20 files changed, 155 insertions, 101 deletions

diff --git a/etc/discord-common.profile b/etc/discord-common.profile
index c453d77d0..44b42aefa 100644
--- a/etc/discord-common.profile
+++ b/etc/discord-common.profile
@@ -32,5 +32,4 @@ private-dev
 private-etc alternatives,fonts,machine-id,localtime,ld.so.cache,ca-certificates,ssl,pki,crypto-policies,resolv.conf
 private-tmp
 
-noexec ${HOME}
 noexec /tmp
diff --git a/etc/evince-previewer.profile b/etc/evince-previewer.profile
index e43bb2da8..bd1ea6aa9 100644
--- a/etc/evince-previewer.profile
+++ b/etc/evince-previewer.profile
@@ -3,7 +3,8 @@
 # Persistent local customizations
 include evince-previewer.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 
 # Redirect
diff --git a/etc/evince-thumbnailer.profile b/etc/evince-thumbnailer.profile
index 4036e1ecb..d11d4e1e1 100644
--- a/etc/evince-thumbnailer.profile
+++ b/etc/evince-thumbnailer.profile
@@ -3,7 +3,8 @@
 # Persistent local customizations
 include evince-thumbnailer.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 
 # Redirect
diff --git a/etc/evince.profile b/etc/evince.profile
index e9b530ece..c10e3b04f 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -20,7 +20,7 @@ include whitelist-var-common.inc
 
 caps.drop all
 machine-id
-# net none breaks AppArmor on Ubuntu systems
+# net none - breaks AppArmor on Ubuntu systems
 netfilter
 no3d
 nodbus
@@ -38,13 +38,12 @@ shell none
 tracelog
 
 private-bin evince,evince-previewer,evince-thumbnailer
+private-cache
 private-dev
-private-etc alternatives,fonts,machine-id
-
+private-etc alternatives,fonts,group,machine-id,passwd
 private-lib evince,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,gconv
-
 private-tmp
 
-#memory-deny-write-execute - breaks application on Archlinux, issue 1803
+# memory-deny-write-execute - might break application (https://github.com/netblue30/firejail/issues/1803)
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/gconf-editor.profile b/etc/gconf-editor.profile
index 20cc5c36f..e9756f8af 100644
--- a/etc/gconf-editor.profile
+++ b/etc/gconf-editor.profile
@@ -4,46 +4,9 @@
 # Persistent local customizations
 include gconf-editor.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
-noblacklist ${HOME}/.config/gconf
 
-include disable-common.inc
-include disable-devel.inc
-include disable-interpreters.inc
-include disable-passwdmgr.inc
-include disable-programs.inc
-include disable-xdg.inc
-
-whitelist ${HOME}/.config/gconf
-include whitelist-common.inc
-
-apparmor
-caps.drop all
-machine-id
-net none
-no3d
-nodvd
-nogroups
-nonewprivs
-noroot
-nosound
-notv
-nou2f
-novideo
-protocol unix
-seccomp
-shell none
-tracelog
-
-disable-mnt
-private-bin gconf-editor
-private-cache
-private-dev
-private-etc alternatives,fonts
-private-lib
-private-tmp
-
-memory-deny-write-execute
-noexec ${HOME}
-noexec /tmp
+# Redirect
+include gconf.profile
diff --git a/etc/gconf-merge-schema.profile b/etc/gconf-merge-schema.profile
new file mode 100644
index 000000000..411b7b815
--- /dev/null
+++ b/etc/gconf-merge-schema.profile
@@ -0,0 +1,12 @@
+# Firejail profile for gconf-merge-schema
+# Description: An obsolete configuration database system (CLI utility)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gconf-merge-schema.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+
+# Redirect
+include gconf.profile
diff --git a/etc/gconf-merge-tree.profile b/etc/gconf-merge-tree.profile
new file mode 100644
index 000000000..66a4226ca
--- /dev/null
+++ b/etc/gconf-merge-tree.profile
@@ -0,0 +1,12 @@
+# Firejail profile for gconf-merge-tree
+# Description: An obsolete configuration database system (CLI utility)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gconf-merge-tree.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+
+# Redirect
+include gconf.profile
diff --git a/etc/gconf.profile b/etc/gconf.profile
new file mode 100644
index 000000000..94af21833
--- /dev/null
+++ b/etc/gconf.profile
@@ -0,0 +1,57 @@
+# Firejail profile for gconf
+# Description: An obsolete configuration database system
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gconf.local
+# Persistent global definitions
+include globals.local
+
+noblacklist ${HOME}/.config/gconf
+
+# Allow python2 (blacklisted by disable-interpreters.inc)
+noblacklist ${PATH}/python2*
+#noblacklist ${PATH}/python3*
+noblacklist /usr/lib/python2*
+#noblacklist /usr/lib/python3*
+
+include disable-common.inc
+include disable-devel.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include disable-xdg.inc
+
+mkdir ${HOME}/.config/gconf
+whitelist ${HOME}/.config/gconf
+include whitelist-common.inc
+
+apparmor
+caps.drop all
+ipc-namespace
+machine-id
+net none
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+nou2f
+novideo
+protocol unix
+seccomp
+shell none
+tracelog
+
+disable-mnt
+private-bin gconf-editor,gconf-merge-*,gconfpkg,gconftool-2,gsettings-*-convert,python2*
+private-cache
+private-dev
+private-etc alternatives,fonts,gconf
+private-lib libpython*,python2*
+private-tmp
+
+memory-deny-write-execute
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/gconfpkg.profile b/etc/gconfpkg.profile
new file mode 100644
index 000000000..1793ce072
--- /dev/null
+++ b/etc/gconfpkg.profile
@@ -0,0 +1,12 @@
+# Firejail profile for gconfpkg
+# Description: An obsolete configuration database system (CLI utility)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gconfpkg.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+
+# Redirect
+include gconf.profile
diff --git a/etc/gconftool-2.profile b/etc/gconftool-2.profile
new file mode 100644
index 000000000..59a2242a7
--- /dev/null
+++ b/etc/gconftool-2.profile
@@ -0,0 +1,12 @@
+# Firejail profile for gconftool-2
+# Description: An obsolete configuration database system (CLI utility)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gconftool-2.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+
+# Redirect
+include gconf.profile
diff --git a/etc/geekbench.profile b/etc/geekbench.profile
index c6e45b7d0..425fb7bb5 100644
--- a/etc/geekbench.profile
+++ b/etc/geekbench.profile
@@ -13,7 +13,7 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
-inclue whitelist-var-common.inc
+include whitelist-var-common.inc
 
 apparmor
 caps.drop all
@@ -40,7 +40,7 @@ disable-mnt
 private-bin bash,geekbenc*,sh
 private-cache
 private-dev
-private-etc alternatives,groups,passwd,lsb-release
+private-etc alternatives,group,passwd,lsb-release
 private-lib libstdc++.so.*
 private-opt none
 private-tmp
@@ -49,5 +49,4 @@ private-tmp
 noexec ${HOME}
 noexec /tmp
 
-# never write anything
 read-only ${HOME}
diff --git a/etc/gpicview.profile b/etc/gpicview.profile
index c43475615..4c66e3772 100644
--- a/etc/gpicview.profile
+++ b/etc/gpicview.profile
@@ -38,7 +38,7 @@ tracelog
 private-bin gpicview
 private-cache
 private-dev
-private-etc alternatives,fonts,groups,passwd
+private-etc alternatives,fonts,group,passwd
 private-lib
 private-tmp
 
diff --git a/etc/gsettings-data-convert.profile b/etc/gsettings-data-convert.profile
new file mode 100644
index 000000000..21a232440
--- /dev/null
+++ b/etc/gsettings-data-convert.profile
@@ -0,0 +1,12 @@
+# Firejail profile for gsettings-data-convert
+# Description: An obsolete configuration database system (CLI utility)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gsettings-data-convert.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+
+# Redirect
+include gconf.profile
diff --git a/etc/gsettings-schema-convert.profile b/etc/gsettings-schema-convert.profile
new file mode 100644
index 000000000..2dbf4fb44
--- /dev/null
+++ b/etc/gsettings-schema-convert.profile
@@ -0,0 +1,12 @@
+# Firejail profile for gsettings-schema-convert
+# Description: An obsolete configuration database system (CLI utility)
+# This file is overwritten after every install/update
+# Persistent local customizations
+include gsettings-schema-convert.local
+# Persistent global definitions
+# added by included profile
+#include globals.local
+
+
+# Redirect
+include gconf.profile
diff --git a/etc/hardinfo.profile b/etc/hardinfo.profile
deleted file mode 100644
index 6be3044b4..000000000
--- a/etc/hardinfo.profile
+++ /dev/null
@@ -1,38 +0,0 @@
-# Firejail profile for hardinfo
-# Description: A system information and benchmark tool
-# This file is overwritten after every install/update
-# Persistent local customizations
-include hardinfo.local
-# Persistent global definitions
-include globals.local
-
-include disable-common.inc
-include disable-devel.inc
-include disable-passwdmgr.inc
-include disable-programs.inc
-include disable-xdg.inc
-
-apparmor
-caps.drop all
-machine-id
-ipc-namespace
-netfilter
-nodbus
-nodvd
-nogroups
-nonewprivs
-noroot
-nosound
-nou2f
-protocol unix,inet,inet6
-seccomp
-shell none
-
-disable-mnt
-private-cache
-private-dev
-private-tmp
-
-# memory-deny-write-execute - Breaks on Arch
-noexec ${HOME}
-noexec /tmp
diff --git a/etc/pavucontrol.profile b/etc/pavucontrol.profile
index 159846a28..6bda9e7d3 100644
--- a/etc/pavucontrol.profile
+++ b/etc/pavucontrol.profile
@@ -15,9 +15,6 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
-mkfile ${HOME}/.config/pavucontrol.ini
-whitelist ${HOME}/.config/pavucontrol.ini
-include whitelist-common.inc
 include whitelist-var-common.inc
 
 apparmor
diff --git a/etc/spectre-meltdown-checker.profile b/etc/spectre-meltdown-checker.profile
index 350f10632..b43047401 100644
--- a/etc/spectre-meltdown-checker.profile
+++ b/etc/spectre-meltdown-checker.profile
@@ -44,7 +44,7 @@ shell none
 
 disable-mnt
 private
-private-bin awk,bzip2,cat,coreos-install,cpucontrol,cut,dd,dmesg,dnf,echo,grep,gunzip,gz,gzip,head,id,kldload,kldstat,liblz4-tool,lzop,mktemp,modinfo,modprobe,mount,nm,objdump,od,perl,printf,readelf,rm,sed,seq,sh,sort,spectre-meltdown-checker,spectre-meltdown-checker.sh,stat,strings,sysctl,tail,test,toolbox,tr,uname,which,xz-utils
+private-bin awk,bzip2,cat,coreos-install,cpucontrol,cut,dd,dirname,dmesg,dnf,echo,grep,gunzip,gz,gzip,head,id,kldload,kldstat,liblz4-tool,lzop,mktemp,modinfo,modprobe,mount,nm,objdump,od,perl,printf,readelf,rm,sed,seq,sh,sort,spectre-meltdown-checker,spectre-meltdown-checker.sh,stat,strings,sysctl,tail,test,toolbox,tr,uname,which,xz-utils
 private-cache
 private-tmp
 
diff --git a/etc/sqlitebrowser.profile b/etc/sqlitebrowser.profile
index 6bdd437cd..8122079e1 100644
--- a/etc/sqlitebrowser.profile
+++ b/etc/sqlitebrowser.profile
@@ -18,10 +18,11 @@ include disable-xdg.inc
 
 include whitelist-var-common.inc
 
+apparmor
 caps.drop all
-net none
-no3d
-nodbus
+ipc-namespace
+netfilter
+# nodbus - breaks proxy creation
 nodvd
 nogroups
 nonewprivs
@@ -30,15 +31,16 @@ nosound
 notv
 nou2f
 novideo
-protocol unix
+protocol unix,inet,inet6,netlink
 seccomp
 shell none
 
 private-bin sqlitebrowser
 private-cache
 private-dev
+private-etc alternatives,ca-certificates,crypto-policies,fonts,group,machine-id,passwd,pki,ssl
 private-tmp
 
-# memory-deny-write-execute - breaks on Arch
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/sysprof-cli.profile b/etc/sysprof-cli.profile
index 28d279d77..62672b22b 100644
--- a/etc/sysprof-cli.profile
+++ b/etc/sysprof-cli.profile
@@ -13,6 +13,8 @@ nodbus
 private-bin sysprof-cli
 private-lib
 
+memory-deny-write-execute
+
 
 # Redirect
 include sysprof.profile
diff --git a/etc/sysprof.profile b/etc/sysprof.profile
index a3135d001..eedf4c4b4 100644
--- a/etc/sysprof.profile
+++ b/etc/sysprof.profile
@@ -42,6 +42,6 @@ private-etc alternatives,fonts,ld.so.cache,machine-id,ssl
 #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so
 private-tmp
 
-memory-deny-write-execute
+# memory-deny-write-execute - Breaks GUI on Arch
 noexec ${HOME}
 noexec /tmp