5 files changed, 26 insertions, 18 deletions

diff --git a/etc/dig.profile b/etc/dig.profile
index e609105b4..af71ff17f 100644
--- a/etc/dig.profile
+++ b/etc/dig.profile
@@ -46,7 +46,8 @@ private
 private-bin bash,dig,sh
 private-cache
 private-dev
-private-lib
+# Uncomment the next line (or put 'private-lib' in your dig.local) on non Debian/Ubuntu OS (see issue #3038)
+#private-lib
 private-tmp
 
 memory-deny-write-execute
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index 96957eeaf..b2837b443 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -315,6 +315,7 @@ blacklist ${HOME}/.config/keybase
 blacklist ${HOME}/.davfs2/secrets
 blacklist ${HOME}/.ecryptfs
 blacklist ${HOME}/.fetchmailrc
+blacklist ${HOME}/.fscrypt
 blacklist ${HOME}/.git-credential-cache
 blacklist ${HOME}/.git-credentials
 blacklist ${HOME}/.gnome2/keyrings
@@ -335,6 +336,7 @@ blacklist ${HOME}/.local/share/pki
 blacklist ${HOME}/.smbcredentials
 blacklist ${HOME}/.ssh
 blacklist ${HOME}/.vaults
+blacklist /.fscrypt
 blacklist /etc/davfs2/secrets
 blacklist /etc/group+
 blacklist /etc/group-
@@ -348,6 +350,7 @@ blacklist /etc/shadow+
 blacklist /etc/shadow-
 blacklist /etc/ssh
 blacklist /home/.ecryptfs
+blacklist /home/.fscrypt
 blacklist /var/backup
 
 # cloud provider configuration
diff --git a/etc/firejail-default b/etc/firejail-default
index e7831e145..a012f5440 100644
--- a/etc/firejail-default
+++ b/etc/firejail-default
@@ -22,12 +22,11 @@ dbus,
 
 ##########
 # With ptrace it is possible to inspect and hijack running programs.
-# Some browsers are also using ptrace for their sandboxing.
 ##########
 # Uncomment this line to allow all ptrace access
 #ptrace,
 # Allow obtaining some process information, but not ptrace(2)
-ptrace (read,readby) peer=firejail-default,
+ptrace (read,readby) peer=@{profile_name},
 
 ##########
 # Allow read access to whole filesystem and control it from firejail.
@@ -46,9 +45,6 @@ ptrace (read,readby) peer=firejail-default,
 ##########
 owner /{,run/firejail/mnt/oroot/}{,var/}run/firejail/mnt/trace w,
 owner /{,run/firejail/mnt/oroot/}{,var/}run/user/[0-9]*/** w,
-owner /{,run/firejail/mnt/oroot/}{,var/}run/user/[0-9]*/*.slave-socket w,
-owner /{,run/firejail/mnt/oroot/}{,var/}run/user/[0-9]*/orcexec.* w,
-
 owner /{,run/firejail/mnt/oroot/}{run,dev}/shm/** w,
 
 # Allow writing to removable media
@@ -58,9 +54,6 @@ owner /{,var/}run/media/** w,
 /{,var/}run/systemd/journal/socket w,
 /{,var/}run/systemd/journal/dev-log w,
 
-# Needed for wine
-/{,var/}run/firejail/profile/@{PID} w,
-
 # Allow access to cups printing socket.
 /{,var/}run/cups/cups.sock w,
 
@@ -94,8 +87,10 @@ deny /proc/@{PID}/oom_score_adj w,
 ##########
 # Blacklist specific sensitive paths.
 ##########
-# Common backup directory
-deny /**/.snapshots/ rwx,
+deny /**/.fscrypt/ rw,
+deny /**/.fscrypt/** rwklmx,
+deny /**/.snapshots/ rw,
+deny /**/.snapshots/** rwklmx,
 
 ##########
 # Allow all networking functionality, and control it from Firejail.
@@ -111,7 +106,8 @@ network packet,
 ##########
 # There is no equivalent in Firejail for filtering signals.
 ##########
-signal,
+signal (send) peer=@{profile_name},
+signal (receive),
 
 ##########
 # We let Firejail deal with capabilities, but ensure that
diff --git a/etc/k3b.profile b/etc/k3b.profile
index 60da458ab..0c1da7ae1 100644
--- a/etc/k3b.profile
+++ b/etc/k3b.profile
@@ -20,17 +20,18 @@ include disable-xdg.inc
 
 include whitelist-var-common.inc
 
-caps.drop all
+caps.keep ipc_lock,sys_nice,sys_rawio,sys_resource
+# net none
 netfilter
 no3d
-nonewprivs
-noroot
+# nonewprivs - breaks privileged helpers
+# noroot - breaks privileged helpers
 nosound
 notv
 novideo
-protocol unix
-seccomp
+# protocol unix - breaks privileged helpers
+# seccomp - breaks privileged helpers
 shell none
-tracelog
 
+private-dev
 # private-tmp
diff --git a/etc/wine.profile b/etc/wine.profile
index 192c375cd..29e79c3f5 100644
--- a/etc/wine.profile
+++ b/etc/wine.profile
@@ -15,13 +15,20 @@ noblacklist ${HOME}/.wine
 include disable-common.inc
 include disable-devel.inc
 include disable-interpreters.inc
+include disable-passwdmgr.inc
 include disable-programs.inc
 
+# uncomment next line if seccomp breaks a program
+# allow-debuggers
 caps.drop all
+# net none
 netfilter
 nodvd
 nogroups
 nonewprivs
 noroot
 notv
+# novideo
 seccomp
+
+private-dev