13 files changed, 217 insertions, 1 deletions

diff --git a/etc/atril.profile b/etc/atril.profile
index e078c1d20..c5b2abc48 100644
--- a/etc/atril.profile
+++ b/etc/atril.profile
@@ -1,4 +1,5 @@
 # Atril profile
+noblacklist ~/.config/atril
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
@@ -7,6 +8,10 @@ include /etc/firejail/disable-passwdmgr.inc
 caps.drop all
 seccomp
 protocol unix,inet,inet6
-netfilter
+net none
 noroot
 tracelog
+
+mkdir ~/.config
+mkdir ~/.config/atril
+whitelist ~/.config/atril
diff --git a/etc/aweather.profile b/etc/aweather.profile
new file mode 100644
index 000000000..d7f510a7e
--- /dev/null
+++ b/etc/aweather.profile
@@ -0,0 +1,23 @@
+# Firejail profile for aweather.
+
+# Noblacklist
+noblacklist ~/.config/aweather
+
+# Include
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+# Call these options
+caps.drop all
+netfilter
+noroot
+protocol unix,inet,inet6,netlink
+seccomp
+tracelog
+
+# Whitelist
+mkdir ~/.config
+mkdir ~/.config/aweather
+whitelist ~/.config/aweather
diff --git a/etc/cherrytree.profile b/etc/cherrytree.profile
index 7bcc61e98..77fa79e11 100644
--- a/etc/cherrytree.profile
+++ b/etc/cherrytree.profile
@@ -1,4 +1,6 @@
 # cherrytree note taking application
+noblacklist /usr/bin/python2*
+noblacklist /usr/lib/python2*
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index b1133f28f..9faa2aa6a 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -26,6 +26,14 @@ blacklist ${HOME}/.VirtualBox
 blacklist ${HOME}/VirtualBox VMs
 blacklist ${HOME}/.config/VirtualBox
 
+# VeraCrypt
+blacklist ${PATH}/veracrypt
+blacklist ${PATH}/veracrypt-uninstall.sh
+blacklist /usr/share/veracrypt
+blacklist /usr/share/applications/veracrypt.*
+blacklist /usr/share/pixmaps/veracrypt.*
+blacklist ${HOME}/.VeraCrypt
+
 # var
 blacklist /var/spool/cron
 blacklist /var/spool/anacron
@@ -133,3 +141,5 @@ blacklist ${PATH}/gnome-terminal
 blacklist ${PATH}/gnome-terminal.wrapper
 blacklist ${PATH}/xfce4-terminal
 blacklist ${PATH}/xfce4-terminal.wrapper
+blacklist ${PATH}/mate-terminal
+blacklist ${PATH}/mate-terminal.wrapper
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 7f18aa16f..317ac082f 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -5,9 +5,18 @@ blacklist ${HOME}/.FBReader
 blacklist ${HOME}/.wine
 blacklist ${HOME}/.Mathematica
 blacklist ${HOME}/.Wolfram Research
+blacklist ${HOME}/.stellarium
 blacklist ${HOME}/.config/mupen64plus
 blacklist ${HOME}/.config/transmission
 blacklist ${HOME}/.config/uGet
+blacklist ${HOME}/.config/Gpredict
+blacklist ${HOME}/.config/aweather
+blacklist ${HOME}/.config/stellarium
+blacklist ~/.kde/share/apps/okular
+blacklist ~/.kde/share/config/okularrc
+blacklist ~/.kde/share/config/okularpartrc
+blacklist ~/.kde/share/apps/gwenview
+blacklist ~/.kde/share/config/gwenviewrc
 
 # Media players
 blacklist ${HOME}/.config/cmus
@@ -54,6 +63,7 @@ blacklist ${HOME}/.hedgewars
 blacklist ${HOME}/.steam
 blacklist ${HOME}/.config/wesnoth
 blacklist ${HOME}/.config/0ad
+blacklist ${HOME}/.warzone2100-3.1
 
 # Cryptocoins
 blacklist ${HOME}/.*coin
diff --git a/etc/google-play-music-desktop-player.profile b/etc/google-play-music-desktop-player.profile
new file mode 100644
index 000000000..7fe43f1f6
--- /dev/null
+++ b/etc/google-play-music-desktop-player.profile
@@ -0,0 +1,17 @@
+# Google Play Music desktop player profile
+noblacklist ~/.config/Google Play Music Desktop Player
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+
+caps.drop all
+seccomp
+protocol unix,inet,inet6,netlink
+noroot
+netfilter
+
+#whitelist ~/.pulse
+#whitelist ~/.config/pulse
+whitelist ~/.config/Google Play Music Desktop Player
diff --git a/etc/gpredict.profile b/etc/gpredict.profile
new file mode 100644
index 000000000..f53cb1b4f
--- /dev/null
+++ b/etc/gpredict.profile
@@ -0,0 +1,23 @@
+# Firejail profile for gpredict.
+
+# Noblacklist
+noblacklist ~/.config/Gpredict
+
+# Include
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+# Call these options
+caps.drop all
+netfilter
+noroot
+protocol unix,inet,inet6,netlink
+seccomp
+tracelog
+
+# Whitelist
+mkdir ~/.config
+mkdir ~/.config/Gpredict
+whitelist ~/.config/Gpredict
diff --git a/etc/gwenview.profile b/etc/gwenview.profile
new file mode 100644
index 000000000..d61c57adc
--- /dev/null
+++ b/etc/gwenview.profile
@@ -0,0 +1,19 @@
+# KDE gwenview profile
+noblacklist ~/.kde/share/apps/gwenview
+noblacklist ~/.kde/share/config/gwenviewrc
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+caps.drop all
+seccomp
+protocol unix
+noroot
+nogroups
+private-dev
+
+#Experimental:
+#shell none
+#private-bin gwenview
+#private-etc X11
+
diff --git a/etc/hexchat.profile b/etc/hexchat.profile
index 8f6fd6217..7978960c8 100644
--- a/etc/hexchat.profile
+++ b/etc/hexchat.profile
@@ -1,5 +1,6 @@
 # HexChat instant messaging profile
 noblacklist ${HOME}/.config/hexchat
+noblacklist /usr/lib/python2*
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
@@ -8,3 +9,8 @@ caps.drop all
 seccomp
 protocol unix,inet,inet6
 noroot
+netfilter
+
+mkdir ~/.config
+mkdir ~/.config/hexchat
+whitelist ~/.config/hexchat
diff --git a/etc/netsurf.profile b/etc/netsurf.profile
new file mode 100644
index 000000000..26b621126
--- /dev/null
+++ b/etc/netsurf.profile
@@ -0,0 +1,34 @@
+# Firejail profile for Mozilla Firefox (Iceweasel in Debian)
+
+noblacklist ~/.config/netsurf
+noblacklist ~/.cache/netsurf
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
+
+caps.drop all
+seccomp
+protocol unix,inet,inet6,netlink
+netfilter
+tracelog
+noroot
+
+whitelist ${DOWNLOADS}
+mkdir ~/.config
+mkdir ~/.config/netsurf
+whitelist ~/.config/netsurf
+mkdir ~/.cache
+mkdir ~/.cache/netsurf
+whitelist ~/.cache/netsurf
+
+# lastpass, keepassx
+whitelist ~/.keepassx
+whitelist ~/.config/keepassx
+whitelist ~/keepassx.kdbx
+whitelist ~/.lastpass
+whitelist ~/.config/lastpass
+
+include /etc/firejail/whitelist-common.inc
+
+
+
diff --git a/etc/okular.profile b/etc/okular.profile
new file mode 100644
index 000000000..7929a8796
--- /dev/null
+++ b/etc/okular.profile
@@ -0,0 +1,21 @@
+# KDE okular profile
+noblacklist ~/.kde/share/apps/okular
+noblacklist ~/.kde/share/config/okularrc
+noblacklist ~/.kde/share/config/okularpartrc
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+caps.drop all
+seccomp
+protocol unix
+noroot
+nogroups
+private-dev
+
+#Experimental:
+#net none
+#shell none
+#private-bin okular,kbuildsycoca4,kbuildsycoca5
+#private-etc X11
+
diff --git a/etc/stellarium.profile b/etc/stellarium.profile
new file mode 100644
index 000000000..7cb74eeaa
--- /dev/null
+++ b/etc/stellarium.profile
@@ -0,0 +1,27 @@
+# Firejail profile for Stellarium.
+
+# Noblacklist
+noblacklist ~/.stellarium
+noblacklist ~/.config/stellarium
+
+# Include
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+# Call these options
+caps.drop all
+netfilter
+noroot
+protocol unix,inet,inet6,netlink
+seccomp
+tracelog
+
+# Whitelist
+mkdir ~/.stellarium
+whitelist ~/.stellarium
+
+mkdir ~/.config
+mkdir ~/.config/stellarium
+whitelist ~/.config/stellarium
diff --git a/etc/warzone2100.profile b/etc/warzone2100.profile
new file mode 100644
index 000000000..7588da657
--- /dev/null
+++ b/etc/warzone2100.profile
@@ -0,0 +1,19 @@
+# Firejail profile for warzone2100
+# Currently supports warzone2100-3.1
+noblacklist ~/.warzone2100-3.1
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+# Call these options
+caps.drop all
+netfilter
+noroot
+protocol unix,inet,inet6,netlink
+seccomp
+tracelog
+
+# Whitelist
+mkdir ~/.warzone2100-3.1
+whitelist ~/.warzone2100-3.1