From ab78a250dbf889898427f46f52260425ccc8eda5 Mon Sep 17 00:00:00 2001
From: Tad <tad@spotco.us>
Date: Sat, 13 Apr 2019 10:27:47 -0400
Subject: Add a conditional to control DRM/noexec exception for browsers

---
 etc/chromium-common.profile | 2 +-
 etc/firefox-common.profile  | 2 +-
 etc/firejail.config         | 9 ++++++---
 etc/midori.profile          | 2 +-
 etc/min.profile             | 2 +-
 5 files changed, 10 insertions(+), 7 deletions(-)

(limited to 'etc')

diff --git a/etc/chromium-common.profile b/etc/chromium-common.profile
index 3c7423316..63983d93b 100644
--- a/etc/chromium-common.profile
+++ b/etc/chromium-common.profile
@@ -7,7 +7,7 @@ include chromium-common.local
 #include globals.local
 
 # noexec ${HOME} breaks DRM binaries.
-ignore noexec ${HOME}
+?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
 
 noblacklist ${HOME}/.pki
 noblacklist ${HOME}/.local/share/pki
diff --git a/etc/firefox-common.profile b/etc/firefox-common.profile
index a2a34f33f..080d9e81a 100644
--- a/etc/firefox-common.profile
+++ b/etc/firefox-common.profile
@@ -7,7 +7,7 @@ include firefox-common.local
 #include globals.local
 
 # noexec ${HOME} breaks DRM binaries.
-ignore noexec ${HOME}
+?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
 
 # Uncomment the following line to allow access to common programs/addons/plugins.
 #include firefox-common-addons.inc
diff --git a/etc/firejail.config b/etc/firejail.config
index b37edf7a5..497d9633e 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -5,9 +5,6 @@
 # Enable AppArmor functionality, default enabled.
 # apparmor yes
 
-# Disable U2F in browsers, default enabled.
-# browser-disable-u2f yes
-
 # Number of ARP probes sent when assigning an IP address for --net option,
 # default 2. This is a partial implementation of RFC 5227. A 0.5 seconds
 # timeout is implemented for each probe. Increase this number to 4 if your
@@ -18,6 +15,12 @@
 # Enable or disable bind support, default enabled.
 # bind yes
 
+# Allow (DRM) execution in browsers, default disabled.
+# browser-allow-drm no
+
+# Disable U2F in browsers, default enabled.
+# browser-disable-u2f yes
+
 # Enable or disable cgroup support, default enabled.
 # cgroup yes
 
diff --git a/etc/midori.profile b/etc/midori.profile
index d59a6a16b..e4d39cd70 100644
--- a/etc/midori.profile
+++ b/etc/midori.profile
@@ -14,7 +14,7 @@ noblacklist ${HOME}/.pki
 noblacklist ${HOME}/.local/share/pki
 
 # noexec ${HOME} breaks DRM binaries.
-ignore noexec ${HOME}
+?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
 
 include disable-common.inc
 include disable-devel.inc
diff --git a/etc/min.profile b/etc/min.profile
index eec81677d..c89df0a95 100644
--- a/etc/min.profile
+++ b/etc/min.profile
@@ -12,7 +12,7 @@ noblacklist ${HOME}/.pki
 noblacklist ${HOME}/.local/share/pki
 
 # noexec ${HOME} breaks DRM binaries.
-ignore noexec ${HOME}
+?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
 
 include disable-common.inc
 include disable-devel.inc
-- 
cgit v1.2.3-70-g09d2