profiles: rename disable-X11.inc to disable-x11.inc (#6294)

That is, make "X11" lowercase so that the order of the includes in the
disable- section remain the same when sorted with `LC_ALL=C`, as is the
case for most of the other sections.  That is also likely to be the
default in text editors (such as in vim on Arch), so this should make
the disable- section more consistent and easier to sort when editing the
profile.

Also, keep the old include as a redirect to the new one for now to avoid
breakage.

Commands used to search and replace:

    git mv etc/inc/disable-X11.inc etc/inc/disable-x11.inc
    git grep -Ilz 'disable-X11' -- etc | xargs -0 \
      perl -pi -e 's/disable-X11/disable-x11/'

Relates to #4462 #4854 #6070 #6289.

This is a follow-up to #6286.
This commit is contained in:
Kelvin M. Klann 2024-03-27 12:13:47 +00:00 committed by GitHub
parent 0d8fb3d1b4
commit 0060b5105b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
62 changed files with 81 additions and 73 deletions

View file

@ -2,14 +2,7 @@
# Persistent customizations should go in a .local file.
include disable-X11.local
blacklist /tmp/.X11-unix
blacklist ${HOME}/.Xauthority
blacklist ${RUNUSER}/gdm/Xauthority
blacklist ${RUNUSER}/.mutter-Xwaylandauth*
blacklist ${RUNUSER}/xauth_*
#blacklist ${RUNUSER}/[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]
blacklist /tmp/xauth*
blacklist /tmp/.ICE-unix
blacklist ${RUNUSER}/ICEauthority
rmenv DISPLAY
rmenv XAUTHORITY
# Warning: This file is deprecated; use disable-x11.inc (lowercase) instead.
# Redirect
include disable-x11.inc

15
etc/inc/disable-x11.inc Normal file
View file

@ -0,0 +1,15 @@
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include disable-x11.local
blacklist /tmp/.X11-unix
blacklist ${HOME}/.Xauthority
blacklist ${RUNUSER}/gdm/Xauthority
blacklist ${RUNUSER}/.mutter-Xwaylandauth*
blacklist ${RUNUSER}/xauth_*
#blacklist ${RUNUSER}/[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]
blacklist /tmp/xauth*
blacklist /tmp/.ICE-unix
blacklist ${RUNUSER}/ICEauthority
rmenv DISPLAY
rmenv XAUTHORITY

View file

@ -19,7 +19,7 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
whitelist ${DOWNLOADS}

View file

@ -38,7 +38,7 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
#whitelist ${DOCUMENTS}

View file

@ -18,7 +18,7 @@ include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

View file

@ -17,7 +17,7 @@ include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
include whitelist-common.inc

View file

@ -25,7 +25,7 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
#whitelist ${HOME}/Projects

View file

@ -16,7 +16,7 @@ include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-shell.inc
#include disable-X11.inc # x11 none
#include disable-x11.inc # x11 none
include disable-xdg.inc
#include whitelist-common.inc # see #903

View file

@ -17,7 +17,7 @@ include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
include whitelist-run-common.inc

View file

@ -17,7 +17,7 @@ include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
mkdir ${HOME}/.config/cointop

View file

@ -25,7 +25,7 @@ blacklist ${RUNUSER}
include disable-common.inc
include disable-exec.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
# Depending on workflow you can add 'include disable-xdg.inc' to your curl.local.
#include disable-xdg.inc

View file

@ -15,7 +15,7 @@ include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-shell.inc
#include disable-X11.inc # x11 none
#include disable-x11.inc # x11 none
include disable-xdg.inc
include whitelist-common.inc

View file

@ -16,7 +16,7 @@ include disable-interpreters.inc
include disable-programs.inc
include disable-shell.inc
include disable-write-mnt.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
#include whitelist-common.inc # see #903

View file

@ -22,7 +22,7 @@ include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
include whitelist-run-common.inc

View file

@ -17,7 +17,7 @@ include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
whitelist ${DOWNLOADS}

View file

@ -17,7 +17,7 @@ include disable-common.inc
include disable-exec.inc
#include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
#mkfile ${HOME}/.digrc # see #903

View file

@ -17,7 +17,7 @@ include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
whitelist /usr/share/dnscrypt-proxy

View file

@ -17,7 +17,7 @@ include disable-common.inc
include disable-devel.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
whitelist /var/lib/libvirt/dnsmasq

View file

@ -16,7 +16,7 @@ include disable-common.inc
include disable-exec.inc
#include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
#include whitelist-common.inc # see #903

View file

@ -16,7 +16,7 @@ include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
apparmor

View file

@ -8,7 +8,7 @@ include erd.local
include globals.local
include disable-exec.inc
#include disable-X11.inc # x11 none
#include disable-x11.inc # x11 none
apparmor
caps.drop all

View file

@ -15,7 +15,7 @@ include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
#include whitelist-usr-share-common.inc

View file

@ -17,7 +17,7 @@ include disable-proc.inc
include disable-programs.inc
#include disable-shell.inc
include disable-write-mnt.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
apparmor

View file

@ -15,7 +15,7 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
whitelist ${DOWNLOADS}

View file

@ -19,7 +19,7 @@ include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
mkdir ${HOME}/.gist

View file

@ -33,7 +33,7 @@ blacklist ${RUNUSER}/wayland-*
include disable-common.inc
include disable-exec.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
whitelist /usr/share/git
whitelist /usr/share/git-core

View file

@ -14,8 +14,8 @@ include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
#include disable-X11.inc # x11 none
include disable-X11.inc
#include disable-x11.inc # x11 none
include disable-x11.inc
include disable-xdg.inc
whitelist ${RUNUSER}/gnupg

View file

@ -22,7 +22,7 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
whitelist ${HOME}/.w3m

View file

@ -15,7 +15,7 @@ include disable-common.inc
include disable-devel.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
mkdir ${HOME}/.gnupg

View file

@ -15,7 +15,7 @@ include disable-common.inc
include disable-devel.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
whitelist ${RUNUSER}/gnupg
whitelist ${RUNUSER}/keyring

View file

@ -13,7 +13,7 @@ include disable-interpreters.inc
# Additional noblacklist files/directories (blacklisted in disable-programs.inc)
# used as associated programs can be added in your links-common.local.
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
whitelist ${DOWNLOADS}

View file

@ -13,7 +13,7 @@ include disable-common.inc
include disable-devel.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
include whitelist-runuser-common.inc

View file

@ -32,7 +32,7 @@ noblacklist /var/lib/pacman
include disable-common.inc
include disable-exec.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
caps.drop all
ipc-namespace

View file

@ -11,7 +11,7 @@ blacklist ${RUNUSER}/wayland-*
include disable-exec.inc
include disable-proc.inc
include disable-X11.inc
include disable-x11.inc
apparmor
caps.drop all

View file

@ -18,7 +18,7 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
mkdir ${HOME}/.moc

View file

@ -50,7 +50,7 @@ include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
mkdir ${HOME}/.Mail

View file

@ -48,7 +48,7 @@ include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
mkdir ${HOME}/.Mail

View file

@ -39,7 +39,7 @@ include disable-common.inc
include disable-exec.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
# If you want whitelisting, change ${HOME}/Projects below to your node projects directory

View file

@ -16,7 +16,7 @@ include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
whitelist ${HOME}/.nslookuprc

View file

@ -15,7 +15,7 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
#include whitelist-common.inc # see #903

View file

@ -18,7 +18,7 @@ include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
whitelist ${DOCUMENTS}

View file

@ -19,7 +19,7 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
# Add the next line to your rsync-download_only.local to enable extra hardening.

View file

@ -27,7 +27,7 @@ include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
mkdir ${HOME}/.config/rtv

View file

@ -9,7 +9,7 @@ include seahorse-daemon.local
#include globals.local
blacklist ${RUNUSER}/wayland-*
include disable-X11.inc
include disable-x11.inc
memory-deny-write-execute

View file

@ -44,7 +44,7 @@ include disable-common.inc
#include disable-interpreters.inc
include disable-programs.inc
include disable-write-mnt.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
#include whitelist-runuser-common.inc

View file

@ -17,7 +17,7 @@ include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
mkdir ${HOME}/.local/share/signal-cli

View file

@ -13,7 +13,7 @@ blacklist ${RUNUSER}/wayland-*
include disable-common.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include whitelist-usr-share-common.inc

View file

@ -24,7 +24,7 @@ include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
mkfile ${HOME}/dead.letter

View file

@ -20,7 +20,7 @@ include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
include whitelist-common.inc

View file

@ -17,7 +17,7 @@ include disable-proc.inc
include disable-programs.inc
#include disable-shell.inc
include disable-write-mnt.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
apparmor

View file

@ -10,7 +10,7 @@ include termshark.local
blacklist ${RUNUSER}
include disable-X11.inc
include disable-x11.inc
# Redirect
include wireshark.profile

View file

@ -18,7 +18,7 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
mkdir ${HOME}/.tin

View file

@ -15,7 +15,7 @@ noblacklist /tmp/tmux-*
#include disable-devel.inc
#include disable-exec.inc
#include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
caps.drop all
ipc-namespace

View file

@ -15,7 +15,7 @@ include disable-devel.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include whitelist-runuser-common.inc

View file

@ -9,7 +9,7 @@ include tshark.local
blacklist ${RUNUSER}
include disable-X11.inc
include disable-x11.inc
# Redirect
include wireshark.profile

View file

@ -23,7 +23,7 @@ include disable-interpreters.inc
include disable-programs.inc
include disable-proc.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
mkdir ${HOME}/.config/tvnamer

View file

@ -16,7 +16,7 @@ include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
whitelist /usr/share/dns

View file

@ -28,7 +28,7 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
mkdir ${HOME}/.w3m

View file

@ -23,7 +23,7 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
# Depending on workflow you can add the next line to your wget.local.
#include disable-xdg.inc

View file

@ -14,7 +14,7 @@ include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
include whitelist-usr-share-common.inc

View file

@ -37,7 +37,7 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-shell.inc
include disable-X11.inc
include disable-x11.inc
include disable-xdg.inc
include whitelist-usr-share-common.inc

View file

@ -120,7 +120,7 @@ include globals.local
#include disable-programs.inc
#include disable-shell.inc
#include disable-write-mnt.inc
#include disable-X11.inc
#include disable-x11.inc
#include disable-xdg.inc
# This section often mirrors noblacklist section above. The idea is
@ -181,7 +181,7 @@ include globals.local
#seccomp.block-secondary
##seccomp-error-action log (only for debugging seccomp issues)
#tracelog
# Prefer 'x11 none' instead of 'disable-X11.inc' if 'net none' is set
# Prefer 'x11 none' instead of 'disable-x11.inc' if 'net none' is set
##x11 none
#disable-mnt