10 files changed, 34 insertions, 6 deletions

diff --git a/etc/dnscrypt-proxy.profile b/etc/dnscrypt-proxy.profile
index 90c244e03..926b8bfcc 100644
--- a/etc/dnscrypt-proxy.profile
+++ b/etc/dnscrypt-proxy.profile
@@ -9,5 +9,6 @@ include /etc/firejail/disable-passwdmgr.inc
 private
 private-dev
 nosound
+no3d
 seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open
 
diff --git a/etc/dnsmasq.profile b/etc/dnsmasq.profile
index 1c01d44e4..3bd43f144 100644
--- a/etc/dnsmasq.profile
+++ b/etc/dnsmasq.profile
@@ -12,5 +12,6 @@ nonewprivs
 private
 private-dev
 nosound
+no3d
 protocol unix,inet,inet6,netlink
 seccomp
diff --git a/etc/file.profile b/etc/file.profile
index c2d7b0b0f..860f7b104 100644
--- a/etc/file.profile
+++ b/etc/file.profile
@@ -7,7 +7,11 @@ tracelog
 net none
 shell none
 private-bin file
-private-dev
 private-etc magic.mgc,magic,localtime
 hostname file
+private-dev
 nosound
+no3d
+private-tmp
+blacklist /tmp/.X11-unix
+
diff --git a/etc/gzip.profile b/etc/gzip.profile
index ce4aa3c4b..4843839c5 100644
--- a/etc/gzip.profile
+++ b/etc/gzip.profile
@@ -5,6 +5,9 @@ include /etc/firejail/default.profile
 tracelog
 net none
 shell none
-private-dev
 private-tmp
+blacklist /tmp/.X11-unix
+private-dev
 nosound
+no3d
+
diff --git a/etc/server.profile b/etc/server.profile
index 88331d951..22cef0a3c 100644
--- a/etc/server.profile
+++ b/etc/server.profile
@@ -9,6 +9,8 @@ include /etc/firejail/disable-passwdmgr.inc
 private
 private-dev
 nosound
+no3d
 private-tmp
+blacklist /tmp/.X11-unix
 seccomp
 
diff --git a/etc/tar.profile b/etc/tar.profile
index 78bf7ad13..3f6599784 100644
--- a/etc/tar.profile
+++ b/etc/tar.profile
@@ -10,6 +10,10 @@ shell none
 # support compressed archives
 private-bin sh,tar,gtar,compress,gzip,lzma,xz,bzip2,lbzip2,lzip,lzop
 private-dev
+nosound
+no3d
 private-etc passwd,group,localtime
 hostname tar
-nosound
+private-tmp
+blacklist /tmp/.X11-unix
+
diff --git a/etc/unrar.profile b/etc/unrar.profile
index e941a8f2a..f29d1b51b 100644
--- a/etc/unrar.profile
+++ b/etc/unrar.profile
@@ -8,6 +8,10 @@ net none
 shell none
 private-bin unrar
 private-dev
+nosound
+no3d
 private-etc passwd,group,localtime
 hostname unrar
-nosound
+private-tmp
+blacklist /tmp/.X11-unix
+
diff --git a/etc/unzip.profile b/etc/unzip.profile
index ab69e932e..957dbdd71 100644
--- a/etc/unzip.profile
+++ b/etc/unzip.profile
@@ -7,7 +7,11 @@ tracelog
 net none
 shell none
 private-bin unzip
-private-dev
 private-etc passwd,group,localtime
 hostname unzip
+private-dev
 nosound
+no3d
+private-tmp
+blacklist /tmp/.X11-unix
+
diff --git a/etc/uudeview.profile b/etc/uudeview.profile
index f6fe0abf1..51e413493 100644
--- a/etc/uudeview.profile
+++ b/etc/uudeview.profile
@@ -13,3 +13,5 @@ private-tmp
 private-etc nonexisting_fakefile_for_empty_etc
 hostname uudeview
 nosound
+uudeview
+
diff --git a/etc/xzdec.profile b/etc/xzdec.profile
index 3692160e6..0647bddeb 100644
--- a/etc/xzdec.profile
+++ b/etc/xzdec.profile
@@ -5,6 +5,9 @@ include /etc/firejail/default.profile
 tracelog
 net none
 shell none
-private-dev
 private-tmp
+blacklist /tmp/.X11-unix
+private-dev
 nosound
+no3d
+