From 459a186b2219d9c5e2c1b5e0fc82018f42a8e14e Mon Sep 17 00:00:00 2001 From: rusty-snake <41237666+rusty-snake@users.noreply.github.com> Date: Wed, 19 May 2021 12:00:23 +0200 Subject: Restrict /usr/libexec --- etc/profile-a-l/0ad.profile | 2 ++ etc/profile-a-l/apostrophe.profile | 1 + etc/profile-a-l/bijiben.profile | 1 + etc/profile-a-l/celluloid.profile | 2 ++ etc/profile-a-l/chromium-browser-privacy.profile | 2 ++ etc/profile-a-l/eo-common.profile | 2 ++ etc/profile-a-l/etr.profile | 2 ++ etc/profile-a-l/evince.profile | 2 ++ etc/profile-a-l/file-roller.profile | 1 + etc/profile-a-l/firefox.profile | 2 ++ etc/profile-a-l/frogatto.profile | 1 + etc/profile-a-l/gapplication.profile | 1 + etc/profile-a-l/gfeeds.profile | 1 + etc/profile-a-l/gnome-maps.profile | 2 ++ etc/profile-a-l/gnome-passwordsafe.profile | 2 ++ etc/profile-a-l/keepassxc.profile | 2 ++ etc/profile-a-l/libreoffice.profile | 2 ++ 17 files changed, 28 insertions(+) (limited to 'etc/profile-a-l') diff --git a/etc/profile-a-l/0ad.profile b/etc/profile-a-l/0ad.profile index 454a15ab2..4009853d3 100644 --- a/etc/profile-a-l/0ad.profile +++ b/etc/profile-a-l/0ad.profile @@ -10,6 +10,8 @@ noblacklist ${HOME}/.cache/0ad noblacklist ${HOME}/.config/0ad noblacklist ${HOME}/.local/share/0ad +blacklist /usr/libexec + include disable-common.inc include disable-devel.inc include disable-exec.inc diff --git a/etc/profile-a-l/apostrophe.profile b/etc/profile-a-l/apostrophe.profile index 54abdb234..01566314f 100644 --- a/etc/profile-a-l/apostrophe.profile +++ b/etc/profile-a-l/apostrophe.profile @@ -31,6 +31,7 @@ include disable-programs.inc include disable-shell.inc include disable-xdg.inc +whitelist /usr/libexec/webkit2gtk-4.0 whitelist /usr/share/apostrophe whitelist /usr/share/texlive whitelist /usr/share/texmf diff --git a/etc/profile-a-l/bijiben.profile b/etc/profile-a-l/bijiben.profile index 721a6c082..854fe5cb9 100644 --- a/etc/profile-a-l/bijiben.profile +++ b/etc/profile-a-l/bijiben.profile @@ -20,6 +20,7 @@ include disable-xdg.inc mkdir ${HOME}/.local/share/bijiben whitelist ${HOME}/.local/share/bijiben whitelist ${HOME}/.cache/tracker +whitelist /usr/libexec/webkit2gtk-4.0 whitelist /usr/share/bijiben whitelist /usr/share/tracker whitelist /usr/share/tracker3 diff --git a/etc/profile-a-l/celluloid.profile b/etc/profile-a-l/celluloid.profile index f02161b9b..1c539cc93 100644 --- a/etc/profile-a-l/celluloid.profile +++ b/etc/profile-a-l/celluloid.profile @@ -17,6 +17,8 @@ include allow-lua.inc include allow-python2.inc include allow-python3.inc +blacklist /usr/libexec + include disable-common.inc include disable-devel.inc include disable-exec.inc diff --git a/etc/profile-a-l/chromium-browser-privacy.profile b/etc/profile-a-l/chromium-browser-privacy.profile index 0283a6934..8803a4d9d 100644 --- a/etc/profile-a-l/chromium-browser-privacy.profile +++ b/etc/profile-a-l/chromium-browser-privacy.profile @@ -6,6 +6,8 @@ include chromium-browser-privacy.local noblacklist ${HOME}/.cache/ungoogled-chromium noblacklist ${HOME}/.config/ungoogled-chromium +blacklist /usr/libexec + mkdir ${HOME}/.cache/ungoogled-chromium mkdir ${HOME}/.config/ungoogled-chromium whitelist ${HOME}/.cache/ungoogled-chromium diff --git a/etc/profile-a-l/eo-common.profile b/etc/profile-a-l/eo-common.profile index 8e8047b00..fe7913e77 100644 --- a/etc/profile-a-l/eo-common.profile +++ b/etc/profile-a-l/eo-common.profile @@ -11,6 +11,8 @@ noblacklist ${HOME}/.local/share/Trash noblacklist ${HOME}/.Steam noblacklist ${HOME}/.steam +blacklist /usr/libexec + include disable-common.inc include disable-devel.inc include disable-exec.inc diff --git a/etc/profile-a-l/etr.profile b/etc/profile-a-l/etr.profile index d44d419c1..fdff1e4b5 100644 --- a/etc/profile-a-l/etr.profile +++ b/etc/profile-a-l/etr.profile @@ -8,6 +8,8 @@ include globals.local noblacklist ${HOME}/.etr +blacklist /usr/libexec + include disable-common.inc include disable-devel.inc include disable-exec.inc diff --git a/etc/profile-a-l/evince.profile b/etc/profile-a-l/evince.profile index adcb29063..a9e39b15c 100644 --- a/etc/profile-a-l/evince.profile +++ b/etc/profile-a-l/evince.profile @@ -13,6 +13,8 @@ include globals.local noblacklist ${HOME}/.config/evince noblacklist ${DOCUMENTS} +blacklist /usr/libexec + include disable-common.inc include disable-devel.inc include disable-exec.inc diff --git a/etc/profile-a-l/file-roller.profile b/etc/profile-a-l/file-roller.profile index 0b8a8cd6c..4e651ed61 100644 --- a/etc/profile-a-l/file-roller.profile +++ b/etc/profile-a-l/file-roller.profile @@ -13,6 +13,7 @@ include disable-interpreters.inc include disable-passwdmgr.inc include disable-programs.inc +whitelist /usr/libexec/file-roller whitelist /usr/share/file-roller include whitelist-runuser-common.inc include whitelist-usr-share-common.inc diff --git a/etc/profile-a-l/firefox.profile b/etc/profile-a-l/firefox.profile index b22a78458..7874c882f 100644 --- a/etc/profile-a-l/firefox.profile +++ b/etc/profile-a-l/firefox.profile @@ -17,6 +17,8 @@ include globals.local noblacklist ${HOME}/.cache/mozilla noblacklist ${HOME}/.mozilla +blacklist /usr/libexec + mkdir ${HOME}/.cache/mozilla/firefox mkdir ${HOME}/.mozilla whitelist ${HOME}/.cache/mozilla/firefox diff --git a/etc/profile-a-l/frogatto.profile b/etc/profile-a-l/frogatto.profile index fa56d2b2d..b4ad81046 100644 --- a/etc/profile-a-l/frogatto.profile +++ b/etc/profile-a-l/frogatto.profile @@ -18,6 +18,7 @@ include disable-xdg.inc mkdir ${HOME}/.frogatto whitelist ${HOME}/.frogatto +whitelist /usr/libexec/frogatto whitelist /usr/share/frogatto include whitelist-common.inc include whitelist-runuser-common.inc diff --git a/etc/profile-a-l/gapplication.profile b/etc/profile-a-l/gapplication.profile index f2da60c87..3a8c055f2 100644 --- a/etc/profile-a-l/gapplication.profile +++ b/etc/profile-a-l/gapplication.profile @@ -7,6 +7,7 @@ include gapplication.local include globals.local blacklist ${RUNUSER}/wayland-* +blacklist /usr/libexec include disable-common.inc include disable-devel.inc diff --git a/etc/profile-a-l/gfeeds.profile b/etc/profile-a-l/gfeeds.profile index 7ec8ba810..f894a42ca 100644 --- a/etc/profile-a-l/gfeeds.profile +++ b/etc/profile-a-l/gfeeds.profile @@ -31,6 +31,7 @@ whitelist ${HOME}/.cache/gfeeds whitelist ${HOME}/.cache/org.gabmus.gfeeds whitelist ${HOME}/.config/org.gabmus.gfeeds.json whitelist ${HOME}/.config/org.gabmus.gfeeds.saved_articles +whitelist /usr/libexec/webkit2gtk-4.0 whitelist /usr/share/gfeeds include whitelist-common.inc include whitelist-runuser-common.inc diff --git a/etc/profile-a-l/gnome-maps.profile b/etc/profile-a-l/gnome-maps.profile index cf2ac2f75..23aab343f 100644 --- a/etc/profile-a-l/gnome-maps.profile +++ b/etc/profile-a-l/gnome-maps.profile @@ -18,6 +18,8 @@ noblacklist ${HOME}/.local/share/maps-places.json # Allow gjs (blacklisted by disable-interpreters.inc) include allow-gjs.inc +blacklist /usr/libexec + include disable-common.inc include disable-devel.inc include disable-exec.inc diff --git a/etc/profile-a-l/gnome-passwordsafe.profile b/etc/profile-a-l/gnome-passwordsafe.profile index 763d67b92..fee5f88b9 100644 --- a/etc/profile-a-l/gnome-passwordsafe.profile +++ b/etc/profile-a-l/gnome-passwordsafe.profile @@ -13,6 +13,8 @@ noblacklist ${HOME}/*.kdbx # Allow python (blacklisted by disable-interpreters.inc) include allow-python3.inc +blacklist /usr/libexec + include disable-common.inc include disable-devel.inc include disable-exec.inc diff --git a/etc/profile-a-l/keepassxc.profile b/etc/profile-a-l/keepassxc.profile index c352a5d89..f71dcf82b 100644 --- a/etc/profile-a-l/keepassxc.profile +++ b/etc/profile-a-l/keepassxc.profile @@ -22,6 +22,8 @@ noblacklist ${HOME}/.config/vivaldi noblacklist ${HOME}/.local/share/torbrowser noblacklist ${HOME}/.mozilla +blacklist /usr/libexec + include disable-common.inc include disable-devel.inc include disable-exec.inc diff --git a/etc/profile-a-l/libreoffice.profile b/etc/profile-a-l/libreoffice.profile index e4440eac0..b1a24888c 100644 --- a/etc/profile-a-l/libreoffice.profile +++ b/etc/profile-a-l/libreoffice.profile @@ -14,6 +14,8 @@ noblacklist ${HOME}/.config/libreoffice # Allow java (blacklisted by disable-devel.inc) include allow-java.inc +blacklist /usr/libexec + include disable-common.inc include disable-devel.inc include disable-exec.inc -- cgit v1.2.3-54-g00ecf