aboutsummaryrefslogtreecommitdiffstats
path: root/etc
diff options
context:
space:
mode:
Diffstat (limited to 'etc')
-rw-r--r--etc/abrowser.profile37
-rw-r--r--etc/akregator.profile1
-rw-r--r--etc/audacity.profile2
-rw-r--r--etc/bnox.profile23
-rw-r--r--etc/brave.profile27
-rw-r--r--etc/chromium-common.profile32
-rw-r--r--etc/chromium.profile24
-rw-r--r--etc/clementine.profile1
-rw-r--r--etc/cliqz.profile79
-rw-r--r--etc/cyberfox.profile60
-rw-r--r--etc/disable-common.inc25
-rw-r--r--etc/disable-programs.inc31
-rw-r--r--etc/dnox.profile23
-rw-r--r--etc/dolphin.profile3
-rw-r--r--etc/dragon.profile1
-rw-r--r--etc/enox.profile36
-rw-r--r--etc/firefox-common-addons.inc55
-rw-r--r--etc/firefox-common.profile44
-rw-r--r--etc/firefox.profile83
-rw-r--r--etc/firejail-default77
-rw-r--r--etc/flashpeak-slimjet.profile26
-rw-r--r--etc/google-chrome-beta.profile23
-rw-r--r--etc/google-chrome-unstable.profile23
-rw-r--r--etc/google-chrome.profile25
-rw-r--r--etc/gwenview.profile2
-rw-r--r--etc/hexchat.profile1
-rw-r--r--etc/icecat.profile40
-rw-r--r--etc/iceweasel.profile2
-rw-r--r--etc/idea.profile10
-rw-r--r--etc/inox.profile23
-rw-r--r--etc/iridium.profile24
-rw-r--r--etc/kaffeine.profile37
-rw-r--r--etc/kdenlive.profile5
-rw-r--r--etc/kget.profile2
-rw-r--r--etc/kmail.profile4
-rw-r--r--etc/krita.profile1
-rw-r--r--etc/krunner.profile8
-rw-r--r--etc/kwin_x11.profile3
-rw-r--r--etc/libreoffice.profile2
-rw-r--r--etc/okular.profile3
-rw-r--r--etc/onionshare-gui.profile2
-rw-r--r--etc/opera-beta.profile17
-rw-r--r--etc/opera.profile16
-rw-r--r--etc/palemoon.profile50
-rwxr-xr-x[-rw-r--r--]etc/pdfchain.profile (renamed from etc/xmr-stak-cpu.profile)21
-rw-r--r--etc/pitivi.profile2
-rw-r--r--etc/qbittorrent.profile1
-rw-r--r--etc/qtox.profile2
-rw-r--r--etc/redeclipse.profile37
-rw-r--r--etc/remmina.profile2
-rw-r--r--etc/scribus.profile1
-rw-r--r--etc/soundconverter.profile2
-rw-r--r--etc/spotify.profile2
-rw-r--r--etc/steam.profile2
-rw-r--r--etc/thunderbird.profile8
-rw-r--r--etc/tilp.profile34
-rw-r--r--etc/torbrowser-launcher.profile5
-rw-r--r--etc/unbound.profile4
-rw-r--r--etc/vivaldi.profile22
-rw-r--r--etc/waterfox.profile71
-rw-r--r--etc/whitelist-common.inc6
-rw-r--r--etc/xmr-stak.profile44
-rw-r--r--etc/xonotic.profile1
-rw-r--r--etc/yandex-browser.profile24
64 files changed, 585 insertions, 719 deletions
diff --git a/etc/abrowser.profile b/etc/abrowser.profile
index 5c964bad1..d757d6f49 100644
--- a/etc/abrowser.profile
+++ b/etc/abrowser.profile
@@ -7,42 +7,15 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/mozilla 8noblacklist ${HOME}/.cache/mozilla
9noblacklist ${HOME}/.mozilla 9noblacklist ${HOME}/.mozilla
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-programs.inc
15 10
16mkdir ${HOME}/.cache/mozilla/abrowser 11mkdir ${HOME}/.cache/mozilla/abrowser
17mkdir ${HOME}/.mozilla 12mkdir ${HOME}/.mozilla
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.cache/gnome-mplayer/plugin
20whitelist ${HOME}/.cache/mozilla/abrowser 13whitelist ${HOME}/.cache/mozilla/abrowser
21whitelist ${HOME}/.config/gnome-mplayer
22whitelist ${HOME}/.config/pipelight-silverlight5.1
23whitelist ${HOME}/.config/pipelight-widevine
24whitelist ${HOME}/.keysnail.js
25whitelist ${HOME}/.lastpass
26whitelist ${HOME}/.mozilla 14whitelist ${HOME}/.mozilla
27whitelist ${HOME}/.pentadactyl
28whitelist ${HOME}/.pentadactylrc
29whitelist ${HOME}/.pki
30whitelist ${HOME}/.vimperator
31whitelist ${HOME}/.vimperatorrc
32whitelist ${HOME}/.wine-pipelight
33whitelist ${HOME}/.wine-pipelight64
34whitelist ${HOME}/.zotero
35whitelist ${HOME}/dwhelper
36include /etc/firejail/whitelist-common.inc
37 15
38caps.drop all 16# private-etc must first be enabled in firefox-common.profile
39netfilter 17#private-etc abrowser
40nodvd 18
41nonewprivs
42noroot
43notv
44protocol unix,inet,inet6,netlink
45seccomp
46tracelog
47 19
48# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse 20# Redirect
21include /etc/firejail/firefox-common.profile
diff --git a/etc/akregator.profile b/etc/akregator.profile
index f2e5ea341..2c49ef9f0 100644
--- a/etc/akregator.profile
+++ b/etc/akregator.profile
@@ -17,6 +17,7 @@ mkfile ${HOME}/.config/akregatorrc
17mkdir ${HOME}/.local/share/akregator 17mkdir ${HOME}/.local/share/akregator
18whitelist ${HOME}/.config/akregatorrc 18whitelist ${HOME}/.config/akregatorrc
19whitelist ${HOME}/.local/share/akregator 19whitelist ${HOME}/.local/share/akregator
20whitelist ${HOME}/.local/share/kssl
20include /etc/firejail/whitelist-common.inc 21include /etc/firejail/whitelist-common.inc
21 22
22include /etc/firejail/whitelist-var-common.inc 23include /etc/firejail/whitelist-var-common.inc
diff --git a/etc/audacity.profile b/etc/audacity.profile
index e173fa65a..ea1d38132 100644
--- a/etc/audacity.profile
+++ b/etc/audacity.profile
@@ -17,7 +17,7 @@ include /etc/firejail/disable-programs.inc
17include /etc/firejail/whitelist-var-common.inc 17include /etc/firejail/whitelist-var-common.inc
18 18
19caps.drop all 19caps.drop all
20net none 20#net none
21no3d 21no3d
22nodvd 22nodvd
23nogroups 23nogroups
diff --git a/etc/bnox.profile b/etc/bnox.profile
index 4270755c8..3207a2923 100644
--- a/etc/bnox.profile
+++ b/etc/bnox.profile
@@ -7,30 +7,11 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/bnox 8noblacklist ${HOME}/.cache/bnox
9noblacklist ${HOME}/.config/bnox 9noblacklist ${HOME}/.config/bnox
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-programs.inc
14 10
15mkdir ${HOME}/.cache/bnox 11mkdir ${HOME}/.cache/bnox
16mkdir ${HOME}/.config/bnox 12mkdir ${HOME}/.config/bnox
17mkdir ${HOME}/.pki
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.cache/bnox 13whitelist ${HOME}/.cache/bnox
20whitelist ${HOME}/.config/bnox 14whitelist ${HOME}/.config/bnox
21whitelist ${HOME}/.pki
22include /etc/firejail/whitelist-common.inc
23include /etc/firejail/whitelist-var-common.inc
24
25caps.keep sys_chroot,sys_admin
26netfilter
27nodvd
28nogroups
29notv
30shell none
31
32private-dev
33# private-tmp - problems with multiple browser sessions
34 15
35noexec ${HOME} 16# Redirect
36noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/brave.profile b/etc/brave.profile
index 668e8a244..f37ac2a05 100644
--- a/etc/brave.profile
+++ b/etc/brave.profile
@@ -8,31 +8,10 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.config/brave 8noblacklist ${HOME}/.config/brave
9# brave uses gpg for built-in password manager 9# brave uses gpg for built-in password manager
10noblacklist ${HOME}/.gnupg 10noblacklist ${HOME}/.gnupg
11noblacklist ${HOME}/.pki
12
13include /etc/firejail/disable-common.inc
14include /etc/firejail/disable-devel.inc
15include /etc/firejail/disable-programs.inc
16 11
17mkdir ${HOME}/.config/brave 12mkdir ${HOME}/.config/brave
18mkdir ${HOME}/.pki
19whitelist ${DOWNLOADS}
20whitelist ${HOME}/.config/KeePass
21whitelist ${HOME}/.config/brave 13whitelist ${HOME}/.config/brave
22whitelist ${HOME}/.config/keepass 14whitelist ${HOME}/.gnupg
23whitelist ${HOME}/.config/lastpass
24whitelist ${HOME}/.keepass
25whitelist ${HOME}/.lastpass
26whitelist ${HOME}/.pki
27include /etc/firejail/whitelist-common.inc
28
29# caps.drop all
30netfilter
31# nonewprivs
32# noroot
33nodvd
34notv
35# protocol unix,inet,inet6,netlink
36# seccomp
37 15
38disable-mnt 16# Redirect
17include /etc/firejail/chromium-common.profile
diff --git a/etc/chromium-common.profile b/etc/chromium-common.profile
new file mode 100644
index 000000000..5c5215309
--- /dev/null
+++ b/etc/chromium-common.profile
@@ -0,0 +1,32 @@
1# Firejail profile for chromium-common
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/chromium-common.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8noblacklist ${HOME}/.pki
9
10include /etc/firejail/disable-common.inc
11include /etc/firejail/disable-devel.inc
12include /etc/firejail/disable-programs.inc
13
14mkdir ${HOME}/.pki
15whitelist ${DOWNLOADS}
16whitelist ${HOME}/.pki
17include /etc/firejail/whitelist-common.inc
18include /etc/firejail/whitelist-var-common.inc
19
20caps.keep sys_chroot,sys_admin
21netfilter
22nodvd
23nogroups
24notv
25shell none
26
27disable-mnt
28private-dev
29# private-tmp - problems with multiple browser sessions
30
31noexec ${HOME}
32noexec /tmp
diff --git a/etc/chromium.profile b/etc/chromium.profile
index 64d790121..ad9f9af33 100644
--- a/etc/chromium.profile
+++ b/etc/chromium.profile
@@ -8,34 +8,14 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.cache/chromium 8noblacklist ${HOME}/.cache/chromium
9noblacklist ${HOME}/.config/chromium 9noblacklist ${HOME}/.config/chromium
10noblacklist ${HOME}/.config/chromium-flags.conf 10noblacklist ${HOME}/.config/chromium-flags.conf
11noblacklist ${HOME}/.pki
12
13include /etc/firejail/disable-common.inc
14include /etc/firejail/disable-devel.inc
15include /etc/firejail/disable-programs.inc
16 11
17mkdir ${HOME}/.cache/chromium 12mkdir ${HOME}/.cache/chromium
18mkdir ${HOME}/.config/chromium 13mkdir ${HOME}/.config/chromium
19mkdir ${HOME}/.pki
20whitelist ${DOWNLOADS}
21whitelist ${HOME}/.cache/chromium 14whitelist ${HOME}/.cache/chromium
22whitelist ${HOME}/.config/chromium 15whitelist ${HOME}/.config/chromium
23whitelist ${HOME}/.config/chromium-flags.conf 16whitelist ${HOME}/.config/chromium-flags.conf
24whitelist ${HOME}/.pki
25include /etc/firejail/whitelist-common.inc
26include /etc/firejail/whitelist-var-common.inc
27
28caps.keep sys_chroot,sys_admin
29netfilter
30nodvd
31nogroups
32notv
33shell none
34 17
35disable-mnt
36# private-bin chromium,chromium-browser,chromedriver 18# private-bin chromium,chromium-browser,chromedriver
37private-dev
38# private-tmp - problems with multiple browser sessions
39 19
40noexec ${HOME} 20# Redirect
41noexec /tmp 21include /etc/firejail/chromium-common.profile
diff --git a/etc/clementine.profile b/etc/clementine.profile
index a736f7bf9..ccf6f9c97 100644
--- a/etc/clementine.profile
+++ b/etc/clementine.profile
@@ -5,6 +5,7 @@ include /etc/firejail/clementine.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/Clementine
8noblacklist ${HOME}/.config/Clementine 9noblacklist ${HOME}/.config/Clementine
9 10
10include /etc/firejail/disable-common.inc 11include /etc/firejail/disable-common.inc
diff --git a/etc/cliqz.profile b/etc/cliqz.profile
index 086dfa233..4ff96311d 100644
--- a/etc/cliqz.profile
+++ b/etc/cliqz.profile
@@ -7,77 +7,14 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/cliqz 8noblacklist ${HOME}/.cache/cliqz
9noblacklist ${HOME}/.config/cliqz 9noblacklist ${HOME}/.config/cliqz
10noblacklist ${HOME}/.config/okularpartrc
11noblacklist ${HOME}/.config/okularrc
12noblacklist ${HOME}/.config/qpdfview
13noblacklist ${HOME}/.kde/share/apps/okular
14noblacklist ${HOME}/.kde/share/config/okularpartrc
15noblacklist ${HOME}/.kde/share/config/okularrc
16noblacklist ${HOME}/.kde4/share/apps/okular
17noblacklist ${HOME}/.kde4/share/config/okularpartrc
18noblacklist ${HOME}/.kde4/share/config/okularrc
19# noblacklist ${HOME}/.local/share/gnome-shell/extensions
20noblacklist ${HOME}/.local/share/okular
21noblacklist ${HOME}/.local/share/qpdfview
22 10
23noblacklist ${HOME}/.pki 11mkdir ${HOME}/.cache/cliqz
12mkdir ${HOME}/.config/cliqz
13whitelist ${HOME}/.cache/cliqz
14whitelist ${HOME}/.config/cliqz
24 15
25include /etc/firejail/disable-common.inc 16# private-etc must first be enabled in firefox-common.profile
26include /etc/firejail/disable-devel.inc 17#private-etc cliqz
27include /etc/firejail/disable-programs.inc
28 18
29mkdir ${HOME}/.cache/mozilla/firefox 19# Redirect
30mkdir ${HOME}/.mozilla 20include /etc/firejail/firefox-common.profile
31mkdir ${HOME}/.pki
32whitelist ${DOWNLOADS}
33whitelist ${HOME}/.cache/gnome-mplayer/plugin
34whitelist ${HOME}/.cache/mozilla/firefox
35whitelist ${HOME}/.config/gnome-mplayer
36whitelist ${HOME}/.config/okularpartrc
37whitelist ${HOME}/.config/okularrc
38whitelist ${HOME}/.config/pipelight-silverlight5.1
39whitelist ${HOME}/.config/pipelight-widevine
40whitelist ${HOME}/.config/qpdfview
41whitelist ${HOME}/.kde/share/apps/okular
42whitelist ${HOME}/.kde/share/config/okularpartrc
43whitelist ${HOME}/.kde/share/config/okularrc
44whitelist ${HOME}/.kde4/share/apps/okular
45whitelist ${HOME}/.kde4/share/config/okularpartrc
46whitelist ${HOME}/.kde4/share/config/okularrc
47whitelist ${HOME}/.keysnail.js
48whitelist ${HOME}/.lastpass
49whitelist ${HOME}/.local/share/gnome-shell/extensions
50whitelist ${HOME}/.local/share/okular
51whitelist ${HOME}/.local/share/qpdfview
52whitelist ${HOME}/.mozilla
53whitelist ${HOME}/.pentadactyl
54whitelist ${HOME}/.pentadactylrc
55whitelist ${HOME}/.pki
56whitelist ${HOME}/.vimperator
57whitelist ${HOME}/.vimperatorrc
58whitelist ${HOME}/.wine-pipelight
59whitelist ${HOME}/.wine-pipelight64
60whitelist ${HOME}/.zotero
61whitelist ${HOME}/dwhelper
62include /etc/firejail/whitelist-common.inc
63include /etc/firejail/whitelist-var-common.inc
64
65caps.drop all
66netfilter
67nodvd
68nogroups
69nonewprivs
70noroot
71notv
72protocol unix,inet,inet6,netlink
73seccomp
74shell none
75tracelog
76
77# private-bin firefox,which,sh,dbus-launch,dbus-send,env
78private-dev
79# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
80private-tmp
81
82noexec ${HOME}
83noexec /tmp
diff --git a/etc/cyberfox.profile b/etc/cyberfox.profile
index 66cd27461..ce51906ba 100644
--- a/etc/cyberfox.profile
+++ b/etc/cyberfox.profile
@@ -7,67 +7,15 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.8pecxstudios 8noblacklist ${HOME}/.8pecxstudios
9noblacklist ${HOME}/.cache/8pecxstudios 9noblacklist ${HOME}/.cache/8pecxstudios
10noblacklist ${HOME}/.config/okularpartrc
11noblacklist ${HOME}/.config/okularrc
12noblacklist ${HOME}/.config/qpdfview
13noblacklist ${HOME}/.kde/share/apps/okular
14noblacklist ${HOME}/.kde4/share/apps/okular
15noblacklist ${HOME}/.local/share/okular
16noblacklist ${HOME}/.local/share/qpdfview
17noblacklist ${HOME}/.pki
18
19include /etc/firejail/disable-common.inc
20include /etc/firejail/disable-devel.inc
21include /etc/firejail/disable-programs.inc
22 10
23mkdir ${HOME}/.8pecxstudios 11mkdir ${HOME}/.8pecxstudios
24mkdir ${HOME}/.cache/8pecxstudios 12mkdir ${HOME}/.cache/8pecxstudios
25mkdir ${HOME}/.pki
26whitelist ${DOWNLOADS}
27whitelist ${HOME}/.8pecxstudios 13whitelist ${HOME}/.8pecxstudios
28whitelist ${HOME}/.cache/8pecxstudios 14whitelist ${HOME}/.cache/8pecxstudios
29whitelist ${HOME}/.cache/gnome-mplayer/plugin
30whitelist ${HOME}/.config/gnome-mplayer
31whitelist ${HOME}/.config/okularpartrc
32whitelist ${HOME}/.config/okularrc
33whitelist ${HOME}/.config/pipelight-silverlight5.1
34whitelist ${HOME}/.config/pipelight-widevine
35whitelist ${HOME}/.config/qpdfview
36whitelist ${HOME}/.kde/share/apps/okular
37whitelist ${HOME}/.kde4/share/apps/okular
38whitelist ${HOME}/.keysnail.js
39whitelist ${HOME}/.lastpass
40whitelist ${HOME}/.local/share/okular
41whitelist ${HOME}/.local/share/qpdfview
42whitelist ${HOME}/.pentadactyl
43whitelist ${HOME}/.pentadactylrc
44whitelist ${HOME}/.pki
45whitelist ${HOME}/.vimperator
46whitelist ${HOME}/.vimperatorrc
47whitelist ${HOME}/.wine-pipelight
48whitelist ${HOME}/.wine-pipelight64
49whitelist ${HOME}/.zotero
50whitelist ${HOME}/dwhelper
51include /etc/firejail/whitelist-common.inc
52
53caps.drop all
54netfilter
55nodvd
56nogroups
57nonewprivs
58noroot
59notv
60protocol unix,inet,inet6,netlink
61seccomp
62shell none
63tracelog
64 15
65disable-mnt
66# private-bin cyberfox,which,sh,dbus-launch,dbus-send,env 16# private-bin cyberfox,which,sh,dbus-launch,dbus-send,env
67private-dev 17# private-etc must first be enabled in firefox-common.profile
68private-dev 18#private-etc cyberfox
69# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,cyberfox,mime.types,mailcap,asound.conf,pulse
70private-tmp
71 19
72noexec ${HOME} 20# Redirect
73noexec /tmp 21include /etc/firejail/firefox-common.profile
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index 91c554f2e..54a292bc2 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -7,7 +7,10 @@ blacklist-nolog ${HOME}/.*_history
7blacklist-nolog ${HOME}/.adobe 7blacklist-nolog ${HOME}/.adobe
8blacklist-nolog ${HOME}/.cache/greenclip* 8blacklist-nolog ${HOME}/.cache/greenclip*
9blacklist-nolog ${HOME}/.history 9blacklist-nolog ${HOME}/.history
10blacklist-nolog ${HOME}/.kde/share/apps/klipper
11blacklist-nolog ${HOME}/.kde4/share/apps/klipper
10blacklist-nolog ${HOME}/.local/share/fish/fish_history 12blacklist-nolog ${HOME}/.local/share/fish/fish_history
13blacklist-nolog ${HOME}/.local/share/klipper
11blacklist-nolog ${HOME}/.macromedia 14blacklist-nolog ${HOME}/.macromedia
12blacklist-nolog /tmp/clipmenu* 15blacklist-nolog /tmp/clipmenu*
13 16
@@ -42,20 +45,21 @@ blacklist /etc/X11/Xsession.d
42blacklist /etc/xdg/autostart 45blacklist /etc/xdg/autostart
43 46
44# KDE config 47# KDE config
45blacklist ${HOME}/.config/*.notifyrc
46blacklist ${HOME}/.config/khotkeysrc 48blacklist ${HOME}/.config/khotkeysrc
47blacklist ${HOME}/.config/krunnerrc 49blacklist ${HOME}/.config/krunnerrc
50blacklist ${HOME}/.config/ksslcertificatemanager
48blacklist ${HOME}/.config/kwinrc 51blacklist ${HOME}/.config/kwinrc
49blacklist ${HOME}/.config/kwinrulesrc 52blacklist ${HOME}/.config/kwinrulesrc
50blacklist ${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc 53blacklist ${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc
54blacklist ${HOME}/.config/plasmashellrc
51blacklist ${HOME}/.config/plasmavaultrc 55blacklist ${HOME}/.config/plasmavaultrc
52blacklist ${HOME}/.kde/share/apps/konsole 56blacklist ${HOME}/.kde/share/apps/konsole
53blacklist ${HOME}/.kde/share/apps/kwin 57blacklist ${HOME}/.kde/share/apps/kwin
54blacklist ${HOME}/.kde/share/apps/plasma 58blacklist ${HOME}/.kde/share/apps/plasma
55blacklist ${HOME}/.kde/share/apps/solid 59blacklist ${HOME}/.kde/share/apps/solid
56blacklist ${HOME}/.kde/share/config/*.notifyrc
57blacklist ${HOME}/.kde/share/config/khotkeysrc 60blacklist ${HOME}/.kde/share/config/khotkeysrc
58blacklist ${HOME}/.kde/share/config/krunnerrc 61blacklist ${HOME}/.kde/share/config/krunnerrc
62blacklist ${HOME}/.kde/share/config/ksslcertificatemanager
59blacklist ${HOME}/.kde/share/config/kwinrc 63blacklist ${HOME}/.kde/share/config/kwinrc
60blacklist ${HOME}/.kde/share/config/kwinrulesrc 64blacklist ${HOME}/.kde/share/config/kwinrulesrc
61blacklist ${HOME}/.kde/share/config/plasma-desktop-appletsrc 65blacklist ${HOME}/.kde/share/config/plasma-desktop-appletsrc
@@ -63,9 +67,9 @@ blacklist ${HOME}/.kde4/share/apps/konsole
63blacklist ${HOME}/.kde4/share/apps/kwin 67blacklist ${HOME}/.kde4/share/apps/kwin
64blacklist ${HOME}/.kde4/share/apps/plasma 68blacklist ${HOME}/.kde4/share/apps/plasma
65blacklist ${HOME}/.kde4/share/apps/solid 69blacklist ${HOME}/.kde4/share/apps/solid
66blacklist ${HOME}/.kde4/share/config/*.notifyrc
67blacklist ${HOME}/.kde4/share/config/khotkeysrc 70blacklist ${HOME}/.kde4/share/config/khotkeysrc
68blacklist ${HOME}/.kde4/share/config/krunnerrc 71blacklist ${HOME}/.kde4/share/config/krunnerrc
72blacklist ${HOME}/.kde4/share/config/ksslcertificatemanager
69blacklist ${HOME}/.kde4/share/config/kwinrc 73blacklist ${HOME}/.kde4/share/config/kwinrc
70blacklist ${HOME}/.kde4/share/config/kwinrulesrc 74blacklist ${HOME}/.kde4/share/config/kwinrulesrc
71blacklist ${HOME}/.kde4/share/config/plasma-desktop-appletsrc 75blacklist ${HOME}/.kde4/share/config/plasma-desktop-appletsrc
@@ -74,15 +78,29 @@ blacklist ${HOME}/.local/share/konsole
74blacklist ${HOME}/.local/share/kwin 78blacklist ${HOME}/.local/share/kwin
75blacklist ${HOME}/.local/share/plasma 79blacklist ${HOME}/.local/share/plasma
76blacklist ${HOME}/.local/share/solid 80blacklist ${HOME}/.local/share/solid
81read-only ${HOME}/.cache/ksycoca5_*
82read-only ${HOME}/.config/*notifyrc
77read-only ${HOME}/.config/kdeglobals 83read-only ${HOME}/.config/kdeglobals
84read-only ${HOME}/.config/kio_httprc
85read-only ${HOME}/.config/kiorc
78read-only ${HOME}/.config/kioslaverc 86read-only ${HOME}/.config/kioslaverc
87read-only ${HOME}/.config/ksslcablacklist
88read-only ${HOME}/.kde/share/apps/kssl
89read-only ${HOME}/.kde/share/config/*notifyrc
79read-only ${HOME}/.kde/share/config/kdeglobals 90read-only ${HOME}/.kde/share/config/kdeglobals
91read-only ${HOME}/.kde/share/config/kio_httprc
80read-only ${HOME}/.kde/share/config/kioslaverc 92read-only ${HOME}/.kde/share/config/kioslaverc
93read-only ${HOME}/.kde/share/config/ksslcablacklist
81read-only ${HOME}/.kde/share/kde4/services 94read-only ${HOME}/.kde/share/kde4/services
95read-only ${HOME}/.kde4/share/apps/kssl
96read-only ${HOME}/.kde4/share/config/*notifyrc
82read-only ${HOME}/.kde4/share/config/kdeglobals 97read-only ${HOME}/.kde4/share/config/kdeglobals
98read-only ${HOME}/.kde4/share/config/kio_httprc
83read-only ${HOME}/.kde4/share/config/kioslaverc 99read-only ${HOME}/.kde4/share/config/kioslaverc
100read-only ${HOME}/.kde4/share/config/ksslcablacklist
84read-only ${HOME}/.kde4/share/kde4/services 101read-only ${HOME}/.kde4/share/kde4/services
85read-only ${HOME}/.local/share/kservices5 102read-only ${HOME}/.local/share/kservices5
103read-only ${HOME}/.local/share/kssl
86 104
87# kdeinit socket 105# kdeinit socket
88blacklist /run/user/*/kdeinit5__* 106blacklist /run/user/*/kdeinit5__*
@@ -236,6 +254,7 @@ read-only ${HOME}/bin
236blacklist ${HOME}/.local/share/Trash 254blacklist ${HOME}/.local/share/Trash
237 255
238# Write-protection for desktop entries 256# Write-protection for desktop entries
257read-only ${HOME}/.config/menus
239read-only ${HOME}/.local/share/applications 258read-only ${HOME}/.local/share/applications
240 259
241# top secret 260# top secret
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 8cfcaa838..8e72dc47e 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -129,11 +129,15 @@ blacklist ${HOME}/.config/iridium
129blacklist ${HOME}/.config/itch 129blacklist ${HOME}/.config/itch
130blacklist ${HOME}/.config/jd-gui.cfg 130blacklist ${HOME}/.config/jd-gui.cfg
131blacklist ${HOME}/.config/k3brc 131blacklist ${HOME}/.config/k3brc
132blacklist ${HOME}/.config/kaffeinerc
132blacklist ${HOME}/.config/katepartrc 133blacklist ${HOME}/.config/katepartrc
133blacklist ${HOME}/.config/katerc 134blacklist ${HOME}/.config/katerc
134blacklist ${HOME}/.config/kateschemarc 135blacklist ${HOME}/.config/kateschemarc
135blacklist ${HOME}/.config/katesyntaxhighlightingrc 136blacklist ${HOME}/.config/katesyntaxhighlightingrc
136blacklist ${HOME}/.config/katevirc 137blacklist ${HOME}/.config/katevirc
138blacklist ${HOME}/.config/kdenliverc
139blacklist ${HOME}/.config/kgetrc
140blacklist ${HOME}/.config/klipperrc
137blacklist ${HOME}/.config/kritarc 141blacklist ${HOME}/.config/kritarc
138blacklist ${HOME}/.config/kwriterc 142blacklist ${HOME}/.config/kwriterc
139blacklist ${HOME}/.config/kdeconnect 143blacklist ${HOME}/.config/kdeconnect
@@ -258,6 +262,7 @@ blacklist ${HOME}/.java
258blacklist ${HOME}/.jitsi 262blacklist ${HOME}/.jitsi
259blacklist ${HOME}/.kde/share/apps/digikam 263blacklist ${HOME}/.kde/share/apps/digikam
260blacklist ${HOME}/.kde/share/apps/gwenview 264blacklist ${HOME}/.kde/share/apps/gwenview
265blacklist ${HOME}/.kde/share/apps/kaffeine
261blacklist ${HOME}/.kde/share/apps/kcookiejar 266blacklist ${HOME}/.kde/share/apps/kcookiejar
262blacklist ${HOME}/.kde/share/apps/kget 267blacklist ${HOME}/.kde/share/apps/kget
263blacklist ${HOME}/.kde/share/apps/khtml 268blacklist ${HOME}/.kde/share/apps/khtml
@@ -272,9 +277,11 @@ blacklist ${HOME}/.kde/share/config/baloorc
272blacklist ${HOME}/.kde/share/config/digikam 277blacklist ${HOME}/.kde/share/config/digikam
273blacklist ${HOME}/.kde/share/config/gwenviewrc 278blacklist ${HOME}/.kde/share/config/gwenviewrc
274blacklist ${HOME}/.kde/share/config/k3brc 279blacklist ${HOME}/.kde/share/config/k3brc
280blacklist ${HOME}/.kde/share/config/kaffeinerc
275blacklist ${HOME}/.kde/share/config/kcookiejarrc 281blacklist ${HOME}/.kde/share/config/kcookiejarrc
276blacklist ${HOME}/.kde/share/config/kgetrc 282blacklist ${HOME}/.kde/share/config/kgetrc
277blacklist ${HOME}/.kde/share/config/khtmlrc 283blacklist ${HOME}/.kde/share/config/khtmlrc
284blacklist ${HOME}/.kde/share/config/klipperrc
278blacklist ${HOME}/.kde/share/config/konq_history 285blacklist ${HOME}/.kde/share/config/konq_history
279blacklist ${HOME}/.kde/share/config/konqsidebartngrc 286blacklist ${HOME}/.kde/share/config/konqsidebartngrc
280blacklist ${HOME}/.kde/share/config/konquerorrc 287blacklist ${HOME}/.kde/share/config/konquerorrc
@@ -285,6 +292,7 @@ blacklist ${HOME}/.kde/share/config/okularpartrc
285blacklist ${HOME}/.kde/share/config/okularrc 292blacklist ${HOME}/.kde/share/config/okularrc
286blacklist ${HOME}/.kde4/share/apps/digikam 293blacklist ${HOME}/.kde4/share/apps/digikam
287blacklist ${HOME}/.kde4/share/apps/gwenview 294blacklist ${HOME}/.kde4/share/apps/gwenview
295blacklist ${HOME}/.kde4/share/apps/kaffeine
288blacklist ${HOME}/.kde4/share/apps/kcookiejar 296blacklist ${HOME}/.kde4/share/apps/kcookiejar
289blacklist ${HOME}/.kde4/share/apps/kget 297blacklist ${HOME}/.kde4/share/apps/kget
290blacklist ${HOME}/.kde4/share/apps/khtml 298blacklist ${HOME}/.kde4/share/apps/khtml
@@ -298,9 +306,11 @@ blacklist ${HOME}/.kde4/share/config/baloofilerc
298blacklist ${HOME}/.kde4/share/config/digikam 306blacklist ${HOME}/.kde4/share/config/digikam
299blacklist ${HOME}/.kde4/share/config/gwenviewrc 307blacklist ${HOME}/.kde4/share/config/gwenviewrc
300blacklist ${HOME}/.kde4/share/config/k3brc 308blacklist ${HOME}/.kde4/share/config/k3brc
309blacklist ${HOME}/.kde4/share/config/kaffeinerc
301blacklist ${HOME}/.kde4/share/config/kcookiejarrc 310blacklist ${HOME}/.kde4/share/config/kcookiejarrc
302blacklist ${HOME}/.kde4/share/config/kgetrc 311blacklist ${HOME}/.kde4/share/config/kgetrc
303blacklist ${HOME}/.kde4/share/config/khtmlrc 312blacklist ${HOME}/.kde4/share/config/khtmlrc
313blacklist ${HOME}/.kde4/share/config/klipperrc
304blacklist ${HOME}/.kde4/share/config/konq_history 314blacklist ${HOME}/.kde4/share/config/konq_history
305blacklist ${HOME}/.kde4/share/config/konqsidebartngrc 315blacklist ${HOME}/.kde4/share/config/konqsidebartngrc
306blacklist ${HOME}/.kde4/share/config/konquerorrc 316blacklist ${HOME}/.kde4/share/config/konquerorrc
@@ -338,6 +348,7 @@ blacklist ${HOME}/.local/share/clipit
338blacklist ${HOME}/.local/share/data/Mumble 348blacklist ${HOME}/.local/share/data/Mumble
339blacklist ${HOME}/.local/share/data/MusE 349blacklist ${HOME}/.local/share/data/MusE
340blacklist ${HOME}/.local/share/data/MuseScore 350blacklist ${HOME}/.local/share/data/MuseScore
351blacklist ${HOME}/.local/share/data/qBittorrent
341blacklist ${HOME}/.local/share/dino 352blacklist ${HOME}/.local/share/dino
342blacklist ${HOME}/.local/share/dolphin 353blacklist ${HOME}/.local/share/dolphin
343blacklist ${HOME}/.local/share/epiphany 354blacklist ${HOME}/.local/share/epiphany
@@ -354,7 +365,11 @@ blacklist ${HOME}/.local/share/gnome-photos
354blacklist ${HOME}/.local/share/gnome-ring 365blacklist ${HOME}/.local/share/gnome-ring
355blacklist ${HOME}/.local/share/gnome-twitch 366blacklist ${HOME}/.local/share/gnome-twitch
356blacklist ${HOME}/.local/share/gwenview 367blacklist ${HOME}/.local/share/gwenview
368blacklist ${HOME}/.local/share/kaffeine
357blacklist ${HOME}/.local/share/kate 369blacklist ${HOME}/.local/share/kate
370blacklist ${HOME}/.local/share/kdenlive
371blacklist ${HOME}/.local/share/kget
372blacklist ${HOME}/.local/share/krita
358blacklist ${HOME}/.local/share/ktorrentrc 373blacklist ${HOME}/.local/share/ktorrentrc
359blacklist ${HOME}/.local/share/ktorrent 374blacklist ${HOME}/.local/share/ktorrent
360blacklist ${HOME}/.local/share/kwrite 375blacklist ${HOME}/.local/share/kwrite
@@ -416,6 +431,7 @@ blacklist ${HOME}/.passwd-s3fs
416blacklist ${HOME}/.pingus 431blacklist ${HOME}/.pingus
417blacklist ${HOME}/.purple 432blacklist ${HOME}/.purple
418blacklist ${HOME}/.qemu-launcher 433blacklist ${HOME}/.qemu-launcher
434blacklist ${HOME}/.redeclipse
419blacklist ${HOME}/.remmina 435blacklist ${HOME}/.remmina
420blacklist ${HOME}/.repo_.gitconfig.json 436blacklist ${HOME}/.repo_.gitconfig.json
421blacklist ${HOME}/.repoconfig 437blacklist ${HOME}/.repoconfig
@@ -435,6 +451,7 @@ blacklist ${HOME}/.sylpheed-2.0
435blacklist ${HOME}/.synfig 451blacklist ${HOME}/.synfig
436blacklist ${HOME}/.tconn 452blacklist ${HOME}/.tconn
437blacklist ${HOME}/.thunderbird 453blacklist ${HOME}/.thunderbird
454blacklist ${HOME}/.tilp
438blacklist ${HOME}/.tooling 455blacklist ${HOME}/.tooling
439blacklist ${HOME}/.tor-browser-* 456blacklist ${HOME}/.tor-browser-*
440blacklist ${HOME}/.ts3client 457blacklist ${HOME}/.ts3client
@@ -453,6 +470,7 @@ blacklist ${HOME}/.wireshark
453blacklist ${HOME}/.wine64 470blacklist ${HOME}/.wine64
454blacklist ${HOME}/.xiphos 471blacklist ${HOME}/.xiphos
455blacklist ${HOME}/.xmms 472blacklist ${HOME}/.xmms
473blacklist ${HOME}/.xmr-stak
456blacklist ${HOME}/.xonotic 474blacklist ${HOME}/.xonotic
457blacklist ${HOME}/.xpdfrc 475blacklist ${HOME}/.xpdfrc
458blacklist ${HOME}/.zoom 476blacklist ${HOME}/.zoom
@@ -463,6 +481,7 @@ blacklist /tmp/ssh-*
463# ~/.cache directory 481# ~/.cache directory
464blacklist ${HOME}/.cache/0ad 482blacklist ${HOME}/.cache/0ad
465blacklist ${HOME}/.cache/8pecxstudios 483blacklist ${HOME}/.cache/8pecxstudios
484blacklist ${HOME}/.cache/Clementine
466blacklist ${HOME}/.cache/Franz 485blacklist ${HOME}/.cache/Franz
467blacklist ${HOME}/.cache/INRIA 486blacklist ${HOME}/.cache/INRIA
468blacklist ${HOME}/.cache/MusicBrainz 487blacklist ${HOME}/.cache/MusicBrainz
@@ -475,6 +494,8 @@ blacklist ${HOME}/.cache/chromium
475blacklist ${HOME}/.cache/chromium-dev 494blacklist ${HOME}/.cache/chromium-dev
476blacklist ${HOME}/.cache/cliqz 495blacklist ${HOME}/.cache/cliqz
477blacklist ${HOME}/.cache/darktable 496blacklist ${HOME}/.cache/darktable
497blacklist ${HOME}/.cache/discover
498blacklist ${HOME}/.cache/dolphin
478blacklist ${HOME}/.cache/epiphany 499blacklist ${HOME}/.cache/epiphany
479blacklist ${HOME}/.cache/evolution 500blacklist ${HOME}/.cache/evolution
480blacklist ${HOME}/.cache/fossamail 501blacklist ${HOME}/.cache/fossamail
@@ -488,6 +509,13 @@ blacklist ${HOME}/.cache/icedove
488blacklist ${HOME}/.cache/INRIA/Natron 509blacklist ${HOME}/.cache/INRIA/Natron
489blacklist ${HOME}/.cache/inox 510blacklist ${HOME}/.cache/inox
490blacklist ${HOME}/.cache/iridium 511blacklist ${HOME}/.cache/iridium
512blacklist ${HOME}/.cache/kdenlive
513blacklist ${HOME}/.cache/kinfocenter
514blacklist ${HOME}/.cache/krunner
515blacklist ${HOME}/.cache/kscreenlocker_greet
516blacklist ${HOME}/.cache/ksmserver-logout-greeter
517blacklist ${HOME}/.cache/ksplashqml
518blacklist ${HOME}/.cache/kwin
491blacklist ${HOME}/.cache/libgweather 519blacklist ${HOME}/.cache/libgweather
492blacklist ${HOME}/.cache/liferea 520blacklist ${HOME}/.cache/liferea
493blacklist ${HOME}/.cache/midori 521blacklist ${HOME}/.cache/midori
@@ -496,17 +524,20 @@ blacklist ${HOME}/.cache/mozilla
496blacklist ${HOME}/.cache/mutt 524blacklist ${HOME}/.cache/mutt
497blacklist ${HOME}/.cache/nheko/nheko 525blacklist ${HOME}/.cache/nheko/nheko
498blacklist ${HOME}/.cache/netsurf 526blacklist ${HOME}/.cache/netsurf
527blacklist ${HOME}/.cache/okular
499blacklist ${HOME}/.cache/opera 528blacklist ${HOME}/.cache/opera
500blacklist ${HOME}/.cache/opera-beta 529blacklist ${HOME}/.cache/opera-beta
501blacklist ${HOME}/.cache/org.gnome.Books 530blacklist ${HOME}/.cache/org.gnome.Books
502blacklist ${HOME}/.cache/pdfmod 531blacklist ${HOME}/.cache/pdfmod
503blacklist ${HOME}/.cache/peek 532blacklist ${HOME}/.cache/peek
533blacklist ${HOME}/.cache/plasmashell
504blacklist ${HOME}/.cache/qBittorrent 534blacklist ${HOME}/.cache/qBittorrent
505blacklist ${HOME}/.cache/qupzilla 535blacklist ${HOME}/.cache/qupzilla
506blacklist ${HOME}/.cache/qutebrowser 536blacklist ${HOME}/.cache/qutebrowser
507blacklist ${HOME}/.cache/simple-scan 537blacklist ${HOME}/.cache/simple-scan
508blacklist ${HOME}/.cache/slimjet 538blacklist ${HOME}/.cache/slimjet
509blacklist ${HOME}/.cache/spotify 539blacklist ${HOME}/.cache/spotify
540blacklist ${HOME}/.cache/systemsettings
510blacklist ${HOME}/.cache/telepathy 541blacklist ${HOME}/.cache/telepathy
511blacklist ${HOME}/.cache/thunderbird 542blacklist ${HOME}/.cache/thunderbird
512blacklist ${HOME}/.cache/torbrowser 543blacklist ${HOME}/.cache/torbrowser
diff --git a/etc/dnox.profile b/etc/dnox.profile
index d6626c048..505884ca6 100644
--- a/etc/dnox.profile
+++ b/etc/dnox.profile
@@ -7,30 +7,11 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/dnox 8noblacklist ${HOME}/.cache/dnox
9noblacklist ${HOME}/.config/dnox 9noblacklist ${HOME}/.config/dnox
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-programs.inc
14 10
15mkdir ${HOME}/.cache/dnox 11mkdir ${HOME}/.cache/dnox
16mkdir ${HOME}/.config/dnox 12mkdir ${HOME}/.config/dnox
17mkdir ${HOME}/.pki
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.cache/dnox 13whitelist ${HOME}/.cache/dnox
20whitelist ${HOME}/.config/dnox 14whitelist ${HOME}/.config/dnox
21whitelist ${HOME}/.pki
22include /etc/firejail/whitelist-common.inc
23include /etc/firejail/whitelist-var-common.inc
24
25caps.keep sys_chroot,sys_admin
26netfilter
27nodvd
28nogroups
29notv
30shell none
31
32private-dev
33# private-tmp - problems with multiple browser sessions
34 15
35noexec ${HOME} 16# Redirect
36noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/dolphin.profile b/etc/dolphin.profile
index c1604826e..ce167b7a7 100644
--- a/etc/dolphin.profile
+++ b/etc/dolphin.profile
@@ -8,7 +8,8 @@ include /etc/firejail/globals.local
8# warning: firejail is currently not effectively constraining dolphin since used services are started by kdeinit5 8# warning: firejail is currently not effectively constraining dolphin since used services are started by kdeinit5
9 9
10noblacklist ${HOME}/.local/share/Trash 10noblacklist ${HOME}/.local/share/Trash
11# noblacklist ${HOME}/.config/dolphinrc - diable-programs.inc is disabled, see below 11# noblacklist ${HOME}/.cache/dolphin - disable-programs.inc is disabled, see below
12# noblacklist ${HOME}/.config/dolphinrc
12# noblacklist ${HOME}/.local/share/dolphin 13# noblacklist ${HOME}/.local/share/dolphin
13 14
14include /etc/firejail/disable-common.inc 15include /etc/firejail/disable-common.inc
diff --git a/etc/dragon.profile b/etc/dragon.profile
index 76544010f..6fa6ec65e 100644
--- a/etc/dragon.profile
+++ b/etc/dragon.profile
@@ -16,7 +16,6 @@ include /etc/firejail/whitelist-var-common.inc
16 16
17caps.drop all 17caps.drop all
18netfilter 18netfilter
19nodvd
20nogroups 19nogroups
21nonewprivs 20nonewprivs
22noroot 21noroot
diff --git a/etc/enox.profile b/etc/enox.profile
new file mode 100644
index 000000000..cc5403719
--- /dev/null
+++ b/etc/enox.profile
@@ -0,0 +1,36 @@
1# Firejail profile for dnox
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/enox.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8noblacklist ${HOME}/.cache/Enox
9noblacklist ${HOME}/.config/Enox
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-programs.inc
14
15mkdir ${HOME}/.cache/dnox
16mkdir ${HOME}/.config/dnox
17mkdir ${HOME}/.pki
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.cache/Enox
20whitelist ${HOME}/.config/Enox
21whitelist ${HOME}/.pki
22include /etc/firejail/whitelist-common.inc
23include /etc/firejail/whitelist-var-common.inc
24
25caps.keep sys_chroot,sys_admin
26netfilter
27nodvd
28nogroups
29notv
30shell none
31
32private-dev
33# private-tmp - problems with multiple browser sessions
34
35noexec ${HOME}
36noexec /tmp
diff --git a/etc/firefox-common-addons.inc b/etc/firefox-common-addons.inc
new file mode 100644
index 000000000..b237c3c05
--- /dev/null
+++ b/etc/firefox-common-addons.inc
@@ -0,0 +1,55 @@
1# This file is overwritten during software install.
2# Persistent customizations should go in a .local file.
3include /etc/firejail/firefox-common-addons.local
4
5noblacklist ${HOME}/.config/kgetrc
6noblacklist ${HOME}/.config/okularpartrc
7noblacklist ${HOME}/.config/okularrc
8noblacklist ${HOME}/.config/qpdfview
9noblacklist ${HOME}/.kde/share/apps/kget
10noblacklist ${HOME}/.kde/share/apps/okular
11noblacklist ${HOME}/.kde/share/config/kgetrc
12noblacklist ${HOME}/.kde/share/config/okularpartrc
13noblacklist ${HOME}/.kde/share/config/okularrc
14noblacklist ${HOME}/.kde4/share/apps/kget
15noblacklist ${HOME}/.kde4/share/apps/okular
16noblacklist ${HOME}/.kde4/share/config/kgetrc
17noblacklist ${HOME}/.kde4/share/config/okularpartrc
18noblacklist ${HOME}/.kde4/share/config/okularrc
19# noblacklist ${HOME}/.local/share/gnome-shell/extensions
20noblacklist ${HOME}/.local/share/kget
21noblacklist ${HOME}/.local/share/okular
22noblacklist ${HOME}/.local/share/qpdfview
23
24whitelist ${HOME}/.cache/gnome-mplayer/plugin
25whitelist ${HOME}/.config/gnome-mplayer
26whitelist ${HOME}/.config/kgetrc
27whitelist ${HOME}/.config/okularpartrc
28whitelist ${HOME}/.config/okularrc
29whitelist ${HOME}/.config/pipelight-silverlight5.1
30whitelist ${HOME}/.config/pipelight-widevine
31whitelist ${HOME}/.config/qpdfview
32whitelist ${HOME}/.kde/share/apps/kget
33whitelist ${HOME}/.kde/share/apps/okular
34whitelist ${HOME}/.kde/share/config/kgetrc
35whitelist ${HOME}/.kde/share/config/okularpartrc
36whitelist ${HOME}/.kde/share/config/okularrc
37whitelist ${HOME}/.kde4/share/apps/kget
38whitelist ${HOME}/.kde4/share/apps/okular
39whitelist ${HOME}/.kde4/share/config/kgetrc
40whitelist ${HOME}/.kde4/share/config/okularpartrc
41whitelist ${HOME}/.kde4/share/config/okularrc
42whitelist ${HOME}/.keysnail.js
43whitelist ${HOME}/.lastpass
44whitelist ${HOME}/.local/share/gnome-shell/extensions
45whitelist ${HOME}/.local/share/kget
46whitelist ${HOME}/.local/share/okular
47whitelist ${HOME}/.local/share/qpdfview
48whitelist ${HOME}/.pentadactyl
49whitelist ${HOME}/.pentadactylrc
50whitelist ${HOME}/.vimperator
51whitelist ${HOME}/.vimperatorrc
52whitelist ${HOME}/.wine-pipelight
53whitelist ${HOME}/.wine-pipelight64
54whitelist ${HOME}/.zotero
55whitelist ${HOME}/dwhelper
diff --git a/etc/firefox-common.profile b/etc/firefox-common.profile
new file mode 100644
index 000000000..0c4271edc
--- /dev/null
+++ b/etc/firefox-common.profile
@@ -0,0 +1,44 @@
1# Firejail profile for firefox-common
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/firefox-common.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8# uncomment the following line to allow access to common programs/addons/plugins
9#include /etc/firejail/firefox-common-addons.inc
10
11noblacklist ${HOME}/.pki
12
13include /etc/firejail/disable-common.inc
14include /etc/firejail/disable-devel.inc
15include /etc/firejail/disable-programs.inc
16
17mkdir ${HOME}/.pki
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.pki
20include /etc/firejail/whitelist-common.inc
21include /etc/firejail/whitelist-var-common.inc
22
23caps.drop all
24# machine-id breaks pulse audio; it should work fine in setups where sound is not required
25#machine-id
26netfilter
27nodvd
28nogroups
29nonewprivs
30noroot
31notv
32protocol unix,inet,inet6,netlink
33seccomp
34shell none
35tracelog
36
37disable-mnt
38private-dev
39# private-etc below works fine on most distributions. There are some problems on CentOS.
40#private-etc ca-certificates,ssl,machine-id,dconf,selinux,passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,mime.types,mailcap,asound.conf,pulse,pki,crypto-policies
41private-tmp
42
43noexec ${HOME}
44noexec /tmp
diff --git a/etc/firefox.profile b/etc/firefox.profile
index 079cb1536..0ab6a6141 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -6,90 +6,17 @@ include /etc/firejail/firefox.local
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/mozilla 8noblacklist ${HOME}/.cache/mozilla
9noblacklist ${HOME}/.config/okularpartrc
10noblacklist ${HOME}/.config/okularrc
11noblacklist ${HOME}/.config/qpdfview
12noblacklist ${HOME}/.kde/share/apps/kget
13noblacklist ${HOME}/.kde/share/apps/okular
14noblacklist ${HOME}/.kde/share/config/kgetrc
15noblacklist ${HOME}/.kde/share/config/okularpartrc
16noblacklist ${HOME}/.kde/share/config/okularrc
17noblacklist ${HOME}/.kde4/share/apps/kget
18noblacklist ${HOME}/.kde4/share/apps/okular
19noblacklist ${HOME}/.kde4/share/config/kgetrc
20noblacklist ${HOME}/.kde4/share/config/okularpartrc
21noblacklist ${HOME}/.kde4/share/config/okularrc
22# noblacklist ${HOME}/.local/share/gnome-shell/extensions
23noblacklist ${HOME}/.local/share/okular
24noblacklist ${HOME}/.local/share/qpdfview
25noblacklist ${HOME}/.mozilla 9noblacklist ${HOME}/.mozilla
26noblacklist ${HOME}/.pki
27
28include /etc/firejail/disable-common.inc
29include /etc/firejail/disable-devel.inc
30include /etc/firejail/disable-programs.inc
31 10
32mkdir ${HOME}/.cache/mozilla/firefox 11mkdir ${HOME}/.cache/mozilla/firefox
33mkdir ${HOME}/.mozilla 12mkdir ${HOME}/.mozilla
34mkdir ${HOME}/.pki
35whitelist ${DOWNLOADS}
36whitelist ${HOME}/.cache/gnome-mplayer/plugin
37whitelist ${HOME}/.cache/mozilla/firefox 13whitelist ${HOME}/.cache/mozilla/firefox
38whitelist ${HOME}/.config/gnome-mplayer
39whitelist ${HOME}/.config/okularpartrc
40whitelist ${HOME}/.config/okularrc
41whitelist ${HOME}/.config/pipelight-silverlight5.1
42whitelist ${HOME}/.config/pipelight-widevine
43whitelist ${HOME}/.config/qpdfview
44whitelist ${HOME}/.kde/share/apps/kget
45whitelist ${HOME}/.kde/share/apps/okular
46whitelist ${HOME}/.kde/share/config/kgetrc
47whitelist ${HOME}/.kde/share/config/okularpartrc
48whitelist ${HOME}/.kde/share/config/okularrc
49whitelist ${HOME}/.kde4/share/apps/kget
50whitelist ${HOME}/.kde4/share/apps/okular
51whitelist ${HOME}/.kde4/share/config/kgetrc
52whitelist ${HOME}/.kde4/share/config/okularpartrc
53whitelist ${HOME}/.kde4/share/config/okularrc
54whitelist ${HOME}/.keysnail.js
55whitelist ${HOME}/.lastpass
56whitelist ${HOME}/.local/share/gnome-shell/extensions
57whitelist ${HOME}/.local/share/okular
58whitelist ${HOME}/.local/share/qpdfview
59whitelist ${HOME}/.mozilla 14whitelist ${HOME}/.mozilla
60whitelist ${HOME}/.pentadactyl
61whitelist ${HOME}/.pentadactylrc
62whitelist ${HOME}/.pki
63whitelist ${HOME}/.vimperator
64whitelist ${HOME}/.vimperatorrc
65whitelist ${HOME}/.wine-pipelight
66whitelist ${HOME}/.wine-pipelight64
67whitelist ${HOME}/.zotero
68whitelist ${HOME}/dwhelper
69include /etc/firejail/whitelist-common.inc
70include /etc/firejail/whitelist-var-common.inc
71
72caps.drop all
73# machine-id breaks pulse audio; it should work fine in setups where sound is not required
74#machine-id
75netfilter
76nodvd
77nogroups
78nonewprivs
79noroot
80notv
81protocol unix,inet,inet6,netlink
82seccomp
83shell none
84tracelog
85 15
86disable-mnt
87# firefox requires a shell to launch on Arch. 16# firefox requires a shell to launch on Arch.
88# private-bin firefox,which,sh,dbus-launch,dbus-send,env,bash 17#private-bin firefox,which,sh,dbus-launch,dbus-send,env,bash
89private-dev 18# private-etc must first be enabled in firefox-common.profile
90# private-etc below works fine on most distributions. There are some problems on CentOS. 19#private-etc firefox
91# private-etc iceweasel,ca-certificates,ssl,machine-id,dconf,selinux,passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse,pki,crypto-policies
92private-tmp
93 20
94noexec ${HOME} 21# Redirect
95noexec /tmp 22include /etc/firejail/firefox-common.profile
diff --git a/etc/firejail-default b/etc/firejail-default
index eb50d6c65..859f8683a 100644
--- a/etc/firejail-default
+++ b/etc/firejail-default
@@ -8,38 +8,66 @@
8# We don't know if this definition is available outside Debian and Ubuntu, so 8# We don't know if this definition is available outside Debian and Ubuntu, so
9# we declare our own here. 9# we declare our own here.
10########## 10##########
11@{PID}={[1-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9]} 11@{PID}={[1-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9]}
12 12
13profile firejail-default flags=(attach_disconnected,mediate_deleted) { 13profile firejail-default flags=(attach_disconnected,mediate_deleted) {
14 14
15########## 15##########
16# D-Bus is a huge security hole. Uncomment this line if you need D-Bus 16# D-Bus is a huge security hole. Uncomment those lines if you need D-Bus
17# functionality. 17# functionality.
18########## 18##########
19##include <abstractions/dbus-strict>
20##include <abstractions/dbus-session-strict>
19#dbus, 21#dbus,
20 22
21########## 23##########
22# Mask /proc and /sys information leakage. The configuration here is barely 24# Line starting with /run/firejail/mnt/oroot deal with --overlay sandboxes
23# enough to run "top" or "ps aux".
24########## 25##########
25/ r, 26/ r,
26/{usr,bin,sbin,dev,etc,home,root,lib,media,mnt,opt,srv,tmp,var}** mrwlk, 27/{usr,bin,sbin,dev,etc,home,root,lib,media,mnt,opt,srv,tmp,var}** mrwlk,
28/run/firejail/mnt/oroot/{usr,bin,sbin,dev,etc,home,root,lib,media,mnt,opt,srv,tmp,var}** mrwlk,
29
27/{,var/}run/ r, 30/{,var/}run/ r,
28/{,var/}run/** r, 31/{,var/}run/** r,
29/{,var/}run/user/**/dconf/ rw, 32/run/firejail/mnt/oroot/{,var/}run/ r,
30/{,var/}run/user/**/dconf/user rw, 33/run/firejail/mnt/oroot/{,var/}run/** r,
31/{,var/}run/user/**/pulse/ rw, 34
32/{,var/}run/user/**/pulse/** rw, 35owner /{,var/}run/user/**/dconf/ rw,
33/{,var/}run/user/**/*.slave-socket rwl, 36owner /{,var/}run/user/**/dconf/user rw,
34/{,var/}run/user/**/#@{PID} rw, 37owner /{,var/}run/user/**/pulse/ rw,
35/{,var/}run/user/**/orcexec.* rwkm, 38owner /{,var/}run/user/**/pulse/** rw,
39owner /{,var/}run/user/**/*.slave-socket rwl,
40owner /{,var/}run/user/**/#@{PID} rw,
41owner /{,var/}run/user/**/orcexec.* rwkm,
42owner /run/firejail/mnt/oroot/{,var/}run/user/**/dconf/ rw,
43owner /run/firejail/mnt/oroot/{,var/}run/user/**/dconf/user rw,
44owner /run/firejail/mnt/oroot/{,var/}run/user/**/pulse/ rw,
45owner /run/firejail/mnt/oroot/{,var/}run/user/**/pulse/** rw,
46owner /run/firejail/mnt/oroot/{,var/}run/user/**/*.slave-socket rwl,
47owner /run/firejail/mnt/oroot/{,var/}run/user/**/#@{PID} rw,
48owner /run/firejail/mnt/oroot/{,var/}run/user/**/orcexec.* rwkm,
49
36/{,var/}run/firejail/mnt/fslogger r, 50/{,var/}run/firejail/mnt/fslogger r,
37/{,var/}run/firejail/appimage r, 51/{,var/}run/firejail/appimage r,
38/{,var/}run/firejail/appimage/** r, 52/{,var/}run/firejail/appimage/** r,
39/{,var/}run/firejail/appimage/** ix, 53/{,var/}run/firejail/appimage/** ix,
54/run/firejail/mnt/oroot/{,var/}run/firejail/mnt/fslogger r,
55/run/firejail/mnt/oroot/{,var/}run/firejail/appimage r,
56/run/firejail/mnt/oroot/{,var/}run/firejail/appimage/** r,
57/run/firejail/mnt/oroot/{,var/}run/firejail/appimage/** ix,
58
40/{run,dev}/shm/ r, 59/{run,dev}/shm/ r,
41/{run,dev}/shm/** rmwk, 60owner /{run,dev}/shm/** rmwk,
61/run/firejail/mnt/oroot/{run,dev}/shm/ r,
62owner /run/firejail/mnt/oroot/{run,dev}/shm/** rmwk,
42 63
64# Needed for wine
65/{,var/}run/firejail/profile/@{PID} w,
66
67##########
68# Mask /proc and /sys information leakage. The configuration here is barely
69# enough to run "top" or "ps aux".
70##########
43/proc/ r, 71/proc/ r,
44/proc/meminfo r, 72/proc/meminfo r,
45/proc/cpuinfo r, 73/proc/cpuinfo r,
@@ -49,6 +77,7 @@ profile firejail-default flags=(attach_disconnected,mediate_deleted) {
49/proc/stat r, 77/proc/stat r,
50/proc/sys/kernel/pid_max r, 78/proc/sys/kernel/pid_max r,
51/proc/sys/kernel/shmmax r, 79/proc/sys/kernel/shmmax r,
80/proc/sys/kernel/yama/ptrace_scope r,
52/proc/sys/vm/overcommit_memory r, 81/proc/sys/vm/overcommit_memory r,
53/proc/sys/vm/overcommit_ratio r, 82/proc/sys/vm/overcommit_ratio r,
54/proc/sys/kernel/random/uuid r, 83/proc/sys/kernel/random/uuid r,
@@ -70,15 +99,22 @@ profile firejail-default flags=(attach_disconnected,mediate_deleted) {
70/proc/@{PID}/statm r, 99/proc/@{PID}/statm r,
71/proc/@{PID}/status r, 100/proc/@{PID}/status r,
72/proc/@{PID}/task/@{PID}/stat r, 101/proc/@{PID}/task/@{PID}/stat r,
102/proc/@{PID}/task/@{PID}/status r,
73/proc/@{PID}/maps r, 103/proc/@{PID}/maps r,
104/proc/@{PID}/mem r,
74/proc/@{PID}/mounts r, 105/proc/@{PID}/mounts r,
75/proc/@{PID}/mountinfo r, 106/proc/@{PID}/mountinfo r,
107deny /proc/@{PID}/oom_adj w,
76/proc/@{PID}/oom_score_adj r, 108/proc/@{PID}/oom_score_adj r,
109deny /proc/@{PID}/oom_score_adj w,
77/proc/@{PID}/auxv r, 110/proc/@{PID}/auxv r,
78/proc/@{PID}/net/dev r, 111/proc/@{PID}/net/dev r,
79/proc/@{PID}/loginuid r, 112/proc/@{PID}/loginuid r,
80/proc/@{PID}/environ r, 113/proc/@{PID}/environ r,
81 114
115# Needed by chromium crash handler. Uncomment if you need it.
116#ptrace (trace tracedby),
117
82########## 118##########
83# Allow running programs only from well-known system directories. If you need 119# Allow running programs only from well-known system directories. If you need
84# to run programs from your home directory, uncomment /home line. 120# to run programs from your home directory, uncomment /home line.
@@ -96,6 +132,23 @@ profile firejail-default flags=(attach_disconnected,mediate_deleted) {
96/opt/** r, 132/opt/** r,
97/opt/** ix, 133/opt/** ix,
98#/home/** ix, 134#/home/** ix,
135/run/firejail/mnt/oroot/lib/** ix,
136/run/firejail/mnt/oroot/lib64/** ix,
137/run/firejail/mnt/oroot/bin/** ix,
138/run/firejail/mnt/oroot/sbin/** ix,
139/run/firejail/mnt/oroot/usr/bin/** ix,
140/run/firejail/mnt/oroot/usr/sbin/** ix,
141/run/firejail/mnt/oroot/usr/local/** ix,
142/run/firejail/mnt/oroot/usr/lib/** ix,
143/run/firejail/mnt/oroot/usr/games/** ix,
144/run/firejail/mnt/oroot/opt/ r,
145/run/firejail/mnt/oroot/opt/** r,
146/run/firejail/mnt/oroot/opt/** ix,
147
148##########
149# Allow acces to cups printing socket
150##########
151/run/cups/cups.sock w,
99 152
100########## 153##########
101# Allow all networking functionality, and control it from Firejail. 154# Allow all networking functionality, and control it from Firejail.
diff --git a/etc/flashpeak-slimjet.profile b/etc/flashpeak-slimjet.profile
index d9be8b9c5..63f9d19a9 100644
--- a/etc/flashpeak-slimjet.profile
+++ b/etc/flashpeak-slimjet.profile
@@ -5,35 +5,13 @@ include /etc/firejail/flashpeak-slimjet.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8# This is a whitelisted profile, the internal browser sandbox
9# is disabled because it requires sudo password. The command
10# to run it is as follows:
11# firejail flashpeak-slimjet --no-sandbox
12
13noblacklist ${HOME}/.cache/slimjet 8noblacklist ${HOME}/.cache/slimjet
14noblacklist ${HOME}/.config/slimjet 9noblacklist ${HOME}/.config/slimjet
15noblacklist ${HOME}/.pki
16
17include /etc/firejail/disable-common.inc
18include /etc/firejail/disable-devel.inc
19include /etc/firejail/disable-programs.inc
20 10
21mkdir ${HOME}/.cache/slimjet 11mkdir ${HOME}/.cache/slimjet
22mkdir ${HOME}/.config/slimjet 12mkdir ${HOME}/.config/slimjet
23mkdir ${HOME}/.pki
24whitelist ${DOWNLOADS}
25whitelist ${HOME}/.cache/slimjet 13whitelist ${HOME}/.cache/slimjet
26whitelist ${HOME}/.config/slimjet 14whitelist ${HOME}/.config/slimjet
27whitelist ${HOME}/.pki
28include /etc/firejail/whitelist-common.inc
29
30caps.drop all
31netfilter
32nodvd
33nonewprivs
34noroot
35notv
36protocol unix,inet,inet6,netlink
37seccomp
38 15
39disable-mnt 16# Redirect
17include /etc/firejail/chromium-common.profile
diff --git a/etc/google-chrome-beta.profile b/etc/google-chrome-beta.profile
index 9c7306b85..ab16558ea 100644
--- a/etc/google-chrome-beta.profile
+++ b/etc/google-chrome-beta.profile
@@ -7,30 +7,11 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/google-chrome-beta 8noblacklist ${HOME}/.cache/google-chrome-beta
9noblacklist ${HOME}/.config/google-chrome-beta 9noblacklist ${HOME}/.config/google-chrome-beta
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-programs.inc
15 10
16mkdir ${HOME}/.cache/google-chrome-beta 11mkdir ${HOME}/.cache/google-chrome-beta
17mkdir ${HOME}/.config/google-chrome-beta 12mkdir ${HOME}/.config/google-chrome-beta
18mkdir ${HOME}/.pki
19whitelist ${DOWNLOADS}
20whitelist ${HOME}/.cache/google-chrome-beta 13whitelist ${HOME}/.cache/google-chrome-beta
21whitelist ${HOME}/.config/google-chrome-beta 14whitelist ${HOME}/.config/google-chrome-beta
22whitelist ${HOME}/.pki
23include /etc/firejail/whitelist-common.inc
24
25caps.keep sys_chroot,sys_admin
26netfilter
27nodvd
28nogroups
29notv
30shell none
31
32private-dev
33# private-tmp - problems with multiple browser sessions
34 15
35noexec ${HOME} 16# Redirect
36noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/google-chrome-unstable.profile b/etc/google-chrome-unstable.profile
index bb05b3e99..b7d0eccf3 100644
--- a/etc/google-chrome-unstable.profile
+++ b/etc/google-chrome-unstable.profile
@@ -7,30 +7,11 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/google-chrome-unstable 8noblacklist ${HOME}/.cache/google-chrome-unstable
9noblacklist ${HOME}/.config/google-chrome-unstable 9noblacklist ${HOME}/.config/google-chrome-unstable
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-programs.inc
15 10
16mkdir ${HOME}/.cache/google-chrome-unstable 11mkdir ${HOME}/.cache/google-chrome-unstable
17mkdir ${HOME}/.config/google-chrome-unstable 12mkdir ${HOME}/.config/google-chrome-unstable
18mkdir ${HOME}/.pki
19whitelist ${DOWNLOADS}
20whitelist ${HOME}/.cache/google-chrome-unstable 13whitelist ${HOME}/.cache/google-chrome-unstable
21whitelist ${HOME}/.config/google-chrome-unstable 14whitelist ${HOME}/.config/google-chrome-unstable
22whitelist ${HOME}/.pki
23include /etc/firejail/whitelist-common.inc
24
25caps.keep sys_chroot,sys_admin
26netfilter
27nodvd
28nogroups
29notv
30shell none
31
32private-dev
33# private-tmp - problems with multiple browser sessions
34 15
35noexec ${HOME} 16# Redirect
36noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/google-chrome.profile b/etc/google-chrome.profile
index 19ebfa974..6e44190ae 100644
--- a/etc/google-chrome.profile
+++ b/etc/google-chrome.profile
@@ -7,32 +7,11 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/google-chrome 8noblacklist ${HOME}/.cache/google-chrome
9noblacklist ${HOME}/.config/google-chrome 9noblacklist ${HOME}/.config/google-chrome
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-programs.inc
15 10
16mkdir ${HOME}/.cache/google-chrome 11mkdir ${HOME}/.cache/google-chrome
17mkdir ${HOME}/.config/google-chrome 12mkdir ${HOME}/.config/google-chrome
18mkdir ${HOME}/.pki
19whitelist ${DOWNLOADS}
20whitelist ${HOME}/.cache/google-chrome 13whitelist ${HOME}/.cache/google-chrome
21whitelist ${HOME}/.config/google-chrome 14whitelist ${HOME}/.config/google-chrome
22whitelist ${HOME}/.pki
23include /etc/firejail/whitelist-common.inc
24include /etc/firejail/whitelist-var-common.inc
25
26caps.keep sys_chroot,sys_admin
27netfilter
28nodvd
29nogroups
30notv
31shell none
32
33disable-mnt
34private-dev
35# private-tmp - problems with multiple browser sessions
36 15
37noexec ${HOME} 16# Redirect
38noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/gwenview.profile b/etc/gwenview.profile
index 8ad3ac5f3..58e059087 100644
--- a/etc/gwenview.profile
+++ b/etc/gwenview.profile
@@ -39,7 +39,7 @@ tracelog
39 39
40private-bin gwenview,gimp*,kbuildsycoca4,kdeinit4 40private-bin gwenview,gimp*,kbuildsycoca4,kdeinit4
41private-dev 41private-dev
42# private-etc X11 42private-etc fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,machine-id,xdg
43 43
44# memory-deny-write-execute 44# memory-deny-write-execute
45noexec ${HOME} 45noexec ${HOME}
diff --git a/etc/hexchat.profile b/etc/hexchat.profile
index 634ced575..02f8e9eeb 100644
--- a/etc/hexchat.profile
+++ b/etc/hexchat.profile
@@ -6,6 +6,7 @@ include /etc/firejail/hexchat.local
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.config/hexchat 8noblacklist ${HOME}/.config/hexchat
9noblacklist /usr/share/perl*
9# noblacklist /usr/lib/python2* 10# noblacklist /usr/lib/python2*
10# noblacklist /usr/lib/python3* 11# noblacklist /usr/lib/python3*
11 12
diff --git a/etc/icecat.profile b/etc/icecat.profile
index 9e5526c95..42e762c21 100644
--- a/etc/icecat.profile
+++ b/etc/icecat.profile
@@ -7,46 +7,14 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/mozilla 8noblacklist ${HOME}/.cache/mozilla
9noblacklist ${HOME}/.mozilla 9noblacklist ${HOME}/.mozilla
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-programs.inc
15 10
16mkdir ${HOME}/.cache/mozilla/icecat 11mkdir ${HOME}/.cache/mozilla/icecat
17mkdir ${HOME}/.mozilla 12mkdir ${HOME}/.mozilla
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.cache/gnome-mplayer/plugin
20whitelist ${HOME}/.cache/mozilla/icecat 13whitelist ${HOME}/.cache/mozilla/icecat
21whitelist ${HOME}/.config/gnome-mplayer
22whitelist ${HOME}/.config/pipelight-silverlight5.1
23whitelist ${HOME}/.config/pipelight-widevine
24whitelist ${HOME}/.keysnail.js
25whitelist ${HOME}/.lastpass
26whitelist ${HOME}/.mozilla 14whitelist ${HOME}/.mozilla
27whitelist ${HOME}/.pentadactyl
28whitelist ${HOME}/.pentadactylrc
29whitelist ${HOME}/.pki
30whitelist ${HOME}/.vimperator
31whitelist ${HOME}/.vimperatorrc
32whitelist ${HOME}/.wine-pipelight
33whitelist ${HOME}/.wine-pipelight64
34whitelist ${HOME}/.zotero
35whitelist ${HOME}/dwhelper
36include /etc/firejail/whitelist-common.inc
37
38caps.drop all
39netfilter
40nodvd
41nonewprivs
42noroot
43notv
44protocol unix,inet,inet6,netlink
45seccomp
46tracelog
47 15
48disable-mnt 16# private-etc must first be enabled in firefox-common.profile
49# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse 17#private-etc icecat
50 18
51noexec ${HOME} 19# Redirect
52noexec /tmp 20include /etc/firejail/firefox-common.profile
diff --git a/etc/iceweasel.profile b/etc/iceweasel.profile
index f6b57dde0..51f15aa1b 100644
--- a/etc/iceweasel.profile
+++ b/etc/iceweasel.profile
@@ -5,6 +5,8 @@ include /etc/firejail/iceweasel.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8# private-etc must first be enabled in firefox-common.profile
9#private-etc iceweasel
8 10
9# Redirect 11# Redirect
10include /etc/firejail/firefox.profile 12include /etc/firejail/firefox.profile
diff --git a/etc/idea.profile b/etc/idea.profile
new file mode 100644
index 000000000..623d71734
--- /dev/null
+++ b/etc/idea.profile
@@ -0,0 +1,10 @@
1# Firejail profile for idea
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/idea.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8
9# Redirect
10include /etc/firejail/idea.sh.profile
diff --git a/etc/inox.profile b/etc/inox.profile
index fbc654434..652761c54 100644
--- a/etc/inox.profile
+++ b/etc/inox.profile
@@ -7,30 +7,11 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/inox 8noblacklist ${HOME}/.cache/inox
9noblacklist ${HOME}/.config/inox 9noblacklist ${HOME}/.config/inox
10noblacklist ${HOME}/.pki
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-programs.inc
14 10
15mkdir ${HOME}/.cache/inox 11mkdir ${HOME}/.cache/inox
16mkdir ${HOME}/.config/inox 12mkdir ${HOME}/.config/inox
17mkdir ${HOME}/.pki
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.cache/inox 13whitelist ${HOME}/.cache/inox
20whitelist ${HOME}/.config/inox 14whitelist ${HOME}/.config/inox
21whitelist ${HOME}/.pki
22include /etc/firejail/whitelist-common.inc
23include /etc/firejail/whitelist-var-common.inc
24
25caps.keep sys_chroot,sys_admin
26netfilter
27nodvd
28nogroups
29notv
30shell none
31
32private-dev
33# private-tmp - problems with multiple browser sessions
34 15
35noexec ${HOME} 16# Redirect
36noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/iridium.profile b/etc/iridium.profile
index 76026722f..2869c3070 100644
--- a/etc/iridium.profile
+++ b/etc/iridium.profile
@@ -8,30 +8,10 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.cache/iridium 8noblacklist ${HOME}/.cache/iridium
9noblacklist ${HOME}/.config/iridium 9noblacklist ${HOME}/.config/iridium
10 10
11include /etc/firejail/disable-common.inc
12# chromium/iridium is distributed with a perl script on Arch
13# include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-programs.inc
15
16mkdir ${HOME}/.cache/iridium 11mkdir ${HOME}/.cache/iridium
17mkdir ${HOME}/.config/iridium 12mkdir ${HOME}/.config/iridium
18mkdir ${HOME}/.pki
19whitelist ${DOWNLOADS}
20whitelist ${HOME}/.cache/iridium 13whitelist ${HOME}/.cache/iridium
21whitelist ${HOME}/.config/iridium 14whitelist ${HOME}/.config/iridium
22whitelist ${HOME}/.pki
23include /etc/firejail/whitelist-common.inc
24include /etc/firejail/whitelist-var-common.inc
25
26caps.keep sys_chroot,sys_admin
27netfilter
28nodvd
29nogroups
30notv
31shell none
32
33private-dev
34# private-tmp - problems with multiple browser sessions
35 15
36noexec ${HOME} 16# Redirect
37noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/kaffeine.profile b/etc/kaffeine.profile
new file mode 100644
index 000000000..07280ab6d
--- /dev/null
+++ b/etc/kaffeine.profile
@@ -0,0 +1,37 @@
1# Firejail profile for kaffeine
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/kaffeine.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8noblacklist ${HOME}/.config/kaffeinerc
9noblacklist ${HOME}/.kde/share/apps/kaffeine
10noblacklist ${HOME}/.kde/share/config/kaffeinerc
11noblacklist ${HOME}/.kde4/share/apps/kaffeine
12noblacklist ${HOME}/.kde4/share/config/kaffeinerc
13noblacklist ${HOME}/.local/share/kaffeine
14
15include /etc/firejail/disable-common.inc
16include /etc/firejail/disable-devel.inc
17include /etc/firejail/disable-passwdmgr.inc
18include /etc/firejail/disable-programs.inc
19
20include /etc/firejail/whitelist-var-common.inc
21
22caps.drop all
23netfilter
24nogroups
25nonewprivs
26noroot
27novideo
28protocol unix,inet,inet6
29seccomp
30shell none
31
32# private-bin kaffeine
33private-dev
34private-tmp
35
36noexec ${HOME}
37noexec /tmp
diff --git a/etc/kdenlive.profile b/etc/kdenlive.profile
index 871706b02..b6d48356d 100644
--- a/etc/kdenlive.profile
+++ b/etc/kdenlive.profile
@@ -6,6 +6,9 @@ include /etc/firejail/kdenlive.local
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8# blacklist /run/user/*/bus 8# blacklist /run/user/*/bus
9noblacklist ${HOME}/.cache/kdenlive
10noblacklist ${HOME}/.config/kdenliverc
11noblacklist ${HOME}/.local/share/kdenlive
9 12
10include /etc/firejail/disable-common.inc 13include /etc/firejail/disable-common.inc
11include /etc/firejail/disable-devel.inc 14include /etc/firejail/disable-devel.inc
@@ -25,7 +28,7 @@ shell none
25 28
26private-bin kdenlive,kdenlive_render,dbus-launch,melt,ffmpeg,ffplay,ffprobe,dvdauthor,genisoimage,vlc,xine,kdeinit5,kshell5,kdeinit5_shutdown,kdeinit5_wrapper,kdeinit4,kshell4,kdeinit4_shutdown,kdeinit4_wrapper 29private-bin kdenlive,kdenlive_render,dbus-launch,melt,ffmpeg,ffplay,ffprobe,dvdauthor,genisoimage,vlc,xine,kdeinit5,kshell5,kdeinit5_shutdown,kdeinit5_wrapper,kdeinit4,kshell4,kdeinit4_shutdown,kdeinit4_wrapper
27private-dev 30private-dev
28# private-etc fonts,alternatives,X11,pulse,passwd 31# private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,xdg,X11
29 32
30# noexec ${HOME} 33# noexec ${HOME}
31noexec /tmp 34noexec /tmp
diff --git a/etc/kget.profile b/etc/kget.profile
index 25c66e044..c4e073c2b 100644
--- a/etc/kget.profile
+++ b/etc/kget.profile
@@ -5,10 +5,12 @@ include /etc/firejail/kget.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.config/kgetrc
8noblacklist ${HOME}/.kde/share/apps/kget 9noblacklist ${HOME}/.kde/share/apps/kget
9noblacklist ${HOME}/.kde/share/config/kgetrc 10noblacklist ${HOME}/.kde/share/config/kgetrc
10noblacklist ${HOME}/.kde4/share/apps/kget 11noblacklist ${HOME}/.kde4/share/apps/kget
11noblacklist ${HOME}/.kde4/share/config/kgetrc 12noblacklist ${HOME}/.kde4/share/config/kgetrc
13noblacklist ${HOME}/.local/share/kget
12 14
13include /etc/firejail/disable-common.inc 15include /etc/firejail/disable-common.inc
14include /etc/firejail/disable-devel.inc 16include /etc/firejail/disable-devel.inc
diff --git a/etc/kmail.profile b/etc/kmail.profile
index 7aad57987..ca774f4ec 100644
--- a/etc/kmail.profile
+++ b/etc/kmail.profile
@@ -25,6 +25,8 @@ protocol unix,inet,inet6,netlink
25# blacklisting of chroot system calls breaks kmail 25# blacklisting of chroot system calls breaks kmail
26seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice 26seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
27# tracelog 27# tracelog
28# writable-run-user is needed for signing and encrypting emails
29writable-run-user
28 30
29private-dev 31private-dev
30# private-tmp 32# private-tmp - breaks akonadi and opening of email attachments
diff --git a/etc/krita.profile b/etc/krita.profile
index 0d2b62c5d..c621e2c72 100644
--- a/etc/krita.profile
+++ b/etc/krita.profile
@@ -7,6 +7,7 @@ include /etc/firejail/globals.local
7 7
8# blacklist /run/user/*/bus 8# blacklist /run/user/*/bus
9noblacklist ${HOME}/.config/kritarc 9noblacklist ${HOME}/.config/kritarc
10noblacklist ${HOME}/.local/share/krita
10 11
11include /etc/firejail/disable-common.inc 12include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc 13include /etc/firejail/disable-devel.inc
diff --git a/etc/krunner.profile b/etc/krunner.profile
index 606b67677..1e97f4290 100644
--- a/etc/krunner.profile
+++ b/etc/krunner.profile
@@ -5,12 +5,15 @@ include /etc/firejail/krunner.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8# start a program in krunner: program will run with this generic profile 8# - programs started in krunner run with this generic profile.
9# open a file in krunner: file viewer will run with its own profile (if firejailed automatically) 9# - when a file is opened in krunner, the file viewer runs in its own sandbox
10# with its own profile, if it is sandboxed automatically.
10 11
12# noblacklist ${HOME}/.cache/krunner
11noblacklist ${HOME}/.config/krunnerrc 13noblacklist ${HOME}/.config/krunnerrc
12noblacklist ${HOME}/.kde/share/config/krunnerrc 14noblacklist ${HOME}/.kde/share/config/krunnerrc
13noblacklist ${HOME}/.kde4/share/config/krunnerrc 15noblacklist ${HOME}/.kde4/share/config/krunnerrc
16# noblacklist ${HOME}/.local/share/baloo
14 17
15include /etc/firejail/disable-common.inc 18include /etc/firejail/disable-common.inc
16# include /etc/firejail/disable-devel.inc 19# include /etc/firejail/disable-devel.inc
@@ -21,6 +24,7 @@ include /etc/firejail/whitelist-var-common.inc
21 24
22caps.drop all 25caps.drop all
23netfilter 26netfilter
27nogroups
24nonewprivs 28nonewprivs
25noroot 29noroot
26protocol unix,inet,inet6 30protocol unix,inet,inet6
diff --git a/etc/kwin_x11.profile b/etc/kwin_x11.profile
index 91bb62efc..534e7cd51 100644
--- a/etc/kwin_x11.profile
+++ b/etc/kwin_x11.profile
@@ -5,6 +5,7 @@ include /etc/firejail/kwin_x11.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/kwin
8noblacklist ${HOME}/.config/kwinrc 9noblacklist ${HOME}/.config/kwinrc
9noblacklist ${HOME}/.config/kwinrulesrc 10noblacklist ${HOME}/.config/kwinrulesrc
10noblacklist ${HOME}/.local/share/kwin 11noblacklist ${HOME}/.local/share/kwin
@@ -33,7 +34,7 @@ tracelog
33disable-mnt 34disable-mnt
34private-bin kwin_x11 35private-bin kwin_x11
35private-dev 36private-dev
36private-etc drirc,fonts,ld.so.cache,machine-id,xdg 37private-etc drirc,fonts,kde5rc,ld.so.cache,machine-id,xdg
37private-tmp 38private-tmp
38 39
39noexec ${HOME} 40noexec ${HOME}
diff --git a/etc/libreoffice.profile b/etc/libreoffice.profile
index 3548a75ad..220e0f02c 100644
--- a/etc/libreoffice.profile
+++ b/etc/libreoffice.profile
@@ -34,3 +34,5 @@ private-tmp
34 34
35noexec ${HOME} 35noexec ${HOME}
36noexec /tmp 36noexec /tmp
37
38join-or-start libreoffice
diff --git a/etc/okular.profile b/etc/okular.profile
index 31b773852..d98d4792f 100644
--- a/etc/okular.profile
+++ b/etc/okular.profile
@@ -7,6 +7,7 @@ include /etc/firejail/globals.local
7 7
8# blacklist /run/user/*/bus 8# blacklist /run/user/*/bus
9 9
10noblacklist ${HOME}/.cache/okular
10noblacklist ${HOME}/.config/okularpartrc 11noblacklist ${HOME}/.config/okularpartrc
11noblacklist ${HOME}/.config/okularrc 12noblacklist ${HOME}/.config/okularrc
12noblacklist ${HOME}/.kde/share/apps/okular 13noblacklist ${HOME}/.kde/share/apps/okular
@@ -42,7 +43,7 @@ tracelog
42 43
43private-bin okular,kbuildsycoca4,kdeinit4,lpr 44private-bin okular,kbuildsycoca4,kdeinit4,lpr
44private-dev 45private-dev
45private-etc alternatives,cups,fonts,ld.so.cache,machine-id 46private-etc alternatives,cups,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg
46# private-tmp - on KDE we need access to the real /tmp for data exchange with email clients 47# private-tmp - on KDE we need access to the real /tmp for data exchange with email clients
47 48
48# memory-deny-write-execute 49# memory-deny-write-execute
diff --git a/etc/onionshare-gui.profile b/etc/onionshare-gui.profile
index 7220f7e1c..8cbe5be7f 100644
--- a/etc/onionshare-gui.profile
+++ b/etc/onionshare-gui.profile
@@ -12,6 +12,8 @@ include /etc/firejail/disable-devel.inc
12include /etc/firejail/disable-passwdmgr.inc 12include /etc/firejail/disable-passwdmgr.inc
13include /etc/firejail/disable-programs.inc 13include /etc/firejail/disable-programs.inc
14 14
15include /etc/firejail/whitelist-var-common.inc
16
15caps.drop all 17caps.drop all
16ipc-namespace 18ipc-namespace
17netfilter 19netfilter
diff --git a/etc/opera-beta.profile b/etc/opera-beta.profile
index 3fe86d26c..38a3152d2 100644
--- a/etc/opera-beta.profile
+++ b/etc/opera-beta.profile
@@ -5,24 +5,13 @@ include /etc/firejail/opera-beta.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/opera
8noblacklist ${HOME}/.config/opera-beta 9noblacklist ${HOME}/.config/opera-beta
9noblacklist ${HOME}/.pki
10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-programs.inc
14 10
15mkdir ${HOME}/.cache/opera 11mkdir ${HOME}/.cache/opera
16mkdir ${HOME}/.config/opera-beta 12mkdir ${HOME}/.config/opera-beta
17mkdir ${HOME}/.pki
18whitelist ${DOWNLOADS}
19whitelist ${HOME}/.cache/opera 13whitelist ${HOME}/.cache/opera
20whitelist ${HOME}/.config/opera-beta 14whitelist ${HOME}/.config/opera-beta
21whitelist ${HOME}/.pki
22include /etc/firejail/whitelist-common.inc
23
24netfilter
25nodvd
26notv
27 15
28disable-mnt 16# Redirect
17include /etc/firejail/chromium-common.profile
diff --git a/etc/opera.profile b/etc/opera.profile
index fed7564b2..c0138c555 100644
--- a/etc/opera.profile
+++ b/etc/opera.profile
@@ -8,25 +8,13 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.cache/opera 8noblacklist ${HOME}/.cache/opera
9noblacklist ${HOME}/.config/opera 9noblacklist ${HOME}/.config/opera
10noblacklist ${HOME}/.opera 10noblacklist ${HOME}/.opera
11noblacklist ${HOME}/.pki
12
13include /etc/firejail/disable-common.inc
14include /etc/firejail/disable-devel.inc
15include /etc/firejail/disable-programs.inc
16 11
17mkdir ${HOME}/.cache/opera 12mkdir ${HOME}/.cache/opera
18mkdir ${HOME}/.config/opera 13mkdir ${HOME}/.config/opera
19mkdir ${HOME}/.opera 14mkdir ${HOME}/.opera
20mkdir ${HOME}/.pki
21whitelist ${DOWNLOADS}
22whitelist ${HOME}/.cache/opera 15whitelist ${HOME}/.cache/opera
23whitelist ${HOME}/.config/opera 16whitelist ${HOME}/.config/opera
24whitelist ${HOME}/.opera 17whitelist ${HOME}/.opera
25whitelist ${HOME}/.pki
26include /etc/firejail/whitelist-common.inc
27
28netfilter
29nodvd
30notv
31 18
32disable-mnt 19# Redirect
20include /etc/firejail/chromium-common.profile
diff --git a/etc/palemoon.profile b/etc/palemoon.profile
index 1112a9bb7..ff7087e55 100644
--- a/etc/palemoon.profile
+++ b/etc/palemoon.profile
@@ -8,53 +8,15 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.cache/moonchild productions/pale moon 8noblacklist ${HOME}/.cache/moonchild productions/pale moon
9noblacklist ${HOME}/.moonchild productions/pale moon 9noblacklist ${HOME}/.moonchild productions/pale moon
10 10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-programs.inc
14
15# These are uncommented in the Firefox profile. If you run into trouble you may
16# want to uncomment (some of) them.
17#whitelist ${HOME}/dwhelper
18#whitelist ${HOME}/.zotero
19#whitelist ${HOME}/.vimperatorrc
20#whitelist ${HOME}/.vimperator
21#whitelist ${HOME}/.pentadactylrc
22#whitelist ${HOME}/.pentadactyl
23#whitelist ${HOME}/.keysnail.js
24#whitelist ${HOME}/.config/gnome-mplayer
25#whitelist ${HOME}/.cache/gnome-mplayer/plugin
26#whitelist ${HOME}/.pki
27#whitelist ${HOME}/.lastpass
28
29# For silverlight
30#whitelist ${HOME}/.wine-pipelight
31#whitelist ${HOME}/.wine-pipelight64
32#whitelist ${HOME}/.config/pipelight-widevine
33#whitelist ${HOME}/.config/pipelight-silverlight5.1
34
35mkdir ${HOME}/.cache/moonchild productions/pale moon 11mkdir ${HOME}/.cache/moonchild productions/pale moon
36mkdir ${HOME}/.moonchild productions 12mkdir ${HOME}/.moonchild productions
37whitelist ${DOWNLOADS}
38whitelist ${HOME}/.cache/moonchild productions/pale moon 13whitelist ${HOME}/.cache/moonchild productions/pale moon
39whitelist ${HOME}/.moonchild productions 14whitelist ${HOME}/.moonchild productions
40include /etc/firejail/whitelist-common.inc
41
42caps.drop all
43netfilter
44nodvd
45nogroups
46nonewprivs
47noroot
48notv
49protocol unix,inet,inet6,netlink
50seccomp
51shell none
52tracelog
53 15
54# private-bin palemoon 16#private-bin palemoon
55# private-dev (disabled for now as it will interfere with webcam use in palemoon) 17# private-etc must first be enabled in firefox-common.profile
56# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse 18#private-etc palemoon
57# private-opt palemoon 19#private-opt palemoon
58private-tmp
59 20
60disable-mnt 21# Redirect
22include /etc/firejail/firefox-common.profile
diff --git a/etc/xmr-stak-cpu.profile b/etc/pdfchain.profile
index 9cc6e0c1f..d43c0911e 100644..100755
--- a/etc/xmr-stak-cpu.profile
+++ b/etc/pdfchain.profile
@@ -1,40 +1,37 @@
1# Firejail profile for xmr-stak-cpu 1# Firejail profile for pdfchain
2# This file is overwritten after every install/update 2# This file is overwritten after every install/update
3# Persistent local customizations 3# Persistent local customizations
4include /etc/firejail/xmr-stak-cpu.local 4include /etc/firejail/pdfchain.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8 8
9blacklist /run/user/*/bus
10
9include /etc/firejail/disable-common.inc 11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-programs.inc
10include /etc/firejail/disable-devel.inc 13include /etc/firejail/disable-devel.inc
11include /etc/firejail/disable-passwdmgr.inc 14include /etc/firejail/disable-passwdmgr.inc
12include /etc/firejail/disable-programs.inc
13 15
14include /etc/firejail/whitelist-var-common.inc 16include /etc/firejail/whitelist-var-common.inc
15 17
16caps.drop all 18caps.drop all
17ipc-namespace 19ipc-namespace
18netfilter 20net none
19no3d 21no3d
20nodvd
21nogroups 22nogroups
22nonewprivs 23nonewprivs
23noroot 24noroot
24nosound 25nosound
25notv 26notv
26novideo 27novideo
27protocol unix,inet,inet6 28protocol unix
28seccomp 29seccomp
29shell none 30shell none
30 31
31disable-mnt 32private-bin pdfchain,pdftk,sh
32private
33private-bin xmr-stak-cpu
34private-dev 33private-dev
35private-etc xmr-stak-cpu.json 34private-etc dconf,fonts,gtk-3.0,xdg
36private-lib
37private-opt none
38private-tmp 35private-tmp
39 36
40memory-deny-write-execute 37memory-deny-write-execute
diff --git a/etc/pitivi.profile b/etc/pitivi.profile
index f2640ed66..6df03e042 100644
--- a/etc/pitivi.profile
+++ b/etc/pitivi.profile
@@ -13,6 +13,8 @@ include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-passwdmgr.inc 13include /etc/firejail/disable-passwdmgr.inc
14include /etc/firejail/disable-programs.inc 14include /etc/firejail/disable-programs.inc
15 15
16include /etc/firejail/whitelist-var-common.inc
17
16caps.drop all 18caps.drop all
17ipc-namespace 19ipc-namespace
18netfilter 20netfilter
diff --git a/etc/qbittorrent.profile b/etc/qbittorrent.profile
index a01b1e9a8..da870ab76 100644
--- a/etc/qbittorrent.profile
+++ b/etc/qbittorrent.profile
@@ -8,6 +8,7 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.cache/qBittorrent 8noblacklist ${HOME}/.cache/qBittorrent
9noblacklist ${HOME}/.config/qBittorrent 9noblacklist ${HOME}/.config/qBittorrent
10noblacklist ${HOME}/.config/qBittorrentrc 10noblacklist ${HOME}/.config/qBittorrentrc
11noblacklist ${HOME}/.local/share/data/qBittorrent
11 12
12include /etc/firejail/disable-common.inc 13include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc 14include /etc/firejail/disable-devel.inc
diff --git a/etc/qtox.profile b/etc/qtox.profile
index a8d980a18..648282db4 100644
--- a/etc/qtox.profile
+++ b/etc/qtox.profile
@@ -33,7 +33,7 @@ tracelog
33 33
34disable-mnt 34disable-mnt
35private-bin qtox 35private-bin qtox
36private-etc fonts,resolv.conf,ld.so.cache 36private-etc fonts,resolv.conf,ld.so.cache,localtime
37private-dev 37private-dev
38private-tmp 38private-tmp
39 39
diff --git a/etc/redeclipse.profile b/etc/redeclipse.profile
new file mode 100644
index 000000000..f0a993c54
--- /dev/null
+++ b/etc/redeclipse.profile
@@ -0,0 +1,37 @@
1# Firejail profile for redeclipse
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/redeclipse.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8noblacklist ${HOME}/.redeclipse
9
10include /etc/firejail/disable-common.inc
11include /etc/firejail/disable-devel.inc
12include /etc/firejail/disable-passwdmgr.inc
13include /etc/firejail/disable-programs.inc
14
15mkdir ${HOME}/.redeclipse
16whitelist ${HOME}/.redeclipse
17include /etc/firejail/whitelist-common.inc
18include /etc/firejail/whitelist-var-common.inc
19
20caps.drop all
21netfilter
22nodvd
23nogroups
24nonewprivs
25noroot
26notv
27novideo
28protocol unix,inet,inet6
29seccomp
30shell none
31
32disable-mnt
33private-dev
34private-tmp
35
36noexec ${HOME}
37noexec /tmp
diff --git a/etc/remmina.profile b/etc/remmina.profile
index 3bb6aa0b1..cc209b84a 100644
--- a/etc/remmina.profile
+++ b/etc/remmina.profile
@@ -5,6 +5,7 @@ include /etc/firejail/remmina.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.remmina
8noblacklist ${HOME}/.config/remmina 9noblacklist ${HOME}/.config/remmina
9noblacklist ${HOME}/.local/share/remmina 10noblacklist ${HOME}/.local/share/remmina
10noblacklist ${HOME}/.ssh 11noblacklist ${HOME}/.ssh
@@ -23,6 +24,7 @@ notv
23novideo 24novideo
24protocol unix,inet,inet6 25protocol unix,inet,inet6
25seccomp 26seccomp
27# seccomp.keep access,arch_prctl,brk,chmod,clock_getres,clock_gettime,clone,close,connect,dup3,eventfd2,execve,fadvise64,fallocate,fcntl,flock,fstat,fstatfs,fsync,ftruncate,futex,getdents,getegid,geteuid,getgid,getpeername,getpid,getrandom,getresgid,getresuid,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init1,inotify_rm_watch,ioctl,lseek,lstat,madvise,memfd_create,mmap,mprotect,mremap,munmap,nanosleep,open,openat,pipe,pipe2,poll,prctl,prlimit64,pwrite64,read,readlink,recvfrom,recvmsg,rename,rt_sigaction,rt_sigprocmask,sendmmsg,sendmsg,sendto,set_robust_list,setsockopt,set_tid_address,shmat,shmctl,shmdt,shmget,shutdown,socket,stat,statfs,sysinfo,tgkill,uname,utimensat,write,writev
26shell none 28shell none
27 29
28private-dev 30private-dev
diff --git a/etc/scribus.profile b/etc/scribus.profile
index 001b91387..8ce63fbf0 100644
--- a/etc/scribus.profile
+++ b/etc/scribus.profile
@@ -8,6 +8,7 @@ include /etc/firejail/globals.local
8blacklist /run/user/*/bus 8blacklist /run/user/*/bus
9 9
10# Support for PDF readers comes with Scribus 1.5 and higher 10# Support for PDF readers comes with Scribus 1.5 and higher
11noblacklist ${HOME}/.cache/okular
11noblacklist ${HOME}/.config/okularpartrc 12noblacklist ${HOME}/.config/okularpartrc
12noblacklist ${HOME}/.config/okularrc 13noblacklist ${HOME}/.config/okularrc
13noblacklist ${HOME}/.config/scribus 14noblacklist ${HOME}/.config/scribus
diff --git a/etc/soundconverter.profile b/etc/soundconverter.profile
index c27fb3819..1f64567ef 100644
--- a/etc/soundconverter.profile
+++ b/etc/soundconverter.profile
@@ -5,8 +5,6 @@ include /etc/firejail/soundconverter.local
5# Persistent global definitions 5# Persistent global definitions
6include /etc/firejail/globals.local 6include /etc/firejail/globals.local
7 7
8blacklist /run/user/*/bus
9
10include /etc/firejail/disable-common.inc 8include /etc/firejail/disable-common.inc
11include /etc/firejail/disable-devel.inc 9include /etc/firejail/disable-devel.inc
12include /etc/firejail/disable-passwdmgr.inc 10include /etc/firejail/disable-passwdmgr.inc
diff --git a/etc/spotify.profile b/etc/spotify.profile
index 736bd3520..fcd0ab92e 100644
--- a/etc/spotify.profile
+++ b/etc/spotify.profile
@@ -42,7 +42,7 @@ shell none
42tracelog 42tracelog
43 43
44disable-mnt 44disable-mnt
45private-bin spotify,bash,sh 45private-bin spotify,bash,sh,zenity
46private-dev 46private-dev
47private-etc fonts,machine-id,pulse,resolv.conf 47private-etc fonts,machine-id,pulse,resolv.conf
48private-opt spotify 48private-opt spotify
diff --git a/etc/steam.profile b/etc/steam.profile
index 1e0fd57d1..4965d3a54 100644
--- a/etc/steam.profile
+++ b/etc/steam.profile
@@ -29,6 +29,8 @@ include /etc/firejail/disable-devel.inc
29include /etc/firejail/disable-passwdmgr.inc 29include /etc/firejail/disable-passwdmgr.inc
30include /etc/firejail/disable-programs.inc 30include /etc/firejail/disable-programs.inc
31 31
32include /etc/firejail/whitelist-var-common.inc
33
32caps.drop all 34caps.drop all
33netfilter 35netfilter
34nodvd 36nodvd
diff --git a/etc/thunderbird.profile b/etc/thunderbird.profile
index 226781332..6045d6d17 100644
--- a/etc/thunderbird.profile
+++ b/etc/thunderbird.profile
@@ -21,14 +21,14 @@ whitelist ${HOME}/.cache/thunderbird
21whitelist ${HOME}/.gnupg 21whitelist ${HOME}/.gnupg
22# whitelist ${HOME}/.icedove 22# whitelist ${HOME}/.icedove
23whitelist ${HOME}/.thunderbird 23whitelist ${HOME}/.thunderbird
24include /etc/firejail/whitelist-common.inc
25include /etc/firejail/whitelist-var-common.inc
26 24
27# We need the real /tmp for data exchange when xdg-open handles email attachments on KDE 25# We need the real /tmp for data exchange when xdg-open handles email attachments on KDE
28ignore private-tmp 26ignore private-tmp
29# machine-id breaks pulse audio; it should work fine in setups where sound is not required 27# machine-id breaks audio in browsers; enable it when sound is not required
30#machine-id 28# machine-id
31read-only ${HOME}/.config/mimeapps.list 29read-only ${HOME}/.config/mimeapps.list
30# writable-run-user is needed for signing and encrypting emails
31writable-run-user
32 32
33# allow browsers 33# allow browsers
34# Redirect 34# Redirect
diff --git a/etc/tilp.profile b/etc/tilp.profile
new file mode 100644
index 000000000..a6165fbfe
--- /dev/null
+++ b/etc/tilp.profile
@@ -0,0 +1,34 @@
1# Firejail profile for tilp
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/tilp.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8noblacklist ${HOME}/.tilp
9
10include /etc/firejail/disable-common.inc
11include /etc/firejail/disable-devel.inc
12include /etc/firejail/disable-passwdmgr.inc
13include /etc/firejail/disable-programs.inc
14
15caps.drop all
16net none
17nodvd
18nogroups
19nonewprivs
20noroot
21notv
22novideo
23protocol unix,netlink
24seccomp
25shell none
26tracelog
27
28disable-mnt
29private-bin tilp
30private-etc fonts
31private-tmp
32
33noexec ${HOME}
34noexec /tmp
diff --git a/etc/torbrowser-launcher.profile b/etc/torbrowser-launcher.profile
index b802478a2..02ef57cce 100644
--- a/etc/torbrowser-launcher.profile
+++ b/etc/torbrowser-launcher.profile
@@ -13,9 +13,12 @@ include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-passwdmgr.inc 13include /etc/firejail/disable-passwdmgr.inc
14include /etc/firejail/disable-programs.inc 14include /etc/firejail/disable-programs.inc
15 15
16mkdir ${HOME}/.config/torbrowser
17mkdir ${HOME}/.local/share/torbrowser
16whitelist ${HOME}/.config/torbrowser 18whitelist ${HOME}/.config/torbrowser
17whitelist ${HOME}/.local/share/torbrowser 19whitelist ${HOME}/.local/share/torbrowser
18include /etc/firejail/whitelist-common.inc 20include /etc/firejail/whitelist-common.inc
21include /etc/firejail/whitelist-var-common.inc
19 22
20caps.drop all 23caps.drop all
21netfilter 24netfilter
@@ -33,7 +36,7 @@ tracelog
33disable-mnt 36disable-mnt
34private-bin bash,cp,dirname,env,expr,file,getconf,gpg,grep,id,ln,mkdir,python*,readlink,rm,sed,sh,tail,test,tor-browser-en,torbrowser-launcher 37private-bin bash,cp,dirname,env,expr,file,getconf,gpg,grep,id,ln,mkdir,python*,readlink,rm,sed,sh,tail,test,tor-browser-en,torbrowser-launcher
35private-dev 38private-dev
36private-etc fonts,hostname,hosts,resolv.conf,pki,ssl,ca-certificates,crypto-policies 39private-etc fonts,hostname,hosts,resolv.conf,pki,ssl,ca-certificates,crypto-policies,alsa,asound.conf,pulse,machine-id
37private-tmp 40private-tmp
38 41
39noexec /tmp 42noexec /tmp
diff --git a/etc/unbound.profile b/etc/unbound.profile
index c03a25752..233e7464f 100644
--- a/etc/unbound.profile
+++ b/etc/unbound.profile
@@ -15,6 +15,9 @@ include /etc/firejail/disable-devel.inc
15include /etc/firejail/disable-passwdmgr.inc 15include /etc/firejail/disable-passwdmgr.inc
16include /etc/firejail/disable-programs.inc 16include /etc/firejail/disable-programs.inc
17 17
18whitelist /var/lib/unbound
19whitelist /var/run
20
18caps.keep net_bind_service,setgid,setuid,sys_chroot,sys_resource 21caps.keep net_bind_service,setgid,setuid,sys_chroot,sys_resource
19no3d 22no3d
20nodvd 23nodvd
@@ -23,6 +26,7 @@ nosound
23notv 26notv
24novideo 27novideo
25seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open 28seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open
29writable-var
26 30
27disable-mnt 31disable-mnt
28private 32private
diff --git a/etc/vivaldi.profile b/etc/vivaldi.profile
index 3a1f72f23..aeef58292 100644
--- a/etc/vivaldi.profile
+++ b/etc/vivaldi.profile
@@ -8,28 +8,10 @@ include /etc/firejail/globals.local
8noblacklist ${HOME}/.cache/vivaldi 8noblacklist ${HOME}/.cache/vivaldi
9noblacklist ${HOME}/.config/vivaldi 9noblacklist ${HOME}/.config/vivaldi
10 10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-programs.inc
14
15mkdir ${HOME}/.cache/vivaldi 11mkdir ${HOME}/.cache/vivaldi
16mkdir ${HOME}/.config/vivaldi 12mkdir ${HOME}/.config/vivaldi
17whitelist ${DOWNLOADS}
18whitelist ${HOME}/.cache/vivaldi 13whitelist ${HOME}/.cache/vivaldi
19whitelist ${HOME}/.config/vivaldi 14whitelist ${HOME}/.config/vivaldi
20include /etc/firejail/whitelist-common.inc
21include /etc/firejail/whitelist-var-common.inc
22
23caps.keep sys_chroot,sys_admin
24netfilter
25nodvd
26nogroups
27notv
28shell none
29
30disable-mnt
31private-dev
32# private-tmp - problems with multiple browser sessions
33 15
34noexec ${HOME} 16# Redirect
35noexec /tmp 17include /etc/firejail/chromium-common.profile
diff --git a/etc/waterfox.profile b/etc/waterfox.profile
index b2abb3a5f..fdd299bbf 100644
--- a/etc/waterfox.profile
+++ b/etc/waterfox.profile
@@ -7,83 +7,22 @@ include /etc/firejail/globals.local
7 7
8noblacklist ${HOME}/.cache/mozilla 8noblacklist ${HOME}/.cache/mozilla
9noblacklist ${HOME}/.cache/waterfox 9noblacklist ${HOME}/.cache/waterfox
10noblacklist ${HOME}/.config/okularpartrc
11noblacklist ${HOME}/.config/okularrc
12noblacklist ${HOME}/.config/qpdfview
13noblacklist ${HOME}/.kde/share/apps/okular
14noblacklist ${HOME}/.kde/share/config/okularpartrc
15noblacklist ${HOME}/.kde/share/config/okularrc
16noblacklist ${HOME}/.kde4/share/apps/okular
17noblacklist ${HOME}/.kde4/share/config/okularpartrc
18noblacklist ${HOME}/.kde4/share/config/okularrc
19# noblacklist ${HOME}/.local/share/gnome-shell/extensions
20noblacklist ${HOME}/.local/share/okular
21noblacklist ${HOME}/.local/share/qpdfview
22noblacklist ${HOME}/.mozilla 10noblacklist ${HOME}/.mozilla
23noblacklist ${HOME}/.waterfox 11noblacklist ${HOME}/.waterfox
24noblacklist ${HOME}/.pki
25
26include /etc/firejail/disable-common.inc
27include /etc/firejail/disable-devel.inc
28include /etc/firejail/disable-programs.inc
29 12
30mkdir ${HOME}/.cache/mozilla/firefox 13mkdir ${HOME}/.cache/mozilla/firefox
31mkdir ${HOME}/.mozilla 14mkdir ${HOME}/.mozilla
32mkdir ${HOME}/.cache/waterfox 15mkdir ${HOME}/.cache/waterfox
33mkdir ${HOME}/.waterfox 16mkdir ${HOME}/.waterfox
34mkdir ${HOME}/.pki
35whitelist ${DOWNLOADS}
36whitelist ${HOME}/.cache/gnome-mplayer/plugin
37whitelist ${HOME}/.cache/mozilla/firefox 17whitelist ${HOME}/.cache/mozilla/firefox
38whitelist ${HOME}/.cache/waterfox 18whitelist ${HOME}/.cache/waterfox
39whitelist ${HOME}/.config/gnome-mplayer
40whitelist ${HOME}/.config/okularpartrc
41whitelist ${HOME}/.config/okularrc
42whitelist ${HOME}/.config/pipelight-silverlight5.1
43whitelist ${HOME}/.config/pipelight-widevine
44whitelist ${HOME}/.config/qpdfview
45whitelist ${HOME}/.kde/share/apps/okular
46whitelist ${HOME}/.kde/share/config/okularpartrc
47whitelist ${HOME}/.kde/share/config/okularrc
48whitelist ${HOME}/.kde4/share/apps/okular
49whitelist ${HOME}/.kde4/share/config/okularpartrc
50whitelist ${HOME}/.kde4/share/config/okularrc
51whitelist ${HOME}/.keysnail.js
52whitelist ${HOME}/.lastpass
53whitelist ${HOME}/.local/share/gnome-shell/extensions
54whitelist ${HOME}/.local/share/okular
55whitelist ${HOME}/.local/share/qpdfview
56whitelist ${HOME}/.mozilla 19whitelist ${HOME}/.mozilla
57whitelist ${HOME}/.waterfox 20whitelist ${HOME}/.waterfox
58whitelist ${HOME}/.pentadactyl
59whitelist ${HOME}/.pentadactylrc
60whitelist ${HOME}/.pki
61whitelist ${HOME}/.vimperator
62whitelist ${HOME}/.vimperatorrc
63whitelist ${HOME}/.wine-pipelight
64whitelist ${HOME}/.wine-pipelight64
65whitelist ${HOME}/.zotero
66whitelist ${HOME}/dwhelper
67include /etc/firejail/whitelist-common.inc
68include /etc/firejail/whitelist-var-common.inc
69
70caps.drop all
71netfilter
72nodvd
73nogroups
74nonewprivs
75noroot
76notv
77protocol unix,inet,inet6,netlink
78seccomp
79shell none
80tracelog
81 21
82# waterfox requires a shell to launch on Arch. We can possibly remove sh though. 22# waterfox requires a shell to launch on Arch. We can possibly remove sh though.
83# private-bin waterfox,which,sh,dbus-launch,dbus-send,env,bash 23#private-bin waterfox,which,sh,dbus-launch,dbus-send,env,bash
84private-dev 24# private-etc must first be enabled in firefox-common.profile
85# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,waterfox,mime.types,mailcap,asound.conf,pulse 25#private-etc waterfox
86private-tmp
87 26
88noexec ${HOME} 27# Redirect
89noexec /tmp 28include /etc/firejail/firefox-common.profile
diff --git a/etc/whitelist-common.inc b/etc/whitelist-common.inc
index 3beb11bfb..c664d5a53 100644
--- a/etc/whitelist-common.inc
+++ b/etc/whitelist-common.inc
@@ -55,14 +55,20 @@ whitelist ${HOME}/.config/dconf
55whitelist ${HOME}/.config/Kvantum 55whitelist ${HOME}/.config/Kvantum
56whitelist ${HOME}/.config/Trolltech.conf 56whitelist ${HOME}/.config/Trolltech.conf
57whitelist ${HOME}/.config/kdeglobals 57whitelist ${HOME}/.config/kdeglobals
58whitelist ${HOME}/.config/kio_httprc
58whitelist ${HOME}/.config/kioslaverc 59whitelist ${HOME}/.config/kioslaverc
60whitelist ${HOME}/.config/ksslcablacklist
59whitelist ${HOME}/.config/qt5ct 61whitelist ${HOME}/.config/qt5ct
60whitelist ${HOME}/.kde/share/config/kdeglobals 62whitelist ${HOME}/.kde/share/config/kdeglobals
63whitelist ${HOME}/.kde/share/config/kio_httprc
61whitelist ${HOME}/.kde/share/config/kioslaverc 64whitelist ${HOME}/.kde/share/config/kioslaverc
65whitelist ${HOME}/.kde/share/config/ksslcablacklist
62whitelist ${HOME}/.kde/share/config/oxygenrc 66whitelist ${HOME}/.kde/share/config/oxygenrc
63whitelist ${HOME}/.kde/share/icons 67whitelist ${HOME}/.kde/share/icons
64whitelist ${HOME}/.kde4/share/config/kdeglobals 68whitelist ${HOME}/.kde4/share/config/kdeglobals
69whitelist ${HOME}/.kde4/share/config/kio_httprc
65whitelist ${HOME}/.kde4/share/config/kioslaverc 70whitelist ${HOME}/.kde4/share/config/kioslaverc
71whitelist ${HOME}/.kde4/share/config/ksslcablacklist
66whitelist ${HOME}/.kde4/share/config/oxygenrc 72whitelist ${HOME}/.kde4/share/config/oxygenrc
67whitelist ${HOME}/.kde4/share/icons 73whitelist ${HOME}/.kde4/share/icons
68whitelist ${HOME}/.local/share/qt5ct 74whitelist ${HOME}/.local/share/qt5ct
diff --git a/etc/xmr-stak.profile b/etc/xmr-stak.profile
new file mode 100644
index 000000000..151a4c694
--- /dev/null
+++ b/etc/xmr-stak.profile
@@ -0,0 +1,44 @@
1# Firejail profile for xmr-stak
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/xmr-stak.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8noblacklist ${HOME}/.xmr-stak
9noblacklist /usr/lib/llvm*
10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-passwdmgr.inc
14include /etc/firejail/disable-programs.inc
15
16mkdir ${HOME}/.xmr-stak
17include /etc/firejail/whitelist-var-common.inc
18
19caps.drop all
20ipc-namespace
21netfilter
22nodvd
23nogroups
24nonewprivs
25noroot
26nosound
27notv
28novideo
29protocol unix,inet,inet6
30seccomp
31shell none
32
33disable-mnt
34private ${HOME}/.xmr-stak
35private-bin xmr-stak
36private-dev
37private-etc ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl
38#private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend
39private-opt cuda
40private-tmp
41
42memory-deny-write-execute
43noexec ${HOME}
44noexec /tmp
diff --git a/etc/xonotic.profile b/etc/xonotic.profile
index d17d2b612..7a466db9b 100644
--- a/etc/xonotic.profile
+++ b/etc/xonotic.profile
@@ -15,6 +15,7 @@ include /etc/firejail/disable-programs.inc
15mkdir ${HOME}/.xonotic 15mkdir ${HOME}/.xonotic
16whitelist ${HOME}/.xonotic 16whitelist ${HOME}/.xonotic
17include /etc/firejail/whitelist-common.inc 17include /etc/firejail/whitelist-common.inc
18include /etc/firejail/whitelist-var-common.inc
18 19
19caps.drop all 20caps.drop all
20netfilter 21netfilter
diff --git a/etc/yandex-browser.profile b/etc/yandex-browser.profile
index 1c7769727..fdb7694a5 100644
--- a/etc/yandex-browser.profile
+++ b/etc/yandex-browser.profile
@@ -9,35 +9,15 @@ noblacklist ${HOME}/.cache/yandex-browser
9noblacklist ${HOME}/.cache/yandex-browser-beta 9noblacklist ${HOME}/.cache/yandex-browser-beta
10noblacklist ${HOME}/.config/yandex-browser 10noblacklist ${HOME}/.config/yandex-browser
11noblacklist ${HOME}/.config/yandex-browser-beta 11noblacklist ${HOME}/.config/yandex-browser-beta
12noblacklist ${HOME}/.pki
13
14include /etc/firejail/disable-common.inc
15include /etc/firejail/disable-devel.inc
16include /etc/firejail/disable-programs.inc
17 12
18mkdir ${HOME}/.cache/yandex-browser 13mkdir ${HOME}/.cache/yandex-browser
19mkdir ${HOME}/.cache/yandex-browser-beta 14mkdir ${HOME}/.cache/yandex-browser-beta
20mkdir ${HOME}/.config/yandex-browser 15mkdir ${HOME}/.config/yandex-browser
21mkdir ${HOME}/.config/yandex-browser-beta 16mkdir ${HOME}/.config/yandex-browser-beta
22mkdir ${HOME}/.pki
23whitelist ${DOWNLOADS}
24whitelist ${HOME}/.cache/yandex-browser 17whitelist ${HOME}/.cache/yandex-browser
25whitelist ${HOME}/.cache/yandex-browser-beta 18whitelist ${HOME}/.cache/yandex-browser-beta
26whitelist ${HOME}/.config/yandex-browser 19whitelist ${HOME}/.config/yandex-browser
27whitelist ${HOME}/.config/yandex-browser-beta 20whitelist ${HOME}/.config/yandex-browser-beta
28whitelist ${HOME}/.pki
29include /etc/firejail/whitelist-common.inc
30
31caps.keep sys_chroot,sys_admin
32netfilter
33nodvd
34nogroups
35notv
36shell none
37
38disable-mnt
39private-dev
40# private-tmp - problems with multiple browser sessions
41 21
42noexec ${HOME} 22# Redirect
43noexec /tmp 23include /etc/firejail/chromium-common.profile
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-03 11:52:16 +0000