Skip to content

Commit

Permalink
Tighten multiple profiles.
Browse files Browse the repository at this point in the history 
This adds whitelist-var-common, machine-id, memory-deny-write-execute,
and noexec home and tmp when possible.
  • Loading branch information
@Fred-Barclay
Fred-Barclay committed Oct 4, 2017
1 parent bca8a78 commit c625937
Show file tree
Hide file tree
Showing 15 changed files with 48 additions and 37 deletions.
2 changes: 2 additions & 0 deletions etc/gedit.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ include /etc/firejail/whitelist-var-common.inc

caps.drop all
# net none - makes settings immutable
machine-id
no3d
nodvd
nogroups
Expand All @@ -37,5 +38,6 @@ private-dev
# private-etc fonts
private-tmp

memory-deny-write-execute
noexec ${HOME}
noexec /tmp
11 changes: 11 additions & 0 deletions etc/gitter.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,13 @@ include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

whitelist ${DOWNLOADS}
whitelist ~/.config/autostart
whitelist ~/.config/Gitter
include /etc/firejail/whitelist-var-common.inc

caps.drop all
machine-id
netfilter
nodvd
nogroups
Expand All @@ -25,7 +31,12 @@ protocol unix,inet,inet6,netlink
seccomp
shell none

disable-mnt
private-bin bash,env,gitter
private-etc fonts,pulse,resolv.conf
private-opt Gitter
private-dev
private-tmp

noexec ${HOME}
noexec /tmp
1 change: 1 addition & 0 deletions etc/google-chrome.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ whitelist ~/.cache/google-chrome
whitelist ~/.config/google-chrome
whitelist ~/.pki
include /etc/firejail/whitelist-common.inc
include /etc/firejail/whitelist-var-common.inc

caps.keep sys_chroot,sys_admin
netfilter
Expand Down
1 change: 0 additions & 1 deletion etc/handbrake.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ netfilter
nogroups
nonewprivs
noroot
nosound
novideo
protocol unix,inet,inet6,netlink
seccomp
Expand Down
3 changes: 3 additions & 0 deletions etc/hexchat.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,10 @@ include /etc/firejail/disable-programs.inc
mkdir ~/.config/hexchat
whitelist ~/.config/hexchat
include /etc/firejail/whitelist-common.inc
include /etc/firejail/whitelist-var-common.inc

caps.drop all
machine-id
netfilter
no3d
nodvd
Expand All @@ -38,5 +40,6 @@ private-bin hexchat
private-dev
private-tmp

memory-deny-write-execute
noexec ${HOME}
noexec /tmp
3 changes: 3 additions & 0 deletions etc/keepassx.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@ include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

include /etc/firejail/whitelist-var-common.inc

caps.drop all
machine-id
net none
Expand All @@ -36,5 +38,6 @@ private-dev
private-etc fonts,machine-id
private-tmp

memory-deny-write-execute
noexec ${HOME}
noexec /tmp
37 changes: 2 additions & 35 deletions etc/keepassx2.profile
View file
Original file line number Diff line number Diff line change
@@ -1,38 +1,5 @@
# Firejail profile for keepassx2
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/keepassx2.local
# Persistent global definitions
include /etc/firejail/globals.local

noblacklist ${HOME}/*.kdb
noblacklist ${HOME}/*.kdbx
noblacklist ${HOME}/.config/keepassx
noblacklist ${HOME}/.keepassx

include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

caps.drop all
net none
no3d
nodvd
nogroups
nonewprivs
noroot
nosound
notv
novideo
protocol unix
seccomp
shell none

private-bin keepassx2
private-dev
private-etc fonts
private-tmp

noexec ${HOME}
noexec /tmp
# Redirects
include /etc/firejail/keepassx.profile
2 changes: 2 additions & 0 deletions etc/keepassxc.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@ include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

include /etc/firejail/whitelist-var-common.inc

caps.drop all
net none
no3d
Expand Down
2 changes: 2 additions & 0 deletions etc/libreoffice.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ include /etc/firejail/disable-programs.inc
include /etc/firejail/whitelist-var-common.inc

caps.drop all
machine-id
netfilter
nodvd
nogroups
Expand All @@ -29,6 +30,7 @@ shell none
tracelog

private-dev
private-tmp

noexec ${HOME}
noexec /tmp
4 changes: 4 additions & 0 deletions etc/pluma.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,11 @@ include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

include /etc/firejail/whitelist-var-common.inc

caps.drop all
# net none - makes settings immutable
machine-id
no3d
nodvd
nogroups
Expand All @@ -32,5 +35,6 @@ private-dev
# private-etc fonts
private-tmp

memory-deny-write-execute
noexec ${HOME}
noexec /tmp
5 changes: 5 additions & 0 deletions etc/qbittorrent.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ whitelist ~/.config/qBittorrentrc
whitelist ~/.config/qt5ct
whitelist ~/.local/share/data/qBittorrent
include /etc/firejail/whitelist-common.inc
include /etc/firejail/whitelist-var-common.inc

caps.drop all
machine-id
Expand All @@ -44,3 +45,7 @@ seccomp
private-dev
# private-etc X11,fonts,xdg,resolv.conf
private-tmp

memory-deny-write-execute
noexec ${HOME}
noexec /tmp
5 changes: 5 additions & 0 deletions etc/stellarium.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,10 @@ mkdir ~/.stellarium
whitelist ~/.config/stellarium
whitelist ~/.stellarium
include /etc/firejail/whitelist-common.inc
include /etc/firejail/whitelist-var-common.inc

caps.drop all
machine-id
netfilter
nodvd
nogroups
Expand All @@ -36,3 +38,6 @@ disable-mnt
private-bin stellarium
private-dev
private-tmp

noexec ${HOME}
noexec /tmp
4 changes: 3 additions & 1 deletion etc/thunderbird.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,11 @@ whitelist ~/.gnupg
whitelist ~/.icedove
whitelist ~/.thunderbird
include /etc/firejail/whitelist-common.inc
include /etc/firejail/whitelist-var-common.inc

ignore private-tmp

machine-id
disable-mnt
read-only ~/.config/mimeapps.list

# allow browsers
Expand Down
1 change: 1 addition & 0 deletions etc/vlc.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ include /etc/firejail/disable-programs.inc
include /etc/firejail/whitelist-var-common.inc

caps.drop all
machine-id
netfilter
# nogroups
nonewprivs
Expand Down
4 changes: 4 additions & 0 deletions etc/xed.profile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,11 @@ include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

include /etc/firejail/whitelist-var-common.inc

caps.drop all
# net none - makes settings immutable
machine-id
no3d
nodvd
nogroups
Expand All @@ -32,5 +35,6 @@ private-dev
# private-etc fonts
private-tmp

memory-deny-write-execute
noexec ${HOME}
noexec /tmp

0 comments on commit c625937

Please sign in to comment.