aboutsummaryrefslogtreecommitdiffstats
path: root/etc
diff options
context:
space:
mode:
Diffstat (limited to 'etc')
-rw-r--r--etc/inc/disable-programs.inc8
-rw-r--r--etc/net/nolocal.net2
-rw-r--r--etc/profile-a-l/cawbird.profile46
-rw-r--r--etc/profile-a-l/com.gitlab.newsflash.profile5
-rw-r--r--etc/profile-a-l/discord-common.profile2
-rw-r--r--etc/profile-a-l/freetube.profile31
-rw-r--r--etc/profile-a-l/github-desktop.profile2
-rw-r--r--etc/profile-a-l/gnome-calculator.profile12
-rw-r--r--etc/profile-a-l/gnome-pomodoro.profile2
-rw-r--r--etc/profile-a-l/homebank.profile59
-rw-r--r--etc/profile-m-z/mattermost-desktop.profile46
-rw-r--r--etc/profile-m-z/meld.profile1
-rw-r--r--etc/profile-m-z/minecraft-launcher.profile58
-rw-r--r--etc/profile-m-z/mpv.profile7
-rw-r--r--etc/profile-m-z/newsflash.profile60
-rw-r--r--etc/profile-m-z/signal-desktop.profile2
-rw-r--r--etc/profile-m-z/teams.profile4
-rw-r--r--etc/profile-m-z/telegram.profile2
-rw-r--r--etc/profile-m-z/virtualbox.profile19
-rw-r--r--etc/profile-m-z/xfce4-screenshooter.profile51
-rw-r--r--etc/profile-m-z/zoom.profile14
21 files changed, 417 insertions, 16 deletions
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index 865eefb18..433699918 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -87,6 +87,7 @@ blacklist ${HOME}/.config/Enox
87blacklist ${HOME}/.config/Ferdi 87blacklist ${HOME}/.config/Ferdi
88blacklist ${HOME}/.config/Franz 88blacklist ${HOME}/.config/Franz
89blacklist ${HOME}/.config/FreeCAD 89blacklist ${HOME}/.config/FreeCAD
90blacklist ${HOME}/.config/FreeTube
90blacklist ${HOME}/.config/Fritzing 91blacklist ${HOME}/.config/Fritzing
91blacklist ${HOME}/.config/GIMP 92blacklist ${HOME}/.config/GIMP
92blacklist ${HOME}/.config/GitHub Desktop 93blacklist ${HOME}/.config/GitHub Desktop
@@ -100,6 +101,7 @@ blacklist ${HOME}/.config/Jitsi Meet
100blacklist ${HOME}/.config/Kid3 101blacklist ${HOME}/.config/Kid3
101blacklist ${HOME}/.config/Kingsoft 102blacklist ${HOME}/.config/Kingsoft
102blacklist ${HOME}/.config/Luminance 103blacklist ${HOME}/.config/Luminance
104blacklist ${HOME}/.config/Mattermost
103blacklist ${HOME}/.config/Meltytech 105blacklist ${HOME}/.config/Meltytech
104blacklist ${HOME}/.config/Mendeley Ltd. 106blacklist ${HOME}/.config/Mendeley Ltd.
105blacklist ${HOME}/.config/Min 107blacklist ${HOME}/.config/Min
@@ -162,6 +164,7 @@ blacklist ${HOME}/.config/caja
162blacklist ${HOME}/.config/calibre 164blacklist ${HOME}/.config/calibre
163blacklist ${HOME}/.config/cantata 165blacklist ${HOME}/.config/cantata
164blacklist ${HOME}/.config/catfish 166blacklist ${HOME}/.config/catfish
167blacklist ${HOME}/.config/cawbird
165blacklist ${HOME}/.config/celluloid 168blacklist ${HOME}/.config/celluloid
166blacklist ${HOME}/.config/cherrytree 169blacklist ${HOME}/.config/cherrytree
167blacklist ${HOME}/.config/chrome-beta-flags.conf 170blacklist ${HOME}/.config/chrome-beta-flags.conf
@@ -236,6 +239,7 @@ blacklist ${HOME}/.config/gthumb
236blacklist ${HOME}/.config/gummi 239blacklist ${HOME}/.config/gummi
237blacklist ${HOME}/.config/gwenviewrc 240blacklist ${HOME}/.config/gwenviewrc
238blacklist ${HOME}/.config/hexchat 241blacklist ${HOME}/.config/hexchat
242blacklist ${HOME}/.config/homebank
239blacklist ${HOME}/.config/i2p 243blacklist ${HOME}/.config/i2p
240blacklist ${HOME}/.config/inkscape 244blacklist ${HOME}/.config/inkscape
241blacklist ${HOME}/.config/inox 245blacklist ${HOME}/.config/inox
@@ -297,6 +301,7 @@ blacklist ${HOME}/.config/nautilus
297blacklist ${HOME}/.config/nemo 301blacklist ${HOME}/.config/nemo
298blacklist ${HOME}/.config/netsurf 302blacklist ${HOME}/.config/netsurf
299blacklist ${HOME}/.config/newsbeuter 303blacklist ${HOME}/.config/newsbeuter
304blacklist ${HOME}/.config/newsflash
300blacklist ${HOME}/.config/nheko 305blacklist ${HOME}/.config/nheko
301blacklist ${HOME}/.config/NitroShare 306blacklist ${HOME}/.config/NitroShare
302blacklist ${HOME}/.config/nomacs 307blacklist ${HOME}/.config/nomacs
@@ -633,6 +638,7 @@ blacklist ${HOME}/.local/share/nautilus
633blacklist ${HOME}/.local/share/nautilus-python 638blacklist ${HOME}/.local/share/nautilus-python
634blacklist ${HOME}/.local/share/nemo 639blacklist ${HOME}/.local/share/nemo
635blacklist ${HOME}/.local/share/nemo-python 640blacklist ${HOME}/.local/share/nemo-python
641blacklist ${HOME}/.local/share/news-flash
636blacklist ${HOME}/.local/share/nomacs 642blacklist ${HOME}/.local/share/nomacs
637blacklist ${HOME}/.local/share/notes 643blacklist ${HOME}/.local/share/notes
638blacklist ${HOME}/.local/share/ocenaudio 644blacklist ${HOME}/.local/share/ocenaudio
@@ -681,6 +687,7 @@ blacklist ${HOME}/.mcabber
681blacklist ${HOME}/.mcabberrc 687blacklist ${HOME}/.mcabberrc
682blacklist ${HOME}/.mediathek3 688blacklist ${HOME}/.mediathek3
683blacklist ${HOME}/.megaglest 689blacklist ${HOME}/.megaglest
690blacklist ${HOME}/.minecraft
684blacklist ${HOME}/.minetest 691blacklist ${HOME}/.minetest
685blacklist ${HOME}/.mirrormagic 692blacklist ${HOME}/.mirrormagic
686blacklist ${HOME}/.moc 693blacklist ${HOME}/.moc
@@ -805,6 +812,7 @@ blacklist ${HOME}/.cache/Ferdi
805blacklist ${HOME}/.cache/Franz 812blacklist ${HOME}/.cache/Franz
806blacklist ${HOME}/.cache/INRIA 813blacklist ${HOME}/.cache/INRIA
807blacklist ${HOME}/.cache/MusicBrainz 814blacklist ${HOME}/.cache/MusicBrainz
815blacklist ${HOME}/.cache/NewsFlashGTK
808blacklist ${HOME}/.cache/QuiteRss 816blacklist ${HOME}/.cache/QuiteRss
809blacklist ${HOME}/.cache/Shortwave 817blacklist ${HOME}/.cache/Shortwave
810blacklist ${HOME}/.cache/Tox 818blacklist ${HOME}/.cache/Tox
diff --git a/etc/net/nolocal.net b/etc/net/nolocal.net
index 8955f740d..0eb9f9784 100644
--- a/etc/net/nolocal.net
+++ b/etc/net/nolocal.net
@@ -32,5 +32,5 @@
32-A OUTPUT -d 172.16.0.0/12 -j DROP 32-A OUTPUT -d 172.16.0.0/12 -j DROP
33 33
34# drop multicast traffic 34# drop multicast traffic
35-A OUTPUT -d 244.0.0.0/4 -j DROP 35-A OUTPUT -d 224.0.0.0/4 -j DROP
36COMMIT 36COMMIT
diff --git a/etc/profile-a-l/cawbird.profile b/etc/profile-a-l/cawbird.profile
new file mode 100644
index 000000000..3d29c3817
--- /dev/null
+++ b/etc/profile-a-l/cawbird.profile
@@ -0,0 +1,46 @@
1# Firejail profile for cawbird
2# Description: Open-source Twitter client for Linux
3# This file is overwritten after every install/update
4# Persistent local customizations
5include cawbird.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.config/cawbird
10
11include disable-common.inc
12include disable-devel.inc
13include disable-exec.inc
14include disable-interpreters.inc
15include disable-passwdmgr.inc
16include disable-programs.inc
17include disable-shell.inc
18include disable-xdg.inc
19
20apparmor
21caps.drop all
22machine-id
23netfilter
24no3d
25nodvd
26nogroups
27nonewprivs
28noroot
29nosound
30notv
31nou2f
32novideo
33protocol unix,inet,inet6
34seccomp
35shell none
36tracelog
37
38disable-mnt
39private-bin cawbird
40private-cache
41private-dev
42private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,resolv.conf,ssl,X11,xdg
43private-tmp
44
45# dbus-user none
46dbus-system none
diff --git a/etc/profile-a-l/com.gitlab.newsflash.profile b/etc/profile-a-l/com.gitlab.newsflash.profile
new file mode 100644
index 000000000..0628d3d01
--- /dev/null
+++ b/etc/profile-a-l/com.gitlab.newsflash.profile
@@ -0,0 +1,5 @@
1# Firejail profile alias for newsflash
2# This file is overwritten after every install/update
3
4# Redirect
5include newsflash.profile
diff --git a/etc/profile-a-l/discord-common.profile b/etc/profile-a-l/discord-common.profile
index cbeef798f..35bea4aaa 100644
--- a/etc/profile-a-l/discord-common.profile
+++ b/etc/profile-a-l/discord-common.profile
@@ -32,7 +32,7 @@ novideo
32protocol unix,inet,inet6,netlink 32protocol unix,inet,inet6,netlink
33seccomp !chroot 33seccomp !chroot
34 34
35private-bin bash,cut,echo,egrep,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh 35private-bin bash,cut,echo,egrep,fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh
36private-dev 36private-dev
37private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,resolv.conf,ssl 37private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,resolv.conf,ssl
38private-tmp 38private-tmp
diff --git a/etc/profile-a-l/freetube.profile b/etc/profile-a-l/freetube.profile
new file mode 100644
index 000000000..91f0caf87
--- /dev/null
+++ b/etc/profile-a-l/freetube.profile
@@ -0,0 +1,31 @@
1# Firejail profile for freetube
2# Description: Youtube client with local subscription feature
3# This file is overwritten after every install/update
4# Persistent local customizations
5include freetube.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.config/FreeTube
10
11include disable-devel.inc
12include disable-exec.inc
13include disable-interpreters.inc
14include disable-shell.inc
15include disable-xdg.inc
16
17mkdir ${HOME}/.config/FreeTube
18whitelist ${HOME}/.config/FreeTube
19
20seccomp !chroot
21shell none
22
23disable-mnt
24private-bin freetube
25private-cache
26private-dev
27private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg
28private-tmp
29
30# Redirect
31include electron.profile
diff --git a/etc/profile-a-l/github-desktop.profile b/etc/profile-a-l/github-desktop.profile
index b25b138ad..152396553 100644
--- a/etc/profile-a-l/github-desktop.profile
+++ b/etc/profile-a-l/github-desktop.profile
@@ -30,7 +30,7 @@ notv
30nou2f 30nou2f
31novideo 31novideo
32protocol unix,inet,inet6,netlink 32protocol unix,inet,inet6,netlink
33seccomp 33seccomp !chroot
34 34
35# Note: On debian-based distributions the binary might be located in 35# Note: On debian-based distributions the binary might be located in
36# /opt/GitHub Desktop/github-desktop, and therefore not be in PATH. 36# /opt/GitHub Desktop/github-desktop, and therefore not be in PATH.
diff --git a/etc/profile-a-l/gnome-calculator.profile b/etc/profile-a-l/gnome-calculator.profile
index bc6626598..ceb01f2a0 100644
--- a/etc/profile-a-l/gnome-calculator.profile
+++ b/etc/profile-a-l/gnome-calculator.profile
@@ -25,7 +25,7 @@ apparmor
25caps.drop all 25caps.drop all
26ipc-namespace 26ipc-namespace
27machine-id 27machine-id
28# net none 28#net none -- breaks currency conversion
29netfilter 29netfilter
30no3d 30no3d
31nodvd 31nodvd
@@ -39,6 +39,7 @@ novideo
39protocol unix,inet,inet6 39protocol unix,inet,inet6
40seccomp 40seccomp
41shell none 41shell none
42tracelog
42 43
43disable-mnt 44disable-mnt
44private-bin gnome-calculator 45private-bin gnome-calculator
@@ -47,8 +48,7 @@ private-dev
47#private-lib gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.*,libgnutls.so.*,libproxy.so.*,librsvg-2.so.*,libxml2.so.* 48#private-lib gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.*,libgnutls.so.*,libproxy.so.*,librsvg-2.so.*,libxml2.so.*
48private-tmp 49private-tmp
49 50
50# makes settings immutable 51dbus-user filter
51# dbus-user none 52dbus-user.own org.gnome.Calculator
52# dbus-system none 53dbus-user.talk ca.desrt.dconf
53 54dbus-system none
54# memory-deny-write-execute
diff --git a/etc/profile-a-l/gnome-pomodoro.profile b/etc/profile-a-l/gnome-pomodoro.profile
index 2a5d2a231..a46e47759 100644
--- a/etc/profile-a-l/gnome-pomodoro.profile
+++ b/etc/profile-a-l/gnome-pomodoro.profile
@@ -50,7 +50,9 @@ private-tmp
50dbus-user filter 50dbus-user filter
51dbus-user.own org.gnome.Pomodoro 51dbus-user.own org.gnome.Pomodoro
52dbus-user.talk ca.desrt.dconf 52dbus-user.talk ca.desrt.dconf
53dbus-user.talk org.gnome.Mutter.IdleMonitor
53dbus-user.talk org.gnome.Shell 54dbus-user.talk org.gnome.Shell
55dbus-user.talk org.freedesktop.Notifications
54dbus-system none 56dbus-system none
55 57
56read-only ${HOME} 58read-only ${HOME}
diff --git a/etc/profile-a-l/homebank.profile b/etc/profile-a-l/homebank.profile
new file mode 100644
index 000000000..8e600a2d7
--- /dev/null
+++ b/etc/profile-a-l/homebank.profile
@@ -0,0 +1,59 @@
1# Firejail profile for homebank
2# Description: Personal finance manager
3# This file is overwritten after every install/update
4# Persistent local customizations
5include homebank.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.config/homebank
10
11include disable-common.inc
12include disable-devel.inc
13include disable-exec.inc
14include disable-interpreters.inc
15include disable-programs.inc
16include disable-passwdmgr.inc
17include disable-shell.inc
18include disable-xdg.inc
19
20mkdir ${HOME}/.config/homebank
21whitelist ${DOWNLOADS}
22whitelist ${HOME}/.config/homebank
23whitelist /usr/share/homebank
24include whitelist-common.inc
25include whitelist-runuser-common.inc
26include whitelist-usr-share-common.inc
27include whitelist-var-common.inc
28
29apparmor
30caps.drop all
31machine-id
32# net none
33netfilter
34nodvd
35no3d
36nodvd
37nogroups
38nonewprivs
39noroot
40nosound
41notv
42nou2f
43novideo
44protocol unix,inet,inet6
45seccomp
46shell none
47tracelog
48
49disable-mnt
50private-bin homebank
51private-cache
52private-dev
53private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11
54private-tmp
55
56dbus-user none
57dbus-system none
58
59# memory-deny-write-execute
diff --git a/etc/profile-m-z/mattermost-desktop.profile b/etc/profile-m-z/mattermost-desktop.profile
new file mode 100644
index 000000000..e4487c8aa
--- /dev/null
+++ b/etc/profile-m-z/mattermost-desktop.profile
@@ -0,0 +1,46 @@
1# Firejail profile for mattermost-desktop
2# This file is overwritten after every install/update
3# Persistent local customizations
4include mattermost-desktop.local
5# Persistent global definitions
6include globals.local
7
8noblacklist ${HOME}/.config/Mattermost
9
10include disable-common.inc
11include disable-devel.inc
12include disable-exec.inc
13include disable-interpreters.inc
14include disable-programs.inc
15include disable-passwdmgr.inc
16include disable-shell.inc
17include disable-xdg.inc
18
19mkdir ${HOME}/.config/Mattermost
20whitelist ${DOWNLOADS}
21whitelist ${HOME}/.config/Mattermost
22include whitelist-common.inc
23include whitelist-runuser-common.inc
24include whitelist-usr-share-common.inc
25include whitelist-var-common.inc
26
27caps.keep sys_admin,sys_chroot
28netfilter
29nodvd
30nogroups
31notv
32nou2f
33novideo
34shell none
35
36disable-mnt
37private-cache
38private-dev
39private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl
40private-tmp
41
42# Not tested
43#dbus-user filter
44#dbus-user.own com.mattermost.Desktop
45#dbus-user.talk org.freedesktop.Notifications
46#dbus-system none
diff --git a/etc/profile-m-z/meld.profile b/etc/profile-m-z/meld.profile
index 84db8b785..385700648 100644
--- a/etc/profile-m-z/meld.profile
+++ b/etc/profile-m-z/meld.profile
@@ -70,6 +70,7 @@ private-cache
70private-dev 70private-dev
71# Uncomment the next line (or put it into your meld.local) if you don't need to compare in /etc. 71# Uncomment the next line (or put it into your meld.local) if you don't need to compare in /etc.
72#private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,ssl,subversion 72#private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,ssl,subversion
73# Comment the next line (or add 'ignore private-tmp to your meld.local') if you want to use it as a difftool (#3551)
73private-tmp 74private-tmp
74 75
75read-only ${HOME}/.ssh 76read-only ${HOME}/.ssh
diff --git a/etc/profile-m-z/minecraft-launcher.profile b/etc/profile-m-z/minecraft-launcher.profile
new file mode 100644
index 000000000..8c7d18c58
--- /dev/null
+++ b/etc/profile-m-z/minecraft-launcher.profile
@@ -0,0 +1,58 @@
1# Firejail profile for minecraft-launcher
2# Description: Official Minecraft launcher from Mojang
3# This file is overwritten after every install/update
4# Persistent local customizations
5include minecraft-launcher.local
6# Persistent global definitions
7include globals.local
8
9# On some distros executable may be in '/opt/minecraft-launcher/', if so, run 'firejail /opt/minecraft-launcher/minecraft-launcher' to start it.
10
11ignore noexec ${HOME}
12
13noblacklist ${HOME}/.minecraft
14
15include allow-java.inc
16
17include disable-common.inc
18include disable-devel.inc
19include disable-exec.inc
20include disable-interpreters.inc
21include disable-passwdmgr.inc
22include disable-programs.inc
23include disable-shell.inc
24include disable-xdg.inc
25
26mkdir ${HOME}/.minecraft
27whitelist ${HOME}/.minecraft
28include whitelist-common.inc
29include whitelist-runuser-common.inc
30include whitelist-usr-share-common.inc
31include whitelist-var-common.inc
32
33apparmor
34caps.drop all
35netfilter
36nodvd
37nogroups
38nonewprivs
39noroot
40notv
41nou2f
42novideo
43protocol unix,inet,inet6,netlink
44seccomp
45shell none
46tracelog
47
48disable-mnt
49private-bin java,java-config,minecraft-launcher
50private-cache
51private-dev
52# If multiplayer or realms break add your own java folder from /etc or comment the line below.
53private-etc alternatives,asound.conf,ati,ca-certificates,crypto-policies,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,java-10-openjdk,java-11-openjdk,java-12-openjdk,java-13-openjdk,java-14-openjdk,java-7-openjdk,java-8-openjdk,java-9-openjdk,java-openjdk,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,login.defs,machine-id,mime.types,nvidia,passwd,pki,pulse,resolv.conf,selinux,services,ssl,timezone,X11,xdg
54private-opt minecraft-launcher
55private-tmp
56
57dbus-user none
58dbus-system none
diff --git a/etc/profile-m-z/mpv.profile b/etc/profile-m-z/mpv.profile
index b0e493c5f..2fc027257 100644
--- a/etc/profile-m-z/mpv.profile
+++ b/etc/profile-m-z/mpv.profile
@@ -30,6 +30,8 @@ include disable-programs.inc
30include disable-shell.inc 30include disable-shell.inc
31include disable-xdg.inc 31include disable-xdg.inc
32 32
33whitelist /usr/share/lua
34whitelist /usr/share/lua*
33whitelist /usr/share/vulkan 35whitelist /usr/share/vulkan
34include whitelist-usr-share-common.inc 36include whitelist-usr-share-common.inc
35include whitelist-var-common.inc 37include whitelist-var-common.inc
@@ -37,8 +39,7 @@ include whitelist-var-common.inc
37apparmor 39apparmor
38caps.drop all 40caps.drop all
39netfilter 41netfilter
40 42# nogroups seems to cause issues with Nvidia drivers sometimes
41# Seems to cause issues with Nvidia drivers sometimes
42nogroups 43nogroups
43nonewprivs 44nonewprivs
44noroot 45noroot
@@ -49,7 +50,7 @@ shell none
49tracelog 50tracelog
50 51
51private-bin env,mpv,python*,youtube-dl 52private-bin env,mpv,python*,youtube-dl
52# Causes slow OSD, see #2838 53# private-cache causes slow OSD, see #2838
53#private-cache 54#private-cache
54private-dev 55private-dev
55 56
diff --git a/etc/profile-m-z/newsflash.profile b/etc/profile-m-z/newsflash.profile
new file mode 100644
index 000000000..d0ac83baf
--- /dev/null
+++ b/etc/profile-m-z/newsflash.profile
@@ -0,0 +1,60 @@
1# Firejail profile for newsflash
2# Description: Modern feed reader
3# This file is overwritten after every install/update
4# Persistent local customizations
5include newsflash.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.cache/NewsFlashGTK
10noblacklist ${HOME}/.config/news-flash
11noblacklist ${HOME}/.local/share/news-flash
12
13include disable-common.inc
14include disable-devel.inc
15include disable-exec.inc
16include disable-interpreters.inc
17include disable-passwdmgr.inc
18include disable-programs.inc
19include disable-shell.inc
20include disable-xdg.inc
21
22mkdir ${HOME}/.cache/NewsFlashGTK
23mkdir ${HOME}/.config/news-flash
24mkdir ${HOME}/.local/share/news-flash
25whitelist ${HOME}/.cache/NewsFlashGTK
26whitelist ${HOME}/.config/news-flash
27whitelist ${HOME}/.local/share/news-flash
28include whitelist-common.inc
29include whitelist-runuser-common.inc
30include whitelist-usr-share-common.inc
31include whitelist-var-common.inc
32
33apparmor
34caps.drop all
35machine-id
36netfilter
37nodvd
38nogroups
39nonewprivs
40noroot
41nosound
42notv
43nou2f
44novideo
45protocol unix,inet,inet6
46seccomp
47shell none
48tracelog
49
50disable-mnt
51private-bin com.gitlab.newsflash,newsflash
52private-cache
53private-dev
54private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pango,pki,resolv.conf,ssl,X11
55private-tmp
56
57dbus-user none
58#dbus-user.own com.gitlab.newsflash
59#dbus-user.talk org.freedesktop.Notifications
60dbus-system none
diff --git a/etc/profile-m-z/signal-desktop.profile b/etc/profile-m-z/signal-desktop.profile
index 5d9225705..b51a86e7d 100644
--- a/etc/profile-m-z/signal-desktop.profile
+++ b/etc/profile-m-z/signal-desktop.profile
@@ -34,10 +34,12 @@ nodvd
34nogroups 34nogroups
35notv 35notv
36nou2f 36nou2f
37novideo
37shell none 38shell none
38 39
39disable-mnt 40disable-mnt
40private-dev 41private-dev
42private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl
41private-tmp 43private-tmp
42 44
43dbus-user none 45dbus-user none
diff --git a/etc/profile-m-z/teams.profile b/etc/profile-m-z/teams.profile
index 326b97e4b..bd7faa80a 100644
--- a/etc/profile-m-z/teams.profile
+++ b/etc/profile-m-z/teams.profile
@@ -1,14 +1,14 @@
1# Firejail profile for teams 1# Firejail profile for teams
2# Description: Official Microsoft Teams client for Linux using Electron. 2# Description: Official Microsoft Teams client for Linux using Electron.
3# This file is overwritten after every install/update 3# This file is overwritten after every install/update
4# Known issues:
5# * if Teams crashes on startup try using "ignore apparmor" in your local config
6# Persistent local customizations 4# Persistent local customizations
7include teams.local 5include teams.local
8# Persistent global definitions 6# Persistent global definitions
9# added by included profile 7# added by included profile
10#include globals.local 8#include globals.local
11 9
10# see #3404
11ignore apparmor
12ignore dbus-user none 12ignore dbus-user none
13ignore dbus-system none 13ignore dbus-system none
14 14
diff --git a/etc/profile-m-z/telegram.profile b/etc/profile-m-z/telegram.profile
index e3af5600a..8e0741458 100644
--- a/etc/profile-m-z/telegram.profile
+++ b/etc/profile-m-z/telegram.profile
@@ -25,5 +25,5 @@ seccomp
25 25
26disable-mnt 26disable-mnt
27private-cache 27private-cache
28private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl
28private-tmp 29private-tmp
29
diff --git a/etc/profile-m-z/virtualbox.profile b/etc/profile-m-z/virtualbox.profile
index c0dbc9116..12bef5d1f 100644
--- a/etc/profile-m-z/virtualbox.profile
+++ b/etc/profile-m-z/virtualbox.profile
@@ -14,9 +14,12 @@ noblacklist /usr/lib/virtualbox
14noblacklist /usr/lib64/virtualbox 14noblacklist /usr/lib64/virtualbox
15 15
16include disable-common.inc 16include disable-common.inc
17include disable-devel.inc
17include disable-exec.inc 18include disable-exec.inc
19include disable-interpreters.inc
18include disable-passwdmgr.inc 20include disable-passwdmgr.inc
19include disable-programs.inc 21include disable-programs.inc
22include disable-xdg.inc
20 23
21mkdir ${HOME}/.config/VirtualBox 24mkdir ${HOME}/.config/VirtualBox
22mkdir ${HOME}/VirtualBox VMs 25mkdir ${HOME}/VirtualBox VMs
@@ -24,9 +27,23 @@ whitelist ${HOME}/.config/VirtualBox
24whitelist ${HOME}/VirtualBox VMs 27whitelist ${HOME}/VirtualBox VMs
25whitelist ${DOWNLOADS} 28whitelist ${DOWNLOADS}
26include whitelist-common.inc 29include whitelist-common.inc
30include whitelist-runuser-common.inc
31include whitelist-usr-share-common.inc
27include whitelist-var-common.inc 32include whitelist-var-common.inc
28 33
29caps.keep net_raw,sys_admin,sys_nice 34# For host-only network sys_admin is needed. See https://github.com/netblue30/firejail/issues/2868#issuecomment-518647630
35
36caps.keep net_raw,sys_nice
30netfilter 37netfilter
31nodvd 38nodvd
39#nogroups
32notv 40notv
41shell none
42tracelog
43
44#disable-mnt
45private-cache
46private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl
47
48dbus-user none
49dbus-system none
diff --git a/etc/profile-m-z/xfce4-screenshooter.profile b/etc/profile-m-z/xfce4-screenshooter.profile
new file mode 100644
index 000000000..b760b44dd
--- /dev/null
+++ b/etc/profile-m-z/xfce4-screenshooter.profile
@@ -0,0 +1,51 @@
1# Firejail profile for xfce4-screenshooter
2# Description: Xfce screenshot tool
3# This file is overwritten after every install/update
4# Persistent local customizations
5include xfce4-screenshooter.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${PICTURES}
10
11include disable-common.inc
12include disable-devel.inc
13include disable-exec.inc
14include disable-interpreters.inc
15include disable-passwdmgr.inc
16include disable-programs.inc
17include disable-shell.inc
18include disable-xdg.inc
19
20whitelist /usr/share/xfce4
21include whitelist-runuser-common.inc
22include whitelist-usr-share-common.inc
23include whitelist-var-common.inc
24
25apparmor
26caps.drop all
27machine-id
28netfilter
29no3d
30nodvd
31nogroups
32nonewprivs
33noroot
34notv
35nou2f
36novideo
37protocol unix,inet,inet6
38seccomp
39shell none
40tracelog
41
42disable-mnt
43private-bin xfce4-screenshooter,xfconf-query
44private-dev
45private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,pki,resolv.conf,ssl
46private-tmp
47
48dbus-user none
49dbus-system none
50
51memory-deny-write-execute
diff --git a/etc/profile-m-z/zoom.profile b/etc/profile-m-z/zoom.profile
index 6eac10703..b3125ee50 100644
--- a/etc/profile-m-z/zoom.profile
+++ b/etc/profile-m-z/zoom.profile
@@ -10,8 +10,11 @@ noblacklist ${HOME}/.zoom
10 10
11include disable-common.inc 11include disable-common.inc
12include disable-devel.inc 12include disable-devel.inc
13include disable-exec.inc
13include disable-interpreters.inc 14include disable-interpreters.inc
15include disable-passwdmgr.inc
14include disable-programs.inc 16include disable-programs.inc
17include disable-xdg.inc
15 18
16mkdir ${HOME}/.cache/zoom 19mkdir ${HOME}/.cache/zoom
17mkfile ${HOME}/.config/zoomus.conf 20mkfile ${HOME}/.config/zoomus.conf
@@ -20,14 +23,25 @@ whitelist ${HOME}/.cache/zoom
20whitelist ${HOME}/.config/zoomus.conf 23whitelist ${HOME}/.config/zoomus.conf
21whitelist ${HOME}/.zoom 24whitelist ${HOME}/.zoom
22include whitelist-common.inc 25include whitelist-common.inc
26include whitelist-runuser-common.inc
27include whitelist-usr-share-common.inc
28include whitelist-var-common.inc
23 29
24caps.drop all 30caps.drop all
25netfilter 31netfilter
26nodvd 32nodvd
33nogroups
27nonewprivs 34nonewprivs
28noroot 35noroot
29notv 36notv
37nou2f
30protocol unix,inet,inet6,netlink 38protocol unix,inet,inet6,netlink
31seccomp !chroot 39seccomp !chroot
40shell none
41tracelog
32 42
43disable-mnt
44private-cache
45private-dev
46private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl
33private-tmp 47private-tmp
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-08-31 19:31:54 +0000