Harden mate-* profiles

onny · Sep 24, 2017 · e3d22fa · e3d22fa
1 parent 463ebe8
commit e3d22fa
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 1 deletion.
diff --git a/etc/mate-color-select.profile b/etc/mate-color-select.profile
@@ -11,6 +11,11 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+whitelist ${HOME}/.config/gtk-3.0
+whitelist ${HOME}/.fonts
+whitelist ${HOME}/.icons
+whitelist ${HOME}/.themes
+
 caps.drop all
 netfilter
 no3d
@@ -26,9 +31,11 @@ seccomp
 shell none
 
 disable-mnt
-private
+private-bin mate-color-select
+private-etc fonts
 private-dev
 private-tmp
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/mate-dictionary.profile b/etc/mate-dictionary.profile
@@ -12,6 +12,12 @@ include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 include /etc/firejail/disable-programs.inc
 
+whitelist ${HOME}/.config/mate/mate-dictionary
+whitelist ${HOME}/.config/gtk-3.0
+whitelist ${HOME}/.fonts
+whitelist ${HOME}/.icons
+whitelist ${HOME}/.themes
+
 caps.drop all
 netfilter
 no3d
@@ -27,8 +33,12 @@ seccomp
 shell none
 
 disable-mnt
+private-bin mate-dictionary
+private-etc fonts,resolv.conf
+private-opt mate-dictionary
 private-dev
 private-tmp
 
+memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp