aboutsummaryrefslogtreecommitdiffstats
path: root/etc
diff options
context:
space:
mode:
Diffstat (limited to 'etc')
-rw-r--r--etc/QMediathekView.profile54
-rw-r--r--etc/aria2c.profile45
-rw-r--r--etc/disable-programs.inc3
-rw-r--r--etc/file.profile4
-rw-r--r--etc/strings.profile4
5 files changed, 109 insertions, 1 deletions
diff --git a/etc/QMediathekView.profile b/etc/QMediathekView.profile
new file mode 100644
index 000000000..558f62f0e
--- /dev/null
+++ b/etc/QMediathekView.profile
@@ -0,0 +1,54 @@
1# Firejail profile for QMediathekView
2# Description: Search, download or stream files from mediathek.de
3# This file is overwritten after every install/update
4# Persistent local customizations
5include /etc/firejail/QMediathekView.local
6# Persistent global definitions
7include /etc/firejail/globals.local
8
9noblacklist ${HOME}/.config/QMediathekView
10noblacklist ${HOME}/.local/share/QMediathekView
11
12noblacklist ${HOME}/.config/mpv
13noblacklist ${HOME}/.config/smplayer
14noblacklist ${HOME}/.config/totem
15noblacklist ${HOME}/.config/vlc
16noblacklist ${HOME}/.config/xplayer
17noblacklist ${HOME}/.local/share/totem
18noblacklist ${HOME}/.local/share/xplayer
19noblacklist ${HOME}/.mplayer
20
21include /etc/firejail/disable-common.inc
22include /etc/firejail/disable-devel.inc
23include /etc/firejail/disable-interpreters.inc
24include /etc/firejail/disable-passwdmgr.inc
25include /etc/firejail/disable-programs.inc
26
27include /etc/firejail/whitelist-var-common.inc
28
29caps.drop all
30netfilter
31# no3d
32# nodbus
33nodvd
34nogroups
35nonewprivs
36noroot
37notv
38nou2f
39protocol unix,inet,inet6
40seccomp
41shell none
42tracelog
43
44disable-mnt
45private-bin QMediathekView,mplayer,mpv,smplayer,totem,vlc,xplayer
46private-cache
47private-dev
48# private-etc none
49# private-lib
50private-tmp
51
52# memory-deny-write-execute - breaks on Arch
53noexec ${HOME}
54noexec /tmp
diff --git a/etc/aria2c.profile b/etc/aria2c.profile
new file mode 100644
index 000000000..4231c58ff
--- /dev/null
+++ b/etc/aria2c.profile
@@ -0,0 +1,45 @@
1# Firejail profile for aria2c
2# Description: Download utility that supports HTTP(S), FTP, BitTorrent and Metalink
3# This file is overwritten after every install/update
4# Persistent local customizations
5include /etc/firejail/aria2c.local
6# Persistent global definitions
7include /etc/firejail/globals.local
8
9noblacklist ${HOME}/.aria2
10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-interpreters.inc
14include /etc/firejail/disable-passwdmgr.inc
15include /etc/firejail/disable-programs.inc
16include /etc/firejail/disable-xdg.inc
17
18caps.drop all
19ipc-namespace
20netfilter
21no3d
22nodbus
23nodvd
24nogroups
25nonewprivs
26noroot
27nosound
28notv
29novideo
30protocol unix,inet,inet6
31seccomp
32shell none
33
34disable-mnt
35# private
36private-bin aria2c,gzip
37private-cache
38private-dev
39private-etc ca-certificates,ssl
40private-lib libreadline.so.*
41private-tmp
42
43memory-deny-write-execute
44noexec ${HOME}
45noexec /tmp
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index c0dad2ee9..b050b8b25 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -32,6 +32,7 @@ blacklist ${HOME}/.aMule
32blacklist ${HOME}/.android 32blacklist ${HOME}/.android
33blacklist ${HOME}/.anydesk 33blacklist ${HOME}/.anydesk
34blacklist ${HOME}/.arduino15 34blacklist ${HOME}/.arduino15
35blacklist ${HOME}/.aria2
35blacklist ${HOME}/.arm 36blacklist ${HOME}/.arm
36blacklist ${HOME}/.asunder_album_genre 37blacklist ${HOME}/.asunder_album_genre
37blacklist ${HOME}/.asunder_album_title 38blacklist ${HOME}/.asunder_album_title
@@ -71,6 +72,7 @@ blacklist ${HOME}/.config/MuseScore
71blacklist ${HOME}/.config/MusicBrainz 72blacklist ${HOME}/.config/MusicBrainz
72blacklist ${HOME}/.config/Nylas Mail 73blacklist ${HOME}/.config/Nylas Mail
73blacklist ${HOME}/.config/Qlipper 74blacklist ${HOME}/.config/Qlipper
75blacklist ${HOME}/.config/QMediathekView
74blacklist ${HOME}/.config/QuiteRss 76blacklist ${HOME}/.config/QuiteRss
75blacklist ${HOME}/.config/QuiteRssrc 77blacklist ${HOME}/.config/QuiteRssrc
76blacklist ${HOME}/.config/Rambox 78blacklist ${HOME}/.config/Rambox
@@ -361,6 +363,7 @@ blacklist ${HOME}/.local/share/3909/PapersPlease
361blacklist ${HOME}/.local/share/Empathy 363blacklist ${HOME}/.local/share/Empathy
362blacklist ${HOME}/.local/share/JetBrains 364blacklist ${HOME}/.local/share/JetBrains
363blacklist ${HOME}/.local/share/Mumble 365blacklist ${HOME}/.local/share/Mumble
366blacklist ${HOME}/.local/share/QMediathekView
364blacklist ${HOME}/.local/share/QuiteRss 367blacklist ${HOME}/.local/share/QuiteRss
365blacklist ${HOME}/.local/share/Ricochet 368blacklist ${HOME}/.local/share/Ricochet
366blacklist ${HOME}/.local/share/Steam 369blacklist ${HOME}/.local/share/Steam
diff --git a/etc/file.profile b/etc/file.profile
index 5d1227520..00e18de20 100644
--- a/etc/file.profile
+++ b/etc/file.profile
@@ -30,10 +30,12 @@ shell none
30tracelog 30tracelog
31x11 none 31x11 none
32 32
33private-bin file 33#private-bin file
34private-cache
34private-dev 35private-dev
35private-etc magic.mgc,magic,localtime 36private-etc magic.mgc,magic,localtime
36private-lib 37private-lib
38private-tmp
37 39
38memory-deny-write-execute 40memory-deny-write-execute
39noexec ${HOME} 41noexec ${HOME}
diff --git a/etc/strings.profile b/etc/strings.profile
index 5bea9525f..ae2fbf18f 100644
--- a/etc/strings.profile
+++ b/etc/strings.profile
@@ -21,9 +21,13 @@ shell none
21tracelog 21tracelog
22 22
23private-bin strings 23private-bin strings
24private-cache
24private-dev 25private-dev
26private-etc none
25private-lib 27private-lib
26 28
27memory-deny-write-execute 29memory-deny-write-execute
30noexec ${HOME}
31noexec /tmp
28 32
29include /etc/firejail/default.profile 33include /etc/firejail/default.profile
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-05 14:10:36 +0000