From 98ed4717bd8b9e28e69904d7ca9caf4deb4e94c3 Mon Sep 17 00:00:00 2001 From: Vladislav Nepogodin Date: Tue, 20 Apr 2021 00:04:10 +0400 Subject: [PATCH] Update Librewolf profile and Add Sway profile (#4164) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Add Sway profile * Fix issue Not working then including firefox-common-addons.profile * Allow sway's fallback config * So I agree with @glitsj16 and @BL4CKH47H4CK3R so.. `No its not needed as it reveals lots of important /usr/share folders like /usr/share/fonts which can used for font fingerprinting and OS detection. Like the site or attacker will know that which font you are using. Linux and windows common font are not same so its a problem. Besides there are so many other important folders as I see. Librewolf can launch and work perfectly without this options` * well.. Revert `include whitelist-usr-share-common.inc` Sync with Firefox profile * 😄 What just hapened * 🔄 Sync with upstream * Merge tested from PR * 🔄 Sync with upstream * Merge tested from PR * Revert changes * Add Sway profile * Fix issue Not working then including firefox-common-addons.profile * Allow sway's fallback config * So I agree with @glitsj16 and @BL4CKH47H4CK3R so.. `No its not needed as it reveals lots of important /usr/share folders like /usr/share/fonts which can used for font fingerprinting and OS detection. Like the site or attacker will know that which font you are using. Linux and windows common font are not same so its a problem. Besides there are so many other important folders as I see. Librewolf can launch and work perfectly without this options` * 🔄 Rebase * 😄 What just hapened * Merge tested from PR * 🔄 Sync with upstream * Merge tested from PR * Revert changes * Update * Update librewolf.profile Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com> Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com> --- etc/inc/disable-common.inc | 1 + etc/profile-a-l/librewolf-nightly.profile | 3 ++ etc/profile-a-l/librewolf.profile | 34 +++++++++++++++++++++-- etc/profile-a-l/sway.profile | 19 +++++++++++++ 4 files changed, 54 insertions(+), 3 deletions(-) create mode 100644 etc/profile-a-l/sway.profile diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc index 52534a9e9..35f89e11b 100644 --- a/etc/inc/disable-common.inc +++ b/etc/inc/disable-common.inc @@ -34,6 +34,7 @@ blacklist ${HOME}/.config/autostart blacklist ${HOME}/.config/autostart-scripts blacklist ${HOME}/.config/awesome blacklist ${HOME}/.config/i3 +blacklist ${HOME}/.config/sway blacklist ${HOME}/.config/lxsession/LXDE/autostart blacklist ${HOME}/.config/openbox blacklist ${HOME}/.config/plasma-workspace diff --git a/etc/profile-a-l/librewolf-nightly.profile b/etc/profile-a-l/librewolf-nightly.profile index e6c3da608..72df5a52a 100644 --- a/etc/profile-a-l/librewolf-nightly.profile +++ b/etc/profile-a-l/librewolf-nightly.profile @@ -6,5 +6,8 @@ include librewolf-nightly.local # added by included profile #include globals.local +# Add the next line to your librewolf-nightly.local to enable private-bin. +#private-bin librewolf-nightly + # Redirect include librewolf.profile diff --git a/etc/profile-a-l/librewolf.profile b/etc/profile-a-l/librewolf.profile index 8e891a930..0934e1271 100644 --- a/etc/profile-a-l/librewolf.profile +++ b/etc/profile-a-l/librewolf.profile @@ -18,12 +18,40 @@ whitelist ${HOME}/.librewolf #noblacklist ${HOME}/.mozilla #whitelist ${HOME}/.mozilla -# librewolf requires a shell to launch on Arch. We can possibly remove sh though. -# Add the next line to your librewolf.local to enable private-bin. -#private-bin bash,dbus-launch,dbus-send,env,librewolf,python*,sh,which +# Uncomment or put in your librewolf.local one of the following whitelist to enable KeePassXC Plugin +# NOTE: start KeePassXC before Librewolf and keep it open to allow communication between them +#whitelist ${RUNUSER}/kpxc_server +#whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer + +whitelist /usr/share/doc +whitelist /usr/share/gtk-doc/html +whitelist /usr/share/mozilla +whitelist /usr/share/webext +include whitelist-usr-share-common.inc + +# Add the next line to your librewolf.local to enable private-bin (Arch Linux). +#private-bin dbus-launch,dbus-send,librewolf,sh # Add the next line to your librewolf.local to enable private-etc. Note # that private-etc must first be enabled in firefox-common.local. #private-etc librewolf +dbus-user filter +# Uncomment or put in your librewolf.local to enable native notifications. +#dbus-user.talk org.freedesktop.Notifications +# Uncomment or put in your librewolf.local to allow to inhibit screensavers +#dbus-user.talk org.freedesktop.ScreenSaver +# Uncomment or put in your librewolf.local for plasma browser integration +#dbus-user.own org.mpris.MediaPlayer2.plasma-browser-integration +#dbus-user.talk org.kde.JobViewServer +#dbus-user.talk org.kde.kuiserver +# Uncomment or put in your librewolf.local to allow screen sharing under wayland. +#whitelist ${RUNUSER}/pipewire-0 +#dbus-user.talk org.freedesktop.portal.* +# Also uncomment or put in your librewolf.local if screen sharing sharing still +# does not work with the above lines (might depend on the portal +# implementation) +#ignore noroot +ignore dbus-user none + # Redirect include firefox-common.profile diff --git a/etc/profile-a-l/sway.profile b/etc/profile-a-l/sway.profile new file mode 100644 index 000000000..4637419bf --- /dev/null +++ b/etc/profile-a-l/sway.profile @@ -0,0 +1,19 @@ +# Firejail profile for Sway +# Description: i3-compatible Wayland compositor +# This file is overwritten after every install/update +# Persistent local customizations +include sway.local +# Persistent global definitions +include globals.local + +# all applications started in sway will run in this profile +noblacklist ${HOME}/.config/sway +# sway uses ~/.config/i3 as fallback if there is no ~/.config/sway +noblacklist ${HOME}/.config/i3 +include disable-common.inc + +caps.drop all +netfilter +noroot +protocol unix,inet,inet6 +seccomp