From 47dba686e4389d0e8820da52918250ee8f6c9a49 Mon Sep 17 00:00:00 2001 From: smitsohu Date: Fri, 18 Aug 2017 15:32:11 +0200 Subject: bring back options --- etc/skanlite.profile | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'etc') diff --git a/etc/skanlite.profile b/etc/skanlite.profile index 0338bc452..d34d2e92d 100644 --- a/etc/skanlite.profile +++ b/etc/skanlite.profile @@ -12,18 +12,20 @@ include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-programs.inc caps.drop all -netfilter +# net none nodvd nogroups nonewprivs noroot nosound notv -# protocol unix,inet,inet6 -seccomp +novideo +protocol unix,netlink +# skanlite makes ioperm system calls, which are blacklisted by default. +seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@reboot,@resources,@swap,acct,add_key,bpf,chroot,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,iopl,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,pciconfig_iobase,pciconfig_read,pciconfig_write,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,s390_mmio_read,s390_mmio_write,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice shell none -# private-bin skanlite +private-bin skanlite,kbuildsycoca4 # private-dev # private-etc # private-tmp -- cgit v1.2.3-54-g00ecf From e97e436afff99e5e63ae1e7fb98b230c9b77a86e Mon Sep 17 00:00:00 2001 From: smitsohu Date: Fri, 18 Aug 2017 15:35:33 +0200 Subject: add novideo --- etc/tracker.profile | 1 + 1 file changed, 1 insertion(+) (limited to 'etc') diff --git a/etc/tracker.profile b/etc/tracker.profile index ded2ae2e5..f3dfb2d4e 100644 --- a/etc/tracker.profile +++ b/etc/tracker.profile @@ -23,6 +23,7 @@ nonewprivs noroot nosound notv +novideo protocol unix seccomp shell none -- cgit v1.2.3-54-g00ecf From 5a8a6897c0f99c2f5a8ccd41d1589731d9632a15 Mon Sep 17 00:00:00 2001 From: smitsohu Date: Fri, 18 Aug 2017 15:39:08 +0200 Subject: fix cvlc (remove notv, nodvd) --- etc/cvlc.profile | 2 -- 1 file changed, 2 deletions(-) (limited to 'etc') diff --git a/etc/cvlc.profile b/etc/cvlc.profile index ee1346617..460966321 100644 --- a/etc/cvlc.profile +++ b/etc/cvlc.profile @@ -14,11 +14,9 @@ include /etc/firejail/disable-programs.inc caps.drop all netfilter -nodvd nogroups nonewprivs noroot -notv protocol unix,inet,inet6,netlink seccomp shell none -- cgit v1.2.3-54-g00ecf From db83d67b7990e1dae19bdb4833abf0d8bfe1906e Mon Sep 17 00:00:00 2001 From: smitsohu Date: Fri, 18 Aug 2017 15:42:15 +0200 Subject: enhance konversation profile --- etc/konversation.profile | 3 +++ 1 file changed, 3 insertions(+) (limited to 'etc') diff --git a/etc/konversation.profile b/etc/konversation.profile index 8bc263d4d..212aa8817 100644 --- a/etc/konversation.profile +++ b/etc/konversation.profile @@ -15,9 +15,12 @@ caps.drop all netfilter nodvd nogroups +nonewprivs noroot notv +novideo protocol unix,inet,inet6 seccomp +tracelog private-tmp -- cgit v1.2.3-54-g00ecf From 7f2ae9a2b664e734deba308a9c596c88fe2035ea Mon Sep 17 00:00:00 2001 From: smitsohu Date: Fri, 18 Aug 2017 15:44:34 +0200 Subject: add netfilter --- etc/tuxguitar.profile | 1 + 1 file changed, 1 insertion(+) (limited to 'etc') diff --git a/etc/tuxguitar.profile b/etc/tuxguitar.profile index ddbcce3f6..5b6a257f6 100644 --- a/etc/tuxguitar.profile +++ b/etc/tuxguitar.profile @@ -14,6 +14,7 @@ include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-programs.inc caps.drop all +netfilter no3d nodvd nonewprivs -- cgit v1.2.3-54-g00ecf From a5709442d178f81661aa70e9206457913cb33780 Mon Sep 17 00:00:00 2001 From: smitsohu Date: Fri, 18 Aug 2017 15:53:26 +0200 Subject: comment private-bin --- etc/skanlite.profile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'etc') diff --git a/etc/skanlite.profile b/etc/skanlite.profile index d34d2e92d..669048ee0 100644 --- a/etc/skanlite.profile +++ b/etc/skanlite.profile @@ -25,7 +25,7 @@ protocol unix,netlink seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@reboot,@resources,@swap,acct,add_key,bpf,chroot,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,iopl,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,pciconfig_iobase,pciconfig_read,pciconfig_write,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,s390_mmio_read,s390_mmio_write,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice shell none -private-bin skanlite,kbuildsycoca4 +# private-bin skanlite,kbuildsycoca4 # private-dev # private-etc # private-tmp -- cgit v1.2.3-54-g00ecf From ca69bc65583931212f940f5e5d447171571e4341 Mon Sep 17 00:00:00 2001 From: smitsohu Date: Fri, 18 Aug 2017 20:32:48 +0200 Subject: bring back netfilter --- etc/skanlite.profile | 1 + 1 file changed, 1 insertion(+) (limited to 'etc') diff --git a/etc/skanlite.profile b/etc/skanlite.profile index 669048ee0..1d590a142 100644 --- a/etc/skanlite.profile +++ b/etc/skanlite.profile @@ -13,6 +13,7 @@ include /etc/firejail/disable-programs.inc caps.drop all # net none +netfilter nodvd nogroups nonewprivs -- cgit v1.2.3-54-g00ecf