25 files changed, 208 insertions, 21 deletions

diff --git a/etc/Fritzing.profile b/etc/Fritzing.profile
new file mode 100644
index 000000000..0c4ad0647
--- /dev/null
+++ b/etc/Fritzing.profile
@@ -0,0 +1,35 @@
+# Firejail profile for fritzing
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/Fritzing.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+noblacklist ${HOME}/.config/Fritzing
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+include /etc/firejail/whitelist-var-common.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/Viber.profile b/etc/Viber.profile
index f5843bfd4..eb244efca 100644
--- a/etc/Viber.profile
+++ b/etc/Viber.profile
@@ -31,8 +31,10 @@ shell none
 
 disable-mnt
 private-bin sh,bash,dig,awk,Viber
-private-etc hosts,fonts,mailcap,resolv.conf,X11,pulse,alternatives,localtime,nsswitch.conf,ssl,proxychains.conf
+private-etc hosts,fonts,mailcap,resolv.conf,X11,pulse,alternatives,localtime,nsswitch.conf,ssl,proxychains.conf,pki,ca-certificates,crypto-policies
 private-tmp
 
 noexec ${HOME}
 noexec /tmp
+
+env QTWEBENGINE_DISABLE_SANDBOX=1
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 74e7e45a7..8cfcaa838 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -3,6 +3,7 @@
 include /etc/firejail/disable-programs.local
 
 blacklist ${HOME}/Monero/wallets
+blacklist ${HOME}/snap
 blacklist ${HOME}/.*coin
 blacklist ${HOME}/.8pecxstudios
 blacklist ${HOME}/.AndroidStudio*
@@ -13,6 +14,7 @@ blacklist ${HOME}/.IdeaIC*
 blacklist ${HOME}/.LuminanceHDR
 blacklist ${HOME}/.Mathematica
 blacklist ${HOME}/.Natron
+blacklist ${HOME}/.PyCharm*
 blacklist ${HOME}/.Skype
 blacklist ${HOME}/.Steam
 blacklist ${HOME}/.Steampath
@@ -41,6 +43,7 @@ blacklist ${HOME}/.config/Clementine
 blacklist ${HOME}/.config/Cryptocat
 blacklist ${HOME}/.config/Franz
 blacklist ${HOME}/.config/FreeCAD
+blacklist ${HOME}/.config/Fritzing
 blacklist ${HOME}/.config/Gitter
 blacklist ${HOME}/.config/Google
 blacklist ${HOME}/.config/Google Play Music Desktop Player
@@ -155,6 +158,7 @@ blacklist ${HOME}/.config/netsurf
 blacklist ${HOME}/.config/nheko
 blacklist ${HOME}/.config/okularpartrc
 blacklist ${HOME}/.config/okularrc
+blacklist ${HOME}/.config/onionshare
 blacklist ${HOME}/.config/opera
 blacklist ${HOME}/.config/opera-beta
 blacklist ${HOME}/.config/orage
@@ -162,6 +166,7 @@ blacklist ${HOME}/.config/org.kde.gwenviewrc
 blacklist ${HOME}/.config/pcmanfm
 blacklist ${HOME}/.config/pdfmod
 blacklist ${HOME}/.config/Pinta
+blacklist ${HOME}/.config/pitivi
 blacklist ${HOME}/.config/pix
 blacklist ${HOME}/.config/pluma
 blacklist ${HOME}/.config/psi+
diff --git a/etc/discord-canary.profile b/etc/discord-canary.profile
new file mode 100644
index 000000000..391af668e
--- /dev/null
+++ b/etc/discord-canary.profile
@@ -0,0 +1,23 @@
+# Firejail profile for discord-canary
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/discord-canary.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+whitelist ${DOWNLOADS}
+whitelist ${HOME}/.config/discordcanary
+
+caps.drop all
+netfilter
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+protocol unix,inet,inet6,netlink
+seccomp
diff --git a/etc/evince.profile b/etc/evince.profile
index 679aac08a..bbf0505cf 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -36,7 +36,7 @@ tracelog
 private-bin evince,evince-previewer,evince-thumbnailer
 private-dev
 private-etc fonts
-private-lib
+#private-lib - seems to be breaking on Gnome Shell 3.26.2, Mutter WM, issue 1711
 private-tmp
 
 memory-deny-write-execute
diff --git a/etc/firefox-developer-edition.profile b/etc/firefox-developer-edition.profile
new file mode 100644
index 000000000..696f95b56
--- /dev/null
+++ b/etc/firefox-developer-edition.profile
@@ -0,0 +1,10 @@
+# Firejail profile for firefox-developer-edition
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/firefox-developer-edition.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+# Redirect
+include /etc/firejail/firefox.profile
diff --git a/etc/firefox.profile b/etc/firefox.profile
index be7fdb12c..079cb1536 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -88,7 +88,7 @@ disable-mnt
 # private-bin firefox,which,sh,dbus-launch,dbus-send,env,bash
 private-dev
 # private-etc below works fine on most distributions. There are some problems on CentOS.
-# private-etc iceweasel,ca-certificates,ssl,machine-id,dconf,selinux,passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
+# private-etc iceweasel,ca-certificates,ssl,machine-id,dconf,selinux,passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse,pki,crypto-policies
 private-tmp
 
 noexec ${HOME}
diff --git a/etc/ideaIC.profile b/etc/ideaIC.profile
new file mode 100644
index 000000000..f7a69fa94
--- /dev/null
+++ b/etc/ideaIC.profile
@@ -0,0 +1,10 @@
+# Firejail profile for ideaIC
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/ideaIC.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+# Redirect
+include /etc/firejail/idea.sh.profile
diff --git a/etc/kwin_x11.profile b/etc/kwin_x11.profile
index 3ce4fe80d..91bb62efc 100644
--- a/etc/kwin_x11.profile
+++ b/etc/kwin_x11.profile
@@ -36,8 +36,5 @@ private-dev
 private-etc drirc,fonts,ld.so.cache,machine-id,xdg
 private-tmp
 
-# disable QML disk caching as it conflicts with the noexec constraints below
-env QML_DISABLE_DISK_CACHE=1
-
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/lollypop.profile b/etc/lollypop.profile
index c0c762c02..f42489cd3 100644
--- a/etc/lollypop.profile
+++ b/etc/lollypop.profile
@@ -25,7 +25,7 @@ seccomp
 shell none
 
 private-dev
-private-etc asound.conf,ca-certificates,fonts,host.conf,hostname,hosts,pulse,resolv.conf,ssl
+private-etc asound.conf,ca-certificates,fonts,host.conf,hostname,hosts,pulse,resolv.conf,ssl,pki,crypto-policies,gtk-3.0,xdg,machine-id
 private-tmp
 
 noexec ${HOME}
diff --git a/etc/minetest.profile b/etc/minetest.profile
index aa4c2218d..c560ac47c 100644
--- a/etc/minetest.profile
+++ b/etc/minetest.profile
@@ -33,7 +33,7 @@ disable-mnt
 private-bin minetest
 private-dev
 # private-etc needs to be updated, see #1702
-#private-etc asound.conf,ca-certificates,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pulse,resolv.conf,ssl
+#private-etc asound.conf,ca-certificates,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pulse,resolv.conf,ssl,pki,crypto-policies
 private-tmp
 
 noexec ${HOME}
diff --git a/etc/okular.profile b/etc/okular.profile
index 59c93bdb0..31b773852 100644
--- a/etc/okular.profile
+++ b/etc/okular.profile
@@ -43,10 +43,7 @@ tracelog
 private-bin okular,kbuildsycoca4,kdeinit4,lpr
 private-dev
 private-etc alternatives,cups,fonts,ld.so.cache,machine-id
-# private-tmp - on KDE we need access to the real /tmp for data exchange with thunderbird
-
-# disable QML disk caching as it conflicts with the noexec constraints below
-env QML_DISABLE_DISK_CACHE=1
+# private-tmp - on KDE we need access to the real /tmp for data exchange with email clients
 
 # memory-deny-write-execute
 noexec ${HOME}
diff --git a/etc/onionshare-gui.profile b/etc/onionshare-gui.profile
new file mode 100644
index 000000000..7220f7e1c
--- /dev/null
+++ b/etc/onionshare-gui.profile
@@ -0,0 +1,35 @@
+# Firejail profile for onionshare-gui
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/onionshare-gui.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+noblacklist ${HOME}/.config/onionshare
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+private-dev
+private-tmp
+
+memory-deny-write-execute
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/pitivi.profile b/etc/pitivi.profile
new file mode 100644
index 000000000..f2640ed66
--- /dev/null
+++ b/etc/pitivi.profile
@@ -0,0 +1,33 @@
+# Firejail profile for pitivi
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/pitivi.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.config/pitivi
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+novideo
+protocol unix
+seccomp
+shell none
+
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/pycharm-community.profile b/etc/pycharm-community.profile
new file mode 100644
index 000000000..b5e508d06
--- /dev/null
+++ b/etc/pycharm-community.profile
@@ -0,0 +1,32 @@
+# Firejail profile for pycharm-community
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/pycharm-community.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+noblacklist ${HOME}/snap
+noblacklist ${HOME}/.PyCharmCE*
+noblacklist ${HOME}/.java
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+machine-id
+nodvd
+nogroups
+nosound
+notv
+novideo
+shell none
+tracelog
+
+# private-etc fonts,passwd - minimal required to run but will probably break
+# program!
+private-dev
+private-tmp
+
+noexec /tmp
diff --git a/etc/pycharm-professional.profile b/etc/pycharm-professional.profile
new file mode 100644
index 000000000..b28082dc4
--- /dev/null
+++ b/etc/pycharm-professional.profile
@@ -0,0 +1,7 @@
+# Firejail profilen alias for pycharm-professional
+# This file is overwritten after every install/update
+
+noblacklist ${HOME}/.PyCharm*
+
+# Redirect
+include /etc/firejail/pycharm-community.profile
diff --git a/etc/quiterss.profile b/etc/quiterss.profile
index 0d02cacae..94c64f2dd 100644
--- a/etc/quiterss.profile
+++ b/etc/quiterss.profile
@@ -44,7 +44,7 @@ tracelog
 disable-mnt
 private-bin quiterss
 private-dev
-# private-etc X11,ssl
+# private-etc X11,ssl,pki,ca-certificates,crypto-policies
 
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/slack.profile b/etc/slack.profile
index faf875cf1..da1f86638 100644
--- a/etc/slack.profile
+++ b/etc/slack.profile
@@ -36,5 +36,5 @@ shell none
 disable-mnt
 private-bin slack
 private-dev
-private-etc asound.conf,ca-certificates,fonts,group,passwd,pulse,resolv.conf,ssl,ld.so.conf,ld.so.cache,localtime
+private-etc asound.conf,ca-certificates,fonts,group,passwd,pulse,resolv.conf,ssl,ld.so.conf,ld.so.cache,localtime,pki,crypto-policies
 private-tmp
diff --git a/etc/steam.profile b/etc/steam.profile
index a683bcc19..1e0fd57d1 100644
--- a/etc/steam.profile
+++ b/etc/steam.profile
@@ -47,5 +47,5 @@ shell none
 # private-dev should be commented for controllers
 private-dev
 # private-etc breaks some games
-#private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,ld.so.conf,ld.so.conf.d,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl,services
+#private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,ld.so.conf,ld.so.conf.d,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl,pki,services,crypto-policies
 private-tmp
diff --git a/etc/surf.profile b/etc/surf.profile
index 7dcbc280e..b91c09885 100644
--- a/etc/surf.profile
+++ b/etc/surf.profile
@@ -29,7 +29,7 @@ tracelog
 disable-mnt
 private-bin ls,surf,sh,bash,curl,dmenu,printf,sed,sleep,st,stterm,xargs,xprop
 private-dev
-private-etc passwd,group,hosts,resolv.conf,fonts,ssl
+private-etc passwd,group,hosts,resolv.conf,fonts,ssl,pki,ca-certificates,crypto-policies
 private-tmp
 
 noexec ${HOME}
diff --git a/etc/terasology.profile b/etc/terasology.profile
index 02a7baeb7..3d27134c4 100644
--- a/etc/terasology.profile
+++ b/etc/terasology.profile
@@ -37,7 +37,7 @@ shell none
 
 disable-mnt
 private-dev
-private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl,java-8-openjdk,java-7-openjdk
+private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl,java-8-openjdk,java-7-openjdk,pki,crypto-policies
 private-tmp
 
 noexec ${HOME}
diff --git a/etc/torbrowser-launcher.profile b/etc/torbrowser-launcher.profile
index 51a5d7735..b802478a2 100644
--- a/etc/torbrowser-launcher.profile
+++ b/etc/torbrowser-launcher.profile
@@ -33,7 +33,7 @@ tracelog
 disable-mnt
 private-bin bash,cp,dirname,env,expr,file,getconf,gpg,grep,id,ln,mkdir,python*,readlink,rm,sed,sh,tail,test,tor-browser-en,torbrowser-launcher
 private-dev
-private-etc fonts
+private-etc fonts,hostname,hosts,resolv.conf,pki,ssl,ca-certificates,crypto-policies
 private-tmp
 
 noexec /tmp
diff --git a/etc/transmission-qt.profile b/etc/transmission-qt.profile
index 0fe124631..b5a41622d 100644
--- a/etc/transmission-qt.profile
+++ b/etc/transmission-qt.profile
@@ -40,4 +40,5 @@ private-dev
 # private-lib - problems on Arch
 private-tmp
 
-memory-deny-write-execute
+# memory-deny-write-execute - problems on Qt 5.10.0, KDE Frameworks 5.41.0
+
diff --git a/etc/w3m.profile b/etc/w3m.profile
index 2d56aa660..d35ed9ae0 100644
--- a/etc/w3m.profile
+++ b/etc/w3m.profile
@@ -31,5 +31,5 @@ tracelog
 
 # private-bin w3m
 private-dev
-private-etc resolv.conf,ssl
+private-etc resolv.conf,ssl,pki,ca-certificates,crypto-policies
 private-tmp
diff --git a/etc/xonotic.profile b/etc/xonotic.profile
index b3d45dc71..d17d2b612 100644
--- a/etc/xonotic.profile
+++ b/etc/xonotic.profile
@@ -32,7 +32,7 @@ disable-mnt
 private-bin bash,blind-id,darkplaces-glx,darkplaces-sdl,dirname,grep,ldd,netstat,ps,readlink,sh,uname,xonotic,xonotic-glx,xonotic-linux32-dedicated,xonotic-linux32-glx,xonotic-linux32-sdl,xonotic-linux64-dedicated,xonotic-linux64-glx,xonotic-linux64-sdl,xonotic-sdl
 private-dev
 # private-etc breaks audio on some distros
-#private-etc asound.conf,ca-certificates,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pulse,resolv.conf,ssl
+#private-etc asound.conf,ca-certificates,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pulse,resolv.conf,ssl,pki,crypto-policies
 private-tmp
 
 noexec ${HOME}