6 files changed, 67 insertions, 1 deletions

diff --git a/etc/audacity.profile b/etc/audacity.profile
new file mode 100644
index 000000000..8971ce1a2
--- /dev/null
+++ b/etc/audacity.profile
@@ -0,0 +1,16 @@
+# Audacity profile
+noblacklist ~/.audacity-data
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+netfilter
+nonewprivs
+noroot
+nogroups
+#private-bin audacity
+protocol unix,inet,inet6
+seccomp
diff --git a/etc/cpio.profile b/etc/cpio.profile
new file mode 100644
index 000000000..811d657f2
--- /dev/null
+++ b/etc/cpio.profile
@@ -0,0 +1,8 @@
+include /usr/local/etc/firejail/server.profile
+include /usr/local/etc/firejail/disable-common.inc
+include /usr/local/etc/firejail/disable-programs.inc
+include /usr/local/etc/firejail/disable-passwdmgr.inc
+caps.drop all
+net none
+shell none
+seccomp
diff --git a/etc/disable-devel.inc b/etc/disable-devel.inc
index 821aa1ea4..963cf6da0 100644
--- a/etc/disable-devel.inc
+++ b/etc/disable-devel.inc
@@ -2,15 +2,20 @@
 
 # GCC
 blacklist /usr/include
+blacklist /usr/lib/gcc
 blacklist /usr/bin/gcc*
 blacklist /usr/bin/cpp*
 blacklist /usr/bin/c9*
 blacklist /usr/bin/c8*
 blacklist /usr/bin/c++*
+blacklist /usr/bin/as
 blacklist /usr/bin/ld
 blacklist /usr/bin/gdb
 blacklist /usr/bin/g++*
 blacklist /usr/bin/x86_64-linux-gnu-g++*
+blacklist /usr/bin/x86_64-linux-gnu-gcc*
+blacklist /usr/bin/x86_64-unknown-linux-gnu-g++*
+blacklist /usr/bin/x86_64-unknown-linux-gnu-gcc*
 
 # clang/llvm
 blacklist /usr/bin/clang*
@@ -18,6 +23,11 @@ blacklist /usr/bin/llvm*
 blacklist /usb/bin/lldb*
 blacklist /usr/lib/llvm*
 
+# tcc - Tiny C Compiler
+blacklist /usr/bin/tcc
+blacklist /usr/bin/x86_64-tcc
+blacklist /usr/lib/tcc
+
 # Valgrind
 blacklist /usr/bin/valgrind*
 blacklist /usr/lib/valgrind
@@ -51,4 +61,3 @@ blacklist /usr/lib/ruby
 #blacklist /usr/local/lib/python3*
 #blacklist /usr/share/python3*
 #blacklist /usr/include/python3*
-
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 70deb2b0c..e9dd331aa 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -32,6 +32,7 @@ blacklist ${HOME}/.config/vlc
 blacklist ${HOME}/.config/mpv
 blacklist ${HOME}/.config/totem
 blacklist ${HOME}/.config/xplayer
+blacklist ${HOME}/.audacity-data
 
 # HTTP / FTP / Mail
 blacklist ${HOME}/.icedove
diff --git a/etc/gzip.profile b/etc/gzip.profile
new file mode 100644
index 000000000..f231c3780
--- /dev/null
+++ b/etc/gzip.profile
@@ -0,0 +1,19 @@
+################################
+# Gzip profile 
+################################
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-passwdmgr.inc
+
+blacklist ${HOME}/.wine
+blacklist ${HOME}/.ssh
+
+tracelog
+caps.drop all
+seccomp 
+net none
+noroot
+nosound
+nogroups
+nonewprivs
+
diff --git a/etc/xzdec.profile b/etc/xzdec.profile
new file mode 100644
index 000000000..f29f7360c
--- /dev/null
+++ b/etc/xzdec.profile
@@ -0,0 +1,13 @@
+# Firejail profile for XZ decompressor
+# xzdec.profile
+
+include /etc/firejail/disable-mgmt.inc
+include /etc/firejail/disable-secret.inc
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+
+caps.drop all
+seccomp
+tracelog
+noroot
+shell none