profile cleanup

Makefile.in

@@ -131,6 +131,7 @@ realinstall:
 	install -c -m 0644 .etc/kmail.profile $(DESTDIR)/$(sysconfdir)/firejail/.
 	install -c -m 0644 .etc/seamonkey.profile $(DESTDIR)/$(sysconfdir)/firejail/.
 	install -c -m 0644 .etc/seamonkey-bin.profile $(DESTDIR)/$(sysconfdir)/firejail/.
+	install -c -m 0644 .etc/telegram.profile $(DESTDIR)/$(sysconfdir)/firejail/.
 	bash -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
 	rm -fr .etc
 	# man pages

README

@@ -18,6 +18,10 @@ License: GPL v2
 Firejail Authors:
 
 netblue30 (netblue30@yahoo.com)
+sinkuu (https://github.com/sinkuu)
+	- blacklisting kwalletd
+Bader Zaidan (https://github.com/BaderSZ)
+	- Telegram profile
 Holger Heinz (https://github.com/hheinz)
 	- manpage work
 Andrey Alekseenko (https://github.com/al42and)

RELNOTES

@@ -3,7 +3,7 @@ firejail (0.9.37) baseline; urgency=low
   * security profiles fixes
   * dynamic allocation of noblacklist buffer
   * --ip6 option - IPv6 support
-  * added KMail, Seamonkey profiles
+  * added KMail, Seamonkey, Telegram profiles
   * --join command enhancement (--join-network, --join-filesystem)
   * symlink invocation
  -- netblue30 <netblue30@yahoo.com>  Tue,  5 Jan 2016 08:00:00 -0500

etc/disable-common.inc

@@ -119,3 +119,7 @@ read-only ${HOME}/.xmonad
 # The user ~/bin directory can override commands such as ls
 read-only ${HOME}/bin
 
+# syslog
+blacklist /dev/kmsg
+blacklist /proc/kmsg
+

platform/debian/conffiles

@@ -57,4 +57,6 @@
 /etc/firejail/kmail.profile
 /etc/firejail/seamonkey.profile
 /etc/firejail/seamonkey-bin.profile
+/etc/firejail/telegram.profile
+
 

todo

@@ -115,3 +115,9 @@ The POSIX standard defines what a “portable filename” is. This turns out to
 http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_276
 
 22. --shutdown does not clear sandboxes started with --join on Debian jessie
+
+23. to document:
+
+http://lwn.net/Articles/414813/
+echo 1 > /proc/sys/kernel/dmesg_restrict
+