github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-21 06:45:29 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 1

Add private-cache to many profiles

Browse source 
grep "cache" -L $(grep "redirect" -iL $(grep "whitelist" -RL))
This commit is contained in:
Tad 2018-06-14 17:28:34 -04:00
parent ce416de492
commit b885aec301
101 changed files with 112 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

13
README.md
View file

@ -100,11 +100,6 @@ We also keep a list of profile fixes for previous released versions in [etc-fixe
`````
# Current development version: 0.9.55
## Mounting a temporary filesystem on top of ~/.cache directory by default
To disable it globally, set "private-cache no" in /etc/firejail/firejail.config.
## New commands:
`````
(wireless support for --net)
@ -128,6 +123,14 @@ To disable it globally, set "private-cache no" in /etc/firejail/firejail.config.
Example:
$ firejail --nou2f
--private-cache
Mount an empty temporary filesystem on top of the .cache
directory in user home. All modifications are discarded
when the sandbox is closed.
Example:
$ firejail --private-cache
`````
## New profiles

4
RELNOTES
View file

@ -1,9 +1,7 @@
firejail (0.9.55) baseline; urgency=low
* work in progress
* modif: removed CFG_CHROOT_DESKTOP configuration option
* mounting a temporary filesystem on top of ~/.cache directory by default.
To disable it globally, set "private-cache no" in
/etc/firejail/firejail.config.
* add --private-cache to support private ~/.cache
* support full paths in private-lib
* globbing support in private-lib
* new profiles: ms-excel, ms-office, ms-onenote, ms-outlook, ms-powerpoint

1
etc/Cryptocat.profile
View file

@ -25,5 +25,6 @@ protocol unix,inet,inet6,netlink
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/android-studio.profile
View file

@ -32,6 +32,7 @@ protocol unix,inet,inet6
seccomp
shell none
private-cache
# private-tmp
# noexec /tmp breaks 'Android Profiler'

1
etc/apktool.profile
View file

@ -26,6 +26,7 @@ seccomp
shell none
private-bin apktool,bash,java,dirname,basename,expr,sh
private-cache
private-dev
noexec ${HOME}

1
etc/arch-audit.profile
View file

@ -32,6 +32,7 @@ shell none
disable-mnt
private
private-cache
private-bin arch-audit
private-dev
private-tmp

1
etc/ardour5.profile
View file

@ -30,6 +30,7 @@ seccomp
shell none
#private-bin sh,ardour4,ardour5,ardour5-copy-mixer,ardour5-export,ardour5-fix_bbtppq,grep,sed,ldd,nm
private-cache
private-dev
#private-etc pulse,X11,alternatives,ardour4,ardour5,fonts
private-tmp

1
etc/arduino.profile
View file

@ -35,6 +35,7 @@ protocol unix,inet,inet6
seccomp
shell none
private-cache
private-tmp
noexec ${HOME}

1
etc/atom.profile
View file

@ -27,6 +27,7 @@ protocol unix,inet,inet6,netlink
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/atool.profile
View file

@ -36,6 +36,7 @@ seccomp
shell none
tracelog
private-cache
# private-bin atool
private-dev
private-etc passwd,group

1
etc/bitlbee.profile
View file

@ -27,6 +27,7 @@ seccomp
disable-mnt
private
private-cache
private-dev
private-tmp
read-write /var/lib/bitlbee

1
etc/bless.profile
View file

@ -29,6 +29,7 @@ seccomp
shell none
# private-bin bless,sh,bash,mono
private-cache
private-dev
private-etc fonts,mono
private-tmp

1
etc/brackets.profile
View file

@ -26,4 +26,5 @@ protocol unix,inet,inet6,netlink
seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,iopl,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,pciconfig_iobase,pciconfig_read,pciconfig_write,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,s390_mmio_read,s390_mmio_write,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplic
shell none
private-cache
private-dev

1
etc/brasero.profile
View file

@ -27,6 +27,7 @@ shell none
tracelog
# private-bin brasero
private-cache
# private-dev
# private-etc fonts
# private-tmp

1
etc/cherrytree.profile
View file

@ -34,6 +34,7 @@ seccomp
shell none
tracelog
private-cache
private-dev
private-tmp

1
etc/cin.profile
View file

@ -29,6 +29,7 @@ seccomp
shell none
#private-bin cin,ffmpeg
private-cache
private-dev
noexec ${HOME}

1
etc/clion.profile
View file

@ -28,6 +28,7 @@ protocol unix,inet,inet6
seccomp
shell none
private-cache
private-dev
# private-tmp

1
etc/clipit.profile
View file

@ -29,6 +29,7 @@ seccomp
shell none
disable-mnt
private-cache
private-dev
private-tmp

1
etc/code.profile
View file

@ -26,6 +26,7 @@ protocol unix,inet,inet6,netlink
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/conky.profile
View file

@ -28,6 +28,7 @@ seccomp
shell none
disable-mnt
private-cache
private-dev
private-tmp

1
etc/curl.profile
View file

@ -29,6 +29,7 @@ seccomp
shell none
# private-bin curl
private-cache
private-dev
# private-etc resolv.conf
private-tmp

1
etc/default.profile
View file

@ -33,6 +33,7 @@ seccomp
# disable-mnt
# private
# private-bin program
# private-cache
# private-dev
# private-etc none
# private-lib

1
etc/dex2jar.profile
View file

@ -34,6 +34,7 @@ seccomp
shell none
private-bin dex2jar,java,sh,bash,expr,dirname,ls,uname,grep
private-cache
private-dev
noexec ${HOME}

1
etc/dia.profile
View file

@ -30,6 +30,7 @@ shell none
disable-mnt
#private-bin dia
private-cache
private-dev
private-tmp

1
etc/dnscrypt-proxy.profile
View file

@ -27,6 +27,7 @@ seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,i
disable-mnt
private
private-cache
private-dev
# mdwe can break modules/plugins

1
etc/dnsmasq.profile
View file

@ -28,4 +28,5 @@ seccomp
disable-mnt
private
private-cache
private-dev

1
etc/elinks.profile
View file

@ -31,6 +31,7 @@ shell none
tracelog
# private-bin elinks
private-cache
private-dev
# private-etc none
private-tmp

3
etc/empathy.profile
View file

@ -20,3 +20,6 @@ noroot
notv
protocol unix,inet,inet6
seccomp
private-cache
private-tmp

1
etc/enchant.profile
View file

@ -30,6 +30,7 @@ shell none
tracelog
# private-bin enchant, enchant-*
private-cache
private-dev
private-etc none
private-tmp

1
etc/exiftool.profile
View file

@ -36,6 +36,7 @@ shell none
tracelog
# private-bin exiftool,perl
private-cache
private-dev
private-etc none
private-tmp

1
etc/feh.profile
View file

@ -27,6 +27,7 @@ seccomp
shell none
private-bin feh,jpegexiforient,jpegtran
private-cache
private-dev
private-etc feh
private-tmp

1
etc/flowblade.profile
View file

@ -31,6 +31,7 @@ protocol unix,inet,inet6,netlink
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/fontforge.profile
View file

@ -32,6 +32,7 @@ protocol unix
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/freecad.profile
View file

@ -29,6 +29,7 @@ seccomp
shell none
private-bin freecad,freecadcmd
private-cache
private-dev
private-tmp

1
etc/freshclam.profile
View file

@ -24,6 +24,7 @@ tracelog
disable-mnt
private
private-cache
private-dev
private-tmp
writable-var

1
etc/geany.profile
View file

@ -25,5 +25,6 @@ protocol unix,inet,inet6
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/git.profile
View file

@ -34,4 +34,5 @@ protocol unix,inet,inet6
seccomp
shell none
private-cache
private-dev

1
etc/gitg.profile
View file

@ -29,6 +29,7 @@ seccomp
shell none
private-bin gitg,git,ssh
private-cache
private-dev
private-tmp

1
etc/globaltime.profile
View file

@ -28,6 +28,7 @@ seccomp
shell none
disable-mnt
private-cache
private-dev
private-tmp

1
etc/gnome-builder.profile
View file

@ -23,4 +23,5 @@ protocol unix,inet,inet6
seccomp
shell none
private-cache
private-dev

1
etc/gnome-documents.profile
View file

@ -30,6 +30,7 @@ seccomp
shell none
tracelog
private-cache
private-dev
private-tmp

1
etc/gnome-mplayer.profile
View file

@ -22,6 +22,7 @@ seccomp
shell none
# private-bin gnome-mplayer,mplayer
private-cache
private-dev
private-tmp

1
etc/gpg-agent.profile
View file

@ -31,4 +31,5 @@ shell none
tracelog
# private-bin gpg-agent,gpg
private-cache
private-dev

1
etc/gpg.profile
View file

@ -31,4 +31,5 @@ shell none
tracelog
# private-bin gpg,gpg-agent
private-cache
private-dev

1
etc/gthumb.profile
View file

@ -29,5 +29,6 @@ shell none
tracelog
private-bin gthumb
private-cache
private-dev
private-tmp

1
etc/gucharmap.profile
View file

@ -28,6 +28,7 @@ shell none
disable-mnt
private
private-cache
private-dev
private-tmp

1
etc/hashcat.profile
View file

@ -31,6 +31,7 @@ shell none
disable-mnt
private-bin hashcat
private-cache
private-dev
private-tmp

1
etc/highlight.profile
View file

@ -30,6 +30,7 @@ shell none
tracelog
private-bin highlight
private-cache
private-dev
# private-etc none
private-tmp

1
etc/hugin.profile
View file

@ -28,6 +28,7 @@ seccomp
shell none
private-bin PTBatcherGUI,calibrate_lens_gui,hugin,hugin_stitch_project,align_image_stack,autooptimiser,celeste_standalone,checkpto,cpclean,cpfind,deghosting_mask,fulla,geocpset,hugin_executor,hugin_hdrmerge,hugin_lensdb,icpfind,linefind,nona,pano_modify,pano_trafo,pto_gen,pto_lensstack,pto_mask,pto_merge,pto_move,pto_template,pto_var,tca_correct,verdandi,vig_optimize,enblend
private-cache
private-dev
private-tmp

1
etc/idea.sh.profile
View file

@ -32,6 +32,7 @@ protocol unix,inet,inet6
seccomp
shell none
private-cache
private-dev
# private-tmp

1
etc/img2txt.profile
View file

@ -27,6 +27,7 @@ shell none
tracelog
# private-bin img2txt
private-cache
private-dev
# private-etc none
private-tmp

1
etc/jd-gui.profile
View file

@ -36,6 +36,7 @@ seccomp
shell none
private-bin jd-gui,sh,bash
private-cache
private-dev
private-tmp

1
etc/jitsi.profile
View file

@ -31,4 +31,5 @@ shell none
tracelog
disable-mnt
private-cache
private-tmp

1
etc/keepass.profile
View file

@ -33,6 +33,7 @@ protocol unix,inet,inet6
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/kino.profile
View file

@ -25,6 +25,7 @@ protocol unix
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/krita.profile
View file

@ -36,6 +36,7 @@ protocol unix
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/less.profile
View file

@ -24,6 +24,7 @@ writable-var-log
# Enable private-bin and private-lib if you are not using any filter.
# private-bin less
# private-lib
private-cache
private-dev
memory-deny-write-execute

1
etc/luminance-hdr.profile
View file

@ -28,6 +28,7 @@ shell none
tracelog
#private-bin luminance-hdr,luminance-hdr-cli,align_image_stack
private-cache
private-dev
private-tmp

1
etc/lximage-qt.profile
View file

@ -27,6 +27,7 @@ protocol unix
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/lynx.profile
View file

@ -29,6 +29,7 @@ shell none
tracelog
# private-bin lynx
private-cache
private-dev
# private-etc none
private-tmp

1
etc/macrofusion.profile
View file

@ -35,6 +35,7 @@ seccomp
shell none
private-bin python*,macrofusion,env,enfuse,exiftool,align_image_stack
private-cache
private-dev
private-tmp

1
etc/mediainfo.profile
View file

@ -30,6 +30,7 @@ shell none
tracelog
private-bin mediainfo
private-cache
private-dev
private-etc none
private-tmp

1
etc/meld.profile
View file

@ -28,6 +28,7 @@ seccomp
shell none
private-bin meld,python*
private-cache
private-dev
private-tmp

1
etc/mpd.profile
View file

@ -28,6 +28,7 @@ seccomp
shell none
#private-bin mpd,bash
private-cache
private-dev
private-tmp

1
etc/obs.profile
View file

@ -25,6 +25,7 @@ shell none
tracelog
private-bin obs
private-cache
private-dev
private-tmp

1
etc/odt2txt.profile
View file

@ -30,6 +30,7 @@ shell none
tracelog
private-bin odt2txt
private-cache
private-dev
private-etc none
private-tmp

1
etc/orage.profile
View file

@ -29,6 +29,7 @@ seccomp
shell none
disable-mnt
private-cache
private-dev
private-tmp

1
etc/parole.profile
View file

@ -22,4 +22,5 @@ seccomp
shell none
private-bin parole,dbus-launch
private-cache
private-etc passwd,group,fonts

1
etc/pdfsam.profile
View file

@ -37,6 +37,7 @@ seccomp
shell none
private-bin pdfsam,sh,bash,java,archlinux-java,grep,awk,dirname,uname,which,sort,find,readlink,expr,ls,java-config
private-cache
private-dev
private-tmp

1
etc/pidgin.profile
View file

@ -26,6 +26,7 @@ shell none
tracelog
private-bin pidgin
private-cache
private-dev
private-tmp

1
etc/pinta.profile
View file

@ -29,6 +29,7 @@ seccomp
shell none
private-dev
private-cache
private-tmp
noexec ${HOME}

1
etc/pix.profile
View file

@ -30,5 +30,6 @@ shell none
tracelog
private-bin pix
private-cache
private-dev
private-tmp

1
etc/pycharm-community.profile
View file

@ -32,6 +32,7 @@ tracelog
# private-etc fonts,passwd - minimal required to run but will probably break
# program!
private-cache
private-dev
private-tmp

1
etc/qemu-launcher.profile
View file

@ -23,6 +23,7 @@ seccomp
shell none
tracelog
private-cache
private-tmp
noexec /tmp

1
etc/qemu-system-x86_64.profile
View file

@ -22,6 +22,7 @@ seccomp
shell none
tracelog
private-cache
private-tmp
noexec /tmp

1
etc/qlipper.profile
View file

@ -28,6 +28,7 @@ seccomp
shell none
disable-mnt
private-cache
private-dev
private-tmp

3
etc/quassel.profile
View file

@ -19,3 +19,6 @@ noroot
notv
protocol unix,inet,inet6
seccomp
private-cache
private-tmp

1
etc/remmina.profile
View file

@ -28,6 +28,7 @@ seccomp
# seccomp.keep access,arch_prctl,brk,chmod,clock_getres,clock_gettime,clone,close,connect,dup3,eventfd2,execve,fadvise64,fallocate,fcntl,flock,fstat,fstatfs,fsync,ftruncate,futex,getdents,getegid,geteuid,getgid,getpeername,getpid,getrandom,getresgid,getresuid,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init1,inotify_rm_watch,ioctl,lseek,lstat,madvise,memfd_create,mmap,mprotect,mremap,munmap,nanosleep,open,openat,pipe,pipe2,poll,prctl,prlimit64,pwrite64,read,readlink,recvfrom,recvmsg,rename,rt_sigaction,rt_sigprocmask,sendmmsg,sendmsg,sendto,set_robust_list,setsockopt,set_tid_address,shmat,shmctl,shmdt,shmget,shutdown,socket,stat,statfs,sysinfo,tgkill,uname,utimensat,write,writev
shell none
private-cache
private-dev
private-tmp

1
etc/ristretto.profile
View file

@ -29,6 +29,7 @@ protocol unix
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/rtorrent.profile
View file

@ -26,5 +26,6 @@ seccomp
shell none
private-bin rtorrent
private-cache
private-dev
private-tmp

1
etc/sdat2img.profile
View file

@ -34,6 +34,7 @@ seccomp
shell none
private-bin sdat2img,env,python*
private-cache
private-dev
noexec ${HOME}

1
etc/shotcut.profile
View file

@ -26,6 +26,7 @@ seccomp
shell none
#private-bin shotcut,melt,qmelt,nice
private-cache
private-dev
#noexec ${HOME}

1
etc/skype.profile
View file

@ -26,6 +26,7 @@ shell none
disable-mnt
#private-bin skype,bash
private-cache
private-dev
private-tmp

1
etc/skypeforlinux.profile
View file

@ -25,6 +25,7 @@ seccomp
shell none
disable-mnt
private-cache
# private-dev - needs /dev/disk
private-tmp

1
etc/soundconverter.profile
View file

@ -31,6 +31,7 @@ protocol unix
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/sqlitebrowser.profile
View file

@ -29,6 +29,7 @@ seccomp
shell none
private-bin sqlitebrowser
private-cache
private-dev
private-tmp

1
etc/ssh.profile
View file

@ -29,6 +29,7 @@ seccomp
shell none
tracelog
private-cache
private-dev
# private-tmp # Breaks when exiting

1
etc/synfigstudio.profile
View file

@ -29,6 +29,7 @@ seccomp
shell none
#private-bin synfigstudio,synfig,ffmpeg
private-cache
private-dev
private-tmp

1
etc/telegram.profile
View file

@ -23,6 +23,7 @@ protocol unix,inet,inet6
seccomp
disable-mnt
private-cache
private-tmp
noexec ${HOME}

1
etc/tilp.profile
View file

@ -28,6 +28,7 @@ tracelog
disable-mnt
private-bin tilp
private-cache
private-etc fonts
private-tmp

1
etc/tor.profile
View file

@ -41,6 +41,7 @@ writable-var
disable-mnt
private
private-bin tor,bash
private-cache
private-dev
private-etc tor,passwd
private-tmp

1
etc/totem.profile
View file

@ -28,6 +28,7 @@ seccomp
shell none
private-bin totem
private-cache
private-dev
# private-etc fonts
private-tmp

1
etc/uefitool.profile
View file

@ -27,6 +27,7 @@ protocol unix
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/uudeview.profile
View file

@ -18,6 +18,7 @@ shell none
tracelog
private-bin uudeview
private-cache
private-dev
private-etc ld.so.preload

1
etc/viewnior.profile
View file

@ -34,6 +34,7 @@ shell none
tracelog
private-bin viewnior
private-cache
private-dev
private-etc fonts
private-tmp

1
etc/w3m.profile
View file

@ -31,6 +31,7 @@ shell none
tracelog
# private-bin w3m
private-cache
private-dev
private-etc resolv.conf,ssl,pki,ca-certificates,crypto-policies
private-tmp

1
etc/webstorm.profile
View file

@ -35,5 +35,6 @@ protocol unix,inet,inet6
seccomp
shell none
private-cache
private-dev
private-tmp

1
etc/wire.profile
View file

@ -29,5 +29,6 @@ seccomp
shell none
disable-mnt
private-cache
private-dev
private-tmp

1
etc/xfce4-dict.profile
View file

@ -28,6 +28,7 @@ seccomp
shell none
disable-mnt
private-cache
private-dev
private-tmp

1
etc/xfce4-notes.profile
View file

@ -30,6 +30,7 @@ seccomp
shell none
disable-mnt
private-cache
private-dev
private-tmp

Some files were not shown because too many files have changed in this diff Show more