github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-21 06:45:29 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 1

Unify all profiles

Browse source
This commit is contained in:
Tad 2017-08-07 01:22:08 -04:00
parent 20fbc19e57
commit 9e3ba319be
332 changed files with 3230 additions and 3639 deletions
Download patch file Download diff file Expand all files Collapse all files

26
etc/0ad.profile
View file

@ -1,28 +1,26 @@
# Persistent global definitions go here # Firejail profile for 0ad
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/0ad.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/0ad.local
# Firejail profile for 0ad.
noblacklist ~/.cache/0ad noblacklist ~/.cache/0ad
noblacklist ~/.config/0ad noblacklist ~/.config/0ad
noblacklist ~/.local/share/0ad noblacklist ~/.local/share/0ad
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc include /etc/firejail/disable-programs.inc
# Whitelists
mkdir ~/.config/0ad
whitelist ~/.config/0ad
mkdir ~/.local/share/0ad
whitelist ~/.local/share/0ad
mkdir ~/.cache/0ad mkdir ~/.cache/0ad
mkdir ~/.config/0ad
mkdir ~/.local/share/0ad
whitelist ~/.cache/0ad whitelist ~/.cache/0ad
whitelist ~/.config/0ad
whitelist ~/.local/share/0ad
include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
netfilter netfilter
@ -35,9 +33,9 @@ seccomp
shell none shell none
tracelog tracelog
disable-mnt
private-dev private-dev
private-tmp private-tmp
disable-mnt
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp

17
etc/2048-qt.profile
View file

@ -1,20 +1,19 @@
# Persistent global definitions go here # Firejail profile for 2048-qt
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/2048-qt.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/2048-qt.local
noblacklist ~/.config/xiaoyong
noblacklist ~/.config/2048-qt noblacklist ~/.config/2048-qt
noblacklist ~/.config/xiaoyong
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
netfilter netfilter
nogroups nogroups
nonewprivs nonewprivs
@ -25,9 +24,9 @@ protocol unix
seccomp seccomp
shell none shell none
disable-mnt
private-dev private-dev
private-tmp private-tmp
disable-mnt
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp

25
etc/7z.profile
View file

@ -1,23 +1,22 @@
# Firejail profile for 7z
# This file is overwritten after every install/update
quiet quiet
# Persistent global definitions go here # Persistent local customizations
include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/7z.local include /etc/firejail/7z.local
# Persistent global definitions
# 7zip crompression tool profile include /etc/firejail/globals.local
ignore noroot
include /etc/firejail/default.profile
blacklist /tmp/.X11-unix blacklist /tmp/.X11-unix
tracelog ignore noroot
net none net none
no3d
nosound
nosound nosound
novideo novideo
shell none shell none
tracelog
private-dev private-dev
nosound
no3d include /etc/firejail/default.profile

13
etc/Cryptocat.profile
View file

@ -1,17 +1,16 @@
# Persistent global definitions go here # Firejail profile for Cryptocat
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/Cryptocat.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/Cryptocat.local
# Firejail profile for Cryptocat
noblacklist ${HOME}/.config/Cryptocat noblacklist ${HOME}/.config/Cryptocat
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter

9
etc/Cyberfox.profile
View file

@ -1,10 +1,5 @@
# Persistent global definitions go here # Firejail profile alias for cyberfox
include /etc/firejail/globals.local # This file is overwritten after every install/update
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/Cyberfox.local
# Firejail profile for Cyberfox (based on Mozilla Firefox)
include /etc/firejail/cyberfox.profile include /etc/firejail/cyberfox.profile

8
etc/FossaMail.profile
View file

@ -1,9 +1,5 @@
# Persistent global definitions go here # Firejail profile alias for fossamail
include /etc/firejail/globals.local # This file is overwritten after every install/update
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/FossaMail.local
# Firejail profile for FossaMail
include /etc/firejail/fossamail.profile include /etc/firejail/fossamail.profile

23
etc/Mathematica.profile
View file

@ -1,26 +1,25 @@
# Persistent global definitions go here # Firejail profile for Mathematica
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/Mathematica.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/Mathematica.local
# Mathematica profile
noblacklist ${HOME}/.Mathematica noblacklist ${HOME}/.Mathematica
noblacklist ${HOME}/.Wolfram Research noblacklist ${HOME}/.Wolfram Research
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
mkdir ~/.Mathematica mkdir ~/.Mathematica
whitelist ~/.Mathematica
mkdir ~/.Wolfram Research mkdir ~/.Wolfram Research
whitelist ~/.Mathematica
whitelist ~/.Wolfram Research whitelist ~/.Wolfram Research
whitelist ~/Documents/Wolfram Mathematica whitelist ~/Documents/Wolfram Mathematica
include /etc/firejail/whitelist-common.inc include /etc/firejail/whitelist-common.inc
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
caps.drop all caps.drop all
nonewprivs nonewprivs
noroot noroot

8
etc/Telegram.profile
View file

@ -1,9 +1,5 @@
# Persistent global definitions go here # Firejail profile alias for telegram
include /etc/firejail/globals.local # This file is overwritten after every install/update
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/Telegram.local
# Telegram profile
include /etc/firejail/telegram.profile include /etc/firejail/telegram.profile

15
etc/Thunar.profile
View file

@ -1,19 +1,18 @@
# Persistent global definitions go here # Firejail profile for Thunar
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/Thunar.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install. noblacklist ${HOME}/.local/share/Trash
# Persistent customizations should go in a .local file.
include /etc/firejail/Thunar.local
# Firejail profile for thunar
noblacklist ~/.config/Thunar noblacklist ~/.config/Thunar
noblacklist ~/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml noblacklist ~/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml
noblacklist ${HOME}/.local/share/Trash
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
#include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
# include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter

7
etc/VirtualBox.profile
View file

@ -1,8 +1,5 @@
# Persistent global definitions go here # Firejail profile alias for virtualbox
include /etc/firejail/globals.local # This file is overwritten after every install/update
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/VirtualBox.local
include /etc/firejail/virtualbox.profile include /etc/firejail/virtualbox.profile

9
etc/Wire.profile
View file

@ -1,10 +1,5 @@
# Persistent global definitions go here # Firejail profile alias for wire
include /etc/firejail/globals.local # This file is overwritten after every install/update
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/Wire.local
# wire messenger profile
include /etc/firejail/wire.profile include /etc/firejail/wire.profile

64
etc/abrowser.profile
View file

@ -1,17 +1,39 @@
# Persistent global definitions go here # Firejail profile for abrowser
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/abrowser.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/abrowser.local
# Firejail profile for Abrowser
noblacklist ~/.mozilla
noblacklist ~/.cache/mozilla noblacklist ~/.cache/mozilla
noblacklist ~/.mozilla
noblacklist ~/.pki noblacklist ~/.pki
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
mkdir ~/.cache/mozilla/abrowser
mkdir ~/.mozilla
whitelist ${DOWNLOADS}
whitelist ~/.cache/gnome-mplayer/plugin
whitelist ~/.cache/mozilla/abrowser
whitelist ~/.config/gnome-mplayer
whitelist ~/.config/pipelight-silverlight5.1
whitelist ~/.config/pipelight-widevine
whitelist ~/.keysnail.js
whitelist ~/.lastpass
whitelist ~/.mozilla
whitelist ~/.pentadactyl
whitelist ~/.pentadactylrc
whitelist ~/.pki
whitelist ~/.vimperator
whitelist ~/.vimperatorrc
whitelist ~/.wine-pipelight
whitelist ~/.wine-pipelight64
whitelist ~/.zotero
whitelist ~/dwhelper
include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
netfilter netfilter
@ -21,30 +43,4 @@ protocol unix,inet,inet6,netlink
seccomp seccomp
tracelog tracelog
whitelist ${DOWNLOADS}
mkdir ~/.mozilla
whitelist ~/.mozilla
mkdir ~/.cache/mozilla/abrowser
whitelist ~/.cache/mozilla/abrowser
whitelist ~/dwhelper
whitelist ~/.zotero
whitelist ~/.vimperatorrc
whitelist ~/.vimperator
whitelist ~/.pentadactylrc
whitelist ~/.pentadactyl
whitelist ~/.keysnail.js
whitelist ~/.config/gnome-mplayer
whitelist ~/.cache/gnome-mplayer/plugin
whitelist ~/.pki
whitelist ~/.lastpass
# silverlight
whitelist ~/.wine-pipelight
whitelist ~/.wine-pipelight64
whitelist ~/.config/pipelight-widevine
whitelist ~/.config/pipelight-silverlight5.1
include /etc/firejail/whitelist-common.inc
# experimental features
# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse # private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse

19
etc/akregator.profile
View file

@ -1,34 +1,35 @@
# Persistent global definitions go here # Firejail profile for akregator
include /etc/firejail/globals.local # This file is overwritten after every install/update
# Persistent local customizations
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/akregator.local include /etc/firejail/akregator.local
# Persistent global definitions
include /etc/firejail/globals.local
noblacklist ${HOME}/.config/akregatorrc noblacklist ${HOME}/.config/akregatorrc
noblacklist ${HOME}/.local/share/akregator noblacklist ${HOME}/.local/share/akregator
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
netfilter netfilter
no3d no3d
nogroups nogroups
nonewprivs nonewprivs
noroot noroot
#nosound
novideo novideo
protocol unix,inet,inet6 protocol unix,inet,inet6
seccomp seccomp
shell none shell none
disable-mnt
private-dev private-dev
private-tmp private-tmp
disable-mnt
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp
# CLOBBERED COMMENTS
# nosound

20
etc/amarok.profile
View file

@ -1,26 +1,28 @@
# Persistent global definitions go here # Firejail profile for amarok
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/amarok.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/amarok.local
# amarok profile
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
nogroups nogroups
nonewprivs nonewprivs
noroot noroot
shell none
#seccomp
protocol unix,inet,inet6 protocol unix,inet,inet6
shell none
# private-bin amarok # private-bin amarok
private-dev private-dev
private-tmp
# private-etc none # private-etc none
private-tmp
# CLOBBERED COMMENTS
# seccomp

16
etc/android-studio.profile
View file

@ -1,11 +1,9 @@
# Persistent global definitions go here # Firejail profile for android-studio
include /etc/firejail/globals.local # This file is overwritten after every install/update
# Persistent local customizations
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/android-studio.local include /etc/firejail/android-studio.local
# Persistent global definitions
# Firejail profile for Android Studio include /etc/firejail/globals.local
noblacklist ${HOME}/.AndroidStudio* noblacklist ${HOME}/.AndroidStudio*
noblacklist ${HOME}/.android noblacklist ${HOME}/.android
@ -25,7 +23,6 @@ netfilter
nogroups nogroups
nonewprivs nonewprivs
noroot noroot
#nosound
novideo novideo
protocol unix,inet,inet6 protocol unix,inet,inet6
seccomp seccomp
@ -35,3 +32,6 @@ private-dev
# private-tmp # private-tmp
noexec /tmp noexec /tmp
# CLOBBERED COMMENTS
# nosound

10
etc/apktool.profile
View file

@ -1,12 +1,12 @@
# Firejail profile for apktool
# This file is overwritten after every install/update
quiet quiet
# Persistent global definitions go here # Persistent local customizations
include /etc/firejail/apktool.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/apktool.local
# Firejail profile for apktool
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc include /etc/firejail/disable-programs.inc

18
etc/arduino.profile
View file

@ -1,22 +1,20 @@
# Persistent global definitions go here # Firejail profile for arduino
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/arduino.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/arduino.local
# Firejail profile for arduino
noblacklist ${HOME}/.arduino15 noblacklist ${HOME}/.arduino15
noblacklist ${HOME}/Arduino
noblacklist ${HOME}/.java noblacklist ${HOME}/.java
noblacklist ${HOME}/Arduino
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
netfilter netfilter
no3d no3d
nogroups nogroups

19
etc/ark.profile
View file

@ -1,17 +1,16 @@
# Persistent global definitions go here # Firejail profile for ark
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/ark.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/ark.local
# ark profile
noblacklist ~/.config/arkrc noblacklist ~/.config/arkrc
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
@ -19,11 +18,11 @@ nogroups
nonewprivs nonewprivs
noroot noroot
nosound nosound
shell none
seccomp
protocol unix protocol unix
seccomp
shell none
# private-bin # private-bin
private-dev private-dev
private-tmp
# private-etc # private-etc
private-tmp

12
etc/arm.profile
View file

@ -1,11 +1,9 @@
# Persistent global definitions go here
include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/arm.local
# Firejail profile for arm # Firejail profile for arm
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/arm.local
# Persistent global definitions
include /etc/firejail/globals.local
noblacklist ${HOME}/.arm noblacklist ${HOME}/.arm

13
etc/atom-beta.profile
View file

@ -1,17 +1,16 @@
# Persistent global definitions go here # Firejail profile for atom-beta
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/atom-beta.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/atom-beta.local
# Firejail profile for Atom Beta.
noblacklist ~/.atom noblacklist ~/.atom
noblacklist ~/.config/Atom noblacklist ~/.config/Atom
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter

13
etc/atom.profile
View file

@ -1,17 +1,16 @@
# Persistent global definitions go here # Firejail profile for atom
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/atom.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/atom.local
# Firejail profile for Atom.
noblacklist ~/.atom noblacklist ~/.atom
noblacklist ~/.config/Atom noblacklist ~/.config/Atom
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter

19
etc/atool.profile
View file

@ -1,18 +1,20 @@
# Persistent global definitions go here # Firejail profile for atool
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/atool.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install. blacklist /tmp/.X11-unix
# Persistent customizations should go in a .local file.
include /etc/firejail/atool.local
# atool profile
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
# include /etc/firejail/disable-devel.inc # include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
no3d
nogroups nogroups
nonewprivs nonewprivs
noroot noroot
@ -20,13 +22,10 @@ nosound
novideo novideo
protocol unix protocol unix
seccomp seccomp
no3d
shell none shell none
tracelog tracelog
blacklist /tmp/.X11-unix
# private-bin atool # private-bin atool
private-tmp
private-dev private-dev
private-etc none private-etc none
private-tmp

14
etc/atril.profile
View file

@ -1,17 +1,17 @@
# Persistent global definitions go here # Firejail profile for atril
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/atril.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/atril.local
# Atril profile
noblacklist ~/.config/atril noblacklist ~/.config/atril
noblacklist ~/.local/share noblacklist ~/.local/share
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
nogroups nogroups

16
etc/audacious.profile
View file

@ -1,17 +1,17 @@
# Persistent global definitions go here # Firejail profile for audacious
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/audacious.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/audacious.local
# Audacious media player profile
noblacklist ~/.config/audacious
noblacklist ~/.config/Audaciousrc noblacklist ~/.config/Audaciousrc
noblacklist ~/.config/audacious
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter

12
etc/audacity.profile
View file

@ -1,11 +1,10 @@
# Persistent global definitions go here # Firejail profile for audacity
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/audacity.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/audacity.local
# Audacity profile
noblacklist ~/.audacity-data noblacklist ~/.audacity-data
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
@ -14,7 +13,6 @@ include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
net none net none
no3d no3d
nogroups nogroups

14
etc/aweather.profile
View file

@ -1,20 +1,20 @@
# Persistent global definitions go here # Firejail profile for aweather
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/aweather.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/aweather.local
# Firejail profile for aweather.
noblacklist ~/.config/aweather noblacklist ~/.config/aweather
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc include /etc/firejail/disable-programs.inc
# Whitelist
mkdir ~/.config/aweather mkdir ~/.config/aweather
whitelist ~/.config/aweather whitelist ~/.config/aweather
include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
netfilter netfilter

10
etc/baobab.profile
View file

@ -1,11 +1,11 @@
# Persistent global definitions go here # Firejail profile for baobab
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/baobab.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/baobab.local
# Firejail profile for Baobab
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc

19
etc/bibletime.profile
View file

@ -1,11 +1,13 @@
# Persistent global definitions go here # Firejail profile for bibletime
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/bibletime.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install. blacklist ~/.Xauthority
# Persistent customizations should go in a .local file. blacklist ~/.bashrc
include /etc/firejail/bibletime.local
# Firejail profile for BibleTime
noblacklist ~/.bibletime noblacklist ~/.bibletime
noblacklist ~/.config/qt5ct noblacklist ~/.config/qt5ct
noblacklist ~/.sword noblacklist ~/.sword
@ -15,13 +17,10 @@ include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc include /etc/firejail/disable-programs.inc
blacklist ~/.bashrc
blacklist ~/.Xauthority
whitelist ${HOME}/.bibletime whitelist ${HOME}/.bibletime
whitelist ${HOME}/.config/qt5ct whitelist ${HOME}/.config/qt5ct
whitelist ${HOME}/.sword whitelist ${HOME}/.sword
include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
netfilter netfilter
@ -36,6 +35,6 @@ shell none
tracelog tracelog
# private-bin bibletime,qt5ct # private-bin bibletime,qt5ct
private-etc fonts,resolv.conf,sword,sword.conf,passwd
private-dev private-dev
private-etc fonts,resolv.conf,sword,sword.conf,passwd
private-tmp private-tmp

24
etc/bitlbee.profile
View file

@ -1,13 +1,13 @@
# Persistent global definitions go here # Firejail profile for bitlbee
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/bitlbee.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/bitlbee.local
# BitlBee instant messaging profile
noblacklist /sbin noblacklist /sbin
noblacklist /usr/sbin noblacklist /usr/sbin
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
@ -16,16 +16,16 @@ include /etc/firejail/disable-programs.inc
netfilter netfilter
no3d no3d
nonewprivs nonewprivs
private
private-dev
protocol unix,inet,inet6
seccomp
nosound nosound
novideo novideo
read-write /var/lib/bitlbee protocol unix,inet,inet6
seccomp
disable-mnt
private
private-dev
private-dev private-dev
private-tmp private-tmp
disable-mnt read-write /var/lib/bitlbee
noexec /tmp noexec /tmp

15
etc/bleachbit.profile
View file

@ -1,18 +1,17 @@
# Persistent global definitions go here # Firejail profile for bleachbit
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/bleachbit.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/bleachbit.local
# bleachbit profile
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
# include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
# include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
net none net none
no3d no3d
nogroups nogroups
@ -26,8 +25,8 @@ shell none
# private-bin # private-bin
# private-dev # private-dev
# private-tmp
# private-etc # private-etc
# private-tmp
memory-deny-write-execute memory-deny-write-execute
noexec ${HOME} noexec ${HOME}

13
etc/blender.profile
View file

@ -1,15 +1,16 @@
# Persistent global definitions go here # Firejail profile for blender
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/blender.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/blender.local
noblacklist ~/.config/blender noblacklist ~/.config/blender
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter

22
etc/bless.profile
View file

@ -1,26 +1,18 @@
# Persistent global definitions go here # Firejail profile for bless
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/bless.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/bless.local
#
#Profile for bless
#
#No Blacklist Paths
noblacklist ${HOME}/.config/bless noblacklist ${HOME}/.config/bless
#Blacklist Paths
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
#Options
caps.drop all caps.drop all
#ipc-namespace
net none net none
no3d no3d
nogroups nogroups

14
etc/brasero.profile
View file

@ -1,20 +1,18 @@
# Persistent global definitions go here # Firejail profile for brasero
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/brasero.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/brasero.local
# brasero profile
noblacklist ~/.config/brasero noblacklist ~/.config/brasero
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
nogroups nogroups
nonewprivs nonewprivs
noroot noroot

27
etc/caja.profile
View file

@ -1,24 +1,18 @@
# Persistent global definitions go here # Firejail profile for caja
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/caja.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/caja.local
# Caja profile for Firejail
# Caja is started by systemd on most systems. Therefore it is not firejailed by default. Since there
# is already a caja process running on MATE desktops firejail will have no effect.
noblacklist ~/.config/caja noblacklist ~/.config/caja
noblacklist ~/.local/share/caja-python
noblacklist ~/.local/share/Trash noblacklist ~/.local/share/Trash
noblacklist ~/.local/share/caja-python
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
# caja needs to be able to start arbitrary applications so we cannot blacklist their files
#include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
# include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
@ -31,6 +25,11 @@ shell none
tracelog tracelog
# private-bin caja # private-bin caja
# private-tmp
# private-dev # private-dev
# private-etc fonts # private-etc fonts
# private-tmp
# CLOBBERED COMMENTS
# Caja is started by systemd on most systems. Therefore it is not firejailed by default. Since there
# caja needs to be able to start arbitrary applications so we cannot blacklist their files
# is already a caja process running on MATE desktops firejail will have no effect.

15
etc/calibre.profile
View file

@ -1,20 +1,19 @@
# Persistent global definitions go here # Firejail profile for calibre
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/calibre.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/calibre.local
noblacklist ~/.config/calibre
noblacklist ~/.cache/calibre noblacklist ~/.cache/calibre
noblacklist ~/.config/calibre
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
# include /etc/firejail/disable-devel.inc # include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
netfilter netfilter
no3d no3d
nogroups nogroups

21
etc/catfish.profile
View file

@ -1,15 +1,12 @@
# Persistent global definitions go here # Firejail profile for catfish
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/catfish.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/catfish.local
# Firejail profile for catfish
noblacklist ~/.config/catfish noblacklist ~/.config/catfish
# We can't blacklist much since catfish
# is for finding files/content
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
caps.drop all caps.drop all
@ -25,8 +22,12 @@ seccomp
shell none shell none
tracelog tracelog
# These options work but are disabled in case
# a users wants to search in these directories.
# private-bin bash,catfish,env,locate,ls,mlocate,python,python2,python2.7,python3,python3.5,python3.5m,python3m # private-bin bash,catfish,env,locate,ls,mlocate,python,python2,python2.7,python3,python3.5,python3.5m,python3m
# private-dev # private-dev
# private-tmp # private-tmp
# CLOBBERED COMMENTS
# These options work but are disabled in case
# We can't blacklist much since catfish
# a users wants to search in these directories.
# is for finding files/content

19
etc/cherrytree.profile
View file

@ -1,22 +1,20 @@
# Persistent global definitions go here # Firejail profile for cherrytree
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/cherrytree.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install. noblacklist ${HOME}/.config/cherrytree
# Persistent customizations should go in a .local file.
include /etc/firejail/cherrytree.local
# cherrytree note taking application
noblacklist /usr/bin/python2* noblacklist /usr/bin/python2*
noblacklist /usr/lib/python3* noblacklist /usr/lib/python3*
noblacklist ${HOME}/.config/cherrytree
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
netfilter netfilter
no3d no3d
nogroups nogroups
@ -34,3 +32,6 @@ private-tmp
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp
# CLOBBERED COMMENTS
# cherrytree note taking application

8
etc/chromium-browser.profile
View file

@ -1,9 +1,5 @@
# Persistent global definitions go here # Firejail profile alias for chromium
include /etc/firejail/globals.local # This file is overwritten after every install/update
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/chromium-browser.local
# Chromium browser profile
include /etc/firejail/chromium.profile include /etc/firejail/chromium.profile

38
etc/chromium.profile
View file

@ -1,41 +1,41 @@
# Persistent global definitions go here # Firejail profile for chromium
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/chromium.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/chromium.local
# Chromium browser profile
noblacklist ~/.config/chromium
noblacklist ~/.cache/chromium noblacklist ~/.cache/chromium
noblacklist ~/.pki noblacklist ~/.config/chromium
# specific to Arch
noblacklist ~/.config/chromium-flags.conf noblacklist ~/.config/chromium-flags.conf
noblacklist ~/.pki
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
# chromium is distributed with a perl script on Arch
# include /etc/firejail/disable-devel.inc # include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
whitelist ${DOWNLOADS}
mkdir ~/.config/chromium
whitelist ~/.config/chromium
mkdir ~/.cache/chromium mkdir ~/.cache/chromium
whitelist ~/.cache/chromium mkdir ~/.config/chromium
mkdir ~/.pki mkdir ~/.pki
whitelist ~/.pki whitelist ${DOWNLOADS}
whitelist ~/.cache/chromium
whitelist ~/.config/chromium
whitelist ~/.config/chromium-flags.conf whitelist ~/.config/chromium-flags.conf
whitelist ~/.pki
include /etc/firejail/whitelist-common.inc include /etc/firejail/whitelist-common.inc
caps.keep sys_chroot,sys_admin caps.keep sys_chroot,sys_admin
#ipc-namespace
netfilter netfilter
nogroups nogroups
shell none shell none
private-dev private-dev
# private-tmp - problems with multiple browser sessions # private-tmp - problems with multiple browser sessions
#disable-mnt
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp
# CLOBBERED COMMENTS
# chromium is distributed with a perl script on Arch
# disable-mnt
# specific to Arch

17
etc/claws-mail.profile
View file

@ -1,25 +1,24 @@
# Persistent global definitions go here # Firejail profile for claws-mail
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/claws-mail.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/claws-mail.local
# claws-mail profile
noblacklist ~/.claws-mail noblacklist ~/.claws-mail
noblacklist ~/.signature
noblacklist ~/.gnupg noblacklist ~/.gnupg
noblacklist ~/.signature
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
nogroups
nonewprivs nonewprivs
noroot noroot
nogroups
nosound nosound
protocol unix,inet,inet6 protocol unix,inet,inet6
seccomp seccomp

16
etc/clementine.profile
View file

@ -1,20 +1,22 @@
# Persistent global definitions go here # Firejail profile for clementine
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/clementine.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/clementine.local
# Clementine media player profile
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
nonewprivs nonewprivs
noroot noroot
novideo novideo
protocol unix,inet,inet6 protocol unix,inet,inet6
# Clementine makes ioprio_set system calls, which are blacklisted by default.
seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,name_to_handle_at,open_by_handle_at,create_module,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,chroot,tuxcall,reboot,mfsservctl,get_kernel_syms,bpf,clock_settime,personality,process_vm_writev,query_module,settimeofday,stime,umount,userfaultfd,ustat,vm86,vm86old seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,name_to_handle_at,open_by_handle_at,create_module,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,chroot,tuxcall,reboot,mfsservctl,get_kernel_syms,bpf,clock_settime,personality,process_vm_writev,query_module,settimeofday,stime,umount,userfaultfd,ustat,vm86,vm86old
# CLOBBERED COMMENTS
# Clementine makes ioprio_set system calls, which are blacklisted by default.

17
etc/clipit.profile
View file

@ -1,16 +1,17 @@
# Persistent global definitions go here # Firejail profile for clipit
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/clipit.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/clipit.local
noblacklist ${HOME}/.local/share/clipit
noblacklist ${HOME}/.config/clipit noblacklist ${HOME}/.config/clipit
noblacklist ${HOME}/.local/share/clipit
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
@ -24,9 +25,9 @@ protocol unix
seccomp seccomp
shell none shell none
disable-mnt
private-dev private-dev
private-tmp private-tmp
disable-mnt
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp

15
etc/cmus.profile
View file

@ -1,17 +1,16 @@
# Persistent global definitions go here # Firejail profile for cmus
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/cmus.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/cmus.local
# cmus profile
noblacklist ${HOME}/.config/cmus noblacklist ${HOME}/.config/cmus
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
@ -19,7 +18,7 @@ nonewprivs
noroot noroot
protocol unix,inet,inet6 protocol unix,inet,inet6
seccomp seccomp
shell none
private-bin cmus private-bin cmus
private-etc group private-etc group
shell none

38
etc/conkeror.profile
View file

@ -1,31 +1,31 @@
# Persistent global definitions go here # Firejail profile for conkeror
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/conkeror.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/conkeror.local
# Firejail profile for Conkeror web browser profile
noblacklist ${HOME}/.conkeror.mozdev.org noblacklist ${HOME}/.conkeror.mozdev.org
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc include /etc/firejail/disable-programs.inc
whitelist ~/.conkeror.mozdev.org
whitelist ~/.conkerorrc
whitelist ~/.gtkrc-2.0
whitelist ~/.lastpass
whitelist ~/.pentadactyl
whitelist ~/.pentadactylrc
whitelist ~/.vimperator
whitelist ~/.vimperatorrc
whitelist ~/.zotero
whitelist ~/Downloads
whitelist ~/dwhelper
include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
netfilter netfilter
nonewprivs nonewprivs
noroot noroot
protocol unix,inet,inet6 protocol unix,inet,inet6
seccomp seccomp
whitelist ~/.conkeror.mozdev.org
whitelist ~/Downloads
whitelist ~/dwhelper
whitelist ~/.zotero
whitelist ~/.lastpass
whitelist ~/.gtkrc-2.0
whitelist ~/.vimperatorrc
whitelist ~/.vimperator
whitelist ~/.pentadactylrc
whitelist ~/.pentadactyl
whitelist ~/.conkerorrc
include /etc/firejail/whitelist-common.inc

12
etc/corebird.profile
View file

@ -1,15 +1,15 @@
# Persistent global definitions go here # Firejail profile for corebird
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/corebird.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/corebird.local
# Firejail corebird profile
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter

35
etc/cpio.profile
View file

@ -1,28 +1,31 @@
# Firejail profile for cpio
# This file is overwritten after every install/update
quiet quiet
# Persistent global definitions go here # Persistent local customizations
include /etc/firejail/cpio.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install. blacklist /tmp/.X11-unix
# Persistent customizations should go in a .local file.
include /etc/firejail/cpio.local
# cpio profile
# /sbin and /usr/sbin are visible inside the sandbox
# /boot is not visible and /var is heavily modified
noblacklist /sbin noblacklist /sbin
noblacklist /usr/sbin noblacklist /usr/sbin
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
private-dev include /etc/firejail/disable-common.inc
seccomp include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
net none net none
net none
no3d
nosound
seccomp
shell none shell none
tracelog tracelog
net none
nosound
no3d
blacklist /tmp/.X11-unix private-dev
# CLOBBERED COMMENTS
# /boot is not visible and /var is heavily modified
# /sbin and /usr/sbin are visible inside the sandbox

7
etc/cryptocat.profile
View file

@ -1,8 +1,5 @@
# Persistent global definitions go here # Firejail profile alias for Cryptocat
include /etc/firejail/globals.local # This file is overwritten after every install/update
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/cryptocat.local
include /etc/Cryptocat.profile include /etc/Cryptocat.profile

17
etc/curl.profile
View file

@ -1,19 +1,20 @@
# Firejail profile for curl
# This file is overwritten after every install/update
quiet quiet
# Persistent global definitions go here # Persistent local customizations
include /etc/firejail/curl.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install. blacklist /tmp/.X11-unix
# Persistent customizations should go in a .local file.
include /etc/firejail/curl.local
# curl profile
noblacklist ~/.curlrc noblacklist ~/.curlrc
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
netfilter netfilter
no3d no3d
nogroups nogroups
@ -24,8 +25,6 @@ protocol unix,inet,inet6
seccomp seccomp
shell none shell none
blacklist /tmp/.X11-unix
# private-bin curl # private-bin curl
private-dev private-dev
# private-etc resolv.conf # private-etc resolv.conf

17
etc/cvlc.profile
View file

@ -1,17 +1,16 @@
# Persistent global definitions go here # Firejail profile for cvlc
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/cvlc.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/vlc.local
# Firejail profile for CVLC
noblacklist ${HOME}/.config/vlc noblacklist ${HOME}/.config/vlc
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
@ -23,9 +22,11 @@ seccomp
shell none shell none
tracelog tracelog
# clvc doesn't like private-bin
# private-bin vlc,cvlc,nvlc,rvlc,qvlc,svlc # private-bin vlc,cvlc,nvlc,rvlc,qvlc,svlc
private-dev private-dev
private-tmp private-tmp
memory-deny-write-execute memory-deny-write-execute
# CLOBBERED COMMENTS
# clvc doesn't like private-bin

92
etc/cyberfox.profile
View file

@ -1,28 +1,56 @@
# Persistent global definitions go here # Firejail profile for cyberfox
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/cyberfox.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/cyberfox.local
# Firejail profile for Cyberfox (based on Mozilla Firefox)
noblacklist ~/.8pecxstudios noblacklist ~/.8pecxstudios
noblacklist ~/.cache/8pecxstudios noblacklist ~/.cache/8pecxstudios
noblacklist ~/.config/qpdfview
noblacklist ~/.local/share/qpdfview
noblacklist ~/.kde4/share/apps/okular
noblacklist ~/.kde/share/apps/okular
noblacklist ~/.local/share/okular
noblacklist ~/.config/okularpartrc noblacklist ~/.config/okularpartrc
noblacklist ~/.config/okularrc noblacklist ~/.config/okularrc
noblacklist ~/.config/qpdfview
noblacklist ~/.kde/share/apps/okular
noblacklist ~/.kde4/share/apps/okular
noblacklist ~/.local/share/okular
noblacklist ~/.local/share/qpdfview
noblacklist ~/.pki noblacklist ~/.pki
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
mkdir ~/.8pecxstudios
mkdir ~/.cache/8pecxstudios
mkdir ~/.pki
whitelist ${DOWNLOADS}
whitelist ~/.8pecxstudios
whitelist ~/.cache/8pecxstudios
whitelist ~/.cache/gnome-mplayer/plugin
whitelist ~/.config/gnome-mplayer
whitelist ~/.config/okularpartrc
whitelist ~/.config/okularrc
whitelist ~/.config/pipelight-silverlight5.1
whitelist ~/.config/pipelight-widevine
whitelist ~/.config/qpdfview
whitelist ~/.kde/share/apps/okular
whitelist ~/.kde4/share/apps/okular
whitelist ~/.keysnail.js
whitelist ~/.lastpass
whitelist ~/.local/share/okular
whitelist ~/.local/share/qpdfview
whitelist ~/.pentadactyl
whitelist ~/.pentadactylrc
whitelist ~/.pki
whitelist ~/.vimperator
whitelist ~/.vimperatorrc
whitelist ~/.wine-pipelight
whitelist ~/.wine-pipelight64
whitelist ~/.zotero
whitelist ~/dwhelper
include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
# ipc-namespace crashes cyberfox on some setups
netfilter netfilter
nogroups nogroups
nonewprivs nonewprivs
@ -32,44 +60,10 @@ seccomp
shell none shell none
tracelog tracelog
whitelist ${DOWNLOADS}
mkdir ~/.8pecxstudios
whitelist ~/.8pecxstudios
mkdir ~/.cache/8pecxstudios
whitelist ~/.cache/8pecxstudios
whitelist ~/dwhelper
whitelist ~/.zotero
whitelist ~/.vimperatorrc
whitelist ~/.vimperator
whitelist ~/.pentadactylrc
whitelist ~/.pentadactyl
whitelist ~/.keysnail.js
whitelist ~/.config/gnome-mplayer
whitelist ~/.cache/gnome-mplayer/plugin
mkdir ~/.pki
whitelist ~/.pki
whitelist ~/.lastpass
whitelist ~/.config/qpdfview
whitelist ~/.local/share/qpdfview
whitelist ~/.config/okularrc
whitelist ~/.config/okularpartrc
whitelist ~/.kde4/share/apps/okular
whitelist ~/.kde/share/apps/okular
whitelist ~/.local/share/okular
# silverlight
whitelist ~/.wine-pipelight
whitelist ~/.wine-pipelight64
whitelist ~/.config/pipelight-widevine
whitelist ~/.config/pipelight-silverlight5.1
include /etc/firejail/whitelist-common.inc
# experimental features
# private-bin cyberfox,which,sh,dbus-launch,dbus-send,env # private-bin cyberfox,which,sh,dbus-launch,dbus-send,env
#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,cyberfox,mime.types,mailcap,asound.conf,pulse
# private-dev might prevent video calls going out
private-dev private-dev
# private-dev might prevent video calls going out
# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,cyberfox,mime.types,mailcap,asound.conf,pulse
private-tmp private-tmp
noexec ${HOME} noexec ${HOME}

14
etc/darktable.profile
View file

@ -1,19 +1,19 @@
# Persistent global definitions go here # Firejail profile for darktable
include /etc/firejail/globals.local # This file is overwritten after every install/update
# Persistent local customizations
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/darktable.local include /etc/firejail/darktable.local
# Persistent global definitions
include /etc/firejail/globals.local
noblacklist ~/.cache/darktable noblacklist ~/.cache/darktable
noblacklist ~/.config/darktable noblacklist ~/.config/darktable
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
netfilter netfilter
nogroups nogroups
nonewprivs nonewprivs

14
etc/deadbeef.profile
View file

@ -1,20 +1,18 @@
# Persistent global definitions go here # Firejail profile for deadbeef
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/deadbeef.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/deadbeef.local
# DeaDBeeF media player profile
noblacklist ${HOME}/.config/deadbeef noblacklist ${HOME}/.config/deadbeef
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
netfilter netfilter
no3d no3d
nogroups nogroups

21
etc/deluge.profile
View file

@ -1,22 +1,20 @@
# Persistent global definitions go here # Firejail profile for deluge
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/deluge.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/deluge.local
# deluge bittorrent client profile
noblacklist ${HOME}/.config/deluge noblacklist ${HOME}/.config/deluge
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
# deluge is using python on Debian
# include /etc/firejail/disable-devel.inc # include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
mkdir ${HOME}/.config/deluge mkdir ${HOME}/.config/deluge
whitelist ${HOME}/.config/deluge
whitelist ${DOWNLOADS} whitelist ${DOWNLOADS}
whitelist ${HOME}/.config/deluge
include /etc/firejail/whitelist-common.inc include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
@ -27,8 +25,11 @@ nosound
novideo novideo
protocol unix,inet,inet6 protocol unix,inet,inet6
seccomp seccomp
shell none shell none
# private-bin deluge,sh,python,uname # private-bin deluge,sh,python,uname
private-dev private-dev
private-tmp private-tmp
# CLOBBERED COMMENTS
# deluge is using python on Debian

10
etc/dex2jar.profile
View file

@ -1,12 +1,12 @@
# Firejail profile for dex2jar
# This file is overwritten after every install/update
quiet quiet
# Persistent global definitions go here # Persistent local customizations
include /etc/firejail/dex2jar.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/dex2jar.local
# Firejail profile for dex2jar
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc

15
etc/dia.profile
View file

@ -1,15 +1,16 @@
# Persistent global definitions go here # Firejail profile for dia
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/dia.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/dia.local
noblacklist ~/.dia noblacklist ~/.dia
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
@ -23,9 +24,9 @@ protocol unix
seccomp seccomp
shell none shell none
disable-mnt
private-dev private-dev
private-tmp private-tmp
disable-mnt
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp

31
etc/digikam.profile
View file

@ -1,36 +1,35 @@
# Persistent global definitions go here # Firejail profile for digikam
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/digikam.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/digikam.local
noblacklist ${HOME}/.kde4/share/apps/digikam
noblacklist ${HOME}/.kde/share/apps/digikam
noblacklist ${HOME}/.config/digikamrc noblacklist ${HOME}/.config/digikamrc
noblacklist ${HOME}/.kde/share/apps/digikam
noblacklist ${HOME}/.kde4/share/apps/digikam
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
nogroups
nonewprivs nonewprivs
noroot noroot
protocol unix,inet,inet6,netlink protocol unix,inet,inet6,netlink
# This is a seccomp whitelist profile for Debian jessie, Kubuntu 17.04.
# Uncomment seccomp.keep line and try it out. By default only the regular seccomp blacklist profile is enabled.
#seccomp.keep fallocate,getrusage,openat,access,arch_prctl,bind,brk,chdir,chmod,clock_getres,clone,close,connect,dup2,dup3,eventfd2,execve,fadvise64,fcntl,fdatasync,flock,fstat,fstatfs,ftruncate,futex,getcwd,getdents,getegid,geteuid,getgid,getpeername,getpgrp,getpid,getppid,getrandom,getresgid,getresuid,getrlimit,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,ioctl,lseek,lstat,madvise,mbind,memfd_create,mkdir,mmap,mprotect,msync,munmap,nanosleep,open,pipe,pipe2,poll,ppoll,prctl,pread64,pwrite64,read,readlink,readlinkat,recvfrom,recvmsg,rename,rt_sigaction,rt_sigprocmask,rt_sigreturn,sched_getaffinity,sched_getparam,sched_get_priority_max,sched_get_priority_min,sched_getscheduler,sched_setscheduler,sched_yield,sendmsg,sendto,setgid,setresgid,setresuid,set_robust_list,setsid,setsockopt,set_tid_address,setuid,shmat,shmctl,shmdt,shmget,shutdown,socket,stat,statfs,sysinfo,timerfd_create,umask,uname,unlink,wait4,waitid,write,writev,fchmod,fchown,unshare,exit,exit_group
seccomp seccomp
nogroups
shell none shell none
# private-bin program # private-bin program
# private-etc none
# private-dev - prevents libdc1394 loading; this lib is used to connect to a camera device # private-dev - prevents libdc1394 loading; this lib is used to connect to a camera device
# private-etc none
private-tmp private-tmp
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp
# CLOBBERED COMMENTS
# seccomp.keep fallocate,getrusage,openat,access,arch_prctl,bind,brk,chdir,chmod,clock_getres,clone,close,connect,dup2,dup3,eventfd2,execve,fadvise64,fcntl,fdatasync,flock,fstat,fstatfs,ftruncate,futex,getcwd,getdents,getegid,geteuid,getgid,getpeername,getpgrp,getpid,getppid,getrandom,getresgid,getresuid,getrlimit,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,ioctl,lseek,lstat,madvise,mbind,memfd_create,mkdir,mmap,mprotect,msync,munmap,nanosleep,open,pipe,pipe2,poll,ppoll,prctl,pread64,pwrite64,read,readlink,readlinkat,recvfrom,recvmsg,rename,rt_sigaction,rt_sigprocmask,rt_sigreturn,sched_getaffinity,sched_getparam,sched_get_priority_max,sched_get_priority_min,sched_getscheduler,sched_setscheduler,sched_yield,sendmsg,sendto,setgid,setresgid,setresuid,set_robust_list,setsid,setsockopt,set_tid_address,setuid,shmat,shmctl,shmdt,shmget,shutdown,socket,stat,statfs,sysinfo,timerfd_create,umask,uname,unlink,wait4,waitid,write,writev,fchmod,fchown,unshare,exit,exit_group

29
etc/dillo.profile
View file

@ -1,16 +1,23 @@
# Persistent global definitions go here # Firejail profile for dillo
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/dillo.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/dillo.local
# Firejail profile for Dillo web browser
noblacklist ~/.dillo noblacklist ~/.dillo
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
mkdir ~/.dillo
mkdir ~/.fltk
whitelist ${DOWNLOADS}
whitelist ~/.dillo
whitelist ~/.fltk
include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
netfilter netfilter
@ -19,11 +26,3 @@ noroot
protocol unix,inet,inet6 protocol unix,inet,inet6
seccomp seccomp
tracelog tracelog
whitelist ${DOWNLOADS}
mkdir ~/.dillo
whitelist ~/.dillo
mkdir ~/.fltk
whitelist ~/.fltk
include /etc/firejail/whitelist-common.inc

22
etc/dino.profile
View file

@ -1,11 +1,10 @@
# Persistent global definitions go here # Firejail profile for dino
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/dino.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/dino.local
# Firejail profile for Dino
noblacklist ${HOME}/.local/share/dino noblacklist ${HOME}/.local/share/dino
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
@ -13,13 +12,12 @@ include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc include /etc/firejail/disable-programs.inc
whitelist ${HOME}/Downloads
mkdir ${HOME}/.local/share/dino mkdir ${HOME}/.local/share/dino
whitelist ${HOME}/.local/share/dino whitelist ${HOME}/.local/share/dino
whitelist ${HOME}/Downloads
include /etc/firejail/whitelist-common.inc include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
#ipc-namespace
netfilter netfilter
no3d no3d
nogroups nogroups
@ -31,11 +29,11 @@ protocol unix,inet,inet6
seccomp seccomp
shell none shell none
private-bin dino
#private-etc fonts #breaks server connection
private-dev
private-tmp
disable-mnt disable-mnt
private-bin dino
private-dev
# private-etc fonts # breaks server connection
private-tmp
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp

16
etc/display.profile
View file

@ -1,20 +1,20 @@
# Persistent global definitions go here # Firejail profile for display
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/display.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/display.local
# display (ImageMagick tool) image viewer profile
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
net none net none
nonewprivs
nogroups nogroups
nonewprivs
noroot noroot
nosound nosound
protocol unix protocol unix
@ -23,6 +23,6 @@ shell none
x11 xorg x11 xorg
private-bin display private-bin display
private-tmp
private-dev private-dev
private-etc none private-etc none
private-tmp

21
etc/dnscrypt-proxy.profile
View file

@ -1,20 +1,21 @@
# Persistent global definitions go here # Firejail profile for dnscrypt-proxy
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/dnscrypt-proxy.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/dnscrypt-proxy.local
# security profile for dnscrypt-proxy
noblacklist /sbin noblacklist /sbin
noblacklist /usr/sbin noblacklist /usr/sbin
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
no3d
nosound
seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open
private private
private-dev private-dev
nosound
no3d
seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open

24
etc/dnsmasq.profile
View file

@ -1,26 +1,26 @@
# Persistent global definitions go here # Firejail profile for dnsmasq
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/dnsmasq.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/dnsmasq.local
# dnsmasq profile
noblacklist /sbin noblacklist /sbin
noblacklist /usr/sbin noblacklist /usr/sbin
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps caps
netfilter netfilter
nonewprivs
private
private-dev
nosound
no3d no3d
nonewprivs
nosound
protocol unix,inet,inet6,netlink protocol unix,inet,inet6,netlink
seccomp seccomp
disable-mnt disable-mnt
private
private-dev

29
etc/dolphin.profile
View file

@ -1,34 +1,33 @@
# Persistent global definitions go here # Firejail profile for dolphin
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/dolphin.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install. noblacklist ${HOME}/.local/share/Trash
# Persistent customizations should go in a .local file.
include /etc/firejail/dolphin.local
# dolphin profile
# warning: firejail is currently not effectively constraining dolphin since used services are started by kdeinit5
noblacklist ~/.config/dolphinrc noblacklist ~/.config/dolphinrc
noblacklist ~/.local/share/dolphin noblacklist ~/.local/share/dolphin
noblacklist ${HOME}/.local/share/Trash
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
# dolphin needs to be able to start arbitrary applications so we cannot blacklist their files
#include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
# include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
nogroups nogroups
nonewprivs nonewprivs
noroot noroot
shell none
seccomp
protocol unix protocol unix
seccomp
shell none
# private-bin # private-bin
# private-dev # private-dev
# private-tmp
# private-etc # private-etc
# private-tmp
# CLOBBERED COMMENTS
# dolphin needs to be able to start arbitrary applications so we cannot blacklist their files
# warning: firejail is currently not effectively constraining dolphin since used services are started by kdeinit5

13
etc/dosbox.profile
View file

@ -1,17 +1,16 @@
# Persistent global definitions go here # Firejail profile for dosbox
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/dosbox.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/dosbox.local
# Firejail profile for dosbox
noblacklist ~/.dosbox noblacklist ~/.dosbox
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter

19
etc/dragon.profile
View file

@ -1,17 +1,16 @@
# Persistent global definitions go here # Firejail profile for dragon
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/dragon.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/dragon.local
# dragon player profile
noblacklist ~/.config/dragonplayerrc noblacklist ~/.config/dragonplayerrc
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
@ -19,14 +18,14 @@ nogroups
nonewprivs nonewprivs
noroot noroot
novideo novideo
shell none
seccomp
protocol unix,inet,inet6 protocol unix,inet,inet6
seccomp
shell none
private-bin dragon private-bin dragon
private-dev private-dev
private-tmp
# private-etc # private-etc
private-tmp
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp

24
etc/dropbox.profile
View file

@ -1,27 +1,27 @@
# Persistent global definitions go here # Firejail profile for dropbox
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/dropbox.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/dropbox.local
# dropbox profile
noblacklist ~/.config/autostart noblacklist ~/.config/autostart
noblacklist ~/.dropbox-dist noblacklist ~/.dropbox-dist
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
mkdir ~/Dropbox
whitelist ~/Dropbox
mkdir ~/.dropbox mkdir ~/.dropbox
whitelist ~/.dropbox
mkdir ~/.dropbox-dist mkdir ~/.dropbox-dist
whitelist ~/.dropbox-dist mkdir ~/Dropbox
mkfile ~/.config/autostart/dropbox.desktop mkfile ~/.config/autostart/dropbox.desktop
whitelist ~/.config/autostart/dropbox.desktop whitelist ~/.config/autostart/dropbox.desktop
whitelist ~/.dropbox
whitelist ~/.dropbox-dist
whitelist ~/Dropbox
include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
netfilter netfilter

11
etc/ebook-viewer.profile
View file

@ -1,10 +1,7 @@
# Persistent global definitions go here # Firejail profile alias for calibre
include /etc/firejail/globals.local # This file is overwritten after every install/update
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/ebook-viewer.local
# Firejail profile for ebook-viewer (Calibre)
include /etc/firejail/calibre.profile
net none net none
include /etc/firejail/calibre.profile

11
etc/electron.profile
View file

@ -1,7 +1,14 @@
# Generic Firejail profile for Electron applications. # Firejail profile for electron
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/electron.local
# Persistent global definitions
include /etc/firejail/globals.local
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter

19
etc/elinks.profile
View file

@ -1,19 +1,21 @@
# Persistent global definitions go here # Firejail profile for elinks
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/elinks.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install. blacklist /tmp/.X11-unix
# Persistent customizations should go in a .local file.
include /etc/firejail/elinks.local
# elinks profile
noblacklist ~/.elinks noblacklist ~/.elinks
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter
no3d no3d
nogroups nogroups
nonewprivs nonewprivs
@ -22,13 +24,10 @@ nosound
novideo novideo
protocol unix,inet,inet6 protocol unix,inet,inet6
seccomp seccomp
netfilter
shell none shell none
tracelog tracelog
blacklist /tmp/.X11-unix
# private-bin elinks # private-bin elinks
private-tmp
private-dev private-dev
# private-etc none # private-etc none
private-tmp

16
etc/emacs.profile
View file

@ -1,23 +1,21 @@
# Persistent global definitions go here # Firejail profile for emacs
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/emacs.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/emacs.local
# emacs profile
noblacklist ~/.emacs noblacklist ~/.emacs
noblacklist ~/.emacs.d noblacklist ~/.emacs.d
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
nogroups
nonewprivs nonewprivs
noroot noroot
nogroups
protocol unix,inet,inet6 protocol unix,inet,inet6
seccomp seccomp

14
etc/empathy.profile
View file

@ -1,19 +1,19 @@
# Persistent global definitions go here # Firejail profile for empathy
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/empathy.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/empathy.local
# Empathy instant messaging profile
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
nonewprivs
nogroups nogroups
nonewprivs
noroot noroot
protocol unix,inet,inet6 protocol unix,inet,inet6
seccomp seccomp

15
etc/enchant.profile
View file

@ -1,17 +1,16 @@
# Persistent global definitions go here # Firejail profile for enchant
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/enchant.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/enchant.local
# enchant profile
noblacklist ~/.config/enchant noblacklist ~/.config/enchant
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
@ -25,6 +24,6 @@ shell none
tracelog tracelog
# private-bin enchant # private-bin enchant
# private-tmp
# private-dev # private-dev
# private-etc fonts # private-etc fonts
# private-tmp

14
etc/engrampa.profile
View file

@ -1,15 +1,15 @@
# Persistent global definitions go here # Firejail profile for engrampa
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/engrampa.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/engrampa.local
# engrampa profile
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
@ -24,6 +24,6 @@ shell none
tracelog tracelog
# private-bin engrampa # private-bin engrampa
# private-tmp
private-dev private-dev
# private-etc fonts # private-etc fonts
# private-tmp

18
etc/eog.profile
View file

@ -1,23 +1,21 @@
# Persistent global definitions go here # Firejail profile for eog
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/eog.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/eog.local
# eog (gnome image viewer) profile
noblacklist ~/.config/eog
noblacklist ~/.Steam noblacklist ~/.Steam
noblacklist ~/.steam noblacklist ~/.config/eog
noblacklist ~/.local/share/Trash noblacklist ~/.local/share/Trash
noblacklist ~/.steam
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
net none net none
no3d no3d
nogroups nogroups

17
etc/eom.profile
View file

@ -1,20 +1,19 @@
# Persistent global definitions go here # Firejail profile for eom
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/eom.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/eom.local
# Firejail profile for Eye of Mate (eom)
noblacklist ~/.config/mate/eom
noblacklist ~/.Steam noblacklist ~/.Steam
noblacklist ~/.steam noblacklist ~/.config/mate/eom
noblacklist ~/.local/share/Trash noblacklist ~/.local/share/Trash
noblacklist ~/.steam
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
nogroups nogroups

25
etc/epiphany.profile
View file

@ -1,26 +1,25 @@
# Persistent global definitions go here # Firejail profile for epiphany
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/epiphany.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install. noblacklist ${HOME}/.cache/epiphany
# Persistent customizations should go in a .local file.
include /etc/firejail/epiphany.local
# Epiphany browser profile
noblacklist ${HOME}/.config/epiphany noblacklist ${HOME}/.config/epiphany
noblacklist ${HOME}/.local/share/epiphany noblacklist ${HOME}/.local/share/epiphany
noblacklist ${HOME}/.cache/epiphany
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
whitelist ${DOWNLOADS}
mkdir ${HOME}/.local/share/epiphany
whitelist ${HOME}/.local/share/epiphany
mkdir ${HOME}/.config/epiphany
whitelist ${HOME}/.config/epiphany
mkdir ${HOME}/.cache/epiphany mkdir ${HOME}/.cache/epiphany
mkdir ${HOME}/.config/epiphany
mkdir ${HOME}/.local/share/epiphany
whitelist ${DOWNLOADS}
whitelist ${HOME}/.cache/epiphany whitelist ${HOME}/.cache/epiphany
whitelist ${HOME}/.config/epiphany
whitelist ${HOME}/.local/share/epiphany
include /etc/firejail/whitelist-common.inc include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all

41
etc/etr.profile
View file

@ -1,41 +1,34 @@
# Persistent global definitions go here # Firejail profile for etr
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/etr.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/etr.local
################################
# Extreme Tux Racer profile
################################
noblacklist ~/.etr noblacklist ~/.etr
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
mkdir ~/.etr mkdir ~/.etr
whitelist ~/.etr whitelist ~/.etr
include /etc/firejail/whitelist-common.inc include /etc/firejail/whitelist-common.inc
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
caps.drop all caps.drop all
net none
nogroups
nonewprivs nonewprivs
noroot noroot
protocol unix,netlink protocol unix,netlink
seccomp seccomp
#
# depending on your usage, you can enable some of the commands below:
#
net none
nogroups
shell none shell none
# private-bin etr # private-bin etr
# private-etc none
private-dev private-dev
# private-etc none
private-tmp private-tmp
# CLOBBERED COMMENTS
# depending on your usage, you can enable some of the commands below:
# nosound # nosound

18
etc/evince.profile
View file

@ -1,20 +1,18 @@
# Persistent global definitions go here # Firejail profile for evince
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/evince.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/evince.local
# evince pdf reader profile
noblacklist ~/.config/evince noblacklist ~/.config/evince
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
netfilter netfilter
no3d no3d
nogroups nogroups
@ -30,9 +28,11 @@ tracelog
private-bin evince,evince-previewer,evince-thumbnailer private-bin evince,evince-previewer,evince-thumbnailer
private-dev private-dev
private-etc fonts private-etc fonts
# evince needs access to /tmp/mozilla* to work in firefox
# private-tmp # private-tmp
memory-deny-write-execute memory-deny-write-execute
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp
# CLOBBERED COMMENTS
# evince needs access to /tmp/mozilla* to work in firefox

27
etc/evolution.profile
View file

@ -1,29 +1,26 @@
# Persistent global definitions go here # Firejail profile for evolution
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/evolution.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install. noblacklist /var/mail
# Persistent customizations should go in a .local file. noblacklist /var/spool/mail
include /etc/firejail/evolution.local noblacklist ~/.bogofilter
# evolution profile
noblacklist ~/.config/evolution
noblacklist ~/.local/share/evolution
noblacklist ~/.cache/evolution noblacklist ~/.cache/evolution
noblacklist ~/.config/evolution
noblacklist ~/.gnupg
noblacklist ~/.local/share/evolution
noblacklist ~/.pki noblacklist ~/.pki
noblacklist ~/.pki/nssdb noblacklist ~/.pki/nssdb
noblacklist ~/.gnupg
noblacklist ~/.bogofilter
noblacklist /var/spool/mail
noblacklist /var/mail
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
netfilter netfilter
no3d no3d
nogroups nogroups

21
etc/exiftool.profile
View file

@ -1,36 +1,35 @@
# Firejail profile for exiftool
# This file is overwritten after every install/update
quiet quiet
# Persistent global definitions go here # Persistent local customizations
include /etc/firejail/exiftool.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install. blacklist /tmp/.X11-unix
# Persistent customizations should go in a .local file.
include /etc/firejail/exiftool.local
# exiftool profile
noblacklist /usr/bin/perl noblacklist /usr/bin/perl
noblacklist /usr/share/perl*
noblacklist /usr/lib/perl* noblacklist /usr/lib/perl*
noblacklist /usr/share/perl*
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
net none net none
no3d
nogroups nogroups
nonewprivs nonewprivs
noroot noroot
nosound nosound
protocol unix protocol unix
seccomp seccomp
no3d
shell none shell none
tracelog tracelog
blacklist /tmp/.X11-unix
# private-bin exiftool,perl # private-bin exiftool,perl
private-tmp
private-dev private-dev
private-etc none private-etc none
private-tmp

15
etc/fbreader.profile
View file

@ -1,17 +1,16 @@
# Persistent global definitions go here # Firejail profile for fbreader
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/fbreader.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/fbreader.local
# fbreader ebook reader profile
noblacklist ${HOME}/.FBReader noblacklist ${HOME}/.FBReader
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter
@ -20,8 +19,8 @@ noroot
nosound nosound
protocol unix,inet,inet6 protocol unix,inet,inet6
seccomp seccomp
shell none shell none
private-bin fbreader,FBReader private-bin fbreader,FBReader
private-dev private-dev
private-tmp private-tmp

12
etc/feh.profile
View file

@ -1,15 +1,15 @@
# Persistent global definitions go here # Firejail profile for feh
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/feh.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/feh.local
# feh image viewer profile
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
net none net none

15
etc/file-roller.profile
View file

@ -1,18 +1,17 @@
# Persistent global definitions go here # Firejail profile for file-roller
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/file-roller.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/file-roller.local
# file-roller profile
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
net none net none
no3d no3d
nogroups nogroups
@ -26,9 +25,9 @@ shell none
tracelog tracelog
# private-bin file-roller # private-bin file-roller
# private-tmp
private-dev private-dev
# private-etc fonts # private-etc fonts
# private-tmp
memory-deny-write-execute memory-deny-write-execute
noexec ${HOME} noexec ${HOME}

21
etc/file.profile
View file

@ -1,15 +1,16 @@
# Firejail profile for file
# This file is overwritten after every install/update
quiet quiet
# Persistent global definitions go here # Persistent local customizations
include /etc/firejail/file.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install. blacklist /tmp/.X11-unix
# Persistent customizations should go in a .local file.
include /etc/firejail/file.local
# file profile
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
hostname file hostname file
@ -17,7 +18,6 @@ net none
no3d no3d
nogroups nogroups
nonewprivs nonewprivs
#noroot
nosound nosound
protocol unix protocol unix
seccomp seccomp
@ -25,8 +25,9 @@ shell none
tracelog tracelog
x11 none x11 none
blacklist /tmp/.X11-unix
private-dev
private-bin file private-bin file
private-dev
private-etc magic.mgc,magic,localtime private-etc magic.mgc,magic,localtime
# CLOBBERED COMMENTS
# noroot

15
etc/filezilla.profile
View file

@ -1,17 +1,16 @@
# Persistent global definitions go here # Firejail profile for filezilla
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/filezilla.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/filezilla.local
# FileZilla ftp profile
noblacklist ${HOME}/.filezilla
noblacklist ${HOME}/.config/filezilla noblacklist ${HOME}/.config/filezilla
noblacklist ${HOME}/.filezilla
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter

10
etc/firefox-esr.profile
View file

@ -1,9 +1,9 @@
# Persistent global definitions go here # Firejail profile for firefox-esr
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/firefox-esr.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/firefox-esr.local
# Firejail profile for Mozilla Firefox ESR
include /etc/firejail/firefox.profile include /etc/firejail/firefox.profile

98
etc/firefox.profile
View file

@ -1,28 +1,56 @@
# Persistent global definitions go here # Firejail profile for firefox
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/firefox.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/firefox.local
# Firejail profile for Mozilla Firefox (Iceweasel in Debian)
noblacklist ~/.mozilla
noblacklist ~/.cache/mozilla noblacklist ~/.cache/mozilla
noblacklist ~/.config/qpdfview
noblacklist ~/.local/share/qpdfview
noblacklist ~/.kde4/share/apps/okular
noblacklist ~/.kde/share/apps/okular
noblacklist ~/.local/share/okular
noblacklist ~/.config/okularpartrc noblacklist ~/.config/okularpartrc
noblacklist ~/.config/okularrc noblacklist ~/.config/okularrc
noblacklist ~/.config/qpdfview
noblacklist ~/.kde/share/apps/okular
noblacklist ~/.kde4/share/apps/okular
noblacklist ~/.local/share/okular
noblacklist ~/.local/share/qpdfview
noblacklist ~/.mozilla
noblacklist ~/.pki noblacklist ~/.pki
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
mkdir ~/.cache/mozilla/firefox
mkdir ~/.mozilla
mkdir ~/.pki
whitelist ${DOWNLOADS}
whitelist ~/.cache/gnome-mplayer/plugin
whitelist ~/.cache/mozilla/firefox
whitelist ~/.config/gnome-mplayer
whitelist ~/.config/okularpartrc
whitelist ~/.config/okularrc
whitelist ~/.config/pipelight-silverlight5.1
whitelist ~/.config/pipelight-widevine
whitelist ~/.config/qpdfview
whitelist ~/.kde/share/apps/okular
whitelist ~/.kde4/share/apps/okular
whitelist ~/.keysnail.js
whitelist ~/.lastpass
whitelist ~/.local/share/okular
whitelist ~/.local/share/qpdfview
whitelist ~/.mozilla
whitelist ~/.pentadactyl
whitelist ~/.pentadactylrc
whitelist ~/.pki
whitelist ~/.vimperator
whitelist ~/.vimperatorrc
whitelist ~/.wine-pipelight
whitelist ~/.wine-pipelight64
whitelist ~/.zotero
whitelist ~/dwhelper
include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
# ipc-namespace crashes firefox on some setups
netfilter netfilter
nogroups nogroups
nonewprivs nonewprivs
@ -32,46 +60,14 @@ seccomp
shell none shell none
tracelog tracelog
whitelist ${DOWNLOADS}
mkdir ~/.mozilla
whitelist ~/.mozilla
mkdir ~/.cache/mozilla/firefox
whitelist ~/.cache/mozilla/firefox
whitelist ~/dwhelper
whitelist ~/.zotero
whitelist ~/.vimperatorrc
whitelist ~/.vimperator
whitelist ~/.pentadactylrc
whitelist ~/.pentadactyl
whitelist ~/.keysnail.js
whitelist ~/.config/gnome-mplayer
whitelist ~/.cache/gnome-mplayer/plugin
mkdir ~/.pki
whitelist ~/.pki
whitelist ~/.lastpass
whitelist ~/.config/qpdfview
whitelist ~/.local/share/qpdfview
whitelist ~/.config/okularrc
whitelist ~/.config/okularpartrc
whitelist ~/.kde4/share/apps/okular
whitelist ~/.kde/share/apps/okular
whitelist ~/.local/share/okular
# silverlight
whitelist ~/.wine-pipelight
whitelist ~/.wine-pipelight64
whitelist ~/.config/pipelight-widevine
whitelist ~/.config/pipelight-silverlight5.1
include /etc/firejail/whitelist-common.inc
# experimental features
# private-bin firefox,which,sh,dbus-launch,dbus-send,env # private-bin firefox,which,sh,dbus-launch,dbus-send,env
#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
# private-dev might prevent video calls going out
private-dev private-dev
# private-dev might prevent video calls going out
# private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
private-tmp private-tmp
#disable-mnt
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp
# CLOBBERED COMMENTS
# disable-mnt

46
etc/flashpeak-slimjet.profile
View file

@ -1,26 +1,26 @@
# Persistent global definitions go here # Firejail profile for flashpeak-slimjet
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/flashpeak-slimjet.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/flashpeak-slimjet.local
# SlimJet browser profile
# This is a whitelisted profile, the internal browser sandbox
# is disabled because it requires sudo password. The command
# to run it is as follows:
#
# firejail flashpeak-slimjet --no-sandbox
#
noblacklist ~/.config/slimjet
noblacklist ~/.cache/slimjet noblacklist ~/.cache/slimjet
noblacklist ~/.config/slimjet
noblacklist ~/.pki noblacklist ~/.pki
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
# include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc include /etc/firejail/disable-programs.inc
# chromium is distributed with a perl script on Arch mkdir ~/.cache/slimjet
# include /etc/firejail/disable-devel.inc mkdir ~/.config/slimjet
# mkdir ~/.pki
whitelist ${DOWNLOADS}
whitelist ~/.cache/slimjet
whitelist ~/.config/slimjet
whitelist ~/.pki
include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
netfilter netfilter
@ -29,12 +29,8 @@ noroot
protocol unix,inet,inet6,netlink protocol unix,inet,inet6,netlink
seccomp seccomp
whitelist ${DOWNLOADS} # CLOBBERED COMMENTS
mkdir ~/.config/slimjet # firejail flashpeak-slimjet --no-sandbox
whitelist ~/.config/slimjet # chromium is distributed with a perl script on Arch
mkdir ~/.cache/slimjet # is disabled because it requires sudo password. The command
whitelist ~/.cache/slimjet # to run it is as follows:
mkdir ~/.pki
whitelist ~/.pki
include /etc/firejail/whitelist-common.inc

15
etc/flowblade.profile
View file

@ -1,18 +1,17 @@
# Persistent global definitions go here # Firejail profile for flowblade
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/flowblade.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/flowblade.local
# FlowBlade profile
noblacklist ${HOME}/.flowblade
noblacklist ${HOME}/.config/flowblade noblacklist ${HOME}/.config/flowblade
noblacklist ${HOME}/.flowblade
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter

12
etc/fontforge.profile
View file

@ -1,16 +1,16 @@
# Persistent global definitions go here # Firejail profile for fontforge
include /etc/firejail/globals.local # This file is overwritten after every install/update
# Persistent local customizations
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/fontforge.local include /etc/firejail/fontforge.local
# Persistent global definitions
include /etc/firejail/globals.local
noblacklist ${HOME}/.FontForge noblacklist ${HOME}/.FontForge
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter

28
etc/fossamail.profile
View file

@ -1,22 +1,20 @@
# Persistent global definitions go here # Firejail profile for fossamail
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/fossamail.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/fossamail.local
# Firejail profile for FossaMail
noblacklist ~/.gnupg
mkdir ~/.gnupg
whitelist ~/.gnupg
noblacklist ~/.fossamail
mkdir ~/.fossamail
whitelist ~/.fossamail
noblacklist ~/.cache/fossamail noblacklist ~/.cache/fossamail
noblacklist ~/.fossamail
noblacklist ~/.gnupg
mkdir ~/.cache/fossamail mkdir ~/.cache/fossamail
mkdir ~/.fossamail
mkdir ~/.gnupg
whitelist ~/.cache/fossamail whitelist ~/.cache/fossamail
whitelist ~/.fossamail
whitelist ~/.gnupg
include /etc/firejail/whitelist-common.inc
include /etc/firejail/firefox.profile include /etc/firejail/firefox.profile

32
etc/franz.profile
View file

@ -1,30 +1,28 @@
# Persistent global definitions go here # Firejail profile for franz
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/franz.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/franz.local
# Franz profile
noblacklist ~/.config/Franz
noblacklist ~/.cache/Franz noblacklist ~/.cache/Franz
noblacklist ~/.config/Franz
noblacklist ~/.pki noblacklist ~/.pki
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
whitelist ${DOWNLOADS}
mkdir ~/.config/Franz
whitelist ~/.config/Franz
mkdir ~/.cache/Franz mkdir ~/.cache/Franz
whitelist ~/.cache/Franz mkdir ~/.config/Franz
mkdir ~/.pki mkdir ~/.pki
whitelist ${DOWNLOADS}
whitelist ~/.cache/Franz
whitelist ~/.config/Franz
whitelist ~/.pki whitelist ~/.pki
include /etc/firejail/whitelist-common.inc include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
#ipc-namespace
netfilter netfilter
nogroups nogroups
nonewprivs nonewprivs
@ -32,11 +30,13 @@ noroot
protocol unix,inet,inet6,netlink protocol unix,inet,inet6,netlink
seccomp seccomp
shell none shell none
#tracelog
disable-mnt
private-dev private-dev
private-tmp private-tmp
disable-mnt
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp
# CLOBBERED COMMENTS
# tracelog

44
etc/frozen-bubble.profile
View file

@ -1,38 +1,34 @@
# Persistent global definitions go here # Firejail profile for frozen-bubble
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/frozen-bubble.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/frozen-bubble.local
################################
# Frozen Bubble profile
################################
noblacklist ~/.frozen-bubble noblacklist ~/.frozen-bubble
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
mkdir ~/.frozen-bubble mkdir ~/.frozen-bubble
whitelist ~/.frozen-bubble whitelist ~/.frozen-bubble
include /etc/firejail/whitelist-common.inc include /etc/firejail/whitelist-common.inc
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
caps.drop all caps.drop all
net none
nogroups
nonewprivs nonewprivs
noroot noroot
protocol unix,netlink protocol unix,netlink
seccomp seccomp
#
# depending on your usage, you can enable some of the commands below:
#
net none
nogroups
shell none shell none
#private-bin frozen-bubble
# private-etc none
private-dev
private-tmp
# nosound
# private-bin frozen-bubble
private-dev
# private-etc none
private-tmp
# CLOBBERED COMMENTS
# depending on your usage, you can enable some of the commands below:
# nosound

56
etc/gajim.profile
View file

@ -1,34 +1,30 @@
# Persistent global definitions go here # Firejail profile for gajim
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/gajim.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/gajim.local
# Firejail profile for Gajim
noblacklist ${HOME}/.local/share/gajim
noblacklist ${HOME}/.config/gajim
noblacklist ${HOME}/.cache/gajim noblacklist ${HOME}/.cache/gajim
noblacklist ${HOME}/.config/gajim
mkdir ${HOME}/.cache/gajim noblacklist ${HOME}/.local/share/gajim
mkdir ${HOME}/.local/share/gajim
mkdir ${HOME}/.config/gajim
mkdir ${HOME}/Downloads
# Allow the local python 2.7 site packages, in case any plugins are using these
mkdir ${HOME}/.local/lib/python2.7/site-packages/
whitelist ${HOME}/.local/lib/python2.7/site-packages/
read-only ${HOME}/.local/lib/python2.7/site-packages/
whitelist ${HOME}/.cache/gajim
whitelist ${HOME}/.local/share/gajim
whitelist ${HOME}/.config/gajim
whitelist ${HOME}/Downloads
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc
mkdir ${HOME}/.cache/gajim
mkdir ${HOME}/.config/gajim
mkdir ${HOME}/.local/lib/python2.7/site-packages/
mkdir ${HOME}/.local/share/gajim
mkdir ${HOME}/Downloads
whitelist ${HOME}/.cache/gajim
whitelist ${HOME}/.config/gajim
whitelist ${HOME}/.local/lib/python2.7/site-packages/
whitelist ${HOME}/.local/share/gajim
whitelist ${HOME}/Downloads
include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
netfilter netfilter
@ -39,8 +35,12 @@ protocol unix,inet,inet6
seccomp seccomp
shell none shell none
#private-bin python2.7 gajim
#private-etc fonts
private-dev
#private-tmp
disable-mnt disable-mnt
# private-bin python2.7 gajim
private-dev
# private-etc fonts
# private-tmp
read-only ${HOME}/.local/lib/python2.7/site-packages/
# CLOBBERED COMMENTS
# Allow the local python 2.7 site packages, in case any plugins are using these

14
etc/galculator.profile
View file

@ -1,20 +1,20 @@
# Persistent global definitions go here # Firejail profile for galculator
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/galculator.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/firejail.local
# Firejail profile for XYZ
noblacklist ~/.config/galculator noblacklist ~/.config/galculator
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
mkdir ~/.config/galculator mkdir ~/.config/galculator
whitelist ~/.config/galculator whitelist ~/.config/galculator
include /etc/firejail/whitelist-common.inc
caps.drop all caps.drop all
net none net none

13
etc/geany.profile
View file

@ -1,14 +1,15 @@
# Persistent global definitions go here # Firejail profile for geany
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/geany.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/geany.local
noblacklist ${HOME}/.config/geany noblacklist ${HOME}/.config/geany
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
netfilter netfilter

37
etc/geary.profile
View file

@ -1,28 +1,29 @@
# Persistent global definitions go here # Firejail profile for geary
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/geary.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/geary.local
# Firejail profile for Gnome Geary
# Users have Geary set to open a browser by clicking a link in an email
# We are not allowed to blacklist browser-specific directories
noblacklist ~/.gnupg noblacklist ~/.gnupg
mkdir ~/.gnupg
whitelist ~/.gnupg
noblacklist ~/.local/share/geary noblacklist ~/.local/share/geary
mkdir ~/.local/share/geary
whitelist ~/.local/share/geary
mkdir ~/.gnupg
mkdir ~/.local/share/geary
whitelist ~/.config/mimeapps.list whitelist ~/.config/mimeapps.list
read-only ~/.config/mimeapps.list whitelist ~/.gnupg
whitelist ~/.local/share/applications whitelist ~/.local/share/applications
whitelist ~/.local/share/geary
include /etc/firejail/whitelist-common.inc
ignore private-tmp
read-only ~/.config/mimeapps.list
read-only ~/.local/share/applications read-only ~/.local/share/applications
# allow browsers
ignore private-tmp
include /etc/firejail/firefox.profile include /etc/firejail/firefox.profile
#include /etc/firejail/chromium.profile - chromium runs as suid!
# CLOBBERED COMMENTS
# Users have Geary set to open a browser by clicking a link in an email
# We are not allowed to blacklist browser-specific directories
# allow browsers

20
etc/gedit.profile
View file

@ -1,23 +1,18 @@
# Persistent global definitions go here # Firejail profile for gedit
include /etc/firejail/globals.local # This file is overwritten after every install/update
# Persistent local customizations
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/gedit.local include /etc/firejail/gedit.local
# Persistent global definitions
# gedit profile include /etc/firejail/globals.local
# when gedit is started via gnome-shell, firejail is not applied because systemd will start it
noblacklist ~/.config/gedit noblacklist ~/.config/gedit
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
# include /etc/firejail/disable-devel.inc # include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
#ipc-namespace
net none net none
no3d no3d
nogroups nogroups
@ -36,3 +31,6 @@ private-tmp
noexec ${HOME} noexec ${HOME}
noexec /tmp noexec /tmp
# CLOBBERED COMMENTS
# when gedit is started via gnome-shell, firejail is not applied because systemd will start it

27
etc/geeqie.profile
View file

@ -1,30 +1,31 @@
# Persistent global definitions go here # Firejail profile for geeqie
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/geeqie.local
# Persistent global definitions
include /etc/firejail/globals.local include /etc/firejail/globals.local
# This file is overwritten during software install. noblacklist ~/.cache/geeqie
# Persistent customizations should go in a .local file.
include /etc/firejail/geeqie.local
# Firejail profile for Geeqie
noblacklist ~/.config/geeqie noblacklist ~/.config/geeqie
noblacklist ~/.local/share/geeqie noblacklist ~/.local/share/geeqie
noblacklist ~/.cache/geeqie
include /etc/firejail/disable-common.inc include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all caps.drop all
nogroups nogroups
nonewprivs nonewprivs
noroot noroot
nosound
protocol unix protocol unix
seccomp seccomp
nosound
private-dev
#Experimental:
shell none shell none
# private-bin geeqie # private-bin geeqie
private-dev
# private-etc X11 # private-etc X11
# CLOBBERED COMMENTS
# Experimental:

11
etc/ghb.profile
View file

@ -1,9 +1,8 @@
# Persistent global definitions go here # Firejail profile alias for handbrake
include /etc/firejail/globals.local # This file is overwritten after every install/update
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/ghb.local
# HandBrake
include /etc/firejail/handbrake.profile include /etc/firejail/handbrake.profile
# CLOBBERED COMMENTS
# HandBrake

7
etc/gimp-2.8.profile
View file

@ -1,8 +1,5 @@
# Persistent global definitions go here # Firejail profile alias for gimp
include /etc/firejail/globals.local # This file is overwritten after every install/update
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/gimp-2.8.local
include /etc/firejail/gimp.profile include /etc/firejail/gimp.profile

Some files were not shown because too many files have changed in this diff Show more