41 files changed, 91 insertions, 6 deletions

diff --git a/etc/7za.profile b/etc/7za.profile
index 28e483a8c..14188e1f0 100644
--- a/etc/7za.profile
+++ b/etc/7za.profile
@@ -1,5 +1,6 @@
 # Firejail profile for 7za
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include 7za.local
 # Persistent global definitions
diff --git a/etc/7zr.profile b/etc/7zr.profile
index 1b85badbc..2cb42fa40 100644
--- a/etc/7zr.profile
+++ b/etc/7zr.profile
@@ -1,5 +1,6 @@
 # Firejail profile for 7zr
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include 7zr.local
 # Persistent global definitions
diff --git a/etc/Xephyr.profile b/etc/Xephyr.profile
index 5ef75022b..ab5fdf942 100644
--- a/etc/Xephyr.profile
+++ b/etc/Xephyr.profile
@@ -1,6 +1,7 @@
 # Firejail profile for Xephyr
 # This file is overwritten after every install/update
 # Persistent local customizations
+quiet
 include Xephyr.local
 # Persistent global definitions
 include globals.local
diff --git a/etc/Xvfb.profile b/etc/Xvfb.profile
index 3ecda698e..6559be21a 100644
--- a/etc/Xvfb.profile
+++ b/etc/Xvfb.profile
@@ -1,6 +1,7 @@
 # Firejail profile for Xvfb
 # Description: Virtual Framebuffer 'fake' X server
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include Xvfb.local
 # Persistent global definitions
diff --git a/etc/acat.profile b/etc/acat.profile
index f35adf3dc..522d8db4e 100644
--- a/etc/acat.profile
+++ b/etc/acat.profile
@@ -1,5 +1,6 @@
 # Firejail profile for acat
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include acat.local
 # Persistent global definitions
diff --git a/etc/adiff.profile b/etc/adiff.profile
index f22a27e79..a80886d56 100644
--- a/etc/adiff.profile
+++ b/etc/adiff.profile
@@ -1,5 +1,6 @@
 # Firejail profile for adiff
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include adiff.local
 # Persistent global definitions
diff --git a/etc/als.profile b/etc/als.profile
index aa7f29337..5eae228b6 100644
--- a/etc/als.profile
+++ b/etc/als.profile
@@ -1,5 +1,6 @@
 # Firejail profile for als
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include als.local
 # Persistent global definitions
diff --git a/etc/apack.profile b/etc/apack.profile
index b09d3d718..9fef911af 100644
--- a/etc/apack.profile
+++ b/etc/apack.profile
@@ -1,5 +1,6 @@
 # Firejail profile for apack
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include apack.local
 # Persistent global definitions
diff --git a/etc/arepack.profile b/etc/arepack.profile
index d23fc21db..012f2f049 100644
--- a/etc/arepack.profile
+++ b/etc/arepack.profile
@@ -1,5 +1,6 @@
 # Firejail profile for arepack
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include arepack.local
 # Persistent global definitions
diff --git a/etc/aunpack.profile b/etc/aunpack.profile
index c119ed9ad..6ce4aa491 100644
--- a/etc/aunpack.profile
+++ b/etc/aunpack.profile
@@ -1,5 +1,6 @@
 # Firejail profile for aunpack
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include aunpack.local
 # Persistent global definitions
diff --git a/etc/conplay.profile b/etc/conplay.profile
index 101ce2f17..d0ad7c753 100644
--- a/etc/conplay.profile
+++ b/etc/conplay.profile
@@ -1,4 +1,6 @@
 # Firejail profile for conplay
+# Description: MPEG audio player/decoder
+# This file is overwritten after every install/update
 # Persistent local customizations
 include conplay.local
 # Persistent global definitions
diff --git a/etc/dig.profile b/etc/dig.profile
index 6f2c1f755..611cbf026 100644
--- a/etc/dig.profile
+++ b/etc/dig.profile
@@ -1,7 +1,7 @@
 # Firejail profile for dig
 # Description: DNS lookup utility
-quiet
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include dig.local
 # Persistent global definitions
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index c0bf1f8d4..a3f7c570b 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -509,6 +509,8 @@ blacklist ${HOME}/.local/share/kaffeine
 blacklist ${HOME}/.local/share/kate
 blacklist ${HOME}/.local/share/kdenlive
 blacklist ${HOME}/.local/share/kget
+blacklist ${HOME}/.local/share/kiwix
+blacklist ${HOME}/.local/share/kiwix-desktop
 blacklist ${HOME}/.local/share/klavaro
 blacklist ${HOME}/.local/share/kmail2
 blacklist ${HOME}/.local/share/knotes
diff --git a/etc/dnscrypt-proxy.profile b/etc/dnscrypt-proxy.profile
index c04451373..bba94e3cb 100644
--- a/etc/dnscrypt-proxy.profile
+++ b/etc/dnscrypt-proxy.profile
@@ -1,6 +1,7 @@
 # Firejail profile for dnscrypt-proxy
 # Description: Tool for securing communications between a client and a DNS resolver
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include dnscrypt-proxy.local
 # Persistent global definitions
diff --git a/etc/dnsmasq.profile b/etc/dnsmasq.profile
index daf4795c3..dfb1b61c1 100644
--- a/etc/dnsmasq.profile
+++ b/etc/dnsmasq.profile
@@ -1,6 +1,7 @@
 # Firejail profile for dnsmasq
 # Description: Small caching DNS proxy and DHCP/TFTP server
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include dnsmasq.local
 # Persistent global definitions
diff --git a/etc/ffmpegthumbnailer.profile b/etc/ffmpegthumbnailer.profile
index 3681c40f1..6d72c3b99 100644
--- a/etc/ffmpegthumbnailer.profile
+++ b/etc/ffmpegthumbnailer.profile
@@ -1,6 +1,7 @@
 # Firejail profile for ffmpegthumbnailer
 # Description: FFmpeg-based video thumbnailer
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include ffmpegthumbnailer.local
 # Persistent global definitions
diff --git a/etc/ffplay.profile b/etc/ffplay.profile
index b42cc29bc..71187a5b5 100644
--- a/etc/ffplay.profile
+++ b/etc/ffplay.profile
@@ -1,6 +1,7 @@
 # Firejail profile for ffplay
 # Description: FFmpeg-based media player
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include ffplay.local
 # Persistent global definitions
diff --git a/etc/ffprobe.profile b/etc/ffprobe.profile
index bd8643206..cb24a7d05 100644
--- a/etc/ffprobe.profile
+++ b/etc/ffprobe.profile
@@ -1,6 +1,7 @@
 # Firejail profile for ffprobe
 # Description: FFmpeg-based media prober
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include ffprobe.local
 # Persistent global definitions
diff --git a/etc/kiwix-desktop.profile b/etc/kiwix-desktop.profile
new file mode 100644
index 000000000..db8f7880c
--- /dev/null
+++ b/etc/kiwix-desktop.profile
@@ -0,0 +1,49 @@
+# Firejail profile for kiwix-desktop
+# Description: view/manage ZIM files
+# This file is overwritten after every install/update
+# Persistent local customizations
+include kiwix-desktop.local
+# Persistent global definitions
+include globals.local
+
+noblacklist ${HOME}/.local/share/kiwix
+noblacklist ${HOME}/.local/share/kiwix-desktop
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include disable-xdg.inc
+
+mkdir ${HOME}/.local/share/kiwix
+mkdir ${HOME}/.local/share/kiwix-desktop
+whitelist ${HOME}/.local/share/kiwix
+whitelist ${HOME}/.local/share/kiwix-desktop
+include whitelist-common.inc
+include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+ipc-namespace
+netfilter
+# no3d
+nodbus
+nodvd
+nogroups
+nonewprivs
+noroot
+# nosound
+notv
+nou2f
+novideo
+protocol unix,inet,inet6,netlink
+seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
+shell none
+
+disable-mnt
+private-cache
+private-dev
+private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,machine-id,pki,pulse,resolv.conf,ssl
+private-tmp
diff --git a/etc/lrunzip.profile b/etc/lrunzip.profile
index 72abec8bb..c010cbd96 100644
--- a/etc/lrunzip.profile
+++ b/etc/lrunzip.profile
@@ -1,6 +1,7 @@
 # Firejail profile for lrunzip
 # Description: Multi-threaded compression with rzip/lzma, lzo and zpaq
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include lrunzip.local
 # Persistent global definitions
diff --git a/etc/lrz.profile b/etc/lrz.profile
index c1f928bde..8077be945 100644
--- a/etc/lrz.profile
+++ b/etc/lrz.profile
@@ -1,6 +1,7 @@
 # Firejail profile for lrz
 # Description: Multi-threaded compression with rzip/lzma, lzo and zpaq
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include lrz.local
 # Persistent global definitions
diff --git a/etc/lrzcat.profile b/etc/lrzcat.profile
index edcd7f8cd..d05ee7aae 100644
--- a/etc/lrzcat.profile
+++ b/etc/lrzcat.profile
@@ -1,6 +1,7 @@
 # Firejail profile for lrzcat
 # Description: Multi-threaded compression with rzip/lzma, lzo and zpaq
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include lrzcat.local
 # Persistent global definitions
diff --git a/etc/lrzip.profile b/etc/lrzip.profile
index a69096e28..3767767f6 100644
--- a/etc/lrzip.profile
+++ b/etc/lrzip.profile
@@ -1,6 +1,7 @@
 # Firejail profile for lrzip
 # Description: Multi-threaded compression with rzip/lzma, lzo and zpaq
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include lrzip.local
 # Persistent global definitions
diff --git a/etc/lrztar.profile b/etc/lrztar.profile
index 54b04b4ec..673e9f62e 100644
--- a/etc/lrztar.profile
+++ b/etc/lrztar.profile
@@ -1,6 +1,7 @@
 # Firejail profile for lrztar
 # Description: Multi-threaded compression with rzip/lzma, lzo and zpaq
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include lrztar.local
 # Persistent global definitions
diff --git a/etc/lrzuntar.profile b/etc/lrzuntar.profile
index f21169b24..245d1c669 100644
--- a/etc/lrzuntar.profile
+++ b/etc/lrzuntar.profile
@@ -1,6 +1,7 @@
 # Firejail profile for lrzuntar
 # Description: Multi-threaded compression with rzip/lzma, lzo and zpaq
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include lrzuntar.local
 # Persistent global definitions
diff --git a/etc/nano.profile b/etc/nano.profile
index 30a6e03e7..9965d8a6b 100644
--- a/etc/nano.profile
+++ b/etc/nano.profile
@@ -1,6 +1,7 @@
 # Firejail profile for nano
 # Description: nano is an easy text editor for the terminal
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include nano.local
 # Persistent global definitions
diff --git a/etc/p7zip.profile b/etc/p7zip.profile
index 644292f2b..7e0069afc 100644
--- a/etc/p7zip.profile
+++ b/etc/p7zip.profile
@@ -1,6 +1,7 @@
 # Firejail profile for p7zip
 # Description: 7zr file archiver with high compression ratio
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include p7zip.local
 # Persistent global definitions
diff --git a/etc/qt-faststart.profile b/etc/qt-faststart.profile
index cf459472a..2cdff33a6 100644
--- a/etc/qt-faststart.profile
+++ b/etc/qt-faststart.profile
@@ -1,6 +1,7 @@
 # Firejail profile for qt-faststart
 # Description: FFmpeg-based media utility
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include qt-faststart.local
 # Persistent global definitions
diff --git a/etc/rnano.profile b/etc/rnano.profile
index 565c957e0..d9048982a 100644
--- a/etc/rnano.profile
+++ b/etc/rnano.profile
@@ -1,6 +1,7 @@
 # Firejail profile for rnano
 # Description: A restricted nano
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include rnano.local
 # Persistent global definitions
diff --git a/etc/scp.profile b/etc/scp.profile
index ca902061c..287b8029a 100644
--- a/etc/scp.profile
+++ b/etc/scp.profile
@@ -1,6 +1,7 @@
 # Firejail profile for scp
 # Description: Secure shell copy
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include scp.local
 # Persistent global definitions
diff --git a/etc/seahorse-daemon.profile b/etc/seahorse-daemon.profile
index 7c0e59c74..6410da4d8 100644
--- a/etc/seahorse-daemon.profile
+++ b/etc/seahorse-daemon.profile
@@ -1,6 +1,7 @@
 # Firejail profile for seahorse-daemon
 # Description: PGP encryption and signing
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include seahorse-daemon.local
 # Persistent global definitions
diff --git a/etc/sftp.profile b/etc/sftp.profile
index c980e1751..66dc2a57b 100644
--- a/etc/sftp.profile
+++ b/etc/sftp.profile
@@ -1,6 +1,7 @@
 # Firejail profile for sftp
 # Description: Secure file transport protocol
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include sftp.local
 # Persistent global definitions
diff --git a/etc/tb-starter-wrapper.profile b/etc/tb-starter-wrapper.profile
index 8a7d45449..7cf85b387 100644
--- a/etc/tb-starter-wrapper.profile
+++ b/etc/tb-starter-wrapper.profile
@@ -13,7 +13,5 @@ noblacklist ${HOME}/.tb
 mkdir ${HOME}/.tb
 whitelist ${HOME}/.tb
 
-x11 xorg
-
 # Redirect
 include torbrowser-launcher.profile
diff --git a/etc/torbrowser-launcher.profile b/etc/torbrowser-launcher.profile
index 00b82e852..8485c0c4c 100644
--- a/etc/torbrowser-launcher.profile
+++ b/etc/torbrowser-launcher.profile
@@ -48,7 +48,7 @@ shell none
 #tracelog
 
 disable-mnt
-private-bin bash,cat,cp,cut,dirname,env,expr,file,getconf,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mv,pwd,python*,readlink,realpath,rm,sed,sh,tail,tar,tclsh,test,tor-browser,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity
+private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,kdialog,ln,mkdir,mv,python*,rm,sed,sh,tail,tar,tclsh,test,tor-browser,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity
 private-dev
-private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,machine-id,pki,pulse,resolv.conf,ssl
+private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,ld.so.cache,machine-id,pki,pulse,resolv.conf,ssl
 private-tmp
diff --git a/etc/transmission-create.profile b/etc/transmission-create.profile
index 9b84bc33a..92a4770e2 100644
--- a/etc/transmission-create.profile
+++ b/etc/transmission-create.profile
@@ -1,6 +1,7 @@
 # Firejail profile for transmission-create
 # Description: CLI utility to create BitTorrent .torrent files
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include transmission-create.local
 # Persistent global definitions
diff --git a/etc/transmission-edit.profile b/etc/transmission-edit.profile
index 07990aa15..6d8a98911 100644
--- a/etc/transmission-edit.profile
+++ b/etc/transmission-edit.profile
@@ -1,6 +1,7 @@
 # Firejail profile for transmission-edit
 # Description: CLI utility to modify BitTorrent .torrent files' announce URLs
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include transmission-edit.local
 # Persistent global definitions
diff --git a/etc/transmission-remote-cli.profile b/etc/transmission-remote-cli.profile
index 98b875fc5..2e7a31545 100644
--- a/etc/transmission-remote-cli.profile
+++ b/etc/transmission-remote-cli.profile
@@ -1,6 +1,7 @@
 # Firejail profile for transmission-remote-cli
 # Description: A remote control utility for transmission-daemon (CLI)
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include transmission-remote-cli.local
 # Persistent global definitions
diff --git a/etc/transmission-remote-gtk.profile b/etc/transmission-remote-gtk.profile
index b7173def5..5a57e4887 100644
--- a/etc/transmission-remote-gtk.profile
+++ b/etc/transmission-remote-gtk.profile
@@ -1,6 +1,7 @@
 # Firejail profile for transmission-remote-gtk
 # Description: A remote control utility for transmission-daemon (GTK GUI)
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include transmission-remote-gtk.local
 # Persistent global definitions
diff --git a/etc/whois.profile b/etc/whois.profile
index f101ee637..859542533 100644
--- a/etc/whois.profile
+++ b/etc/whois.profile
@@ -1,7 +1,7 @@
 # Firejail profile for whois
 # Description: Intelligent WHOIS client
-quiet
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include whois.local
 # Persistent global definitions
diff --git a/etc/xpra.profile b/etc/xpra.profile
index 6f66b9300..1033a7471 100644
--- a/etc/xpra.profile
+++ b/etc/xpra.profile
@@ -1,6 +1,7 @@
 # Firejail profile for xpra
 # Description: Tool to detach/reattach running X programs
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include xpra.local
 # Persistent global definitions
diff --git a/etc/zpaq.profile b/etc/zpaq.profile
index 6bf3605eb..80329ecfd 100644
--- a/etc/zpaq.profile
+++ b/etc/zpaq.profile
@@ -1,6 +1,7 @@
 # Firejail profile for zpaq
 # Description: Programmable file compressor, library and utilities. Based on the PAQ compression algorithm.
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include zpaq.local
 # Persistent global definitions