From 67f5ae8a4f80bffe2452f5fa406d7e49e61cd2c2 Mon Sep 17 00:00:00 2001 From: glitsj16 Date: Tue, 25 Jul 2023 19:30:19 +0000 Subject: firefox(-based) profiles: refactor wusc (#5914) --- etc/profile-a-l/abrowser.profile | 1 + etc/profile-a-l/basilisk.profile | 1 + etc/profile-a-l/cachy-browser.profile | 7 +------ etc/profile-a-l/cliqz.profile | 1 + etc/profile-a-l/cyberfox.profile | 2 ++ etc/profile-a-l/firedragon.profile | 1 + etc/profile-a-l/firefox-common-addons.profile | 1 - etc/profile-a-l/firefox-common.profile | 5 +++++ etc/profile-a-l/firefox.profile | 5 ----- etc/profile-a-l/icecat.profile | 1 + etc/profile-a-l/librewolf.profile | 5 ----- etc/profile-m-z/palemoon.profile | 2 ++ etc/profile-m-z/thunderbird.profile | 3 --- etc/profile-m-z/waterfox.profile | 1 + 14 files changed, 16 insertions(+), 20 deletions(-) diff --git a/etc/profile-a-l/abrowser.profile b/etc/profile-a-l/abrowser.profile index 2e6e8f1af..8b70756ba 100644 --- a/etc/profile-a-l/abrowser.profile +++ b/etc/profile-a-l/abrowser.profile @@ -12,6 +12,7 @@ mkdir ${HOME}/.cache/mozilla/abrowser mkdir ${HOME}/.mozilla whitelist ${HOME}/.cache/mozilla/abrowser whitelist ${HOME}/.mozilla +whitelist /usr/share/abrowser # private-etc must first be enabled in firefox-common.profile #private-etc abrowser diff --git a/etc/profile-a-l/basilisk.profile b/etc/profile-a-l/basilisk.profile index a962bfe02..7d2fe143c 100644 --- a/etc/profile-a-l/basilisk.profile +++ b/etc/profile-a-l/basilisk.profile @@ -12,6 +12,7 @@ mkdir ${HOME}/.cache/moonchild productions/basilisk mkdir ${HOME}/.moonchild productions whitelist ${HOME}/.cache/moonchild productions/basilisk whitelist ${HOME}/.moonchild productions +whitelist /usr/share/basilisk # Basilisk can use the full firejail seccomp filter (unlike firefox >= 60) seccomp diff --git a/etc/profile-a-l/cachy-browser.profile b/etc/profile-a-l/cachy-browser.profile index 7a14d9464..4b486913e 100644 --- a/etc/profile-a-l/cachy-browser.profile +++ b/etc/profile-a-l/cachy-browser.profile @@ -13,6 +13,7 @@ mkdir ${HOME}/.cache/cachy mkdir ${HOME}/.cachy whitelist ${HOME}/.cache/cachy whitelist ${HOME}/.cachy +whitelist /usr/share/cachy-browser # Add the next lines to your cachy-browser.local if you want to use the migration wizard. #noblacklist ${HOME}/.mozilla @@ -23,12 +24,6 @@ whitelist ${HOME}/.cachy #whitelist ${RUNUSER}/kpxc_server #whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer -whitelist /usr/share/doc -whitelist /usr/share/gtk-doc/html -whitelist /usr/share/mozilla -whitelist /usr/share/webext -include whitelist-usr-share-common.inc - # Add the next line to your cachy-browser.local to enable private-bin (Arch Linux). #private-bin dbus-launch,dbus-send,cachy-browser,sh # Add the next line to your cachy-browser.local to enable private-etc. diff --git a/etc/profile-a-l/cliqz.profile b/etc/profile-a-l/cliqz.profile index d0b8cc0ef..d0bf9797e 100644 --- a/etc/profile-a-l/cliqz.profile +++ b/etc/profile-a-l/cliqz.profile @@ -15,6 +15,7 @@ mkdir ${HOME}/.config/cliqz whitelist ${HOME}/.cache/cliqz whitelist ${HOME}/.cliqz whitelist ${HOME}/.config/cliqz +whitelist /usr/share/cliqz # private-etc must first be enabled in firefox-common.profile #private-etc cliqz diff --git a/etc/profile-a-l/cyberfox.profile b/etc/profile-a-l/cyberfox.profile index d1fff0004..a303c5979 100644 --- a/etc/profile-a-l/cyberfox.profile +++ b/etc/profile-a-l/cyberfox.profile @@ -12,6 +12,8 @@ mkdir ${HOME}/.8pecxstudios mkdir ${HOME}/.cache/8pecxstudios whitelist ${HOME}/.8pecxstudios whitelist ${HOME}/.cache/8pecxstudios +whitelist /usr/share/8pecxstudios +whitelist /usr/share/cyberfox # private-bin cyberfox,dbus-launch,dbus-send,env,sh,which # private-etc must first be enabled in firefox-common.profile diff --git a/etc/profile-a-l/firedragon.profile b/etc/profile-a-l/firedragon.profile index 77487161e..3177fb989 100644 --- a/etc/profile-a-l/firedragon.profile +++ b/etc/profile-a-l/firedragon.profile @@ -13,6 +13,7 @@ mkdir ${HOME}/.cache/firedragon mkdir ${HOME}/.firedragon whitelist ${HOME}/.cache/firedragon whitelist ${HOME}/.firedragon +whitelist /usr/share/firedragon # Add the next lines to your firedragon.local if you want to use the migration wizard. #noblacklist ${HOME}/.mozilla diff --git a/etc/profile-a-l/firefox-common-addons.profile b/etc/profile-a-l/firefox-common-addons.profile index 6dc1fca8a..f12750fda 100644 --- a/etc/profile-a-l/firefox-common-addons.profile +++ b/etc/profile-a-l/firefox-common-addons.profile @@ -74,7 +74,6 @@ whitelist ${HOME}/.zotero whitelist ${HOME}/dwhelper whitelist /usr/share/lua whitelist /usr/share/lua* -whitelist /usr/share/vulkan # GNOME Shell integration (chrome-gnome-shell) needs dbus and python noblacklist ${HOME}/.local/share/gnome-shell diff --git a/etc/profile-a-l/firefox-common.profile b/etc/profile-a-l/firefox-common.profile index 42d12c5d9..9c8601e7b 100644 --- a/etc/profile-a-l/firefox-common.profile +++ b/etc/profile-a-l/firefox-common.profile @@ -29,9 +29,14 @@ mkdir ${HOME}/.pki whitelist ${DOWNLOADS} whitelist ${HOME}/.local/share/pki whitelist ${HOME}/.pki +whitelist /usr/share/doc +whitelist /usr/share/gtk-doc/html +whitelist /usr/share/mozilla +whitelist /usr/share/webext include whitelist-common.inc include whitelist-run-common.inc include whitelist-runuser-common.inc +include whitelist-usr-share-common.inc include whitelist-var-common.inc apparmor diff --git a/etc/profile-a-l/firefox.profile b/etc/profile-a-l/firefox.profile index 1fcbf0562..c5fb15f74 100644 --- a/etc/profile-a-l/firefox.profile +++ b/etc/profile-a-l/firefox.profile @@ -34,15 +34,10 @@ whitelist ${HOME}/.mozilla #whitelist ${RUNUSER}/kpxc_server #whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer -whitelist /usr/share/doc whitelist /usr/share/firefox whitelist /usr/share/gnome-shell/search-providers/firefox-search-provider.ini -whitelist /usr/share/gtk-doc/html -whitelist /usr/share/mozilla -whitelist /usr/share/webext whitelist ${RUNUSER}/*firefox* whitelist ${RUNUSER}/psd/*firefox* -include whitelist-usr-share-common.inc # firefox requires a shell to launch on Arch - add the next line to your firefox.local to enable private-bin. #private-bin bash,dbus-launch,dbus-send,env,firefox,sh,which diff --git a/etc/profile-a-l/icecat.profile b/etc/profile-a-l/icecat.profile index 660343a29..b0a42fb77 100644 --- a/etc/profile-a-l/icecat.profile +++ b/etc/profile-a-l/icecat.profile @@ -12,6 +12,7 @@ mkdir ${HOME}/.cache/mozilla/icecat mkdir ${HOME}/.mozilla whitelist ${HOME}/.cache/mozilla/icecat whitelist ${HOME}/.mozilla +whitelist /usr/share/icecat # private-etc must first be enabled in firefox-common.profile #private-etc icecat diff --git a/etc/profile-a-l/librewolf.profile b/etc/profile-a-l/librewolf.profile index b84cbb119..7ddbda18c 100644 --- a/etc/profile-a-l/librewolf.profile +++ b/etc/profile-a-l/librewolf.profile @@ -23,12 +23,7 @@ whitelist ${HOME}/.librewolf #whitelist ${RUNUSER}/kpxc_server #whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer -whitelist /usr/share/doc -whitelist /usr/share/gtk-doc/html whitelist /usr/share/librewolf -whitelist /usr/share/mozilla -whitelist /usr/share/webext -include whitelist-usr-share-common.inc # Add the next line to your librewolf.local to enable private-bin (Arch Linux). #private-bin dbus-launch,dbus-send,librewolf,sh diff --git a/etc/profile-m-z/palemoon.profile b/etc/profile-m-z/palemoon.profile index 24701b657..ab4e24595 100644 --- a/etc/profile-m-z/palemoon.profile +++ b/etc/profile-m-z/palemoon.profile @@ -12,6 +12,8 @@ mkdir ${HOME}/.cache/moonchild productions/pale moon mkdir ${HOME}/.moonchild productions whitelist ${HOME}/.cache/moonchild productions/pale moon whitelist ${HOME}/.moonchild productions +whitelist /usr/share/moonchild productions +whitelist /usr/share/palemoon # Palemoon can use the full firejail seccomp filter (unlike firefox >= 60) seccomp diff --git a/etc/profile-m-z/thunderbird.profile b/etc/profile-m-z/thunderbird.profile index 5df207e25..f2405a7d3 100644 --- a/etc/profile-m-z/thunderbird.profile +++ b/etc/profile-m-z/thunderbird.profile @@ -47,10 +47,7 @@ whitelist ${HOME}/.thunderbird whitelist /usr/share/gnupg whitelist /usr/share/gnupg2 -whitelist /usr/share/mozilla whitelist /usr/share/thunderbird -whitelist /usr/share/webext -include whitelist-usr-share-common.inc # machine-id breaks audio in browsers; enable or put it in your thunderbird.local when sound is not required #machine-id diff --git a/etc/profile-m-z/waterfox.profile b/etc/profile-m-z/waterfox.profile index 18f1ca79a..bf6f45e41 100644 --- a/etc/profile-m-z/waterfox.profile +++ b/etc/profile-m-z/waterfox.profile @@ -12,6 +12,7 @@ mkdir ${HOME}/.cache/waterfox mkdir ${HOME}/.waterfox whitelist ${HOME}/.cache/waterfox whitelist ${HOME}/.waterfox +whitelist /usr/share/waterfox # Add the next lines to your watefox.local if you want to use the migration wizard. #noblacklist ${HOME}/.mozilla -- cgit v1.2.3-70-g09d2