diff options
Diffstat (limited to 'etc')
-rw-r--r-- | etc/inc/disable-programs.inc | 4 | ||||
-rw-r--r-- | etc/profile-m-z/newsbeuter.profile | 18 | ||||
-rw-r--r-- | etc/profile-m-z/newsboat.profile | 14 | ||||
-rw-r--r-- | etc/profile-m-z/telegram.profile | 10 | ||||
-rw-r--r-- | etc/profile-m-z/virtualbox.profile | 1 | ||||
-rw-r--r-- | etc/profile-m-z/youtube-dl-gui.profile | 56 | ||||
-rw-r--r-- | etc/templates/profile.template | 2 |
7 files changed, 99 insertions, 6 deletions
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 06b8cfb6d..7a37c9fb4 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -334,6 +334,7 @@ blacklist ${HOME}/.config/nemo | |||
334 | blacklist ${HOME}/.config/neomutt | 334 | blacklist ${HOME}/.config/neomutt |
335 | blacklist ${HOME}/.config/netsurf | 335 | blacklist ${HOME}/.config/netsurf |
336 | blacklist ${HOME}/.config/newsbeuter | 336 | blacklist ${HOME}/.config/newsbeuter |
337 | blacklist ${HOME}/.config/newsboat | ||
337 | blacklist ${HOME}/.config/newsflash | 338 | blacklist ${HOME}/.config/newsflash |
338 | blacklist ${HOME}/.config/nheko | 339 | blacklist ${HOME}/.config/nheko |
339 | blacklist ${HOME}/.config/NitroShare | 340 | blacklist ${HOME}/.config/NitroShare |
@@ -437,6 +438,7 @@ blacklist ${HOME}/.config/yandex-browser | |||
437 | blacklist ${HOME}/.config/yandex-browser-beta | 438 | blacklist ${HOME}/.config/yandex-browser-beta |
438 | blacklist ${HOME}/.config/yelp | 439 | blacklist ${HOME}/.config/yelp |
439 | blacklist ${HOME}/.config/youtube-dl | 440 | blacklist ${HOME}/.config/youtube-dl |
441 | blacklist ${HOME}/.config/youtube-dlg | ||
440 | blacklist ${HOME}/.config/youtubemusic-nativefier-040164 | 442 | blacklist ${HOME}/.config/youtubemusic-nativefier-040164 |
441 | blacklist ${HOME}/.config/youtube-music-desktop-app | 443 | blacklist ${HOME}/.config/youtube-music-desktop-app |
442 | blacklist ${HOME}/.config/youtube-viewer | 444 | blacklist ${HOME}/.config/youtube-viewer |
@@ -702,6 +704,8 @@ blacklist ${HOME}/.local/share/nautilus-python | |||
702 | blacklist ${HOME}/.local/share/nemo | 704 | blacklist ${HOME}/.local/share/nemo |
703 | blacklist ${HOME}/.local/share/nemo-python | 705 | blacklist ${HOME}/.local/share/nemo-python |
704 | blacklist ${HOME}/.local/share/news-flash | 706 | blacklist ${HOME}/.local/share/news-flash |
707 | blacklist ${HOME}/.local/share/newsbeuter | ||
708 | blacklist ${HOME}/.local/share/newsboat | ||
705 | blacklist ${HOME}/.local/share/nomacs | 709 | blacklist ${HOME}/.local/share/nomacs |
706 | blacklist ${HOME}/.local/share/notes | 710 | blacklist ${HOME}/.local/share/notes |
707 | blacklist ${HOME}/.local/share/ocenaudio | 711 | blacklist ${HOME}/.local/share/ocenaudio |
diff --git a/etc/profile-m-z/newsbeuter.profile b/etc/profile-m-z/newsbeuter.profile index 85581a2f0..6efb19502 100644 --- a/etc/profile-m-z/newsbeuter.profile +++ b/etc/profile-m-z/newsbeuter.profile | |||
@@ -7,13 +7,23 @@ include newsbeuter.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | noblacklist ${HOME}/.config/newsbeuter | 10 | ignore include newsboat.local |
11 | noblacklist ${HOME}/.newsbeuter | 11 | ignore mkdir ${HOME}/.config/newsboat |
12 | ignore mkdir ${HOME}/.local/share/newsboat | ||
13 | ignore mkdir ${HOME}/.newsboat | ||
14 | blacklist ${PATH}/newsboat | ||
15 | |||
16 | blacklist ${HOME}/.config/newsboat | ||
17 | blacklist ${HOME}/.local/share/newsboat | ||
18 | blacklist ${HOME}/.newsboat | ||
19 | |||
20 | nowhitelist ${HOME}/.config/newsboat | ||
21 | nowhitelist ${HOME}/.local/share/newsboat | ||
22 | nowhitelist ${HOME}/.newsboat | ||
12 | 23 | ||
13 | mkdir ${HOME}/.config/newsbeuter | 24 | mkdir ${HOME}/.config/newsbeuter |
25 | mkdir ${HOME}/.local/share/newsbeuter | ||
14 | mkdir ${HOME}/.newsbeuter | 26 | mkdir ${HOME}/.newsbeuter |
15 | whitelist ${HOME}/.config/newsbeuter | ||
16 | whitelist ${HOME}/.newsbeuter | ||
17 | 27 | ||
18 | private-bin newsbeuter | 28 | private-bin newsbeuter |
19 | 29 | ||
diff --git a/etc/profile-m-z/newsboat.profile b/etc/profile-m-z/newsboat.profile index 85b780ced..23c2de43c 100644 --- a/etc/profile-m-z/newsboat.profile +++ b/etc/profile-m-z/newsboat.profile | |||
@@ -6,6 +6,11 @@ include newsboat.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.config/newsbeuter | ||
10 | noblacklist ${HOME}/.config/newsboat | ||
11 | noblacklist ${HOME}/.local/share/newsbeuter | ||
12 | noblacklist ${HOME}/.local/share/newsboat | ||
13 | noblacklist ${HOME}/.newsbeuter | ||
9 | noblacklist ${HOME}/.newsboat | 14 | noblacklist ${HOME}/.newsboat |
10 | 15 | ||
11 | include disable-common.inc | 16 | include disable-common.inc |
@@ -16,7 +21,14 @@ include disable-passwdmgr.inc | |||
16 | include disable-programs.inc | 21 | include disable-programs.inc |
17 | include disable-xdg.inc | 22 | include disable-xdg.inc |
18 | 23 | ||
24 | mkdir ${HOME}/.config/newsboat | ||
25 | mkdir ${HOME}/.local/share/newsboat | ||
19 | mkdir ${HOME}/.newsboat | 26 | mkdir ${HOME}/.newsboat |
27 | whitelist ${HOME}/.config/newsbeuter | ||
28 | whitelist ${HOME}/.config/newsboat | ||
29 | whitelist ${HOME}/.local/share/newsbeuter | ||
30 | whitelist ${HOME}/.local/share/newsboat | ||
31 | whitelist ${HOME}/.newsbeuter | ||
20 | whitelist ${HOME}/.newsboat | 32 | whitelist ${HOME}/.newsboat |
21 | include whitelist-common.inc | 33 | include whitelist-common.inc |
22 | include whitelist-runuser-common.inc | 34 | include whitelist-runuser-common.inc |
@@ -38,7 +50,7 @@ seccomp | |||
38 | shell none | 50 | shell none |
39 | 51 | ||
40 | disable-mnt | 52 | disable-mnt |
41 | private-bin gzip,lynx,newsboat,sh | 53 | private-bin gzip,lynx,newsboat,sh,w3m |
42 | private-cache | 54 | private-cache |
43 | private-dev | 55 | private-dev |
44 | private-etc alternatives,ca-certificates,crypto-policies,lynx.cfg,lynx.lss,pki,resolv.conf,ssl,terminfo | 56 | private-etc alternatives,ca-certificates,crypto-policies,lynx.cfg,lynx.lss,pki,resolv.conf,ssl,terminfo |
diff --git a/etc/profile-m-z/telegram.profile b/etc/profile-m-z/telegram.profile index fce7dc461..38d291324 100644 --- a/etc/profile-m-z/telegram.profile +++ b/etc/profile-m-z/telegram.profile | |||
@@ -36,10 +36,20 @@ noroot | |||
36 | notv | 36 | notv |
37 | protocol unix,inet,inet6,netlink | 37 | protocol unix,inet,inet6,netlink |
38 | seccomp | 38 | seccomp |
39 | seccomp.block-secondary | ||
39 | shell none | 40 | shell none |
41 | tracelog | ||
40 | 42 | ||
41 | disable-mnt | 43 | disable-mnt |
44 | #private-bin telegram,Telegram,telegram-desktop | ||
42 | private-cache | 45 | private-cache |
43 | private-dev | 46 | private-dev |
44 | private-etc alsa,alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,machine-id,os-release,passwd,pki,pulse,resolv.conf,ssl,xdg | 47 | private-etc alsa,alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,machine-id,os-release,passwd,pki,pulse,resolv.conf,ssl,xdg |
45 | private-tmp | 48 | private-tmp |
49 | |||
50 | dbus-user filter | ||
51 | dbus-user.talk org.freedesktop.Notifications | ||
52 | dbus-user.talk org.kde.StatusNotifierWatcher | ||
53 | dbus-user.talk org.gnome.Mutter.IdleMonitor | ||
54 | dbus-user.talk org.freedesktop.ScreenSaver | ||
55 | dbus-system none | ||
diff --git a/etc/profile-m-z/virtualbox.profile b/etc/profile-m-z/virtualbox.profile index 232ff8ae4..64d787bfb 100644 --- a/etc/profile-m-z/virtualbox.profile +++ b/etc/profile-m-z/virtualbox.profile | |||
@@ -44,6 +44,7 @@ shell none | |||
44 | tracelog | 44 | tracelog |
45 | 45 | ||
46 | #disable-mnt | 46 | #disable-mnt |
47 | #private-bin basename,bash,env,gawk,grep,ps,readlink,sh,virtualbox,VirtualBox,VBox*,vbox*,whoami | ||
47 | private-cache | 48 | private-cache |
48 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl | 49 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl |
49 | private-tmp | 50 | private-tmp |
diff --git a/etc/profile-m-z/youtube-dl-gui.profile b/etc/profile-m-z/youtube-dl-gui.profile new file mode 100644 index 000000000..c072d6267 --- /dev/null +++ b/etc/profile-m-z/youtube-dl-gui.profile | |||
@@ -0,0 +1,56 @@ | |||
1 | # Firejail profile for youtube-dl-gui | ||
2 | # Description: A cross platform front-end GUI of the popular youtube-dl media downloader | ||
3 | include youtube-dl-gui.local | ||
4 | # This file is overwritten after every install/update | ||
5 | include globals.local | ||
6 | |||
7 | #These are blacklisted by disable-interpreters.inc | ||
8 | include allow-python2.inc | ||
9 | include allow-python3.inc | ||
10 | |||
11 | noblacklist ${HOME}/.config/youtube-dlg | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | mkdir ${HOME}/.config/youtube-dlg | ||
23 | whitelist ${HOME}/.config/youtube-dlg | ||
24 | whitelist ${DOWNLOADS} | ||
25 | include whitelist-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | machine-id | ||
33 | netfilter | ||
34 | nodvd | ||
35 | nogroups | ||
36 | nonewprivs | ||
37 | noroot | ||
38 | nosound | ||
39 | notv | ||
40 | nou2f | ||
41 | novideo | ||
42 | protocol unix,inet,inet6 | ||
43 | seccomp | ||
44 | seccomp.block-secondary | ||
45 | shell none | ||
46 | tracelog | ||
47 | |||
48 | disable-mnt | ||
49 | private-bin atomicparsley,ffmpeg,ffprobe,python*,youtube-dl-gui | ||
50 | private-cache | ||
51 | private-dev | ||
52 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,locale,locale.conf,passwd,pki,resolv.conf,ssl | ||
53 | private-tmp | ||
54 | |||
55 | dbus-user none | ||
56 | dbus-system none | ||
diff --git a/etc/templates/profile.template b/etc/templates/profile.template index af5497757..065245a63 100644 --- a/etc/templates/profile.template +++ b/etc/templates/profile.template | |||
@@ -203,7 +203,7 @@ include globals.local | |||
203 | # - Some features like native notifications are implemented as portal too. | 203 | # - Some features like native notifications are implemented as portal too. |
204 | # - In order to make dconf work (when used by the app) you need to allow | 204 | # - In order to make dconf work (when used by the app) you need to allow |
205 | # 'ca.desrt.dconf' even when not allowed by flatpak. | 205 | # 'ca.desrt.dconf' even when not allowed by flatpak. |
206 | # Notes and Policiy about addresses can be found at | 206 | # Notes and policies about addresses can be found at |
207 | # <https://github.com/netblue30/firejail/wiki/Restrict-D-Bus> | 207 | # <https://github.com/netblue30/firejail/wiki/Restrict-D-Bus> |
208 | #dbus-user filter | 208 | #dbus-user filter |
209 | #dbus-user.own com.github.netblue30.firejail | 209 | #dbus-user.own com.github.netblue30.firejail |