From 46dc993c56f58840e385c19ed685936e5e706253 Mon Sep 17 00:00:00 2001 From: glitsj16 Date: Mon, 3 Jul 2023 21:40:57 +0000 Subject: Create rssguard.profile --- etc/profile-m-z/rssguard.profile | 57 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 etc/profile-m-z/rssguard.profile (limited to 'etc/profile-m-z') diff --git a/etc/profile-m-z/rssguard.profile b/etc/profile-m-z/rssguard.profile new file mode 100644 index 000000000..bad641eb8 --- /dev/null +++ b/etc/profile-m-z/rssguard.profile @@ -0,0 +1,57 @@ +# Firejail profile for rssguard +# Description: Simple (yet powerful) Qt feed reader +# This file is overwritten after every install/update +# Persistent local customizations +include rssguard.local +# Persistent global definitions +include globals.local + +noblacklist ${HOME}/.config/RSS Guard 4 + +include allow-nodejs.inc + +include disable-common.inc +include disable-devel.inc +include disable-exec.inc +include disable-interpreters.inc +include disable-proc.inc +include disable-programs.inc +include disable-shell.inc +include disable-xdg.inc + +mkdir ${HOME}/.config/RSS Guard 4 +whitelist ${HOME}/.config/RSS Guard 4 +whitelist ${DOWNLOADS} +include whitelist-common.inc +include whitelist-run-common.inc +include whitelist-runuser-common.inc +include whitelist-usr-share-common.inc +include whitelist-var-common.inc + +apparmor +caps.drop all +netfilter +# no3d +nodvd +nogroups +noinput +nonewprivs +noroot +# nosound +notv +nou2f +novideo +protocol unix,inet,inet6 +seccomp +tracelog + +disable-mnt +private-bin node,rssguard +private-dev +private-etc @network,@sound,@tls-ca,@x11,mime.types +private-tmp + +dbus-user none +dbus-system none + +restrict-namespaces -- cgit v1.2.3-70-g09d2 From 698935530d4ed2cfa5fa057879abf9a136cdb48c Mon Sep 17 00:00:00 2001 From: glitsj16 Date: Tue, 4 Jul 2023 12:29:08 +0000 Subject: rssguard.profile: add seccomp.block-secondary --- etc/profile-m-z/rssguard.profile | 1 + 1 file changed, 1 insertion(+) (limited to 'etc/profile-m-z') diff --git a/etc/profile-m-z/rssguard.profile b/etc/profile-m-z/rssguard.profile index bad641eb8..ab42718b0 100644 --- a/etc/profile-m-z/rssguard.profile +++ b/etc/profile-m-z/rssguard.profile @@ -43,6 +43,7 @@ nou2f novideo protocol unix,inet,inet6 seccomp +seccomp.block-secondary tracelog disable-mnt -- cgit v1.2.3-70-g09d2 From e447e630d36ed3c881be871a04e916760c14abea Mon Sep 17 00:00:00 2001 From: glitsj16 Date: Wed, 5 Jul 2023 22:40:46 +0000 Subject: rssguard.profile: add netlink to protocol --- etc/profile-m-z/rssguard.profile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'etc/profile-m-z') diff --git a/etc/profile-m-z/rssguard.profile b/etc/profile-m-z/rssguard.profile index ab42718b0..81381c205 100644 --- a/etc/profile-m-z/rssguard.profile +++ b/etc/profile-m-z/rssguard.profile @@ -41,7 +41,7 @@ noroot notv nou2f novideo -protocol unix,inet,inet6 +protocol unix,inet,inet6,netlink seccomp seccomp.block-secondary tracelog -- cgit v1.2.3-70-g09d2