From 00a17b055e9775051445d60ae5e70458c446f641 Mon Sep 17 00:00:00 2001
From: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
Date: Thu, 4 Feb 2021 17:36:12 +0100
Subject: Add profile for vmware-view

blacklist ${HOME}/.vwmare is already in disable-programs.inc
I did not add it to firecfg.config because it has many extra features
such as usb-redirection that I could not test.
---
 README.md                           |  2 ++
 RELNOTES                            |  4 +++
 etc/profile-m-z/vmware-view.profile | 58 +++++++++++++++++++++++++++++++++++++
 3 files changed, 64 insertions(+)
 create mode 100644 etc/profile-m-z/vmware-view.profile

diff --git a/README.md b/README.md
index e7b38a040..4c6b52d3d 100644
--- a/README.md
+++ b/README.md
@@ -198,3 +198,5 @@ Stats:
 ```
 
 ### New profiles:
+
+vmware-view
diff --git a/RELNOTES b/RELNOTES
index fae29632d..a5d03cd81 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,3 +1,7 @@
+firejail (0.9.65) baseline; urgency=low
+  * new profiles: vmware-view
+
+
 firejail (0.9.64.2) baseline; urgency=low
   * allow --tmpfs inside $HOME for unprivileged users
   * --disable-usertmpfs  compile time option
diff --git a/etc/profile-m-z/vmware-view.profile b/etc/profile-m-z/vmware-view.profile
new file mode 100644
index 000000000..5a5baea3a
--- /dev/null
+++ b/etc/profile-m-z/vmware-view.profile
@@ -0,0 +1,58 @@
+# Firejail profile for vmware-view
+# Description: VMware Horizon Client
+# This file is overwritten after every install/update
+# Persistent local customizations
+include vmware-view.local
+# Persistent global definitions
+include globals.local
+
+noblacklist ${HOME}/.vmware
+
+noblacklist /sbin
+noblacklist /usr/sbin
+
+include allow-bin-sh.inc
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include disable-shell.inc
+include disable-xdg.inc
+
+mkdir ${HOME}/.vmware
+whitelist ${HOME}/.vmware
+include whitelist-common.inc
+include whitelist-runuser-common.inc
+include whitelist-usr-share-common.inc
+include whitelist-var-common.inc
+
+caps.drop all
+netfilter
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+nou2f
+# Comment novideo (or add 'ignore novideo' to your vmware-view.local) if you need your webcam
+novideo
+# protocol produces a lot error messages but nothing seems to be broken
+protocol unix,inet,inet6
+seccomp !iopl
+seccomp.block-secondary
+shell none
+tracelog
+
+disable-mnt
+private-cache
+private-dev
+private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dconf,drirc,fonts,gai.conf,gconf,glvnd,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,machine-id,magic,magic.mgc,mime.types,nsswitch.conf,nvidia,pango,passwd,pki,protocols,proxychains.conf,pulse,resolv.conf,rpc,services,ssl,terminfo,vmware,X11,xdg,vmware-tools,vmware-vix
+# Logs are "stored" in /tmp, comment (or add 'ignore private-tmp' to your vmware-view.local)
+# if you need them without joining the sandbox.
+private-tmp
+
+dbus-user none
+dbus-system none
-- 
cgit v1.2.3-70-g09d2