From 5dd4748076b6016b0faf0a99485e99a2134b5b06 Mon Sep 17 00:00:00 2001
From: netblue30 <netblue30@yahoo.com>
Date: Fri, 12 Feb 2016 17:55:26 -0500
Subject: [PATCH] added lxterminal profile

---
 Makefile.in               |  1 +
 etc/lxterminal.profile    | 19 +++++++++++++++++++
 platform/debian/conffiles |  2 ++
 3 files changed, 22 insertions(+)
 create mode 100644 etc/lxterminal.profile

diff --git a/Makefile.in b/Makefile.in
index c4b3d238a..f5e52979f 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -137,6 +137,7 @@ realinstall:
 	install -c -m 0644 .etc/uget-gtk.profile $(DESTDIR)/$(sysconfdir)/firejail/.
 	install -c -m 0644 .etc/mupen64plus.profile $(DESTDIR)/$(sysconfdir)/firejail/.
 	install -c -m 0644 .etc/disable-terminals.inc $(DESTDIR)/$(sysconfdir)/firejail/.
+	install -c -m 0644 .etc/lxterminal.profile $(DESTDIR)/$(sysconfdir)/firejail/.
 	bash -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
 	rm -fr .etc
 	# man pages
diff --git a/etc/lxterminal.profile b/etc/lxterminal.profile
new file mode 100644
index 000000000..a614a8dbf
--- /dev/null
+++ b/etc/lxterminal.profile
@@ -0,0 +1,19 @@
+# lxterminal (LXDE) profile
+
+include /etc/firejail/disable-mgmt.inc
+include /etc/firejail/disable-secret.inc
+include /etc/firejail/disable-common.inc
+blacklist ${HOME}/.pki/nssdb
+blacklist ${HOME}/.lastpass
+blacklist ${HOME}/.keepassx
+blacklist ${HOME}/.password-store
+caps.drop all
+seccomp
+protocol unix,inet,inet6
+netfilter
+
+#noroot - somehow this breaks on Debian Jessie!
+
+# lxterminal is a single-instence program
+# blacklist any existing lxterminal socket in order to force a second process instance
+blacklist /tmp/.lxterminal-socket*
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index 3adb5201d..27e65c5e6 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -62,3 +62,5 @@
 /etc/firejail/Mathematica.profile
 /etc/firejail/uget-gtk.profile
 /etc/firejail/mupen64plus.profile
+/etc/disable-terminals.inc
+/etc/lxterminal.profile