master
parent
bf695e1588
commit
777ae32ba6
|
|
@ -0,0 +1,31 @@
|
||||||
|
# Firejail profile for 0ad.
|
||||||
|
noblacklist ~/.cache/0ad
|
||||||
|
noblacklist ~/.config/0ad
|
||||||
|
noblacklist ~/.local/share/0ad
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
|
||||||
|
# Whitelists
|
||||||
|
mkdir ~/.cache/0ad
|
||||||
|
whitelist ~/.cache/0ad
|
||||||
|
|
||||||
|
mkdir ~/.config/0ad
|
||||||
|
whitelist ~/.config/0ad
|
||||||
|
|
||||||
|
mkdir ~/.local/share/0ad
|
||||||
|
whitelist ~/.local/share/0ad
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
# 7zip crompression tool profile
|
||||||
|
quiet
|
||||||
|
ignore noroot
|
||||||
|
include /etc/firejail/default.profile
|
||||||
|
tracelog
|
||||||
|
net none
|
||||||
|
shell none
|
||||||
|
private-dev
|
||||||
|
nosound
|
||||||
|
|
@ -0,0 +1,3 @@
|
||||||
|
# Firejail profile for Cyberfox (based on Mozilla Firefox)
|
||||||
|
|
||||||
|
include /etc/firejail/cyberfox.profile
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Mathematica profile
|
||||||
|
noblacklist ${HOME}/.Mathematica
|
||||||
|
noblacklist ${HOME}/.Wolfram Research
|
||||||
|
|
||||||
|
mkdir ~/.Mathematica
|
||||||
|
whitelist ~/.Mathematica
|
||||||
|
mkdir ~/.Wolfram Research
|
||||||
|
whitelist ~/.Wolfram Research
|
||||||
|
whitelist ~/Documents/Wolfram Mathematica
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
seccomp
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
# Telegram IRC profile
|
||||||
|
include /etc/firejail/telegram.profile
|
||||||
|
|
@ -0,0 +1,50 @@
|
||||||
|
# Firejail profile for Abrowser
|
||||||
|
|
||||||
|
noblacklist ~/.mozilla
|
||||||
|
noblacklist ~/.cache/mozilla
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
seccomp
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
mkdir ~/.mozilla
|
||||||
|
whitelist ~/.mozilla
|
||||||
|
mkdir ~/.cache/mozilla/abrowser
|
||||||
|
whitelist ~/.cache/mozilla/abrowser
|
||||||
|
whitelist ~/dwhelper
|
||||||
|
whitelist ~/.zotero
|
||||||
|
whitelist ~/.vimperatorrc
|
||||||
|
whitelist ~/.vimperator
|
||||||
|
whitelist ~/.pentadactylrc
|
||||||
|
whitelist ~/.pentadactyl
|
||||||
|
whitelist ~/.keysnail.js
|
||||||
|
whitelist ~/.config/gnome-mplayer
|
||||||
|
whitelist ~/.cache/gnome-mplayer/plugin
|
||||||
|
whitelist ~/.pki
|
||||||
|
|
||||||
|
# lastpass, keepassx
|
||||||
|
whitelist ~/.keepassx
|
||||||
|
whitelist ~/.config/keepassx
|
||||||
|
whitelist ~/keepassx.kdbx
|
||||||
|
whitelist ~/.lastpass
|
||||||
|
whitelist ~/.config/lastpass
|
||||||
|
|
||||||
|
|
||||||
|
#silverlight
|
||||||
|
whitelist ~/.wine-pipelight
|
||||||
|
whitelist ~/.wine-pipelight64
|
||||||
|
whitelist ~/.config/pipelight-widevine
|
||||||
|
whitelist ~/.config/pipelight-silverlight5.1
|
||||||
|
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
||||||
|
# experimental features
|
||||||
|
#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Firejail profile for Atom Beta.
|
||||||
|
noblacklist ~/.atom
|
||||||
|
noblacklist ~/.config/Atom
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
nogroups
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Firejail profile for Atom.
|
||||||
|
noblacklist ~/.atom
|
||||||
|
noblacklist ~/.config/Atom
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
nogroups
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# Atril profile
|
||||||
|
noblacklist ~/.config/atril
|
||||||
|
noblacklist ~/.local/share
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nonewprivs
|
||||||
|
nogroups
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-bin atril, atril-previewer, atril-thumbnailer
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
# Audacious media player profile
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# Audacity profile
|
||||||
|
noblacklist ~/.audacity-data
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
nogroups
|
||||||
|
noroot
|
||||||
|
protocol unix
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-bin audacity
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,25 @@
|
||||||
|
# Firejail profile for aweather.
|
||||||
|
noblacklist ~/.config/aweather
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
|
||||||
|
# Whitelist
|
||||||
|
mkdir ~/.config/aweather
|
||||||
|
whitelist ~/.config/aweather
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
nogroups
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-bin aweather
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
# BitlBee instant messaging profile
|
||||||
|
noblacklist /sbin
|
||||||
|
noblacklist /usr/sbin
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
private
|
||||||
|
private-dev
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
nosound
|
||||||
|
read-write /var/lib/bitlbee
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
# Profile for Brave browser
|
||||||
|
|
||||||
|
noblacklist ~/.config/brave
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
seccomp
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
|
||||||
|
mkdir ~/.config/brave
|
||||||
|
whitelist ~/.config/brave
|
||||||
|
|
@ -0,0 +1,19 @@
|
||||||
|
# cherrytree note taking application
|
||||||
|
noblacklist /usr/bin/python2*
|
||||||
|
noblacklist /usr/lib/python3*
|
||||||
|
noblacklist ${HOME}/.config/cherrytree
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
seccomp
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
# Chromium browser profile
|
||||||
|
include /etc/firejail/chromium.profile
|
||||||
|
|
@ -0,0 +1,31 @@
|
||||||
|
# Chromium browser profile
|
||||||
|
noblacklist ~/.config/chromium
|
||||||
|
noblacklist ~/.cache/chromium
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
|
||||||
|
# chromium is distributed with a perl script on Arch
|
||||||
|
# include /etc/firejail/disable-devel.inc
|
||||||
|
#
|
||||||
|
|
||||||
|
netfilter
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
mkdir ~/.config/chromium
|
||||||
|
whitelist ~/.config/chromium
|
||||||
|
mkdir ~/.cache/chromium
|
||||||
|
whitelist ~/.cache/chromium
|
||||||
|
mkdir ~/.pki
|
||||||
|
whitelist ~/.pki
|
||||||
|
|
||||||
|
# lastpass, keepassx
|
||||||
|
whitelist ~/.keepassx
|
||||||
|
whitelist ~/.config/keepassx
|
||||||
|
whitelist ~/keepassx.kdbx
|
||||||
|
whitelist ~/.lastpass
|
||||||
|
whitelist ~/.config/lastpass
|
||||||
|
|
||||||
|
# specific to Arch
|
||||||
|
whitelist ~/.config/chromium-flags.conf
|
||||||
|
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
@ -0,0 +1,24 @@
|
||||||
|
# claws-mail profile
|
||||||
|
|
||||||
|
noblacklist ~/.claws-mail
|
||||||
|
noblacklist ~/.signature
|
||||||
|
noblacklist ~/.gnupg
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nogroups
|
||||||
|
nosound
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
# Clementine media player profile
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
# cmus profile
|
||||||
|
noblacklist ${HOME}/.config/cmus
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
||||||
|
private-bin cmus
|
||||||
|
private-etc group
|
||||||
|
shell none
|
||||||
|
|
@ -0,0 +1,24 @@
|
||||||
|
# Firejail profile for Conkeror web browser profile
|
||||||
|
noblacklist ${HOME}/.conkeror.mozdev.org
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
||||||
|
whitelist ~/.conkeror.mozdev.org
|
||||||
|
whitelist ~/Downloads
|
||||||
|
whitelist ~/dwhelper
|
||||||
|
whitelist ~/.zotero
|
||||||
|
whitelist ~/.lastpass
|
||||||
|
whitelist ~/.gtkrc-2.0
|
||||||
|
whitelist ~/.vimperatorrc
|
||||||
|
whitelist ~/.vimperator
|
||||||
|
whitelist ~/.pentadactylrc
|
||||||
|
whitelist ~/.pentadactyl
|
||||||
|
whitelist ~/.conkerorrc
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
# Firejail corebird profile
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# cpio profile
|
||||||
|
# /sbin and /usr/sbin are visible inside the sandbox
|
||||||
|
# /boot is not visible and /var is heavily modified
|
||||||
|
quiet
|
||||||
|
noblacklist /sbin
|
||||||
|
noblacklist /usr/sbin
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
private-dev
|
||||||
|
seccomp
|
||||||
|
caps.drop all
|
||||||
|
net none
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
net none
|
||||||
|
nosound
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -0,0 +1,50 @@
|
||||||
|
# Firejail profile for Cyberfox (based on Mozilla Firefox)
|
||||||
|
|
||||||
|
noblacklist ~/.8pecxstudios
|
||||||
|
noblacklist ~/.cache/8pecxstudios
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
seccomp
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
mkdir ~/.8pecxstudios
|
||||||
|
whitelist ~/.8pecxstudios
|
||||||
|
mkdir ~/.cache/8pecxstudios
|
||||||
|
whitelist ~/.cache/8pecxstudios
|
||||||
|
whitelist ~/dwhelper
|
||||||
|
whitelist ~/.zotero
|
||||||
|
whitelist ~/.vimperatorrc
|
||||||
|
whitelist ~/.vimperator
|
||||||
|
whitelist ~/.pentadactylrc
|
||||||
|
whitelist ~/.pentadactyl
|
||||||
|
whitelist ~/.keysnail.js
|
||||||
|
whitelist ~/.config/gnome-mplayer
|
||||||
|
whitelist ~/.cache/gnome-mplayer/plugin
|
||||||
|
whitelist ~/.pki
|
||||||
|
|
||||||
|
# lastpass, keepassx
|
||||||
|
whitelist ~/.keepassx
|
||||||
|
whitelist ~/.config/keepassx
|
||||||
|
whitelist ~/keepassx.kdbx
|
||||||
|
whitelist ~/.lastpass
|
||||||
|
whitelist ~/.config/lastpass
|
||||||
|
|
||||||
|
|
||||||
|
#silverlight
|
||||||
|
whitelist ~/.wine-pipelight
|
||||||
|
whitelist ~/.wine-pipelight64
|
||||||
|
whitelist ~/.config/pipelight-widevine
|
||||||
|
whitelist ~/.config/pipelight-silverlight5.1
|
||||||
|
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
||||||
|
# experimental features
|
||||||
|
#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
# DeaDBeeF media player profile
|
||||||
|
noblacklist ${HOME}/.config/deadbeef
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
@ -0,0 +1,15 @@
|
||||||
|
################################
|
||||||
|
# Generic GUI application profile
|
||||||
|
################################
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
#blacklist ${HOME}/.wine
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# deluge bittorrernt client profile
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
# deluge is using python on Debian
|
||||||
|
#include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
||||||
|
shell none
|
||||||
|
#private-bin deluge,sh,python,uname
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
# Firejail profile for Dillo web browser
|
||||||
|
|
||||||
|
noblacklist ~/.dillo
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
mkdir ~/.dillo
|
||||||
|
whitelist ~/.dillo
|
||||||
|
mkdir ~/.fltk
|
||||||
|
whitelist ~/.fltk
|
||||||
|
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
@ -0,0 +1,177 @@
|
||||||
|
# Local customizations come here
|
||||||
|
include /etc/firejail/disable-common.local
|
||||||
|
|
||||||
|
# History files in $HOME
|
||||||
|
blacklist-nolog ${HOME}/.history
|
||||||
|
blacklist-nolog ${HOME}/.*_history
|
||||||
|
blacklist ${HOME}/.local/share/systemd
|
||||||
|
blacklist-nolog ${HOME}/.adobe
|
||||||
|
blacklist-nolog ${HOME}/.macromedia
|
||||||
|
read-only ${HOME}/.local/share/applications
|
||||||
|
|
||||||
|
# X11 session autostart
|
||||||
|
blacklist ${HOME}/.xinitrc
|
||||||
|
blacklist ${HOME}/.xprofile
|
||||||
|
blacklist ${HOME}/.config/autostart
|
||||||
|
blacklist /etc/xdg/autostart
|
||||||
|
blacklist ${HOME}/.kde4/Autostart
|
||||||
|
blacklist ${HOME}/.kde4/share/autostart
|
||||||
|
blacklist ${HOME}/.kde/Autostart
|
||||||
|
blacklist ${HOME}/.kde/share/autostart
|
||||||
|
blacklist ${HOME}/.config/plasma-workspace/shutdown
|
||||||
|
blacklist ${HOME}/.config/plasma-workspace/env
|
||||||
|
blacklist ${HOME}/.config/lxsession/LXDE/autostart
|
||||||
|
blacklist ${HOME}/.fluxbox/startup
|
||||||
|
blacklist ${HOME}/.config/openbox/autostart
|
||||||
|
blacklist ${HOME}/.config/openbox/environment
|
||||||
|
blacklist ${HOME}/.gnomerc
|
||||||
|
blacklist /etc/X11/Xsession.d/
|
||||||
|
|
||||||
|
# VirtualBox
|
||||||
|
blacklist ${HOME}/.VirtualBox
|
||||||
|
blacklist ${HOME}/VirtualBox VMs
|
||||||
|
blacklist ${HOME}/.config/VirtualBox
|
||||||
|
|
||||||
|
# VeraCrypt
|
||||||
|
blacklist ${PATH}/veracrypt
|
||||||
|
blacklist ${PATH}/veracrypt-uninstall.sh
|
||||||
|
blacklist /usr/share/veracrypt
|
||||||
|
blacklist /usr/share/applications/veracrypt.*
|
||||||
|
blacklist /usr/share/pixmaps/veracrypt.*
|
||||||
|
blacklist ${HOME}/.VeraCrypt
|
||||||
|
|
||||||
|
# var
|
||||||
|
blacklist /var/spool/cron
|
||||||
|
blacklist /var/spool/anacron
|
||||||
|
blacklist /var/run/acpid.socket
|
||||||
|
blacklist /var/run/minissdpd.sock
|
||||||
|
blacklist /var/run/rpcbind.sock
|
||||||
|
blacklist /var/run/mysqld/mysqld.sock
|
||||||
|
blacklist /var/run/mysql/mysqld.sock
|
||||||
|
blacklist /var/lib/mysqld/mysql.sock
|
||||||
|
blacklist /var/lib/mysql/mysql.sock
|
||||||
|
blacklist /var/run/docker.sock
|
||||||
|
|
||||||
|
# etc
|
||||||
|
blacklist /etc/cron.*
|
||||||
|
blacklist /etc/profile.d
|
||||||
|
blacklist /etc/rc.local
|
||||||
|
blacklist /etc/anacrontab
|
||||||
|
|
||||||
|
# General startup files
|
||||||
|
read-only ${HOME}/.xinitrc
|
||||||
|
read-only ${HOME}/.xserverrc
|
||||||
|
read-only ${HOME}/.profile
|
||||||
|
|
||||||
|
# Shell startup files
|
||||||
|
read-only ${HOME}/.antigen
|
||||||
|
read-only ${HOME}/.bash_login
|
||||||
|
read-only ${HOME}/.bashrc
|
||||||
|
read-only ${HOME}/.bash_profile
|
||||||
|
read-only ${HOME}/.bash_logout
|
||||||
|
read-only ${HOME}/.zsh.d
|
||||||
|
read-only ${HOME}/.zshenv
|
||||||
|
read-only ${HOME}/.zshrc
|
||||||
|
read-only ${HOME}/.zshrc.local
|
||||||
|
read-only ${HOME}/.zlogin
|
||||||
|
read-only ${HOME}/.zprofile
|
||||||
|
read-only ${HOME}/.zlogout
|
||||||
|
read-only ${HOME}/.zsh_files
|
||||||
|
read-only ${HOME}/.tcshrc
|
||||||
|
read-only ${HOME}/.cshrc
|
||||||
|
read-only ${HOME}/.csh_files
|
||||||
|
read-only ${HOME}/.profile
|
||||||
|
|
||||||
|
# Initialization files that allow arbitrary command execution
|
||||||
|
read-only ${HOME}/.caffrc
|
||||||
|
read-only ${HOME}/.dotfiles
|
||||||
|
read-only ${HOME}/dotfiles
|
||||||
|
read-only ${HOME}/.mailcap
|
||||||
|
read-only ${HOME}/.exrc
|
||||||
|
read-only ${HOME}/_exrc
|
||||||
|
read-only ${HOME}/.vimrc
|
||||||
|
read-only ${HOME}/_vimrc
|
||||||
|
read-only ${HOME}/.gvimrc
|
||||||
|
read-only ${HOME}/_gvimrc
|
||||||
|
read-only ${HOME}/.vim
|
||||||
|
read-only ${HOME}/.emacs
|
||||||
|
read-only ${HOME}/.emacs.d
|
||||||
|
read-only ${HOME}/.nano
|
||||||
|
read-only ${HOME}/.tmux.conf
|
||||||
|
read-only ${HOME}/.iscreenrc
|
||||||
|
read-only ${HOME}/.muttrc
|
||||||
|
read-only ${HOME}/.mutt/muttrc
|
||||||
|
read-only ${HOME}/.msmtprc
|
||||||
|
read-only ${HOME}/.reportbugrc
|
||||||
|
read-only ${HOME}/.xmonad
|
||||||
|
read-only ${HOME}/.xscreensaver
|
||||||
|
|
||||||
|
# The user ~/bin directory can override commands such as ls
|
||||||
|
read-only ${HOME}/bin
|
||||||
|
|
||||||
|
# top secret
|
||||||
|
blacklist ${HOME}/.ssh
|
||||||
|
blacklist ${HOME}/.cert
|
||||||
|
blacklist ${HOME}/.gnome2/keyrings
|
||||||
|
blacklist ${HOME}/.kde4/share/apps/kwallet
|
||||||
|
blacklist ${HOME}/.kde/share/apps/kwallet
|
||||||
|
blacklist ${HOME}/.local/share/kwalletd
|
||||||
|
blacklist ${HOME}/.config/keybase
|
||||||
|
blacklist ${HOME}/.netrc
|
||||||
|
blacklist ${HOME}/.gnupg
|
||||||
|
blacklist ${HOME}/.caff
|
||||||
|
blacklist ${HOME}/.smbcredentials
|
||||||
|
blacklist ${HOME}/*.kdbx
|
||||||
|
blacklist ${HOME}/*.kdb
|
||||||
|
blacklist ${HOME}/*.key
|
||||||
|
blacklist ${HOME}/.muttrc
|
||||||
|
blacklist ${HOME}/.mutt/muttrc
|
||||||
|
blacklist ${HOME}/.msmtprc
|
||||||
|
blacklist /etc/shadow
|
||||||
|
blacklist /etc/gshadow
|
||||||
|
blacklist /etc/passwd-
|
||||||
|
blacklist /etc/group-
|
||||||
|
blacklist /etc/shadow-
|
||||||
|
blacklist /etc/gshadow-
|
||||||
|
blacklist /etc/passwd+
|
||||||
|
blacklist /etc/group+
|
||||||
|
blacklist /etc/shadow+
|
||||||
|
blacklist /etc/gshadow+
|
||||||
|
blacklist /etc/ssh
|
||||||
|
blacklist /var/backup
|
||||||
|
|
||||||
|
# system management
|
||||||
|
blacklist ${PATH}/umount
|
||||||
|
blacklist ${PATH}/mount
|
||||||
|
blacklist ${PATH}/fusermount
|
||||||
|
blacklist ${PATH}/su
|
||||||
|
blacklist ${PATH}/sudo
|
||||||
|
blacklist ${PATH}/xinput
|
||||||
|
blacklist ${PATH}/evtest
|
||||||
|
blacklist ${PATH}/xev
|
||||||
|
blacklist ${PATH}/strace
|
||||||
|
blacklist ${PATH}/nc
|
||||||
|
blacklist ${PATH}/ncat
|
||||||
|
|
||||||
|
# system directories
|
||||||
|
blacklist /sbin
|
||||||
|
blacklist /usr/sbin
|
||||||
|
blacklist /usr/local/sbin
|
||||||
|
|
||||||
|
# prevent lxterminal connecting to an existing lxterminal session
|
||||||
|
blacklist /tmp/.lxterminal-socket*
|
||||||
|
|
||||||
|
# disable terminals running as server resulting in sandbox escape
|
||||||
|
blacklist ${PATH}/gnome-terminal
|
||||||
|
blacklist ${PATH}/gnome-terminal.wrapper
|
||||||
|
blacklist ${PATH}/xfce4-terminal
|
||||||
|
blacklist ${PATH}/xfce4-terminal.wrapper
|
||||||
|
blacklist ${PATH}/mate-terminal
|
||||||
|
blacklist ${PATH}/mate-terminal.wrapper
|
||||||
|
blacklist ${PATH}/lilyterm
|
||||||
|
blacklist ${PATH}/pantheon-terminal
|
||||||
|
blacklist ${PATH}/roxterm
|
||||||
|
blacklist ${PATH}/roxterm-config
|
||||||
|
blacklist ${PATH}/terminix
|
||||||
|
blacklist ${PATH}/urxvtc
|
||||||
|
blacklist ${PATH}/urxvtcd
|
||||||
|
|
@ -0,0 +1,66 @@
|
||||||
|
# Local customizations come here
|
||||||
|
include /etc/firejail/disable-devel.local
|
||||||
|
|
||||||
|
# development tools
|
||||||
|
|
||||||
|
# GCC
|
||||||
|
blacklist /usr/include
|
||||||
|
#blacklist /usr/lib/gcc - seems to create problems on Gentoo
|
||||||
|
blacklist /usr/bin/gcc*
|
||||||
|
blacklist /usr/bin/cpp*
|
||||||
|
blacklist /usr/bin/c9*
|
||||||
|
blacklist /usr/bin/c8*
|
||||||
|
blacklist /usr/bin/c++*
|
||||||
|
blacklist /usr/bin/as
|
||||||
|
blacklist /usr/bin/ld
|
||||||
|
blacklist /usr/bin/gdb
|
||||||
|
blacklist /usr/bin/g++*
|
||||||
|
blacklist /usr/bin/x86_64-linux-gnu-g++*
|
||||||
|
blacklist /usr/bin/x86_64-linux-gnu-gcc*
|
||||||
|
blacklist /usr/bin/x86_64-unknown-linux-gnu-g++*
|
||||||
|
blacklist /usr/bin/x86_64-unknown-linux-gnu-gcc*
|
||||||
|
|
||||||
|
# clang/llvm
|
||||||
|
blacklist /usr/bin/clang*
|
||||||
|
blacklist /usr/bin/llvm*
|
||||||
|
blacklist /usr/bin/lldb*
|
||||||
|
blacklist /usr/lib/llvm*
|
||||||
|
|
||||||
|
# tcc - Tiny C Compiler
|
||||||
|
blacklist /usr/bin/tcc
|
||||||
|
blacklist /usr/bin/x86_64-tcc
|
||||||
|
blacklist /usr/lib/tcc
|
||||||
|
|
||||||
|
# Valgrind
|
||||||
|
blacklist /usr/bin/valgrind*
|
||||||
|
blacklist /usr/lib/valgrind
|
||||||
|
|
||||||
|
# Perl
|
||||||
|
blacklist /usr/bin/perl
|
||||||
|
blacklist /usr/bin/cpan*
|
||||||
|
blacklist /usr/share/perl*
|
||||||
|
blacklist /usr/lib/perl*
|
||||||
|
|
||||||
|
# PHP
|
||||||
|
blacklist /usr/bin/php*
|
||||||
|
blacklist /usr/share/php*
|
||||||
|
blacklist /usr/lib/php*
|
||||||
|
|
||||||
|
# Ruby
|
||||||
|
blacklist /usr/bin/ruby
|
||||||
|
blacklist /usr/lib/ruby
|
||||||
|
|
||||||
|
# Programs using python: deluge, firefox addons, filezilla, cherrytree, xchat, hexchat, libreoffice
|
||||||
|
# Python 2
|
||||||
|
#blacklist /usr/bin/python2*
|
||||||
|
#blacklist /usr/lib/python2*
|
||||||
|
#blacklist /usr/local/lib/python2*
|
||||||
|
#blacklist /usr/include/python2*
|
||||||
|
#blacklist /usr/share/python2*
|
||||||
|
#
|
||||||
|
# Python 3
|
||||||
|
#blacklist /usr/bin/python3*
|
||||||
|
#blacklist /usr/lib/python3*
|
||||||
|
#blacklist /usr/local/lib/python3*
|
||||||
|
#blacklist /usr/share/python3*
|
||||||
|
#blacklist /usr/include/python3*
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
# Local customizations come here
|
||||||
|
include /etc/firejail/disable-passwdmgr.local
|
||||||
|
|
||||||
|
blacklist ${HOME}/.pki/nssdb
|
||||||
|
blacklist ${HOME}/.lastpass
|
||||||
|
blacklist ${HOME}/.keepassx
|
||||||
|
blacklist ${HOME}/.password-store
|
||||||
|
blacklist ${HOME}/keepassx.kdbx
|
||||||
|
blacklist ${HOME}/.config/keepassx
|
||||||
|
|
||||||
|
|
@ -0,0 +1,167 @@
|
||||||
|
# Local customizations come here
|
||||||
|
include /etc/firejail/disable-programs.local
|
||||||
|
|
||||||
|
# various programs
|
||||||
|
blacklist ${HOME}/.Atom
|
||||||
|
blacklist ${HOME}/.remmina
|
||||||
|
blacklist ${HOME}/.tconn
|
||||||
|
blacklist ${HOME}/.FBReader
|
||||||
|
blacklist ${HOME}/.wine
|
||||||
|
blacklist ${HOME}/.Mathematica
|
||||||
|
blacklist ${HOME}/.Wolfram Research
|
||||||
|
blacklist ${HOME}/.stellarium
|
||||||
|
blacklist ${HOME}/.config/Atom
|
||||||
|
blacklist ${HOME}/.config/gthumb
|
||||||
|
blacklist ${HOME}/.config/mupen64plus
|
||||||
|
blacklist ${HOME}/.config/transmission
|
||||||
|
blacklist ${HOME}/.config/uGet
|
||||||
|
blacklist ${HOME}/.config/Gpredict
|
||||||
|
blacklist ${HOME}/.config/aweather
|
||||||
|
blacklist ${HOME}/.config/stellarium
|
||||||
|
blacklist ${HOME}/.config/atril
|
||||||
|
blacklist ${HOME}/.config/xreader
|
||||||
|
blacklist ${HOME}/.config/xviewer
|
||||||
|
blacklist ${HOME}/.config/libreoffice
|
||||||
|
blacklist ${HOME}/.config/pix
|
||||||
|
blacklist ${HOME}/.config/mate/eom
|
||||||
|
blacklist ${HOME}/.kde/share/apps/okular
|
||||||
|
blacklist ${HOME}/.kde/share/config/okularrc
|
||||||
|
blacklist ${HOME}/.kde/share/config/okularpartrc
|
||||||
|
blacklist ${HOME}/.kde/share/apps/gwenview
|
||||||
|
blacklist ${HOME}/.kde/share/config/gwenviewrc
|
||||||
|
blacklist ${HOME}/.config/qpdfview
|
||||||
|
blacklist ${HOME}/.config/Luminance
|
||||||
|
blacklist ${HOME}/.config/synfig
|
||||||
|
blacklist ${HOME}/.synfig
|
||||||
|
blacklist ${HOME}/.inkscape
|
||||||
|
blacklist ${HOME}/.gimp*
|
||||||
|
blacklist ${HOME}/.config/zathura
|
||||||
|
blacklist ${HOME}/.config/cherrytree
|
||||||
|
blacklist ${HOME}/.xpdfrc
|
||||||
|
blacklist ${HOME}/.openshot
|
||||||
|
blacklist ${HOME}/.openshot_qt
|
||||||
|
blacklist ${HOME}/.flowblade
|
||||||
|
blacklist ${HOME}/.config/flowblade
|
||||||
|
blacklist ${HOME}/.config/eog
|
||||||
|
|
||||||
|
|
||||||
|
# Media players
|
||||||
|
blacklist ${HOME}/.config/cmus
|
||||||
|
blacklist ${HOME}/.config/deadbeef
|
||||||
|
blacklist ${HOME}/.config/spotify
|
||||||
|
blacklist ${HOME}/.config/vlc
|
||||||
|
blacklist ${HOME}/.config/mpv
|
||||||
|
blacklist ${HOME}/.config/totem
|
||||||
|
blacklist ${HOME}/.config/xplayer
|
||||||
|
blacklist ${HOME}/.audacity-data
|
||||||
|
|
||||||
|
# HTTP / FTP / Mail
|
||||||
|
blacklist ${HOME}/.icedove
|
||||||
|
blacklist ${HOME}/.thunderbird
|
||||||
|
blacklist ${HOME}/.sylpheed-2.0
|
||||||
|
blacklist ${HOME}/.config/midori
|
||||||
|
blacklist ${HOME}/.mozilla
|
||||||
|
blacklist ${HOME}/.config/chromium
|
||||||
|
blacklist ${HOME}/.config/google-chrome
|
||||||
|
blacklist ${HOME}/.config/google-chrome-beta
|
||||||
|
blacklist ${HOME}/.config/google-chrome-unstable
|
||||||
|
blacklist ${HOME}/.config/opera
|
||||||
|
blacklist ${HOME}/.config/opera-beta
|
||||||
|
blacklist ${HOME}/.opera
|
||||||
|
blacklist ${HOME}/.config/vivaldi
|
||||||
|
blacklist ${HOME}/.filezilla
|
||||||
|
blacklist ${HOME}/.config/filezilla
|
||||||
|
blacklist ${HOME}/.dillo
|
||||||
|
blacklist ${HOME}/.conkeror.mozdev.org
|
||||||
|
blacklist ${HOME}/.config/epiphany
|
||||||
|
blacklist ${HOME}/.config/slimjet
|
||||||
|
blacklist ${HOME}/.config/qutebrowser
|
||||||
|
blacklist ${HOME}/.8pecxstudios
|
||||||
|
blacklist ${HOME}/.config/brave
|
||||||
|
blacklist ${HOME}/.config/inox
|
||||||
|
blacklist ${HOME}/.muttrc
|
||||||
|
blacklist ${HOME}/.mutt
|
||||||
|
blacklist ${HOME}/.mutt/muttrc
|
||||||
|
blacklist ${HOME}/.msmtprc
|
||||||
|
blacklist ${HOME}/.config/evolution
|
||||||
|
blacklist ${HOME}/.local/share/evolution
|
||||||
|
blacklist ${HOME}/.cache/evolution
|
||||||
|
|
||||||
|
# Instant Messaging
|
||||||
|
blacklist ${HOME}/.config/hexchat
|
||||||
|
blacklist ${HOME}/.mcabber
|
||||||
|
blacklist ${HOME}/.mcabberrc
|
||||||
|
blacklist ${HOME}/.purple
|
||||||
|
blacklist ${HOME}/.config/psi+
|
||||||
|
blacklist ${HOME}/.retroshare
|
||||||
|
blacklist ${HOME}/.weechat
|
||||||
|
blacklist ${HOME}/.config/xchat
|
||||||
|
blacklist ${HOME}/.Skype
|
||||||
|
blacklist ${HOME}/.config/skypeforlinux
|
||||||
|
blacklist ${HOME}/.config/tox
|
||||||
|
blacklist ${HOME}/.TelegramDesktop
|
||||||
|
blacklist ${HOME}/.config/Gitter
|
||||||
|
blacklist ${HOME}/.config/Franz
|
||||||
|
blacklist ${HOME}/.jitsi
|
||||||
|
blacklist ${HOME}/.config/Slack
|
||||||
|
blacklist ${HOME}/.cache/gajim
|
||||||
|
blacklist ${HOME}/.local/share/gajim
|
||||||
|
blacklist ${HOME}/.config/gajim
|
||||||
|
|
||||||
|
# Games
|
||||||
|
blacklist ${HOME}/.hedgewars
|
||||||
|
blacklist ${HOME}/.steam
|
||||||
|
blacklist ${HOME}/.config/wesnoth
|
||||||
|
blacklist ${HOME}/.config/0ad
|
||||||
|
blacklist ${HOME}/.warzone2100-3.1
|
||||||
|
blacklist ${HOME}/.dosbox
|
||||||
|
|
||||||
|
# Cryptocoins
|
||||||
|
blacklist ${HOME}/.*coin
|
||||||
|
blacklist ${HOME}/.electrum*
|
||||||
|
blacklist ${HOME}/wallet.dat
|
||||||
|
|
||||||
|
# git, subversion
|
||||||
|
blacklist ${HOME}/.subversion
|
||||||
|
blacklist ${HOME}/.gitconfig
|
||||||
|
blacklist ${HOME}/.git-credential-cache
|
||||||
|
|
||||||
|
# cache
|
||||||
|
blacklist ${HOME}/.cache/mozilla
|
||||||
|
blacklist ${HOME}/.cache/chromium
|
||||||
|
blacklist ${HOME}/.cache/google-chrome
|
||||||
|
blacklist ${HOME}/.cache/google-chrome-beta
|
||||||
|
blacklist ${HOME}/.cache/google-chrome-unstable
|
||||||
|
blacklist ${HOME}/.cache/opera
|
||||||
|
blacklist ${HOME}/.cache/opera-beta
|
||||||
|
blacklist ${HOME}/.cache/vivaldi
|
||||||
|
blacklist ${HOME}/.cache/epiphany
|
||||||
|
blacklist ${HOME}/.cache/slimjet
|
||||||
|
blacklist ${HOME}/.cache/qutebrowser
|
||||||
|
blacklist ${HOME}/.cache/spotify
|
||||||
|
blacklist ${HOME}/.cache/thunderbird
|
||||||
|
blacklist ${HOME}/.cache/icedove
|
||||||
|
blacklist ${HOME}/.cache/transmission
|
||||||
|
blacklist ${HOME}/.cache/wesnoth
|
||||||
|
blacklist ${HOME}/.cache/0ad
|
||||||
|
blacklist ${HOME}/.cache/8pecxstudios
|
||||||
|
blacklist ${HOME}/.cache/xreader
|
||||||
|
blacklist ${HOME}/.cache/Franz
|
||||||
|
|
||||||
|
# share
|
||||||
|
blacklist ${HOME}/.local/share/epiphany
|
||||||
|
blacklist ${HOME}/.local/share/mupen64plus
|
||||||
|
blacklist ${HOME}/.local/share/spotify
|
||||||
|
blacklist ${HOME}/.local/share/steam
|
||||||
|
blacklist ${HOME}/.local/share/wesnoth
|
||||||
|
blacklist ${HOME}/.local/share/0ad
|
||||||
|
blacklist ${HOME}/.local/share/xplayer
|
||||||
|
blacklist ${HOME}/.local/share/totem
|
||||||
|
blacklist ${HOME}/.local/share/psi+
|
||||||
|
blacklist ${HOME}/.local/share/pix
|
||||||
|
blacklist ${HOME}/.local/share/gnome-chess
|
||||||
|
blacklist ${HOME}/.local/share/qpdfview
|
||||||
|
blacklist ${HOME}/.local/share/zathura
|
||||||
|
|
||||||
|
# ssh
|
||||||
|
blacklist /tmp/ssh-*
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
# security profile for dnscrypt-proxy
|
||||||
|
noblacklist /sbin
|
||||||
|
noblacklist /usr/sbin
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
private
|
||||||
|
private-dev
|
||||||
|
nosound
|
||||||
|
no3d
|
||||||
|
seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open
|
||||||
|
|
||||||
|
|
@ -0,0 +1,17 @@
|
||||||
|
# dnsmasq profile
|
||||||
|
noblacklist /sbin
|
||||||
|
noblacklist /usr/sbin
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
caps
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
private
|
||||||
|
private-dev
|
||||||
|
nosound
|
||||||
|
no3d
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
seccomp
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# Firejail profile for dosbox
|
||||||
|
noblacklist ~/.dosbox
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-bin dosbox
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# dropbox profile
|
||||||
|
noblacklist ~/.config/autostart
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
||||||
|
mkdir ~/Dropbox
|
||||||
|
whitelist ~/Dropbox
|
||||||
|
mkdir ~/.dropbox
|
||||||
|
whitelist ~/.dropbox
|
||||||
|
mkdir ~/.dropbox-dist
|
||||||
|
whitelist ~/.dropbox-dist
|
||||||
|
|
||||||
|
mkfile ~/.config/autostart/dropbox.desktop
|
||||||
|
whitelist ~/.config/autostart/dropbox.desktop
|
||||||
|
|
@ -0,0 +1,17 @@
|
||||||
|
# emacs profile
|
||||||
|
|
||||||
|
noblacklist ~/.emacs
|
||||||
|
noblacklist ~/.emacs.d
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nogroups
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
# Empathy instant messaging profile
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
# eog (gnome image viewer) profile
|
||||||
|
|
||||||
|
noblacklist ~/.config/eog
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nogroups
|
||||||
|
protocol unix
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
|
||||||
|
private-bin eog
|
||||||
|
private-dev
|
||||||
|
private-etc fonts
|
||||||
|
private-tmp
|
||||||
|
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# Firejail profile for Eye of Mate (eom)
|
||||||
|
noblacklist ~/.config/mate/eom
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-bin eom
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
# Epiphany browser profile
|
||||||
|
noblacklist ${HOME}/.config/epiphany
|
||||||
|
noblacklist ${HOME}/.cache/epiphany
|
||||||
|
noblacklist ${HOME}/.local/share/epiphany
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
mkdir ${HOME}/.local/share/epiphany
|
||||||
|
whitelist ${HOME}/.local/share/epiphany
|
||||||
|
mkdir ${HOME}/.config/epiphany
|
||||||
|
whitelist ${HOME}/.config/epiphany
|
||||||
|
mkdir ${HOME}/.cache/epiphany
|
||||||
|
whitelist ${HOME}/.cache/epiphany
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
# evince pdf reader profile
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-bin evince,evince-previewer,evince-thumbnailer
|
||||||
|
private-dev
|
||||||
|
|
@ -0,0 +1,25 @@
|
||||||
|
# evolution profile
|
||||||
|
|
||||||
|
noblacklist ~/.config/evolution
|
||||||
|
noblacklist ~/.local/share/evolution
|
||||||
|
noblacklist ~/.cache/evolution
|
||||||
|
noblacklist ~/.pki
|
||||||
|
noblacklist ~/.pki/nssdb
|
||||||
|
noblacklist ~/.gnupg
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nogroups
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# fbreader ebook reader profile
|
||||||
|
noblacklist ${HOME}/.FBReader
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
||||||
|
shell none
|
||||||
|
private-bin fbreader,FBReader
|
||||||
|
whitelist /tmp/.X11-unix
|
||||||
|
private-dev
|
||||||
|
nosound
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# feh image viewer profile
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
seccomp
|
||||||
|
protocol unix
|
||||||
|
netfilter
|
||||||
|
net none
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nogroups
|
||||||
|
nosound
|
||||||
|
shell none
|
||||||
|
|
||||||
|
private-bin feh
|
||||||
|
whitelist /tmp/.X11-unix
|
||||||
|
private-dev
|
||||||
|
private-etc feh
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
# file profile
|
||||||
|
quiet
|
||||||
|
ignore noroot
|
||||||
|
include /etc/firejail/default.profile
|
||||||
|
|
||||||
|
tracelog
|
||||||
|
net none
|
||||||
|
shell none
|
||||||
|
private-bin file
|
||||||
|
private-etc magic.mgc,magic,localtime
|
||||||
|
hostname file
|
||||||
|
private-dev
|
||||||
|
nosound
|
||||||
|
no3d
|
||||||
|
blacklist /tmp/.X11-unix
|
||||||
|
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
# FileZilla ftp profile
|
||||||
|
noblacklist ${HOME}/.filezilla
|
||||||
|
noblacklist ${HOME}/.config/filezilla
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
||||||
|
shell none
|
||||||
|
private-bin filezilla,uname,sh,python,lsb_release,fzputtygen,fzsftp
|
||||||
|
whitelist /tmp/.X11-unix
|
||||||
|
private-dev
|
||||||
|
nosound
|
||||||
|
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
# Firejail profile for Mozilla Firefox ESR
|
||||||
|
include /etc/firejail/firefox.profile
|
||||||
|
|
@ -0,0 +1,50 @@
|
||||||
|
# Firejail profile for Mozilla Firefox (Iceweasel in Debian)
|
||||||
|
|
||||||
|
noblacklist ~/.mozilla
|
||||||
|
noblacklist ~/.cache/mozilla
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
seccomp
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
mkdir ~/.mozilla
|
||||||
|
whitelist ~/.mozilla
|
||||||
|
mkdir ~/.cache/mozilla/firefox
|
||||||
|
whitelist ~/.cache/mozilla/firefox
|
||||||
|
whitelist ~/dwhelper
|
||||||
|
whitelist ~/.zotero
|
||||||
|
whitelist ~/.vimperatorrc
|
||||||
|
whitelist ~/.vimperator
|
||||||
|
whitelist ~/.pentadactylrc
|
||||||
|
whitelist ~/.pentadactyl
|
||||||
|
whitelist ~/.keysnail.js
|
||||||
|
whitelist ~/.config/gnome-mplayer
|
||||||
|
whitelist ~/.cache/gnome-mplayer/plugin
|
||||||
|
whitelist ~/.pki
|
||||||
|
|
||||||
|
# lastpass, keepassx
|
||||||
|
whitelist ~/.keepassx
|
||||||
|
whitelist ~/.config/keepassx
|
||||||
|
whitelist ~/keepassx.kdbx
|
||||||
|
whitelist ~/.lastpass
|
||||||
|
whitelist ~/.config/lastpass
|
||||||
|
|
||||||
|
|
||||||
|
#silverlight
|
||||||
|
whitelist ~/.wine-pipelight
|
||||||
|
whitelist ~/.wine-pipelight64
|
||||||
|
whitelist ~/.config/pipelight-widevine
|
||||||
|
whitelist ~/.config/pipelight-silverlight5.1
|
||||||
|
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
||||||
|
# experimental features
|
||||||
|
#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse
|
||||||
|
|
@ -0,0 +1,81 @@
|
||||||
|
# This is Firejail system-wide configuration file, see firejail-config(5) for
|
||||||
|
# more information. The file contains keyword-argument pairs, one per line.
|
||||||
|
# Most features are enabled by default. Use 'yes' or 'no' as configuration
|
||||||
|
# values.
|
||||||
|
|
||||||
|
# Enable or disable bind support, default enabled.
|
||||||
|
# bind yes
|
||||||
|
|
||||||
|
# Enable or disable chroot support, default enabled.
|
||||||
|
# chroot yes
|
||||||
|
|
||||||
|
# Use chroot for desktop programs, default enabled. The sandbox will have full
|
||||||
|
# access to system's /dev directory in order to allow video acceleration,
|
||||||
|
# and it will harden the rest of the chroot tree.
|
||||||
|
# chroot-desktop yes
|
||||||
|
|
||||||
|
# Enable or disable file transfer support, default enabled.
|
||||||
|
# file-transfer yes
|
||||||
|
|
||||||
|
# Force use of nonewprivs. This mitigates the possibility of
|
||||||
|
# a user abusing firejail's features to trick a privileged (suid
|
||||||
|
# or file capabilities) process into loading code or configuration
|
||||||
|
# that is partially under their control. Default disabled.
|
||||||
|
# force-nonewprivs no
|
||||||
|
|
||||||
|
# Enable or disable networking features, default enabled.
|
||||||
|
# network yes
|
||||||
|
|
||||||
|
# Enable or disable overlayfs features, default enabled.
|
||||||
|
# overlayfs yes
|
||||||
|
|
||||||
|
# Remove /usr/local directories from private-bin list, default disabled.
|
||||||
|
# private-bin-no-local no
|
||||||
|
|
||||||
|
# Enable or disable private-home feature, default enabled
|
||||||
|
# private-home yes
|
||||||
|
|
||||||
|
# Enable --quiet as default every time the sandbox is started. Default disabled.
|
||||||
|
# quiet-by-default no
|
||||||
|
|
||||||
|
# Remount /proc and /sys inside the sandbox, default enabled.
|
||||||
|
# remount-proc-sys yes
|
||||||
|
|
||||||
|
# Enable or disable restricted network support, default disabled. If enabled,
|
||||||
|
# networking features should also be enabled (network yes).
|
||||||
|
# Restricted networking grants access to --interface, --net=ethXXX and
|
||||||
|
# --netfilter only to root user. Regular users are only allowed --net=none.
|
||||||
|
# restricted-network no
|
||||||
|
|
||||||
|
# Change default netfilter configuration. When using --netfilter option without
|
||||||
|
# a file argument, the default filter is hardcoded (see man 1 firejail). This
|
||||||
|
# configuration entry allows the user to change the default by specifying
|
||||||
|
# a file containing the filter configuration. The filter file format is the
|
||||||
|
# format of iptables-save and iptable-restore commands. Example:
|
||||||
|
# netfilter-default /etc/iptables.iptables.rules
|
||||||
|
|
||||||
|
# Enable or disable seccomp support, default enabled.
|
||||||
|
# seccomp yes
|
||||||
|
|
||||||
|
# Enable or disable user namespace support, default enabled.
|
||||||
|
# userns yes
|
||||||
|
|
||||||
|
# Enable or disable whitelisting support, default enabled.
|
||||||
|
# whitelist yes
|
||||||
|
|
||||||
|
# Enable or disable X11 sandboxing support, default enabled.
|
||||||
|
# x11 yes
|
||||||
|
|
||||||
|
# Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for
|
||||||
|
# a full list of resolutions available on your specific setup.
|
||||||
|
# xephyr-screen 640x480
|
||||||
|
# xephyr-screen 800x600
|
||||||
|
# xephyr-screen 1024x768
|
||||||
|
# xephyr-screen 1280x1024
|
||||||
|
|
||||||
|
# Firejail window title in Xephyr, default enabled.
|
||||||
|
# xephyr-window-title yes
|
||||||
|
|
||||||
|
# Xephyr command extra parameters. None by default, and the declaration is commented out.
|
||||||
|
# xephyr-extra-params -keybd ephyr,,,xkbmodel=evdev
|
||||||
|
# xephyr-extra-params -grayscale
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
# SlimJet browser profile
|
||||||
|
# This is a whitelisted profile, the internal browser sandbox
|
||||||
|
# is disabled because it requires sudo password. The command
|
||||||
|
# to run it is as follows:
|
||||||
|
#
|
||||||
|
# firejail flashpeak-slimjet --no-sandbox
|
||||||
|
#
|
||||||
|
noblacklist ~/.config/slimjet
|
||||||
|
noblacklist ~/.cache/slimjet
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
|
||||||
|
# chromium is distributed with a perl script on Arch
|
||||||
|
# include /etc/firejail/disable-devel.inc
|
||||||
|
#
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
seccomp
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
mkdir ~/.config/slimjet
|
||||||
|
whitelist ~/.config/slimjet
|
||||||
|
mkdir ~/.cache/slimjet
|
||||||
|
whitelist ~/.cache/slimjet
|
||||||
|
mkdir ~/.pki
|
||||||
|
whitelist ~/.pki
|
||||||
|
|
||||||
|
# lastpass, keepassx
|
||||||
|
whitelist ~/.keepassx
|
||||||
|
whitelist ~/.config/keepassx
|
||||||
|
whitelist ~/keepassx.kdbx
|
||||||
|
whitelist ~/.lastpass
|
||||||
|
whitelist ~/.config/lastpass
|
||||||
|
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
# OpenShot profile
|
||||||
|
noblacklist ${HOME}/.flowblade
|
||||||
|
noblacklist ${HOME}/.config/flowblade
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
seccomp
|
||||||
|
|
@ -0,0 +1,24 @@
|
||||||
|
# Franz profile
|
||||||
|
noblacklist ~/.config/Franz
|
||||||
|
noblacklist ~/.cache/Franz
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
seccomp
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
netfilter
|
||||||
|
#tracelog
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
mkdir ~/.config/Franz
|
||||||
|
whitelist ~/.config/Franz
|
||||||
|
mkdir ~/.cache/Franz
|
||||||
|
whitelist ~/.cache/Franz
|
||||||
|
mkdir ~/.pki
|
||||||
|
whitelist ~/.pki
|
||||||
|
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
@ -0,0 +1,33 @@
|
||||||
|
# Firejail profile for Gajim
|
||||||
|
|
||||||
|
mkdir ${HOME}/.cache/gajim
|
||||||
|
mkdir ${HOME}/.local/share/gajim
|
||||||
|
mkdir ${HOME}/.config/gajim
|
||||||
|
mkdir ${HOME}/Downloads
|
||||||
|
|
||||||
|
# Allow the local python 2.7 site packages, in case any plugins are using these
|
||||||
|
mkdir ${HOME}/.local/lib/python2.7/site-packages/
|
||||||
|
whitelist ${HOME}/.local/lib/python2.7/site-packages/
|
||||||
|
read-only ${HOME}/.local/lib/python2.7/site-packages/
|
||||||
|
|
||||||
|
whitelist ${HOME}/.cache/gajim
|
||||||
|
whitelist ${HOME}/.local/share/gajim
|
||||||
|
whitelist ${HOME}/.config/gajim
|
||||||
|
whitelist ${HOME}/Downloads
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
nogroups
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
|
||||||
|
#private-bin python2.7 gajim
|
||||||
|
private-dev
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
# gimp
|
||||||
|
noblacklist ${HOME}/.gimp*
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix
|
||||||
|
seccomp
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
noexec ${HOME}
|
||||||
|
noexec /tmp
|
||||||
|
nogroups
|
||||||
|
nosound
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
# git profile
|
||||||
|
quiet
|
||||||
|
noblacklist ~/.gitconfig
|
||||||
|
noblacklist ~/.ssh
|
||||||
|
noblacklist ~/.gnupg
|
||||||
|
noblacklist ~/.emacs
|
||||||
|
noblacklist ~/.emacs.d
|
||||||
|
noblacklist ~/.viminfo
|
||||||
|
noblacklist ~/.vim
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nogroups
|
||||||
|
nosound
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
|
||||||
|
private-dev
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Firejail profile for Gitter
|
||||||
|
noblacklist ~/.config/Gitter
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
|
||||||
|
private-bin gitter
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
# Firejail profile for gnome-chess
|
||||||
|
noblacklist /.local/share/gnome-chess
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-bin fairymax,gnome-chess,hoichess
|
||||||
|
private-dev
|
||||||
|
private-etc fonts,gnome-chess
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,17 @@
|
||||||
|
# GNOME MPlayer profile
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
|
||||||
|
private-bin gnome-mplayer
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,27 @@
|
||||||
|
# Google Chrome beta browser profile
|
||||||
|
noblacklist ~/.config/google-chrome-beta
|
||||||
|
noblacklist ~/.cache/google-chrome-beta
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
|
||||||
|
# chromium is distributed with a perl script on Arch
|
||||||
|
# include /etc/firejail/disable-devel.inc
|
||||||
|
#
|
||||||
|
|
||||||
|
netfilter
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
mkdir ~/.config/google-chrome-beta
|
||||||
|
whitelist ~/.config/google-chrome-beta
|
||||||
|
mkdir ~/.cache/google-chrome-beta
|
||||||
|
whitelist ~/.cache/google-chrome-beta
|
||||||
|
mkdir ~/.pki
|
||||||
|
whitelist ~/.pki
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
||||||
|
# lastpass, keepassx
|
||||||
|
whitelist ~/.keepassx
|
||||||
|
whitelist ~/.config/keepassx
|
||||||
|
whitelist ~/keepassx.kdbx
|
||||||
|
whitelist ~/.lastpass
|
||||||
|
whitelist ~/.config/lastpass
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
# Google Chrome browser profile
|
||||||
|
include /etc/firejail/google-chrome.profile
|
||||||
|
|
@ -0,0 +1,27 @@
|
||||||
|
# Google Chrome unstable browser profile
|
||||||
|
noblacklist ~/.config/google-chrome-unstable
|
||||||
|
noblacklist ~/.cache/google-chrome-unstable
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
|
||||||
|
# chromium is distributed with a perl script on Arch
|
||||||
|
# include /etc/firejail/disable-devel.inc
|
||||||
|
#
|
||||||
|
|
||||||
|
netfilter
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
mkdir ~/.config/google-chrome-unstable
|
||||||
|
whitelist ~/.config/google-chrome-unstable
|
||||||
|
mkdir ~/.cache/google-chrome-unstable
|
||||||
|
whitelist ~/.cache/google-chrome-unstable
|
||||||
|
mkdir ~/.pki
|
||||||
|
whitelist ~/.pki
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
||||||
|
# lastpass, keepassx
|
||||||
|
whitelist ~/.keepassx
|
||||||
|
whitelist ~/.config/keepassx
|
||||||
|
whitelist ~/keepassx.kdbx
|
||||||
|
whitelist ~/.lastpass
|
||||||
|
whitelist ~/.config/lastpass
|
||||||
|
|
@ -0,0 +1,28 @@
|
||||||
|
# Google Chrome browser profile
|
||||||
|
noblacklist ~/.config/google-chrome
|
||||||
|
noblacklist ~/.cache/google-chrome
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
|
||||||
|
# chromium is distributed with a perl script on Arch
|
||||||
|
# include /etc/firejail/disable-devel.inc
|
||||||
|
#
|
||||||
|
|
||||||
|
netfilter
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
mkdir ~/.config/google-chrome
|
||||||
|
whitelist ~/.config/google-chrome
|
||||||
|
mkdir ~/.cache/google-chrome
|
||||||
|
whitelist ~/.cache/google-chrome
|
||||||
|
mkdir ~/.pki
|
||||||
|
whitelist ~/.pki
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
||||||
|
# lastpass, keepassx
|
||||||
|
whitelist ~/.keepassx
|
||||||
|
whitelist ~/.config/keepassx
|
||||||
|
whitelist ~/keepassx.kdbx
|
||||||
|
whitelist ~/.lastpass
|
||||||
|
whitelist ~/.config/lastpass
|
||||||
|
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
# Google Play Music desktop player profile
|
||||||
|
noblacklist ~/.config/Google Play Music Desktop Player
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
netfilter
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
seccomp
|
||||||
|
|
||||||
|
#whitelist ~/.pulse
|
||||||
|
#whitelist ~/.config/pulse
|
||||||
|
whitelist ~/.config/Google Play Music Desktop Player
|
||||||
|
|
@ -0,0 +1,25 @@
|
||||||
|
# Firejail profile for gpredict.
|
||||||
|
noblacklist ~/.config/Gpredict
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
|
||||||
|
# Whitelist
|
||||||
|
mkdir ~/.config/Gpredict
|
||||||
|
whitelist ~/.config/Gpredict
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
nogroups
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-bin gpredict
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,3 @@
|
||||||
|
# gtar profile
|
||||||
|
quiet
|
||||||
|
include /etc/firejail/tar.profile
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# gthumb profile
|
||||||
|
noblacklist ${HOME}/.config/gthumb
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-bin gthumb
|
||||||
|
whitelist /tmp/.X11-unix
|
||||||
|
private-dev
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# KDE gwenview profile
|
||||||
|
noblacklist ~/.kde/share/apps/gwenview
|
||||||
|
noblacklist ~/.kde/share/config/gwenviewrc
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nogroups
|
||||||
|
private-dev
|
||||||
|
protocol unix
|
||||||
|
seccomp
|
||||||
|
nosound
|
||||||
|
|
||||||
|
#Experimental:
|
||||||
|
#shell none
|
||||||
|
#private-bin gwenview
|
||||||
|
#private-etc X11
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
# gzip profile
|
||||||
|
quiet
|
||||||
|
ignore noroot
|
||||||
|
include /etc/firejail/default.profile
|
||||||
|
tracelog
|
||||||
|
net none
|
||||||
|
shell none
|
||||||
|
blacklist /tmp/.X11-unix
|
||||||
|
private-dev
|
||||||
|
nosound
|
||||||
|
no3d
|
||||||
|
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
# whitelist profile for Hedgewars (game)
|
||||||
|
noblacklist ${HOME}/.hedgewars
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
seccomp
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
||||||
|
mkdir ~/.hedgewars
|
||||||
|
whitelist ~/.hedgewars
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
@ -0,0 +1,28 @@
|
||||||
|
# HexChat instant messaging profile
|
||||||
|
# Currently in testing (may not work for all users)
|
||||||
|
noblacklist ${HOME}/.config/hexchat
|
||||||
|
#noblacklist /usr/lib/python2*
|
||||||
|
#noblacklist /usr/lib/python3*
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
mkdir ~/.config/hexchat
|
||||||
|
whitelist ~/.config/hexchat
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
||||||
|
private-bin hexchat
|
||||||
|
#debug note: private-bin requires perl, python, etc on some systems
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,51 @@
|
||||||
|
# Firejail profile for GNU Icecat
|
||||||
|
|
||||||
|
noblacklist ~/.mozilla
|
||||||
|
noblacklist ~/.cache/mozilla
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
seccomp
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
mkdir ~/.mozilla
|
||||||
|
whitelist ~/.mozilla
|
||||||
|
mkdir ~/.cache/mozilla/icecat
|
||||||
|
whitelist ~/.cache/mozilla/icecat
|
||||||
|
whitelist ~/dwhelper
|
||||||
|
whitelist ~/.zotero
|
||||||
|
whitelist ~/.vimperatorrc
|
||||||
|
whitelist ~/.vimperator
|
||||||
|
whitelist ~/.pentadactylrc
|
||||||
|
whitelist ~/.pentadactyl
|
||||||
|
whitelist ~/.keysnail.js
|
||||||
|
whitelist ~/.config/gnome-mplayer
|
||||||
|
whitelist ~/.cache/gnome-mplayer/plugin
|
||||||
|
whitelist ~/.pki
|
||||||
|
|
||||||
|
# lastpass, keepassx
|
||||||
|
whitelist ~/.keepassx
|
||||||
|
whitelist ~/.config/keepassx
|
||||||
|
whitelist ~/keepassx.kdbx
|
||||||
|
whitelist ~/.lastpass
|
||||||
|
whitelist ~/.config/lastpass
|
||||||
|
|
||||||
|
|
||||||
|
#silverlight
|
||||||
|
whitelist ~/.wine-pipelight
|
||||||
|
whitelist ~/.wine-pipelight64
|
||||||
|
whitelist ~/.config/pipelight-widevine
|
||||||
|
whitelist ~/.config/pipelight-silverlight5.1
|
||||||
|
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
||||||
|
# experimental features
|
||||||
|
#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse
|
||||||
|
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
# Firejail profile for Mozilla Thunderbird (Icedove in Debian Stable)
|
||||||
|
# Users have icedove set to open a browser by clicking a link in an email
|
||||||
|
# We are not allowed to blacklist browser-specific directories
|
||||||
|
|
||||||
|
noblacklist ~/.gnupg
|
||||||
|
mkdir ~/.gnupg
|
||||||
|
whitelist ~/.gnupg
|
||||||
|
|
||||||
|
noblacklist ~/.icedove
|
||||||
|
mkdir ~/.icedove
|
||||||
|
whitelist ~/.icedove
|
||||||
|
|
||||||
|
noblacklist ~/.cache/icedove
|
||||||
|
mkdir ~/.cache/icedove
|
||||||
|
whitelist ~/.cache/icedove
|
||||||
|
|
||||||
|
include /etc/firejail/firefox.profile
|
||||||
|
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
# Firejail profile for Mozilla Firefox (Iceweasel in Debian)
|
||||||
|
include /etc/firejail/firefox.profile
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
# inkscape
|
||||||
|
noblacklist ${HOME}/.inkscape
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix
|
||||||
|
seccomp
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
noexec ${HOME}
|
||||||
|
noexec /tmp
|
||||||
|
nogroups
|
||||||
|
nosound
|
||||||
|
|
@ -0,0 +1,24 @@
|
||||||
|
# Inox browser profile
|
||||||
|
noblacklist ~/.config/inox
|
||||||
|
noblacklist ~/.cache/inox
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
|
||||||
|
netfilter
|
||||||
|
|
||||||
|
whitelist ${DOWNLOADS}
|
||||||
|
mkdir ~/.config/inox
|
||||||
|
whitelist ~/.config/inox
|
||||||
|
mkdir ~/.cache/inox
|
||||||
|
whitelist ~/.cache/inox
|
||||||
|
mkdir ~/.pki
|
||||||
|
whitelist ~/.pki
|
||||||
|
|
||||||
|
# lastpass, keepassx
|
||||||
|
whitelist ~/.keepassx
|
||||||
|
whitelist ~/.config/keepassx
|
||||||
|
whitelist ~/keepassx.kdbx
|
||||||
|
whitelist ~/.lastpass
|
||||||
|
whitelist ~/.config/lastpass
|
||||||
|
|
||||||
|
include /etc/firejail/whitelist-common.inc
|
||||||
|
|
@ -0,0 +1,17 @@
|
||||||
|
# Firejail profile for jitsi
|
||||||
|
noblacklist ~/.jitsi
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nonewprivs
|
||||||
|
nogroups
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
# keepass password manager profile
|
||||||
|
|
||||||
|
noblacklist ${HOME}/.config/keepass
|
||||||
|
noblacklist ${HOME}/.keepass
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
netfilter
|
||||||
|
shell none
|
||||||
|
|
||||||
|
private-tmp
|
||||||
|
private-dev
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
# keepassx password manager profile
|
||||||
|
|
||||||
|
noblacklist ${HOME}/.config/keepassx
|
||||||
|
noblacklist ${HOME}/.keepassx
|
||||||
|
noblacklist ${HOME}/keepassx.kdbx
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix
|
||||||
|
seccomp
|
||||||
|
netfilter
|
||||||
|
shell none
|
||||||
|
|
||||||
|
private-tmp
|
||||||
|
private-dev
|
||||||
|
|
@ -0,0 +1,19 @@
|
||||||
|
# kmail profile
|
||||||
|
noblacklist ${HOME}/.gnupg
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
nogroups
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6,netlink
|
||||||
|
seccomp
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-dev
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,15 @@
|
||||||
|
# Firejail konversation profile
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nogroups
|
||||||
|
noroot
|
||||||
|
seccomp
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
|
||||||
|
private-tmp
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
# less profile
|
||||||
|
quiet
|
||||||
|
ignore noroot
|
||||||
|
include /etc/firejail/default.profile
|
||||||
|
tracelog
|
||||||
|
net none
|
||||||
|
shell none
|
||||||
|
private-dev
|
||||||
|
nosound
|
||||||
|
|
@ -0,0 +1,19 @@
|
||||||
|
# Firejail profile for LibreOffice
|
||||||
|
noblacklist ~/.config/libreoffice
|
||||||
|
noblacklist /usr/local/sbin
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-dev
|
||||||
|
# whitelist /tmp/.X11-unix/
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
################################
|
||||||
|
# LibreOffice profile
|
||||||
|
################################
|
||||||
|
include /etc/firejail/libreoffice.profile
|
||||||
|
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
################################
|
||||||
|
# LibreOffice profile
|
||||||
|
################################
|
||||||
|
include /etc/firejail/libreoffice.profile
|
||||||
|
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
################################
|
||||||
|
# LibreOffice profile
|
||||||
|
################################
|
||||||
|
include /etc/firejail/libreoffice.profile
|
||||||
|
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
################################
|
||||||
|
# LibreOffice profile
|
||||||
|
################################
|
||||||
|
include /etc/firejail/libreoffice.profile
|
||||||
|
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
# /etc/firejail/login.users - restricted user shell configuration
|
||||||
|
#
|
||||||
|
# Each user entry consists of a user name and firejail
|
||||||
|
# program arguments:
|
||||||
|
#
|
||||||
|
# user name: arguments
|
||||||
|
#
|
||||||
|
# For example:
|
||||||
|
#
|
||||||
|
# netblue:--net=none --protocol=unix
|
||||||
|
#
|
||||||
|
# The extra arguments are inserted into program command line if firejail
|
||||||
|
# was started as a login shell.
|
||||||
|
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
################################
|
||||||
|
# LibreOffice profile
|
||||||
|
################################
|
||||||
|
include /etc/firejail/libreoffice.profile
|
||||||
|
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
################################
|
||||||
|
# LibreOffice profile
|
||||||
|
################################
|
||||||
|
include /etc/firejail/libreoffice.profile
|
||||||
|
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
################################
|
||||||
|
# LibreOffice profile
|
||||||
|
################################
|
||||||
|
include /etc/firejail/libreoffice.profile
|
||||||
|
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
################################
|
||||||
|
# LibreOffice profile
|
||||||
|
################################
|
||||||
|
include /etc/firejail/libreoffice.profile
|
||||||
|
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# luminance-hdr
|
||||||
|
noblacklist ${HOME}/.config/Luminance
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
protocol unix
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
seccomp
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
private-tmp
|
||||||
|
private-dev
|
||||||
|
noexec ${HOME}
|
||||||
|
noexec /tmp
|
||||||
|
nogroups
|
||||||
|
nosound
|
||||||
|
ipc-namespace
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
# lxterminal (LXDE) profile
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
#noroot - somehow this breaks on Debian Jessie!
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
# Mathematica profile
|
||||||
|
include /etc/firejail/Mathematica.profile
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# mcabber profile
|
||||||
|
noblacklist ${HOME}/.mcabber
|
||||||
|
noblacklist ${HOME}/.mcabberrc
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
||||||
|
private-bin mcabber
|
||||||
|
private-etc null
|
||||||
|
private-dev
|
||||||
|
shell none
|
||||||
|
nosound
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
# Midori browser profile
|
||||||
|
noblacklist ${HOME}/.config/midori
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
# noroot - noroot break midori on Ubuntu 14.04
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
# mpv media player profile
|
||||||
|
noblacklist ${HOME}/.config/mpv
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
netfilter
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
protocol unix,inet,inet6
|
||||||
|
seccomp
|
||||||
|
|
||||||
|
# to test
|
||||||
|
shell none
|
||||||
|
private-bin mpv,youtube-dl,python2.7
|
||||||
|
|
@ -0,0 +1,29 @@
|
||||||
|
# mupdf reader profile
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
nogroups
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
nosound
|
||||||
|
protocol unix
|
||||||
|
seccomp
|
||||||
|
netfilter
|
||||||
|
shell none
|
||||||
|
tracelog
|
||||||
|
|
||||||
|
private-tmp
|
||||||
|
private-dev
|
||||||
|
private-etc fonts
|
||||||
|
|
||||||
|
# mupdf will never write anything
|
||||||
|
read-only ${HOME}
|
||||||
|
|
||||||
|
#
|
||||||
|
# Experimental:
|
||||||
|
#
|
||||||
|
#seccomp.keep access,arch_prctl,brk,clone,close,connect,execve,exit_group,fchmod,fchown,fcntl,fstat,futex,getcwd,getpeername,getrlimit,getsockname,getsockopt,lseek,lstat,mlock,mmap,mprotect,mremap,munmap,nanosleep,open,poll,prctl,read,recvfrom,recvmsg,restart_syscall,rt_sigaction,rt_sigprocmask,select,sendmsg,set_robust_list,set_tid_address,setresgid,setresuid,shmat,shmctl,shmget,shutdown,socket,stat,sysinfo,uname,unshare,wait4,write,writev
|
||||||
|
# private-bin mupdf,sh,tempfile,rm
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# mupen64plus profile
|
||||||
|
# manually whitelist ROM files
|
||||||
|
noblacklist ${HOME}/.config/mupen64plus
|
||||||
|
noblacklist ${HOME}/.local/share/mupen64plus
|
||||||
|
|
||||||
|
include /etc/firejail/disable-common.inc
|
||||||
|
include /etc/firejail/disable-programs.inc
|
||||||
|
include /etc/firejail/disable-devel.inc
|
||||||
|
include /etc/firejail/disable-passwdmgr.inc
|
||||||
|
|
||||||
|
mkdir ${HOME}/.local/share/mupen64plus
|
||||||
|
whitelist ${HOME}/.local/share/mupen64plus/
|
||||||
|
mkdir ${HOME}/.config/mupen64plus
|
||||||
|
whitelist ${HOME}/.config/mupen64plus/
|
||||||
|
|
||||||
|
caps.drop all
|
||||||
|
net none
|
||||||
|
nonewprivs
|
||||||
|
noroot
|
||||||
|
seccomp
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue