github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-21 06:45:29 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 1

WIP: Blacklist common programming interpreters. (#1837)

Browse source 
* Use path variable instead of full path when blacklisting devel tools.

* Part 1: blacklist python, perl, ruby, etc in disable-interpreters.inc

* Part 2: allow access to java as needed

* Typo: missing blacklist

* Part 3: allow perl access as needed

* typo

* Add xreader thumbnailer and previewer profiles

* Add xplayer audio-preview and thumbnailer profiles

* Add atril thumbnailer and previewer profiles

* More fixups after adding disable-interpreters.inc

* Blacklist javac

* More javac noblacklisting

* Remove javac from dex2jar, libreoffice, multimc5, and pdfsam profiles

* --nodbus, first draft for #1825

* dbus.c

* rework akonadi integration

the usr.sbin.mysqld-akonadi apparmor profile, enforced by default in ubuntu and
debian testing (and probably opensuse), doesn't play well with a number of firejail options.
the reason for this is that once the no_new_privs bit is set, apparmor profile
transitions are forbidden.

enforcing our own apparmor policy instead is also no solution, because
these programs don't even start without d-bus.

relaxing the kmail profile was necessary so that kmail can fire up akonadi itself,
just in case akonadi has not been started earlier already by another program.
this is always an issue when kmail is the only installed akonadi client, but
there may be more circumstances. for reasons outlined above this doesn't help
debian and ubuntu (opensuse?) users though :-/

a brief summary of the seccomp exceptions: chroot is needed for qt webengine,
io_prioset for the akonadi indexing agent, io_getevents, io_submit, io_setup
are needed for mysqld. when akonadi has an sqlite3 backend, less exceptions
to the seccomp filter are necessary, but mysqld is the default.

in the future all kontact suite profiles  (itm only kmail, knotes) should
probably be redirections to akonadi_control, but the issues with apparmor
make this somewhat impractical for now (options like 'protocol' couldn't go to
akonadi_control.local any more, if current kmail redirected to there).

* Add nodbus to some profiles - part 1

* Spotify works with nodbus on Arch

* Enable nodbus for keepassx and keepassxc profiles.

I've tested on keepassxc but should work for keepassx as well. Settings are not immutable.

* recalibrate dbus access, deploy nodbus option

see #1822 and #1825. also systematically replaces
'blacklist /run/user/*/bus' with 'nodbus'.

with contributions from @Fred-Barclay

* various blacklist additions

* Add a profile for ncdu, enable private-etc in Steam again, and fixup gnome-recipes

* comment nodbus where it interferes with dconf

pending further discussion

* Add a disabled and extensive private-bin for Steam

* Further improve private-bin in steam

* comment apparmor, net where they interfere with dconf - #1843

* gnome-calculator fixup

* spectre support for clang compiler

* spectre clang support

* enable/disable dbus handling in /etc/firejail/firejail.config

* nodbus man pages, etc.

* redirect knotes to kmail, some tweaks

* testing

* gimp fixup

* Even more fixups after adding disable-interpreters.inc

* AWS and GCP store credentials in local directories as part of project setup.

Configuration for cloud providers is sensitive information; it should be
in the default block list. I didn't see profiles for gcloud or awscli,
so haven't added any exclusions.

boto and kubectl are not provider-specific, but also store credentials for
whichever platforms they happen to be being used with.

* testing

* consolidate makefiles

* gitignore

* Use path variable instead of full path when blacklisting devel tools.

* Part 1: blacklist python, perl, ruby, etc in disable-interpreters.inc

* Part 2: allow access to java as needed

* Typo: missing blacklist

* Part 3: allow perl access as needed

* typo

* More fixups after adding disable-interpreters.inc

* Blacklist javac

* More javac noblacklisting

* Remove javac from dex2jar, libreoffice, multimc5, and pdfsam profiles

* Cleanup rebase leftovers

* imagej doesn't need javac access

* Add cc to blacklisted compilers

* Use wildcards when blacklisting some gcc paths

* Blacklist lua in disable-interpreters

* Correct blacklist for node.js

* Fred Barclay note: some of these commits (all of the ones that don't affect files inside etc/) aren't mine but were added during a rebase + squash
This commit is contained in:
Fred Barclay 2018-04-02 10:56:55 -05:00 • committed by GitHub
parent 352a36ec69
commit 2d8ff695ad
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
311 changed files with 636 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

1
etc/0ad.profile
View file

@ -11,6 +11,7 @@ noblacklist ${HOME}/.local/share/0ad
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/2048-qt.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/xiaoyong
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/Cryptocat.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/Cryptocat
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/Fritzing.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/Fritzing
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/Mathematica.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.Wolfram Research
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/Thunar.profile
View file

@ -11,6 +11,7 @@ noblacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
# include /etc/firejail/disable-programs.inc

1
etc/Viber.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.ViberPC
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/akonadi_control.profile
View file

@ -18,6 +18,7 @@ noblacklist /usr/sbin
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/akregator.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.local/share/akregator
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/amarok.profile
View file

@ -8,6 +8,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/amule.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.aMule
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/arch-audit.profile
View file

@ -11,6 +11,7 @@ noblacklist /var/lib/pacman
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

2
etc/archaudit-report.profile
View file

@ -11,8 +11,10 @@ noblacklist /var/lib/pacman
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/whitelist-common.inc
caps.drop all

1
etc/ardour5.profile
View file

@ -12,6 +12,7 @@ noblacklist ${HOME}/.vst
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/arduino.profile
View file

@ -11,6 +11,7 @@ noblacklist ${HOME}/Arduino
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/ark.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/arkrc
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

7
etc/arm.profile
View file

@ -7,8 +7,15 @@ include /etc/firejail/globals.local
noblacklist ${HOME}/.arm
# Allow python (blacklisted by disable-interpreters.inc)
noblacklist ${PATH}/python2*
noblacklist ${PATH}/python3*
noblacklist /usr/lib/python2*
noblacklist /usr/lib/python3*
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/asunder.profile
View file

@ -12,6 +12,7 @@ noblacklist ${HOME}/.asunder_album_artist
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/atool.profile
View file

@ -9,6 +9,7 @@ blacklist /tmp/.X11-unix
include /etc/firejail/disable-common.inc
# include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/atril.profile
View file

@ -13,6 +13,7 @@ noblacklist ${HOME}/.config/atril
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/audacious.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/audacious
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/audacity.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.audacity-data
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/aweather.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/aweather
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/baloo_file.profile
View file

@ -14,6 +14,7 @@ noblacklist ${HOME}/.local/share/baloo
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/baobab.profile
View file

@ -7,6 +7,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
# include /etc/firejail/disable-programs.inc

1
etc/basilisk.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.moonchild productions/basilisk
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-programs.inc
# These are uncommented in the Firefox profile. If you run into trouble you may

1
etc/bibletime.profile
View file

@ -12,6 +12,7 @@ noblacklist ${HOME}/.sword
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/bitcoin-qt.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.bitcoin
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/bitlbee.profile
View file

@ -11,6 +11,7 @@ noblacklist /usr/sbin
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/bleachbit.profile
View file

@ -7,6 +7,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
# include /etc/firejail/disable-programs.inc

7
etc/blender.profile
View file

@ -7,8 +7,15 @@ include /etc/firejail/globals.local
noblacklist ${HOME}/.config/blender
# Allow python (blacklisted by disable-interpreters.inc)
noblacklist ${PATH}/python2*
noblacklist ${PATH}/python3*
noblacklist /usr/lib/python2*
noblacklist /usr/lib/python3*
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/bless.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/bless
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/bluefish.profile
View file

@ -7,6 +7,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/brasero.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/brasero
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/bsdtar.profile
View file

@ -8,6 +8,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
# include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

7
etc/caja.profile
View file

@ -12,8 +12,15 @@ noblacklist ${HOME}/.local/share/Trash
# noblacklist ${HOME}/.config/caja - disable-programs.inc is disabled, see below
# noblacklist ${HOME}/.local/share/caja-python
# Allow python (blacklisted by disable-interpreters.inc)
noblacklist ${PATH}/python2*
noblacklist ${PATH}/python3*
noblacklist /usr/lib/python2*
noblacklist /usr/lib/python3*
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
# include /etc/firejail/disable-programs.inc

2
etc/calibre.profile
View file

@ -9,7 +9,7 @@ noblacklist ${HOME}/.cache/calibre
noblacklist ${HOME}/.config/calibre
include /etc/firejail/disable-common.inc
# include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/calligra.profile
View file

@ -7,6 +7,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

7
etc/catfish.profile
View file

@ -10,8 +10,15 @@ include /etc/firejail/globals.local
noblacklist ${HOME}/.config/catfish
# Allow python (blacklisted by disable-interpreters.inc)
noblacklist ${PATH}/python2*
noblacklist ${PATH}/python3*
noblacklist /usr/lib/python2*
noblacklist /usr/lib/python3*
include /etc/firejail/disable-common.inc
# include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

9
etc/cherrytree.profile
View file

@ -6,11 +6,16 @@ include /etc/firejail/cherrytree.local
include /etc/firejail/globals.local
noblacklist ${HOME}/.config/cherrytree
#noblacklist /usr/bin/python2*
#noblacklist /usr/lib/python3*
# Allow python (blacklisted by disable-interpreters.inc)
noblacklist ${PATH}/python2*
noblacklist ${PATH}/python3*
noblacklist /usr/lib/python2*
noblacklist /usr/lib/python3*
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/chromium-common.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.pki
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-programs.inc
mkdir ${HOME}/.pki

1
etc/cin.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.bcast5
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/claws-mail.profile
View file

@ -11,6 +11,7 @@ noblacklist ${HOME}/.signature
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/clementine.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/Clementine
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/clipit.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.local/share/clipit
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/cmus.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/cmus
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/conky.profile
View file

@ -8,6 +8,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/corebird.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/corebird
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/cower.profile
View file

@ -19,6 +19,7 @@ noblacklist /var/lib/pacman
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/darktable.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/darktable
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/deadbeef.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/deadbeef
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/default.profile
View file

@ -10,6 +10,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
# include /etc/firejail/disable-devel.inc
# include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

7
etc/deluge.profile
View file

@ -7,8 +7,15 @@ include /etc/firejail/globals.local
noblacklist ${HOME}/.config/deluge
# Allow python (blacklisted by disable-interpreters.inc)
noblacklist ${PATH}/python2*
noblacklist ${PATH}/python3*
noblacklist /usr/lib/python2*
noblacklist /usr/lib/python3*
include /etc/firejail/disable-common.inc
# include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

13
etc/dex2jar.profile
View file

@ -6,8 +6,21 @@ include /etc/firejail/dex2jar.local
# Persistent global definitions
include /etc/firejail/globals.local
# Allow access to java
noblacklist ${PATH}/java
noblacklist /usr/lib/java
noblacklist /etc/java
noblacklist /usr/share/java
# Allow access to java
noblacklist ${PATH}/java
noblacklist /usr/lib/java
noblacklist /etc/java
noblacklist /usr/share/java
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/dia.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.dia
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/digikam.profile
View file

@ -12,6 +12,7 @@ noblacklist ${HOME}/.kde4/share/apps/digikam
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/dillo.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.dillo
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/dino.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.local/share/dino
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

90
etc/disable-devel.inc
View file

@ -6,76 +6,54 @@ include /etc/firejail/disable-devel.local
# GCC
#blacklist /usr/lib/gcc - seems to create problems on Gentoo
blacklist /usr/bin/as
blacklist /usr/bin/c++*
blacklist /usr/bin/c8*
blacklist /usr/bin/c9*
blacklist /usr/bin/cpp*
blacklist /usr/bin/g++*
blacklist /usr/bin/gcc*
blacklist /usr/bin/gdb
blacklist /usr/bin/ld
blacklist /usr/bin/x86_64-unknown-linux-gnu-gcc*
blacklist /usr/bin/x86_64-linux-gnu-g++*
blacklist /usr/bin/x86_64-linux-gnu-gcc*
blacklist /usr/bin/x86_64-unknown-linux-gnu-g++*
blacklist ${PATH}/as
blacklist ${PATH}/cc
blacklist ${PATH}/c++*
blacklist ${PATH}/c8*
blacklist ${PATH}/c9*
blacklist ${PATH}/cpp*
blacklist ${PATH}/g++*
blacklist ${PATH}/gcc*
blacklist ${PATH}/gdb
blacklist ${PATH}/ld
blacklist ${PATH}/*-gcc*
blacklist ${PATH}/*-g++*
blacklist ${PATH}/*-gcc*
blacklist ${PATH}/*-g++*
blacklist /usr/include
# clang/llvm
blacklist /usr/bin/clang*
blacklist /usr/bin/lldb*
blacklist /usr/bin/llvm*
blacklist ${PATH}/clang*
blacklist ${PATH}/lldb*
blacklist ${PATH}/llvm*
blacklist /usr/lib/llvm*
# tcc - Tiny C Compiler
blacklist /usr/bin/tcc
blacklist /usr/bin/x86_64-tcc
blacklist ${PATH}/tcc
blacklist ${PATH}/x86_64-tcc
blacklist /usr/lib/tcc
# Valgrind
blacklist /usr/bin/valgrind*
blacklist ${PATH}/valgrind*
blacklist /usr/lib/valgrind
# Perl
blacklist /usr/bin/cpan*
blacklist /usr/bin/perl
blacklist /usr/lib/perl*
blacklist /usr/share/perl*
# PHP
blacklist /usr/bin/php*
blacklist /usr/lib/php*
blacklist /usr/share/php*
# Ruby
blacklist /usr/bin/ruby
blacklist /usr/lib/ruby
# Programs using python: deluge, firefox addons, filezilla, cherrytree, xchat, hexchat, libreoffice, scribus
# Python 2
#blacklist /usr/bin/python2*
#blacklist /usr/include/python2*
#blacklist /usr/lib/python2*
#blacklist /usr/local/lib/python2*
#blacklist /usr/share/python2*
#
# Python 3
#blacklist /usr/bin/python3*
#blacklist /usr/include/python3*
#blacklist /usr/lib/python3*
#blacklist /usr/local/lib/python3*
#blacklist /usr/share/python3*
# Java
blacklist ${PATH}/java
blacklist ${PATH}/javac
blacklist /usr/lib/java
blacklist /etc/java
blacklist /usr/share/java
#Go
blacklist /usr/bin/gccgo
blacklist /usr/bin/go
blacklist /usr/bin/gofmt
blacklist ${PATH}/gccgo
blacklist ${PATH}/go
blacklist ${PATH}/gofmt
#Rust
blacklist /usr/bin/rust-gdb
blacklist /usr/bin/rust-lldb
blacklist /usr/bin/rustc
blacklist ${PATH}/rust-gdb
blacklist ${PATH}/rust-lldb
blacklist ${PATH}/rustc
#OpenSSL
blacklist /usr/bin/openssl
blacklist /usr/bin/openssl-1.0
blacklist ${PATH}/openssl
blacklist ${PATH}/openssl-1.0

44
etc/disable-interpreters.inc Normal file
View file

@ -0,0 +1,44 @@
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/disable-interpreters.local
# Lua
blacklist ${PATH}/lua*
blacklist /usr/lib/lua
blacklist /usr/include/lua*
blacklist /usr/share/lua
# Node.js
blacklist ${PATH}/node
blacklist /usr/include/node
# Perl
blacklist ${PATH}/cpan*
blacklist ${PATH}/core_perl
blacklist ${PATH}/perl
blacklist /usr/lib/perl*
blacklist /usr/share/perl*
# PHP
blacklist ${PATH}/php*
blacklist /usr/lib/php*
blacklist /usr/share/php*
# Ruby
blacklist ${PATH}/ruby
blacklist /usr/lib/ruby
# Programs using python: deluge, firefox addons, filezilla, cherrytree, xchat, hexchat, libreoffice, scribus
# Python 2
blacklist ${PATH}/python2*
blacklist /usr/include/python2*
blacklist /usr/lib/python2*
blacklist /usr/local/lib/python2*
blacklist /usr/share/python2*
# Python 3
blacklist ${PATH}/python3*
blacklist /usr/include/python3*
blacklist /usr/lib/python3*
blacklist /usr/local/lib/python3*
blacklist /usr/share/python3*

13
etc/display.profile
View file

@ -5,8 +5,21 @@ include /etc/firejail/display.local
# Persistent global definitions
include /etc/firejail/globals.local
# Allow python (blacklisted by disable-interpreters.inc)
noblacklist ${PATH}/python2*
noblacklist ${PATH}/python3*
noblacklist /usr/lib/python2*
noblacklist /usr/lib/python3*
# Allow python (blacklisted by disable-interpreters.inc)
noblacklist ${PATH}/python2*
noblacklist ${PATH}/python3*
noblacklist /usr/lib/python2*
noblacklist /usr/lib/python3*
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/dnscrypt-proxy.profile
View file

@ -12,6 +12,7 @@ noblacklist /usr/sbin
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/dnsmasq.profile
View file

@ -12,6 +12,7 @@ noblacklist /usr/sbin
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/dolphin.profile
View file

@ -14,6 +14,7 @@ noblacklist ${HOME}/.local/share/Trash
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
# dolphin needs to be able to start arbitrary applications so we cannot blacklist their files
# include /etc/firejail/disable-programs.inc

1
etc/dooble.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.dooble
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/dosbox.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.dosbox
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/dragon.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/dragonplayerrc
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/dropbox.profile
View file

@ -11,6 +11,7 @@ noblacklist ${HOME}/.dropbox-dist
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/elinks.profile
View file

@ -11,6 +11,7 @@ noblacklist ${HOME}/.elinks
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/empathy.profile
View file

@ -8,6 +8,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-programs.inc
caps.drop all

1
etc/enchant.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/enchant
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/engrampa.profile
View file

@ -7,6 +7,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/enpass.profile
View file

@ -6,6 +6,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/eog.profile
View file

@ -12,6 +12,7 @@ noblacklist ${HOME}/.steam
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/eom.profile
View file

@ -12,6 +12,7 @@ noblacklist ${HOME}/.steam
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/epiphany.profile
View file

@ -11,6 +11,7 @@ noblacklist ${HOME}/.local/share/epiphany
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-programs.inc
mkdir ${HOME}/.cache/epiphany

1
etc/evince.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/evince
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/evolution.profile
View file

@ -16,6 +16,7 @@ noblacklist ${HOME}/.pki
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

4
etc/exiftool.profile
View file

@ -8,12 +8,14 @@ include /etc/firejail/globals.local
blacklist /tmp/.X11-unix
noblacklist /usr/bin/perl
# Allow access to perl
noblacklist ${PATH}/perl
noblacklist /usr/lib/perl*
noblacklist /usr/share/perl*
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/falkon.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/falkon
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/fbreader.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.FBReader
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/feh.profile
View file

@ -7,6 +7,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/fetchmail.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.netrc
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/ffmpeg.profile
View file

@ -8,6 +8,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/file-roller.profile
View file

@ -7,6 +7,7 @@ include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

7
etc/filezilla.profile
View file

@ -8,8 +8,15 @@ include /etc/firejail/globals.local
noblacklist ${HOME}/.config/filezilla
noblacklist ${HOME}/.filezilla
# Allow python (blacklisted by disable-interpreters.inc)
noblacklist ${PATH}/python2*
noblacklist ${PATH}/python3*
noblacklist /usr/lib/python2*
noblacklist /usr/lib/python3*
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/whitelist-var-common.inc

1
etc/firefox-common.profile
View file

@ -12,6 +12,7 @@ noblacklist ${HOME}/.pki
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-programs.inc
mkdir ${HOME}/.pki

1
etc/flowblade.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.flowblade
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/fontforge.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.FontForge
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/franz.profile
View file

@ -11,6 +11,7 @@ noblacklist ${HOME}/.pki
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-programs.inc
mkdir ${HOME}/.cache/Franz

1
etc/freecad.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/FreeCAD
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/frozen-bubble.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.frozen-bubble
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

5
etc/gajim.profile
View file

@ -9,8 +9,13 @@ noblacklist ${HOME}/.cache/gajim
noblacklist ${HOME}/.config/gajim
noblacklist ${HOME}/.local/share/gajim
# Allow python2.7 (blacklisted by disable-interpreters.inc)
noblacklist ${PATH}/python2*
noblacklist /usr/lib/python2*
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/galculator.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/galculator
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/gedit.profile
View file

@ -11,6 +11,7 @@ noblacklist ${HOME}/.gitconfig
include /etc/firejail/disable-common.inc
# include /etc/firejail/disable-devel.inc
# include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/geeqie.profile
View file

@ -11,6 +11,7 @@ noblacklist ${HOME}/.local/share/geeqie
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/gitg.profile
View file

@ -11,6 +11,7 @@ noblacklist ${HOME}/.ssh
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/gitter.profile
View file

@ -10,6 +10,7 @@ noblacklist ${HOME}/.config/Gitter
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/gjs.profile
View file

@ -14,6 +14,7 @@ noblacklist ${HOME}/.local/share/gnome-photos
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

1
etc/globaltime.profile
View file

@ -9,6 +9,7 @@ noblacklist ${HOME}/.config/globaltime
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

Some files were not shown because too many files have changed in this diff Show more