mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
b66da99f9a
Changes: * Convert all private-opt entries (other than `private-opt none`) to whitelist entries * Remove remaining commented private-opt entries and related comments (for profiles that also have a corresponding whitelist entry) * Enable `whitelist /opt/basilisk` in basilisk.profile (similarly to mullvad-browser.profile and palemoon.profile) * Update private-opt comment in etc/templates/profile.template Most private-opt entries were converted into whitelist entries on commit175905530("profiles: exchange private-opt with a whitelist (#6021)", 2023-10-18), while some of them were left alone due to the program size being deemed small enough as not to break file-copy-limit in firejail.config. For the sake of simplicity and clarity (and to avoid potential issues with program install sizes increasing over time), convert those private-opt entries into whitelist entries as well (note that users can still enable private-opt in the corresponding .local profile). Also, some commented private-opt entries remain (with a note about potential issues with private-opt). Since commit175905530also documented the drawbacks of private-opt in firejail.1, it should be fine to remove the commented entries and related comments (note that in all of the profiles containing such comments, there is already an equivalent whitelist entry). Related commits: *f3f739c5d("microsoft-edge.profile: rewrite profile for stable channel", 2022-08-11) / PR #5709 *121e043df("microsoft-edge-{dev,beta}: replaced private-opt by whitelist #5307", 2022-08-11) / PR #5709 *2cb40fbec("microsoft-edge fixes (#5697)", 2023-03-14) *58732a654("Add profiles for jami and postman (#5691)", 2023-03-15) *175905530("profiles: exchange private-opt with a whitelist (#6021)", 2023-10-18)
29 lines
783 B
Text
29 lines
783 B
Text
# Firejail profile for basilisk
|
|
# This file is overwritten after every install/update
|
|
# Persistent local customizations
|
|
include basilisk.local
|
|
# Persistent global definitions
|
|
include globals.local
|
|
|
|
noblacklist ${HOME}/.cache/moonchild productions/basilisk
|
|
noblacklist ${HOME}/.moonchild productions/basilisk
|
|
|
|
mkdir ${HOME}/.cache/moonchild productions/basilisk
|
|
mkdir ${HOME}/.moonchild productions
|
|
whitelist ${HOME}/.cache/moonchild productions/basilisk
|
|
whitelist ${HOME}/.moonchild productions
|
|
whitelist /opt/basilisk
|
|
whitelist /usr/share/basilisk
|
|
|
|
# Basilisk can use the full firejail seccomp filter (unlike firefox >= 60)
|
|
seccomp
|
|
ignore seccomp
|
|
|
|
#private-bin basilisk
|
|
private-etc basilisk
|
|
|
|
restrict-namespaces
|
|
ignore restrict-namespaces
|
|
|
|
# Redirect
|
|
include firefox-common.profile
|