From 669c18c606893be64011d6b76763243db1b79b9c Mon Sep 17 00:00:00 2001 From: glitsj16 Date: Mon, 3 Oct 2022 18:32:54 +0000 Subject: Harden qutebrowser --- etc/profile-m-z/qutebrowser.profile | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'etc/profile-m-z') diff --git a/etc/profile-m-z/qutebrowser.profile b/etc/profile-m-z/qutebrowser.profile index 5b254c58b..ae62c0b89 100644 --- a/etc/profile-m-z/qutebrowser.profile +++ b/etc/profile-m-z/qutebrowser.profile @@ -10,6 +10,9 @@ noblacklist ${HOME}/.cache/qutebrowser noblacklist ${HOME}/.config/qutebrowser noblacklist ${HOME}/.local/share/qutebrowser +# Allow /bin/sh (blacklisted by disable-shell.inc) +include allow-bin-sh.inc + # Allow python (blacklisted by disable-interpreters.inc) include allow-python2.inc include allow-python3.inc @@ -19,6 +22,7 @@ include disable-devel.inc include disable-exec.inc include disable-interpreters.inc include disable-programs.inc +include disable-shell.inc mkdir ${HOME}/.cache/qutebrowser mkdir ${HOME}/.config/qutebrowser @@ -27,7 +31,12 @@ whitelist ${DOWNLOADS} whitelist ${HOME}/.cache/qutebrowser whitelist ${HOME}/.config/qutebrowser whitelist ${HOME}/.local/share/qutebrowser +whitelist /usr/share/qtbrowser include whitelist-common.inc +include whitelist-run-common.inc +include whitelist-runuser-common.inc +include whitelist-usr-share-common.inc +include whitelist-var-common.inc apparmor caps.drop all -- cgit v1.2.3-54-g00ecf