mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-21 06:45:29 -06:00
8b60da9811
To reduce clutter in the user home.
This appears to be a legacy path and the relevant profiles already
create an XDG path as well:
mkdir ${HOME}/.local/share/pki
From nss 3.111[1]:
/**
* Return the path to user's NSS database.
* We search in the following dirs in order:
* (1) $HOME/.pki/nssdb;
* (2) $XDG_DATA_HOME/pki/nssdb if XDG_DATA_HOME is set;
* (3) $HOME/.local/share/pki/nssdb (default XDG_DATA_HOME value).
* If (1) does not exist, then the returned dir will be set to either
* (2) or (3), depending if XDG_DATA_HOME is set.
*/
The XDG path has apparently been supported since nss 3.42, which was
released on 2019-01-25[2] [3] [4].
Misc: The original path was first added on commit 3a71eb2af ("added
mkdir in all whitelisted profiles", 2016-02-18) and the XDG path was
first added on commit 63c35052b ("Add '$HOME/.local/share/pki' to
blacklist", 2019-02-03).
Relates to #4262.
[1] https://github.com/nss-dev/nss/blob/NSS_3_111_RTM/lib/sysinit/nsssysinit.c#L64-L72
[2] https://github.com/nss-dev/nss/blob/NSS_3_42_RTM/lib/sysinit/nsssysinit.c#L65-L73
[3] 7f21d4f497
[4] https://github.com/nss-dev/nss/releases/tag/NSS_3_42_RTM
39 lines
936 B
Text
39 lines
936 B
Text
# Firejail profile for rambox
|
|
# Description: Free and Open Source messaging and emailing app that combines common web applications into one (Electron-based)
|
|
# This file is overwritten after every install/update
|
|
# Persistent local customizations
|
|
include rambox.local
|
|
# Persistent global definitions
|
|
include globals.local
|
|
|
|
noblacklist ${HOME}/.config/Rambox
|
|
noblacklist ${HOME}/.local/share/pki
|
|
noblacklist ${HOME}/.pki
|
|
|
|
include disable-common.inc
|
|
include disable-devel.inc
|
|
include disable-interpreters.inc
|
|
include disable-programs.inc
|
|
|
|
mkdir ${HOME}/.config/Rambox
|
|
mkdir ${HOME}/.local/share/pki
|
|
whitelist ${DOWNLOADS}
|
|
whitelist ${HOME}/.config/Rambox
|
|
whitelist ${HOME}/.local/share/pki
|
|
whitelist ${HOME}/.pki
|
|
include whitelist-common.inc
|
|
|
|
caps.drop all
|
|
netfilter
|
|
nodvd
|
|
nogroups
|
|
nonewprivs
|
|
noroot
|
|
notv
|
|
protocol unix,inet,inet6,netlink
|
|
# electron-based application, needing chroot
|
|
#seccomp
|
|
seccomp !chroot
|
|
#tracelog
|
|
|
|
#restrict-namespaces
|