26 files changed, 38 insertions, 32 deletions

diff --git a/etc/QOwnNotes.profile b/etc/QOwnNotes.profile
index f63a8b9ef..090845259 100644
--- a/etc/QOwnNotes.profile
+++ b/etc/QOwnNotes.profile
@@ -11,7 +11,13 @@ noblacklist ${HOME}/Nextcloud/Notes
 noblacklist ${HOME}/.config/PBE
 noblacklist ${HOME}/.local/share/PBE
 
-mkdir ${DOCUMENTS}
+include disable-common.inc
+include disable-devel.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include disable-xdg.inc
+
 mkdir ${HOME}/Nextcloud/Notes
 mkdir ${HOME}.config/PBE
 mkdir ${HOME}/.local/share/PBE
@@ -22,13 +28,6 @@ whitelist ${HOME}/.local/share/PBE
 include whitelist-common.inc
 include whitelist-var-common.inc
 
-include disable-common.inc
-include disable-devel.inc
-include disable-interpreters.inc
-include disable-passwdmgr.inc
-include disable-programs.inc
-include disable-xdg.inc
-
 caps.drop all
 machine-id
 netfilter
diff --git a/etc/baloo_file.profile b/etc/baloo_file.profile
index 0d108ac13..176d8cae7 100644
--- a/etc/baloo_file.profile
+++ b/etc/baloo_file.profile
@@ -7,7 +7,7 @@ include globals.local
 
 # Make home directory read-only and allow writing only to ${HOME}/.local/share
 # Note: Baloo will not be able to update the "first run" key in its configuration files.
-# read-only  ${HOME}
+# read-only ${HOME}
 # read-write ${HOME}/.local/share
 
 noblacklist ${HOME}/.config/baloofilerc
diff --git a/etc/bitcoin-qt.profile b/etc/bitcoin-qt.profile
index 54c04f837..74123ee51 100644
--- a/etc/bitcoin-qt.profile
+++ b/etc/bitcoin-qt.profile
@@ -7,6 +7,7 @@ include bitcoin-qt.local
 include globals.local
 
 noblacklist ${HOME}/.bitcoin
+noblacklist ${HOME}/.config/Bitcoin
 
 include disable-common.inc
 include disable-devel.inc
diff --git a/etc/brackets.profile b/etc/brackets.profile
index 783b9db87..cead6ec24 100644
--- a/etc/brackets.profile
+++ b/etc/brackets.profile
@@ -12,7 +12,6 @@ noblacklist ${HOME}/.config/Brackets
 #noblacklist ${HOME}/.cargo/config
 #noblacklist ${HOME}/.cargo/registry
 
-
 include disable-common.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
diff --git a/etc/bsdtar.profile b/etc/bsdtar.profile
index a2cd5e559..b6b673976 100644
--- a/etc/bsdtar.profile
+++ b/etc/bsdtar.profile
@@ -6,14 +6,14 @@ include bsdtar.local
 # Persistent global definitions
 include globals.local
 
+blacklist /tmp/.X11-unix
+
 include disable-common.inc
 # include disable-devel.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
-blacklist /tmp/.X11-unix
-
 caps.drop all
 hostname bsdtar
 ipc-namespace
diff --git a/etc/clawsker.profile b/etc/clawsker.profile
index a3ae74582..404e1b8ed 100644
--- a/etc/clawsker.profile
+++ b/etc/clawsker.profile
@@ -21,6 +21,7 @@ include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
+mkdir ${HOME}/.claws-mail
 whitelist ${HOME}/.claws-mail
 include whitelist-common.inc
 
@@ -40,8 +41,7 @@ protocol unix
 seccomp
 shell none
 
-# disable-mnt
-# private
+disable-mnt
 private-bin clawsker,perl
 private-cache
 private-dev
diff --git a/etc/d-feet.profile b/etc/d-feet.profile
index aa4ab191b..a7068383d 100644
--- a/etc/d-feet.profile
+++ b/etc/d-feet.profile
@@ -21,6 +21,7 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist ${HOME}/.config/d-feet
 include whitelist-common.inc
 include whitelist-var-common.inc
 
diff --git a/etc/dconf-editor.profile b/etc/dconf-editor.profile
index 72b4f7a77..5f498f58c 100644
--- a/etc/dconf-editor.profile
+++ b/etc/dconf-editor.profile
@@ -20,7 +20,6 @@ caps.drop all
 machine-id
 net none
 no3d
-# nodbus - DBUS is needed to commit changes to dconf
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/dconf.profile b/etc/dconf.profile
index 0f1869fb8..d2376cc35 100644
--- a/etc/dconf.profile
+++ b/etc/dconf.profile
@@ -13,8 +13,7 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
-mkdir ${HOME}/.config/dconf
-whitelist ${HOME}/.config/dconf
+# dconf paths are whitelisted by the following
 include whitelist-common.inc
 
 apparmor
diff --git a/etc/dig.profile b/etc/dig.profile
index 6d5e97ac3..23970d9d0 100644
--- a/etc/dig.profile
+++ b/etc/dig.profile
@@ -7,13 +7,16 @@ include dig.local
 # Persistent global definitions
 include globals.local
 
+noblacklist ${HOME}/.digrc
+
 include disable-common.inc
 # include disable-devel.inc
 # include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
-#include disable-xdg.inc
+include disable-xdg.inc
 
+mkfile ${HOME}/.digrc
 whitelist ${HOME}/.digrc
 include whitelist-common.inc
 include whitelist-var-common.inc
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index b1717d086..4ed3ba2ea 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -288,6 +288,7 @@ blacklist ${HOME}/.curlrc
 blacklist ${HOME}/.dashcore
 blacklist ${HOME}/.devilspie
 blacklist ${HOME}/.dia
+blacklist ${HOME}/.digrc
 blacklist ${HOME}/.dillo
 blacklist ${HOME}/.dooble
 blacklist ${HOME}/.dosbox
diff --git a/etc/discord-common.profile b/etc/discord-common.profile
index c520454e8..c453d77d0 100644
--- a/etc/discord-common.profile
+++ b/etc/discord-common.profile
@@ -12,6 +12,8 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 
 whitelist ${DOWNLOADS}
+include whitelist-common.inc
+include whitelist-var-common.inc
 
 caps.drop all
 netfilter
diff --git a/etc/gconf-editor.profile b/etc/gconf-editor.profile
index a5132e937..20cc5c36f 100644
--- a/etc/gconf-editor.profile
+++ b/etc/gconf-editor.profile
@@ -15,6 +15,7 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist ${HOME}/.config/gconf
 include whitelist-common.inc
 
 apparmor
@@ -22,7 +23,6 @@ caps.drop all
 machine-id
 net none
 no3d
-# nodbus - DBUS is needed to commit changes to gconf
 nodvd
 nogroups
 nonewprivs
diff --git a/etc/gitter.profile b/etc/gitter.profile
index d84f01f20..ab333d1fb 100644
--- a/etc/gitter.profile
+++ b/etc/gitter.profile
@@ -14,6 +14,7 @@ include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
+mkdir ${HOME}/.config/Gitter
 whitelist ${DOWNLOADS}
 whitelist ${HOME}/.config/autostart
 whitelist ${HOME}/.config/Gitter
diff --git a/etc/gucharmap.profile b/etc/gucharmap.profile
index c85424de9..b1bd59307 100644
--- a/etc/gucharmap.profile
+++ b/etc/gucharmap.profile
@@ -14,6 +14,9 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+include whitelist-common.inc
+include whitelist-var-common.inc
+
 apparmor
 caps.drop all
 machine-id
@@ -32,8 +35,6 @@ seccomp
 shell none
 
 disable-mnt
-# for GTK theme support comment 'private'
-private
 private-cache
 private-dev
 private-tmp
@@ -42,5 +43,4 @@ memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
 
-# gucharmap will never write anything
 read-only ${HOME}
diff --git a/etc/hedgewars.profile b/etc/hedgewars.profile
index 4dfb40890..1e9f898e0 100644
--- a/etc/hedgewars.profile
+++ b/etc/hedgewars.profile
@@ -14,7 +14,7 @@ include disable-interpreters.inc
 include disable-passwdmgr.inc
 include disable-programs.inc
 
-mkdir     ${HOME}/.hedgewars
+mkdir ${HOME}/.hedgewars
 whitelist ${HOME}/.hedgewars
 include whitelist-common.inc
 
diff --git a/etc/mendeleydesktop.profile b/etc/mendeleydesktop.profile
index 3a5edc364..046526310 100644
--- a/etc/mendeleydesktop.profile
+++ b/etc/mendeleydesktop.profile
@@ -7,7 +7,6 @@ include mendeleydesktop.local
 include globals.local
 
 noblacklist ${DOCUMENTS}
-noblacklist ${DOWNLOADS}
 noblacklist ${HOME}/.cache/Mendeley Ltd.
 noblacklist ${HOME}/.config/Mendeley Ltd.
 noblacklist ${HOME}/.local/share/Mendeley Ltd.
diff --git a/etc/min.profile b/etc/min.profile
index c44855636..eb1163175 100644
--- a/etc/min.profile
+++ b/etc/min.profile
@@ -17,9 +17,11 @@ include disable-interpreters.inc
 include disable-programs.inc
 
 mkdir ${HOME}/.pki
+mkdir ${HOME}/.config/Min
 mkdir ${HOME}/.local/share/pki
 whitelist ${DOWNLOADS}
 whitelist ${HOME}/.pki
+whitelist ${HOME}/.config/Min
 whitelist ${HOME}/.local/share/pki
 include whitelist-common.inc
 include whitelist-var-common.inc
diff --git a/etc/mpDris2.profile b/etc/mpDris2.profile
index 909144fc2..48b5070f6 100644
--- a/etc/mpDris2.profile
+++ b/etc/mpDris2.profile
@@ -48,5 +48,4 @@ private-tmp
 noexec ${HOME}
 noexec /tmp
 
-# mpDris2 will never write anything
 read-only ${HOME}
diff --git a/etc/mupdf.profile b/etc/mupdf.profile
index 59ad36305..c1d4f2cbe 100644
--- a/etc/mupdf.profile
+++ b/etc/mupdf.profile
@@ -40,5 +40,4 @@ private-dev
 private-etc alternatives,fonts
 private-tmp
 
-# mupdf will never write anything
 read-only ${HOME}
diff --git a/etc/qbittorrent.profile b/etc/qbittorrent.profile
index 0420d38e9..7b1f05574 100644
--- a/etc/qbittorrent.profile
+++ b/etc/qbittorrent.profile
@@ -25,8 +25,9 @@ include disable-programs.inc
 
 mkdir ${HOME}/.cache/qBittorrent
 mkdir ${HOME}/.config/qBittorrent
+mkfile ${HOME}/.config/qBittorrentrc
 mkdir ${HOME}/.local/share/data/qBittorrent
-whitelist  ${DOWNLOADS}
+whitelist ${DOWNLOADS}
 whitelist ${HOME}/.cache/qBittorrent
 whitelist ${HOME}/.config/qBittorrent
 whitelist ${HOME}/.config/qBittorrentrc
diff --git a/etc/skypeforlinux.profile b/etc/skypeforlinux.profile
index f8198adab..ad200be37 100644
--- a/etc/skypeforlinux.profile
+++ b/etc/skypeforlinux.profile
@@ -30,4 +30,4 @@ private-cache
 private-tmp
 
 noexec ${HOME}
-# noexec /tmp  - breaks Skype
+# noexec /tmp - breaks Skype
diff --git a/etc/transgui.profile b/etc/transgui.profile
index 21daa0685..83191ab58 100644
--- a/etc/transgui.profile
+++ b/etc/transgui.profile
@@ -1,5 +1,5 @@
 # Firejail profile for transgui
-# Description:  Cross-platform Transmission BitTorrent client
+# Description: Cross-platform Transmission BitTorrent client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include /etc/firejail/transgui.local
@@ -7,7 +7,6 @@ include /etc/firejail/transgui.local
 include globals.local
 
 noblacklist ${HOME}/.config/transgui
-noblacklist ${DOWNLOADS}
 
 include disable-common.inc
 include disable-devel.inc
@@ -18,6 +17,7 @@ include disable-xdg.inc
 
 mkdir ${HOME}/.config/transgui
 whitelist ${HOME}/.config/transgui
+whitelist ${DOWNLOADS}
 include whitelist-common.inc
 include whitelist-var-common.inc
 
diff --git a/etc/transmission-gtk.profile b/etc/transmission-gtk.profile
index 867f9f113..00de26003 100644
--- a/etc/transmission-gtk.profile
+++ b/etc/transmission-gtk.profile
@@ -17,7 +17,7 @@ include disable-programs.inc
 
 mkdir ${HOME}/.cache/transmission
 mkdir ${HOME}/.config/transmission
-whitelist  ${DOWNLOADS}
+whitelist ${DOWNLOADS}
 whitelist ${HOME}/.cache/transmission
 whitelist ${HOME}/.config/transmission
 include whitelist-common.inc
diff --git a/etc/transmission-qt.profile b/etc/transmission-qt.profile
index 81b8f38cf..96d9b4bb0 100644
--- a/etc/transmission-qt.profile
+++ b/etc/transmission-qt.profile
@@ -17,7 +17,7 @@ include disable-programs.inc
 
 mkdir ${HOME}/.cache/transmission
 mkdir ${HOME}/.config/transmission
-whitelist  ${DOWNLOADS}
+whitelist ${DOWNLOADS}
 whitelist ${HOME}/.cache/transmission
 whitelist ${HOME}/.config/transmission
 include whitelist-common.inc
diff --git a/etc/xfce4-mixer.profile b/etc/xfce4-mixer.profile
index 093fba362..9c8c5c531 100644
--- a/etc/xfce4-mixer.profile
+++ b/etc/xfce4-mixer.profile
@@ -15,6 +15,7 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+mkfile ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml
 whitelist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml
 include whitelist-common.inc
 include whitelist-var-common.inc