From 0dba38435ef92ccc01cc9ff23b69df55489ec983 Mon Sep 17 00:00:00 2001 From: Tad Date: Wed, 5 Jul 2017 09:40:54 -0400 Subject: Harden profiles - Added 'disable-devel.conf' to many profiles - Added 'disable-mnt' to many profiles - Added 'noexec' to many profiles - Removed 'netfilter' and 'net none' from profiles with 'protocol unix' - Cleaned up profiles using defaults --- etc/xfce4-notes.profile | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) (limited to 'etc/xfce4-notes.profile') diff --git a/etc/xfce4-notes.profile b/etc/xfce4-notes.profile index 737bb0a23..544225920 100644 --- a/etc/xfce4-notes.profile +++ b/etc/xfce4-notes.profile @@ -8,23 +8,26 @@ include /etc/firejail/xfce4-notes.local noblacklist ${HOME}/.config/xfce4/xfce4-notes.rc noblacklist ${HOME}/.config/xfce4/xfce4-notes.gtkrc noblacklist ${HOME}/.local/share/notes + include /etc/firejail/disable-common.inc -include /etc/firejail/disable-programs.inc +include /etc/firejail/disable-devel.inc include /etc/firejail/disable-passwdmgr.inc +include /etc/firejail/disable-programs.inc caps.drop all -netfilter +no3d +nogroups nonewprivs noroot -protocol unix,inet,inet6 +nosound +novideo +protocol unix seccomp - -# -# depending on your usage, you can enable some of the commands below: -# -nogroups shell none -# private-bin program -# private-etc none + private-dev -# private-tmp +private-tmp +disable-mnt + +noexec ${HOME} +noexec /tmp -- cgit v1.2.3-54-g00ecf