diff options
Diffstat (limited to 'etc')
207 files changed, 1342 insertions, 103 deletions
diff --git a/etc/2048-qt.profile b/etc/2048-qt.profile index 2347039a6..12268706a 100644 --- a/etc/2048-qt.profile +++ b/etc/2048-qt.profile | |||
@@ -23,8 +23,9 @@ whitelist ${HOME}/.config/xiaoyong | |||
23 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
25 | 25 | ||
26 | apparmor | ||
26 | caps.drop all | 27 | caps.drop all |
27 | netfilter | 28 | net none |
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
diff --git a/etc/Screenshot.profile b/etc/Screenshot.profile new file mode 100644 index 000000000..d4b083736 --- /dev/null +++ b/etc/Screenshot.profile | |||
@@ -0,0 +1,6 @@ | |||
1 | # Firejail profile for gnome-screenshot | ||
2 | # This file is overwritten after every install/update | ||
3 | |||
4 | # Temporary fix for https://github.com/netblue30/firejail/issues/2624 | ||
5 | # Redirect | ||
6 | include gnome-screenshot.profile | ||
diff --git a/etc/Viber.profile b/etc/Viber.profile index 925e130de..3195e39fa 100644 --- a/etc/Viber.profile +++ b/etc/Viber.profile | |||
@@ -6,6 +6,7 @@ include Viber.local | |||
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | noblacklist ${HOME}/.ViberPC | 8 | noblacklist ${HOME}/.ViberPC |
9 | noblacklist ${PATH}/dig | ||
9 | 10 | ||
10 | include disable-common.inc | 11 | include disable-common.inc |
11 | include disable-devel.inc | 12 | include disable-devel.inc |
diff --git a/etc/abiword.profile b/etc/abiword.profile new file mode 100644 index 000000000..748cda195 --- /dev/null +++ b/etc/abiword.profile | |||
@@ -0,0 +1,46 @@ | |||
1 | # Firejail profile for abiword | ||
2 | # Description: flexible cross-platform word processor | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include abiword.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/abiword | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | |||
18 | whitelist /usr/share/abiword-3.0 | ||
19 | include whitelist-usr-share-common.inc | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | machine-id | ||
26 | net none | ||
27 | no3d | ||
28 | #nodbus | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | private-bin abiword | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc fonts,gtk-3.0,passwd | ||
46 | private-tmp | ||
diff --git a/etc/asunder.profile b/etc/asunder.profile index 1f3acd735..fceac7cf9 100644 --- a/etc/asunder.profile +++ b/etc/asunder.profile | |||
@@ -20,21 +20,25 @@ include disable-passwdmgr.inc | |||
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-xdg.inc | 21 | include disable-xdg.inc |
22 | 22 | ||
23 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
24 | 25 | ||
25 | apparmor | 26 | apparmor |
26 | caps.drop all | 27 | caps.drop all |
27 | netfilter | 28 | netfilter |
29 | no3d | ||
28 | nodbus | 30 | nodbus |
29 | # nogroups | 31 | # nogroups |
30 | nonewprivs | 32 | nonewprivs |
31 | noroot | 33 | noroot |
32 | nou2f | 34 | nou2f |
35 | notv | ||
33 | novideo | 36 | novideo |
34 | protocol unix,inet,inet6 | 37 | protocol unix,inet,inet6 |
35 | seccomp | 38 | seccomp |
36 | shell none | 39 | shell none |
37 | 40 | ||
41 | private-cache | ||
38 | private-dev | 42 | private-dev |
39 | private-tmp | 43 | private-tmp |
40 | 44 | ||
diff --git a/etc/atool.profile b/etc/atool.profile index 0250451fc..ff3c81a80 100644 --- a/etc/atool.profile +++ b/etc/atool.profile | |||
@@ -25,7 +25,6 @@ hostname atool | |||
25 | ipc-namespace | 25 | ipc-namespace |
26 | machine-id | 26 | machine-id |
27 | net none | 27 | net none |
28 | netfilter | ||
29 | no3d | 28 | no3d |
30 | nodvd | 29 | nodvd |
31 | nodbus | 30 | nodbus |
diff --git a/etc/audacious.profile b/etc/audacious.profile index 4d0c93047..1bba61a7f 100644 --- a/etc/audacious.profile +++ b/etc/audacious.profile | |||
@@ -39,5 +39,3 @@ tracelog | |||
39 | private-cache | 39 | private-cache |
40 | private-dev | 40 | private-dev |
41 | private-tmp | 41 | private-tmp |
42 | |||
43 | memory-deny-write-execute | ||
diff --git a/etc/audacity.profile b/etc/audacity.profile index 200d3a387..022b54d0f 100644 --- a/etc/audacity.profile +++ b/etc/audacity.profile | |||
@@ -40,5 +40,3 @@ tracelog | |||
40 | private-bin audacity | 40 | private-bin audacity |
41 | private-dev | 41 | private-dev |
42 | private-tmp | 42 | private-tmp |
43 | |||
44 | memory-deny-write-execute | ||
diff --git a/etc/baobab.profile b/etc/baobab.profile index 18c862a4d..a2cfa6d67 100644 --- a/etc/baobab.profile +++ b/etc/baobab.profile | |||
@@ -14,6 +14,8 @@ include disable-passwdmgr.inc | |||
14 | # include disable-programs.inc | 14 | # include disable-programs.inc |
15 | # include disable-xdg.inc | 15 | # include disable-xdg.inc |
16 | 16 | ||
17 | include whitelist-runuser-common.inc | ||
18 | |||
17 | caps.drop all | 19 | caps.drop all |
18 | net none | 20 | net none |
19 | no3d | 21 | no3d |
@@ -29,6 +31,7 @@ novideo | |||
29 | protocol unix | 31 | protocol unix |
30 | seccomp | 32 | seccomp |
31 | shell none | 33 | shell none |
34 | tracelog | ||
32 | 35 | ||
33 | private-bin baobab | 36 | private-bin baobab |
34 | private-dev | 37 | private-dev |
diff --git a/etc/bluefish.profile b/etc/bluefish.profile index 412088ba9..a85840d2f 100644 --- a/etc/bluefish.profile +++ b/etc/bluefish.profile | |||
@@ -15,6 +15,7 @@ include disable-programs.inc | |||
15 | 15 | ||
16 | include whitelist-var-common.inc | 16 | include whitelist-var-common.inc |
17 | 17 | ||
18 | apparmor | ||
18 | caps.drop all | 19 | caps.drop all |
19 | net none | 20 | net none |
20 | no3d | 21 | no3d |
diff --git a/etc/brasero.profile b/etc/brasero.profile index 67fc07afb..417a6b3e0 100644 --- a/etc/brasero.profile +++ b/etc/brasero.profile | |||
@@ -15,6 +15,9 @@ include disable-interpreters.inc | |||
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | 17 | ||
18 | include whitelist-var-common.inc | ||
19 | |||
20 | apparmor | ||
18 | caps.drop all | 21 | caps.drop all |
19 | net none | 22 | net none |
20 | nogroups | 23 | nogroups |
diff --git a/etc/calibre.profile b/etc/calibre.profile index ad6f0aa0d..d17cfa85f 100644 --- a/etc/calibre.profile +++ b/etc/calibre.profile | |||
@@ -19,6 +19,7 @@ include disable-xdg.inc | |||
19 | 19 | ||
20 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
21 | 21 | ||
22 | apparmor | ||
22 | caps.drop all | 23 | caps.drop all |
23 | netfilter | 24 | netfilter |
24 | nodvd | 25 | nodvd |
diff --git a/etc/catfish.profile b/etc/catfish.profile index c6c2d7e8a..577391c5d 100644 --- a/etc/catfish.profile +++ b/etc/catfish.profile | |||
@@ -24,6 +24,7 @@ include disable-passwdmgr.inc | |||
24 | whitelist /var/lib/mlocate | 24 | whitelist /var/lib/mlocate |
25 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
26 | 26 | ||
27 | apparmor | ||
27 | caps.drop all | 28 | caps.drop all |
28 | net none | 29 | net none |
29 | no3d | 30 | no3d |
diff --git a/etc/celluloid.profile b/etc/celluloid.profile index d099ba11e..daed19634 100644 --- a/etc/celluloid.profile +++ b/etc/celluloid.profile | |||
@@ -24,6 +24,7 @@ include disable-passwdmgr.inc | |||
24 | include disable-programs.inc | 24 | include disable-programs.inc |
25 | include disable-xdg.inc | 25 | include disable-xdg.inc |
26 | 26 | ||
27 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
28 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
29 | 30 | ||
diff --git a/etc/com.github.dahenson.agenda.profile b/etc/com.github.dahenson.agenda.profile new file mode 100644 index 000000000..ea5370649 --- /dev/null +++ b/etc/com.github.dahenson.agenda.profile | |||
@@ -0,0 +1,60 @@ | |||
1 | # Firejail profile for com.github.dahenson.agenda | ||
2 | # Description: Simple, fast, no-nonsense to-do (task) list | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include com.github.dahenson.agenda.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/agenda | ||
10 | noblacklist ${HOME}/.config/agenda | ||
11 | noblacklist ${HOME}/.local/share/agenda | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | mkdir ${HOME}/.cache/agenda | ||
22 | mkdir ${HOME}/.config/agenda | ||
23 | mkdir ${HOME}/.local/share/agenda | ||
24 | whitelist ${HOME}/.cache/agenda | ||
25 | whitelist ${HOME}/.config/agenda | ||
26 | whitelist ${HOME}/.local/share/agenda | ||
27 | include whitelist-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
29 | include whitelist-runuser-common.inc | ||
30 | include whitelist-var-common.inc | ||
31 | |||
32 | apparmor | ||
33 | caps.drop all | ||
34 | machine-id | ||
35 | net none | ||
36 | no3d | ||
37 | nodvd | ||
38 | nogroups | ||
39 | nonewprivs | ||
40 | noroot | ||
41 | nosound | ||
42 | notv | ||
43 | nou2f | ||
44 | novideo | ||
45 | protocol unix | ||
46 | seccomp | ||
47 | shell none | ||
48 | tracelog | ||
49 | |||
50 | disable-mnt | ||
51 | private-bin com.github.dahenson.agenda | ||
52 | private-cache | ||
53 | private-dev | ||
54 | private-etc dconf,fonts,gtk-3.0 | ||
55 | private-tmp | ||
56 | |||
57 | read-only ${HOME} | ||
58 | read-write ${HOME}/.cache/agenda | ||
59 | read-write ${HOME}/.config/agenda | ||
60 | read-write ${HOME}/.local/share/agenda | ||
diff --git a/etc/curl.profile b/etc/curl.profile index 3f93e5f7e..a33d084ce 100644 --- a/etc/curl.profile +++ b/etc/curl.profile | |||
@@ -10,6 +10,8 @@ include globals.local | |||
10 | noblacklist ${HOME}/.curlrc | 10 | noblacklist ${HOME}/.curlrc |
11 | 11 | ||
12 | blacklist /tmp/.X11-unix | 12 | blacklist /tmp/.X11-unix |
13 | blacklist ${RUNUSER}/wayland-* | ||
14 | blacklist ${RUNUSER} | ||
13 | 15 | ||
14 | include disable-common.inc | 16 | include disable-common.inc |
15 | include disable-exec.inc | 17 | include disable-exec.inc |
@@ -19,7 +21,9 @@ include disable-programs.inc | |||
19 | #include disable-xdg.inc | 21 | #include disable-xdg.inc |
20 | 22 | ||
21 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | ||
22 | 25 | ||
26 | apparmor | ||
23 | caps.drop all | 27 | caps.drop all |
24 | ipc-namespace | 28 | ipc-namespace |
25 | machine-id | 29 | machine-id |
diff --git a/etc/d-feet.profile b/etc/d-feet.profile index 897bf5f5d..51df7b455 100644 --- a/etc/d-feet.profile +++ b/etc/d-feet.profile | |||
@@ -24,6 +24,7 @@ mkdir ${HOME}/.config/d-feet | |||
24 | whitelist ${HOME}/.config/d-feet | 24 | whitelist ${HOME}/.config/d-feet |
25 | whitelist /usr/share/d-feet | 25 | whitelist /usr/share/d-feet |
26 | include whitelist-common.inc | 26 | include whitelist-common.inc |
27 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
28 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
29 | 30 | ||
diff --git a/etc/dconf-editor.profile b/etc/dconf-editor.profile index a9d25128f..e7cc66e32 100644 --- a/etc/dconf-editor.profile +++ b/etc/dconf-editor.profile | |||
@@ -16,6 +16,7 @@ include disable-xdg.inc | |||
16 | 16 | ||
17 | whitelist ${HOME}/.local/share/glib-2.0 | 17 | whitelist ${HOME}/.local/share/glib-2.0 |
18 | include whitelist-common.inc | 18 | include whitelist-common.inc |
19 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
diff --git a/etc/default.profile b/etc/default.profile index 95a6e8095..7731b6e00 100644 --- a/etc/default.profile +++ b/etc/default.profile | |||
@@ -16,6 +16,11 @@ include disable-passwdmgr.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | # include disable-xdg.inc | 17 | # include disable-xdg.inc |
18 | 18 | ||
19 | # include whitelist-common.inc | ||
20 | # include whitelist-usr-share-common.inc | ||
21 | # include whitelist-runuser-common.inc | ||
22 | # include whitelist-var-common.inc | ||
23 | |||
19 | # apparmor | 24 | # apparmor |
20 | caps.drop all | 25 | caps.drop all |
21 | # ipc-namespace | 26 | # ipc-namespace |
@@ -42,8 +47,11 @@ seccomp | |||
42 | # private-bin program | 47 | # private-bin program |
43 | # private-cache | 48 | # private-cache |
44 | # private-dev | 49 | # private-dev |
45 | # private-etc alternatives | 50 | # see /usr/share/doc/firejail/profile.template for more common private-etc paths. |
51 | # private-etc alternatives,fonts,machine-id | ||
46 | # private-lib | 52 | # private-lib |
53 | # private-opt none | ||
47 | # private-tmp | 54 | # private-tmp |
48 | 55 | ||
49 | # memory-deny-write-execute | 56 | # memory-deny-write-execute |
57 | # read-only ${HOME} | ||
diff --git a/etc/deluge.profile b/etc/deluge.profile index 8f4f9fbe9..17c5059f5 100644 --- a/etc/deluge.profile +++ b/etc/deluge.profile | |||
@@ -14,6 +14,7 @@ include allow-python3.inc | |||
14 | 14 | ||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | # include disable-devel.inc | 16 | # include disable-devel.inc |
17 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 20 | include disable-programs.inc |
@@ -24,6 +25,7 @@ whitelist ${HOME}/.config/deluge | |||
24 | include whitelist-common.inc | 25 | include whitelist-common.inc |
25 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
26 | 27 | ||
28 | apparmor | ||
27 | caps.drop all | 29 | caps.drop all |
28 | machine-id | 30 | machine-id |
29 | netfilter | 31 | netfilter |
diff --git a/etc/dia.profile b/etc/dia.profile index bd79797b7..3a8651e2e 100644 --- a/etc/dia.profile +++ b/etc/dia.profile | |||
@@ -19,6 +19,9 @@ include disable-passwdmgr.inc | |||
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-xdg.inc | 20 | include disable-xdg.inc |
21 | 21 | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
22 | caps.drop all | 25 | caps.drop all |
23 | net none | 26 | net none |
24 | no3d | 27 | no3d |
diff --git a/etc/dig.profile b/etc/dig.profile index 054e4891d..270a95c05 100644 --- a/etc/dig.profile +++ b/etc/dig.profile | |||
@@ -8,8 +8,11 @@ include dig.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | noblacklist ${HOME}/.digrc | 10 | noblacklist ${HOME}/.digrc |
11 | noblacklist ${PATH}/dig | ||
11 | 12 | ||
12 | blacklist /tmp/.X11-unix | 13 | blacklist /tmp/.X11-unix |
14 | blacklist ${RUNUSER}/wayland-* | ||
15 | blacklist ${RUNUSER} | ||
13 | 16 | ||
14 | include disable-common.inc | 17 | include disable-common.inc |
15 | # include disable-devel.inc | 18 | # include disable-devel.inc |
@@ -25,6 +28,7 @@ include whitelist-common.inc | |||
25 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
27 | 30 | ||
31 | apparmor | ||
28 | caps.drop all | 32 | caps.drop all |
29 | ipc-namespace | 33 | ipc-namespace |
30 | machine-id | 34 | machine-id |
@@ -47,7 +51,6 @@ tracelog | |||
47 | disable-mnt | 51 | disable-mnt |
48 | private | 52 | private |
49 | private-bin bash,dig,sh | 53 | private-bin bash,dig,sh |
50 | private-cache | ||
51 | private-dev | 54 | private-dev |
52 | # Uncomment the next line (or put 'private-lib' in your dig.local) on non Debian/Ubuntu OS (see issue #3038) | 55 | # Uncomment the next line (or put 'private-lib' in your dig.local) on non Debian/Ubuntu OS (see issue #3038) |
53 | #private-lib | 56 | #private-lib |
diff --git a/etc/disable-common.inc b/etc/disable-common.inc index bf29cd137..92c6cd2a8 100644 --- a/etc/disable-common.inc +++ b/etc/disable-common.inc | |||
@@ -166,6 +166,14 @@ blacklist ${HOME}/VirtualBox VMs | |||
166 | blacklist ${HOME}/.config/gnome-boxes | 166 | blacklist ${HOME}/.config/gnome-boxes |
167 | blacklist ${HOME}/.local/share/gnome-boxes | 167 | blacklist ${HOME}/.local/share/gnome-boxes |
168 | 168 | ||
169 | # libvirt | ||
170 | blacklist ${HOME}/.cache/libvirt | ||
171 | blacklist ${HOME}/.config/libvirt | ||
172 | blacklist ${RUNUSER}/libvirt | ||
173 | blacklist /var/cache/libvirt | ||
174 | blacklist /var/lib/libvirt | ||
175 | blacklist /var/log/libvirt | ||
176 | |||
169 | # VeraCrypt | 177 | # VeraCrypt |
170 | blacklist ${HOME}/.VeraCrypt | 178 | blacklist ${HOME}/.VeraCrypt |
171 | blacklist ${PATH}/veracrypt | 179 | blacklist ${PATH}/veracrypt |
@@ -444,8 +452,20 @@ blacklist /.snapshots | |||
444 | 452 | ||
445 | # flatpak | 453 | # flatpak |
446 | blacklist ${HOME}/.config/flatpak | 454 | blacklist ${HOME}/.config/flatpak |
447 | blacklist ${HOME}/.local/share/flatpak | 455 | blacklist ${HOME}/.local/share/flatpak/app |
456 | blacklist ${HOME}/.local/share/flatpak/appstream | ||
457 | blacklist ${HOME}/.local/share/flatpak/db | ||
458 | read-only ${HOME}/.local/share/flatpak/exports | ||
459 | blacklist ${HOME}/.local/share/flatpak/oci | ||
460 | blacklist ${HOME}/.local/share/flatpak/overrides | ||
461 | blacklist ${HOME}/.local/share/flatpak/repo | ||
462 | blacklist ${HOME}/.local/share/flatpak/runtime | ||
448 | blacklist ${HOME}/.var | 463 | blacklist ${HOME}/.var |
464 | blacklist ${RUNUSER}/app | ||
465 | blacklist ${RUNUSER}/doc | ||
466 | blacklist ${RUNUSER}/.dbus-proxy | ||
467 | blacklist ${RUNUSER}/.flatpak | ||
468 | blacklist ${RUNUSER}/.flatpak-helper | ||
449 | blacklist /usr/share/flatpak | 469 | blacklist /usr/share/flatpak |
450 | blacklist /var/lib/flatpak | 470 | blacklist /var/lib/flatpak |
451 | # most of the time bwrap is SUID binary | 471 | # most of the time bwrap is SUID binary |
@@ -462,3 +482,16 @@ blacklist ${HOME}/sent | |||
462 | 482 | ||
463 | # kernel configuration | 483 | # kernel configuration |
464 | blacklist /proc/config.gz | 484 | blacklist /proc/config.gz |
485 | |||
486 | # prevent DNS malware attempting to communicate with the server | ||
487 | # using regular DNS tools | ||
488 | blacklist ${PATH}/dig | ||
489 | blacklist ${PATH}/kdig | ||
490 | blacklist ${PATH}/nslookup | ||
491 | blacklist ${PATH}/host | ||
492 | blacklist ${PATH}/dlint | ||
493 | blacklist ${PATH}/dnswalk | ||
494 | blacklist ${PATH}/dns2tcp | ||
495 | blacklist ${PATH}/iodine | ||
496 | blacklist ${PATH}/knsupdate | ||
497 | blacklist ${PATH}/resolvectl | ||
diff --git a/etc/disable-devel.inc b/etc/disable-devel.inc index 59df9fb0f..e1ba13380 100644 --- a/etc/disable-devel.inc +++ b/etc/disable-devel.inc | |||
@@ -26,7 +26,6 @@ blacklist ${PATH}/*-gcc* | |||
26 | blacklist ${PATH}/*-g++* | 26 | blacklist ${PATH}/*-g++* |
27 | blacklist ${PATH}/*-gcc* | 27 | blacklist ${PATH}/*-gcc* |
28 | blacklist ${PATH}/*-g++* | 28 | blacklist ${PATH}/*-g++* |
29 | blacklist /usr/include | ||
30 | # seems to create problems on Gentoo | 29 | # seems to create problems on Gentoo |
31 | #blacklist /usr/lib/gcc | 30 | #blacklist /usr/lib/gcc |
32 | 31 | ||
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index db257c1b6..5bb2f851a 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc | |||
@@ -8,6 +8,8 @@ blacklist ${HOME}/Monero/wallets | |||
8 | blacklist ${HOME}/Nextcloud/Notes | 8 | blacklist ${HOME}/Nextcloud/Notes |
9 | blacklist ${HOME}/SoftMaker | 9 | blacklist ${HOME}/SoftMaker |
10 | blacklist ${HOME}/Standard Notes Backups | 10 | blacklist ${HOME}/Standard Notes Backups |
11 | blacklist ${HOME}/TeamSpeak3-Client-linux_x86 | ||
12 | blacklist ${HOME}/TeamSpeak3-Client-linux_amd64 | ||
11 | blacklist ${HOME}/mps | 13 | blacklist ${HOME}/mps |
12 | blacklist ${HOME}/wallet.dat | 14 | blacklist ${HOME}/wallet.dat |
13 | blacklist ${HOME}/.*coin | 15 | blacklist ${HOME}/.*coin |
@@ -73,6 +75,7 @@ blacklist ${HOME}/.config/Code Industry | |||
73 | blacklist ${HOME}/.config/Cryptocat | 75 | blacklist ${HOME}/.config/Cryptocat |
74 | blacklist ${HOME}/.config/Debauchee/Barrier.conf | 76 | blacklist ${HOME}/.config/Debauchee/Barrier.conf |
75 | blacklist ${HOME}/.config/Enox | 77 | blacklist ${HOME}/.config/Enox |
78 | blacklist ${HOME}/.config/Ferdi | ||
76 | blacklist ${HOME}/.config/Franz | 79 | blacklist ${HOME}/.config/Franz |
77 | blacklist ${HOME}/.config/FreeCAD | 80 | blacklist ${HOME}/.config/FreeCAD |
78 | blacklist ${HOME}/.config/Fritzing | 81 | blacklist ${HOME}/.config/Fritzing |
@@ -116,6 +119,8 @@ blacklist ${HOME}/.config/Thunar | |||
116 | blacklist ${HOME}/.config/VirtualBox | 119 | blacklist ${HOME}/.config/VirtualBox |
117 | blacklist ${HOME}/.config/Wire | 120 | blacklist ${HOME}/.config/Wire |
118 | blacklist ${HOME}/.config/Zeal | 121 | blacklist ${HOME}/.config/Zeal |
122 | blacklist ${HOME}/.config/abiword | ||
123 | blacklist ${HOME}/.config/agenda | ||
119 | blacklist ${HOME}/.config/akonadi* | 124 | blacklist ${HOME}/.config/akonadi* |
120 | blacklist ${HOME}/.config/akregatorrc | 125 | blacklist ${HOME}/.config/akregatorrc |
121 | blacklist ${HOME}/.config/ardour4 | 126 | blacklist ${HOME}/.config/ardour4 |
@@ -228,6 +233,7 @@ blacklist ${HOME}/.config/klavaro | |||
228 | blacklist ${HOME}/.config/klipperrc | 233 | blacklist ${HOME}/.config/klipperrc |
229 | blacklist ${HOME}/.config/kmail2rc | 234 | blacklist ${HOME}/.config/kmail2rc |
230 | blacklist ${HOME}/.config/kmailsearchindexingrc | 235 | blacklist ${HOME}/.config/kmailsearchindexingrc |
236 | blacklist ${HOME}/.config/kmplayerrc | ||
231 | blacklist ${HOME}/.config/knotesrc | 237 | blacklist ${HOME}/.config/knotesrc |
232 | blacklist ${HOME}/.config/konversationrc | 238 | blacklist ${HOME}/.config/konversationrc |
233 | blacklist ${HOME}/.config/kritarc | 239 | blacklist ${HOME}/.config/kritarc |
@@ -305,6 +311,7 @@ blacklist ${HOME}/.config/slimjet | |||
305 | blacklist ${HOME}/.config/smplayer | 311 | blacklist ${HOME}/.config/smplayer |
306 | blacklist ${HOME}/.config/smtube | 312 | blacklist ${HOME}/.config/smtube |
307 | blacklist ${HOME}/.config/snox | 313 | blacklist ${HOME}/.config/snox |
314 | blacklist ${HOME}/.config/sound-juicer | ||
308 | blacklist ${HOME}/.config/specialmailcollectionsrc | 315 | blacklist ${HOME}/.config/specialmailcollectionsrc |
309 | blacklist ${HOME}/.config/spotify | 316 | blacklist ${HOME}/.config/spotify |
310 | blacklist ${HOME}/.config/sqlitebrowser | 317 | blacklist ${HOME}/.config/sqlitebrowser |
@@ -327,6 +334,7 @@ blacklist ${HOME}/.config/vivaldi | |||
327 | blacklist ${HOME}/.config/vivaldi-snapshot | 334 | blacklist ${HOME}/.config/vivaldi-snapshot |
328 | blacklist ${HOME}/.config/vlc | 335 | blacklist ${HOME}/.config/vlc |
329 | blacklist ${HOME}/.config/wesnoth | 336 | blacklist ${HOME}/.config/wesnoth |
337 | blacklist ${HOME}/.config/wormux | ||
330 | blacklist ${HOME}/.config/Whalebird | 338 | blacklist ${HOME}/.config/Whalebird |
331 | blacklist ${HOME}/.config/wireshark | 339 | blacklist ${HOME}/.config/wireshark |
332 | blacklist ${HOME}/.config/xchat | 340 | blacklist ${HOME}/.config/xchat |
@@ -375,6 +383,7 @@ blacklist ${HOME}/.fossamail | |||
375 | blacklist ${HOME}/.freeciv | 383 | blacklist ${HOME}/.freeciv |
376 | blacklist ${HOME}/.freecol | 384 | blacklist ${HOME}/.freecol |
377 | blacklist ${HOME}/.freemind | 385 | blacklist ${HOME}/.freemind |
386 | blacklist ${HOME}/.frogatto | ||
378 | blacklist ${HOME}/.frozen-bubble | 387 | blacklist ${HOME}/.frozen-bubble |
379 | blacklist ${HOME}/.gimp* | 388 | blacklist ${HOME}/.gimp* |
380 | blacklist ${HOME}/.gist | 389 | blacklist ${HOME}/.gist |
@@ -424,6 +433,7 @@ blacklist ${HOME}/.kde/share/config/kfindrc | |||
424 | blacklist ${HOME}/.kde/share/config/kgetrc | 433 | blacklist ${HOME}/.kde/share/config/kgetrc |
425 | blacklist ${HOME}/.kde/share/config/khtmlrc | 434 | blacklist ${HOME}/.kde/share/config/khtmlrc |
426 | blacklist ${HOME}/.kde/share/config/klipperrc | 435 | blacklist ${HOME}/.kde/share/config/klipperrc |
436 | blacklist ${HOME}/.kde/share/config/kmplayerrc | ||
427 | blacklist ${HOME}/.kde/share/config/konq_history | 437 | blacklist ${HOME}/.kde/share/config/konq_history |
428 | blacklist ${HOME}/.kde/share/config/konqsidebartngrc | 438 | blacklist ${HOME}/.kde/share/config/konqsidebartngrc |
429 | blacklist ${HOME}/.kde/share/config/konquerorrc | 439 | blacklist ${HOME}/.kde/share/config/konquerorrc |
@@ -496,6 +506,7 @@ blacklist ${HOME}/.local/share/TpLogger | |||
496 | blacklist ${HOME}/.local/share/Zeal | 506 | blacklist ${HOME}/.local/share/Zeal |
497 | blacklist ${HOME}/.local/share/akonadi* | 507 | blacklist ${HOME}/.local/share/akonadi* |
498 | blacklist ${HOME}/.local/share/akregator | 508 | blacklist ${HOME}/.local/share/akregator |
509 | blacklist ${HOME}/.local/share/agenda | ||
499 | blacklist ${HOME}/.local/share/apps/korganizer | 510 | blacklist ${HOME}/.local/share/apps/korganizer |
500 | blacklist ${HOME}/.local/share/aspyr-media | 511 | blacklist ${HOME}/.local/share/aspyr-media |
501 | blacklist ${HOME}/.local/share/autokey | 512 | blacklist ${HOME}/.local/share/autokey |
@@ -531,10 +542,14 @@ blacklist ${HOME}/.local/share/gnome-2048 | |||
531 | blacklist ${HOME}/.local/share/gnome-chess | 542 | blacklist ${HOME}/.local/share/gnome-chess |
532 | blacklist ${HOME}/.local/share/gnome-builder | 543 | blacklist ${HOME}/.local/share/gnome-builder |
533 | blacklist ${HOME}/.local/share/gnome-latex | 544 | blacklist ${HOME}/.local/share/gnome-latex |
545 | blacklist ${HOME}/.local/share/gnome-mines | ||
534 | blacklist ${HOME}/.local/share/gnome-music | 546 | blacklist ${HOME}/.local/share/gnome-music |
547 | blacklist ${HOME}/.local/share/gnome-nibbles | ||
535 | blacklist ${HOME}/.local/share/gnome-photos | 548 | blacklist ${HOME}/.local/share/gnome-photos |
549 | blacklist ${HOME}/.local/share/gnome-pomodoro | ||
536 | blacklist ${HOME}/.local/share/gnome-recipes | 550 | blacklist ${HOME}/.local/share/gnome-recipes |
537 | blacklist ${HOME}/.local/share/gnome-ring | 551 | blacklist ${HOME}/.local/share/gnome-ring |
552 | blacklist ${HOME}/.local/share/gnome-sudoku | ||
538 | blacklist ${HOME}/.local/share/gnome-twitch | 553 | blacklist ${HOME}/.local/share/gnome-twitch |
539 | blacklist ${HOME}/.local/share/godot | 554 | blacklist ${HOME}/.local/share/godot |
540 | blacklist ${HOME}/.local/share/gradio | 555 | blacklist ${HOME}/.local/share/gradio |
@@ -549,6 +564,7 @@ blacklist ${HOME}/.local/share/kiwix | |||
549 | blacklist ${HOME}/.local/share/kiwix-desktop | 564 | blacklist ${HOME}/.local/share/kiwix-desktop |
550 | blacklist ${HOME}/.local/share/klavaro | 565 | blacklist ${HOME}/.local/share/klavaro |
551 | blacklist ${HOME}/.local/share/kmail2 | 566 | blacklist ${HOME}/.local/share/kmail2 |
567 | blacklist ${HOME}/.local/share/kmplayer | ||
552 | blacklist ${HOME}/.local/share/knotes | 568 | blacklist ${HOME}/.local/share/knotes |
553 | blacklist ${HOME}/.local/share/krita | 569 | blacklist ${HOME}/.local/share/krita |
554 | blacklist ${HOME}/.local/share/ktorrent | 570 | blacklist ${HOME}/.local/share/ktorrent |
@@ -603,6 +619,7 @@ blacklist ${HOME}/.local/share/vpltd | |||
603 | blacklist ${HOME}/.local/share/vulkan | 619 | blacklist ${HOME}/.local/share/vulkan |
604 | blacklist ${HOME}/.local/share/warsow-2.1 | 620 | blacklist ${HOME}/.local/share/warsow-2.1 |
605 | blacklist ${HOME}/.local/share/wesnoth | 621 | blacklist ${HOME}/.local/share/wesnoth |
622 | blacklist ${HOME}/.local/share/wormux | ||
606 | blacklist ${HOME}/.local/share/xplayer | 623 | blacklist ${HOME}/.local/share/xplayer |
607 | blacklist ${HOME}/.local/share/xreader | 624 | blacklist ${HOME}/.local/share/xreader |
608 | blacklist ${HOME}/.local/share/zathura | 625 | blacklist ${HOME}/.local/share/zathura |
@@ -638,6 +655,7 @@ blacklist ${HOME}/.openttd | |||
638 | blacklist ${HOME}/.opera | 655 | blacklist ${HOME}/.opera |
639 | blacklist ${HOME}/.opera-beta | 656 | blacklist ${HOME}/.opera-beta |
640 | blacklist ${HOME}/.ostrichriders | 657 | blacklist ${HOME}/.ostrichriders |
658 | blacklist ${HOME}/.penguin-command | ||
641 | blacklist ${HOME}/.pingus | 659 | blacklist ${HOME}/.pingus |
642 | blacklist ${HOME}/.pioneer | 660 | blacklist ${HOME}/.pioneer |
643 | blacklist ${HOME}/.purple | 661 | blacklist ${HOME}/.purple |
@@ -650,6 +668,7 @@ blacklist ${HOME}/.remmina | |||
650 | blacklist ${HOME}/.repo_.gitconfig.json | 668 | blacklist ${HOME}/.repo_.gitconfig.json |
651 | blacklist ${HOME}/.repoconfig | 669 | blacklist ${HOME}/.repoconfig |
652 | blacklist ${HOME}/.retroshare | 670 | blacklist ${HOME}/.retroshare |
671 | blacklist ${HOME}/.ripperXrc | ||
653 | blacklist ${HOME}/.scorched3d | 672 | blacklist ${HOME}/.scorched3d |
654 | blacklist ${HOME}/.scribus | 673 | blacklist ${HOME}/.scribus |
655 | blacklist ${HOME}/.scribusrc | 674 | blacklist ${HOME}/.scribusrc |
@@ -697,6 +716,7 @@ blacklist ${HOME}/.widelands | |||
697 | blacklist ${HOME}/.wine | 716 | blacklist ${HOME}/.wine |
698 | blacklist ${HOME}/.wine64 | 717 | blacklist ${HOME}/.wine64 |
699 | blacklist ${HOME}/.wireshark | 718 | blacklist ${HOME}/.wireshark |
719 | blacklist ${HOME}/.wormux | ||
700 | blacklist ${HOME}/.xiphos | 720 | blacklist ${HOME}/.xiphos |
701 | blacklist ${HOME}/.xmind | 721 | blacklist ${HOME}/.xmind |
702 | blacklist ${HOME}/.xmms | 722 | blacklist ${HOME}/.xmms |
@@ -721,12 +741,14 @@ blacklist ${HOME}/.cache/BraveSoftware | |||
721 | blacklist ${HOME}/.cache/Clementine | 741 | blacklist ${HOME}/.cache/Clementine |
722 | blacklist ${HOME}/.cache/Enox | 742 | blacklist ${HOME}/.cache/Enox |
723 | blacklist ${HOME}/.cache/Enpass | 743 | blacklist ${HOME}/.cache/Enpass |
744 | blacklist ${HOME}/.cache/Ferdi | ||
724 | blacklist ${HOME}/.cache/Franz | 745 | blacklist ${HOME}/.cache/Franz |
725 | blacklist ${HOME}/.cache/INRIA | 746 | blacklist ${HOME}/.cache/INRIA |
726 | blacklist ${HOME}/.cache/MusicBrainz | 747 | blacklist ${HOME}/.cache/MusicBrainz |
727 | blacklist ${HOME}/.cache/QuiteRss | 748 | blacklist ${HOME}/.cache/QuiteRss |
728 | blacklist ${HOME}/.cache/Tox | 749 | blacklist ${HOME}/.cache/Tox |
729 | blacklist ${HOME}/.cache/Zeal | 750 | blacklist ${HOME}/.cache/Zeal |
751 | blacklist ${HOME}/.cache/agenda | ||
730 | blacklist ${HOME}/.cache/akonadi* | 752 | blacklist ${HOME}/.cache/akonadi* |
731 | blacklist ${HOME}/.cache/atril | 753 | blacklist ${HOME}/.cache/atril |
732 | blacklist ${HOME}/.cache/attic | 754 | blacklist ${HOME}/.cache/attic |
@@ -759,6 +781,7 @@ blacklist ${HOME}/.cache/gfeeds | |||
759 | blacklist ${HOME}/.cache/gimp | 781 | blacklist ${HOME}/.cache/gimp |
760 | blacklist ${HOME}/.cache/gnome-builder | 782 | blacklist ${HOME}/.cache/gnome-builder |
761 | blacklist ${HOME}/.cache/gnome-recipes | 783 | blacklist ${HOME}/.cache/gnome-recipes |
784 | blacklist ${HOME}/.cache/gnome-screenshot | ||
762 | blacklist ${HOME}/.cache/gnome-twitch | 785 | blacklist ${HOME}/.cache/gnome-twitch |
763 | blacklist ${HOME}/.cache/godot | 786 | blacklist ${HOME}/.cache/godot |
764 | blacklist ${HOME}/.cache/google-chrome | 787 | blacklist ${HOME}/.cache/google-chrome |
diff --git a/etc/discord-common.profile b/etc/discord-common.profile index a6e730937..cbeef798f 100644 --- a/etc/discord-common.profile +++ b/etc/discord-common.profile | |||
@@ -6,12 +6,17 @@ include discord-common.local | |||
6 | # added by caller profile | 6 | # added by caller profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | ignore noexec ${HOME} | ||
10 | |||
9 | include disable-common.inc | 11 | include disable-common.inc |
10 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
11 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
12 | include disable-programs.inc | 15 | include disable-programs.inc |
13 | 16 | ||
14 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
18 | whitelist ${HOME}/.config/BetterDiscord | ||
19 | whitelist ${HOME}/.local/share/betterdiscordctl | ||
15 | include whitelist-common.inc | 20 | include whitelist-common.inc |
16 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
17 | 22 | ||
@@ -25,11 +30,9 @@ notv | |||
25 | nou2f | 30 | nou2f |
26 | novideo | 31 | novideo |
27 | protocol unix,inet,inet6,netlink | 32 | protocol unix,inet,inet6,netlink |
28 | seccomp | 33 | seccomp !chroot |
29 | 34 | ||
30 | private-bin bash,cut,echo,egrep,grep,head,sed,sh,tr,xdg-mime,xdg-open,zsh | 35 | private-bin bash,cut,echo,egrep,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh |
31 | private-dev | 36 | private-dev |
32 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,resolv.conf,ssl | 37 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,resolv.conf,ssl |
33 | private-tmp | 38 | private-tmp |
34 | |||
35 | noexec /tmp | ||
diff --git a/etc/elinks.profile b/etc/elinks.profile index 82d1ba528..2a306d704 100644 --- a/etc/elinks.profile +++ b/etc/elinks.profile | |||
@@ -18,6 +18,8 @@ include disable-passwdmgr.inc | |||
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-xdg.inc | 19 | include disable-xdg.inc |
20 | 20 | ||
21 | include whitelist-runuser-common.inc | ||
22 | |||
21 | caps.drop all | 23 | caps.drop all |
22 | netfilter | 24 | netfilter |
23 | no3d | 25 | no3d |
diff --git a/etc/enchant.profile b/etc/enchant.profile index fa556c7d2..69e8b1e44 100644 --- a/etc/enchant.profile +++ b/etc/enchant.profile | |||
@@ -21,6 +21,7 @@ include disable-xdg.inc | |||
21 | mkdir ${HOME}/.config/enchant | 21 | mkdir ${HOME}/.config/enchant |
22 | whitelist ${HOME}/.config/enchant | 22 | whitelist ${HOME}/.config/enchant |
23 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | 25 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
26 | 27 | ||
diff --git a/etc/eo-common.profile b/etc/eo-common.profile index 13f498c03..80c704c6b 100644 --- a/etc/eo-common.profile +++ b/etc/eo-common.profile | |||
@@ -18,6 +18,7 @@ include disable-interpreters.inc | |||
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | 20 | ||
21 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
diff --git a/etc/evince.profile b/etc/evince.profile index 143a347e6..68ef5eb9a 100644 --- a/etc/evince.profile +++ b/etc/evince.profile | |||
@@ -21,6 +21,7 @@ whitelist /usr/share/doc | |||
21 | whitelist /usr/share/evince | 21 | whitelist /usr/share/evince |
22 | whitelist /usr/share/poppler | 22 | whitelist /usr/share/poppler |
23 | whitelist /usr/share/tracker | 23 | whitelist /usr/share/tracker |
24 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | 25 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
26 | 27 | ||
diff --git a/etc/evolution.profile b/etc/evolution.profile index 71a7a5600..4740bf935 100644 --- a/etc/evolution.profile +++ b/etc/evolution.profile | |||
@@ -23,6 +23,8 @@ include disable-interpreters.inc | |||
23 | include disable-passwdmgr.inc | 23 | include disable-passwdmgr.inc |
24 | include disable-programs.inc | 24 | include disable-programs.inc |
25 | 25 | ||
26 | include whitelist-runuser-common.inc | ||
27 | |||
26 | caps.drop all | 28 | caps.drop all |
27 | netfilter | 29 | netfilter |
28 | # no3d breaks under wayland | 30 | # no3d breaks under wayland |
diff --git a/etc/fbreader.profile b/etc/fbreader.profile index 701f14dce..af670cee2 100644 --- a/etc/fbreader.profile +++ b/etc/fbreader.profile | |||
@@ -11,6 +11,7 @@ noblacklist ${DOCUMENTS} | |||
11 | 11 | ||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 17 | include disable-programs.inc |
@@ -18,8 +19,9 @@ include disable-xdg.inc | |||
18 | 19 | ||
19 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
20 | 21 | ||
22 | apparmor | ||
21 | caps.drop all | 23 | caps.drop all |
22 | netfilter | 24 | net none |
23 | nodvd | 25 | nodvd |
24 | nonewprivs | 26 | nonewprivs |
25 | noroot | 27 | noroot |
diff --git a/etc/feedreader.profile b/etc/feedreader.profile index 5a72b60ea..7d3c7a8f4 100644 --- a/etc/feedreader.profile +++ b/etc/feedreader.profile | |||
@@ -23,6 +23,7 @@ whitelist ${HOME}/.cache/feedreader | |||
23 | whitelist ${HOME}/.local/share/feedreader | 23 | whitelist ${HOME}/.local/share/feedreader |
24 | whitelist /usr/share/feedreader | 24 | whitelist /usr/share/feedreader |
25 | include whitelist-common.inc | 25 | include whitelist-common.inc |
26 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
28 | 29 | ||
diff --git a/etc/ferdi.profile b/etc/ferdi.profile new file mode 100644 index 000000000..9b4c5f114 --- /dev/null +++ b/etc/ferdi.profile | |||
@@ -0,0 +1,46 @@ | |||
1 | # Firejail profile for ferdi | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include ferdi.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | ignore noexec /tmp | ||
9 | |||
10 | noblacklist ${HOME}/.cache/Ferdi | ||
11 | noblacklist ${HOME}/.config/Ferdi | ||
12 | noblacklist ${HOME}/.pki | ||
13 | noblacklist ${HOME}/.local/share/pki | ||
14 | |||
15 | include disable-common.inc | ||
16 | include disable-devel.inc | ||
17 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | ||
19 | include disable-programs.inc | ||
20 | |||
21 | mkdir ${HOME}/.cache/Ferdi | ||
22 | mkdir ${HOME}/.config/Ferdi | ||
23 | mkdir ${HOME}/.pki | ||
24 | mkdir ${HOME}/.local/share/pki | ||
25 | whitelist ${DOWNLOADS} | ||
26 | whitelist ${HOME}/.cache/Ferdi | ||
27 | whitelist ${HOME}/.config/Ferdi | ||
28 | whitelist ${HOME}/.pki | ||
29 | whitelist ${HOME}/.local/share/pki | ||
30 | include whitelist-common.inc | ||
31 | |||
32 | caps.drop all | ||
33 | netfilter | ||
34 | nodvd | ||
35 | nogroups | ||
36 | nonewprivs | ||
37 | noroot | ||
38 | notv | ||
39 | nou2f | ||
40 | protocol unix,inet,inet6,netlink | ||
41 | seccomp !chroot | ||
42 | shell none | ||
43 | |||
44 | disable-mnt | ||
45 | private-dev | ||
46 | private-tmp | ||
diff --git a/etc/file-roller.profile b/etc/file-roller.profile index 253b82cfe..70dd030ee 100644 --- a/etc/file-roller.profile +++ b/etc/file-roller.profile | |||
@@ -14,6 +14,7 @@ include disable-passwdmgr.inc | |||
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | 15 | ||
16 | whitelist /usr/share/file-roller | 16 | whitelist /usr/share/file-roller |
17 | include whitelist-runuser-common.inc | ||
17 | include whitelist-usr-share-common.inc | 18 | include whitelist-usr-share-common.inc |
18 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
19 | 20 | ||
@@ -36,7 +37,7 @@ seccomp | |||
36 | shell none | 37 | shell none |
37 | tracelog | 38 | tracelog |
38 | 39 | ||
39 | private-bin 7z,7za,7zr,ar,arj,brotli,bzip2,compress,cpio,dpkg-deb,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,rar,rzip,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,xz,zip,zoo | 40 | private-bin 7z,7za,7zr,ar,arj,bash,brotli,bzip2,compress,cpio,dpkg-deb,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,p7zip,rar,rzip,sh,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,xz,zip,zoo |
40 | private-cache | 41 | private-cache |
41 | private-dev | 42 | private-dev |
42 | private-etc dconf,fonts,gtk-3.0,xdg | 43 | private-etc dconf,fonts,gtk-3.0,xdg |
diff --git a/etc/file.profile b/etc/file.profile index 9b21818f8..854586354 100644 --- a/etc/file.profile +++ b/etc/file.profile | |||
@@ -8,6 +8,7 @@ include file.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | include disable-common.inc | 13 | include disable-common.inc |
13 | include disable-exec.inc | 14 | include disable-exec.inc |
@@ -38,8 +39,8 @@ x11 none | |||
38 | #private-bin bzip2,file,gzip,lrzip,lz4,lzip,xz,zstd | 39 | #private-bin bzip2,file,gzip,lrzip,lz4,lzip,xz,zstd |
39 | private-cache | 40 | private-cache |
40 | private-dev | 41 | private-dev |
41 | private-etc alternatives,localtime,magic,magic.mgc | 42 | #private-etc alternatives,localtime,magic,magic.mgc |
42 | private-lib file,libarchive.so.*,libfakeroot,libmagic.so.* | 43 | #private-lib file,libarchive.so.*,libfakeroot,libmagic.so.*,libseccomp.so.* |
43 | 44 | ||
44 | memory-deny-write-execute | 45 | memory-deny-write-execute |
45 | read-only ${HOME} | 46 | read-only ${HOME} |
diff --git a/etc/filezilla.profile b/etc/filezilla.profile index d8d4c1746..6c7ab8f0d 100644 --- a/etc/filezilla.profile +++ b/etc/filezilla.profile | |||
@@ -17,6 +17,8 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | |||
21 | include whitelist-runuser-common.inc | ||
20 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
21 | 23 | ||
22 | caps.drop all | 24 | caps.drop all |
diff --git a/etc/firefox-esr.profile b/etc/firefox-esr.profile index 6c1d77986..5e69fdb51 100644 --- a/etc/firefox-esr.profile +++ b/etc/firefox-esr.profile | |||
@@ -6,5 +6,7 @@ include firefox-esr.local | |||
6 | # added by included profile | 6 | # added by included profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | whitelist /usr/share/firefox-esr | ||
10 | |||
9 | # Redirect | 11 | # Redirect |
10 | include firefox.profile | 12 | include firefox.profile |
diff --git a/etc/firefox.profile b/etc/firefox.profile index 0530516d8..4a2cb260f 100644 --- a/etc/firefox.profile +++ b/etc/firefox.profile | |||
@@ -15,6 +15,7 @@ whitelist ${HOME}/.cache/mozilla/firefox | |||
15 | whitelist ${HOME}/.mozilla | 15 | whitelist ${HOME}/.mozilla |
16 | 16 | ||
17 | whitelist /usr/share/doc | 17 | whitelist /usr/share/doc |
18 | whitelist /usr/share/firefox | ||
18 | whitelist /usr/share/gtk-doc/html | 19 | whitelist /usr/share/gtk-doc/html |
19 | whitelist /usr/share/mozilla | 20 | whitelist /usr/share/mozilla |
20 | whitelist /usr/share/webext | 21 | whitelist /usr/share/webext |
diff --git a/etc/firejail-default b/etc/firejail-default index 763b838d3..e68e51c63 100644 --- a/etc/firejail-default +++ b/etc/firejail-default | |||
@@ -65,6 +65,8 @@ owner /proc/@{PID}/{uid_map,gid_map,setgroups} w, | |||
65 | 65 | ||
66 | # Needed for electron apps | 66 | # Needed for electron apps |
67 | /proc/@{PID}/comm w, | 67 | /proc/@{PID}/comm w, |
68 | # Needed for nslookup, dig, host | ||
69 | /proc/@{PID}/task/@{PID}/comm w, | ||
68 | 70 | ||
69 | # Used by chromium | 71 | # Used by chromium |
70 | owner /proc/@{PID}/oom_score_adj w, | 72 | owner /proc/@{PID}/oom_score_adj w, |
diff --git a/etc/flameshot.profile b/etc/flameshot.profile index 3aad9723b..9a3df98f4 100644 --- a/etc/flameshot.profile +++ b/etc/flameshot.profile | |||
@@ -17,6 +17,8 @@ include disable-passwdmgr.inc | |||
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-xdg.inc | 18 | include disable-xdg.inc |
19 | 19 | ||
20 | include whitelist-runuser-common.inc | ||
21 | |||
20 | caps.drop all | 22 | caps.drop all |
21 | ipc-namespace | 23 | ipc-namespace |
22 | netfilter | 24 | netfilter |
diff --git a/etc/four-in-a-row.profile b/etc/four-in-a-row.profile new file mode 100644 index 000000000..b468c3435 --- /dev/null +++ b/etc/four-in-a-row.profile | |||
@@ -0,0 +1,17 @@ | |||
1 | # Firejail profile for four-in-a-row | ||
2 | # Description: Sliding tile puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include four-in-a-row.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore machine-id | ||
10 | ignore nosound | ||
11 | |||
12 | whitelist /usr/share/four-in-a-row | ||
13 | |||
14 | private-bin four-in-a-row | ||
15 | |||
16 | # Redirect | ||
17 | include gnome_games-common.profile | ||
diff --git a/etc/freeciv.profile b/etc/freeciv.profile index fa115d325..379c5eca9 100644 --- a/etc/freeciv.profile +++ b/etc/freeciv.profile | |||
@@ -21,6 +21,7 @@ whitelist ${HOME}/.freeciv | |||
21 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | apparmor | ||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | netfilter | 27 | netfilter |
diff --git a/etc/freeoffice-planmaker.profile b/etc/freeoffice-planmaker.profile index b6ca167eb..9449e7c48 100644 --- a/etc/freeoffice-planmaker.profile +++ b/etc/freeoffice-planmaker.profile | |||
@@ -7,4 +7,4 @@ include freeoffice-planmaker.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/freeoffice-presentations.profile b/etc/freeoffice-presentations.profile index 43661028c..636868e2e 100644 --- a/etc/freeoffice-presentations.profile +++ b/etc/freeoffice-presentations.profile | |||
@@ -7,4 +7,4 @@ include freeoffice-presentations.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/freeoffice-textmaker.profile b/etc/freeoffice-textmaker.profile index f7d30eaed..5d98d1cc6 100644 --- a/etc/freeoffice-textmaker.profile +++ b/etc/freeoffice-textmaker.profile | |||
@@ -6,4 +6,4 @@ include freeoffice-textmaker.local | |||
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Redirect | 8 | # Redirect |
9 | include softmaker-common.profile | 9 | include softmaker-common.inc |
diff --git a/etc/frogatto.profile b/etc/frogatto.profile new file mode 100644 index 000000000..fd7c5fc16 --- /dev/null +++ b/etc/frogatto.profile | |||
@@ -0,0 +1,47 @@ | |||
1 | # Firejail profile for frogatto | ||
2 | # Description: 2D platformer game starring a quixotic frog | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include frogatto.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.frogatto | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.frogatto | ||
20 | whitelist ${HOME}/.frogatto | ||
21 | whitelist /usr/share/frogatto | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | |||
26 | apparmor | ||
27 | caps.drop all | ||
28 | net none | ||
29 | nodbus | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin frogatto,sh | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc machine-id | ||
47 | private-tmp | ||
diff --git a/etc/frozen-bubble.profile b/etc/frozen-bubble.profile index 6cef181c8..c089d2e35 100644 --- a/etc/frozen-bubble.profile +++ b/etc/frozen-bubble.profile | |||
@@ -13,6 +13,7 @@ include allow-perl.inc | |||
13 | 13 | ||
14 | include disable-common.inc | 14 | include disable-common.inc |
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 19 | include disable-programs.inc |
@@ -22,6 +23,7 @@ whitelist ${HOME}/.frozen-bubble | |||
22 | include whitelist-common.inc | 23 | include whitelist-common.inc |
23 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
24 | 25 | ||
26 | apparmor | ||
25 | caps.drop all | 27 | caps.drop all |
26 | net none | 28 | net none |
27 | nodbus | 29 | nodbus |
diff --git a/etc/gedit.profile b/etc/gedit.profile index a4471077a..148b98c99 100644 --- a/etc/gedit.profile +++ b/etc/gedit.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | 21 | ||
22 | include whitelist-runuser-common.inc | ||
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
24 | # apparmor - makes settings immutable | 25 | # apparmor - makes settings immutable |
diff --git a/etc/gfeeds.profile b/etc/gfeeds.profile index d332c1bbe..7de762e0d 100644 --- a/etc/gfeeds.profile +++ b/etc/gfeeds.profile | |||
@@ -29,6 +29,7 @@ whitelist ${HOME}/.cache/org.gabmus.gfeeds | |||
29 | whitelist ${HOME}/.config/org.gabmus.gfeeds.json | 29 | whitelist ${HOME}/.config/org.gabmus.gfeeds.json |
30 | whitelist /usr/share/gfeeds | 30 | whitelist /usr/share/gfeeds |
31 | include whitelist-common.inc | 31 | include whitelist-common.inc |
32 | include whitelist-runuser-common.inc | ||
32 | include whitelist-usr-share-common.inc | 33 | include whitelist-usr-share-common.inc |
33 | include whitelist-var-common.inc | 34 | include whitelist-var-common.inc |
34 | 35 | ||
diff --git a/etc/gitg.profile b/etc/gitg.profile index 56f8e136f..68f38c3ce 100644 --- a/etc/gitg.profile +++ b/etc/gitg.profile | |||
@@ -19,7 +19,16 @@ include disable-interpreters.inc | |||
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | 21 | ||
22 | #whitelist ${HOME}/YOUR_GIT_PROJECTS_DIRECTORY | ||
23 | #whitelist ${HOME}/.config/git | ||
24 | #whitelist ${HOME}/.gitconfig | ||
25 | #whitelist ${HOME}/.git-credentials | ||
26 | #whitelist ${HOME}/.local/share/gitg | ||
27 | #whitelist ${HOME}/.ssh | ||
28 | #include whitelist-common.inc | ||
29 | |||
22 | whitelist /usr/share/gitg | 30 | whitelist /usr/share/gitg |
31 | include whitelist-runuser-common.inc | ||
23 | include whitelist-usr-share-common.inc | 32 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | 33 | include whitelist-var-common.inc |
25 | 34 | ||
diff --git a/etc/gjs.profile b/etc/gjs.profile index 85dd57f29..9c8848b8a 100644 --- a/etc/gjs.profile +++ b/etc/gjs.profile | |||
@@ -22,6 +22,7 @@ include disable-interpreters.inc | |||
22 | include disable-passwdmgr.inc | 22 | include disable-passwdmgr.inc |
23 | include disable-programs.inc | 23 | include disable-programs.inc |
24 | 24 | ||
25 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
27 | 28 | ||
diff --git a/etc/gnome-2048.profile b/etc/gnome-2048.profile index 9eb4c147d..978a13244 100644 --- a/etc/gnome-2048.profile +++ b/etc/gnome-2048.profile | |||
@@ -8,31 +8,10 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.local/share/gnome-2048 | 9 | noblacklist ${HOME}/.local/share/gnome-2048 |
10 | 10 | ||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | |||
18 | include whitelist-var-common.inc | ||
19 | |||
20 | mkdir ${HOME}/.local/share/gnome-2048 | 11 | mkdir ${HOME}/.local/share/gnome-2048 |
21 | whitelist ${HOME}/.local/share/gnome-2048 | 12 | whitelist ${HOME}/.local/share/gnome-2048 |
22 | include whitelist-common.inc | ||
23 | |||
24 | caps.drop all | ||
25 | netfilter | ||
26 | nodvd | ||
27 | nonewprivs | ||
28 | noroot | ||
29 | notv | ||
30 | nou2f | ||
31 | novideo | ||
32 | protocol unix,inet,inet6 | ||
33 | seccomp | ||
34 | 13 | ||
35 | disable-mnt | 14 | private-bin gnome-2048 |
36 | private-dev | ||
37 | private-tmp | ||
38 | 15 | ||
16 | # Redirect | ||
17 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-books.profile b/etc/gnome-books.profile index 84e38d0e1..998109ca7 100644 --- a/etc/gnome-books.profile +++ b/etc/gnome-books.profile | |||
@@ -23,8 +23,9 @@ include disable-xdg.inc | |||
23 | 23 | ||
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
25 | 25 | ||
26 | apparmor | ||
26 | caps.drop all | 27 | caps.drop all |
27 | netfilter | 28 | net none |
28 | no3d | 29 | no3d |
29 | nodvd | 30 | nodvd |
30 | nogroups | 31 | nogroups |
diff --git a/etc/gnome-builder.profile b/etc/gnome-builder.profile index eaf48931d..7a684dd59 100644 --- a/etc/gnome-builder.profile +++ b/etc/gnome-builder.profile | |||
@@ -17,6 +17,8 @@ include disable-common.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-runuser-common.inc | ||
21 | |||
20 | caps.drop all | 22 | caps.drop all |
21 | ipc-namespace | 23 | ipc-namespace |
22 | netfilter | 24 | netfilter |
diff --git a/etc/gnome-calculator.profile b/etc/gnome-calculator.profile index 6709a331e..627ae368a 100644 --- a/etc/gnome-calculator.profile +++ b/etc/gnome-calculator.profile | |||
@@ -16,6 +16,7 @@ include disable-programs.inc | |||
16 | include disable-xdg.inc | 16 | include disable-xdg.inc |
17 | 17 | ||
18 | include whitelist-common.inc | 18 | include whitelist-common.inc |
19 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
diff --git a/etc/gnome-characters.profile b/etc/gnome-characters.profile index 2d4724610..77b0c3c15 100644 --- a/etc/gnome-characters.profile +++ b/etc/gnome-characters.profile | |||
@@ -19,9 +19,11 @@ include disable-xdg.inc | |||
19 | 19 | ||
20 | whitelist /usr/share/org.gnome.Characters | 20 | whitelist /usr/share/org.gnome.Characters |
21 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-runuser-common.inc | ||
22 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
23 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
24 | 25 | ||
26 | apparmor | ||
25 | caps.drop all | 27 | caps.drop all |
26 | machine-id | 28 | machine-id |
27 | net none | 29 | net none |
diff --git a/etc/gnome-chess.profile b/etc/gnome-chess.profile index e657293ac..a80e1ca6d 100644 --- a/etc/gnome-chess.profile +++ b/etc/gnome-chess.profile | |||
@@ -16,6 +16,10 @@ include disable-passwdmgr.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | 17 | include disable-xdg.inc |
18 | 18 | ||
19 | whitelist /usr/share/gnuchess | ||
20 | whitelist /usr/share/gnome-chess | ||
21 | include whitelist-runuser-common.inc | ||
22 | include whitelist-usr-share-common.inc | ||
19 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
20 | 24 | ||
21 | apparmor | 25 | apparmor |
diff --git a/etc/gnome-clocks.profile b/etc/gnome-clocks.profile index 025335a23..b865423c5 100644 --- a/etc/gnome-clocks.profile +++ b/etc/gnome-clocks.profile | |||
@@ -17,6 +17,7 @@ include disable-xdg.inc | |||
17 | whitelist /usr/share/gnome-clocks | 17 | whitelist /usr/share/gnome-clocks |
18 | whitelist /usr/share/libgweather | 18 | whitelist /usr/share/libgweather |
19 | include whitelist-common.inc | 19 | include whitelist-common.inc |
20 | include whitelist-runuser-common.inc | ||
20 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
21 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
22 | 23 | ||
diff --git a/etc/gnome-contacts.profile b/etc/gnome-contacts.profile index ac6d82451..7c1e4bb58 100644 --- a/etc/gnome-contacts.profile +++ b/etc/gnome-contacts.profile | |||
@@ -17,6 +17,7 @@ include disable-programs.inc | |||
17 | include disable-xdg.inc | 17 | include disable-xdg.inc |
18 | 18 | ||
19 | include whitelist-common.inc | 19 | include whitelist-common.inc |
20 | include whitelist-runuser-common.inc | ||
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
22 | caps.drop all | 23 | caps.drop all |
diff --git a/etc/gnome-font-viewer.profile b/etc/gnome-font-viewer.profile index 468ef0401..b2327133c 100644 --- a/etc/gnome-font-viewer.profile +++ b/etc/gnome-font-viewer.profile | |||
@@ -17,8 +17,9 @@ include disable-xdg.inc | |||
17 | 17 | ||
18 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
19 | 19 | ||
20 | apparmor | ||
20 | caps.drop all | 21 | caps.drop all |
21 | netfilter | 22 | net none |
22 | no3d | 23 | no3d |
23 | nodvd | 24 | nodvd |
24 | nonewprivs | 25 | nonewprivs |
diff --git a/etc/gnome-hexgl.profile b/etc/gnome-hexgl.profile index 386c33d7f..a06ccc9c1 100644 --- a/etc/gnome-hexgl.profile +++ b/etc/gnome-hexgl.profile | |||
@@ -15,9 +15,8 @@ include disable-programs.inc | |||
15 | include disable-xdg.inc | 15 | include disable-xdg.inc |
16 | 16 | ||
17 | mkdir ${HOME}/.cache/mesa_shader_cache | 17 | mkdir ${HOME}/.cache/mesa_shader_cache |
18 | whitelist ${RUNUSER}/pulse | ||
19 | whitelist ${RUNUSER}/wayland-0 | ||
20 | whitelist /usr/share/gnome-hexgl | 18 | whitelist /usr/share/gnome-hexgl |
19 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
23 | 22 | ||
diff --git a/etc/gnome-latex.profile b/etc/gnome-latex.profile index 1bf48c6ab..ea4151137 100644 --- a/etc/gnome-latex.profile +++ b/etc/gnome-latex.profile | |||
@@ -22,6 +22,7 @@ include disable-programs.inc | |||
22 | whitelist /usr/share/gnome-latex | 22 | whitelist /usr/share/gnome-latex |
23 | whitelist /usr/share/perl5 | 23 | whitelist /usr/share/perl5 |
24 | whitelist /usr/share/texlive | 24 | whitelist /usr/share/texlive |
25 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
26 | # May cause issues. | 27 | # May cause issues. |
27 | #include whitelist-var-common.inc | 28 | #include whitelist-var-common.inc |
diff --git a/etc/gnome-logs.profile b/etc/gnome-logs.profile index 0c5bec144..31b7cfb4f 100644 --- a/etc/gnome-logs.profile +++ b/etc/gnome-logs.profile | |||
@@ -15,6 +15,7 @@ include disable-programs.inc | |||
15 | include disable-xdg.inc | 15 | include disable-xdg.inc |
16 | 16 | ||
17 | whitelist /var/log/journal | 17 | whitelist /var/log/journal |
18 | include whitelist-runuser-common.inc | ||
18 | include whitelist-usr-share-common.inc | 19 | include whitelist-usr-share-common.inc |
19 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
20 | 21 | ||
diff --git a/etc/gnome-mahjongg.profile b/etc/gnome-mahjongg.profile new file mode 100644 index 000000000..653c5f949 --- /dev/null +++ b/etc/gnome-mahjongg.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for gnome-mahjongg | ||
2 | # Description: Sliding tile puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-mahjongg.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | whitelist /usr/share/gnome-mahjongg | ||
10 | |||
11 | private-bin gnome-mahjongg | ||
12 | |||
13 | # Redirect | ||
14 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-maps.profile b/etc/gnome-maps.profile index 62350b862..bf263efa9 100644 --- a/etc/gnome-maps.profile +++ b/etc/gnome-maps.profile | |||
@@ -13,7 +13,6 @@ include globals.local | |||
13 | 13 | ||
14 | noblacklist ${HOME}/.cache/champlain | 14 | noblacklist ${HOME}/.cache/champlain |
15 | noblacklist ${HOME}/.cache/org.gnome.Maps | 15 | noblacklist ${HOME}/.cache/org.gnome.Maps |
16 | noblacklist ${HOME}/.local/share/flatpak | ||
17 | noblacklist ${HOME}/.local/share/maps-places.json | 16 | noblacklist ${HOME}/.local/share/maps-places.json |
18 | 17 | ||
19 | # Allow gjs (blacklisted by disable-interpreters.inc) | 18 | # Allow gjs (blacklisted by disable-interpreters.inc) |
@@ -36,6 +35,7 @@ whitelist ${PICTURES} | |||
36 | whitelist /usr/share/gnome-maps | 35 | whitelist /usr/share/gnome-maps |
37 | whitelist /usr/share/libgweather | 36 | whitelist /usr/share/libgweather |
38 | include whitelist-common.inc | 37 | include whitelist-common.inc |
38 | include whitelist-runuser-common.inc | ||
39 | include whitelist-usr-share-common.inc | 39 | include whitelist-usr-share-common.inc |
40 | include whitelist-var-common.inc | 40 | include whitelist-var-common.inc |
41 | 41 | ||
diff --git a/etc/gnome-mines.profile b/etc/gnome-mines.profile new file mode 100644 index 000000000..9cae75524 --- /dev/null +++ b/etc/gnome-mines.profile | |||
@@ -0,0 +1,18 @@ | |||
1 | # Firejail profile for gnome-mines | ||
2 | # Description: Sliding tile puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-mines.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/gnome-mines | ||
10 | |||
11 | mkdir ${HOME}/.local/share/gnome-mines | ||
12 | whitelist ${HOME}/.local/share/gnome-mines | ||
13 | whitelist /usr/share/gnome-mines | ||
14 | |||
15 | private-bin gnome-mines | ||
16 | |||
17 | # Redirect | ||
18 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-music.profile b/etc/gnome-music.profile index ad3fa1753..36b46897c 100644 --- a/etc/gnome-music.profile +++ b/etc/gnome-music.profile | |||
@@ -21,8 +21,10 @@ include disable-passwdmgr.inc | |||
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-xdg.inc | 22 | include disable-xdg.inc |
23 | 23 | ||
24 | include whitelist-runuser-common.inc | ||
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
27 | apparmor | ||
26 | caps.drop all | 28 | caps.drop all |
27 | netfilter | 29 | netfilter |
28 | no3d | 30 | no3d |
@@ -37,8 +39,9 @@ seccomp | |||
37 | shell none | 39 | shell none |
38 | tracelog | 40 | tracelog |
39 | 41 | ||
40 | private-bin env,gio-launch-desktop,gnome-music,python*,yelp | 42 | # private-bin calls a file manager - whatever is installed! |
43 | #private-bin env,gio-launch-desktop,gnome-music,python*,yelp | ||
41 | private-dev | 44 | private-dev |
42 | private-etc alternatives,asound.conf,fonts,machine-id,pulse | 45 | private-etc alternatives,asound.conf,dconf,fonts,fonts,gtk-3.0,machine-id,pulse,selinux,xdg |
43 | private-tmp | 46 | private-tmp |
44 | 47 | ||
diff --git a/etc/gnome-nettool.profile b/etc/gnome-nettool.profile index d15299890..649473679 100644 --- a/etc/gnome-nettool.profile +++ b/etc/gnome-nettool.profile | |||
@@ -16,6 +16,7 @@ include disable-xdg.inc | |||
16 | 16 | ||
17 | whitelist /usr/share/gnome-nettool | 17 | whitelist /usr/share/gnome-nettool |
18 | #include whitelist-common.inc -- see #903 | 18 | #include whitelist-common.inc -- see #903 |
19 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
diff --git a/etc/gnome-nibbles.profile b/etc/gnome-nibbles.profile new file mode 100644 index 000000000..4e42b6b15 --- /dev/null +++ b/etc/gnome-nibbles.profile | |||
@@ -0,0 +1,21 @@ | |||
1 | # Firejail profile for gnome-nibbles | ||
2 | # Description: Sliding tile puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-nibbles.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore machine-id | ||
10 | ignore nosound | ||
11 | |||
12 | noblacklist ${HOME}/.local/share/gnome-nibbles | ||
13 | |||
14 | mkdir ${HOME}/.local/share/gnome-nibbles | ||
15 | whitelist ${HOME}/.local/share/gnome-nibbles | ||
16 | whitelist /usr/share/gnome-nibbles | ||
17 | |||
18 | private-bin gnome-nibbles | ||
19 | |||
20 | # Redirect | ||
21 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-passwordsafe.profile b/etc/gnome-passwordsafe.profile index de8f6ad7d..555a59d93 100644 --- a/etc/gnome-passwordsafe.profile +++ b/etc/gnome-passwordsafe.profile | |||
@@ -21,13 +21,9 @@ include disable-passwdmgr.inc | |||
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-xdg.inc | 22 | include disable-xdg.inc |
23 | 23 | ||
24 | whitelist ${RUNUSER}/bus | ||
25 | # If you have a second wayland compositor, whitelist its socket here. | ||
26 | whitelist ${RUNUSER}/wayland-0 | ||
27 | whitelist ${RUNUSER}/gdm/Xauthority | ||
28 | |||
29 | whitelist /usr/share/cracklib | 24 | whitelist /usr/share/cracklib |
30 | whitelist /usr/share/passwordsafe | 25 | whitelist /usr/share/passwordsafe |
26 | include whitelist-runuser-common.inc | ||
31 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
32 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
33 | 29 | ||
diff --git a/etc/gnome-photos.profile b/etc/gnome-photos.profile index aa0b7dbe3..2af406af9 100644 --- a/etc/gnome-photos.profile +++ b/etc/gnome-photos.profile | |||
@@ -17,8 +17,10 @@ include disable-interpreters.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-runuser-common.inc | ||
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
23 | apparmor | ||
22 | caps.drop all | 24 | caps.drop all |
23 | netfilter | 25 | netfilter |
24 | nodvd | 26 | nodvd |
diff --git a/etc/gnome-pomodoro.profile b/etc/gnome-pomodoro.profile new file mode 100644 index 000000000..f8be23f07 --- /dev/null +++ b/etc/gnome-pomodoro.profile | |||
@@ -0,0 +1,51 @@ | |||
1 | # Firejail profile for gnome-pomodoro | ||
2 | # Description: time management utility for GNOME based on the pomodoro technique | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-pomodoro.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/gnome-pomodoro | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.local/share/gnome-pomodoro | ||
20 | whitelist ${HOME}/.local/share/gnome-pomodoro | ||
21 | whitelist /usr/share/gnome-pomodoro | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | no3d | ||
31 | nodvd | ||
32 | nogroups | ||
33 | nonewprivs | ||
34 | noroot | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix | ||
39 | seccomp | ||
40 | shell none | ||
41 | tracelog | ||
42 | |||
43 | disable-mnt | ||
44 | private-bin gnome-pomodoro | ||
45 | private-cache | ||
46 | private-dev | ||
47 | private-etc dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id | ||
48 | private-tmp | ||
49 | |||
50 | read-only ${HOME} | ||
51 | read-write ${HOME}/.local/share/gnome-pomodoro | ||
diff --git a/etc/gnome-recipes.profile b/etc/gnome-recipes.profile index b4791afc5..20c355371 100644 --- a/etc/gnome-recipes.profile +++ b/etc/gnome-recipes.profile | |||
@@ -26,6 +26,7 @@ include whitelist-common.inc | |||
26 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
28 | 28 | ||
29 | apparmor | ||
29 | caps.drop all | 30 | caps.drop all |
30 | ipc-namespace | 31 | ipc-namespace |
31 | machine-id | 32 | machine-id |
diff --git a/etc/gnome-robots.profile b/etc/gnome-robots.profile new file mode 100644 index 000000000..888324a5c --- /dev/null +++ b/etc/gnome-robots.profile | |||
@@ -0,0 +1,17 @@ | |||
1 | # Firejail profile for gnome-robots | ||
2 | # Description: Sliding tile puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-robots.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore machine-id | ||
10 | ignore nosound | ||
11 | |||
12 | whitelist /usr/share/gnome-robots | ||
13 | |||
14 | private-bin gnome-robots | ||
15 | |||
16 | # Redirect | ||
17 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-schedule.profile b/etc/gnome-schedule.profile index c8dd8ead7..55913a2d7 100644 --- a/etc/gnome-schedule.profile +++ b/etc/gnome-schedule.profile | |||
@@ -39,6 +39,7 @@ whitelist /usr/share/gnome-schedule | |||
39 | whitelist /var/spool/atd | 39 | whitelist /var/spool/atd |
40 | whitelist /var/spool/cron | 40 | whitelist /var/spool/cron |
41 | include whitelist-common.inc | 41 | include whitelist-common.inc |
42 | include whitelist-runuser-common.inc | ||
42 | include whitelist-usr-share-common.inc | 43 | include whitelist-usr-share-common.inc |
43 | include whitelist-var-common.inc | 44 | include whitelist-var-common.inc |
44 | 45 | ||
diff --git a/etc/gnome-screenshot.profile b/etc/gnome-screenshot.profile new file mode 100644 index 000000000..cc5efb161 --- /dev/null +++ b/etc/gnome-screenshot.profile | |||
@@ -0,0 +1,44 @@ | |||
1 | # Firejail profile for gnome-screenshot | ||
2 | # Description: GNOME screenshot tool | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-screenshot.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${PICTURES} | ||
10 | noblacklist ${HOME}/.cache/gnome-screenshot | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-runuser-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | net none | ||
27 | no3d | ||
28 | nodvd | ||
29 | nogroups | ||
30 | nonewprivs | ||
31 | noroot | ||
32 | notv | ||
33 | nou2f | ||
34 | novideo | ||
35 | protocol unix | ||
36 | seccomp | ||
37 | shell none | ||
38 | tracelog | ||
39 | |||
40 | disable-mnt | ||
41 | private-bin gnome-screenshot | ||
42 | private-dev | ||
43 | private-etc dconf,fonts,gtk-3.0,localtime,machine-id | ||
44 | private-tmp | ||
diff --git a/etc/gnome-sound-recorder.profile b/etc/gnome-sound-recorder.profile index 7f8fc8a0c..a64ec25a9 100644 --- a/etc/gnome-sound-recorder.profile +++ b/etc/gnome-sound-recorder.profile | |||
@@ -7,7 +7,6 @@ include gnome-sound-recorder.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${MUSIC} | 9 | noblacklist ${MUSIC} |
10 | noblacklist ${HOME}/.local/share/flatpak | ||
11 | noblacklist ${HOME}/.local/share/Trash | 10 | noblacklist ${HOME}/.local/share/Trash |
12 | 11 | ||
13 | # Allow gjs (blacklisted by disable-interpreters.inc) | 12 | # Allow gjs (blacklisted by disable-interpreters.inc) |
diff --git a/etc/gnome-sudoku.profile b/etc/gnome-sudoku.profile new file mode 100644 index 000000000..b41bccd1e --- /dev/null +++ b/etc/gnome-sudoku.profile | |||
@@ -0,0 +1,17 @@ | |||
1 | # Firejail profile for gnome-sudoku | ||
2 | # Description: Sliding tile puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-sudoku.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/gnome-sudoku | ||
10 | |||
11 | mkdir ${HOME}/.local/share/gnome-sudoku | ||
12 | whitelist ${HOME}/.local/share/gnome-sudoku | ||
13 | |||
14 | private-bin gnome-sudoku | ||
15 | |||
16 | # Redirect | ||
17 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-taquin.profile b/etc/gnome-taquin.profile new file mode 100644 index 000000000..efd64d455 --- /dev/null +++ b/etc/gnome-taquin.profile | |||
@@ -0,0 +1,17 @@ | |||
1 | # Firejail profile for gnome-taquin | ||
2 | # Description: Sliding tile puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-taquin.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore machine-id | ||
10 | ignore nosound | ||
11 | |||
12 | whitelist /usr/share/gnome-taquin | ||
13 | |||
14 | private-bin gnome-taquin | ||
15 | |||
16 | # Redirect | ||
17 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-tetravex.profile b/etc/gnome-tetravex.profile new file mode 100644 index 000000000..e9622539c --- /dev/null +++ b/etc/gnome-tetravex.profile | |||
@@ -0,0 +1,12 @@ | |||
1 | # Firejail profile for gnome-tetravex | ||
2 | # Description: Sliding tile puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-tetravex.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | private-bin gnome-tetravex | ||
10 | |||
11 | # Redirect | ||
12 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-todo.profile b/etc/gnome-todo.profile new file mode 100644 index 000000000..6240cce65 --- /dev/null +++ b/etc/gnome-todo.profile | |||
@@ -0,0 +1,51 @@ | |||
1 | # Firejail profile for gnome-todo | ||
2 | # Description: Personal task manager for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-todo.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Allow python (blacklisted by disable-interpreters.inc) | ||
10 | include allow-python3.inc | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | whitelist /usr/share/gnome-todo | ||
21 | include whitelist-common.inc | ||
22 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | |||
26 | apparmor | ||
27 | caps.drop all | ||
28 | machine-id | ||
29 | net none | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | nosound | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix | ||
39 | seccomp | ||
40 | shell none | ||
41 | tracelog | ||
42 | |||
43 | disable-mnt | ||
44 | #private | ||
45 | private-bin gnome-todo | ||
46 | private-cache | ||
47 | private-dev | ||
48 | private-etc dconf,fonts,gtk-3.0,localtime,passwd,xdg | ||
49 | private-tmp | ||
50 | |||
51 | read-only ${HOME} | ||
diff --git a/etc/gnome-weather.profile b/etc/gnome-weather.profile index 10db6296b..a181f1b9e 100644 --- a/etc/gnome-weather.profile +++ b/etc/gnome-weather.profile | |||
@@ -21,6 +21,7 @@ include disable-passwdmgr.inc | |||
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-xdg.inc | 22 | include disable-xdg.inc |
23 | 23 | ||
24 | include whitelist-runuser-common.inc | ||
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
26 | caps.drop all | 27 | caps.drop all |
diff --git a/etc/gnome_games-common.profile b/etc/gnome_games-common.profile new file mode 100644 index 000000000..0b75c5e92 --- /dev/null +++ b/etc/gnome_games-common.profile | |||
@@ -0,0 +1,43 @@ | |||
1 | # Firejail profile for gnome_games-common | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include gnome_games-common.local | ||
5 | # Persistent global definitions | ||
6 | # added by caller profile | ||
7 | #include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-xdg.inc | ||
16 | |||
17 | include whitelist-common.inc | ||
18 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | ||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
23 | caps.drop all | ||
24 | machine-id | ||
25 | net none | ||
26 | nodvd | ||
27 | nogroups | ||
28 | nonewprivs | ||
29 | noroot | ||
30 | nosound | ||
31 | notv | ||
32 | nou2f | ||
33 | novideo | ||
34 | protocol unix | ||
35 | seccomp | ||
36 | shell none | ||
37 | tracelog | ||
38 | |||
39 | disable-mnt | ||
40 | private-cache | ||
41 | private-dev | ||
42 | private-etc dconf,fonts,gconf,gtk-2.0,gtk-3.0,machine-id,pango,X11 | ||
43 | private-tmp | ||
diff --git a/etc/gpg-agent.profile b/etc/gpg-agent.profile index 16bda186e..adc8957e6 100644 --- a/etc/gpg-agent.profile +++ b/etc/gpg-agent.profile | |||
@@ -21,9 +21,12 @@ include disable-xdg.inc | |||
21 | 21 | ||
22 | mkdir ${HOME}/.gnupg | 22 | mkdir ${HOME}/.gnupg |
23 | whitelist ${HOME}/.gnupg | 23 | whitelist ${HOME}/.gnupg |
24 | whitelist ${RUNUSER}/gnupg | ||
25 | whitelist ${RUNUSER}/keyring | ||
24 | whitelist /usr/share/gnupg | 26 | whitelist /usr/share/gnupg |
25 | whitelist /usr/share/gnupg2 | 27 | whitelist /usr/share/gnupg2 |
26 | include whitelist-common.inc | 28 | include whitelist-common.inc |
29 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | 30 | include whitelist-usr-share-common.inc |
28 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
29 | 32 | ||
diff --git a/etc/gpg.profile b/etc/gpg.profile index b408a0123..787f35f9e 100644 --- a/etc/gpg.profile +++ b/etc/gpg.profile | |||
@@ -18,9 +18,12 @@ include disable-interpreters.inc | |||
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | 20 | ||
21 | whitelist ${RUNUSER}/gnupg | ||
22 | whitelist ${RUNUSER}/keyring | ||
21 | whitelist /usr/share/gnupg | 23 | whitelist /usr/share/gnupg |
22 | whitelist /usr/share/gnupg2 | 24 | whitelist /usr/share/gnupg2 |
23 | whitelist /usr/share/pacman/keyrings | 25 | whitelist /usr/share/pacman/keyrings |
26 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
26 | 29 | ||
diff --git a/etc/gucharmap.profile b/etc/gucharmap.profile index b3aa58d29..f3e3ab14d 100644 --- a/etc/gucharmap.profile +++ b/etc/gucharmap.profile | |||
@@ -15,6 +15,7 @@ include disable-programs.inc | |||
15 | include disable-xdg.inc | 15 | include disable-xdg.inc |
16 | 16 | ||
17 | include whitelist-common.inc | 17 | include whitelist-common.inc |
18 | include whitelist-runuser-common.inc | ||
18 | include whitelist-usr-share-common.inc | 19 | include whitelist-usr-share-common.inc |
19 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
20 | 21 | ||
diff --git a/etc/handbrake.profile b/etc/handbrake.profile index 324c629e3..add3f407c 100644 --- a/etc/handbrake.profile +++ b/etc/handbrake.profile | |||
@@ -22,7 +22,7 @@ include whitelist-var-common.inc | |||
22 | 22 | ||
23 | apparmor | 23 | apparmor |
24 | caps.drop all | 24 | caps.drop all |
25 | netfilter | 25 | net none |
26 | nodbus | 26 | nodbus |
27 | nogroups | 27 | nogroups |
28 | nonewprivs | 28 | nonewprivs |
diff --git a/etc/highlight.profile b/etc/highlight.profile index 036de8d99..fc8b2f65a 100644 --- a/etc/highlight.profile +++ b/etc/highlight.profile | |||
@@ -7,6 +7,7 @@ include highlight.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | blacklist ${RUNUSER}/wayland-* | 9 | blacklist ${RUNUSER}/wayland-* |
10 | blacklist ${RUNUSER} | ||
10 | 11 | ||
11 | include disable-common.inc | 12 | include disable-common.inc |
12 | include disable-devel.inc | 13 | include disable-devel.inc |
diff --git a/etc/host.profile b/etc/host.profile new file mode 100644 index 000000000..51b372361 --- /dev/null +++ b/etc/host.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for host | ||
2 | # Description: DNS lookup utility | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include host.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | noblacklist ${PATH}/host | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | ipc-namespace | ||
26 | machine-id | ||
27 | netfilter | ||
28 | no3d | ||
29 | nodbus | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | nosound | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix,inet,inet6 | ||
39 | seccomp | ||
40 | shell none | ||
41 | tracelog | ||
42 | |||
43 | disable-mnt | ||
44 | private | ||
45 | private-bin bash,host,sh | ||
46 | private-dev | ||
47 | private-tmp | ||
48 | |||
49 | memory-deny-write-execute | ||
diff --git a/etc/iagno.profile b/etc/iagno.profile new file mode 100644 index 000000000..e79043048 --- /dev/null +++ b/etc/iagno.profile | |||
@@ -0,0 +1,37 @@ | |||
1 | # Firejail profile for iagno | ||
2 | # Description: Reversi clone for Gnome desktop | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include iagno.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | |||
16 | include whitelist-var-common.inc | ||
17 | |||
18 | apparmor | ||
19 | caps.drop all | ||
20 | net none | ||
21 | #nodbus | ||
22 | nodvd | ||
23 | nogroups | ||
24 | nonewprivs | ||
25 | noroot | ||
26 | notv | ||
27 | nou2f | ||
28 | novideo | ||
29 | protocol unix | ||
30 | seccomp | ||
31 | shell none | ||
32 | |||
33 | disable-mnt | ||
34 | private | ||
35 | private-bin iagno | ||
36 | private-dev | ||
37 | private-tmp | ||
diff --git a/etc/kino.profile b/etc/kino.profile index 9e8d61391..b3ade0dd9 100644 --- a/etc/kino.profile +++ b/etc/kino.profile | |||
@@ -16,6 +16,9 @@ include disable-interpreters.inc | |||
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | 18 | ||
19 | include whitelist-var-common.inc | ||
20 | |||
21 | apparmor | ||
19 | caps.drop all | 22 | caps.drop all |
20 | netfilter | 23 | netfilter |
21 | nogroups | 24 | nogroups |
diff --git a/etc/kmplayer.profile b/etc/kmplayer.profile new file mode 100644 index 000000000..7eabde61d --- /dev/null +++ b/etc/kmplayer.profile | |||
@@ -0,0 +1,41 @@ | |||
1 | # Firejail profile for mplayer | ||
2 | # Description: mplayer KDE GUI (movie player) | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include kmplayer.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/kmplayerrc | ||
10 | noblacklist ${HOME}/.kde/share/config/kmplayerrc | ||
11 | noblacklist ${HOME}/.local/share/kmplayer | ||
12 | noblacklist ${MUSIC} | ||
13 | noblacklist ${VIDEOS} | ||
14 | |||
15 | include disable-common.inc | ||
16 | include disable-devel.inc | ||
17 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | ||
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | |||
26 | apparmor | ||
27 | caps.drop all | ||
28 | netfilter | ||
29 | nogroups | ||
30 | nonewprivs | ||
31 | noroot | ||
32 | nou2f | ||
33 | protocol unix,inet,inet6,netlink | ||
34 | seccomp | ||
35 | shell none | ||
36 | |||
37 | # private-bin kmplayer,mplayer | ||
38 | private-cache | ||
39 | private-dev | ||
40 | private-tmp | ||
41 | |||
diff --git a/etc/latex-common.profile b/etc/latex-common.profile index 712ada722..84901e8ef 100644 --- a/etc/latex-common.profile +++ b/etc/latex-common.profile | |||
@@ -14,6 +14,7 @@ include disable-passwdmgr.inc | |||
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | 15 | ||
16 | whitelist /var/lib | 16 | whitelist /var/lib |
17 | include whitelist-runuser-common.inc | ||
17 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/leafpad.profile b/etc/leafpad.profile index 56a792c8e..c456541aa 100644 --- a/etc/leafpad.profile +++ b/etc/leafpad.profile | |||
@@ -17,8 +17,9 @@ include disable-programs.inc | |||
17 | 17 | ||
18 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
19 | 19 | ||
20 | apparmor | ||
20 | caps.drop all | 21 | caps.drop all |
21 | netfilter | 22 | net none |
22 | no3d | 23 | no3d |
23 | nodvd | 24 | nodvd |
24 | nogroups | 25 | nogroups |
diff --git a/etc/less.profile b/etc/less.profile index 00624e0f1..27e24c852 100644 --- a/etc/less.profile +++ b/etc/less.profile | |||
@@ -8,6 +8,7 @@ include less.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | noblacklist ${HOME}/.lesshst | 13 | noblacklist ${HOME}/.lesshst |
13 | 14 | ||
diff --git a/etc/lightsoff.profile b/etc/lightsoff.profile new file mode 100644 index 000000000..65c8bd78d --- /dev/null +++ b/etc/lightsoff.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for lightsoff | ||
2 | # Description: Sliding tile puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include lightsoff.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | whitelist /usr/share/lightsoff | ||
10 | |||
11 | private-bin lightsoff | ||
12 | |||
13 | # Redirect | ||
14 | include gnome_games-common.profile | ||
diff --git a/etc/lincity-ng.profile b/etc/lincity-ng.profile index b55ac9a15..748d38221 100644 --- a/etc/lincity-ng.profile +++ b/etc/lincity-ng.profile | |||
@@ -21,6 +21,7 @@ whitelist ${HOME}/.lincity-ng | |||
21 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | apparmor | ||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | net none | 27 | net none |
diff --git a/etc/links.profile b/etc/links.profile index a31001c87..b2f94d3cf 100644 --- a/etc/links.profile +++ b/etc/links.profile | |||
@@ -24,6 +24,7 @@ include disable-xdg.inc | |||
24 | mkdir ${HOME}/.links | 24 | mkdir ${HOME}/.links |
25 | whitelist ${HOME}/.links | 25 | whitelist ${HOME}/.links |
26 | whitelist ${DOWNLOADS} | 26 | whitelist ${DOWNLOADS} |
27 | include whitelist-runuser-common.inc | ||
27 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
28 | 29 | ||
29 | caps.drop all | 30 | caps.drop all |
diff --git a/etc/lximage-qt.profile b/etc/lximage-qt.profile index 74adb7a67..a33ddab78 100644 --- a/etc/lximage-qt.profile +++ b/etc/lximage-qt.profile | |||
@@ -14,9 +14,11 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include whitelist-var-common.inc | ||
17 | 18 | ||
19 | apparmor | ||
18 | caps.drop all | 20 | caps.drop all |
19 | netfilter | 21 | net none |
20 | no3d | 22 | no3d |
21 | nodvd | 23 | nodvd |
22 | nogroups | 24 | nogroups |
diff --git a/etc/lxmusic.profile b/etc/lxmusic.profile index e1a37343e..9094f4377 100644 --- a/etc/lxmusic.profile +++ b/etc/lxmusic.profile | |||
@@ -20,6 +20,7 @@ include disable-xdg.inc | |||
20 | 20 | ||
21 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
22 | 22 | ||
23 | apparmor | ||
23 | caps.drop all | 24 | caps.drop all |
24 | netfilter | 25 | netfilter |
25 | no3d | 26 | no3d |
diff --git a/etc/lynx.profile b/etc/lynx.profile index fb6fe94ec..dbd0a61e5 100644 --- a/etc/lynx.profile +++ b/etc/lynx.profile | |||
@@ -16,6 +16,8 @@ include disable-passwdmgr.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | 17 | include disable-xdg.inc |
18 | 18 | ||
19 | include whitelist-runuser-common.inc | ||
20 | |||
19 | caps.drop all | 21 | caps.drop all |
20 | netfilter | 22 | netfilter |
21 | no3d | 23 | no3d |
diff --git a/etc/lzcat.profile b/etc/lzcat.profile index f7410b928..d9c72407f 100644 --- a/etc/lzcat.profile +++ b/etc/lzcat.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzcmp.profile b/etc/lzcmp.profile index f7410b928..d9c72407f 100644 --- a/etc/lzcmp.profile +++ b/etc/lzcmp.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzegrep.profile b/etc/lzegrep.profile index f7410b928..d9c72407f 100644 --- a/etc/lzegrep.profile +++ b/etc/lzegrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzfgrep.profile b/etc/lzfgrep.profile index f7410b928..d9c72407f 100644 --- a/etc/lzfgrep.profile +++ b/etc/lzfgrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzgrep.profile b/etc/lzgrep.profile index f7410b928..d9c72407f 100644 --- a/etc/lzgrep.profile +++ b/etc/lzgrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzip.profile b/etc/lzip.profile index f7410b928..d9c72407f 100644 --- a/etc/lzip.profile +++ b/etc/lzip.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzless.profile b/etc/lzless.profile index f7410b928..d9c72407f 100644 --- a/etc/lzless.profile +++ b/etc/lzless.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzma.profile b/etc/lzma.profile index f7410b928..d9c72407f 100644 --- a/etc/lzma.profile +++ b/etc/lzma.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzmainfo.profile b/etc/lzmainfo.profile index f7410b928..d9c72407f 100644 --- a/etc/lzmainfo.profile +++ b/etc/lzmainfo.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzmore.profile b/etc/lzmore.profile index f7410b928..d9c72407f 100644 --- a/etc/lzmore.profile +++ b/etc/lzmore.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/mate-calc.profile b/etc/mate-calc.profile index 2f6020ad3..8bd62ae0b 100644 --- a/etc/mate-calc.profile +++ b/etc/mate-calc.profile | |||
@@ -22,7 +22,9 @@ whitelist ${HOME}/.cache/mate-calc | |||
22 | whitelist ${HOME}/.config/caja | 22 | whitelist ${HOME}/.config/caja |
23 | whitelist ${HOME}/.config/mate-menu | 23 | whitelist ${HOME}/.config/mate-menu |
24 | include whitelist-common.inc | 24 | include whitelist-common.inc |
25 | include whitelist-var-common.inc | ||
25 | 26 | ||
27 | apparmor | ||
26 | caps.drop all | 28 | caps.drop all |
27 | net none | 29 | net none |
28 | no3d | 30 | no3d |
diff --git a/etc/mate-dictionary.profile b/etc/mate-dictionary.profile index 49a776766..59f439c91 100644 --- a/etc/mate-dictionary.profile +++ b/etc/mate-dictionary.profile | |||
@@ -18,6 +18,7 @@ mkdir ${HOME}/.config/mate/mate-dictionary | |||
18 | whitelist ${HOME}/.config/mate/mate-dictionary | 18 | whitelist ${HOME}/.config/mate/mate-dictionary |
19 | include whitelist-common.inc | 19 | include whitelist-common.inc |
20 | 20 | ||
21 | apparmor | ||
21 | caps.drop all | 22 | caps.drop all |
22 | netfilter | 23 | netfilter |
23 | no3d | 24 | no3d |
diff --git a/etc/meld.profile b/etc/meld.profile index 9a320c13d..be13e9643 100644 --- a/etc/meld.profile +++ b/etc/meld.profile | |||
@@ -36,6 +36,8 @@ include disable-passwdmgr.inc | |||
36 | # Uncomment the next line (or put it into your meld.local) if you don't need to compare files in disable-programs.inc. | 36 | # Uncomment the next line (or put it into your meld.local) if you don't need to compare files in disable-programs.inc. |
37 | #include disable-programs.inc | 37 | #include disable-programs.inc |
38 | 38 | ||
39 | include whitelist-runuser-common.inc | ||
40 | |||
39 | # Uncomment the next lines (or put it into your meld.local) if you don't need to compare files in /usr/share. | 41 | # Uncomment the next lines (or put it into your meld.local) if you don't need to compare files in /usr/share. |
40 | #whitelist /usr/share/meld | 42 | #whitelist /usr/share/meld |
41 | #include whitelist-usr-share-common.inc | 43 | #include whitelist-usr-share-common.inc |
diff --git a/etc/midori.profile b/etc/midori.profile index e11e2acaa..e15259608 100644 --- a/etc/midori.profile +++ b/etc/midori.profile | |||
@@ -48,7 +48,9 @@ whitelist ${HOME}/.local/share/webkitgtk | |||
48 | whitelist ${HOME}/.pki | 48 | whitelist ${HOME}/.pki |
49 | whitelist ${HOME}/.local/share/pki | 49 | whitelist ${HOME}/.local/share/pki |
50 | include whitelist-common.inc | 50 | include whitelist-common.inc |
51 | include whitelist-var-common.inc | ||
51 | 52 | ||
53 | apparmor | ||
52 | caps.drop all | 54 | caps.drop all |
53 | netfilter | 55 | netfilter |
54 | nodvd | 56 | nodvd |
@@ -60,3 +62,4 @@ seccomp | |||
60 | tracelog | 62 | tracelog |
61 | 63 | ||
62 | disable-mnt | 64 | disable-mnt |
65 | private-tmp | ||
diff --git a/etc/mousepad.profile b/etc/mousepad.profile index 20370a5b5..868313c40 100644 --- a/etc/mousepad.profile +++ b/etc/mousepad.profile | |||
@@ -17,8 +17,9 @@ include disable-programs.inc | |||
17 | 17 | ||
18 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
19 | 19 | ||
20 | apparmor | ||
20 | caps.drop all | 21 | caps.drop all |
21 | netfilter | 22 | net none |
22 | nodvd | 23 | nodvd |
23 | nogroups | 24 | nogroups |
24 | nonewprivs | 25 | nonewprivs |
diff --git a/etc/mplayer.profile b/etc/mplayer.profile index 9ab4f8c7f..cd25d6c0b 100644 --- a/etc/mplayer.profile +++ b/etc/mplayer.profile | |||
@@ -21,7 +21,9 @@ include disable-xdg.inc | |||
21 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | apparmor | ||
24 | caps.drop all | 25 | caps.drop all |
26 | # net none - mplayer can be used for streaming. | ||
25 | netfilter | 27 | netfilter |
26 | # nogroups | 28 | # nogroups |
27 | nonewprivs | 29 | nonewprivs |
diff --git a/etc/mupdf.profile b/etc/mupdf.profile index 43afbc859..592467658 100644 --- a/etc/mupdf.profile +++ b/etc/mupdf.profile | |||
@@ -18,6 +18,7 @@ include disable-xdg.inc | |||
18 | 18 | ||
19 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
20 | 20 | ||
21 | apparmor | ||
21 | caps.drop all | 22 | caps.drop all |
22 | machine-id | 23 | machine-id |
23 | net none | 24 | net none |
diff --git a/etc/musescore.profile b/etc/musescore.profile index b3693c956..679e82ae8 100644 --- a/etc/musescore.profile +++ b/etc/musescore.profile | |||
@@ -23,6 +23,7 @@ include disable-xdg.inc | |||
23 | 23 | ||
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
25 | 25 | ||
26 | apparmor | ||
26 | caps.drop all | 27 | caps.drop all |
27 | netfilter | 28 | netfilter |
28 | no3d | 29 | no3d |
diff --git a/etc/mutt.profile b/etc/mutt.profile index 1fc412955..8ff547b52 100644 --- a/etc/mutt.profile +++ b/etc/mutt.profile | |||
@@ -40,6 +40,8 @@ include disable-interpreters.inc | |||
40 | include disable-passwdmgr.inc | 40 | include disable-passwdmgr.inc |
41 | include disable-programs.inc | 41 | include disable-programs.inc |
42 | 42 | ||
43 | include whitelist-runuser-common.inc | ||
44 | |||
43 | caps.drop all | 45 | caps.drop all |
44 | netfilter | 46 | netfilter |
45 | no3d | 47 | no3d |
diff --git a/etc/newsboat.profile b/etc/newsboat.profile index e063abe53..eabd17b4b 100644 --- a/etc/newsboat.profile +++ b/etc/newsboat.profile | |||
@@ -19,6 +19,7 @@ include disable-xdg.inc | |||
19 | mkdir ${HOME}/.newsboat | 19 | mkdir ${HOME}/.newsboat |
20 | whitelist ${HOME}/.newsboat | 20 | whitelist ${HOME}/.newsboat |
21 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-runuser-common.inc | ||
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
24 | caps.drop all | 25 | caps.drop all |
diff --git a/etc/nslookup.profile b/etc/nslookup.profile new file mode 100644 index 000000000..4aa1cfcbf --- /dev/null +++ b/etc/nslookup.profile | |||
@@ -0,0 +1,53 @@ | |||
1 | # Firejail profile for nslookup | ||
2 | # Description: DNS lookup utility | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include nslookup.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist /tmp/.X11-unix | ||
11 | blacklist ${RUNUSER}/wayland-* | ||
12 | blacklist ${RUNUSER} | ||
13 | |||
14 | noblacklist ${PATH}/nslookup | ||
15 | |||
16 | include disable-common.inc | ||
17 | include disable-devel.inc | ||
18 | include disable-exec.inc | ||
19 | include disable-interpreters.inc | ||
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | ||
22 | include disable-xdg.inc | ||
23 | |||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | ipc-namespace | ||
30 | machine-id | ||
31 | netfilter | ||
32 | no3d | ||
33 | nodbus | ||
34 | nodvd | ||
35 | nogroups | ||
36 | nonewprivs | ||
37 | noroot | ||
38 | nosound | ||
39 | notv | ||
40 | nou2f | ||
41 | novideo | ||
42 | protocol unix,inet,inet6 | ||
43 | seccomp | ||
44 | shell none | ||
45 | tracelog | ||
46 | |||
47 | disable-mnt | ||
48 | private | ||
49 | private-bin bash,nslookup,sh | ||
50 | private-dev | ||
51 | private-tmp | ||
52 | |||
53 | memory-deny-write-execute | ||
diff --git a/etc/open-invaders.profile b/etc/open-invaders.profile index 5925ccc09..1f214b7f5 100644 --- a/etc/open-invaders.profile +++ b/etc/open-invaders.profile | |||
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.openinvaders | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
@@ -17,7 +18,9 @@ include disable-programs.inc | |||
17 | mkdir ${HOME}/.openinvaders | 18 | mkdir ${HOME}/.openinvaders |
18 | whitelist ${HOME}/.openinvaders | 19 | whitelist ${HOME}/.openinvaders |
19 | include whitelist-common.inc | 20 | include whitelist-common.inc |
21 | include whitelist-var-common.inc | ||
20 | 22 | ||
23 | apparmor | ||
21 | caps.drop all | 24 | caps.drop all |
22 | net none | 25 | net none |
23 | nodbus | 26 | nodbus |
@@ -32,6 +35,6 @@ protocol unix,netlink | |||
32 | seccomp | 35 | seccomp |
33 | shell none | 36 | shell none |
34 | 37 | ||
35 | # private-bin open-invaders | 38 | private-bin open-invaders |
36 | private-dev | 39 | private-dev |
37 | private-tmp | 40 | private-tmp |
diff --git a/etc/opencity.profile b/etc/opencity.profile index 6a27c8095..b0192c947 100644 --- a/etc/opencity.profile +++ b/etc/opencity.profile | |||
@@ -21,6 +21,7 @@ whitelist ${HOME}/.opencity | |||
21 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | apparmor | ||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | net none | 27 | net none |
diff --git a/etc/openclonk.profile b/etc/openclonk.profile index da60006b3..20b2a9626 100644 --- a/etc/openclonk.profile +++ b/etc/openclonk.profile | |||
@@ -21,9 +21,11 @@ whitelist ${HOME}/.clonk | |||
21 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | apparmor | ||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | net none | 27 | # net none - networked game |
28 | netfilter | ||
27 | nodbus | 29 | nodbus |
28 | nodvd | 30 | nodvd |
29 | nogroups | 31 | nogroups |
diff --git a/etc/openttd.profile b/etc/openttd.profile index 5de4d325d..10f2f39c3 100644 --- a/etc/openttd.profile +++ b/etc/openttd.profile | |||
@@ -21,9 +21,10 @@ whitelist ${HOME}/.openttd | |||
21 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | apparmor | ||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | netfilter | 27 | net none |
27 | nodbus | 28 | nodbus |
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
diff --git a/etc/pandoc.profile b/etc/pandoc.profile index 9a8d82a96..9117b0c07 100644 --- a/etc/pandoc.profile +++ b/etc/pandoc.profile | |||
@@ -8,6 +8,7 @@ include pandoc.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | noblacklist ${DOCUMENTS} | 13 | noblacklist ${DOCUMENTS} |
13 | 14 | ||
diff --git a/etc/patch.profile b/etc/patch.profile index 4a3365378..95c92a3f5 100644 --- a/etc/patch.profile +++ b/etc/patch.profile | |||
@@ -8,6 +8,7 @@ include patch.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | noblacklist ${DOCUMENTS} | 13 | noblacklist ${DOCUMENTS} |
13 | 14 | ||
diff --git a/etc/pdftotext.profile b/etc/pdftotext.profile index 73ebf4615..a7112f1e8 100644 --- a/etc/pdftotext.profile +++ b/etc/pdftotext.profile | |||
@@ -7,6 +7,7 @@ include pdftotext.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | blacklist ${RUNUSER}/wayland-* | 9 | blacklist ${RUNUSER}/wayland-* |
10 | blacklist ${RUNUSER} | ||
10 | 11 | ||
11 | noblacklist ${DOCUMENTS} | 12 | noblacklist ${DOCUMENTS} |
12 | 13 | ||
diff --git a/etc/penguin-command.profile b/etc/penguin-command.profile new file mode 100644 index 000000000..a44126b65 --- /dev/null +++ b/etc/penguin-command.profile | |||
@@ -0,0 +1,39 @@ | |||
1 | # Firejail profile for open-invaders | ||
2 | # Description: Space Invaders clone | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include penguin-command.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.penguin-command | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | |||
18 | whitelist ${HOME}/.penguin-command | ||
19 | include whitelist-common.inc | ||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
23 | caps.drop all | ||
24 | net none | ||
25 | nodbus | ||
26 | nodvd | ||
27 | nogroups | ||
28 | nonewprivs | ||
29 | noroot | ||
30 | notv | ||
31 | nou2f | ||
32 | novideo | ||
33 | protocol unix,netlink | ||
34 | seccomp | ||
35 | shell none | ||
36 | |||
37 | private-bin penguin-command | ||
38 | private-dev | ||
39 | private-tmp | ||
diff --git a/etc/ping.profile b/etc/ping.profile index 5f68ee011..3ef8ad64a 100644 --- a/etc/ping.profile +++ b/etc/ping.profile | |||
@@ -7,6 +7,10 @@ include ping.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist /tmp/.X11-unix | ||
11 | blacklist ${RUNUSER}/wayland-* | ||
12 | blacklist ${RUNUSER} | ||
13 | |||
10 | include disable-common.inc | 14 | include disable-common.inc |
11 | include disable-devel.inc | 15 | include disable-devel.inc |
12 | include disable-exec.inc | 16 | include disable-exec.inc |
@@ -19,6 +23,7 @@ include whitelist-common.inc | |||
19 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
21 | 25 | ||
26 | apparmor | ||
22 | caps.keep net_raw | 27 | caps.keep net_raw |
23 | ipc-namespace | 28 | ipc-namespace |
24 | #net tun0 | 29 | #net tun0 |
diff --git a/etc/pingus.profile b/etc/pingus.profile index a3adc55a2..8e77a26d0 100644 --- a/etc/pingus.profile +++ b/etc/pingus.profile | |||
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.pingus | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
@@ -17,7 +18,9 @@ include disable-programs.inc | |||
17 | mkdir ${HOME}/.pingus | 18 | mkdir ${HOME}/.pingus |
18 | whitelist ${HOME}/.pingus | 19 | whitelist ${HOME}/.pingus |
19 | include whitelist-common.inc | 20 | include whitelist-common.inc |
21 | include whitelist-var-common.inc | ||
20 | 22 | ||
23 | apparmor | ||
21 | caps.drop all | 24 | caps.drop all |
22 | net none | 25 | net none |
23 | nodbus | 26 | nodbus |
diff --git a/etc/pitivi.profile b/etc/pitivi.profile index 89a6a020b..c722e29b4 100644 --- a/etc/pitivi.profile +++ b/etc/pitivi.profile | |||
@@ -6,7 +6,6 @@ include pitivi.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | |||
10 | noblacklist ${HOME}/.config/pitivi | 9 | noblacklist ${HOME}/.config/pitivi |
11 | 10 | ||
12 | # Allow python (blacklisted by disable-interpreters.inc) | 11 | # Allow python (blacklisted by disable-interpreters.inc) |
@@ -20,11 +19,13 @@ include disable-interpreters.inc | |||
20 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | 21 | ||
22 | include whitelist-runuser-common.inc | ||
23 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
24 | 24 | ||
25 | apparmor | ||
25 | caps.drop all | 26 | caps.drop all |
26 | ipc-namespace | 27 | ipc-namespace |
27 | netfilter | 28 | net none |
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
diff --git a/etc/planmaker18.profile b/etc/planmaker18.profile index 4cf1efb7f..2ba8e86c0 100644 --- a/etc/planmaker18.profile +++ b/etc/planmaker18.profile | |||
@@ -7,4 +7,4 @@ include planmaker18.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/planmaker18free.profile b/etc/planmaker18free.profile index bb85f1fc7..d0bce44f5 100644 --- a/etc/planmaker18free.profile +++ b/etc/planmaker18free.profile | |||
@@ -7,4 +7,4 @@ include planmaker18free.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/pngquant.profile b/etc/pngquant.profile index f9ce43c4c..4695eee71 100644 --- a/etc/pngquant.profile +++ b/etc/pngquant.profile | |||
@@ -16,6 +16,8 @@ include disable-interpreters.inc | |||
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | 18 | ||
19 | include whitelist-runuser-common.inc | ||
20 | include whitelist-usr-share-common.inc | ||
19 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
20 | 22 | ||
21 | apparmor | 23 | apparmor |
diff --git a/etc/polari.profile b/etc/polari.profile index 939e2537e..87a53775f 100644 --- a/etc/polari.profile +++ b/etc/polari.profile | |||
@@ -28,6 +28,7 @@ whitelist ${HOME}/.local/share/TpLogger | |||
28 | whitelist ${HOME}/.local/share/telepathy | 28 | whitelist ${HOME}/.local/share/telepathy |
29 | whitelist ${HOME}/.purple | 29 | whitelist ${HOME}/.purple |
30 | include whitelist-common.inc | 30 | include whitelist-common.inc |
31 | include whitelist-runuser-common.inc | ||
31 | 32 | ||
32 | caps.drop all | 33 | caps.drop all |
33 | netfilter | 34 | netfilter |
diff --git a/etc/ppsspp.profile b/etc/ppsspp.profile index 970290002..0b5da661a 100644 --- a/etc/ppsspp.profile +++ b/etc/ppsspp.profile | |||
@@ -21,7 +21,6 @@ include whitelist-var-common.inc | |||
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | ipc-namespace | 23 | ipc-namespace |
24 | netfilter | ||
25 | net none | 24 | net none |
26 | nodbus | 25 | nodbus |
27 | nodvd | 26 | nodvd |
diff --git a/etc/presentations18.profile b/etc/presentations18.profile index ac844d1af..d4f531060 100644 --- a/etc/presentations18.profile +++ b/etc/presentations18.profile | |||
@@ -7,4 +7,5 @@ include presentations18.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
11 | |||
diff --git a/etc/presentations18free.profile b/etc/presentations18free.profile index 218747224..e2319f13f 100644 --- a/etc/presentations18free.profile +++ b/etc/presentations18free.profile | |||
@@ -7,4 +7,4 @@ include presentations18free.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/qpdfview.profile b/etc/qpdfview.profile index 863f57ba4..dace1634f 100644 --- a/etc/qpdfview.profile +++ b/etc/qpdfview.profile | |||
@@ -20,6 +20,7 @@ include disable-xdg.inc | |||
20 | 20 | ||
21 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
22 | 22 | ||
23 | apparmor | ||
23 | caps.drop all | 24 | caps.drop all |
24 | machine-id | 25 | machine-id |
25 | # needs D-Bus when started from a file manager | 26 | # needs D-Bus when started from a file manager |
diff --git a/etc/remmina.profile b/etc/remmina.profile index e85ceca13..6311c91df 100644 --- a/etc/remmina.profile +++ b/etc/remmina.profile | |||
@@ -19,6 +19,7 @@ include disable-passwdmgr.inc | |||
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-xdg.inc | 20 | include disable-xdg.inc |
21 | 21 | ||
22 | include whitelist-runuser-common.inc | ||
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
24 | caps.drop all | 25 | caps.drop all |
diff --git a/etc/rhythmbox.profile b/etc/rhythmbox.profile index ad8b1015e..689fbe626 100644 --- a/etc/rhythmbox.profile +++ b/etc/rhythmbox.profile | |||
@@ -25,10 +25,11 @@ include disable-xdg.inc | |||
25 | whitelist /usr/share/rhythmbox | 25 | whitelist /usr/share/rhythmbox |
26 | whitelist /usr/share/lua | 26 | whitelist /usr/share/lua |
27 | whitelist /usr/share/libquvi-scripts | 27 | whitelist /usr/share/libquvi-scripts |
28 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | 29 | include whitelist-usr-share-common.inc |
29 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
30 | 31 | ||
31 | # apparmor - makes settings immutable | 32 | apparmor |
32 | caps.drop all | 33 | caps.drop all |
33 | netfilter | 34 | netfilter |
34 | # nodbus - makes settings immutable | 35 | # nodbus - makes settings immutable |
@@ -38,7 +39,7 @@ noroot | |||
38 | notv | 39 | notv |
39 | nou2f | 40 | nou2f |
40 | novideo | 41 | novideo |
41 | protocol unix,inet,inet6 | 42 | protocol unix,inet,inet6,netlink |
42 | seccomp | 43 | seccomp |
43 | shell none | 44 | shell none |
44 | tracelog | 45 | tracelog |
diff --git a/etc/ripperx.profile b/etc/ripperx.profile new file mode 100644 index 000000000..b572aa1b4 --- /dev/null +++ b/etc/ripperx.profile | |||
@@ -0,0 +1,41 @@ | |||
1 | # Firejail profile for mpv | ||
2 | # Description: Graphical audio CD ripper and encoder | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ripperx.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.ripperXrc | ||
10 | noblacklist ${MUSIC} | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | netfilter | ||
26 | no3d | ||
27 | nodbus | ||
28 | nogroups | ||
29 | nonewprivs | ||
30 | noroot | ||
31 | nou2f | ||
32 | notv | ||
33 | novideo | ||
34 | protocol unix,inet,inet6 | ||
35 | seccomp | ||
36 | shell none | ||
37 | tracelog | ||
38 | |||
39 | private-cache | ||
40 | private-dev | ||
41 | private-tmp | ||
diff --git a/etc/ristretto.profile b/etc/ristretto.profile index 8fcbb203c..a1cbdf16c 100644 --- a/etc/ristretto.profile +++ b/etc/ristretto.profile | |||
@@ -17,7 +17,11 @@ include disable-interpreters.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
20 | caps.drop all | 23 | caps.drop all |
24 | net none | ||
21 | netfilter | 25 | netfilter |
22 | no3d | 26 | no3d |
23 | nodvd | 27 | nodvd |
diff --git a/etc/rsync-download_only.profile b/etc/rsync-download_only.profile index 84147f0a5..500656a4b 100644 --- a/etc/rsync-download_only.profile +++ b/etc/rsync-download_only.profile | |||
@@ -14,6 +14,7 @@ include globals.local | |||
14 | 14 | ||
15 | blacklist /tmp/.X11-unix | 15 | blacklist /tmp/.X11-unix |
16 | blacklist ${RUNUSER}/wayland-* | 16 | blacklist ${RUNUSER}/wayland-* |
17 | blacklist ${RUNUSER} | ||
17 | 18 | ||
18 | include disable-common.inc | 19 | include disable-common.inc |
19 | include disable-devel.inc | 20 | include disable-devel.inc |
diff --git a/etc/scribus.profile b/etc/scribus.profile index e20cd1b5a..e7faccea1 100644 --- a/etc/scribus.profile +++ b/etc/scribus.profile | |||
@@ -40,6 +40,7 @@ include disable-xdg.inc | |||
40 | 40 | ||
41 | include whitelist-var-common.inc | 41 | include whitelist-var-common.inc |
42 | 42 | ||
43 | apparmor | ||
43 | caps.drop all | 44 | caps.drop all |
44 | net none | 45 | net none |
45 | nodbus | 46 | nodbus |
diff --git a/etc/seahorse.profile b/etc/seahorse.profile index 5a742d05f..3a69086b5 100644 --- a/etc/seahorse.profile +++ b/etc/seahorse.profile | |||
@@ -31,7 +31,10 @@ whitelist /usr/share/gnupg | |||
31 | whitelist /usr/share/gnupg2 | 31 | whitelist /usr/share/gnupg2 |
32 | whitelist /usr/share/seahorse | 32 | whitelist /usr/share/seahorse |
33 | whitelist /usr/share/seahorse-nautilus | 33 | whitelist /usr/share/seahorse-nautilus |
34 | whitelist ${RUNUSER}/gnupg | ||
35 | whitelist ${RUNUSER}/keyring | ||
34 | #include whitelist-common.inc | 36 | #include whitelist-common.inc |
37 | include whitelist-runuser-common.inc | ||
35 | include whitelist-usr-share-common.inc | 38 | include whitelist-usr-share-common.inc |
36 | include whitelist-var-common.inc | 39 | include whitelist-var-common.inc |
37 | 40 | ||
diff --git a/etc/shellcheck.profile b/etc/shellcheck.profile index f8744bdf8..fb43c61e4 100644 --- a/etc/shellcheck.profile +++ b/etc/shellcheck.profile | |||
@@ -8,6 +8,7 @@ include shellcheck.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | noblacklist ${DOCUMENTS} | 13 | noblacklist ${DOCUMENTS} |
13 | 14 | ||
@@ -23,6 +24,7 @@ whitelist /usr/share/shellcheck | |||
23 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
27 | apparmor | ||
26 | caps.drop all | 28 | caps.drop all |
27 | ipc-namespace | 29 | ipc-namespace |
28 | machine-id | 30 | machine-id |
diff --git a/etc/simutrans.profile b/etc/simutrans.profile index c6f5f70b0..73093a259 100644 --- a/etc/simutrans.profile +++ b/etc/simutrans.profile | |||
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.simutrans | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
@@ -17,7 +18,9 @@ include disable-programs.inc | |||
17 | mkdir ${HOME}/.simutrans | 18 | mkdir ${HOME}/.simutrans |
18 | whitelist ${HOME}/.simutrans | 19 | whitelist ${HOME}/.simutrans |
19 | include whitelist-common.inc | 20 | include whitelist-common.inc |
21 | include whitelist-var-common.inc | ||
20 | 22 | ||
23 | apparmor | ||
21 | caps.drop all | 24 | caps.drop all |
22 | net none | 25 | net none |
23 | nodbus | 26 | nodbus |
diff --git a/etc/slack.profile b/etc/slack.profile index 54069f657..9a10e38fe 100644 --- a/etc/slack.profile +++ b/etc/slack.profile | |||
@@ -28,7 +28,7 @@ noroot | |||
28 | notv | 28 | notv |
29 | nou2f | 29 | nou2f |
30 | protocol unix,inet,inet6,netlink | 30 | protocol unix,inet,inet6,netlink |
31 | seccomp | 31 | seccomp !chroot |
32 | shell none | 32 | shell none |
33 | 33 | ||
34 | disable-mnt | 34 | disable-mnt |
diff --git a/etc/smtube.profile b/etc/smtube.profile index 98e0229ce..79bc02979 100644 --- a/etc/smtube.profile +++ b/etc/smtube.profile | |||
@@ -28,6 +28,7 @@ whitelist /usr/share/smtube | |||
28 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
29 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
30 | 30 | ||
31 | apparmor | ||
31 | caps.drop all | 32 | caps.drop all |
32 | netfilter | 33 | netfilter |
33 | nodvd | 34 | nodvd |
diff --git a/etc/sol.profile b/etc/sol.profile index ea1620b31..4c8fdfbb1 100644 --- a/etc/sol.profile +++ b/etc/sol.profile | |||
@@ -17,6 +17,7 @@ include disable-xdg.inc | |||
17 | include whitelist-common.inc | 17 | include whitelist-common.inc |
18 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
19 | 19 | ||
20 | apparmor | ||
20 | caps.drop all | 21 | caps.drop all |
21 | ipc-namespace | 22 | ipc-namespace |
22 | net none | 23 | net none |
diff --git a/etc/sound-juicer.profile b/etc/sound-juicer.profile new file mode 100644 index 000000000..ebd321573 --- /dev/null +++ b/etc/sound-juicer.profile | |||
@@ -0,0 +1,41 @@ | |||
1 | # Firejail profile for mpv | ||
2 | # Description: Graphical audio CD ripper and encoder | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include sound-juicer.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/sound-juicer | ||
10 | noblacklist ${MUSIC} | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
23 | caps.drop all | ||
24 | netfilter | ||
25 | no3d | ||
26 | #nodbus | ||
27 | nogroups | ||
28 | nonewprivs | ||
29 | noroot | ||
30 | nosound | ||
31 | nou2f | ||
32 | notv | ||
33 | novideo | ||
34 | protocol unix,inet,inet6,netlink | ||
35 | seccomp | ||
36 | shell none | ||
37 | tracelog | ||
38 | |||
39 | private-cache | ||
40 | private-dev | ||
41 | private-tmp | ||
diff --git a/etc/ssh.profile b/etc/ssh.profile index 1551c3fb6..cbd59c6e0 100644 --- a/etc/ssh.profile +++ b/etc/ssh.profile | |||
@@ -18,7 +18,10 @@ include disable-exec.inc | |||
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | 20 | ||
21 | whitelist ${RUNUSER}/keyring/ssh | ||
22 | whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh | ||
21 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
24 | include whitelist-runuser-common.inc | ||
22 | 25 | ||
23 | caps.drop all | 26 | caps.drop all |
24 | ipc-namespace | 27 | ipc-namespace |
diff --git a/etc/steam.profile b/etc/steam.profile index bc90af837..499d21e6d 100644 --- a/etc/steam.profile +++ b/etc/steam.profile | |||
@@ -27,8 +27,8 @@ noblacklist /usr/sbin | |||
27 | include allow-java.inc | 27 | include allow-java.inc |
28 | 28 | ||
29 | # Allow python (blacklisted by disable-interpreters.inc) | 29 | # Allow python (blacklisted by disable-interpreters.inc) |
30 | include allow-python2.inc | 30 | include allow-python2.inc |
31 | include allow-python3.inc | 31 | include allow-python3.inc |
32 | 32 | ||
33 | include disable-common.inc | 33 | include disable-common.inc |
34 | include disable-devel.inc | 34 | include disable-devel.inc |
@@ -38,14 +38,13 @@ include disable-programs.inc | |||
38 | 38 | ||
39 | include whitelist-var-common.inc | 39 | include whitelist-var-common.inc |
40 | 40 | ||
41 | # allow-debuggers needed for running some games with proton | ||
42 | allow-debuggers | ||
43 | caps.drop all | 41 | caps.drop all |
44 | #ipc-namespace | 42 | #ipc-namespace |
45 | netfilter | 43 | netfilter |
46 | # nodbus disabled as it breaks appindicator support | 44 | # nodbus disabled as it breaks appindicator support |
47 | #nodbus | 45 | #nodbus |
48 | nodvd | 46 | nodvd |
47 | # nVidia user may need to comment / ignore nogroups and noroot | ||
49 | nogroups | 48 | nogroups |
50 | nonewprivs | 49 | nonewprivs |
51 | noroot | 50 | noroot |
@@ -54,9 +53,9 @@ nou2f | |||
54 | # novideo should be commented for VR | 53 | # novideo should be commented for VR |
55 | novideo | 54 | novideo |
56 | protocol unix,inet,inet6,netlink | 55 | protocol unix,inet,inet6,netlink |
57 | # seccomp cause sometimes issues (see #2860, #2951), | 56 | # seccomp cause sometimes issues (see #2951, #3267), |
58 | # comment it or add 'ignore seccomp' to steam.local if so. | 57 | # comment it or add 'ignore seccomp' to steam.local if so. |
59 | seccomp | 58 | seccomp !kcmp,!ptrace |
60 | shell none | 59 | shell none |
61 | # tracelog disabled as it breaks integrated browser | 60 | # tracelog disabled as it breaks integrated browser |
62 | #tracelog | 61 | #tracelog |
diff --git a/etc/strings.profile b/etc/strings.profile index 7dc453b1f..7d2d035a4 100644 --- a/etc/strings.profile +++ b/etc/strings.profile | |||
@@ -8,6 +8,7 @@ include strings.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | #include disable-common.inc | 13 | #include disable-common.inc |
13 | include disable-devel.inc | 14 | include disable-devel.inc |
diff --git a/etc/supertux2.profile b/etc/supertux2.profile index 4c64ee766..a702faa9e 100644 --- a/etc/supertux2.profile +++ b/etc/supertux2.profile | |||
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.local/share/supertux2 | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
@@ -19,6 +20,7 @@ whitelist ${HOME}/.local/share/supertux2 | |||
19 | include whitelist-common.inc | 20 | include whitelist-common.inc |
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
23 | apparmor | ||
22 | caps.drop all | 24 | caps.drop all |
23 | net none | 25 | net none |
24 | nodbus | 26 | nodbus |
diff --git a/etc/tcpdump.profile b/etc/tcpdump.profile index 3c46dfdcb..881fbf49e 100644 --- a/etc/tcpdump.profile +++ b/etc/tcpdump.profile | |||
@@ -19,6 +19,7 @@ include disable-xdg.inc | |||
19 | 19 | ||
20 | include whitelist-common.inc | 20 | include whitelist-common.inc |
21 | 21 | ||
22 | apparmor | ||
22 | caps.keep net_raw | 23 | caps.keep net_raw |
23 | ipc-namespace | 24 | ipc-namespace |
24 | #net tun0 | 25 | #net tun0 |
diff --git a/etc/teams.profile b/etc/teams.profile index 8b60a941e..0e5a42be7 100644 --- a/etc/teams.profile +++ b/etc/teams.profile | |||
@@ -9,6 +9,8 @@ include teams.local | |||
9 | # added by included profile | 9 | # added by included profile |
10 | #include globals.local | 10 | #include globals.local |
11 | 11 | ||
12 | ignore nodbus | ||
13 | |||
12 | noblacklist ${HOME}/.config/teams | 14 | noblacklist ${HOME}/.config/teams |
13 | noblacklist ${HOME}/.config/Microsoft | 15 | noblacklist ${HOME}/.config/Microsoft |
14 | 16 | ||
@@ -30,7 +32,6 @@ tracelog | |||
30 | disable-mnt | 32 | disable-mnt |
31 | private-cache | 33 | private-cache |
32 | private-dev | 34 | private-dev |
33 | private-tmp | ||
34 | 35 | ||
35 | # Redirect | 36 | # Redirect |
36 | include electron.profile | 37 | include electron.profile |
diff --git a/etc/templates/profile.template b/etc/templates/profile.template index 0362b82af..4cb40027c 100644 --- a/etc/templates/profile.template +++ b/etc/templates/profile.template | |||
@@ -27,6 +27,7 @@ | |||
27 | # ALLOW INCLUDES | 27 | # ALLOW INCLUDES |
28 | # BLACKLISTS | 28 | # BLACKLISTS |
29 | # DISABLE INCLUDES | 29 | # DISABLE INCLUDES |
30 | # NOWHITELISTS | ||
30 | # MKDIRS | 31 | # MKDIRS |
31 | # WHITELISTS | 32 | # WHITELISTS |
32 | # WHITELIST INCLUDES | 33 | # WHITELIST INCLUDES |
@@ -62,6 +63,8 @@ include globals.local | |||
62 | #blacklist /tmp/.X11-unix | 63 | #blacklist /tmp/.X11-unix |
63 | # Disable Wayland | 64 | # Disable Wayland |
64 | #blacklist ${RUNUSER}/wayland-* | 65 | #blacklist ${RUNUSER}/wayland-* |
66 | # Disable RUNUSER (cli only) | ||
67 | #blacklist ${RUNUSER} | ||
65 | 68 | ||
66 | # It is common practice to add files/dirs containing program-specific configuration | 69 | # It is common practice to add files/dirs containing program-specific configuration |
67 | # (often ${HOME}/PROGRAMNAME or ${HOME}/.config/PROGRAMNAME) into disable-programs.inc | 70 | # (often ${HOME}/PROGRAMNAME or ${HOME}/.config/PROGRAMNAME) into disable-programs.inc |
@@ -116,6 +119,7 @@ include globals.local | |||
116 | ##mkfile PATH | 119 | ##mkfile PATH |
117 | #whitelist PATH | 120 | #whitelist PATH |
118 | #include whitelist-common.inc | 121 | #include whitelist-common.inc |
122 | #GTK3 only: include whitelist-runuser-common.inc | ||
119 | #include whitelist-usr-share-common.inc | 123 | #include whitelist-usr-share-common.inc |
120 | #include whitelist-var-common.inc | 124 | #include whitelist-var-common.inc |
121 | 125 | ||
diff --git a/etc/terasology.profile b/etc/terasology.profile index 9a8426435..3324a18be 100644 --- a/etc/terasology.profile +++ b/etc/terasology.profile | |||
@@ -28,7 +28,6 @@ include whitelist-common.inc | |||
28 | caps.drop all | 28 | caps.drop all |
29 | ipc-namespace | 29 | ipc-namespace |
30 | net none | 30 | net none |
31 | netfilter | ||
32 | nodbus | 31 | nodbus |
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
diff --git a/etc/textmaker18.profile b/etc/textmaker18.profile index 8284df791..d28947394 100644 --- a/etc/textmaker18.profile +++ b/etc/textmaker18.profile | |||
@@ -7,4 +7,5 @@ include textmaker18.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
11 | |||
diff --git a/etc/textmaker18free.profile b/etc/textmaker18free.profile index ad945ca55..7b4fd5b08 100644 --- a/etc/textmaker18free.profile +++ b/etc/textmaker18free.profile | |||
@@ -7,4 +7,5 @@ include textmaker18free.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
11 | |||
diff --git a/etc/thunderbird.profile b/etc/thunderbird.profile index b375247f4..4193ef963 100644 --- a/etc/thunderbird.profile +++ b/etc/thunderbird.profile | |||
@@ -47,6 +47,7 @@ whitelist ${HOME}/.thunderbird | |||
47 | 47 | ||
48 | whitelist /usr/share/gnupg | 48 | whitelist /usr/share/gnupg |
49 | whitelist /usr/share/mozilla | 49 | whitelist /usr/share/mozilla |
50 | whitelist /usr/share/thunderbird | ||
50 | whitelist /usr/share/webext | 51 | whitelist /usr/share/webext |
51 | include whitelist-usr-share-common.inc | 52 | include whitelist-usr-share-common.inc |
52 | 53 | ||
diff --git a/etc/torbrowser-launcher.profile b/etc/torbrowser-launcher.profile index 72bdf9fa1..329d7be02 100644 --- a/etc/torbrowser-launcher.profile +++ b/etc/torbrowser-launcher.profile | |||
@@ -12,8 +12,8 @@ noblacklist ${HOME}/.config/torbrowser | |||
12 | noblacklist ${HOME}/.local/share/torbrowser | 12 | noblacklist ${HOME}/.local/share/torbrowser |
13 | 13 | ||
14 | # Allow python (blacklisted by disable-interpreters.inc) | 14 | # Allow python (blacklisted by disable-interpreters.inc) |
15 | include allow-python2.inc | 15 | include allow-python2.inc |
16 | include allow-python3.inc | 16 | include allow-python3.inc |
17 | 17 | ||
18 | include disable-common.inc | 18 | include disable-common.inc |
19 | include disable-devel.inc | 19 | include disable-devel.inc |
diff --git a/etc/tracker.profile b/etc/tracker.profile index d47185b1d..9030b1e01 100644 --- a/etc/tracker.profile +++ b/etc/tracker.profile | |||
@@ -17,6 +17,8 @@ include disable-interpreters.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-runuser-common.inc | ||
21 | |||
20 | caps.drop all | 22 | caps.drop all |
21 | netfilter | 23 | netfilter |
22 | no3d | 24 | no3d |
diff --git a/etc/transmission-gtk.profile b/etc/transmission-gtk.profile index 01bdeb4ef..baa970307 100644 --- a/etc/transmission-gtk.profile +++ b/etc/transmission-gtk.profile | |||
@@ -7,6 +7,8 @@ include transmission-gtk.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | include whitelist-runuser-common.inc | ||
11 | |||
10 | private-bin transmission-gtk | 12 | private-bin transmission-gtk |
11 | 13 | ||
12 | ignore memory-deny-write-execute | 14 | ignore memory-deny-write-execute |
diff --git a/etc/transmission-remote-cli.profile b/etc/transmission-remote-cli.profile index 8b3a966c1..7b9285e66 100644 --- a/etc/transmission-remote-cli.profile +++ b/etc/transmission-remote-cli.profile | |||
@@ -8,8 +8,8 @@ include transmission-remote-cli.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | # Allow python (blacklisted by disable-interpreters.inc) | 10 | # Allow python (blacklisted by disable-interpreters.inc) |
11 | include allow-python2.inc | 11 | include allow-python2.inc |
12 | include allow-python3.inc | 12 | include allow-python3.inc |
13 | 13 | ||
14 | private-bin python*,transmission-remote-cli | 14 | private-bin python*,transmission-remote-cli |
15 | 15 | ||
diff --git a/etc/ts3client_runscript.sh.profile b/etc/ts3client_runscript.sh.profile new file mode 100644 index 000000000..8d4675454 --- /dev/null +++ b/etc/ts3client_runscript.sh.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile alias for teamspeak3 | ||
2 | # Description: TeamSpeak is software for quality voice communication via the Internet | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ts3client_runscript.sh.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | ignore noexec ${HOME} | ||
11 | |||
12 | noblacklist ${HOME}/TeamSpeak3-Client-linux_x86 | ||
13 | noblacklist ${HOME}/TeamSpeak3-Client-linux_amd64 | ||
14 | |||
15 | whitelist ${HOME}/TeamSpeak3-Client-linux_x86 | ||
16 | whitelist ${HOME}/TeamSpeak3-Client-linux_amd64 | ||
17 | |||
18 | # Redirect | ||
19 | include teamspeak3.profile | ||
diff --git a/etc/tshark.profile b/etc/tshark.profile index 22ced5d8a..684a9491d 100644 --- a/etc/tshark.profile +++ b/etc/tshark.profile | |||
@@ -16,9 +16,11 @@ include disable-xdg.inc | |||
16 | 16 | ||
17 | whitelist /usr/share/wireshark | 17 | whitelist /usr/share/wireshark |
18 | include whitelist-common.inc | 18 | include whitelist-common.inc |
19 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
23 | apparmor | ||
22 | #caps.keep net_raw | 24 | #caps.keep net_raw |
23 | caps.keep dac_override,net_admin,net_raw | 25 | caps.keep dac_override,net_admin,net_raw |
24 | ipc-namespace | 26 | ipc-namespace |
diff --git a/etc/tuxguitar.profile b/etc/tuxguitar.profile index ae868a022..d2b13d9ee 100644 --- a/etc/tuxguitar.profile +++ b/etc/tuxguitar.profile | |||
@@ -15,6 +15,7 @@ include allow-java.inc | |||
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 21 | include disable-programs.inc |
@@ -22,6 +23,7 @@ include disable-xdg.inc | |||
22 | 23 | ||
23 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
24 | 25 | ||
26 | apparmor | ||
25 | caps.drop all | 27 | caps.drop all |
26 | netfilter | 28 | netfilter |
27 | no3d | 29 | no3d |
diff --git a/etc/unknown-horizons.profile b/etc/unknown-horizons.profile index 7223ea2e1..1e623f9ce 100644 --- a/etc/unknown-horizons.profile +++ b/etc/unknown-horizons.profile | |||
@@ -9,13 +9,16 @@ include globals.local | |||
9 | noblacklist ${HOME}/.unknown-horizons | 9 | noblacklist ${HOME}/.unknown-horizons |
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-exec.inc | ||
12 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
13 | include disable-programs.inc | 14 | include disable-programs.inc |
14 | 15 | ||
15 | mkdir ${HOME}/.unknown-horizons | 16 | mkdir ${HOME}/.unknown-horizons |
16 | whitelist ${HOME}/.unknown-horizons | 17 | whitelist ${HOME}/.unknown-horizons |
17 | include whitelist-common.inc | 18 | include whitelist-common.inc |
19 | include whitelist-var-common.inc | ||
18 | 20 | ||
21 | apparmor | ||
19 | caps.drop all | 22 | caps.drop all |
20 | nodvd | 23 | nodvd |
21 | nogroups | 24 | nogroups |
@@ -28,6 +31,7 @@ protocol unix,inet,inet6,netlink | |||
28 | seccomp | 31 | seccomp |
29 | shell none | 32 | shell none |
30 | 33 | ||
34 | disable-mnt | ||
31 | # private-bin unknown-horizons | 35 | # private-bin unknown-horizons |
32 | private-dev | 36 | private-dev |
33 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl | 37 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl |
diff --git a/etc/unlzma.profile b/etc/unlzma.profile index f7410b928..d9c72407f 100644 --- a/etc/unlzma.profile +++ b/etc/unlzma.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/unxz.profile b/etc/unxz.profile index f7410b928..d9c72407f 100644 --- a/etc/unxz.profile +++ b/etc/unxz.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/uzbl-browser.profile b/etc/uzbl-browser.profile index d4e54235b..41487a8f2 100644 --- a/etc/uzbl-browser.profile +++ b/etc/uzbl-browser.profile | |||
@@ -10,8 +10,8 @@ noblacklist ${HOME}/.gnupg | |||
10 | noblacklist ${HOME}/.local/share/uzbl | 10 | noblacklist ${HOME}/.local/share/uzbl |
11 | 11 | ||
12 | # Allow python (blacklisted by disable-interpreters.inc) | 12 | # Allow python (blacklisted by disable-interpreters.inc) |
13 | include allow-python2.inc | 13 | include allow-python2.inc |
14 | include allow-python3.inc | 14 | include allow-python3.inc |
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | 17 | include disable-devel.inc |
diff --git a/etc/vim.profile b/etc/vim.profile index d27a9a633..e9a474239 100644 --- a/etc/vim.profile +++ b/etc/vim.profile | |||
@@ -17,6 +17,8 @@ include disable-common.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-runuser-common.inc | ||
21 | |||
20 | caps.drop all | 22 | caps.drop all |
21 | netfilter | 23 | netfilter |
22 | nodvd | 24 | nodvd |
diff --git a/etc/w3m.profile b/etc/w3m.profile index 97465baa1..5215ee6f5 100644 --- a/etc/w3m.profile +++ b/etc/w3m.profile | |||
@@ -20,6 +20,8 @@ include disable-passwdmgr.inc | |||
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-xdg.inc | 21 | include disable-xdg.inc |
22 | 22 | ||
23 | include whitelist-runuser-common.inc | ||
24 | |||
23 | caps.drop all | 25 | caps.drop all |
24 | netfilter | 26 | netfilter |
25 | no3d | 27 | no3d |
diff --git a/etc/warmux.profile b/etc/warmux.profile new file mode 100644 index 000000000..df7af49c4 --- /dev/null +++ b/etc/warmux.profile | |||
@@ -0,0 +1,53 @@ | |||
1 | # Firejail profile for warmux | ||
2 | # Description: a convivial mass murder game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include warmux.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/wormux | ||
10 | noblacklist ${HOME}/.local/share/wormux | ||
11 | noblacklist ${HOME}/.wormux | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | mkdir ${HOME}/.config/wormux | ||
22 | mkdir ${HOME}/.local/share/wormux | ||
23 | mkdir ${HOME}/.wormux | ||
24 | whitelist ${HOME}/.config/wormux | ||
25 | whitelist ${HOME}/.local/share/wormux | ||
26 | whitelist ${HOME}/.wormux | ||
27 | whitelist /usr/share/warmux | ||
28 | include whitelist-common.inc | ||
29 | include whitelist-usr-share-common.inc | ||
30 | include whitelist-var-common.inc | ||
31 | |||
32 | apparmor | ||
33 | caps.drop all | ||
34 | netfilter | ||
35 | nodbus | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix,inet,inet6 | ||
44 | seccomp | ||
45 | shell none | ||
46 | tracelog | ||
47 | |||
48 | disable-mnt | ||
49 | private-bin warmux | ||
50 | private-cache | ||
51 | private-dev | ||
52 | private-etc ca-certificates,crypto-policies,host.conf,hostname,hosts,machine-id,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | ||
53 | private-tmp | ||
diff --git a/etc/warzone2100.profile b/etc/warzone2100.profile index e65e0a0c3..e33cace49 100644 --- a/etc/warzone2100.profile +++ b/etc/warzone2100.profile | |||
@@ -22,6 +22,7 @@ whitelist ${HOME}/.warzone2100-3.2 | |||
22 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
24 | 24 | ||
25 | apparmor | ||
25 | caps.drop all | 26 | caps.drop all |
26 | netfilter | 27 | netfilter |
27 | nodvd | 28 | nodvd |
diff --git a/etc/wget.profile b/etc/wget.profile index 401926e2d..ad7a14c41 100644 --- a/etc/wget.profile +++ b/etc/wget.profile | |||
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.wgetrc | |||
13 | 13 | ||
14 | blacklist /tmp/.X11-unix | 14 | blacklist /tmp/.X11-unix |
15 | blacklist ${RUNUSER}/wayland-* | 15 | blacklist ${RUNUSER}/wayland-* |
16 | blacklist ${RUNUSER} | ||
16 | 17 | ||
17 | include disable-common.inc | 18 | include disable-common.inc |
18 | include disable-devel.inc | 19 | include disable-devel.inc |
@@ -26,6 +27,7 @@ include disable-programs.inc | |||
26 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
28 | 29 | ||
30 | apparmor | ||
29 | caps.drop all | 31 | caps.drop all |
30 | ipc-namespace | 32 | ipc-namespace |
31 | machine-id | 33 | machine-id |
diff --git a/etc/whitelist-runuser-common.inc b/etc/whitelist-runuser-common.inc new file mode 100644 index 000000000..de59d03d3 --- /dev/null +++ b/etc/whitelist-runuser-common.inc | |||
@@ -0,0 +1,10 @@ | |||
1 | # Local customizations come here | ||
2 | include whitelist-runuser-common.local | ||
3 | |||
4 | # common ${RUNUSER} (=/run/user/$UID) whitelist for all profiles | ||
5 | |||
6 | whitelist ${RUNUSER}/bus | ||
7 | whitelist ${RUNUSER}/dconf | ||
8 | whitelist ${RUNUSER}/gdm/Xauthority | ||
9 | whitelist ${RUNUSER}/pulse/native | ||
10 | whitelist ${RUNUSER}/wayland-0 | ||
diff --git a/etc/whitelist-usr-share-common.inc b/etc/whitelist-usr-share-common.inc index a9d4cadb8..8a0f6774a 100644 --- a/etc/whitelist-usr-share-common.inc +++ b/etc/whitelist-usr-share-common.inc | |||
@@ -22,6 +22,7 @@ whitelist /usr/share/glib-2.0 | |||
22 | whitelist /usr/share/glvnd | 22 | whitelist /usr/share/glvnd |
23 | whitelist /usr/share/gtk-2.0 | 23 | whitelist /usr/share/gtk-2.0 |
24 | whitelist /usr/share/gtk-3.0 | 24 | whitelist /usr/share/gtk-3.0 |
25 | whitelist /usr/share/gtk-engines | ||
25 | whitelist /usr/share/gtksourceview-3.0 | 26 | whitelist /usr/share/gtksourceview-3.0 |
26 | whitelist /usr/share/gtksourceview-4 | 27 | whitelist /usr/share/gtksourceview-4 |
27 | whitelist /usr/share/hunspell | 28 | whitelist /usr/share/hunspell |
diff --git a/etc/whois.profile b/etc/whois.profile index 0e60e18ab..5fea610d8 100644 --- a/etc/whois.profile +++ b/etc/whois.profile | |||
@@ -9,6 +9,7 @@ include globals.local | |||
9 | 9 | ||
10 | blacklist /tmp/.X11-unix | 10 | blacklist /tmp/.X11-unix |
11 | blacklist ${RUNUSER}/wayland-* | 11 | blacklist ${RUNUSER}/wayland-* |
12 | blacklist ${RUNUSER} | ||
12 | 13 | ||
13 | include disable-common.inc | 14 | include disable-common.inc |
14 | include disable-devel.inc | 15 | include disable-devel.inc |
@@ -21,6 +22,7 @@ include disable-xdg.inc | |||
21 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
25 | apparmor | ||
24 | caps.drop all | 26 | caps.drop all |
25 | hostname whois | 27 | hostname whois |
26 | ipc-namespace | 28 | ipc-namespace |
diff --git a/etc/widelands.profile b/etc/widelands.profile index c6b5f27da..dd956fa28 100644 --- a/etc/widelands.profile +++ b/etc/widelands.profile | |||
@@ -21,6 +21,7 @@ whitelist ${HOME}/.widelands | |||
21 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | apparmor | ||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | netfilter | 27 | netfilter |
diff --git a/etc/wire-desktop.profile b/etc/wire-desktop.profile index 3c783322b..e199be02c 100644 --- a/etc/wire-desktop.profile +++ b/etc/wire-desktop.profile | |||
@@ -26,7 +26,7 @@ nou2f | |||
26 | shell none | 26 | shell none |
27 | 27 | ||
28 | disable-mnt | 28 | disable-mnt |
29 | private-bin bash,electron,electron4,env,sh,wire-desktop | 29 | private-bin bash,electron,electron4,electron6,env,sh,wire-desktop |
30 | private-dev | 30 | private-dev |
31 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl | 31 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl |
32 | private-tmp | 32 | private-tmp |
diff --git a/etc/x-terminal-emulator.profile b/etc/x-terminal-emulator.profile index e21b74030..b6424f342 100644 --- a/etc/x-terminal-emulator.profile +++ b/etc/x-terminal-emulator.profile | |||
@@ -8,7 +8,6 @@ include globals.local | |||
8 | caps.drop all | 8 | caps.drop all |
9 | ipc-namespace | 9 | ipc-namespace |
10 | net none | 10 | net none |
11 | netfilter | ||
12 | nodbus | 11 | nodbus |
13 | nogroups | 12 | nogroups |
14 | noroot | 13 | noroot |
diff --git a/etc/x2goclient.profile b/etc/x2goclient.profile new file mode 100644 index 000000000..bb0535ae6 --- /dev/null +++ b/etc/x2goclient.profile | |||
@@ -0,0 +1,47 @@ | |||
1 | # Firejail profile for x2goclient | ||
2 | # Description: Graphical client for X2Go remote desktop system | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include x2goclient.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.ssh | ||
10 | noblacklist ${HOME}/.x2go | ||
11 | noblacklist ${HOME}/.x2goclient | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | |||
20 | apparmor | ||
21 | caps.drop all | ||
22 | ipc-namespace | ||
23 | netfilter | ||
24 | #no3d | ||
25 | nodbus | ||
26 | nodvd | ||
27 | nogroups | ||
28 | nonewprivs | ||
29 | noroot | ||
30 | notv | ||
31 | nou2f | ||
32 | novideo | ||
33 | protocol unix,inet,inet6 | ||
34 | seccomp | ||
35 | shell none | ||
36 | tracelog | ||
37 | |||
38 | #private-bin nxproxy,x2goclient | ||
39 | private-cache | ||
40 | private-dev | ||
41 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,X11,xdg | ||
42 | #private-lib | ||
43 | private-opt none | ||
44 | private-srv none | ||
45 | private-tmp | ||
46 | |||
47 | #memory-deny-write-execute | ||
diff --git a/etc/xcalc.profile b/etc/xcalc.profile index 0ad423d30..a644af351 100644 --- a/etc/xcalc.profile +++ b/etc/xcalc.profile | |||
@@ -15,9 +15,9 @@ include disable-xdg.inc | |||
15 | 15 | ||
16 | include whitelist-var-common.inc | 16 | include whitelist-var-common.inc |
17 | 17 | ||
18 | apparmor | ||
18 | caps.drop all | 19 | caps.drop all |
19 | net none | 20 | net none |
20 | netfilter | ||
21 | no3d | 21 | no3d |
22 | nodbus | 22 | nodbus |
23 | nodvd | 23 | nodvd |
diff --git a/etc/xed.profile b/etc/xed.profile index a67230e51..145dd988e 100644 --- a/etc/xed.profile +++ b/etc/xed.profile | |||
@@ -11,8 +11,8 @@ noblacklist ${HOME}/.python_history | |||
11 | noblacklist ${HOME}/.pythonhist | 11 | noblacklist ${HOME}/.pythonhist |
12 | 12 | ||
13 | # Allow python (blacklisted by disable-interpreters.inc) | 13 | # Allow python (blacklisted by disable-interpreters.inc) |
14 | include allow-python2.inc | 14 | include allow-python2.inc |
15 | include allow-python3.inc | 15 | include allow-python3.inc |
16 | 16 | ||
17 | include disable-common.inc | 17 | include disable-common.inc |
18 | include disable-devel.inc | 18 | include disable-devel.inc |
diff --git a/etc/xfce4-dict.profile b/etc/xfce4-dict.profile index bc499bd30..a3e0c4633 100644 --- a/etc/xfce4-dict.profile +++ b/etc/xfce4-dict.profile | |||
@@ -15,6 +15,9 @@ include disable-interpreters.inc | |||
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | 17 | ||
18 | include whitelist-var-common.inc | ||
19 | |||
20 | apparmor | ||
18 | caps.drop all | 21 | caps.drop all |
19 | netfilter | 22 | netfilter |
20 | no3d | 23 | no3d |
diff --git a/etc/xfce4-notes.profile b/etc/xfce4-notes.profile index 4dad1bf7a..c3d0930ff 100644 --- a/etc/xfce4-notes.profile +++ b/etc/xfce4-notes.profile | |||
@@ -17,6 +17,9 @@ include disable-interpreters.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
20 | caps.drop all | 23 | caps.drop all |
21 | netfilter | 24 | netfilter |
22 | no3d | 25 | no3d |
diff --git a/etc/xpdf.profile b/etc/xpdf.profile index 8c405ba1d..cb7ac4a59 100644 --- a/etc/xpdf.profile +++ b/etc/xpdf.profile | |||
@@ -19,6 +19,7 @@ include disable-xdg.inc | |||
19 | 19 | ||
20 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
21 | 21 | ||
22 | apparmor | ||
22 | caps.drop all | 23 | caps.drop all |
23 | machine-id | 24 | machine-id |
24 | net none | 25 | net none |
@@ -38,4 +39,4 @@ shell none | |||
38 | 39 | ||
39 | private-dev | 40 | private-dev |
40 | private-tmp | 41 | private-tmp |
41 | 42 | memory-deny-write-execute | |
diff --git a/etc/xplayer.profile b/etc/xplayer.profile index 325ce7627..7c474da41 100644 --- a/etc/xplayer.profile +++ b/etc/xplayer.profile | |||
@@ -11,8 +11,8 @@ noblacklist ${MUSIC} | |||
11 | noblacklist ${VIDEOS} | 11 | noblacklist ${VIDEOS} |
12 | 12 | ||
13 | # Allow python (blacklisted by disable-interpreters.inc) | 13 | # Allow python (blacklisted by disable-interpreters.inc) |
14 | include allow-python2.inc | 14 | include allow-python2.inc |
15 | include allow-python3.inc | 15 | include allow-python3.inc |
16 | 16 | ||
17 | include disable-common.inc | 17 | include disable-common.inc |
18 | include disable-devel.inc | 18 | include disable-devel.inc |
diff --git a/etc/xxd.profile b/etc/xxd.profile index 569f194d3..864e8ce9c 100644 --- a/etc/xxd.profile +++ b/etc/xxd.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for xxd | 1 | # Firejail profile for xxd |
2 | # Description: Tool to make (or reverse) a hex dump | 2 | # Description: Tool to make (or reverse) a hex dump |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include xxd.local | 6 | include xxd.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
@@ -8,4 +9,4 @@ include xxd.local | |||
8 | #include globals.local | 9 | #include globals.local |
9 | 10 | ||
10 | # Redirect | 11 | # Redirect |
11 | include vim.profile | 12 | include cpio.profile |
diff --git a/etc/xz.profile b/etc/xz.profile index f7410b928..d9c72407f 100644 --- a/etc/xz.profile +++ b/etc/xz.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzcat.profile b/etc/xzcat.profile index f7410b928..d9c72407f 100644 --- a/etc/xzcat.profile +++ b/etc/xzcat.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzcmp.profile b/etc/xzcmp.profile index f7410b928..d9c72407f 100644 --- a/etc/xzcmp.profile +++ b/etc/xzcmp.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzdiff.profile b/etc/xzdiff.profile index f7410b928..d9c72407f 100644 --- a/etc/xzdiff.profile +++ b/etc/xzdiff.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzegrep.profile b/etc/xzegrep.profile index f7410b928..d9c72407f 100644 --- a/etc/xzegrep.profile +++ b/etc/xzegrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzfgrep.profile b/etc/xzfgrep.profile index f7410b928..d9c72407f 100644 --- a/etc/xzfgrep.profile +++ b/etc/xzfgrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzmore.profile b/etc/xzmore.profile index f7410b928..d9c72407f 100644 --- a/etc/xzmore.profile +++ b/etc/xzmore.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/yelp.profile b/etc/yelp.profile index acd483209..7053f98e8 100644 --- a/etc/yelp.profile +++ b/etc/yelp.profile | |||
@@ -23,6 +23,7 @@ whitelist /usr/share/help | |||
23 | whitelist /usr/share/yelp | 23 | whitelist /usr/share/yelp |
24 | whitelist /usr/share/yelp-xsl | 24 | whitelist /usr/share/yelp-xsl |
25 | include whitelist-common.inc | 25 | include whitelist-common.inc |
26 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
28 | 29 | ||
diff --git a/etc/youtube-dl.profile b/etc/youtube-dl.profile index 19effef47..6066313a3 100644 --- a/etc/youtube-dl.profile +++ b/etc/youtube-dl.profile | |||
@@ -22,6 +22,7 @@ include allow-python3.inc | |||
22 | 22 | ||
23 | blacklist /tmp/.X11-unix | 23 | blacklist /tmp/.X11-unix |
24 | blacklist ${RUNUSER}/wayland-* | 24 | blacklist ${RUNUSER}/wayland-* |
25 | blacklist ${RUNUSER} | ||
25 | 26 | ||
26 | include disable-common.inc | 27 | include disable-common.inc |
27 | include disable-devel.inc | 28 | include disable-devel.inc |
diff --git a/etc/zathura.profile b/etc/zathura.profile index 703c8edd4..9ca5fd862 100644 --- a/etc/zathura.profile +++ b/etc/zathura.profile | |||
@@ -25,6 +25,7 @@ whitelist /usr/share/zathura | |||
25 | include whitelist-usr-share-common.inc | 25 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
27 | 27 | ||
28 | apparmor | ||
28 | caps.drop all | 29 | caps.drop all |
29 | ipc-namespace | 30 | ipc-namespace |
30 | machine-id | 31 | machine-id |
@@ -47,7 +48,8 @@ private-bin zathura | |||
47 | private-cache | 48 | private-cache |
48 | private-dev | 49 | private-dev |
49 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id | 50 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id |
50 | private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,libarchive.so.*,libdjvulibre.so.*,libgirara-gtk*,libpoppler-glib.so.*,libspectre.so.*,zathura | 51 | # private-lib has problems on Debian 10 |
52 | #private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,libarchive.so.*,libdjvulibre.so.*,libgirara-gtk*,libpoppler-glib.so.*,libspectre.so.*,zathura | ||
51 | private-tmp | 53 | private-tmp |
52 | 54 | ||
53 | read-only ${HOME} | 55 | read-only ${HOME} |
diff --git a/etc/zoom.profile b/etc/zoom.profile index 6d312aff6..6eac10703 100644 --- a/etc/zoom.profile +++ b/etc/zoom.profile | |||
@@ -27,7 +27,7 @@ nodvd | |||
27 | nonewprivs | 27 | nonewprivs |
28 | noroot | 28 | noroot |
29 | notv | 29 | notv |
30 | protocol unix,inet,inet6 | 30 | protocol unix,inet,inet6,netlink |
31 | seccomp | 31 | seccomp !chroot |
32 | 32 | ||
33 | private-tmp | 33 | private-tmp |