diff options
Diffstat (limited to 'etc')
33 files changed, 561 insertions, 96 deletions
diff --git a/etc/Xephyr.profile b/etc/Xephyr.profile index a9960ebea..b4325cd74 100644 --- a/etc/Xephyr.profile +++ b/etc/Xephyr.profile | |||
@@ -40,4 +40,4 @@ private | |||
40 | # private-bin Xephyr,sh,xkbcomp,strace,bash,cat,ls | 40 | # private-bin Xephyr,sh,xkbcomp,strace,bash,cat,ls |
41 | private-dev | 41 | private-dev |
42 | # private-etc alternatives,ld.so.conf,ld.so.cache,resolv.conf,host.conf,nsswitch.conf,gai.conf,hosts,hostname | 42 | # private-etc alternatives,ld.so.conf,ld.so.cache,resolv.conf,host.conf,nsswitch.conf,gai.conf,hosts,hostname |
43 | private-tmp | 43 | #private-tmp |
diff --git a/etc/bitlbee.profile b/etc/bitlbee.profile index 2c2f88ed5..287e5f52e 100644 --- a/etc/bitlbee.profile +++ b/etc/bitlbee.profile | |||
@@ -33,6 +33,6 @@ private | |||
33 | private-cache | 33 | private-cache |
34 | private-dev | 34 | private-dev |
35 | private-tmp | 35 | private-tmp |
36 | read-write /var/lib/bitlbee | ||
37 | 36 | ||
38 | noexec /tmp | 37 | noexec /tmp |
38 | read-write /var/lib/bitlbee | ||
diff --git a/etc/cantata.profile b/etc/cantata.profile new file mode 100644 index 000000000..e4a4de9c1 --- /dev/null +++ b/etc/cantata.profile | |||
@@ -0,0 +1,40 @@ | |||
1 | # Firejail profile for Cantata | ||
2 | # Description: Multimedia player - Qt5 client for the music Player daemon (MPD) | ||
3 | # This file is overwritten during software install. | ||
4 | # Persistent local customizations | ||
5 | include cantata.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/cantata | ||
10 | noblacklist ${HOME}/.config/cantata | ||
11 | noblacklist ${HOME}/.local/share/cantata | ||
12 | noblacklist ${MUSIC} | ||
13 | |||
14 | noblacklist ${PATH}/perl | ||
15 | noblacklist /usr/lib/perl* | ||
16 | noblacklist /usr/share/perl* | ||
17 | |||
18 | include disable-common.inc | ||
19 | include disable-devel.inc | ||
20 | include disable-exec.inc | ||
21 | include disable-interpreters.inc | ||
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | ||
24 | include disable-xdg.inc | ||
25 | |||
26 | # apparmor | ||
27 | caps.drop all | ||
28 | ipc-namespace | ||
29 | netfilter | ||
30 | nonewprivs | ||
31 | noroot | ||
32 | nou2f | ||
33 | novideo | ||
34 | protocol unix,inet,inet6,netlink | ||
35 | seccomp | ||
36 | shell none | ||
37 | |||
38 | # private-etc samba,gcrypt,drirc,fonts,mpd.conf,kde5rc,passwd,xdg,hosts,ssl | ||
39 | private-bin cantata,mpd,perl | ||
40 | private-dev | ||
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index 7de2a620f..5481f976f 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc | |||
@@ -94,6 +94,7 @@ blacklist ${HOME}/.config/Nathan Osman | |||
94 | blacklist ${HOME}/.config/Nylas Mail | 94 | blacklist ${HOME}/.config/Nylas Mail |
95 | blacklist ${HOME}/.config/PBE | 95 | blacklist ${HOME}/.config/PBE |
96 | blacklist ${HOME}/.config/Qlipper | 96 | blacklist ${HOME}/.config/Qlipper |
97 | blacklist ${HOME}/.config/QGIS | ||
97 | blacklist ${HOME}/.config/QMediathekView | 98 | blacklist ${HOME}/.config/QMediathekView |
98 | blacklist ${HOME}/.config/QuiteRss | 99 | blacklist ${HOME}/.config/QuiteRss |
99 | blacklist ${HOME}/.config/QuiteRssrc | 100 | blacklist ${HOME}/.config/QuiteRssrc |
@@ -128,6 +129,7 @@ blacklist ${HOME}/.config/brasero | |||
128 | blacklist ${HOME}/.config/brave | 129 | blacklist ${HOME}/.config/brave |
129 | blacklist ${HOME}/.config/caja | 130 | blacklist ${HOME}/.config/caja |
130 | blacklist ${HOME}/.config/calibre | 131 | blacklist ${HOME}/.config/calibre |
132 | blacklist ${HOME}/.config/cantata | ||
131 | blacklist ${HOME}/.config/catfish | 133 | blacklist ${HOME}/.config/catfish |
132 | blacklist ${HOME}/.config/celluloid | 134 | blacklist ${HOME}/.config/celluloid |
133 | blacklist ${HOME}/.config/cherrytree | 135 | blacklist ${HOME}/.config/cherrytree |
@@ -208,6 +210,7 @@ blacklist ${HOME}/.config/kdeconnect | |||
208 | blacklist ${HOME}/.config/knotesrc | 210 | blacklist ${HOME}/.config/knotesrc |
209 | blacklist ${HOME}/.config/konversationrc | 211 | blacklist ${HOME}/.config/konversationrc |
210 | blacklist ${HOME}/.config/ktorrentrc | 212 | blacklist ${HOME}/.config/ktorrentrc |
213 | blacklist ${HOME}/.config/ktouch2rc | ||
211 | blacklist ${HOME}/.config/leafpad | 214 | blacklist ${HOME}/.config/leafpad |
212 | blacklist ${HOME}/.config/libreoffice | 215 | blacklist ${HOME}/.config/libreoffice |
213 | blacklist ${HOME}/.config/liferea | 216 | blacklist ${HOME}/.config/liferea |
@@ -218,6 +221,7 @@ blacklist ${HOME}/.config/mana | |||
218 | blacklist ${HOME}/.config/mate-calc | 221 | blacklist ${HOME}/.config/mate-calc |
219 | blacklist ${HOME}/.config/mate/eom | 222 | blacklist ${HOME}/.config/mate/eom |
220 | blacklist ${HOME}/.config/mate/mate-dictionary | 223 | blacklist ${HOME}/.config/mate/mate-dictionary |
224 | blacklist ${HOME}/.config/meteo-qt | ||
221 | blacklist ${HOME}/.config/mfusion | 225 | blacklist ${HOME}/.config/mfusion |
222 | blacklist ${HOME}/.config/midori | 226 | blacklist ${HOME}/.config/midori |
223 | blacklist ${HOME}/.config/mono | 227 | blacklist ${HOME}/.config/mono |
@@ -305,6 +309,7 @@ blacklist ${HOME}/.config/xreader | |||
305 | blacklist ${HOME}/.config/xviewer | 309 | blacklist ${HOME}/.config/xviewer |
306 | blacklist ${HOME}/.config/yandex-browser | 310 | blacklist ${HOME}/.config/yandex-browser |
307 | blacklist ${HOME}/.config/yandex-browser-beta | 311 | blacklist ${HOME}/.config/yandex-browser-beta |
312 | blacklist ${HOME}/.config/yelp | ||
308 | blacklist ${HOME}/.config/zathura | 313 | blacklist ${HOME}/.config/zathura |
309 | blacklist ${HOME}/.config/zoomus.conf | 314 | blacklist ${HOME}/.config/zoomus.conf |
310 | blacklist ${HOME}/.conkeror.mozdev.org | 315 | blacklist ${HOME}/.conkeror.mozdev.org |
@@ -436,6 +441,7 @@ blacklist ${HOME}/.local/share/JetBrains | |||
436 | blacklist ${HOME}/.local/share/Mendeley Ltd. | 441 | blacklist ${HOME}/.local/share/Mendeley Ltd. |
437 | blacklist ${HOME}/.local/share/Mumble | 442 | blacklist ${HOME}/.local/share/Mumble |
438 | blacklist ${HOME}/.local/share/PBE | 443 | blacklist ${HOME}/.local/share/PBE |
444 | blacklist ${HOME}/.local/share/QGIS | ||
439 | blacklist ${HOME}/.local/share/QMediathekView | 445 | blacklist ${HOME}/.local/share/QMediathekView |
440 | blacklist ${HOME}/.local/share/QuiteRss | 446 | blacklist ${HOME}/.local/share/QuiteRss |
441 | blacklist ${HOME}/.local/share/Ricochet | 447 | blacklist ${HOME}/.local/share/Ricochet |
@@ -451,6 +457,7 @@ blacklist ${HOME}/.local/share/aspyr-media | |||
451 | blacklist ${HOME}/.local/share/baloo | 457 | blacklist ${HOME}/.local/share/baloo |
452 | blacklist ${HOME}/.local/share/bibletime | 458 | blacklist ${HOME}/.local/share/bibletime |
453 | blacklist ${HOME}/.local/share/caja-python | 459 | blacklist ${HOME}/.local/share/caja-python |
460 | blacklist ${HOME}/.local/share/cantata | ||
454 | blacklist ${HOME}/.local/share/cdprojektred | 461 | blacklist ${HOME}/.local/share/cdprojektred |
455 | blacklist ${HOME}/.local/share/clipit | 462 | blacklist ${HOME}/.local/share/clipit |
456 | blacklist ${HOME}/.local/share/contacts | 463 | blacklist ${HOME}/.local/share/contacts |
@@ -491,6 +498,7 @@ blacklist ${HOME}/.local/share/knotes | |||
491 | blacklist ${HOME}/.local/share/krita | 498 | blacklist ${HOME}/.local/share/krita |
492 | blacklist ${HOME}/.local/share/ktorrentrc | 499 | blacklist ${HOME}/.local/share/ktorrentrc |
493 | blacklist ${HOME}/.local/share/ktorrent | 500 | blacklist ${HOME}/.local/share/ktorrent |
501 | blacklist ${HOME}/.local/share/ktouch | ||
494 | blacklist ${HOME}/.local/share/kwrite | 502 | blacklist ${HOME}/.local/share/kwrite |
495 | blacklist ${HOME}/.local/share/liferea | 503 | blacklist ${HOME}/.local/share/liferea |
496 | blacklist ${HOME}/.local/share/local-mail | 504 | blacklist ${HOME}/.local/share/local-mail |
@@ -549,6 +557,7 @@ blacklist ${HOME}/.minetest | |||
549 | blacklist ${HOME}/.moonchild productions/basilisk | 557 | blacklist ${HOME}/.moonchild productions/basilisk |
550 | blacklist ${HOME}/.moonchild productions/pale moon | 558 | blacklist ${HOME}/.moonchild productions/pale moon |
551 | blacklist ${HOME}/.mozilla | 559 | blacklist ${HOME}/.mozilla |
560 | blacklist ${HOME}/.mp3splt-gtk | ||
552 | blacklist ${HOME}/.mpd | 561 | blacklist ${HOME}/.mpd |
553 | blacklist ${HOME}/.mpdconf | 562 | blacklist ${HOME}/.mpdconf |
554 | blacklist ${HOME}/.mplayer | 563 | blacklist ${HOME}/.mplayer |
@@ -572,6 +581,7 @@ blacklist ${HOME}/.pingus | |||
572 | blacklist ${HOME}/.pioneer | 581 | blacklist ${HOME}/.pioneer |
573 | blacklist ${HOME}/.purple | 582 | blacklist ${HOME}/.purple |
574 | blacklist ${HOME}/.qemu-launcher | 583 | blacklist ${HOME}/.qemu-launcher |
584 | blacklist ${HOME}/.qgis2 | ||
575 | blacklist ${HOME}/.qmmp | 585 | blacklist ${HOME}/.qmmp |
576 | blacklist ${HOME}/.quodlibet | 586 | blacklist ${HOME}/.quodlibet |
577 | blacklist ${HOME}/.redeclipse | 587 | blacklist ${HOME}/.redeclipse |
@@ -648,6 +658,7 @@ blacklist ${HOME}/.cache/attic | |||
648 | blacklist ${HOME}/.cache/bnox | 658 | blacklist ${HOME}/.cache/bnox |
649 | blacklist ${HOME}/.cache/borg | 659 | blacklist ${HOME}/.cache/borg |
650 | blacklist ${HOME}/.cache/calibre | 660 | blacklist ${HOME}/.cache/calibre |
661 | blacklist ${HOME}/.cache/cantata | ||
651 | blacklist ${HOME}/.cache/champlain | 662 | blacklist ${HOME}/.cache/champlain |
652 | blacklist ${HOME}/.cache/chromium | 663 | blacklist ${HOME}/.cache/chromium |
653 | blacklist ${HOME}/.cache/chromium-dev | 664 | blacklist ${HOME}/.cache/chromium-dev |
diff --git a/etc/eo-common.profile b/etc/eo-common.profile new file mode 100644 index 000000000..ad18e10c4 --- /dev/null +++ b/etc/eo-common.profile | |||
@@ -0,0 +1,47 @@ | |||
1 | # Firejail profile for eo-common | ||
2 | # Description: Common profile for Eye of GNOME/MATE graphics viewer program | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include eo-common.local | ||
6 | # Persistent global definitions | ||
7 | # already included by caller profile | ||
8 | #include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.local/share/Trash | ||
11 | noblacklist ${HOME}/.Steam | ||
12 | noblacklist ${HOME}/.steam | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | ||
20 | |||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | ipc-namespace | ||
26 | machine-id | ||
27 | no3d | ||
28 | nodvd | ||
29 | nogroups | ||
30 | nonewprivs | ||
31 | noroot | ||
32 | nosound | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix,netlink | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | private-cache | ||
42 | private-dev | ||
43 | private-etc alternatives,dconf,fonts,gtk-3.0 | ||
44 | private-lib eog,eom,gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.* | ||
45 | private-tmp | ||
46 | |||
47 | #memory-deny-write-execute - breaks on Arch | ||
diff --git a/etc/eog.profile b/etc/eog.profile index 1dcc687fc..8e3aa42fe 100644 --- a/etc/eog.profile +++ b/etc/eog.profile | |||
@@ -6,46 +6,12 @@ include eog.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.Steam | ||
10 | noblacklist ${HOME}/.config/eog | 9 | noblacklist ${HOME}/.config/eog |
11 | noblacklist ${HOME}/.local/share/Trash | ||
12 | noblacklist ${HOME}/.steam | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | ||
20 | |||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | ipc-namespace | ||
26 | machine-id | ||
27 | no3d | ||
28 | nodvd | ||
29 | nogroups | ||
30 | nonewprivs | ||
31 | noroot | ||
32 | nosound | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | 10 | ||
41 | # private-bin, private-etc and private-lib break 'Open With' / 'Open in file manager' | 11 | # private-bin, private-etc and private-lib break 'Open With' / 'Open in file manager' |
42 | # comment those if you need that functionality | 12 | # comment those if you need that functionality |
43 | # or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eog.local | 13 | # or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eog.local |
44 | private-bin eog | 14 | private-bin eog |
45 | private-cache | ||
46 | private-dev | ||
47 | private-etc alternatives,fonts | ||
48 | private-lib eog,gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.* | ||
49 | private-tmp | ||
50 | 15 | ||
51 | # memory-deny-write-execute | 16 | # Redirect |
17 | include eo-common.profile | ||
diff --git a/etc/eom.profile b/etc/eom.profile index 7cb3f98cd..437326d38 100644 --- a/etc/eom.profile +++ b/etc/eom.profile | |||
@@ -6,42 +6,12 @@ include eom.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.Steam | ||
10 | noblacklist ${HOME}/.config/mate/eom | 9 | noblacklist ${HOME}/.config/mate/eom |
11 | noblacklist ${HOME}/.local/share/Trash | ||
12 | noblacklist ${HOME}/.steam | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | ||
20 | |||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | caps.drop all | ||
24 | no3d | ||
25 | nodvd | ||
26 | nogroups | ||
27 | nonewprivs | ||
28 | noroot | ||
29 | nosound | ||
30 | notv | ||
31 | nou2f | ||
32 | novideo | ||
33 | protocol unix | ||
34 | seccomp | ||
35 | shell none | ||
36 | tracelog | ||
37 | 10 | ||
38 | # private-bin, private-etc and private-lib break 'Open With' / 'Open in file manager' | 11 | # private-bin, private-etc and private-lib break 'Open With' / 'Open in file manager' |
39 | # comment those if you need that functionality | 12 | # comment those if you need that functionality |
40 | # or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eom.local | 13 | # or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eom.local |
41 | private-bin eom | 14 | private-bin eom |
42 | private-dev | ||
43 | private-etc alternatives,fonts | ||
44 | private-lib | ||
45 | private-tmp | ||
46 | 15 | ||
47 | #memory-deny-write-execute - breaks on Arch | 16 | # Redirect |
17 | include eo-common.profile | ||
diff --git a/etc/exiftool.profile b/etc/exiftool.profile index 2ee4aae6f..f694ea212 100644 --- a/etc/exiftool.profile +++ b/etc/exiftool.profile | |||
@@ -41,7 +41,7 @@ shell none | |||
41 | tracelog | 41 | tracelog |
42 | 42 | ||
43 | # To support exiftool in private-bin on Arch Linux (and derivatives), symlink /usr/bin/vendor_perl/exiftool to /usr/bin/exiftool and uncomment the below. | 43 | # To support exiftool in private-bin on Arch Linux (and derivatives), symlink /usr/bin/vendor_perl/exiftool to /usr/bin/exiftool and uncomment the below. |
44 | # Users on non-Arch Linux distributions can safely uncomment the below to enable extra hardening. | 44 | # Users on non-Arch Linux distributions can safely uncomment (or put in exiftool.local) the line below to enable extra hardening. |
45 | #private-bin exiftool,perl | 45 | #private-bin exiftool,perl |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
diff --git a/etc/firefox-common.profile b/etc/firefox-common.profile index 080d9e81a..bccbb3412 100644 --- a/etc/firefox-common.profile +++ b/etc/firefox-common.profile | |||
@@ -9,7 +9,7 @@ include firefox-common.local | |||
9 | # noexec ${HOME} breaks DRM binaries. | 9 | # noexec ${HOME} breaks DRM binaries. |
10 | ?BROWSER_ALLOW_DRM: ignore noexec ${HOME} | 10 | ?BROWSER_ALLOW_DRM: ignore noexec ${HOME} |
11 | 11 | ||
12 | # Uncomment the following line to allow access to common programs/addons/plugins. | 12 | # Uncomment the following line (or put it in your firefox-common.local) to allow access to common programs/addons/plugins. |
13 | #include firefox-common-addons.inc | 13 | #include firefox-common-addons.inc |
14 | 14 | ||
15 | noblacklist ${HOME}/.pki | 15 | noblacklist ${HOME}/.pki |
diff --git a/etc/firejail.config b/etc/firejail.config index 497d9633e..92df8ad1a 100644 --- a/etc/firejail.config +++ b/etc/firejail.config | |||
@@ -32,7 +32,7 @@ | |||
32 | 32 | ||
33 | # Disable /mnt, /media, /run/mount and /run/media access. By default access | 33 | # Disable /mnt, /media, /run/mount and /run/media access. By default access |
34 | # to these directories is enabled. Unlike --disable-mnt profile option this | 34 | # to these directories is enabled. Unlike --disable-mnt profile option this |
35 | # cannot be overridden by --noblacklist. | 35 | # cannot be overridden by --noblacklist or --ignore. |
36 | # disable-mnt no | 36 | # disable-mnt no |
37 | 37 | ||
38 | # Enable or disable file transfer support, default enabled. | 38 | # Enable or disable file transfer support, default enabled. |
diff --git a/etc/gnome-chess.profile b/etc/gnome-chess.profile index 2f4626891..04409a5e4 100644 --- a/etc/gnome-chess.profile +++ b/etc/gnome-chess.profile | |||
@@ -18,7 +18,10 @@ include disable-xdg.inc | |||
18 | 18 | ||
19 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
20 | 20 | ||
21 | apparmor | ||
21 | caps.drop all | 22 | caps.drop all |
23 | machine-id | ||
24 | net none | ||
22 | no3d | 25 | no3d |
23 | nodvd | 26 | nodvd |
24 | nogroups | 27 | nogroups |
@@ -35,6 +38,7 @@ tracelog | |||
35 | 38 | ||
36 | disable-mnt | 39 | disable-mnt |
37 | private-bin fairymax,gnome-chess,hoichess,gnuchess | 40 | private-bin fairymax,gnome-chess,hoichess,gnuchess |
41 | private-cache | ||
38 | private-dev | 42 | private-dev |
39 | private-etc alternatives,fonts,gnome-chess | 43 | private-etc alternatives,dconf,fonts,gnome-chess,gtk-3.0 |
40 | private-tmp | 44 | private-tmp |
diff --git a/etc/gpg.profile b/etc/gpg.profile index 47e6e5265..51662b59c 100644 --- a/etc/gpg.profile +++ b/etc/gpg.profile | |||
@@ -29,8 +29,7 @@ nou2f | |||
29 | novideo | 29 | novideo |
30 | protocol unix,inet,inet6 | 30 | protocol unix,inet,inet6 |
31 | seccomp | 31 | seccomp |
32 | # Causes gpg to hang | 32 | shell none |
33 | #shell none | ||
34 | tracelog | 33 | tracelog |
35 | 34 | ||
36 | # private-bin gpg,gpg-agent | 35 | # private-bin gpg,gpg-agent |
diff --git a/etc/inkview.profile b/etc/inkview.profile new file mode 100644 index 000000000..6c0127f37 --- /dev/null +++ b/etc/inkview.profile | |||
@@ -0,0 +1,8 @@ | |||
1 | # Firejail profile for inkview | ||
2 | # Description: an SVG slideshow program | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include inkview.local | ||
6 | |||
7 | # Redirect | ||
8 | include inkscape.profile | ||
diff --git a/etc/keepassxc.profile b/etc/keepassxc.profile index 33b4509b7..c1adfd516 100644 --- a/etc/keepassxc.profile +++ b/etc/keepassxc.profile | |||
@@ -41,7 +41,7 @@ protocol netlink,unix | |||
41 | seccomp | 41 | seccomp |
42 | shell none | 42 | shell none |
43 | 43 | ||
44 | private-bin keepassxc | 44 | private-bin keepassxc,keepassxc-proxy |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,fonts,ld.so.cache,machine-id | 46 | private-etc alternatives,fonts,ld.so.cache,machine-id |
47 | private-tmp | 47 | private-tmp |
diff --git a/etc/ktouch.profile b/etc/ktouch.profile new file mode 100644 index 000000000..446bc50ee --- /dev/null +++ b/etc/ktouch.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for KTouch | ||
2 | # Description: a typing tutor by KDE | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ktouch.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/ktouch2rc | ||
10 | noblacklist ${HOME}/.local/share/ktouch | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkfile ${HOME}/.config/ktouch2rc | ||
21 | mkdir ${HOME}/.local/share/ktouch | ||
22 | whitelist ${HOME}/.config/ktouch2rc | ||
23 | whitelist ${HOME}/.local/share/ktouch | ||
24 | include whitelist-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | machine-id | ||
30 | net none | ||
31 | nodbus | ||
32 | nodvd | ||
33 | nogroups | ||
34 | nonewprivs | ||
35 | noroot | ||
36 | nosound | ||
37 | notv | ||
38 | nou2f | ||
39 | novideo | ||
40 | protocol unix,netlink | ||
41 | seccomp | ||
42 | shell none | ||
43 | tracelog | ||
44 | |||
45 | disable-mnt | ||
46 | private-bin ktouch | ||
47 | private-cache | ||
48 | private-dev | ||
49 | private-etc alternatives,fonts,kde5rc,machine-id | ||
50 | private-tmp | ||
diff --git a/etc/libreoffice.profile b/etc/libreoffice.profile index 6e77cd741..5bb943323 100644 --- a/etc/libreoffice.profile +++ b/etc/libreoffice.profile | |||
@@ -29,9 +29,7 @@ include whitelist-var-common.inc | |||
29 | # comment the next line to use the ubuntu profile instead of firejail's apparmor profile | 29 | # comment the next line to use the ubuntu profile instead of firejail's apparmor profile |
30 | apparmor | 30 | apparmor |
31 | caps.drop all | 31 | caps.drop all |
32 | #machine-id | ||
33 | netfilter | 32 | netfilter |
34 | #nodbus | ||
35 | nodvd | 33 | nodvd |
36 | nogroups | 34 | nogroups |
37 | # comment nonewprivs when using the ubuntu 18.04/debian 10 apparmor profile | 35 | # comment nonewprivs when using the ubuntu 18.04/debian 10 apparmor profile |
@@ -50,5 +48,4 @@ tracelog | |||
50 | private-dev | 48 | private-dev |
51 | private-tmp | 49 | private-tmp |
52 | 50 | ||
53 | |||
54 | join-or-start libreoffice | 51 | join-or-start libreoffice |
diff --git a/etc/masterpdfeditor.profile b/etc/masterpdfeditor.profile index ce6486115..e4da0c66a 100644 --- a/etc/masterpdfeditor.profile +++ b/etc/masterpdfeditor.profile | |||
@@ -20,9 +20,7 @@ include whitelist-var-common.inc | |||
20 | 20 | ||
21 | apparmor | 21 | apparmor |
22 | caps.drop all | 22 | caps.drop all |
23 | ipc-namespace | ||
24 | machine-id | 23 | machine-id |
25 | no3d | ||
26 | nodvd | 24 | nodvd |
27 | nogroups | 25 | nogroups |
28 | nonewprivs | 26 | nonewprivs |
@@ -36,7 +34,6 @@ seccomp | |||
36 | shell none | 34 | shell none |
37 | tracelog | 35 | tracelog |
38 | 36 | ||
39 | private-bin masterpdfedito* | ||
40 | private-cache | 37 | private-cache |
41 | private-dev | 38 | private-dev |
42 | private-etc alternatives,fonts | 39 | private-etc alternatives,fonts |
diff --git a/etc/meteo-qt.profile b/etc/meteo-qt.profile new file mode 100644 index 000000000..a769a97ec --- /dev/null +++ b/etc/meteo-qt.profile | |||
@@ -0,0 +1,53 @@ | |||
1 | # Firejail profile for meteo-qt | ||
2 | # Description: System tray application for weather status information | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include meteo-qt.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/autostart | ||
10 | noblacklist ${HOME}/.config/meteo-qt | ||
11 | |||
12 | # Allow python (blacklisted by disable-interpreters.inc) | ||
13 | noblacklist ${PATH}/python3* | ||
14 | noblacklist /usr/lib/python3* | ||
15 | noblacklist /usr/local/lib/python3* | ||
16 | |||
17 | include disable-common.inc | ||
18 | include disable-devel.inc | ||
19 | include disable-exec.inc | ||
20 | include disable-interpreters.inc | ||
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | ||
23 | include disable-xdg.inc | ||
24 | |||
25 | whitelist ${HOME}/.config/autostart | ||
26 | mkdir ${HOME}/.config/meteo-qt | ||
27 | whitelist ${HOME}/.config/meteo-qt | ||
28 | include whitelist-common.inc | ||
29 | include whitelist-var-common.inc | ||
30 | |||
31 | caps.drop all | ||
32 | netfilter | ||
33 | nodbus | ||
34 | nodvd | ||
35 | nogroups | ||
36 | nonewprivs | ||
37 | noroot | ||
38 | nosound | ||
39 | notv | ||
40 | nou2f | ||
41 | novideo | ||
42 | protocol unix,inet,inet6 | ||
43 | seccomp | ||
44 | shell none | ||
45 | tracelog | ||
46 | |||
47 | disable-mnt | ||
48 | private-bin meteo-qt,python* | ||
49 | private-cache | ||
50 | private-dev | ||
51 | private-tmp | ||
52 | |||
53 | memory-deny-write-execute | ||
diff --git a/etc/mp3splt-gtk.profile b/etc/mp3splt-gtk.profile new file mode 100644 index 000000000..d14006112 --- /dev/null +++ b/etc/mp3splt-gtk.profile | |||
@@ -0,0 +1,41 @@ | |||
1 | # Firejail profile for mp3splt-gtk | ||
2 | # Description: Gtk utility for mp3/ogg splitting without decoding | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include mp3splt-gtk.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.mp3splt-gtk | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | |||
18 | include whitelist-var-common.inc | ||
19 | |||
20 | apparmor | ||
21 | caps.drop all | ||
22 | net none | ||
23 | no3d | ||
24 | nodbus | ||
25 | nodvd | ||
26 | nogroups | ||
27 | nonewprivs | ||
28 | noroot | ||
29 | notv | ||
30 | nou2f | ||
31 | novideo | ||
32 | protocol unix | ||
33 | seccomp | ||
34 | shell none | ||
35 | tracelog | ||
36 | |||
37 | private-bin mp3splt-gtk | ||
38 | private-cache | ||
39 | private-dev | ||
40 | private-etc alsa,alternatives,asound.conf,fonts,gtk-3.0,dconf,machine-id,openal,pulse | ||
41 | private-tmp | ||
diff --git a/etc/ocenaudio.profile b/etc/ocenaudio.profile index ceeb59384..b2249f63b 100644 --- a/etc/ocenaudio.profile +++ b/etc/ocenaudio.profile | |||
@@ -24,7 +24,7 @@ ipc-namespace | |||
24 | # net none breaks AppArmor on Ubuntu systems | 24 | # net none breaks AppArmor on Ubuntu systems |
25 | netfilter | 25 | netfilter |
26 | no3d | 26 | no3d |
27 | # nodbus - breaks preferences, comment when needed | 27 | # nodbus - breaks preferences, comment (or put 'ignore nodbus' in your oceanaudio.local) when needed |
28 | nodbus | 28 | nodbus |
29 | nodvd | 29 | nodvd |
30 | nogroups | 30 | nogroups |
@@ -39,12 +39,10 @@ shell none | |||
39 | tracelog | 39 | tracelog |
40 | 40 | ||
41 | # disable-mnt | 41 | # disable-mnt |
42 | # private | ||
43 | private-bin ocenaudio | 42 | private-bin ocenaudio |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | private-etc alternatives,asound.conf,fonts,ld.so.cache,pulse | 45 | private-etc alternatives,asound.conf,fonts,ld.so.cache,pulse |
47 | # private-lib | ||
48 | private-tmp | 46 | private-tmp |
49 | 47 | ||
50 | # memory-deny-write-execute - breaks on Arch | 48 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/orage.profile b/etc/orage.profile index 2c55ab909..4e12892d6 100644 --- a/etc/orage.profile +++ b/etc/orage.profile | |||
@@ -24,7 +24,7 @@ nodvd | |||
24 | nogroups | 24 | nogroups |
25 | nonewprivs | 25 | nonewprivs |
26 | noroot | 26 | noroot |
27 | nosound | 27 | # nosound - calendar application, It must be able to play sound to wake you up. |
28 | notv | 28 | notv |
29 | nou2f | 29 | nou2f |
30 | novideo | 30 | novideo |
diff --git a/etc/pidgin.profile b/etc/pidgin.profile index 444478149..bdd5404f5 100644 --- a/etc/pidgin.profile +++ b/etc/pidgin.profile | |||
@@ -6,9 +6,7 @@ include pidgin.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | mkdir ${HOME}/.purple | ||
10 | noblacklist ${HOME}/.purple | 9 | noblacklist ${HOME}/.purple |
11 | whitelist ${HOME}/.purple | ||
12 | 10 | ||
13 | ignore noexec ${RUNUSER} | 11 | ignore noexec ${RUNUSER} |
14 | ignore noexec /dev/shm | 12 | ignore noexec /dev/shm |
@@ -20,6 +18,9 @@ include disable-interpreters.inc | |||
20 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 19 | include disable-programs.inc |
22 | include disable-xdg.inc | 20 | include disable-xdg.inc |
21 | |||
22 | mkdir ${HOME}/.purple | ||
23 | whitelist ${HOME}/.purple | ||
23 | include whitelist-common.inc | 24 | include whitelist-common.inc |
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
diff --git a/etc/qgis.profile b/etc/qgis.profile new file mode 100644 index 000000000..45fe59cf7 --- /dev/null +++ b/etc/qgis.profile | |||
@@ -0,0 +1,60 @@ | |||
1 | # Firejail profile for qgis | ||
2 | # Description: GIS application | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include qgis.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/QtProject.conf | ||
10 | noblacklist ${HOME}/.config/QGIS | ||
11 | noblacklist ${HOME}/.local/share/QGIS | ||
12 | noblacklist ${HOME}/.qgis2 | ||
13 | noblacklist ${DOCUMENTS} | ||
14 | |||
15 | # Allow python (blacklisted by disable-interpreters.inc) | ||
16 | noblacklist ${PATH}/python3* | ||
17 | noblacklist /usr/lib/python3* | ||
18 | noblacklist /usr/local/lib/python3* | ||
19 | |||
20 | include disable-common.inc | ||
21 | include disable-devel.inc | ||
22 | include disable-exec.inc | ||
23 | include disable-interpreters.inc | ||
24 | include disable-passwdmgr.inc | ||
25 | include disable-programs.inc | ||
26 | include disable-xdg.inc | ||
27 | |||
28 | mkdir ${HOME}/.local/share/QGIS | ||
29 | mkdir ${HOME}/.qgis2 | ||
30 | mkdir ${HOME}/.config/QGIS | ||
31 | whitelist ${HOME}/.local/share/QGIS | ||
32 | whitelist ${HOME}/.qgis2 | ||
33 | whitelist ${HOME}/.config/QGIS | ||
34 | whitelist ${DOCUMENTS} | ||
35 | include whitelist-common.inc | ||
36 | include whitelist-var-common.inc | ||
37 | |||
38 | caps.drop all | ||
39 | netfilter | ||
40 | machine-id | ||
41 | nodbus | ||
42 | nodvd | ||
43 | nogroups | ||
44 | nonewprivs | ||
45 | noroot | ||
46 | nosound | ||
47 | notv | ||
48 | nou2f | ||
49 | novideo | ||
50 | # blacklisting of mbind system calls breaks old version | ||
51 | seccomp.drop @cpu-emulation,@debug,@obsolete,@privileged,set_mempolicy,migrate_pages,move_pages,open_by_handle_at,name_to_handle_at,ioprio_set,ni_syscall,syslog,fanotify_init,kcmp,add_key,request_key,keyctl,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,vmsplice,umount,userfaultfd,mincore | ||
52 | protocol unix,inet,inet6,netlink | ||
53 | shell none | ||
54 | tracelog | ||
55 | |||
56 | disable-mnt | ||
57 | private-cache | ||
58 | private-dev | ||
59 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl,QGIS,QGIS.conf,Trolltech.conf | ||
60 | private-tmp | ||
diff --git a/etc/seahorse.profile b/etc/seahorse.profile index cd9f6c767..fc54a0716 100644 --- a/etc/seahorse.profile +++ b/etc/seahorse.profile | |||
@@ -50,7 +50,7 @@ nou2f | |||
50 | novideo | 50 | novideo |
51 | protocol unix,inet,inet6 | 51 | protocol unix,inet,inet6 |
52 | seccomp | 52 | seccomp |
53 | # shell none - causes gpg to hang | 53 | shell none |
54 | tracelog | 54 | tracelog |
55 | 55 | ||
56 | disable-mnt | 56 | disable-mnt |
diff --git a/etc/spotify.profile b/etc/spotify.profile index 6f7f6ec85..00c2aabe2 100644 --- a/etc/spotify.profile +++ b/etc/spotify.profile | |||
@@ -6,9 +6,6 @@ include spotify.local | |||
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | blacklist ${HOME}/.bashrc | 8 | blacklist ${HOME}/.bashrc |
9 | blacklist /lost+found | ||
10 | blacklist /sbin | ||
11 | blacklist /srv | ||
12 | 9 | ||
13 | noblacklist ${HOME}/.cache/spotify | 10 | noblacklist ${HOME}/.cache/spotify |
14 | noblacklist ${HOME}/.config/spotify | 11 | noblacklist ${HOME}/.config/spotify |
@@ -49,5 +46,6 @@ private-bin spotify,bash,sh,zenity | |||
49 | private-dev | 46 | private-dev |
50 | private-etc alternatives,fonts,group,ld.so.cache,machine-id,pulse,resolv.conf,hosts,nsswitch.conf,host.conf,ca-certificates,ssl,pki,crypto-policies | 47 | private-etc alternatives,fonts,group,ld.so.cache,machine-id,pulse,resolv.conf,hosts,nsswitch.conf,host.conf,ca-certificates,ssl,pki,crypto-policies |
51 | private-opt spotify | 48 | private-opt spotify |
49 | private-srv none | ||
52 | private-tmp | 50 | private-tmp |
53 | 51 | ||
diff --git a/etc/sysprof.profile b/etc/sysprof.profile index 3cfea5c5e..e978e03f2 100644 --- a/etc/sysprof.profile +++ b/etc/sysprof.profile | |||
@@ -24,7 +24,7 @@ no3d | |||
24 | nodvd | 24 | nodvd |
25 | nogroups | 25 | nogroups |
26 | nonewprivs | 26 | nonewprivs |
27 | # Ubuntu 16.04 version needs root privileges - uncomment if you don't use that | 27 | # Ubuntu 16.04 version needs root privileges - uncomment or put in sysprof.local if you don't use that |
28 | #noroot | 28 | #noroot |
29 | nosound | 29 | nosound |
30 | notv | 30 | notv |
diff --git a/etc/templates/Notes b/etc/templates/Notes new file mode 100644 index 000000000..a4170207b --- /dev/null +++ b/etc/templates/Notes | |||
@@ -0,0 +1,7 @@ | |||
1 | Notes | ||
2 | ===== | ||
3 | |||
4 | * Lines with one # are often used | ||
5 | * Lines with two ## are only in special situation needed | ||
6 | * Add programs specific paths like .config/program to disable-programs.inc | ||
7 | * Add the name of the profile/program to src/firecfg/firecfg.config | ||
diff --git a/etc/templates/profile.template b/etc/templates/profile.template new file mode 100644 index 000000000..d7da0ed20 --- /dev/null +++ b/etc/templates/profile.template | |||
@@ -0,0 +1,82 @@ | |||
1 | # Firejail profile for PROGRAM_NAME | ||
2 | # Description: DESCRIPTION | ||
3 | # This file is overwritten after every install/update | ||
4 | ##quiet | ||
5 | # Persistent local customizations | ||
6 | #include PROFILE.local | ||
7 | # Persistent global definitions | ||
8 | #include globals.local | ||
9 | |||
10 | ##ignore noexec ${HOME} | ||
11 | |||
12 | ##blacklist PATH | ||
13 | |||
14 | #noblacklist PATH | ||
15 | |||
16 | # Allow python (blacklisted by disable-interpreters.inc) | ||
17 | #noblacklist ${PATH}/python2* | ||
18 | #noblacklist ${PATH}/python3* | ||
19 | #noblacklist /usr/lib/python2* | ||
20 | #noblacklist /usr/lib/python3* | ||
21 | #noblacklist /usr/local/lib/python2* | ||
22 | #noblacklist /usr/local/lib/python3* | ||
23 | |||
24 | #include disable-common.inc | ||
25 | #include disable-devel.inc | ||
26 | #include disable-exec.inc | ||
27 | #include disable-interpreters.inc | ||
28 | #include disable-passwdmgr.inc | ||
29 | #include disable-programs.inc | ||
30 | #include disable-xdg.inc | ||
31 | |||
32 | #mkdir PATH | ||
33 | #mkfile PATH | ||
34 | #whitelist PATH | ||
35 | #include whitelist-common.inc | ||
36 | #include whitelist-var-common.inc | ||
37 | |||
38 | #apparmor | ||
39 | #caps.drop all | ||
40 | # CLI only | ||
41 | ##ipc-namespace | ||
42 | #machine-id | ||
43 | # 'net none' or 'netfilter' | ||
44 | #net none | ||
45 | #netfilter | ||
46 | #no3d | ||
47 | #nodbus | ||
48 | #nodvd | ||
49 | #nogroups | ||
50 | #nonewprivs | ||
51 | #noroot | ||
52 | #nosound | ||
53 | #notv | ||
54 | #nou2f | ||
55 | #novideo | ||
56 | #protocol unix,inet,inet6,netlink | ||
57 | #seccomp | ||
58 | ##seccomp.drop SYSCALLS | ||
59 | #shell none | ||
60 | #tracelog | ||
61 | |||
62 | #disable-mnt | ||
63 | ##private | ||
64 | #private-bin PROGRAMS | ||
65 | #private-cache | ||
66 | #private-dev | ||
67 | #private-etc FILES | ||
68 | # private-etc templates (see also #1734) | ||
69 | # Internet: ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl | ||
70 | # Sound: alsa,asound.conf,machine-id,openal,pulse | ||
71 | # GTK: dconf,fonts,gtk-2.0,gtk-3.0,pango,xdg | ||
72 | # KDE/QT: fonts,kde4rc,kde5rc,ld.so.cache,machine-id,Trolltech.conf,xdg | ||
73 | # GUIs: fonts | ||
74 | # Alternatives: alternatives | ||
75 | ##private-lib LIBS | ||
76 | ##private-opt NAME | ||
77 | #private-tmp | ||
78 | |||
79 | ##env VAR=VALUE | ||
80 | #memory-deny-write-execute | ||
81 | ##read-only ${HOME} | ||
82 | ##join-or-start NAME | ||
diff --git a/etc/templates/redirect_alias-profile.template b/etc/templates/redirect_alias-profile.template new file mode 100644 index 000000000..56dd43ca4 --- /dev/null +++ b/etc/templates/redirect_alias-profile.template | |||
@@ -0,0 +1,36 @@ | |||
1 | # Firejail profile for PRGOGRAM_NAME | ||
2 | # Description: DESCRIPTION | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include PROFILE.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | #NOTE: let include globals.local commented | ||
10 | |||
11 | # Additional blacklisting (if needed) | ||
12 | #blacklist PATH | ||
13 | |||
14 | # Additional noblacklisting (if needed) | ||
15 | #noblacklist PATH | ||
16 | |||
17 | # Additional whitelisting (if needed) | ||
18 | #mkdir PATH | ||
19 | #mkfile PATH | ||
20 | #whitelist PATH | ||
21 | |||
22 | # Additional options if needed (see firejail-profile.example) | ||
23 | |||
24 | # Add programs to private-bin (if needed) | ||
25 | #private-bin PROGRAMS | ||
26 | # Add files to private-etc (if needed) | ||
27 | #private-etc FILES | ||
28 | |||
29 | # Ignore something that is in the included profile | ||
30 | #ignore net none | ||
31 | #ignore private-bin | ||
32 | #ignore seccomp | ||
33 | #... | ||
34 | |||
35 | # Redirect | ||
36 | include PROFILE.profile | ||
diff --git a/etc/templates/syscalls.txt b/etc/templates/syscalls.txt new file mode 100644 index 000000000..ec8247517 --- /dev/null +++ b/etc/templates/syscalls.txt | |||
@@ -0,0 +1,43 @@ | |||
1 | Hints for writing seccomp.drop lines | ||
2 | ==================================== | ||
3 | |||
4 | @clock=adjtimex,clock_adjtime,clock_settime,settimeofday,stime | ||
5 | @module=delete_module,finit_module,init_module | ||
6 | @raw-io=ioperm,iopl,pciconfig_iobase,pciconfig_read,pciconfig_write,s390_mmio_read,s390_mmio_write | ||
7 | @reboot=kexec_load,kexec_file_load,reboot, | ||
8 | @swap=swapon,swapoff | ||
9 | |||
10 | @privileged=@clock,@module,@raw-io,@reboot,@swap,acct,bpf,chroot,mount,nfsservctl,pivot_root,setdomainname,sethostname,umount2,vhangup | ||
11 | |||
12 | @cpu-emulation=modify_ldt,subpage_prot,switch_endian,vm86,vm86old | ||
13 | @debug=lookup_dcookie,perf_event_open,process_vm_writev,rtas,s390_runtime_instr,sys_debug_setcontext | ||
14 | @obsolete=_sysctl,afs_syscall,bdflush,break,create_module,ftime,get_kernel_syms,getpmsg,gtty,lock,mpx,prof,profil,putpmsg,query_module,security,sgetmask,ssetmask,stty,sysfs,tuxcall,ulimit,uselib,ustat,vserver | ||
15 | @resources=set_mempolicy,migrate_pages,move_pages,mbind | ||
16 | |||
17 | @default=@cpu-emulation,@debug,@obsolete,@privileged,@resources,open_by_handle_at,name_to_handle_at,ioprio_set,ni_syscall,syslog,fanotify_init,kcmp,add_key,request_key,keyctl,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,vmsplice,umount,userfaultfd,mincore | ||
18 | |||
19 | @default-nodebuggers=@default,ptrace,personality,process_vm_readv | ||
20 | |||
21 | @default-keep=execve,prctl | ||
22 | |||
23 | |||
24 | +---------+----------------+---------------+ | ||
25 | | @clock | @cpu-emulation | @default-keep | | ||
26 | | @module | @debug | | | ||
27 | | @raw-io | @obsolete | | | ||
28 | | @reboot | @resources | | | ||
29 | | @swap | | | | ||
30 | +---------+----------------+---------------+ | ||
31 | : : | ||
32 | +-------------+ : | ||
33 | | @privileged | : | ||
34 | +-------------+ : | ||
35 | : : | ||
36 | +----------+ : | ||
37 | | @default |........: | ||
38 | +----------+ | ||
39 | : | ||
40 | +----------------------+ | ||
41 | | @default-nodebuggers | | ||
42 | +----------------------+ | ||
43 | |||
diff --git a/etc/transgui.profile b/etc/transgui.profile index 8043bfa01..0d09cef87 100644 --- a/etc/transgui.profile +++ b/etc/transgui.profile | |||
@@ -2,7 +2,7 @@ | |||
2 | # Description: Cross-platform Transmission BitTorrent client | 2 | # Description: Cross-platform Transmission BitTorrent client |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include /etc/firejail/transgui.local | 5 | include transgui.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
diff --git a/etc/xiphos.profile b/etc/xiphos.profile index 3ad03e2c6..33056395e 100644 --- a/etc/xiphos.profile +++ b/etc/xiphos.profile | |||
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.xiphos | |||
13 | 13 | ||
14 | include disable-common.inc | 14 | include disable-common.inc |
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 19 | include disable-programs.inc |
@@ -20,8 +21,11 @@ include disable-programs.inc | |||
20 | whitelist ${HOME}/.sword | 21 | whitelist ${HOME}/.sword |
21 | whitelist ${HOME}/.xiphos | 22 | whitelist ${HOME}/.xiphos |
22 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-var-common.inc | ||
23 | 25 | ||
26 | apparmor | ||
24 | caps.drop all | 27 | caps.drop all |
28 | machine-id | ||
25 | netfilter | 29 | netfilter |
26 | nodvd | 30 | nodvd |
27 | nogroups | 31 | nogroups |
@@ -36,7 +40,9 @@ seccomp | |||
36 | shell none | 40 | shell none |
37 | tracelog | 41 | tracelog |
38 | 42 | ||
43 | disable-mnt | ||
39 | private-bin xiphos | 44 | private-bin xiphos |
45 | private-cache | ||
40 | private-dev | 46 | private-dev |
41 | private-etc alternatives,fonts,resolv.conf,sword,ca-certificates,ssl,pki,crypto-policies | 47 | private-etc alternatives,fonts,resolv.conf,sword,ca-certificates,ssli,sword.conf,pki,crypto-policies |
42 | private-tmp | 48 | private-tmp |
diff --git a/etc/yelp.profile b/etc/yelp.profile new file mode 100644 index 000000000..66f094e1d --- /dev/null +++ b/etc/yelp.profile | |||
@@ -0,0 +1,51 @@ | |||
1 | # Firejail profile for yelp | ||
2 | # Description: Help browser for the GNOME desktop | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include yelp.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/yelp | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.config/yelp | ||
20 | whitelist ${HOME}/.config/yelp | ||
21 | include whitelist-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | net none | ||
27 | nodvd | ||
28 | nogroups | ||
29 | nonewprivs | ||
30 | noroot | ||
31 | notv | ||
32 | nou2f | ||
33 | novideo | ||
34 | protocol unix | ||
35 | seccomp | ||
36 | shell none | ||
37 | tracelog | ||
38 | |||
39 | disable-mnt | ||
40 | private-bin yelp | ||
41 | private-cache | ||
42 | private-dev | ||
43 | private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,gtk-3.0,machine-id,openal,os-release,pulse,sgml,xml | ||
44 | private-tmp | ||
45 | |||
46 | # read-only ${HOME} breaks some not necesarry featrues, comment it if | ||
47 | # you need them or put 'ignore read-only ${HOME}' into your yelp.local. | ||
48 | # broken features: | ||
49 | # 1. yelp --editor-mode | ||
50 | # 2. saving the window geometry | ||
51 | read-only ${HOME} | ||