6 files changed, 45 insertions, 4 deletions

diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 00473de95..a5c7502db 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -30,6 +30,7 @@ blacklist ${HOME}/.cache/darktable
 blacklist ${HOME}/.cache/epiphany
 blacklist ${HOME}/.cache/evolution
 blacklist ${HOME}/.cache/gajim
+blacklist ${HOME}/.cache/geeqie
 blacklist ${HOME}/.cache/google-chrome
 blacklist ${HOME}/.cache/google-chrome-beta
 blacklist ${HOME}/.cache/google-chrome-unstable
@@ -103,6 +104,7 @@ blacklist ${HOME}/.config/evolution
 blacklist ${HOME}/.config/filezilla
 blacklist ${HOME}/.config/flowblade
 blacklist ${HOME}/.config/gajim
+blacklist ${HOME}/.config/geeqie
 blacklist ${HOME}/.config/gedit
 blacklist ${HOME}/.config/google-chrome
 blacklist ${HOME}/.config/google-chrome-beta
@@ -221,6 +223,7 @@ blacklist ${HOME}/.local/share/epiphany
 blacklist ${HOME}/.local/share/evolution
 blacklist ${HOME}/.local/share/feral-interactive
 blacklist ${HOME}/.local/share/gajim
+blacklist ${HOME}/.local/share/geeqie
 blacklist ${HOME}/.local/share/gnome-2048
 blacklist ${HOME}/.local/share/gnome-chess
 blacklist ${HOME}/.local/share/gnome-music
@@ -284,6 +287,7 @@ blacklist ${HOME}/.weechat
 blacklist ${HOME}/.wine
 blacklist ${HOME}/.wine64
 blacklist ${HOME}/.xiphos
+blacklist ${HOME}/.xmms
 blacklist ${HOME}/.xonotic
 blacklist ${HOME}/.xpdfrc
 blacklist ${HOME}/.zoom
diff --git a/etc/engrampa.profile b/etc/engrampa.profile
index b30b53085..da4872ca0 100644
--- a/etc/engrampa.profile
+++ b/etc/engrampa.profile
@@ -13,7 +13,6 @@ nogroups
 nonewprivs
 noroot
 nosound
-no3d
 protocol unix
 seccomp
 netfilter
diff --git a/etc/firefox.profile b/etc/firefox.profile
index e323cac91..e2cfb9138 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -54,5 +54,5 @@ include /etc/firejail/whitelist-common.inc
 # experimental features
 #private-bin firefox,which,sh,dbus-launch,dbus-send,env
 #private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
-private-dev
-private-tmp
+private-dev 
+#private-tmp
diff --git a/etc/firejail.config b/etc/firejail.config
index 766802a7d..0887e05b5 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -6,6 +6,9 @@
 # Enable or disable bind support, default enabled.
 # bind yes
 
+# Enable mounting a tmpfs on top of ~/.cache directory, default enabled.
+# cache-tmpfs yes
+
 # Enable or disable chroot support, default enabled.
 # chroot yes
 
@@ -14,6 +17,10 @@
 # and it will harden the rest of the chroot tree.
 # chroot-desktop yes
 
+# Disable /mnt, /media, /run/mount and /run/media access. By default access
+# to these directories is enabled.
+# disable-mnt no
+
 # Enable or disable file transfer support, default enabled.
 # file-transfer yes
 
@@ -26,6 +33,10 @@
 # Enabled by default
 # follow-symlink-as-user yes
 
+# Follow symlink for private-bin command.
+# Disabled by default
+# follow-symlink-private-bin no
+
 # Force use of nonewprivs.  This mitigates the possibility of
 # a user abusing firejail's features to trick a privileged (suid
 # or file capabilities) process into loading code or configuration
diff --git a/etc/geeqie.profile b/etc/geeqie.profile
new file mode 100644
index 000000000..57f942a50
--- /dev/null
+++ b/etc/geeqie.profile
@@ -0,0 +1,27 @@
+# This file is overwritten during software install.
+# Persistent customizations should go in a .local file.
+include /etc/firejail/geeqie.local
+
+# Firejail profile for Geeqie
+noblacklist ~/.cache/geeqie
+noblacklist ~/.config/geeqie
+noblacklist ~/.local/share/geeqie
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+
+caps.drop all
+nogroups
+nonewprivs
+noroot
+protocol unix
+seccomp
+nosound
+
+private-dev
+
+#Experimental:
+shell none
+#private-bin geeqie
+#private-etc X11
diff --git a/etc/vlc.profile b/etc/vlc.profile
index 9d1cdb4c8..0c96f0108 100644
--- a/etc/vlc.profile
+++ b/etc/vlc.profile
@@ -20,5 +20,5 @@ seccomp
 shell none
 
 private-bin vlc,cvlc,nvlc,rvlc,qvlc,svlc
-private-dev
+# private-dev
 private-tmp