1 files changed, 46 insertions, 27 deletions

diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c
index 96a83954d..1726b4dbb 100644
--- a/src/fbuilder/build_profile.c
+++ b/src/fbuilder/build_profile.c
@@ -141,6 +141,12 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
         if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
                 if (fp == stdout)
                         printf("--- Built profile beings after this line ---\n");
+                fprintf(fp, "# Save this file as \"application.profile\" (change \"application\" with the\n");
+                fprintf(fp, "# program name) in ~/.config/firejail directory. Firejail will find it\n");
+                fprintf(fp, "# automatically every time you sandbox your application.\n#\n");
+                fprintf(fp, "# Run \"firejail application\" to test it. In the file there are\n");
+                fprintf(fp, "# some other commands you can try. Enable them by removing the \"#\".\n\n");
+
                 fprintf(fp, "# Firejail profile for %s\n", argv[index]);
                 fprintf(fp, "# Persistent local customizations\n");
                 fprintf(fp, "#include %s.local\n", argv[index]);
@@ -148,56 +154,69 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
                 fprintf(fp, "#include globals.local\n");
                 fprintf(fp, "\n");
 
-                fprintf(fp, "### basic blacklisting\n");
+                fprintf(fp, "### Basic Blacklisting ###\n");
+                fprintf(fp, "### Enable as many of them as you can! A very important one is\n");
+                fprintf(fp, "### \"disable-exec.inc\". This will make among other things your home\n");
+                fprintf(fp, "### and /tmp directories non-executable.\n");
                 fprintf(fp, "include disable-common.inc\n");
-                fprintf(fp, "# include disable-devel.inc\n");
-                fprintf(fp, "# include disable-exec.inc\n");
-                fprintf(fp, "# include disable-interpreters.inc\n");
+                fprintf(fp, "#include disable-devel.inc\n");
+                fprintf(fp, "#include disable-exec.inc\n");
+                fprintf(fp, "#include disable-interpreters.inc\n");
                 fprintf(fp, "include disable-passwdmgr.inc\n");
-                fprintf(fp, "# include disable-programs.inc\n");
-                fprintf(fp, "# include disable-xdg.inc\n");
+                fprintf(fp, "include disable-programs.inc\n");
+                fprintf(fp, "#include disable-shell.inc\n");
+                fprintf(fp, "#include disable-xdg.inc\n");
                 fprintf(fp, "\n");
 
-                fprintf(fp, "### home directory whitelisting\n");
+                fprintf(fp, "### Home Directory Whitelisting ###\n");
+                fprintf(fp, "### If something goes wrong, this section is the first one to comment out.\n");
+                fprintf(fp, "### Instead, you'll have to relay on the basic blacklisting above.\n");
                 build_home(trace_output, fp);
                 fprintf(fp, "\n");
 
-                fprintf(fp, "### filesystem\n");
-                fprintf(fp, "# /usr/share:\n");
+                fprintf(fp, "### Filesystem Whitelisting ###\n");
                 build_share(trace_output, fp);
-                fprintf(fp, "# /var:\n");
+                //todo: include whitelist-runuser-common.inc
                 build_var(trace_output, fp);
                 fprintf(fp, "\n");
-                fprintf(fp, "# $PATH:\n");
-                build_bin(trace_output, fp);
-                fprintf(fp, "# /dev:\n");
-                build_dev(trace_output, fp);
-                fprintf(fp, "# /etc:\n");
-                build_etc(trace_output, fp);
-                fprintf(fp, "# /tmp:\n");
-                build_tmp(trace_output, fp);
-                fprintf(fp, "\n");
 
-                fprintf(fp, "### security filters\n");
+                fprintf(fp, "#apparmor\n");
                 fprintf(fp, "caps.drop all\n");
+                fprintf(fp, "ipc-namespace\n");
+                fprintf(fp, "netfilter\n");
+                fprintf(fp, "#nodvd\n");
+                fprintf(fp, "#nogroups\n");
+                fprintf(fp, "#noinput\n");
                 fprintf(fp, "nonewprivs\n");
+                fprintf(fp, "noroot\n");
+                fprintf(fp, "#notv\n");
+                fprintf(fp, "#nou2f\n");
+                fprintf(fp, "#novideo\n");
+                build_protocol(trace_output, fp);
                 fprintf(fp, "seccomp\n");
                 if (!have_strace) {
-                        fprintf(fp, "# If you install strace on your system, Firejail will also create a\n");
-                        fprintf(fp, "# whitelisted seccomp filter.\n");
+                        fprintf(fp, "### If you install strace on your system, Firejail will also create a\n");
+                        fprintf(fp, "### whitelisted seccomp filter.\n");
                 }
                 else if (!have_yama_permission)
-                        fprintf(fp, "# Yama security module prevents creation of a whitelisted seccomp filter\n");
+                        fprintf(fp, "### Yama security module prevents creation of a whitelisted seccomp filter\n");
                 else
                         build_seccomp(strace_output, fp);
+                fprintf(fp, "shell none\n");
+                fprintf(fp, "#tracelog\n");
                 fprintf(fp, "\n");
 
-                fprintf(fp, "### network\n");
-                build_protocol(trace_output, fp);
+                fprintf(fp, "#disable-mnt\n");
+                build_bin(trace_output, fp);
+                fprintf(fp, "#private-lib\n");
+                build_dev(trace_output, fp);
+                build_etc(trace_output, fp);
+                build_tmp(trace_output, fp);
                 fprintf(fp, "\n");
 
-                fprintf(fp, "### environment\n");
-                fprintf(fp, "shell none\n");
+                fprintf(fp, "#dbus-user none\n");
+                fprintf(fp, "#dbus-system none\n");
+                fprintf(fp, "#memory-deny-write-execute\n");
 
                 if (!arg_debug) {
                         unlink(trace_output);