5 files changed, 36 insertions, 17 deletions

diff --git a/etc/inc/allow-common-devel.inc b/etc/inc/allow-common-devel.inc
index 4e460fc10..9576239f3 100644
--- a/etc/inc/allow-common-devel.inc
+++ b/etc/inc/allow-common-devel.inc
@@ -8,8 +8,13 @@ noblacklist ${HOME}/.gitconfig
 noblacklist ${HOME}/.git-credentials
 
 # Java
+noblacklist ${HOME}/.ammonite
+noblacklist ${HOME}/.config/jgit
+noblacklist ${HOME}/.g8
 noblacklist ${HOME}/.gradle
+noblacklist ${HOME}/.ivy2
 noblacklist ${HOME}/.java
+noblacklist ${HOME}/.sbt
 
 # Node.js
 noblacklist ${HOME}/.node-gyp
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index fcd385cae..efe1b2572 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -175,6 +175,7 @@ blacklist ${HOME}/.cache/mypaint
 blacklist ${HOME}/.cache/netsurf
 blacklist ${HOME}/.cache/nheko
 blacklist ${HOME}/.cache/nvim
+blacklist ${HOME}/.cache/ocenaudio
 blacklist ${HOME}/.cache/okular
 blacklist ${HOME}/.cache/opera
 blacklist ${HOME}/.cache/opera-beta
diff --git a/etc/profile-a-l/cmake.profile b/etc/profile-a-l/cmake.profile
index 26cc2a00a..acc03e93f 100644
--- a/etc/profile-a-l/cmake.profile
+++ b/etc/profile-a-l/cmake.profile
@@ -1,12 +1,15 @@
-# Firejail profile for cargo
-# Description: The Rust package manager
+# Firejail profile for cmake
+# Description: A cross-platform open-source make system
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
-include cargo.local
+include cmake.local
 # Persistent global definitions
 include globals.local
 
+whitelist /usr/share/cmake
+whitelist /usr/share/cmake-*
+
 memory-deny-write-execute
 
 # Redirect
diff --git a/etc/profile-m-z/ocenaudio.profile b/etc/profile-m-z/ocenaudio.profile
index 0bfb35333..080b4c92b 100644
--- a/etc/profile-m-z/ocenaudio.profile
+++ b/etc/profile-m-z/ocenaudio.profile
@@ -6,8 +6,9 @@ include ocenaudio.local
 # Persistent global definitions
 include globals.local
 
+noblacklist ${HOME}/.cache/ocenaudio
 noblacklist ${HOME}/.local/share/ocenaudio
-noblacklist ${DOCUMENTS}
+
 noblacklist ${MUSIC}
 
 include disable-common.inc
@@ -18,38 +19,44 @@ include disable-programs.inc
 include disable-shell.inc
 include disable-xdg.inc
 
+mkdir ${HOME}/.cache/ocenaudio
+mkdir ${HOME}/.local/share/ocenaudio
+whitelist ${HOME}/.cache/ocenaudio
+whitelist ${HOME}/.local/share/ocenaudio
+whitelist ${DOWNLOADS}
+whitelist ${MUSIC}
+include whitelist-common.inc
+include whitelist-run-common.inc
+include whitelist-runuser-common.inc
 include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
 apparmor
 caps.drop all
-ipc-namespace
-# net none - breaks update functionality and AppArmor on Ubuntu systems
-# Add 'net none' to your ocenaudio.local when you want that functionality.
-#net none
+#ipc-namespace
 netfilter
 no3d
 nodvd
 nogroups
 noinput
 nonewprivs
+noprinters
 noroot
 notv
 nou2f
 novideo
-protocol unix
+# Add `protocol unix\nignore protocol` to your ocenaudio.local to disable networking.
+protocol unix,inet,inet6
 seccomp
 shell none
 tracelog
 
-private-bin ocenaudio
+private-bin ocenaudio,ocenvst
 private-cache
 private-dev
-private-etc alternatives,asound.conf,fonts,ld.so.cache,ld.so.preload,pulse
+private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg
+private-opt ocenaudio
 private-tmp
 
-# breaks preferences
-# dbus-user none
-# dbus-system none
-
-#memory-deny-write-execute - breaks on Arch (see issue #1803)
+dbus-user none
+dbus-system none
diff --git a/etc/profile-m-z/pip.profile b/etc/profile-m-z/pip.profile
index a0926371f..560957d47 100644
--- a/etc/profile-m-z/pip.profile
+++ b/etc/profile-m-z/pip.profile
@@ -3,7 +3,7 @@
 # This file is overwritten after every install/update
 quiet
 # Persistent local customizations
-include meson.local
+include pip.local
 # Persistent global definitions
 include globals.local
 
@@ -12,6 +12,9 @@ ignore read-only ${HOME}/.local/lib
 # Allow python3 (blacklisted by disable-interpreters.inc)
 include allow-python3.inc
 
+noblacklist ${HOME}/.cache/pip
+
+#whitelist ${HOME}/.cache/pip
 #whitelist ${HOME}/.local/lib/python*
 
 # Redirect