36 files changed, 209 insertions, 39 deletions

diff --git a/etc/0ad.profile b/etc/0ad.profile
index 674fb2c6a..88c9c453b 100644
--- a/etc/0ad.profile
+++ b/etc/0ad.profile
@@ -12,6 +12,7 @@ noblacklist ${HOME}/.local/share/0ad
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -44,5 +45,3 @@ private-bin 0ad,pyrogenesis,sh,which
 private-dev
 private-tmp
 
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/2048-qt.profile b/etc/2048-qt.profile
index 10f354f19..2347039a6 100644
--- a/etc/2048-qt.profile
+++ b/etc/2048-qt.profile
@@ -11,6 +11,7 @@ noblacklist ${HOME}/.config/xiaoyong
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -39,6 +40,3 @@ shell none
 disable-mnt
 private-dev
 private-tmp
-
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/Builder.profile b/etc/Builder.profile
new file mode 100644
index 000000000..128e0dfe3
--- /dev/null
+++ b/etc/Builder.profile
@@ -0,0 +1,7 @@
+# Firejail profile for gnome-builder
+# This file is overwritten after every install/update
+
+
+# Temporary fix for https://github.com/netblue30/firejail/issues/2624
+# Redirect
+include gnome-builder.profile
diff --git a/etc/Documents.profile b/etc/Documents.profile
new file mode 100644
index 000000000..c965c55a8
--- /dev/null
+++ b/etc/Documents.profile
@@ -0,0 +1,7 @@
+# Firejail profile for gnome-documents
+# This file is overwritten after every install/update
+
+
+# Temporary fix for https://github.com/netblue30/firejail/issues/2624
+# Redirect
+include gnome-documents.profile
diff --git a/etc/Logs.profile b/etc/Logs.profile
new file mode 100644
index 000000000..f82722ed4
--- /dev/null
+++ b/etc/Logs.profile
@@ -0,0 +1,7 @@
+# Firejail profile for gnome-logs
+# This file is overwritten after every install/update
+
+
+# Temporary fix for https://github.com/netblue30/firejail/issues/2624
+# Redirect
+include gnome-logs.profile
diff --git a/etc/Maps.profile b/etc/Maps.profile
new file mode 100644
index 000000000..b3fc03e38
--- /dev/null
+++ b/etc/Maps.profile
@@ -0,0 +1,7 @@
+# Firejail profile for gnome-maps
+# This file is overwritten after every install/update
+
+
+# Temporary fix for https://github.com/netblue30/firejail/issues/2624
+# Redirect
+include gnome-maps.profile
diff --git a/etc/assogiate.profile b/etc/assogiate.profile
index c579cc280..6a9848e83 100644
--- a/etc/assogiate.profile
+++ b/etc/assogiate.profile
@@ -7,6 +7,7 @@ include assogiate.local
 include globals.local
 
 noblacklist ${PICTURES}
+whitelist ${PICTURES}
 
 include disable-common.inc
 include disable-devel.inc
@@ -15,9 +16,8 @@ include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
-
-whitelist ${PICTURES}
 include whitelist-common.inc
+include whitelist-var-common.inc
 
 apparmor
 caps.drop all
@@ -39,7 +39,7 @@ shell none
 tracelog
 
 disable-mnt
-private-bin assogiate,gtk-update-icon-cache
+private-bin assogiate,gtk-update-icon-cache,update-mime-database
 private-cache
 private-dev
 private-lib gnome-vfs-2.0,libattr.so.*,libacl.so.*,libfam.so.*
diff --git a/etc/atom.profile b/etc/atom.profile
index 995c5598d..1c0afb277 100644
--- a/etc/atom.profile
+++ b/etc/atom.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.atom
 noblacklist ${HOME}/.config/Atom
 noblacklist ${HOME}/.cargo/config
 noblacklist ${HOME}/.cargo/registry
+noblacklist ${HOME}/.gitconfig
 
 include disable-common.inc
 include disable-passwdmgr.inc
diff --git a/etc/autokey-common.profile b/etc/autokey-common.profile
new file mode 100644
index 000000000..44c0a3c15
--- /dev/null
+++ b/etc/autokey-common.profile
@@ -0,0 +1,47 @@
+# Firejail profile for autokey
+# Description: Desktop automation utility
+# This file is overwritten after every install/update
+# Persistent local customizations
+include autokey-common.local
+# Persistent global definitions
+include globals.local
+
+noblacklist ${HOME}/.config/autokey
+noblacklist ${HOME}/.local/share/autokey
+
+# Allow python (blacklisted by disable-interpreters.inc)
+noblacklist ${PATH}/python2*
+noblacklist ${PATH}/python3*
+noblacklist /usr/lib/python2*
+noblacklist /usr/lib/python3*
+noblacklist /usr/local/lib/python2*
+noblacklist /usr/local/lib/python3*
+noblacklist /usr/share/python2*
+noblacklist /usr/share/python3*
+
+include disable-common.inc
+include disable-devel.inc
+# disable-exec.inc might break scripting functionality
+#include disable-exec.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include whitelist-var-common.inc
+
+caps.drop all
+netfilter
+no3d
+nogroups
+nonewprivs
+noroot
+nou2f
+protocol unix,inet,inet6
+seccomp
+shell none
+tracelog
+
+private-cache
+private-dev
+private-tmp
+
+# memory-deny-write-execute - Breaks on Arch
diff --git a/etc/autokey-gtk.profile b/etc/autokey-gtk.profile
new file mode 100644
index 000000000..86168ba0d
--- /dev/null
+++ b/etc/autokey-gtk.profile
@@ -0,0 +1,11 @@
+# Firejail profile for autokey-gtk
+# Description: Desktop automation utility (GTK version)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include autokey-gtk.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+#Redirect
+include autokey-common.profile
diff --git a/etc/autokey-qt.profile b/etc/autokey-qt.profile
new file mode 100644
index 000000000..f3877d829
--- /dev/null
+++ b/etc/autokey-qt.profile
@@ -0,0 +1,11 @@
+# Firejail profile for autokey-qt
+# Description: Desktop automation utility (Qt version)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include autokey-qt.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+#Redirect
+include autokey-common.profile
diff --git a/etc/autokey-run.profile b/etc/autokey-run.profile
new file mode 100644
index 000000000..b70239022
--- /dev/null
+++ b/etc/autokey-run.profile
@@ -0,0 +1,11 @@
+# Firejail profile for autokey-run
+# Description: Desktop automation utility (CLI version)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include autokey-run.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+#Redirect
+include autokey-common.profile
diff --git a/etc/autokey-shell.profile b/etc/autokey-shell.profile
new file mode 100644
index 000000000..5745fce77
--- /dev/null
+++ b/etc/autokey-shell.profile
@@ -0,0 +1,11 @@
+# Firejail profile for autokey-shell
+# Description: Desktop automation utility (CLI shell)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include autokey-shell.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+#Redirect
+include autokey-common.profile
diff --git a/etc/brackets.profile b/etc/brackets.profile
index cead6ec24..46870e1ad 100644
--- a/etc/brackets.profile
+++ b/etc/brackets.profile
@@ -9,8 +9,10 @@ noblacklist ${HOME}/.config/Brackets
 #noblacklist /opt/brackets/
 #noblacklist /opt/google/
 # Uncomment the the next two lines if you are developing rust.
+# or put it in your brackets.local
 #noblacklist ${HOME}/.cargo/config
 #noblacklist ${HOME}/.cargo/registry
+noblacklist ${HOME}/.gitconfig
 
 include disable-common.inc
 include disable-passwdmgr.inc
diff --git a/etc/calibre.profile b/etc/calibre.profile
index 5c7d3e1e7..363e9191d 100644
--- a/etc/calibre.profile
+++ b/etc/calibre.profile
@@ -12,6 +12,7 @@ noblacklist ${DOCUMENTS}
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
@@ -36,6 +37,3 @@ tracelog
 
 private-dev
 private-tmp
-
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/cherrytree.profile b/etc/cherrytree.profile
index 22bda418a..44ef12aa2 100644
--- a/etc/cherrytree.profile
+++ b/etc/cherrytree.profile
@@ -19,6 +19,7 @@ noblacklist /usr/local/lib/python3*
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -44,5 +45,3 @@ private-cache
 private-dev
 private-tmp
 
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/clocks.profile b/etc/clocks.profile
new file mode 100644
index 000000000..dd234ce44
--- /dev/null
+++ b/etc/clocks.profile
@@ -0,0 +1,7 @@
+# Firejail profile for gnome-clocks
+# This file is overwritten after every install/update
+
+
+# Temporary fix for https://github.com/netblue30/firejail/issues/2624
+# Redirect
+include gnome-clocks.profile
diff --git a/etc/eom.profile b/etc/eom.profile
index a6007f99c..745e650aa 100644
--- a/etc/eom.profile
+++ b/etc/eom.profile
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.steam
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -43,5 +44,3 @@ private-lib
 private-tmp
 
 #memory-deny-write-execute - breaks on Arch
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/evince.profile b/etc/evince.profile
index c3c6d4be0..b1f984784 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -11,6 +11,7 @@ noblacklist ${DOCUMENTS}
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -23,7 +24,8 @@ machine-id
 # net none - breaks AppArmor on Ubuntu systems
 netfilter
 no3d
-nodbus # might break two-page-view on some systems
+# nodbus might break two-page-view on some systems
+nodbus
 nodvd
 nogroups
 nonewprivs
@@ -45,5 +47,3 @@ private-lib evince,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,li
 private-tmp
 
 # memory-deny-write-execute - might break application (https://github.com/netblue30/firejail/issues/1803)
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/frozen-bubble.profile b/etc/frozen-bubble.profile
index ed3b4490f..6de61840c 100644
--- a/etc/frozen-bubble.profile
+++ b/etc/frozen-bubble.profile
@@ -8,6 +8,13 @@ include globals.local
 
 noblacklist ${HOME}/.frozen-bubble
 
+# Allow perl (blacklisted by disable-interpreters.inc)
+noblacklist ${PATH}/cpan*
+noblacklist ${PATH}/core_perl
+noblacklist ${PATH}/perl
+noblacklist /usr/lib/perl*
+noblacklist /usr/share/perl*
+
 include disable-common.inc
 include disable-devel.inc
 include disable-interpreters.inc
diff --git a/etc/geany.profile b/etc/geany.profile
index a21e19329..7f96449c9 100644
--- a/etc/geany.profile
+++ b/etc/geany.profile
@@ -8,6 +8,7 @@ include globals.local
 
 noblacklist ${HOME}/.config/geany
 noblacklist ${HOME}/.python-history
+noblacklist ${HOME}/.gitconfig
 
 include disable-common.inc
 include disable-passwdmgr.inc
diff --git a/etc/gnome-builder.profile b/etc/gnome-builder.profile
index 05ebea80c..d5e3cd435 100644
--- a/etc/gnome-builder.profile
+++ b/etc/gnome-builder.profile
@@ -9,6 +9,7 @@ include globals.local
 noblacklist ${HOME}/.cargo/config
 noblacklist ${HOME}/.cargo/registry
 noblacklist ${HOME}/.python-history
+noblacklist ${HOME}/.gitconfig
 
 include disable-common.inc
 include disable-passwdmgr.inc
diff --git a/etc/gnome-chess.profile b/etc/gnome-chess.profile
index dc5b62428..2f4626891 100644
--- a/etc/gnome-chess.profile
+++ b/etc/gnome-chess.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.local/share/gnome-chess
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -37,6 +38,3 @@ private-bin fairymax,gnome-chess,hoichess,gnuchess
 private-dev
 private-etc alternatives,fonts,gnome-chess
 private-tmp
-
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-contacts.profile b/etc/gnome-contacts.profile
index 2a13b3b27..ac6d82451 100644
--- a/etc/gnome-contacts.profile
+++ b/etc/gnome-contacts.profile
@@ -10,6 +10,7 @@ noblacklist ${DOCUMENTS}
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -35,5 +36,3 @@ disable-mnt
 private-dev
 private-tmp
 
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/gnome-logs.profile b/etc/gnome-logs.profile
index c7cbd8388..9a12162db 100644
--- a/etc/gnome-logs.profile
+++ b/etc/gnome-logs.profile
@@ -26,6 +26,7 @@ nodbus
 nodvd
 # When using 'volatile' storage (https://www.freedesktop.org/software/systemd/man/journald.conf.html),
 # comment both 'nogroups' and 'noroot'
+# or put 'ignore nogroups' and 'ignore noroot' to your gnome-logs.local.
 nogroups
 nonewprivs
 noroot
@@ -46,7 +47,5 @@ private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.s
 private-tmp
 writable-var-log
 
-memory-deny-write-execute
-
 # comment this if you export logs to a file in your ${HOME}
 read-only ${HOME}
diff --git a/etc/hexchat.profile b/etc/hexchat.profile
index e8abf4b31..ee70e6655 100644
--- a/etc/hexchat.profile
+++ b/etc/hexchat.profile
@@ -19,6 +19,7 @@ noblacklist /usr/local/lib/python3*
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -53,5 +54,3 @@ private-dev
 private-tmp
 
 # memory-deny-write-execute - breaks python
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/leafpad.profile b/etc/leafpad.profile
index 47ea5606a..56a792c8e 100644
--- a/etc/leafpad.profile
+++ b/etc/leafpad.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/leafpad
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -36,5 +37,3 @@ private-dev
 private-lib
 private-tmp
 
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/mousepad.profile b/etc/mousepad.profile
index 4500f74a5..3b9807b28 100644
--- a/etc/mousepad.profile
+++ b/etc/mousepad.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/Mousepad
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
diff --git a/etc/ping.profile b/etc/ping.profile
index bdd29c1a1..66574bab5 100644
--- a/etc/ping.profile
+++ b/etc/ping.profile
@@ -8,6 +8,7 @@ include globals.local
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -46,5 +47,3 @@ private-tmp
 
 # memory-deny-write-execute is built using seccomp; nonewprivs will kill it
 #memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/pinta.profile b/etc/pinta.profile
index 3dfe3cc1b..8151bc98f 100644
--- a/etc/pinta.profile
+++ b/etc/pinta.profile
@@ -12,6 +12,7 @@ noblacklist ${PICTURES}
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -37,5 +38,3 @@ private-dev
 private-cache
 private-tmp
 
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/sol.profile b/etc/sol.profile
index c194eed05..ea1620b31 100644
--- a/etc/sol.profile
+++ b/etc/sol.profile
@@ -7,6 +7,7 @@ include globals.local
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -40,5 +41,3 @@ private-dev
 private-tmp
 
 # memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/utox.profile b/etc/utox.profile
new file mode 100644
index 000000000..9216a6a05
--- /dev/null
+++ b/etc/utox.profile
@@ -0,0 +1,47 @@
+# Firejail profile for utox
+# Description: Lightweight Tox client
+# This file is overwritten after every install/update
+# Persistent local customizations
+include utox.local
+# Persistent global definitions
+include globals.local
+
+noblacklist ${HOME}/.config/tox
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include disable-xdg.inc
+
+mkdir ${HOME}/.config/tox
+whitelist ${DOWNLOADS}
+whitelist ${HOME}/.config/tox
+include whitelist-common.inc
+include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+ipc-namespace
+netfilter
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+nou2f
+protocol unix,inet,inet6
+seccomp
+shell none
+tracelog
+
+disable-mnt
+private-bin utox
+private-cache
+private-dev
+private-etc alternatives,fonts,resolv.conf,ld.so.cache,localtime,ca-certificates,ssl,pki,crypto-policies,machine-id,pulse,openal
+private-tmp
+
+memory-deny-write-execute
diff --git a/etc/virtualbox.profile b/etc/virtualbox.profile
index 1ef44dd5c..45f9949f3 100644
--- a/etc/virtualbox.profile
+++ b/etc/virtualbox.profile
@@ -14,6 +14,7 @@ noblacklist /usr/lib/virtualbox
 noblacklist /usr/lib64/virtualbox
 
 include disable-common.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
diff --git a/etc/warzone2100.profile b/etc/warzone2100.profile
index 816f2236c..85cbc5e43 100644
--- a/etc/warzone2100.profile
+++ b/etc/warzone2100.profile
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.warzone2100-3.*
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
diff --git a/etc/wget.profile b/etc/wget.profile
index c0a6f0d21..a7ef32e2c 100644
--- a/etc/wget.profile
+++ b/etc/wget.profile
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.wget-hsts
 noblacklist ${HOME}/.wgetrc
 
 include disable-common.inc
+include disable-exec.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
@@ -38,5 +39,3 @@ private-dev
 # private-etc alternatives,resolv.conf,ca-certificates,ssl,pki,crypto-policies
 # private-tmp
 
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/xcalc.profile b/etc/xcalc.profile
index 1941787b1..0ad423d30 100644
--- a/etc/xcalc.profile
+++ b/etc/xcalc.profile
@@ -7,6 +7,7 @@ include globals.local
 
 include disable-common.inc
 include disable-devel.inc
+include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
@@ -38,5 +39,3 @@ private-dev
 private-lib
 private-tmp
 
-noexec ${HOME}
-noexec /tmp