16 files changed, 177 insertions, 8 deletions

diff --git a/etc/arch-audit.profile b/etc/arch-audit.profile
new file mode 100644
index 000000000..d8ed64811
--- /dev/null
+++ b/etc/arch-audit.profile
@@ -0,0 +1,40 @@
+# Firejail profile for arch-audit
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include /etc/firejail/arch-audit.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist /var/lib/pacman
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+disable-mnt
+private
+private-bin arch-audit
+private-dev
+private-tmp
+
+memory-deny-write-execute
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/audacious.profile b/etc/audacious.profile
index bd2367fe0..52e701821 100644
--- a/etc/audacious.profile
+++ b/etc/audacious.profile
@@ -15,6 +15,7 @@ include /etc/firejail/disable-programs.inc
 
 caps.drop all
 netfilter
+nogroups
 nonewprivs
 noroot
 notv
diff --git a/etc/conky.profile b/etc/conky.profile
new file mode 100644
index 000000000..4ee25f099
--- /dev/null
+++ b/etc/conky.profile
@@ -0,0 +1,35 @@
+# Firejail profile for conky
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/conky.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+disable-mnt
+private-dev
+private-tmp
+
+memory-deny-write-execute
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/corebird.profile b/etc/corebird.profile
index 87f7a970b..99a3335ef 100644
--- a/etc/corebird.profile
+++ b/etc/corebird.profile
@@ -5,16 +5,30 @@ include /etc/firejail/corebird.local
 # Persistent global definitions
 include /etc/firejail/globals.local
 
+noblacklist ~/.config/corebird
 
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+include /etc/firejail/whitelist-var-common.inc
+
 caps.drop all
 netfilter
 nodvd
+nogroups
+nonewprivs
 noroot
 notv
+novideo
 protocol unix,inet,inet6
 seccomp
+shell none
+
+private-bin corebird
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index ca6ba9710..abce0fe57 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -2,15 +2,14 @@
 # Persistent customizations should go in a .local file.
 include /etc/firejail/disable-common.local
 
-# History files and clipboard managers in $HOME
+# History files in $HOME and clipboard managers
 blacklist-nolog ${HOME}/.*_history
 blacklist-nolog ${HOME}/.adobe
-blacklist-nolog ${HOME}/.bash_history
+blacklist-nolog ${HOME}/.cache/greenclip*
 blacklist-nolog ${HOME}/.history
 blacklist-nolog ${HOME}/.local/share/fish/fish_history
 blacklist-nolog ${HOME}/.macromedia
-blacklist-nolog /tmp/clipmenu*   
-blacklist-nolog ${HOME}/.cache/greenclip*
+blacklist-nolog /tmp/clipmenu*
 
 # X11 session autostart
 # blacklist ${HOME}/.xpra - this will kill --x11=xpra cmdline option for all programs
@@ -229,7 +228,6 @@ blacklist ${HOME}/.mutt/muttrc
 blacklist ${HOME}/.muttrc
 blacklist ${HOME}/.netrc
 blacklist ${HOME}/.pki
-blacklist ${HOME}/.password-store
 blacklist ${HOME}/.smbcredentials
 blacklist ${HOME}/.ssh
 blacklist /etc/group+
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 88b7e7d32..615e28172 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -82,6 +82,7 @@ blacklist ${HOME}/.config/chromium-dev
 blacklist ${HOME}/.config/chromium-flags.conf
 blacklist ${HOME}/.config/clipit
 blacklist ${HOME}/.config/cmus
+blacklist ${HOME}/.config/corebird
 blacklist ${HOME}/.config/darktable
 blacklist ${HOME}/.config/deadbeef
 blacklist ${HOME}/.config/deluge
diff --git a/etc/ffmpeg.profile b/etc/ffmpeg.profile
new file mode 100644
index 000000000..e098c95e3
--- /dev/null
+++ b/etc/ffmpeg.profile
@@ -0,0 +1,33 @@
+# Firejail profile for default
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include /etc/firejail/ffmpeg.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+net none
+no3d
+nodvd
+nosound
+notv
+novideo
+nonewprivs
+noroot
+# protocol none - needs to be implemented!
+seccomp
+# seccomp.keep futex,write,read,munmap,fstat,mprotect,mmap,open,close,stat,lseek,brk,rt_sigaction,rt_sigprocmask,ioctl,access,select,madvise,getpid,clone,execve,fcntl,getdents,readlink,getrlimit,getrusage,statfs,getpriority,setpriority,arch_prctl,sched_getaffinity,set_tid_address,set_robust_list,getrandom
+# memory-deny-write-execute - it breaks old versions of ffmpeg
+shell none
+tracelog
+
+private-tmp
+private-dev
+private-bin ffmpeg
+include /etc/firejail/whitelist-var-common.inc
diff --git a/etc/firefox.profile b/etc/firefox.profile
index f65b020a9..1f4a8e3f6 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -73,7 +73,8 @@ seccomp
 shell none
 tracelog
 
-# private-bin firefox,which,sh,dbus-launch,dbus-send,env
+# firefox requires a shell to launch on Arch. We can possibly remove sh though.
+# private-bin firefox,which,sh,dbus-launch,dbus-send,env,sh,bash
 private-dev
 # private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
 private-tmp
diff --git a/etc/geary.profile b/etc/geary.profile
index 7878154a6..3ab4a21d8 100644
--- a/etc/geary.profile
+++ b/etc/geary.profile
@@ -14,7 +14,6 @@ noblacklist ~/.local/share/geary
 mkdir ~/.gnupg
 mkdir ~/.local/share/geary
 whitelist ~/.gnupg
-whitelist ~/.local/share/applications
 whitelist ~/.local/share/geary
 include /etc/firejail/whitelist-common.inc
 
diff --git a/etc/musescore.profile b/etc/musescore.profile
index 3b5a0b13c..b039d07b2 100644
--- a/etc/musescore.profile
+++ b/etc/musescore.profile
@@ -19,6 +19,7 @@ caps.drop all
 netfilter
 no3d
 nodvd
+nogroups
 nonewprivs
 noroot
 notv
diff --git a/etc/quiterss.profile b/etc/quiterss.profile
index 96fe04e83..f820b590e 100644
--- a/etc/quiterss.profile
+++ b/etc/quiterss.profile
@@ -23,6 +23,7 @@ whitelist ${HOME}/.cache/QuiteRss
 whitelist ${HOME}/.config/QuiteRss/
 whitelist ${HOME}/.config/QuiteRssrc
 whitelist ${HOME}/.local/share/data/QuiteRss
+whitelist ${HOME}/.local/share/QuiteRss
 whitelist ${HOME}/quiterssfeeds.opml
 include /etc/firejail/whitelist-common.inc
 
diff --git a/etc/smtube.profile b/etc/smtube.profile
new file mode 100644
index 000000000..2694dd5b0
--- /dev/null
+++ b/etc/smtube.profile
@@ -0,0 +1,37 @@
+# Firejail profile for smtube
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/smtube.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+noblacklist ${HOME}/.config/smplayer
+noblacklist ${HOME}/.config/smtube
+noblacklist ${HOME}/.config/mpv
+noblacklist ${HOME}/.mplayer
+noblacklist ${HOME}/.config/vlc
+noblacklist ${HOME}/.local/share/vlc
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+
+caps.drop all
+netfilter
+nodvd
+notv
+novideo
+nogroups
+nonewprivs
+noroot
+protocol unix,inet,inet6,netlink
+seccomp
+shell none
+
+#no private-bin because users can add their own players to smtube and that would prevent that
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/thunderbird.profile b/etc/thunderbird.profile
index 17bf51873..8e878eb1c 100644
--- a/etc/thunderbird.profile
+++ b/etc/thunderbird.profile
@@ -20,7 +20,6 @@ mkdir ~/.thunderbird
 whitelist ~/.cache/thunderbird
 whitelist ~/.gnupg
 whitelist ~/.icedove
-whitelist ~/.local/share/applications
 whitelist ~/.thunderbird
 include /etc/firejail/whitelist-common.inc
 
diff --git a/etc/tuxguitar.profile b/etc/tuxguitar.profile
index 5b6a257f6..fbc198cc3 100644
--- a/etc/tuxguitar.profile
+++ b/etc/tuxguitar.profile
@@ -17,6 +17,7 @@ caps.drop all
 netfilter
 no3d
 nodvd
+nogroups
 nonewprivs
 noroot
 notv
diff --git a/etc/whitelist-common.inc b/etc/whitelist-common.inc
index ef95a7e5e..310149ecd 100644
--- a/etc/whitelist-common.inc
+++ b/etc/whitelist-common.inc
@@ -35,10 +35,14 @@ whitelist ~/.gtkrc-2.0
 whitelist ~/.gtk-2.0
 whitelist ~/.config/gtk-2.0
 whitelist ~/.config/gtk-3.0
+whitelist ~/.config/gtkrc
+whitelist ~/.config/gtkrc-2.0
 whitelist ~/.themes
 whitelist ~/.local/share/themes
 whitelist ~/.kde/share/config/gtkrc
 whitelist ~/.kde/share/config/gtkrc-2.0
+whitelist ~/.kde4/share/config/gtkrc
+whitelist ~/.kde4/share/config/gtkrc-2.0
 whitelist ~/.gnome2
 whitelist ~/.gnome2-private
 
@@ -51,3 +55,6 @@ whitelist ~/.config/kdeglobals
 whitelist ~/.kde/share/config/oxygenrc
 whitelist ~/.kde/share/config/kdeglobals
 whitelist ~/.kde/share/icons
+whitelist ~/.kde4/share/config/oxygenrc
+whitelist ~/.kde4/share/config/kdeglobals
+whitelist ~/.kde4/share/icons
diff --git a/etc/whitelist-var-common.inc b/etc/whitelist-var-common.inc
index bd3473acc..024995f20 100644
--- a/etc/whitelist-var-common.inc
+++ b/etc/whitelist-var-common.inc
@@ -8,3 +8,4 @@ whitelist /var/lib/menu-xdg
 whitelist /var/cache/fontconfig
 whitelist /var/tmp
 whitelist /var/run
+whitelist /var/lock