From dfca5a379b53144ae0d9cdd1de724bb5c9014a3d Mon Sep 17 00:00:00 2001 From: bbhtt <62639087+bbhtt@users.noreply.github.com> Date: Mon, 28 Dec 2020 14:01:55 +0000 Subject: Add secret storage dbus --- etc/profile-a-l/element-desktop.profile | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/etc/profile-a-l/element-desktop.profile b/etc/profile-a-l/element-desktop.profile index 2d56369cd..48a826f2e 100644 --- a/etc/profile-a-l/element-desktop.profile +++ b/etc/profile-a-l/element-desktop.profile @@ -7,6 +7,8 @@ include element-desktop.local # added by included profile #include globals.local +ignore dbus-user none + noblacklist ${HOME}/.config/Element mkdir ${HOME}/.config/Element @@ -15,5 +17,8 @@ whitelist /opt/Element private-opt Element +dbus-user filter +dbus-user.talk org.freedesktop.secrets + # Redirect include riot-desktop.profile -- cgit v1.2.3-70-g09d2 From 5365e8caf0a07a466b930f20e10935c232971a92 Mon Sep 17 00:00:00 2001 From: bbhtt <62639087+bbhtt@users.noreply.github.com> Date: Mon, 28 Dec 2020 14:02:32 +0000 Subject: Calls each program from /bin to populate list --- etc/profile-a-l/alacarte.profile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/profile-a-l/alacarte.profile b/etc/profile-a-l/alacarte.profile index 8f7640ffe..98188d2a7 100644 --- a/etc/profile-a-l/alacarte.profile +++ b/etc/profile-a-l/alacarte.profile @@ -49,7 +49,7 @@ shell none tracelog disable-mnt -private-bin alacarte,bash,python*,sh +# private-bin alacarte,bash,python*,sh private-cache private-dev private-etc alternatives,dconf,fonts,gtk-3.0,locale.alias,locale.conf,login.defs,mime.types,nsswitch.conf,passwd,pki,X11,xdg -- cgit v1.2.3-70-g09d2 From 66e1f35cf2c14ab5fec541668ece290f479d0ad8 Mon Sep 17 00:00:00 2001 From: bbhtt <62639087+bbhtt@users.noreply.github.com> Date: Mon, 28 Dec 2020 14:03:30 +0000 Subject: Add quiet --- etc/profile-a-l/feh.profile | 1 + etc/profile-a-l/links.profile | 1 + etc/profile-a-l/lynx.profile | 1 + 3 files changed, 3 insertions(+) diff --git a/etc/profile-a-l/feh.profile b/etc/profile-a-l/feh.profile index 3ee07e559..8ac7755de 100644 --- a/etc/profile-a-l/feh.profile +++ b/etc/profile-a-l/feh.profile @@ -1,6 +1,7 @@ # Firejail profile for feh # Description: imlib2 based image viewer # This file is overwritten after every install/update +quiet # Persistent local customizations include feh.local # Persistent global definitions diff --git a/etc/profile-a-l/links.profile b/etc/profile-a-l/links.profile index b2f94d3cf..ccc77f274 100644 --- a/etc/profile-a-l/links.profile +++ b/etc/profile-a-l/links.profile @@ -1,6 +1,7 @@ # Firejail profile for links # Description: Text WWW browser # This file is overwritten after every install/update +quiet # Persistent local customizations include links.local # Persistent global definitions diff --git a/etc/profile-a-l/lynx.profile b/etc/profile-a-l/lynx.profile index dbd0a61e5..76a0e7ed0 100644 --- a/etc/profile-a-l/lynx.profile +++ b/etc/profile-a-l/lynx.profile @@ -1,6 +1,7 @@ # Firejail profile for lynx # Description: Classic non-graphical (text-mode) web browser # This file is overwritten after every install/update +quiet # Persistent local customizations include lynx.local # Persistent global definitions -- cgit v1.2.3-70-g09d2 From 31b92b33cfc827a3215584b50f56418e7fd75be0 Mon Sep 17 00:00:00 2001 From: bbhtt <62639087+bbhtt@users.noreply.github.com> Date: Mon, 28 Dec 2020 14:04:25 +0000 Subject: Add whitelists, remove wrong cache whitelist, add dbus rules, apparmor --- etc/profile-m-z/nheko.profile | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/etc/profile-m-z/nheko.profile b/etc/profile-m-z/nheko.profile index 701098f4b..7a3f59159 100644 --- a/etc/profile-m-z/nheko.profile +++ b/etc/profile-m-z/nheko.profile @@ -16,14 +16,19 @@ include disable-interpreters.inc include disable-passwdmgr.inc include disable-programs.inc include disable-shell.inc +include disable-xdg.inc mkdir ${HOME}/.config/nheko mkdir ${HOME}/.cache/nheko/nheko whitelist ${HOME}/.config/nheko -whitelist ${HOME}/.cache/nheko/nheko +whitelist ${HOME}/.cache/nheko whitelist ${DOWNLOADS} include whitelist-common.inc +include whitelist-runuser-common.inc +include whitelist-usr-share-common.inc +include whitelist-var-common.inc +apparmor caps.drop all netfilter nodvd @@ -38,5 +43,12 @@ tracelog disable-mnt private-bin nheko +private-cache +private-dev +private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg private-tmp +dbus-user filter +dbus-user.talk org.freedesktop.Notifications +dbus-user.talk org.kde.StatusNotifierWatcher +dbus-system none -- cgit v1.2.3-70-g09d2 From 015a7c9b56c93734f3667abbbcd40462e7fb330e Mon Sep 17 00:00:00 2001 From: bbhtt <62639087+bbhtt@users.noreply.github.com> Date: Mon, 28 Dec 2020 14:04:43 +0000 Subject: Add dbus rules --- etc/profile-m-z/spectral.profile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/etc/profile-m-z/spectral.profile b/etc/profile-m-z/spectral.profile index 66e917432..5f8d5de86 100644 --- a/etc/profile-m-z/spectral.profile +++ b/etc/profile-m-z/spectral.profile @@ -49,5 +49,7 @@ private-dev private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg private-tmp -dbus-user none +dbus-user filter +dbus-user.talk org.freedesktop.Notifications +dbus-user.talk org.kde.StatusNotifierWatcher dbus-system none -- cgit v1.2.3-70-g09d2 From 41de6120c42d5b56690cadcb6d62348485cecd14 Mon Sep 17 00:00:00 2001 From: bbhtt <62639087+bbhtt@users.noreply.github.com> Date: Mon, 28 Dec 2020 14:16:53 +0000 Subject: Fix Nheko cache directory --- etc/inc/disable-programs.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 07fefec8c..7423d53fa 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc @@ -958,7 +958,7 @@ blacklist ${HOME}/.cache/ms-skype-online blacklist ${HOME}/.cache/ms-word-online blacklist ${HOME}/.cache/mutt blacklist ${HOME}/.cache/mypaint -blacklist ${HOME}/.cache/nheko/nheko +blacklist ${HOME}/.cache/nheko blacklist ${HOME}/.cache/netsurf blacklist ${HOME}/.cache/okular blacklist ${HOME}/.cache/opera -- cgit v1.2.3-70-g09d2 From 7268981f6014ea647619196734c03b729128b07f Mon Sep 17 00:00:00 2001 From: bbhtt <62639087+bbhtt@users.noreply.github.com> Date: Tue, 29 Dec 2020 03:18:42 +0000 Subject: Put a comment about dbus rules and comment them --- etc/profile-m-z/nheko.profile | 10 ++++++---- etc/profile-m-z/spectral.profile | 8 +++++--- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/etc/profile-m-z/nheko.profile b/etc/profile-m-z/nheko.profile index 7a3f59159..42e7e92fc 100644 --- a/etc/profile-m-z/nheko.profile +++ b/etc/profile-m-z/nheko.profile @@ -7,7 +7,7 @@ include nheko.local include globals.local noblacklist ${HOME}/.config/nheko -noblacklist ${HOME}/.cache/nheko/nheko +noblacklist ${HOME}/.cache/nheko include disable-common.inc include disable-devel.inc @@ -48,7 +48,9 @@ private-dev private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg private-tmp -dbus-user filter -dbus-user.talk org.freedesktop.Notifications -dbus-user.talk org.kde.StatusNotifierWatcher +dbus-user none +# Comment the above line and uncomment below lines for notification popups +# dbus-user filter +# dbus-user.talk org.freedesktop.Notifications +# dbus-user.talk org.kde.StatusNotifierWatcher dbus-system none diff --git a/etc/profile-m-z/spectral.profile b/etc/profile-m-z/spectral.profile index 5f8d5de86..093661d8c 100644 --- a/etc/profile-m-z/spectral.profile +++ b/etc/profile-m-z/spectral.profile @@ -49,7 +49,9 @@ private-dev private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg private-tmp -dbus-user filter -dbus-user.talk org.freedesktop.Notifications -dbus-user.talk org.kde.StatusNotifierWatcher +dbus-user none +# Comment the above line and uncomment below lines for notification popups +# dbus-user filter +# dbus-user.talk org.freedesktop.Notifications +# dbus-user.talk org.kde.StatusNotifierWatcher dbus-system none -- cgit v1.2.3-70-g09d2