From 3d02204e7424f84695fb776b43886945514fba7b Mon Sep 17 00:00:00 2001 From: Tad Date: Tue, 22 Aug 2017 12:05:13 -0400 Subject: Add a profile for Neverball --- README.md | 2 +- RELNOTES | 2 +- etc/disable-programs.inc | 1 + etc/neverball.profile | 37 +++++++++++++++++++++++++++++++++++++ platform/debian/conffiles | 1 + src/firecfg/firecfg.config | 1 + 6 files changed, 42 insertions(+), 2 deletions(-) create mode 100644 etc/neverball.profile diff --git a/README.md b/README.md index dd616f8a4..6f1c892aa 100644 --- a/README.md +++ b/README.md @@ -214,4 +214,4 @@ IntelliJ IDEA, Android Studio, electron, riot-web, Extreme Tux Racer, Frozen Bubble, Open Invaders, Pingus, Simutrans, SuperTux, telegram-desktop, arm, rambox, apktool, baobab, dex2jar, gitg, hashcat, obs, picard, remmina, sdat2img, soundconverter, sqlitebrowse, truecraft, gnome-twitch, tuxguitar, -musescore +musescore, neverball diff --git a/RELNOTES b/RELNOTES index 7b0f13737..b50904b4e 100644 --- a/RELNOTES +++ b/RELNOTES @@ -25,7 +25,7 @@ firejail (0.9.49) baseline; urgency=low * new profiles: Frozen Bubble, Open Invaders, Pingus, Simutrans, SuperTux * new profiles: telegram-desktop, arm, rambox, apktool, baobab, dex2jar, gitg, * new profiles: hashcat, obs, picard, remmina, sdat2img, soundconverter, sqlitebrowse, - * new profiles: truecraft, gnome-twitch, tuxguitar, musescore + * new profiles: truecraft, gnome-twitch, tuxguitar, musescore, neverball * bugfixes -- netblue30 Mon, 12 Jun 2017 20:00:00 -0500 diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index 7b0e6e9eb..d02377036 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc @@ -334,6 +334,7 @@ blacklist ${HOME}/.multimc5 blacklist ${HOME}/.mutt blacklist ${HOME}/.mutt/muttrc blacklist ${HOME}/.muttrc +blacklist ${HOME}/.neverball blacklist ${HOME}/.nv blacklist ${HOME}/.nylas-mail blacklist ${HOME}/.openinvaders diff --git a/etc/neverball.profile b/etc/neverball.profile new file mode 100644 index 000000000..6a9a3a577 --- /dev/null +++ b/etc/neverball.profile @@ -0,0 +1,37 @@ +# Firejail profile for neverball +# This file is overwritten after every install/update +# Persistent local customizations +include /etc/firejail/neverball.local +# Persistent global definitions +include /etc/firejail/globals.local + +noblacklist ${HOME}/.neverball + +include /etc/firejail/disable-common.inc +include /etc/firejail/disable-devel.inc +include /etc/firejail/disable-passwdmgr.inc +include /etc/firejail/disable-programs.inc + +mkdir ${HOME}/.neverball +whitelist ${HOME}/.neverball +include /etc/firejail/whitelist-common.inc + +caps.drop all +netfilter +nodvd +nogroups +nonewprivs +noroot +notv +novideo +protocol unix,netlink +seccomp +shell none + +disable-mnt +private-bin neverball +private-dev +private-tmp + +noexec ${HOME} +noexec /tmp diff --git a/platform/debian/conffiles b/platform/debian/conffiles index 6473c6fef..e7eab20a2 100644 --- a/platform/debian/conffiles +++ b/platform/debian/conffiles @@ -220,6 +220,7 @@ /etc/firejail/mutt.profile /etc/firejail/nautilus.profile /etc/firejail/nemo.profile +/etc/firejail/neverball.profile /etc/firejail/netsurf.profile /etc/firejail/nolocal.net /etc/firejail/nylas.profile diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 15e95b9a7..6bdeaab77 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config @@ -197,6 +197,7 @@ musescore mutt nautilus netsurf +neverball nylas obs odt2txt -- cgit v1.2.3-54-g00ecf From a699755ce6740c1d35046621d96fda57592676be Mon Sep 17 00:00:00 2001 From: Tad Date: Tue, 22 Aug 2017 20:05:29 -0400 Subject: Fix Steam regressions --- etc/steam.profile | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/etc/steam.profile b/etc/steam.profile index 96899038a..227162e1f 100644 --- a/etc/steam.profile +++ b/etc/steam.profile @@ -5,12 +5,17 @@ include /etc/firejail/steam.local # Persistent global definitions include /etc/firejail/globals.local -noblacklist ${HOME}/.Steam -noblacklist ${HOME}/.Steampath -noblacklist ${HOME}/.Steampid noblacklist ${HOME}/.java +noblacklist ${HOME}/.killingfloor +noblacklist ${HOME}/.local/share/3909/PapersPlease +noblacklist ${HOME}/.local/share/aspyr-media +noblacklist ${HOME}/.local/share/cdprojektred +noblacklist ${HOME}/.local/share/feral-interactive noblacklist ${HOME}/.local/share/Steam -noblacklist ${HOME}/.local/share/steam +noblacklist ${HOME}/.local/share/SuperHexagon +noblacklist ${HOME}/.local/share/Terraria +noblacklist ${HOME}/.local/share/vpltd +noblacklist ${HOME}/.local/share/vulkan noblacklist ${HOME}/.steam noblacklist ${HOME}/.steampath noblacklist ${HOME}/.steampid @@ -29,12 +34,15 @@ nogroups nonewprivs noroot notv -# novideo +# novideo should be commented for VR +novideo protocol unix,inet,inet6,netlink seccomp shell none # tracelog disabled as it breaks integrated browser # tracelog +# private-dev should be commented for controllers private-dev +private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl private-tmp -- cgit v1.2.3-54-g00ecf From a7f934325a3a4f8ca0dd35e5aaf38d309c46da00 Mon Sep 17 00:00:00 2001 From: Tad Date: Tue, 22 Aug 2017 20:23:01 -0400 Subject: Harden /var --- etc/bitlbee.profile | 1 + etc/disable-common.inc | 12 ++++++++++++ etc/server.profile | 2 ++ 3 files changed, 15 insertions(+) diff --git a/etc/bitlbee.profile b/etc/bitlbee.profile index 0b61e7b9f..1b7b2c258 100644 --- a/etc/bitlbee.profile +++ b/etc/bitlbee.profile @@ -7,6 +7,7 @@ include /etc/firejail/globals.local noblacklist /sbin noblacklist /usr/sbin +noblacklist /var/log include /etc/firejail/disable-common.inc include /etc/firejail/disable-devel.inc diff --git a/etc/disable-common.inc b/etc/disable-common.inc index c220b9c50..294ff6bcb 100644 --- a/etc/disable-common.inc +++ b/etc/disable-common.inc @@ -107,15 +107,27 @@ blacklist ${PATH}/zuluCrypt-cli blacklist ${PATH}/zuluMount-cli # var +blacklist /var/cache/apt +blacklist /var/cache/pacman +blacklist /var/lib/apt +blacklist /var/lib/clamav +blacklist /var/lib/dkms blacklist /var/lib/mysql/mysql.sock blacklist /var/lib/mysqld/mysql.sock +blacklist /var/lib/pacman +blacklist /var/lib/systemd +blacklist /var/lib/upower +blacklist /var/log blacklist /var/mail +blacklist /var/opt blacklist /var/run/acpid.socket blacklist /var/run/docker.sock blacklist /var/run/minissdpd.sock blacklist /var/run/mysql/mysqld.sock blacklist /var/run/mysqld/mysqld.sock blacklist /var/run/rpcbind.sock +blacklist /var/run/screens +blacklist /var/run/systemd blacklist /var/spool/anacron blacklist /var/spool/cron diff --git a/etc/server.profile b/etc/server.profile index 04ef555de..edd4666e1 100644 --- a/etc/server.profile +++ b/etc/server.profile @@ -13,6 +13,8 @@ blacklist /tmp/.X11-unix noblacklist /sbin noblacklist /usr/sbin +# noblacklist /var/log +# noblacklist /var/opt include /etc/firejail/disable-common.inc # include /etc/firejail/disable-devel.inc -- cgit v1.2.3-54-g00ecf From 86edb43ddb0f1457aa5c2c7a22dbecbd36cc7410 Mon Sep 17 00:00:00 2001 From: Tad Date: Tue, 22 Aug 2017 21:51:59 -0400 Subject: Add private-etc to Xonotic --- etc/xonotic.profile | 1 + 1 file changed, 1 insertion(+) diff --git a/etc/xonotic.profile b/etc/xonotic.profile index c7db00daf..fefeac76b 100644 --- a/etc/xonotic.profile +++ b/etc/xonotic.profile @@ -31,6 +31,7 @@ shell none disable-mnt private-bin xonotic-sdl,xonotic-glx,blind-id private-dev +private-etc asound.conf,ca-certificates,drirc,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,pulse,resolv.conf,ssl private-tmp noexec ${HOME} -- cgit v1.2.3-54-g00ecf