@ -27,6 +27,7 @@ whitelist ${HOME}/.cache/supertuxkart | |||
27 | whitelist ${HOME}/.local/share/supertuxkart | 27 | whitelist ${HOME}/.local/share/supertuxkart |
28 | whitelist /usr/share/supertuxkart | 28 | whitelist /usr/share/supertuxkart |
29 | include whitelist-common.inc | 29 | include whitelist-common.inc |
30 | include whitelist-runuser-common.inc | ||
30 | include whitelist-usr-share-common.inc | 31 | include whitelist-usr-share-common.inc |
31 | include whitelist-var-common.inc | 32 | include whitelist-var-common.inc |
32 | 33 | ||
diff --git a/etc/profile-m-z/telegram.profile b/etc/profile-m-z/telegram.profile index 8e0741458..4100a9572 100644 --- a/etc/profile-m-z/telegram.profile +++ b/etc/profile-m-z/telegram.profile | |||
@@ -20,7 +20,7 @@ nodvd | |||
20 | nonewprivs | 20 | nonewprivs |
21 | noroot | 21 | noroot |
22 | notv | 22 | notv |
23 | protocol unix,inet,inet6 | 23 | protocol unix,inet,inet6,netlink |
24 | seccomp | 24 | seccomp |
25 | 25 | ||
26 | disable-mnt | 26 | disable-mnt |
diff --git a/etc/profile-m-z/totem.profile b/etc/profile-m-z/totem.profile index abbbba6c3..7bb2f3e2d 100644 --- a/etc/profile-m-z/totem.profile +++ b/etc/profile-m-z/totem.profile | |||
@@ -28,12 +28,11 @@ mkdir ${HOME}/.config/totem | |||
28 | mkdir ${HOME}/.local/share/totem | 28 | mkdir ${HOME}/.local/share/totem |
29 | whitelist ${HOME}/.config/totem | 29 | whitelist ${HOME}/.config/totem |
30 | whitelist ${HOME}/.local/share/totem | 30 | whitelist ${HOME}/.local/share/totem |
31 | whitelist ${DESKTOP} | 31 | whitelist /usr/share/totem |
32 | whitelist ${DOWNLOADS} | ||
33 | whitelist ${MUSIC} | ||
34 | whitelist ${PICTURES} | ||
35 | whitelist ${VIDEOS} | ||
36 | include whitelist-common.inc | 32 | include whitelist-common.inc |
33 | include whitelist-players.inc | ||
34 | include whitelist-runuser-common.inc | ||
35 | include whitelist-usr-share-common.inc | ||
37 | include whitelist-var-common.inc | 36 | include whitelist-var-common.inc |
38 | 37 | ||
39 | # apparmor - makes settings immutable | 38 | # apparmor - makes settings immutable |
@@ -57,4 +56,4 @@ private-tmp | |||
57 | 56 | ||
58 | # makes settings immutable | 57 | # makes settings immutable |
59 | # dbus-user none | 58 | # dbus-user none |
60 | # dbus-system none | 59 | dbus-system none |
diff --git a/etc/profile-m-z/trojita.profile b/etc/profile-m-z/trojita.profile new file mode 100644 index 000000000..a8641af85 --- /dev/null +++ b/etc/profile-m-z/trojita.profile | |||
@@ -0,0 +1,63 @@ | |||
1 | # Firejail profile for trojita | ||
2 | # Description: Qt mail client | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include trojita.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.abook | ||
10 | noblacklist ${HOME}/.mozilla | ||
11 | noblacklist ${HOME}/.cache/flaska.net/trojita | ||
12 | noblacklist ${HOME}/.config/flaska.net | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-shell.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | mkdir ${HOME}/.abook | ||
24 | mkdir ${HOME}/.cache/flaska.net/trojita | ||
25 | mkdir ${HOME}/.config/flaska.net | ||
26 | whitelist ${HOME}/.abook | ||
27 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | ||
28 | whitelist ${HOME}/.cache/flaska.net/trojita | ||
29 | whitelist ${HOME}/.config/flaska.net | ||
30 | include whitelist-common.inc | ||
31 | include whitelist-runuser-common.inc | ||
32 | include whitelist-usr-share-common.inc | ||
33 | include whitelist-var-common.inc | ||
34 | |||
35 | apparmor | ||
36 | caps.drop all | ||
37 | netfilter | ||
38 | no3d | ||
39 | nodvd | ||
40 | nogroups | ||
41 | nonewprivs | ||
42 | noroot | ||
43 | nosound | ||
44 | notv | ||
45 | nou2f | ||
46 | novideo | ||
47 | protocol unix,inet,inet6,netlink | ||
48 | seccomp | ||
49 | shell none | ||
50 | tracelog | ||
51 | |||
52 | # disable-mnt | ||
53 | # Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile. | ||
54 | private-bin trojita | ||
55 | private-cache | ||
56 | private-dev | ||
57 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg | ||
58 | private-tmp | ||
59 | |||
60 | dbus-user none | ||
61 | dbus-system none | ||
62 | |||
63 | read-only ${HOME}/.mozilla/firefox/profiles.ini | ||
diff --git a/etc/profile-m-z/twitch.profile b/etc/profile-m-z/twitch.profile new file mode 100644 index 000000000..3c50344f1 --- /dev/null +++ b/etc/profile-m-z/twitch.profile | |||
@@ -0,0 +1,36 @@ | |||
1 | # Firejail profile for twitch | ||
2 | # Description: Unofficial electron based desktop warpper for Twitch | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include twitch.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/Twitch | ||
10 | |||
11 | include disable-devel.inc | ||
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-shell.inc | ||
15 | include disable-xdg.inc | ||
16 | |||
17 | mkdir ${HOME}/.config/Twitch | ||
18 | whitelist ${HOME}/.config/Twitch | ||
19 | include whitelist-common.inc | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | seccomp !chroot | ||
25 | shell none | ||
26 | |||
27 | disable-mnt | ||
28 | private-bin twitch | ||
29 | private-cache | ||
30 | private-dev | ||
31 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
32 | private-opt Twitch | ||
33 | private-tmp | ||
34 | |||
35 | # Redirect | ||
36 | include electron.profile | ||
diff --git a/etc/profile-m-z/virtualbox.profile b/etc/profile-m-z/virtualbox.profile index 12bef5d1f..7a49ad88a 100644 --- a/etc/profile-m-z/virtualbox.profile +++ b/etc/profile-m-z/virtualbox.profile | |||
@@ -26,6 +26,7 @@ mkdir ${HOME}/VirtualBox VMs | |||
26 | whitelist ${HOME}/.config/VirtualBox | 26 | whitelist ${HOME}/.config/VirtualBox |
27 | whitelist ${HOME}/VirtualBox VMs | 27 | whitelist ${HOME}/VirtualBox VMs |
28 | whitelist ${DOWNLOADS} | 28 | whitelist ${DOWNLOADS} |
29 | whitelist /usr/share/virtualbox | ||
29 | include whitelist-common.inc | 30 | include whitelist-common.inc |
30 | include whitelist-runuser-common.inc | 31 | include whitelist-runuser-common.inc |
31 | include whitelist-usr-share-common.inc | 32 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-m-z/vlc.profile b/etc/profile-m-z/vlc.profile index 07a1b5fc0..fc8efe089 100644 --- a/etc/profile-m-z/vlc.profile +++ b/etc/profile-m-z/vlc.profile | |||
@@ -8,6 +8,7 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.cache/vlc | 9 | noblacklist ${HOME}/.cache/vlc |
10 | noblacklist ${HOME}/.config/vlc | 10 | noblacklist ${HOME}/.config/vlc |
11 | noblacklist ${HOME}/.config/aacs | ||
11 | noblacklist ${HOME}/.local/share/vlc | 12 | noblacklist ${HOME}/.local/share/vlc |
12 | 13 | ||
13 | include disable-common.inc | 14 | include disable-common.inc |
@@ -23,13 +24,10 @@ mkdir ${HOME}/.config/vlc | |||
23 | mkdir ${HOME}/.local/share/vlc | 24 | mkdir ${HOME}/.local/share/vlc |
24 | whitelist ${HOME}/.cache/vlc | 25 | whitelist ${HOME}/.cache/vlc |
25 | whitelist ${HOME}/.config/vlc | 26 | whitelist ${HOME}/.config/vlc |
27 | whitelist ${HOME}/.config/aacs | ||
26 | whitelist ${HOME}/.local/share/vlc | 28 | whitelist ${HOME}/.local/share/vlc |
27 | whitelist ${DESKTOP} | ||
28 | whitelist ${DOWNLOADS} | ||
29 | whitelist ${MUSIC} | ||
30 | whitelist ${PICTURES} | ||
31 | whitelist ${VIDEOS} | ||
32 | include whitelist-common.inc | 29 | include whitelist-common.inc |
30 | include whitelist-players.inc | ||
33 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
34 | 32 | ||
35 | #apparmor - on Ubuntu 18.04 it refuses to start without dbus access | 33 | #apparmor - on Ubuntu 18.04 it refuses to start without dbus access |
diff --git a/etc/profile-m-z/vmware.profile b/etc/profile-m-z/vmware.profile index 720b69773..493c53936 100644 --- a/etc/profile-m-z/vmware.profile +++ b/etc/profile-m-z/vmware.profile | |||
@@ -34,6 +34,6 @@ shell none | |||
34 | tracelog | 34 | tracelog |
35 | 35 | ||
36 | #disable-mnt | 36 | #disable-mnt |
37 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl,vmware,vmware-installer,vmware-vix | 37 | #private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl,vmware,vmware-installer,vmware-vix |
38 | dbus-user none | 38 | dbus-user none |
39 | dbus-system none | 39 | dbus-system none |
diff --git a/etc/profile-m-z/warsow.profile b/etc/profile-m-z/warsow.profile index d8cd5557e..178e0c7b1 100644 --- a/etc/profile-m-z/warsow.profile +++ b/etc/profile-m-z/warsow.profile | |||
@@ -24,7 +24,10 @@ mkdir ${HOME}/.cache/warsow-2.1 | |||
24 | mkdir ${HOME}/.local/share/warsow-2.1 | 24 | mkdir ${HOME}/.local/share/warsow-2.1 |
25 | whitelist ${HOME}/.cache/warsow-2.1 | 25 | whitelist ${HOME}/.cache/warsow-2.1 |
26 | whitelist ${HOME}/.local/share/warsow-2.1 | 26 | whitelist ${HOME}/.local/share/warsow-2.1 |
27 | whitelist /usr/share/warsow | ||
27 | include whitelist-common.inc | 28 | include whitelist-common.inc |
29 | include whitelist-runuser-common.inc | ||
30 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
29 | 32 | ||
30 | caps.drop all | 33 | caps.drop all |
diff --git a/etc/profile-m-z/wire-desktop.profile b/etc/profile-m-z/wire-desktop.profile index 8f6014dc3..d265c6bae 100644 --- a/etc/profile-m-z/wire-desktop.profile +++ b/etc/profile-m-z/wire-desktop.profile | |||
@@ -27,7 +27,7 @@ seccomp !chroot | |||
27 | shell none | 27 | shell none |
28 | 28 | ||
29 | disable-mnt | 29 | disable-mnt |
30 | private-bin bash,electron,electron4,electron6,env,sh,wire-desktop | 30 | private-bin bash,electron,electron[0-9],electron[0-9][0-9],env,sh,wire-desktop |
31 | private-dev | 31 | private-dev |
32 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl | 32 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl |
33 | private-tmp | 33 | private-tmp |
diff --git a/etc/profile-m-z/xournalpp.profile b/etc/profile-m-z/xournalpp.profile new file mode 100644 index 000000000..03deb514a --- /dev/null +++ b/etc/profile-m-z/xournalpp.profile | |||
@@ -0,0 +1,26 @@ | |||
1 | # Firejail profile for xournalpp | ||
2 | # Description: Handwriting note-taking software with PDF annotation support | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include xournalpp.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.xournalpp | ||
11 | |||
12 | whitelist /usr/share/texlive | ||
13 | whitelist /usr/share/xournalpp | ||
14 | whitelist /var/lib/texmf | ||
15 | include whitelist-runuser-common.inc | ||
16 | |||
17 | #mkdir ${HOME}/.xournalpp | ||
18 | #whitelist ${HOME}/.xournalpp | ||
19 | #whitelist ${DOCUMENTS} | ||
20 | #include whitelist-common.inc | ||
21 | |||
22 | private-bin kpsewhich,pdflatex,xournalpp | ||
23 | private-etc latexmk.conf,texlive | ||
24 | |||
25 | # Redirect | ||
26 | include xournal.profile | ||
diff --git a/etc/profile-m-z/xplayer.profile b/etc/profile-m-z/xplayer.profile index 555d8e9a4..d22d04818 100644 --- a/etc/profile-m-z/xplayer.profile +++ b/etc/profile-m-z/xplayer.profile | |||
@@ -24,12 +24,8 @@ mkdir ${HOME}/.config/xplayer | |||
24 | mkdir ${HOME}/.local/share/xplayer | 24 | mkdir ${HOME}/.local/share/xplayer |
25 | whitelist ${HOME}/.config/xplayer | 25 | whitelist ${HOME}/.config/xplayer |
26 | whitelist ${HOME}/.local/share/xplayer | 26 | whitelist ${HOME}/.local/share/xplayer |
27 | whitelist ${DESKTOP} | ||
28 | whitelist ${DOWNLOADS} | ||
29 | whitelist ${MUSIC} | ||
30 | whitelist ${PICTURES} | ||
31 | whitelist ${VIDEOS} | ||
32 | include whitelist-common.inc | 27 | include whitelist-common.inc |
28 | include whitelist-players.inc | ||
33 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
34 | 30 | ||
35 | # apparmor - makes settings immutable | 31 | # apparmor - makes settings immutable |
diff --git a/etc/profile-m-z/youtube.profile b/etc/profile-m-z/youtube.profile new file mode 100644 index 000000000..a6c7750a9 --- /dev/null +++ b/etc/profile-m-z/youtube.profile | |||
@@ -0,0 +1,37 @@ | |||
1 | # Firejail profile for youtube | ||
2 | # Description: Unofficial electron based desktop warpper for YouTube | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include youtube.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/Youtube | ||
10 | |||
11 | include disable-devel.inc | ||
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-shell.inc | ||
15 | include disable-xdg.inc | ||
16 | |||
17 | mkdir ${HOME}/.config/Youtube | ||
18 | whitelist ${HOME}/.config/Youtube | ||
19 | include whitelist-common.inc | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | novideo | ||
25 | seccomp !chroot | ||
26 | shell none | ||
27 | |||
28 | disable-mnt | ||
29 | private-bin youtube | ||
30 | private-cache | ||
31 | private-dev | ||
32 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
33 | private-opt Youtube | ||
34 | private-tmp | ||
35 | |||
36 | # Redirect | ||
37 | include electron.profile | ||
diff --git a/etc/profile-m-z/youtubemusic-nativefier.profile b/etc/profile-m-z/youtubemusic-nativefier.profile new file mode 100644 index 000000000..3a94a5707 --- /dev/null +++ b/etc/profile-m-z/youtubemusic-nativefier.profile | |||
@@ -0,0 +1,38 @@ | |||
1 | # Firejail profile for youtubemusic-nativefier | ||
2 | # Description: Unofficial electron based desktop warpper for YouTube Music | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include youtube.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/youtubemusic-nativefier-040164 | ||
10 | |||
11 | include disable-devel.inc | ||
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-shell.inc | ||
15 | include disable-xdg.inc | ||
16 | |||
17 | mkdir ${HOME}/.config/youtubemusic-nativefier-040164 | ||
18 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 | ||
19 | include whitelist-common.inc | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | nou2f | ||
25 | novideo | ||
26 | seccomp !chroot | ||
27 | shell none | ||
28 | |||
29 | disable-mnt | ||
30 | private-bin youtubemusic-nativefier | ||
31 | private-cache | ||
32 | private-dev | ||
33 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
34 | private-opt youtubemusic-nativefier | ||
35 | private-tmp | ||
36 | |||
37 | # Redirect | ||
38 | include electron.profile | ||
diff --git a/etc/profile-m-z/ytmdesktop.profile b/etc/profile-m-z/ytmdesktop.profile new file mode 100644 index 000000000..5c37b838b --- /dev/null +++ b/etc/profile-m-z/ytmdesktop.profile | |||
@@ -0,0 +1,39 @@ | |||
1 | # Firejail profile for ytmdesktop | ||
2 | # Description: Unofficial electron based desktop warpper for YouTube Music | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include youtube.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore dbus-user none | ||
10 | |||
11 | noblacklist ${HOME}/.config/youtube-music-desktop-app | ||
12 | |||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | mkdir ${HOME}/.config/youtube-music-desktop-app | ||
19 | whitelist ${HOME}/.config/youtube-music-desktop-app | ||
20 | include whitelist-common.inc | ||
21 | include whitelist-runuser-common.inc | ||
22 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | |||
25 | nou2f | ||
26 | novideo | ||
27 | seccomp !chroot | ||
28 | shell none | ||
29 | |||
30 | disable-mnt | ||
31 | # private-bin env,ytmdesktop | ||
32 | private-cache | ||
33 | private-dev | ||
34 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
35 | # private-opt | ||
36 | private-tmp | ||
37 | |||
38 | # Redirect | ||
39 | include electron.profile | ||
diff --git a/etc/templates/profile.template b/etc/templates/profile.template index 02d9fa076..d57306aee 100644 --- a/etc/templates/profile.template +++ b/etc/templates/profile.template | |||
@@ -110,6 +110,7 @@ include globals.local | |||
110 | #include disable-passwdmgr.inc | 110 | #include disable-passwdmgr.inc |
111 | #include disable-programs.inc | 111 | #include disable-programs.inc |
112 | #include disable-shell.inc | 112 | #include disable-shell.inc |
113 | #include disable-write-mnt.inc | ||
113 | #include disable-xdg.inc | 114 | #include disable-xdg.inc |
114 | 115 | ||
115 | # This section often mirrors noblacklist section above. The idea is | 116 | # This section often mirrors noblacklist section above. The idea is |
diff --git a/etc/templates/syscalls.txt b/etc/templates/syscalls.txt index ea3b5a6b0..c454887dd 100644 --- a/etc/templates/syscalls.txt +++ b/etc/templates/syscalls.txt | |||
@@ -33,7 +33,7 @@ Definition of groups | |||
33 | @clock=adjtimex,clock_adjtime,clock_settime,settimeofday,stime | 33 | @clock=adjtimex,clock_adjtime,clock_settime,settimeofday,stime |
34 | @cpu-emulation=modify_ldt,subpage_prot,switch_endian,vm86,vm86old | 34 | @cpu-emulation=modify_ldt,subpage_prot,switch_endian,vm86,vm86old |
35 | @debug=lookup_dcookie,perf_event_open,process_vm_writev,rtas,s390_runtime_instr,sys_debug_setcontext | 35 | @debug=lookup_dcookie,perf_event_open,process_vm_writev,rtas,s390_runtime_instr,sys_debug_setcontext |
36 | @default=@clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@swap,open_by_handle_at,name_to_handle_at,ioprio_set,ni_syscall,syslog,fanotify_init,kcmp,add_key,request_key,mbind,migrate_pages,move_pages,keyctl,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,set_mempolicyvmsplice,umount,userfaultfd,acct,bpf,chroot,mount,nfsservctl,pivot_root,setdomainname,sethostname,umount2,vhangup | 36 | @default=@clock,@cpu-emulation,@debug,@module,@mount,@obsolete,@raw-io,@reboot,@swap,open_by_handle_at,name_to_handle_at,ioprio_set,ni_syscall,syslog,fanotify_init,kcmp,add_key,request_key,mbind,migrate_pages,move_pages,keyctl,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,set_mempolicyvmsplice,userfaultfd,acct,bpf,nfsservctl,setdomainname,sethostname,vhangup |
37 | @default-nodebuggers=@default,ptrace,personality,process_vm_readv | 37 | @default-nodebuggers=@default,ptrace,personality,process_vm_readv |
38 | @default-keep=execve,prctl | 38 | @default-keep=execve,prctl |
39 | @file-system=access,chdir,chmod,close,creat,faccessat,fallocate,fchdir,fchmod,fchmodat,fcntl,fcntl64,fgetxattr,flistxattr,fremovexattr,fsetxattr,fstat,fstat64,fstatat64,fstatfs,fstatfs64,ftruncate,ftruncate64,futimesat,getcwd,getdents,getdents64,getxattr,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,lgetxattr,link,linkat,listxattr,llistxattr,lremovexattr,lsetxattr,lstat,lstat64,mkdir,mkdirat,mknod,mknodat,mmap,mmap2,munmap,newfstatat,oldfstat,oldlstat,oldstat,open,openat,readlink,readlinkat,removexattr,rename,renameat,renameat2,rmdir,setxattr,stat,stat64,statfs,statfs64,statx,symlink,symlinkat,truncate,truncate64,unlink,unlinkat,utime,utimensat,utimes | 39 | @file-system=access,chdir,chmod,close,creat,faccessat,fallocate,fchdir,fchmod,fchmodat,fcntl,fcntl64,fgetxattr,flistxattr,fremovexattr,fsetxattr,fstat,fstat64,fstatat64,fstatfs,fstatfs64,ftruncate,ftruncate64,futimesat,getcwd,getdents,getdents64,getxattr,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,lgetxattr,link,linkat,listxattr,llistxattr,lremovexattr,lsetxattr,lstat,lstat64,mkdir,mkdirat,mknod,mknodat,mmap,mmap2,munmap,newfstatat,oldfstat,oldlstat,oldstat,open,openat,readlink,readlinkat,removexattr,rename,renameat,renameat2,rmdir,setxattr,stat,stat64,statfs,statfs64,statx,symlink,symlinkat,truncate,truncate64,unlink,unlinkat,utime,utimensat,utimes |
@@ -62,15 +62,14 @@ Inheritance of groups | |||
62 | 62 | ||
63 | +---------------+ | 63 | +---------------+ |
64 | | @default-keep | | 64 | | @default-keep | |
65 | | @mount | | ||
66 | +---------------+ | 65 | +---------------+ |
67 | 66 | ||
68 | +----------------+ +---------+ +--------+ +--------------+ | 67 | +----------------+ +---------+ +--------+ +--------------+ |
69 | | @cpu-emulation | | @clock | | @chown | | @aio | | 68 | | @cpu-emulation | | @clock | | @chown | | @aio | |
70 | | @debug | | @module | +--------+ | @basic-io | | 69 | | @debug | | @module | +--------+ | @basic-io | |
71 | | @obsolete | | @raw-io | : : | @file-system | | 70 | | @obsolete | | @raw-io | : : | @file-system | |
72 | +----------------+ | @reboot | : : | @io-event | | 71 | | @mount | | @reboot | : : | @io-event | |
73 | : | @swap | : : | @ipc | | 72 | +----------------+ | @swap | : : | @ipc | |
74 | : +---------+ : : | @keyring | | 73 | : +---------+ : : | @keyring | |
75 | : : : : : | @memlock | | 74 | : : : : : | @memlock | |
76 | : ..............: : : : | @network-io | | 75 | : ..............: : : : | @network-io | |