github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-21 06:45:29 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 1

makepkg profile for Arch platform, #1642

Browse source
This commit is contained in:
netblue30 2017-11-15 08:14:46 -05:00
parent c14c5050c1
commit d0ae074854
3 changed files with 60 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -236,7 +236,7 @@ imagej, karbon, kdenlive, krita, linphone, lmms, macrofusion, mpd, natron, Natro
ricochet, shotcut, teamspeak3, tor, tor-browser-en, Viber, x-terminal-emulator, zart, ricochet, shotcut, teamspeak3, tor, tor-browser-en, Viber, x-terminal-emulator, zart,
conky, arch-audit, ffmpeg, bluefish, cliqz, cinelerra, openshot-qt, pinta, uefitool, conky, arch-audit, ffmpeg, bluefish, cliqz, cinelerra, openshot-qt, pinta, uefitool,
aosp, pdfmod, gnome-ring, signal-desktop, xcalc, zaproxy, kopete, kget, nheko, Enpass, aosp, pdfmod, gnome-ring, signal-desktop, xcalc, zaproxy, kopete, kget, nheko, Enpass,
kwin_x11, krunner, ping, bsdtar kwin_x11, krunner, ping, bsdtar, makepkg (Arch),
Upstreamed many profiles from the following sources: https://github.com/chiraag-nataraj/firejail-profiles, Upstreamed many profiles from the following sources: https://github.com/chiraag-nataraj/firejail-profiles,
https://github.com/nyancat18/fe, and https://aur.archlinux.org/packages/firejail-profiles. https://github.com/nyancat18/fe, and https://aur.archlinux.org/packages/firejail-profiles.

2
RELNOTES
View file

@ -41,7 +41,7 @@ firejail (0.9.51) baseline; urgency=low
Viber, x-terminal-emulator, zart, conky, arch-audit, ffmpeg, bluefish, Viber, x-terminal-emulator, zart, conky, arch-audit, ffmpeg, bluefish,
cinelerra, openshot-qt, pinta, uefitool, aosp, pdfmod, gnome-ring, cinelerra, openshot-qt, pinta, uefitool, aosp, pdfmod, gnome-ring,
xcalc, zaproxy, kopete, cliqz, signal-desktop, kget, nheko, Enpass, xcalc, zaproxy, kopete, cliqz, signal-desktop, kget, nheko, Enpass,
kwin_x11, krunner, ping, bsdtar kwin_x11, krunner, ping, bsdtar, makepkg (Arch)
-- netblue30 <netblue30@yahoo.com> Thu, 9 Nov 2017 08:00:00 -0500 -- netblue30 <netblue30@yahoo.com> Thu, 9 Nov 2017 08:00:00 -0500

58
etc/makepkg.profile Normal file
View file

@ -0,0 +1,58 @@
# Firejail profile for makepkg
# This file is overwritten after every install/update
# Note: see this Arch forum discussion https://bbs.archlinux.org/viewtopic.php?pid=1743138
# for potential issues and their solutions when Firejailing makepkg
# This profile could be significantly strengthened by adding the following to makepkg.local
# whitelist ~/<Your Build Folder>
# whitelist ~/.gnupg
quiet
# Persistent local customizations
include /etc/firejail/makepkg.local
# Persistent global definitions
include /etc/firejail/globals.local
# Enable severely restricted access to ${HOME}/.gnupg
noblacklist ~/.gnupg
read-only ~/.gnupg/gpg.conf
read-only ~/.gnupg/trustdb.gpg
read-only ~/.gnupg/pubring.kbx
blacklist ~/.gnupg/random_seed
blacklist ~/.gnupg/pubring.kbx~
blacklist ~/.gnupg/private-keys-v1.d
blacklist ~/.gnupg/crls.d
blacklist ~/.gnupg/openpgp-revocs.d
# Need to be able to read /var/lib/pacman, {Note no capabilities so automatically read-only}
noblacklist /var/lib/pacman
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc
caps.drop all
ipc-namespace
netfilter
no3d
nodvd
nogroups
nonewprivs
# noroot is only disabled to allow the creation of kernel headers from an official pckgbuild.
#noroot
nosound
notv
novideo
protocol unix,inet,inet6
seccomp
shell none
disable-mnt
private-tmp
memory-deny-write-execute
noexec ${HOME}
noexec /tmp