From c81777164c370c62099c7c974bbdf7fa25257d81 Mon Sep 17 00:00:00 2001 From: Amin Vakil Date: Fri, 8 May 2026 14:38:49 +0330 Subject: [PATCH] profiles: add llm-agent-common.inc (#7158) Note: This also sets `env NO_BROWSER=true` in pi.profile. --- README | 1 + RELNOTES | 1 + etc/inc/llm-agent-common.inc | 62 ++++++++++++++++++++++++++++++++ etc/profile-a-l/gemini.profile | 55 ++-------------------------- etc/profile-m-z/opencode.profile | 54 ++-------------------------- etc/profile-m-z/pi.profile | 54 ++-------------------------- 6 files changed, 70 insertions(+), 157 deletions(-) create mode 100644 etc/inc/llm-agent-common.inc diff --git a/README b/README index 919cda773..ddbc6bd9a 100644 --- a/README +++ b/README @@ -167,6 +167,7 @@ Amin Vakil (https://github.com/aminvakil) - new profile: gemini (#6936) - new profile: opencode (#7135) - new profile: pi (#7136) + - profiles: add llm-agent-common.inc (#7158) Ammon Smith (https://github.com/ammongit) - Add DBus filter rules specific to firefox-developer-edition Andreas Hunkeler (https://github.com/Karneades) diff --git a/RELNOTES b/RELNOTES index 839d04242..bf4be0d62 100644 --- a/RELNOTES +++ b/RELNOTES @@ -24,6 +24,7 @@ firejail (0.9.81) baseline; urgency=low * profiles: firefox-common: allow auto light/dark theme switching (#7103) * profiles: steam: allow more 3d cache paths (#7149) * profiles: torbrowser-launcher: add no3d (#7143) + * profiles: add llm-agent-common.inc (#7158) * new profile: gemini (#6936) * new profile: opencode (#7135) * new profile: pi (#7136) diff --git a/etc/inc/llm-agent-common.inc b/etc/inc/llm-agent-common.inc new file mode 100644 index 000000000..b5a97d6fe --- /dev/null +++ b/etc/inc/llm-agent-common.inc @@ -0,0 +1,62 @@ +# Firejail profile for llm-agent-common +# Description: Common profile for LLM agents +# This file is overwritten after every install/update +# Persistent local customizations +include llm-agent-common.local +# Persistent global definitions +# added by caller profile +#include globals.local + +# Allow /bin/sh (blacklisted by disable-shell.inc) +include allow-bin-sh.inc + +# Allows files commonly used by IDEs +include allow-common-devel.inc + +# Allow ssh (blacklisted by disable-common.inc) +include allow-ssh.inc + +blacklist ${RUNUSER} + +include disable-common.inc +include disable-proc.inc +include disable-programs.inc +include disable-x11.inc +include disable-xdg.inc + +whitelist ${RUNUSER}/openssh_agent +include whitelist-run-common.inc +#include whitelist-usr-share-common.inc +include whitelist-var-common.inc + +caps.drop all +ipc-namespace +machine-id +netfilter +no3d +nodvd +nogroups +noinput +nonewprivs +noprinters +noroot +nosound +notv +nou2f +novideo +protocol unix,inet,inet6,netlink +seccomp +seccomp.block-secondary +tracelog + +disable-mnt +private-cache +private-dev +private-etc @network,@tls-ca +private-tmp + +dbus-user none +dbus-system none + +env NO_BROWSER=true +restrict-namespaces diff --git a/etc/profile-a-l/gemini.profile b/etc/profile-a-l/gemini.profile index a99bd95a1..5b85b296b 100644 --- a/etc/profile-a-l/gemini.profile +++ b/etc/profile-a-l/gemini.profile @@ -9,23 +9,6 @@ include globals.local noblacklist ${HOME}/.gemini -# Allow /bin/sh (blacklisted by disable-shell.inc) -include allow-bin-sh.inc - -# Allows files commonly used by IDEs -include allow-common-devel.inc - -# Allow ssh (blacklisted by disable-common.inc) -include allow-ssh.inc - -blacklist ${RUNUSER} - -include disable-common.inc -include disable-proc.inc -include disable-programs.inc -include disable-x11.inc -include disable-xdg.inc - # Add the following lines to gemini.local to enable whitelisting in `${HOME}`. #whitelist ${HOME}/.config/git #whitelist ${HOME}/.gemini @@ -34,39 +17,5 @@ include disable-xdg.inc #whitelist ${HOME}/.gitconfig #include whitelist-common.inc -whitelist ${RUNUSER}/openssh_agent -include whitelist-run-common.inc -#include whitelist-usr-share-common.inc -include whitelist-var-common.inc - -caps.drop all -ipc-namespace -machine-id -netfilter -no3d -nodvd -nogroups -noinput -nonewprivs -noprinters -noroot -nosound -notv -nou2f -novideo -protocol unix,inet,inet6,netlink -seccomp -seccomp.block-secondary -tracelog - -disable-mnt -private-cache -private-dev -private-etc @network,@tls-ca -private-tmp - -dbus-user none -dbus-system none - -env NO_BROWSER=true -restrict-namespaces +# Redirect +include llm-agent-common.inc diff --git a/etc/profile-m-z/opencode.profile b/etc/profile-m-z/opencode.profile index 2e0d1948c..9cdf02434 100644 --- a/etc/profile-m-z/opencode.profile +++ b/etc/profile-m-z/opencode.profile @@ -12,23 +12,6 @@ noblacklist ${HOME}/.config/opencode noblacklist ${HOME}/.local/share/opencode noblacklist ${HOME}/.local/state/opencode -# Allow /bin/sh (blacklisted by disable-shell.inc) -include allow-bin-sh.inc - -# Allows files commonly used by IDEs -include allow-common-devel.inc - -# Allow ssh (blacklisted by disable-common.inc) -include allow-ssh.inc - -blacklist ${RUNUSER} - -include disable-common.inc -include disable-proc.inc -include disable-programs.inc -include disable-x11.inc -include disable-xdg.inc - # Add the following lines to opencode.local to enable whitelisting in `${HOME}`. #mkdir ${HOME}/.cache/opencode #mkdir ${HOME}/.config/opencode @@ -42,40 +25,7 @@ include disable-xdg.inc #whitelist ${HOME}/.local/state/opencode #include whitelist-common.inc -whitelist ${RUNUSER}/openssh_agent -include whitelist-run-common.inc -#include whitelist-usr-share-common.inc -include whitelist-var-common.inc - apparmor -caps.drop all -ipc-namespace -machine-id -netfilter -no3d -nodvd -nogroups -noinput -nonewprivs -noprinters -noroot -nosound -notv -nou2f -novideo -protocol unix,inet,inet6,netlink -seccomp -seccomp.block-secondary -tracelog -disable-mnt -private-cache -private-dev -private-etc @network,@tls-ca -private-tmp - -dbus-user none -dbus-system none - -env NO_BROWSER=true -restrict-namespaces +# Redirect +include llm-agent-common.inc diff --git a/etc/profile-m-z/pi.profile b/etc/profile-m-z/pi.profile index f3243d5a4..69be8e526 100644 --- a/etc/profile-m-z/pi.profile +++ b/etc/profile-m-z/pi.profile @@ -10,23 +10,6 @@ include globals.local noblacklist ${HOME}/.agents noblacklist ${HOME}/.pi -# Allow /bin/sh (blacklisted by disable-shell.inc) -include allow-bin-sh.inc - -# Allows files commonly used by IDEs -include allow-common-devel.inc - -# Allow ssh (blacklisted by disable-common.inc) -include allow-ssh.inc - -blacklist ${RUNUSER} - -include disable-common.inc -include disable-proc.inc -include disable-programs.inc -include disable-x11.inc -include disable-xdg.inc - # Add the following lines to pi.local to enable whitelisting in `${HOME}`. #mkdir ${HOME}/.agents #mkdir ${HOME}/.pi @@ -36,38 +19,5 @@ include disable-xdg.inc #whitelist ${HOME}/.pi #include whitelist-common.inc -whitelist ${RUNUSER}/openssh_agent -include whitelist-run-common.inc -#include whitelist-usr-share-common.inc -include whitelist-var-common.inc - -caps.drop all -ipc-namespace -machine-id -netfilter -no3d -nodvd -nogroups -noinput -nonewprivs -noprinters -noroot -nosound -notv -nou2f -novideo -protocol unix,inet,inet6,netlink -seccomp -seccomp.block-secondary -tracelog - -disable-mnt -private-cache -private-dev -private-etc @network,@tls-ca -private-tmp - -dbus-user none -dbus-system none - -restrict-namespaces +# Redirect +include llm-agent-common.inc