Codebase list firejail / b54b616
Update upstream source from tag 'upstream/0.9.72' Update to upstream version '0.9.72' with Debian dir eb72d0ca38db05f00ea2d4ad235c0c35e8ad79b7 Reiner Herrmann 1 year, 3 months ago
686 changed file(s) with 2379 addition(s) and 271 deletion(s). Raw diff Collapse all Expand all
+9
-3
Makefile less more
241241 asc: config.mk
242242 ./mkasc.sh $(VERSION)
243243
244 deb: dist config.sh
245 ./mkdeb.sh
246
244247 deb-apparmor: dist config.sh
245248 ./mkdeb.sh -apparmor --enable-apparmor
246249
264267 # make test
265268 #
266269
267 TESTS=profiles private-lib apps apps-x11 apps-x11-xorg sysutils utils environment filters fs fcopy fnetfilter
270 TESTS=profiles apps apps-x11 apps-x11-xorg sysutils utils environment filters fs fcopy fnetfilter
268271 TEST_TARGETS=$(patsubst %,test-%,$(TESTS))
269272
270273 $(TEST_TARGETS):
271274 $(MAKE) -C test $(subst test-,,$@)
272275
273 test: test-profiles test-private-lib test-fcopy test-fnetfilter test-fs test-utils test-sysutils test-environment test-apps test-apps-x11 test-apps-x11-xorg test-filters
276 test: test-profiles test-fcopy test-fnetfilter test-fs test-utils test-sysutils test-environment test-apps test-apps-x11 test-apps-x11-xorg test-filters
274277 echo "TEST COMPLETE"
275278
276 test-noprofiles: test-private-lib test-fcopy test-fnetfilter test-fs test-utils test-sysutils test-environment test-apps test-apps-x11 test-apps-x11-xorg test-filters
279 test-noprofiles: test-fcopy test-fnetfilter test-fs test-utils test-sysutils test-environment test-apps test-apps-x11 test-apps-x11-xorg test-filters
277280 echo "TEST COMPLETE"
278281
279282 test-github: test-profiles test-fcopy test-fnetfilter test-fs test-utils test-sysutils test-environment
284287 # The tests are very intrusive, by the time you are done
285288 # with them you will need to restart your computer.
286289 ##########################################
290 # private-lib is disabled by default in /etc/firejail/firejail.config
291 test-private-lib:
292 $(MAKE) -C test $(subst test-,,$@)
287293
288294 # a firejail-test account is required, public/private key setup
289295 test-ssh:
+10
-1
README less more
207207 - email clients whitelisting and fixes
208208 Benjamin Kampmann (https://github.com/ligthyear)
209209 - Forward exit code from child process
210 BeautyYuYanli (https://github.com/BeautyYuYanli)
211 - add linuxqq and qq profiles
210212 bitfreak25 (https://github.com/bitfreak25)
211213 - added PlayOnLinux profile
212214 - minetest profile fix
213215 - added sylpheed profile
214
215216 bn0785ac (https://github.com/bn0785ac)
216217 - fixed bnox, dnox profiles
217218 - support all tor-browser langpacks
236237 - update virtualbox.profile
237238 - Quodlibet profile
238239 - update apparmor firejail-local for Brave + ipfs
240 bymoz089 (https://github.com/bymoz089)
241 - add timezone access to make libical functional
239242 BytesTuner (https://github.com/BytesTuner)
240243 - provided keepassxc profile
241244 caoliver (https://github.com/caoliver)
282285 - fix dino profile
283286 - fix wireshark profile
284287 - prevent emptty /usr/share in google-chrome profiles
288 cubercsl (https://github.com/cubercsl)
289 - add linuxqq and qq profiles
285290 curiosity-seeker (https://github.com/curiosity-seeker - old)
286291 curiosityseeker (https://github.com/curiosityseeker - new)
287292 - tightening unbound and dnscrypt-proxy profiles
348353 - handle malloc() failures; use gnu_basename() instead of basenaem()
349354 Dmitriy Chestnykh (https://github.com/chestnykh)
350355 - add ability to disable user profiles at compile time
356 Dpeta (https://github.com/Dpeta)
357 - add Chatterino profile
351358 dshmgh (https://github.com/dshmgh)
352359 - overlayfs fix for systems with /home mounted on a separate partition
353360 Duncan Overbruck (https://github.com/Duncaen)
647654 - added symlink fixer fix_private-bin.py in contrib section
648655 - update fix_private-bin.py
649656 - fix meld
657 - temporary fix to the bug caused by apparmor profiles stacking
650658 kortewegdevries (https://github.com/kortewegdevries)
651659 - a whole bunch of new profiles and fixes
652660 - whitelisting evolution, kmail
971979 - allow resolution of .local names with avahi-daemon in the apparmor profile
972980 - allow access to avahi-daemon in apparmor/firejail-default
973981 - make appimage examples consistent with --appimage option short description
982 - blacklist google-drive-ocamlfuse config
974983 smitsohu (https://github.com/smitsohu)
975984 - read-only kde4 services directory
976985 - enhanced mediathekview profile
+26
-9
RELNOTES less more
0 firejail (0.9.72rc1) baseline; urgency=low
1 * work in progress
0 firejail (0.9.72) baseline; urgency=low
21 * feature: On failing to remount a fuse filesystem, give warning instead of
32 erroring out (#5240 #5242)
43 * feature: Update syscall tables and seccomp groups (#5188)
54 * feature: improve force-nonewprivs security guarantees (#5217 #5271)
6 * feature: restrict namespaces (--restrict-namespaces) implemented as
7 a seccomp filter for both 64 and 32 bit architectures (#4939 #5259)
8 * feature: support for custom AppArmor profiles (--apparmor=) (#5274 #5316
9 #5317)
10 * feature: added support for ICMP in nettrace
11 * feature: --dnstrace, --icmptrace, and --snitrace
5 * feature: add support for restricting the creation of Linux namespaces
6 (--restrict-namespaces, --restrict-namespaces=), implemented as a seccomp
7 filter for both 64 and 32 bit architectures (#4939 #5259)
8 * feature: add support for custom AppArmor profiles (--apparmor=) (#5274
9 #5316 #5317 #5475)
10 * feature: add support for ICMP in nettrace
11 * feature: add --dnstrace, --icmptrace, and --snitrace commands
12 * feature: Add basic gtksourceview language-spec (file type detection/syntax
13 highlighting for profiles) (#5502)
14 * feature: add restrict-namespaces to (almost) all applicable profiles (#5440
15 #5537)
16 * feature: add support for netlock in profile files
1217 * modif: removed --cgroup= command (#5190 #5200)
1318 * modif: set --shell=none as the default (#5190)
1419 * modif: removed --shell= command (#5190 #5196 #5209)
1924 * modif: disabled tracelog by default in /etc/firejail/firejail.config
2025 (#5190)
2126 * modif: removed grsecurity support
27 * modif: stop hiding blacklisted files in /etc by default and add a new
28 etc-hide-blacklisted option to firejail.config that enables the previous
29 behavior (disabled by default) (#5010 #5230 #5591 #5595)
2230 * bugfix: Flood of seccomp audit log entries (#5207)
31 * bugfix: --netlock does not work (Error: no valid sandbox) (#5312)
2332 * build: deduplicate configure-time vars into new config files (#5140 #5284)
2433 * build: fix file mode of shell scripts (644 -> 755) (#5206)
2534 * build: reduce autoconf input files from 32 to 2 (#5219)
3241 * build: Fix musl warnings (#5421 #5431)
3342 * build: sort.py improvements (#5429)
3443 * build: deduplicate makefiles (#5478)
44 * build: fix formatting and misc in configure (#5488)
45 * build: actually set LDFLAGS/LIBS & stop overriding CFLAGS/LDFLAGS (#5504)
46 * build: make shell commands more portable in firejail.vim (#5577)
3547 * ci: bump ubuntu to 22.04 and use newer compilers / analyzers (#5275)
3648 * ci: ignore git-related paths and the project license (#5249)
3749 * ci: Harden GitHub Actions (StepSecurity) (#5439)
4759 (#5366)
4860 * docs: Add gist note to bug_report.md (#5398)
4961 * docs: clarify that --appimage should appear before --profile (#5402 #5451)
50 -- netblue30 <netblue30@yahoo.com> Sat, 11 Jun 2022 09:00:00 -0500
62 * docs: add more Firefox examples to the firejail-local AppArmor profile
63 (#5493)
64 * docs: Fix broken Restrict-DBus wiki link on profile.template (#5554)
65 * docs: Remove invalid --profile-path from --help (#5585 #5586)
66 * several new profiles
67 -- netblue30 <netblue30@yahoo.com> Mon, 16 Jan 2023 09:00:00 -0500
5168
5269 firejail (0.9.70) baseline; urgency=low
5370 * security: CVE-2022-31214 - root escalation in --join logic
+9
-9
configure less more
00 #! /bin/sh
11 # Guess values for system-dependent variables and create Makefiles.
2 # Generated by GNU Autoconf 2.69 for firejail 0.9.72rc1.
2 # Generated by GNU Autoconf 2.69 for firejail 0.9.72.
33 #
44 # Report bugs to <netblue30@protonmail.com>.
55 #
579579 # Identity of this package.
580580 PACKAGE_NAME='firejail'
581581 PACKAGE_TARNAME='firejail'
582 PACKAGE_VERSION='0.9.72rc1'
583 PACKAGE_STRING='firejail 0.9.72rc1'
582 PACKAGE_VERSION='0.9.72'
583 PACKAGE_STRING='firejail 0.9.72'
584584 PACKAGE_BUGREPORT='netblue30@protonmail.com'
585585 PACKAGE_URL='https://firejail.wordpress.com'
586586
12971297 # Omit some internal or obsolete options to make the list less imposing.
12981298 # This message is too long to be a string in the A/UX 3.1 sh.
12991299 cat <<_ACEOF
1300 \`configure' configures firejail 0.9.72rc1 to adapt to many kinds of systems.
1300 \`configure' configures firejail 0.9.72 to adapt to many kinds of systems.
13011301
13021302 Usage: $0 [OPTION]... [VAR=VALUE]...
13031303
13591359
13601360 if test -n "$ac_init_help"; then
13611361 case $ac_init_help in
1362 short | recursive ) echo "Configuration of firejail 0.9.72rc1:";;
1362 short | recursive ) echo "Configuration of firejail 0.9.72:";;
13631363 esac
13641364 cat <<\_ACEOF
13651365
14831483 test -n "$ac_init_help" && exit $ac_status
14841484 if $ac_init_version; then
14851485 cat <<\_ACEOF
1486 firejail configure 0.9.72rc1
1486 firejail configure 0.9.72
14871487 generated by GNU Autoconf 2.69
14881488
14891489 Copyright (C) 2012 Free Software Foundation, Inc.
17391739 This file contains any messages produced by compilers while
17401740 running configure, to aid debugging if configure makes a mistake.
17411741
1742 It was created by firejail $as_me 0.9.72rc1, which was
1742 It was created by firejail $as_me 0.9.72, which was
17431743 generated by GNU Autoconf 2.69. Invocation command line was
17441744
17451745 $ $0 $@
46394639 # report actual input values of CONFIG_FILES etc. instead of their
46404640 # values after options handling.
46414641 ac_log="
4642 This file was extended by firejail $as_me 0.9.72rc1, which was
4642 This file was extended by firejail $as_me 0.9.72, which was
46434643 generated by GNU Autoconf 2.69. Invocation command line was
46444644
46454645 CONFIG_FILES = $CONFIG_FILES
46934693 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
46944694 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
46954695 ac_cs_version="\\
4696 firejail config.status 0.9.72rc1
4696 firejail config.status 0.9.72
46974697 configured by $0, generated by GNU Autoconf 2.69,
46984698 with options \\"\$ac_cs_config\\"
46994699
+1
-1
configure.ac less more
1111 #
1212
1313 AC_PREREQ([2.68])
14 AC_INIT([firejail], [0.9.72rc1], [netblue30@protonmail.com], [],
14 AC_INIT([firejail], [0.9.72], [netblue30@protonmail.com], [],
1515 [https://firejail.wordpress.com])
1616
1717 AC_CONFIG_SRCDIR([src/firejail/main.c])
+7
-7
contrib/vim/syntax/firejail.vim less more
2323 syn match fjProtocolList /,/ nextgroup=fjProtocol contained
2424
2525 " Syscalls grabbed from: src/include/syscall*.h
26 " Generate list with: sed -ne 's/{\s\+"\([^"]\+\)",.*},/\1/p' src/include/syscall*.h | sort -u | tr $'\n' ' '
26 " Generate list with: sed -n 's/{\s\+"\([^"]\+\)",.*},/\1/p' src/include/syscall*.h | sort -u | tr '\n' ' '
2727 syn keyword fjSyscall _llseek _newselect _sysctl accept accept4 access acct add_key adjtimex afs_syscall alarm arch_prctl arm_fadvise64_64 arm_sync_file_range bdflush bind bpf break brk capget capset chdir chmod chown chown32 chroot clock_adjtime clock_adjtime64 clock_getres clock_getres_time64 clock_gettime clock_gettime64 clock_nanosleep clock_nanosleep_time64 clock_settime clock_settime64 clone clone3 close connect copy_file_range creat create_module delete_module dup dup2 dup3 epoll_create epoll_create1 epoll_ctl epoll_ctl_old epoll_pwait epoll_wait epoll_wait_old eventfd eventfd2 execve execveat exit exit_group faccessat faccessat2 fadvise64 fadvise64_64 fallocate fanotify_init fanotify_mark fchdir fchmod fchmodat fchown fchown32 fchownat fcntl fcntl64 fdatasync fgetxattr finit_module flistxattr flock fork fremovexattr fsconfig fsetxattr fsmount fsopen fspick fstat fstat64 fstatat64 fstatfs fstatfs64 fsync ftime ftruncate ftruncate64 futex futex_time64 futimesat getcpu getcwd getdents getdents64 getegid getegid32 geteuid geteuid32 getgid getgid32 getgroups getgroups32 getitimer get_kernel_syms get_mempolicy getpeername getpgid getpgrp getpid getpmsg getppid getpriority getrandom getresgid getresgid32 getresuid getresuid32 getrlimit get_robust_list getrusage getsid getsockname getsockopt get_thread_area gettid gettimeofday getuid getuid32 getxattr gtty idle init_module inotify_add_watch inotify_init inotify_init1 inotify_rm_watch io_cancel ioctl io_destroy io_getevents ioperm io_pgetevents io_pgetevents_time64 iopl ioprio_get ioprio_set io_setup io_submit io_uring_enter io_uring_register io_uring_setup ipc kcmp kexec_file_load kexec_load keyctl kill lchown lchown32 lgetxattr link linkat listen listxattr llistxattr lock lookup_dcookie lremovexattr lseek lsetxattr lstat lstat64 madvise mbind membarrier memfd_create migrate_pages mincore mkdir mkdirat mknod mknodat mlock mlock2 mlockall mmap mmap2 modify_ldt mount move_mount move_pages mprotect mpx mq_getsetattr mq_notify mq_open mq_timedreceive mq_timedreceive_time64 mq_timedsend mq_timedsend_time64 mq_unlink mremap msgctl msgget msgrcv msgsnd msync munlock munlockall munmap name_to_handle_at nanosleep newfstatat nfsservctl nice oldfstat oldlstat oldolduname oldstat olduname open openat open_by_handle_at open_tree pause pciconfig_iobase pciconfig_read pciconfig_write perf_event_open personality pidfd_open pidfd_send_signal pipe pipe2 pivot_root pkey_alloc pkey_free pkey_mprotect poll ppoll ppoll_time64 prctl pread64 preadv preadv2 prlimit64 process_vm_readv process_vm_writev prof profil pselect6 pselect6_time64 ptrace putpmsg pwrite64 pwritev pwritev2 query_module quotactl read readahead readdir readlink readlinkat readv reboot recv recvfrom recvmmsg recvmmsg_time64 recvmsg remap_file_pages removexattr rename renameat renameat2 request_key restart_syscall rmdir rseq rt_sigaction rt_sigpending rt_sigprocmask rt_sigqueueinfo rt_sigreturn rt_sigsuspend rt_sigtimedwait rt_sigtimedwait_time64 rt_tgsigqueueinfo sched_getaffinity sched_getattr sched_getparam sched_get_priority_max sched_get_priority_min sched_getscheduler sched_rr_get_interval sched_rr_get_interval_time64 sched_setaffinity sched_setattr sched_setparam sched_setscheduler sched_yield seccomp security select semctl semget semop semtimedop semtimedop_time64 send sendfile sendfile64 sendmmsg sendmsg sendto setdomainname setfsgid setfsgid32 setfsuid setfsuid32 setgid setgid32 setgroups setgroups32 sethostname setitimer set_mempolicy setns setpgid setpriority setregid setregid32 setresgid setresgid32 setresuid setresuid32 setreuid setreuid32 setrlimit set_robust_list setsid setsockopt set_thread_area set_tid_address settimeofday setuid setuid32 setxattr sgetmask shmat shmctl shmdt shmget shutdown sigaction sigaltstack signal signalfd signalfd4 sigpending sigprocmask sigreturn sigsuspend socket socketcall socketpair splice ssetmask stat stat64 statfs statfs64 statx stime stty swapoff swapon symlink symlinkat sync sync_file_range sync_file_range2 syncfs syscall sysfs sysinfo syslog tee tgkill time timer_create timer_delete timerfd_create timerfd_gettime timerfd_gettime64 timerfd_settime timerfd_settime64 timer_getoverrun timer_gettime timer_gettime64 timer_settime timer_settime64 times tkill truncate truncate64 tuxcall ugetrlimit ulimit umask umount umount2 uname unlink unlinkat unshare uselib userfaultfd ustat utime utimensat utimensat_time64 utimes vfork vhangup vm86 vm86old vmsplice vserver wait4 waitid waitpid write writev nextgroup=fjSyscallErrno contained
2828 " Syscall groups grabbed from: src/fseccomp/syscall.c
29 " Generate list with: rg -o '"@([^",]+)' -r '$1' src/lib/syscall.c | sort -u | tr $'\n' '|'
29 " Generate list with: sed -En 's/.*"@([^",]+).*/\1/p' src/lib/syscall.c | sort -u | tr '\n' '|'
3030 syn match fjSyscall /\v\@(aio|basic-io|chown|clock|cpu-emulation|debug|default|default-keep|default-nodebuggers|file-system|io-event|ipc|keyring|memlock|module|mount|network-io|obsolete|privileged|process|raw-io|reboot|resources|setuid|signal|swap|sync|system-service|timer)>/ nextgroup=fjSyscallErrno contained
3131 syn match fjSyscall /\$[0-9]\+/ nextgroup=fjSyscallErrno contained
3232 " Errnos grabbed from: src/fseccomp/errno.c
33 " Generate list with: rg -o '"(E[^"]+)' -r '$1' src/lib/errno.c | sort -u | tr $'\n' '|'
33 " Generate list with: sed -En 's/.*"(E[^"]+).*/\1/p' src/lib/errno.c | sort -u | tr '\n' '|'
3434 syn match fjSyscallErrno /\v(:(E2BIG|EACCES|EADDRINUSE|EADDRNOTAVAIL|EADV|EAFNOSUPPORT|EAGAIN|EALREADY|EBADE|EBADF|EBADFD|EBADMSG|EBADR|EBADRQC|EBADSLT|EBFONT|EBUSY|ECANCELED|ECHILD|ECHRNG|ECOMM|ECONNABORTED|ECONNREFUSED|ECONNRESET|EDEADLK|EDEADLOCK|EDESTADDRREQ|EDOM|EDOTDOT|EDQUOT|EEXIST|EFAULT|EFBIG|EHOSTDOWN|EHOSTUNREACH|EHWPOISON|EIDRM|EILSEQ|EINPROGRESS|EINTR|EINVAL|EIO|EISCONN|EISDIR|EISNAM|EKEYEXPIRED|EKEYREJECTED|EKEYREVOKED|EL2HLT|EL2NSYNC|EL3HLT|EL3RST|ELIBACC|ELIBBAD|ELIBEXEC|ELIBMAX|ELIBSCN|ELNRNG|ELOOP|EMEDIUMTYPE|EMFILE|EMLINK|EMSGSIZE|EMULTIHOP|ENAMETOOLONG|ENAVAIL|ENETDOWN|ENETRESET|ENETUNREACH|ENFILE|ENOANO|ENOATTR|ENOBUFS|ENOCSI|ENODATA|ENODEV|ENOENT|ENOEXEC|ENOKEY|ENOLCK|ENOLINK|ENOMEDIUM|ENOMEM|ENOMSG|ENONET|ENOPKG|ENOPROTOOPT|ENOSPC|ENOSR|ENOSTR|ENOSYS|ENOTBLK|ENOTCONN|ENOTDIR|ENOTEMPTY|ENOTNAM|ENOTRECOVERABLE|ENOTSOCK|ENOTSUP|ENOTTY|ENOTUNIQ|ENXIO|EOPNOTSUPP|EOVERFLOW|EOWNERDEAD|EPERM|EPFNOSUPPORT|EPIPE|EPROTO|EPROTONOSUPPORT|EPROTOTYPE|ERANGE|EREMCHG|EREMOTE|EREMOTEIO|ERESTART|ERFKILL|EROFS|ESHUTDOWN|ESOCKTNOSUPPORT|ESPIPE|ESRCH|ESRMNT|ESTALE|ESTRPIPE|ETIME|ETIMEDOUT|ETOOMANYREFS|ETXTBSY|EUCLEAN|EUNATCH|EUSERS|EWOULDBLOCK|EXDEV|EXFULL)>)?/ nextgroup=fjSyscallList contained
3535 syn match fjSyscallList /,/ nextgroup=fjSyscall contained
3636
4646 syn keyword fjFilter filter contained
4747
4848 " Variable names grabbed from: src/firejail/macros.c
49 " Generate list with: rg -o '\$\{([^}]+)\}' -r '$1' src/firejail/macros.c | sort -u | tr $'\n' '|'
49 " Generate list with: sed -En 's/.*\$\{([^}]+)\}.*/\1/p' src/firejail/macros.c | sort -u | tr '\n' '|'
5050 syn match fjVar /\v\$\{(CFG|DESKTOP|DOCUMENTS|DOWNLOADS|HOME|MUSIC|PATH|PICTURES|RUNUSER|VIDEOS)}/
5151
5252 " Commands grabbed from: src/firejail/profile.c
53 " Generate list with: { rg -o 'strn?cmp\(ptr, "([^"]+) "' -r '$1' src/firejail/profile.c; echo private-lib; } | grep -vEx '(include|ignore|caps\.drop|caps\.keep|protocol|restrict-namespaces|seccomp|seccomp\.drop|seccomp\.keep|env|rmenv|net|ip)' | sort -u | tr $'\n' '|' # private-lib is special-cased in the code and doesn't match the regex; grep-ed patterns are handled later with 'syn match nextgroup=' directives (except for include which is special-cased as a fjCommandNoCond keyword)
53 " Generate list with: { sed -En 's/.*strn?cmp\(ptr, "([^"]+) ".*/\1/p' src/firejail/profile.c; echo private-lib; } | grep -Ev '^(include|ignore|caps\.drop|caps\.keep|protocol|restrict-namespaces|seccomp|seccomp\.drop|seccomp\.keep|env|rmenv|net|ip)$' | sort -u | tr '\n' '|' # private-lib is special-cased in the code and doesn't match the regex; grep-ed patterns are handled later with 'syn match nextgroup=' directives (except for include which is special-cased as a fjCommandNoCond keyword)
5454 syn match fjCommand /\v(apparmor|bind|blacklist|blacklist-nolog|cpu|defaultgw|dns|hostname|hosts-file|ip6|iprange|join-or-start|mac|mkdir|mkfile|mtu|name|netfilter|netfilter6|netmask|nice|noblacklist|noexec|nowhitelist|overlay-named|private|private-bin|private-cwd|private-etc|private-home|private-lib|private-opt|private-srv|read-only|read-write|rlimit-as|rlimit-cpu|rlimit-fsize|rlimit-nofile|rlimit-nproc|rlimit-sigpending|timeout|tmpfs|veth-name|whitelist|xephyr-screen) / skipwhite contained
55 " Generate list with: rg -o 'strn?cmp\(ptr, "([^ "]*[^ ])"' -r '$1' src/firejail/profile.c | grep -vEx '(include|rlimit|quiet)' | sed -e 's/\./\\./' | sort -u | tr $'\n' '|' # include/rlimit are false positives, quiet is special-cased below
55 " Generate list with: sed -En 's/.*strn?cmp\(ptr, "([^ "]*[^ ])".*/\1/p' src/firejail/profile.c | grep -Ev '^(include|rlimit|quiet)$' | sed 's/\./\\./' | sort -u | tr '\n' '|' # include/rlimit are false positives, quiet is special-cased below
5656 syn match fjCommand /\v(allow-debuggers|allusers|apparmor|caps|deterministic-exit-code|deterministic-shutdown|disable-mnt|ipc-namespace|keep-config-pulse|keep-dev-shm|keep-fd|keep-var-tmp|machine-id|memory-deny-write-execute|netfilter|no3d|noautopulse|nodbus|nodvd|nogroups|noinput|nonewprivs|noprinters|noroot|nosound|notv|nou2f|novideo|overlay|overlay-tmpfs|private|private-cache|private-cwd|private-dev|private-lib|private-tmp|seccomp|seccomp\.32|seccomp\.block-secondary|tracelog|writable-etc|writable-run-user|writable-var|writable-var-log|x11)$/ contained
5757 syn match fjCommand /ignore / nextgroup=fjCommand,fjCommandNoCond skipwhite contained
5858 syn match fjCommand /caps\.drop / nextgroup=fjCapability,fjAll skipwhite contained
7474 syn match fjCommandNoCond /quiet$/ contained
7575
7676 " Conditionals grabbed from: src/firejail/profile.c
77 " Generate list with: awk -- 'BEGIN {process=0;} /^Cond conditionals\[\] = \{$/ {process=1;} /\t*\{"[^"]+".*/ { if (process) {print gensub(/^\t*\{"([^"]+)".*$/, "\\1", 1);} } /^\t\{ NULL, NULL \}$/ {process=0;}' src/firejail/profile.c | sort -u | tr $'\n' '|'
77 " Generate list with: awk -- 'BEGIN {process=0;} /^Cond conditionals\[\] = \{$/ {process=1;} /\t*\{"[^"]+".*/ { if (process) {print gensub(/^\t*\{"([^"]+)".*$/, "\\1", 1);} } /^\t\{ NULL, NULL \}$/ {process=0;}' src/firejail/profile.c | sort -u | tr '\n' '|'
7878 syn match fjConditional /\v\?(ALLOW_TRAY|BROWSER_ALLOW_DRM|BROWSER_DISABLE_U2F|HAS_APPIMAGE|HAS_NET|HAS_NODBUS|HAS_NOSOUND|HAS_X11) ?:/ nextgroup=fjCommand skipwhite contained
7979
8080 " A line is either a command, a conditional or a comment
+4
-0
etc/firejail.config less more
7676
7777 # Enable or disable overlayfs features, default enabled.
7878 # overlayfs yes
79
80 # Hide blacklisted files in /etc directory (enabling this may break
81 # /etc/resolv.conf; see #5010), default disabled.
82 # etc-hide-blacklisted no
7983
8084 # Set the limit for file copy in several --private-* options. The size is set
8185 # in megabytes. By default we allow up to 500MB.
+2
-1
etc/inc/disable-common.inc less more
557557 # disable terminals running as server resulting in sandbox escape
558558 blacklist ${PATH}/gnome-terminal
559559 blacklist ${PATH}/gnome-terminal.wrapper
560 blacklist ${PATH}/kgx
560561 # blacklist ${PATH}/konsole
561562 # konsole doesn't seem to have this problem - last tested on Ubuntu 16.04
562563 blacklist ${PATH}/lilyterm
618619 blacklist ${HOME}/postponed
619620 blacklist ${HOME}/sent
620621
621 # kernel configuration
622 # kernel configuration - keep this here although it's also in disable-proc.inc
622623 blacklist /proc/config.gz
623624
624625 # prevent DNS malware attempting to communicate with the server using regular DNS tools
+1
-1
etc/inc/disable-proc.inc less more
77 blacklist /proc/buddyinfo
88 blacklist /proc/cgroups
99 blacklist /proc/cmdline
10 blacklist /proc/config.gz
10 blacklist /proc/config.gz # keep this here even though it's also in disable-common.inc
1111 blacklist /proc/consoles
1212 #blacklist /proc/cpuinfo
1313 blacklist /proc/crypto
+11
-0
etc/inc/disable-programs.inc less more
8484 blacklist ${HOME}/.cache/akonadi*
8585 blacklist ${HOME}/.cache/atril
8686 blacklist ${HOME}/.cache/attic
87 blacklist ${HOME}/.cache/audacity
8788 blacklist ${HOME}/.cache/babl
8889 blacklist ${HOME}/.cache/bnox
8990 blacklist ${HOME}/.cache/borg
114115 blacklist ${HOME}/.cache/fractal
115116 blacklist ${HOME}/.cache/freecol
116117 blacklist ${HOME}/.cache/gajim
118 blacklist ${HOME}/.cache/gdfuse
117119 blacklist ${HOME}/.cache/geary
118120 blacklist ${HOME}/.cache/geeqie
119121 blacklist ${HOME}/.cache/gegl-0.4
317319 blacklist ${HOME}/.config/Pinta
318320 blacklist ${HOME}/.config/QGIS
319321 blacklist ${HOME}/.config/QMediathekView
322 blacklist ${HOME}/.config/QQ
320323 blacklist ${HOME}/.config/Qlipper
321324 blacklist ${HOME}/.config/QuiteRss
322325 blacklist ${HOME}/.config/QuiteRssrc
358361 blacklist ${HOME}/.config/asunder
359362 blacklist ${HOME}/.config/atril
360363 blacklist ${HOME}/.config/audacious
364 blacklist ${HOME}/.config/audacity
361365 blacklist ${HOME}/.config/autokey
362366 blacklist ${HOME}/.config/avidemux3_qt5rc
363367 blacklist ${HOME}/.config/aweather
433437 blacklist ${HOME}/.config/galculator
434438 blacklist ${HOME}/.config/gallery-dl
435439 blacklist ${HOME}/.config/gconf
440 blacklist ${HOME}/.config/gdfuse
436441 blacklist ${HOME}/.config/geany
437442 blacklist ${HOME}/.config/geary
438443 blacklist ${HOME}/.config/gedit
705710 blacklist ${HOME}/.funnyboat
706711 blacklist ${HOME}/.g8
707712 blacklist ${HOME}/.gallery-dl.conf
713 blacklist ${HOME}/.gdfuse
708714 blacklist ${HOME}/.geekbench5
709715 blacklist ${HOME}/.gimp*
710716 blacklist ${HOME}/.gist
860866 blacklist ${HOME}/.local/share/akregator
861867 blacklist ${HOME}/.local/share/apps/korganizer
862868 blacklist ${HOME}/.local/share/aspyr-media
869 blacklist ${HOME}/.local/share/audacity
863870 blacklist ${HOME}/.local/share/authenticator-rs
864871 blacklist ${HOME}/.local/share/autokey
865872 blacklist ${HOME}/.local/share/backintime
872879 blacklist ${HOME}/.local/share/calligragemini
873880 blacklist ${HOME}/.local/share/cantata
874881 blacklist ${HOME}/.local/share/cdprojektred
882 blacklist ${HOME}/.local/share/chatterino
875883 blacklist ${HOME}/.local/share/clipit
876884 blacklist ${HOME}/.local/share/com.github.johnfactotum.Foliate
877885 blacklist ${HOME}/.local/share/contacts
893901 blacklist ${HOME}/.local/share/five-or-more
894902 blacklist ${HOME}/.local/share/freecol
895903 blacklist ${HOME}/.local/share/gajim
904 blacklist ${HOME}/.local/share/gdfuse
896905 blacklist ${HOME}/.local/share/geary
897906 blacklist ${HOME}/.local/share/geeqie
898907 blacklist ${HOME}/.local/share/ghostwriter
10141023 blacklist ${HOME}/.local/share/xplayer
10151024 blacklist ${HOME}/.local/share/xreader
10161025 blacklist ${HOME}/.local/share/zathura
1026 blacklist ${HOME}/.local/state/audacity
10171027 blacklist ${HOME}/.local/state/pipewire
10181028 blacklist ${HOME}/.lv2
10191029 blacklist ${HOME}/.lyx
11761186 blacklist ${RUNUSER}/*firefox*
11771187 blacklist ${RUNUSER}/akonadi
11781188 blacklist ${RUNUSER}/psd/*firefox*
1189 blacklist /etc/ssmtp
11791190 blacklist /tmp/.wine-*
11801191 blacklist /tmp/akonadi-*
11811192 blacklist /var/games/nethack
+1
-0
etc/inc/whitelist-run-common.inc less more
22 include whitelist-run-common.local
33
44 whitelist /run/NetworkManager/resolv.conf
5 whitelist /run/avahi-daemon/socket
56 whitelist /run/cups/cups.sock
67 whitelist /run/dbus/system_bus_socket
78 whitelist /run/media
+2
-0
etc/profile-a-l/0ad.profile less more
5353
5454 dbus-user none
5555 dbus-system none
56
57 restrict-namespaces
+2
-0
etc/profile-a-l/2048-qt.profile less more
3939 disable-mnt
4040 private-dev
4141 private-tmp
42
43 restrict-namespaces
+2
-0
etc/profile-a-l/Cryptocat.profile less more
2727 private-cache
2828 private-dev
2929 private-tmp
30
31 restrict-namespaces
+1
-0
etc/profile-a-l/Fritzing.profile less more
3535 private-dev
3636 private-tmp
3737
38 restrict-namespaces
+2
-0
etc/profile-a-l/JDownloader.profile less more
4444
4545 dbus-user none
4646 dbus-system none
47
48 restrict-namespaces
+2
-0
etc/profile-a-l/abiword.profile less more
4545
4646 # dbus-user none
4747 # dbus-system none
48
49 restrict-namespaces
+1
-0
etc/profile-a-l/agetpkg.profile less more
5555 dbus-system none
5656
5757 memory-deny-write-execute
58 restrict-namespaces
+1
-0
etc/profile-a-l/akonadi_control.profile less more
5454 private-dev
5555 # private-tmp - breaks programs that depend on akonadi
5656
57 # restrict-namespaces
+1
-0
etc/profile-a-l/akregator.profile less more
4848 private-tmp
4949
5050 deterministic-shutdown
51 # restrict-namespaces
+1
-0
etc/profile-a-l/alacarte.profile less more
6161 read-write ${HOME}/.gnome/apps
6262 read-write ${HOME}/.local/share/applications
6363 read-write ${HOME}/.local/share/flatpak/exports
64 restrict-namespaces
+2
-0
etc/profile-a-l/alienarena.profile less more
4747
4848 dbus-user none
4949 dbus-system none
50
51 restrict-namespaces
+1
-0
etc/profile-a-l/alpine.profile less more
9999
100100 memory-deny-write-execute
101101 read-only ${HOME}/.signature
102 restrict-namespaces
+2
-0
etc/profile-a-l/amarok.profile less more
4343 #dbus-user.own org.kde.klauncher
4444 #dbus-user.talk org.kde.knotify
4545 dbus-system none
46
47 # restrict-namespaces
+1
-0
etc/profile-a-l/amule.profile less more
3939 private-dev
4040 private-tmp
4141
42 restrict-namespaces
+1
-0
etc/profile-a-l/android-studio.profile less more
3939
4040 # noexec /tmp breaks 'Android Profiler'
4141 #noexec /tmp
42 restrict-namespaces
+2
-0
etc/profile-a-l/anki.profile less more
5353
5454 dbus-user none
5555 dbus-system none
56
57 # restrict-namespaces
+2
-0
etc/profile-a-l/anydesk.profile less more
3232 private-bin anydesk
3333 private-dev
3434 private-tmp
35
36 restrict-namespaces
+2
-0
etc/profile-a-l/aosp.profile less more
3939 #seccomp
4040
4141 private-tmp
42
43 #restrict-namespaces
+2
-0
etc/profile-a-l/apktool.profile less more
3434
3535 dbus-user none
3636 dbus-system none
37
38 restrict-namespaces
+2
-0
etc/profile-a-l/apostrophe.profile less more
6868 dbus-user.own org.gnome.gitlab.somas.Apostrophe
6969 dbus-user.talk ca.desrt.dconf
7070 dbus-system none
71
72 restrict-namespaces
+1
-0
etc/profile-a-l/arch-audit.profile less more
4848 dbus-system none
4949
5050 memory-deny-write-execute
51 restrict-namespaces
+1
-0
etc/profile-a-l/archaudit-report.profile less more
3535 private-tmp
3636
3737 memory-deny-write-execute
38 restrict-namespaces
+1
-0
etc/profile-a-l/archiver-common.profile less more
4848 dbus-system none
4949
5050 memory-deny-write-execute
51 restrict-namespaces
+2
-0
etc/profile-a-l/ardour5.profile less more
3939
4040 dbus-user none
4141 dbus-system none
42
43 restrict-namespaces
+1
-0
etc/profile-a-l/arduino.profile less more
3232 private-cache
3333 private-tmp
3434
35 restrict-namespaces
+1
-0
etc/profile-a-l/aria2c.profile less more
5252 dbus-system none
5353
5454 memory-deny-write-execute
55 restrict-namespaces
+2
-0
etc/profile-a-l/ark.profile less more
4343
4444 # dbus-user none
4545 # dbus-system none
46
47 restrict-namespaces
+1
-0
etc/profile-a-l/arm.profile less more
4444 private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,passwd,pki,ssl,tor
4545 private-tmp
4646
47 restrict-namespaces
+1
-0
etc/profile-a-l/artha.profile less more
6464 dbus-system none
6565
6666 memory-deny-write-execute
67 restrict-namespaces
+1
-0
etc/profile-a-l/assogiate.profile less more
5050
5151 memory-deny-write-execute
5252 read-write ${HOME}/.local/share/mime
53 restrict-namespaces
+1
-0
etc/profile-a-l/asunder.profile less more
4444
4545 # mdwe is disabled due to breaking hardware accelerated decoding
4646 # memory-deny-write-execute
47 restrict-namespaces
+1
-0
etc/profile-a-l/atril.profile less more
4848
4949 # webkit gtk killed by memory-deny-write-execute
5050 #memory-deny-write-execute
51 restrict-namespaces
+2
-0
etc/profile-a-l/audacious.profile less more
4141 # dbus needed for MPRIS
4242 # dbus-user none
4343 # dbus-system none
44
45 restrict-namespaces
+13
-0
etc/profile-a-l/audacity.profile less more
55 # Persistent global definitions
66 include globals.local
77
8 # Add the below lines to your audacity.local if you need online plugins.
9 #ignore net none
10 #netfilter
11 #protocol inet6
12
813 noblacklist ${HOME}/.audacity-data
14 noblacklist ${HOME}/.cache/audacity
15 noblacklist ${HOME}/.config/audacity
16 noblacklist ${HOME}/.local/share/audacity
17 noblacklist ${HOME}/.local/state/audacity
918 noblacklist ${DOCUMENTS}
1019 noblacklist ${MUSIC}
1120
1928
2029 include whitelist-var-common.inc
2130
31 # Silence blacklist violation. See #5539.
32 allow-debuggers
2233 ## Enabling App Armor appears to break some Fedora / Arch installs
2334 #apparmor
2435 caps.drop all
4354 # problems on Fedora 27
4455 # dbus-user none
4556 # dbus-system none
57
58 restrict-namespaces
+1
-0
etc/profile-a-l/audio-recorder.profile less more
5050 dbus-system none
5151
5252 # memory-deny-write-execute - breaks on Arch
53 restrict-namespaces
+2
-0
etc/profile-a-l/authenticator-rs.profile less more
5151 dbus-user filter
5252 dbus-user.talk ca.desrt.dconf
5353 dbus-system none
54
55 restrict-namespaces
+1
-0
etc/profile-a-l/authenticator.profile less more
4545 # dbus-system none
4646
4747 #memory-deny-write-execute - breaks on Arch (see issue #1803)
48 restrict-namespaces
+1
-0
etc/profile-a-l/autokey-common.profile less more
3838 private-tmp
3939
4040 #memory-deny-write-execute - breaks on Arch (see issue #1803)
41 restrict-namespaces
+2
-0
etc/profile-a-l/avidemux.profile less more
5454
5555 dbus-user none
5656 dbus-system none
57
58 restrict-namespaces
+2
-0
etc/profile-a-l/aweather.profile less more
3636 private-bin aweather
3737 private-dev
3838 private-tmp
39
40 restrict-namespaces
+2
-1
etc/profile-a-l/awesome.profile less more
1313 netfilter
1414 noroot
1515 protocol unix,inet,inet6
16 seccomp
16 seccomp !chroot
1717
1818 read-only ${HOME}/.config/awesome/autorun.sh
19 #restrict-namespaces
+2
-0
etc/profile-a-l/ballbuster.profile less more
4848
4949 dbus-user none
5050 dbus-system none
51
52 restrict-namespaces
+2
-0
etc/profile-a-l/baloo_file.profile less more
5151 private-cache
5252 private-dev
5353 private-tmp
54
55 restrict-namespaces
+5
-60
etc/profile-a-l/balsa.profile less more
66 include globals.local
77
88 noblacklist ${HOME}/.balsa
9 noblacklist ${HOME}/.gnupg
10 noblacklist ${HOME}/.mozilla
11 noblacklist ${HOME}/.signature
129 noblacklist ${HOME}/mail
13 noblacklist /var/mail
14 noblacklist /var/spool/mail
1510
16 include disable-common.inc
17 include disable-devel.inc
18 include disable-exec.inc
19 include disable-interpreters.inc
20 include disable-programs.inc
2111 include disable-shell.inc
22 include disable-xdg.inc
2312
2413 mkdir ${HOME}/.balsa
25 mkdir ${HOME}/.gnupg
26 mkfile ${HOME}/.signature
2714 mkdir ${HOME}/mail
2815 whitelist ${HOME}/.balsa
29 whitelist ${HOME}/.gnupg
30 whitelist ${HOME}/.mozilla/firefox/profiles.ini
31 whitelist ${HOME}/.signature
3216 whitelist ${HOME}/mail
33 whitelist ${RUNUSER}/gnupg
3417 whitelist /usr/share/balsa
35 whitelist /usr/share/gnupg
36 whitelist /usr/share/gnupg2
37 whitelist /var/mail
38 whitelist /var/spool/mail
39 include whitelist-common.inc
40 include whitelist-runuser-common.inc
41 include whitelist-usr-share-common.inc
42 include whitelist-var-common.inc
4318
44 apparmor
45 caps.drop all
46 netfilter
47 no3d
48 nodvd
49 nogroups
50 noinput
51 nonewprivs
52 noroot
53 nosound
54 notv
55 nou2f
56 novideo
57 protocol unix,inet,inet6
58 seccomp
59 tracelog
19 # Add "pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg.
20 #private-bin balsa,balsa-ab,gpg,gpg-agent,gpg2,gpgsm
6021
61 # disable-mnt
62 # Add "pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg
63 # Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile.
64 private-bin balsa,balsa-ab,gpg,gpg-agent,gpg2,gpgsm
65 private-cache
66 private-dev
67 private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,mailname,passwd,pki,resolv.conf,selinux,ssl,xdg
68 private-tmp
69 writable-run-user
70 writable-var
22 dbus-user.own org.desktop.Balsa
7123
72 dbus-user filter
73 dbus-user.own org.desktop.Balsa
74 dbus-user.talk ca.desrt.dconf
75 dbus-user.talk org.freedesktop.Notifications
76 dbus-user.talk org.freedesktop.secrets
77 dbus-user.talk org.gnome.keyring.SystemPrompter
78 dbus-system none
79
80 read-only ${HOME}/.mozilla/firefox/profiles.ini
24 # Redirect
25 include email-common.profile
+1
-0
etc/profile-a-l/baobab.profile less more
4040 # dbus-system none
4141
4242 read-only ${HOME}
43 restrict-namespaces
+1
-0
etc/profile-a-l/barrier.profile less more
4141 private-tmp
4242
4343 memory-deny-write-execute
44 restrict-namespaces
+3
-0
etc/profile-a-l/basilisk.profile less more
2121 #private-etc basilisk
2222 #private-opt basilisk
2323
24 restrict-namespaces
25 ignore restrict-namespaces
26
2427 # Redirect
2528 include firefox-common.profile
+2
-0
etc/profile-a-l/bcompare.profile less more
4343
4444 dbus-user none
4545 dbus-system none
46
47 restrict-namespaces
+2
-0
etc/profile-a-l/bibletime.profile less more
5555
5656 dbus-user none
5757 dbus-system none
58
59 # restrict-namespaces
+1
-0
etc/profile-a-l/bijiben.profile less more
5959 dbus-system none
6060
6161 env WEBKIT_FORCE_SANDBOX=0
62 restrict-namespaces
+1
-0
etc/profile-a-l/bitcoin-qt.profile less more
4646 private-tmp
4747
4848 memory-deny-write-execute
49 restrict-namespaces
+1
-0
etc/profile-a-l/bitlbee.profile less more
3737 private-tmp
3838
3939 read-write /var/lib/bitlbee
40 restrict-namespaces
+2
-1
etc/profile-a-l/blackbox.profile less more
1313 netfilter
1414 noroot
1515 protocol unix,inet,inet6
16 seccomp
16 seccomp !chroot
1717
18 #restrict-namespaces
+1
-0
etc/profile-a-l/bleachbit.profile less more
3939
4040 # memory-deny-write-execute breaks some systems, see issue #1850
4141 # memory-deny-write-execute
42 restrict-namespaces
+2
-0
etc/profile-a-l/blender.profile less more
3636 seccomp !mbind
3737
3838 private-dev
39
40 restrict-namespaces
+2
-0
etc/profile-a-l/bless.profile less more
3838
3939 dbus-user none
4040 dbus-system none
41
42 restrict-namespaces
+1
-0
etc/profile-a-l/blobby.profile less more
4747 dbus-system none
4848
4949 memory-deny-write-execute
50 restrict-namespaces
+2
-0
etc/profile-a-l/blobwars.profile less more
4646
4747 dbus-user none
4848 dbus-system none
49
50 restrict-namespaces
+2
-0
etc/profile-a-l/bluefish.profile less more
3636
3737 dbus-user none
3838 dbus-system none
39
40 restrict-namespaces
+2
-0
etc/profile-a-l/brackets.profile less more
3030
3131 private-cache
3232 private-dev
33
34 # restrict-namespaces
+2
-0
etc/profile-a-l/brasero.profile less more
3232 private-cache
3333 # private-dev
3434 # private-tmp
35
36 restrict-namespaces
+2
-0
etc/profile-a-l/build-systems-common.profile less more
6262
6363 dbus-user none
6464 dbus-system none
65
66 restrict-namespaces
+2
-0
etc/profile-a-l/bzflag.profile less more
4343
4444 dbus-user none
4545 dbus-system none
46
47 restrict-namespaces
+2
-0
etc/profile-a-l/calibre.profile less more
3434
3535 private-dev
3636 private-tmp
37
38 # restrict-namespaces
+1
-0
etc/profile-a-l/calligra.profile less more
3636
3737 # noexec ${HOME}
3838 noexec /tmp
39 restrict-namespaces
+1
-0
etc/profile-a-l/cameramonitor.profile less more
5151 # dbus-system none
5252
5353 # memory-deny-write-execute - breaks on Arch
54 restrict-namespaces
+2
-0
etc/profile-a-l/cantata.profile less more
3636 # private-etc alternatives,drirc,fonts,gcrypt,hosts,kde5rc,mpd.conf,passwd,samba,ssl,xdg
3737 private-bin cantata,mpd,perl
3838 private-dev
39
40 restrict-namespaces
+2
-0
etc/profile-a-l/catfish.profile less more
4545
4646 dbus-user none
4747 dbus-system none
48
49 restrict-namespaces
+2
-0
etc/profile-a-l/cawbird.profile less more
4242
4343 # dbus-user none
4444 dbus-system none
45
46 restrict-namespaces
+1
-0
etc/profile-a-l/celluloid.profile less more
6363
6464 read-only ${HOME}
6565 read-write ${HOME}/.config/celluloid
66 restrict-namespaces
+1
-0
etc/profile-a-l/chafa.profile less more
5252 dbus-system none
5353
5454 read-only ${HOME}
55 restrict-namespaces
+92
-0
etc/profile-a-l/chatterino.profile less more
0 # Firejail profile for Chatterino
1 # Description: Chat client for https://twitch.tv
2 # This file is overwritten after every install/update
3 # Persistent local customizations
4 include chatterino.local
5 # Persistent global definitions
6 include globals.local
7
8 # To upload images, whitelist/noblacklist their path in chatterino.local.
9 #whitelist ${PICTURES}
10 # For custom notification sounds, whitelist/noblacklist their path in chatterino.local.
11 #whitelist ${MUSIC}
12
13 # Also allow access to mpv/vlc, they're usable via streamlink.
14 noblacklist ${HOME}/.config/mpv
15 noblacklist ${HOME}/.config/pulse
16 noblacklist ${HOME}/.config/vlc
17 noblacklist ${HOME}/.local/share/chatterino
18 noblacklist ${HOME}/.local/share/vlc
19
20 # Allow Lua for mpv (blacklisted by disable-interpreters.inc)
21 include allow-lua.inc
22
23 # Allow Python for Streamlink integration (blacklisted by disable-interpreters.inc)
24 include allow-python3.inc
25
26 include disable-common.inc
27 include disable-devel.inc
28 include disable-exec.inc
29 include disable-interpreters.inc
30 include disable-proc.inc
31 include disable-programs.inc
32 include disable-xdg.inc
33
34 # Also allow read-only access to mpv/VLC, they're usable via streamlink.
35 mkdir ${HOME}/.local/share/chatterino
36 # VLC preferences will fail to save with read-only set.
37 whitelist ${HOME}/.local/share/chatterino
38 whitelist-ro ${HOME}/.config/mpv
39 whitelist-ro ${HOME}/.config/pulse
40 whitelist-ro ${HOME}/.config/vlc
41 whitelist-ro ${HOME}/.local/share/vlc
42 include whitelist-common.inc
43 include whitelist-run-common.inc
44 include whitelist-runuser-common.inc
45 include whitelist-usr-share-common.inc
46 include whitelist-var-common.inc
47
48 # Streamlink+VLC doesn't seem to close properly with apparmor enabled.
49 #apparmor
50 caps.drop all
51 netfilter
52 nodvd
53 nogroups
54 nonewprivs
55 noprinters
56 noroot
57 notv
58 nou2f
59 # Netlink is required for streamlink integration.
60 protocol unix,inet,inet6,netlink
61 # Seccomp may break browser integration.
62 seccomp
63 seccomp.block-secondary
64 tracelog
65
66 disable-mnt
67 # Add more private-bin lines for browsers or video players to chatterino.local if wanted.
68 private-bin chatterino,cvlc,env,ffmpeg,mpv,nvlc,pgrep,python*,qvlc,rvlc,streamlink,svlc,vlc
69 # private-cache may cause issues with mpv (see #2838)
70 private-cache
71 private-dev
72 private-etc alsa,alternatives,asound.conf,ca-certificates,dbus-1,fonts,hostname,hosts,kde4rc,kde5rc,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,nvidia,passwd,pulse,resolv.conf,rpc,services,ssl,Trolltech.conf,X11
73 private-srv none
74 private-tmp
75
76 dbus-user filter
77 dbus-user.own com.chatterino.*
78 # Allow notifications.
79 dbus-user.talk org.freedesktop.Notifications
80 # For media player integration.
81 dbus-user.talk org.freedesktop.ScreenSaver
82 ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
83 dbus-user.own org.mpris.MediaPlayer2.chatterino
84 dbus-user.talk org.mpris.MediaPlayer2.Player
85 dbus-system none
86
87 # Prevents browsers/players from lingering after Chatterino is closed.
88 #deterministic-shutdown
89 # memory-deny-write-execute may break streamlink and browser integration.
90 #memory-deny-write-execute
91 restrict-namespaces
+1
-0
etc/profile-a-l/checkbashisms.profile less more
5151 dbus-system none
5252
5353 memory-deny-write-execute
54 restrict-namespaces
+2
-0
etc/profile-a-l/cheese.profile less more
5757 dbus-user.own org.gnome.Cheese
5858 dbus-user.talk ca.desrt.dconf
5959 dbus-system none
60
61 restrict-namespaces
+1
-0
etc/profile-a-l/cherrytree.profile less more
3939 private-dev
4040 private-tmp
4141
42 restrict-namespaces
+2
-0
etc/profile-a-l/chromium-common-hardened.inc.profile less more
66 noroot
77 protocol unix,inet,inet6,netlink
88 seccomp !chroot
9
10 #restrict-namespaces
+2
-0
etc/profile-a-l/cin.profile less more
3333
3434 dbus-user none
3535 dbus-system none
36
37 restrict-namespaces
+0
-10
etc/profile-a-l/cinelerra-gg less more
0 # Firejail profile alias for cin
1 # This file is overwritten after every install/update
2 # Persistent local customizations
3 include cinelerra-gg.local
4 # Persistent global definitions
5 # added by included profile
6 #include globals.local
7
8 # Redirect
9 include cin.profile
+10
-0
etc/profile-a-l/cinelerra-gg.profile less more
0 # Firejail profile alias for cin
1 # This file is overwritten after every install/update
2 # Persistent local customizations
3 include cinelerra-gg.local
4 # Persistent global definitions
5 # added by included profile
6 #include globals.local
7
8 # Redirect
9 include cin.profile
+1
-0
etc/profile-a-l/clamav.profile less more
3636 read-only ${HOME}
3737
3838 memory-deny-write-execute
39 restrict-namespaces
+2
-0
etc/profile-a-l/clamtk.profile less more
2626
2727 dbus-user none
2828 dbus-system none
29
30 restrict-namespaces
+1
-7
etc/profile-a-l/claws-mail.profile less more
00 # Firejail profile for claws-mail
1 # Description: Fast, lightweight and user-friendly GTK+2 based email client
1 # Description: Fast, lightweight and user-friendly GTK based email client
22 # This file is overwritten after every install/update
33 # Persistent local customizations
44 include claws-mail.local
1919
2020 # private-bin claws-mail,curl,gpg,gpg2,gpg-agent,gpgsm,gpgme-config,pinentry,pinentry-gtk-2
2121
22 dbus-user filter
23 dbus-user.talk ca.desrt.dconf
24 dbus-user.talk org.gnome.keyring.SystemPrompter
25 # Add the next line to your claws-mail.local if you use the notification plugin.
26 # dbus-user.talk org.freedesktop.Notifications
27
2822 # Redirect
2923 include email-common.profile
+1
-0
etc/profile-a-l/clawsker.profile less more
5050 dbus-system none
5151
5252 #memory-deny-write-execute - breaks on Arch (see issue #1803)
53 restrict-namespaces
+2
-0
etc/profile-a-l/clementine.profile less more
3737
3838 dbus-system none
3939 # dbus-user none
40
41 restrict-namespaces
+1
-0
etc/profile-a-l/clion.profile less more
3939 # private-tmp
4040
4141 noexec /tmp
42 restrict-namespaces
+2
-0
etc/profile-a-l/clipgrab.profile less more
4747 # 'dbus-user none' breaks tray menu - add 'dbus-user none' to your clipgrab.local if you don't need it.
4848 # dbus-user none
4949 # dbus-system none
50
51 # restrict-namespaces
+1
-1
etc/profile-a-l/clipit.profile less more
5858 dbus-system none
5959
6060 #memory-deny-write-execute
61 read-only ${HOME}
6162 restrict-namespaces
62 read-only ${HOME}
+2
-0
etc/profile-a-l/cmus.profile less more
2626
2727 private-bin cmus
2828 private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl
29
30 restrict-namespaces
+1
-0
etc/profile-a-l/cointop.profile less more
5959 dbus-system none
6060
6161 memory-deny-write-execute
62 restrict-namespaces
+2
-0
etc/profile-a-l/colorful.profile less more
4848
4949 dbus-user none
5050 dbus-system none
51
52 restrict-namespaces
+2
-0
etc/profile-a-l/com.github.bleakgrey.tootle.profile less more
5151 # dbus-user.own com.github.bleakgrey.tootle
5252 # dbus-user.talk ca.desrt.dconf
5353 dbus-system none
54
55 restrict-namespaces
+1
-0
etc/profile-a-l/com.github.dahenson.agenda.profile less more
6262 read-write ${HOME}/.cache/agenda
6363 read-write ${HOME}/.config/agenda
6464 read-write ${HOME}/.local/share/agenda
65 restrict-namespaces
+1
-0
etc/profile-a-l/com.github.johnfactotum.Foliate.profile less more
5959 read-only ${HOME}
6060 read-write ${HOME}/.cache/com.github.johnfactotum.Foliate
6161 read-write ${HOME}/.local/share/com.github.johnfactotum.Foliate
62 restrict-namespaces
+2
-0
etc/profile-a-l/com.github.phase1geo.minder.profile less more
5757 dbus-user.own com.github.phase1geo.minder
5858 dbus-user.talk ca.desrt.dconf
5959 dbus-system none
60
61 restrict-namespaces
+1
-0
etc/profile-a-l/com.github.tchx84.Flatseal.profile less more
6161 dbus-system none
6262
6363 read-write ${HOME}/.local/share/flatpak/overrides
64 restrict-namespaces
+2
-0
etc/profile-a-l/conkeror.profile less more
3333 seccomp
3434
3535 disable-mnt
36
37 restrict-namespaces
+1
-0
etc/profile-a-l/conky.profile less more
4242 private-tmp
4343
4444 memory-deny-write-execute
45 restrict-namespaces
+1
-0
etc/profile-a-l/corebird.profile less more
3434 private-dev
3535 private-tmp
3636
37 restrict-namespaces
+1
-0
etc/profile-a-l/cower.profile less more
4545
4646 memory-deny-write-execute
4747 read-only ${HOME}/.config/cower/config
48 restrict-namespaces
+1
-0
etc/profile-a-l/coyim.profile less more
4545 dbus-system none
4646
4747 #memory-deny-write-execute
48 restrict-namespaces
+2
-0
etc/profile-a-l/crawl.profile less more
4343
4444 dbus-user none
4545 dbus-system none
46
47 restrict-namespaces
+1
-0
etc/profile-a-l/crow.profile less more
4242 private-tmp
4343 private-srv none
4444
45 restrict-namespaces
+2
-0
etc/profile-a-l/curl.profile less more
5757
5858 dbus-user none
5959 dbus-system none
60
61 restrict-namespaces
+1
-0
etc/profile-a-l/d-feet.profile less more
5252 private-tmp
5353
5454 #memory-deny-write-execute - breaks on Arch (see issue #1803)
55 restrict-namespaces
+1
-0
etc/profile-a-l/darktable.profile less more
4040 private-dev
4141 private-tmp
4242
43 restrict-namespaces
+1
-0
etc/profile-a-l/dbus-send.profile less more
5555
5656 memory-deny-write-execute
5757 read-only ${HOME}
58 restrict-namespaces
+2
-0
etc/profile-a-l/dconf-editor.profile less more
4949 dbus-user.own ca.desrt.dconf-editor
5050 dbus-user.talk ca.desrt.dconf
5151 dbus-system none
52
53 restrict-namespaces
+1
-0
etc/profile-a-l/dconf.profile less more
4949 private-tmp
5050
5151 memory-deny-write-execute
52 restrict-namespaces
+1
-0
etc/profile-a-l/ddgtk.profile less more
5050 dbus-system none
5151
5252 # memory-deny-write-execute - breaks on Arch
53 restrict-namespaces
+1
-0
etc/profile-a-l/deadbeef.profile less more
3131 private-dev
3232 private-tmp
3333
34 restrict-namespaces
+1
-1
etc/profile-a-l/default.profile less more
5959 # deterministic-shutdown
6060 # memory-deny-write-execute
6161 # read-only ${HOME}
62 # restrict-namespaces
62 restrict-namespaces
+2
-0
etc/profile-a-l/deluge.profile less more
4242 private-bin deluge,deluge-console,deluge-gtk,deluge-web,deluged,python*,sh,uname
4343 private-dev
4444 private-tmp
45
46 restrict-namespaces
+2
-0
etc/profile-a-l/desktopeditors.profile less more
4141
4242 dbus-user none
4343 dbus-system none
44
45 restrict-namespaces
+1
-0
etc/profile-a-l/devhelp.profile less more
4949
5050 #memory-deny-write-execute - breaks on Arch (see issue #1803)
5151 read-only ${HOME}
52 restrict-namespaces
+1
-0
etc/profile-a-l/devilspie.profile less more
5555
5656 memory-deny-write-execute
5757 read-only ${HOME}
58 restrict-namespaces
+2
-0
etc/profile-a-l/dex2jar.profile less more
3838
3939 dbus-user none
4040 dbus-system none
41
42 restrict-namespaces
+2
-0
etc/profile-a-l/dia.profile less more
5353
5454 dbus-user none
5555 dbus-system none
56
57 restrict-namespaces
+1
-0
etc/profile-a-l/dig.profile less more
5555 dbus-system none
5656
5757 memory-deny-write-execute
58 restrict-namespaces
+2
-0
etc/profile-a-l/digikam.profile less more
4242
4343 # dbus-user none
4444 # dbus-system none
45
46 # restrict-namespaces
+1
-0
etc/profile-a-l/dillo.profile less more
3636 private-tmp
3737
3838 deterministic-shutdown
39 restrict-namespaces
+2
-0
etc/profile-a-l/dino.profile less more
5252 dbus-system filter
5353 # Integration with systemd-logind or elogind
5454 dbus-system.talk org.freedesktop.login1
55
56 restrict-namespaces
+2
-0
etc/profile-a-l/display.profile less more
4444
4545 dbus-user none
4646 dbus-system none
47
48 restrict-namespaces
+1
-0
etc/profile-a-l/dnscrypt-proxy.profile less more
5050
5151 # mdwe can break modules/plugins
5252 memory-deny-write-execute
53 restrict-namespaces
+2
-0
etc/profile-a-l/dnsmasq.profile less more
3939 private-dev
4040 private-tmp
4141 writable-var
42
43 restrict-namespaces
+2
-0
etc/profile-a-l/dolphin-emu.profile less more
5959
6060 dbus-user none
6161 dbus-system none
62
63 restrict-namespaces
+1
-0
etc/profile-a-l/dooble.profile less more
3737 private-dev
3838 private-tmp
3939
40 restrict-namespaces
+2
-0
etc/profile-a-l/dosbox.profile less more
4040
4141 dbus-user none
4242 dbus-system none
43
44 restrict-namespaces
+1
-0
etc/profile-a-l/dragon.profile less more
3838 private-dev
3939 private-tmp
4040
41 restrict-namespaces
+1
-0
etc/profile-a-l/drawio.profile less more
5050 dbus-system none
5151
5252 # memory-deny-write-execute - breaks on Arch
53 # restrict-namespaces
+1
-0
etc/profile-a-l/drill.profile less more
5151 dbus-system none
5252
5353 memory-deny-write-execute
54 restrict-namespaces
+1
-0
etc/profile-a-l/dropbox.profile less more
4545 private-tmp
4646
4747 noexec /tmp
48 restrict-namespaces
+1
-0
etc/profile-a-l/easystroke.profile less more
5252 # dbus-system none
5353
5454 memory-deny-write-execute
55 restrict-namespaces
+10
-0
etc/profile-a-l/electron-hardened.inc.profile less more
0 # Firejail profile alias for chrome-common-hardened.inc
1 # This file is overwritten after every install/update
2 # Persistent local customizations
3 include electron-hardened.inc.local
4 # Persistent global definitions
5 # added by caller profile
6 #include globals.local
7
8 # Redirect
9 include chrome-common-hardened.inc.profile
+2
-2
etc/profile-a-l/electron.profile less more
2121 include whitelist-usr-share-common.inc
2222 include whitelist-var-common.inc
2323
24 # Add the next line to your chromium-common.local if your kernel allows unprivileged userns clone.
25 #include chromium-common-hardened.inc.profile
24 # Add the next line to your electron.local if your kernel allows unprivileged userns clone.
25 #include electron-hardened.inc.profile
2626
2727 apparmor
2828 caps.keep sys_admin,sys_chroot
+2
-0
etc/profile-a-l/electrum.profile less more
5050
5151 # dbus-user none
5252 # dbus-system none
53
54 restrict-namespaces
+1
-0
etc/profile-a-l/emacs.profile less more
2929
3030 read-write ${HOME}/.emacs
3131 read-write ${HOME}/.emacs.d
32 restrict-namespaces
+15
-9
etc/profile-a-l/email-common.profile less more
00 # Firejail profile for email-common
1 # Description: Common profile for claws-mail and sylpheed email clients
1 # Description: Common profile for GUI mail clients
22 # This file is overwritten after every install/update
33 # Persistent local customizations
44 include email-common.local
1313 # when storing mail outside the default ${HOME}/Mail path, 'noblacklist' the custom path in your email-common.local
1414 # and 'blacklist' it in your disable-common.local too so it is kept hidden from other applications
1515 noblacklist ${HOME}/Mail
16 noblacklist /var/mail
17 noblacklist /var/spool/mail
1618
1719 noblacklist ${DOCUMENTS}
1820
3739 whitelist ${RUNUSER}/gnupg
3840 whitelist /usr/share/gnupg
3941 whitelist /usr/share/gnupg2
42 whitelist /var/mail
43 whitelist /var/spool/mail
4044 include whitelist-common.inc
4145 include whitelist-runuser-common.inc
4246 include whitelist-usr-share-common.inc
6468 # disable-mnt
6569 private-cache
6670 private-dev
67 private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,localtime,machine-id,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg
71 private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,localtime,machine-id,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,timezone,xdg
6872 private-tmp
6973 # encrypting and signing email
7074 writable-run-user
75 writable-var
7176
77 dbus-user filter
78 dbus-user.talk ca.desrt.dconf
79 dbus-user.talk org.freedesktop.Notifications
80 dbus-user.talk org.freedesktop.secrets
81 dbus-user.talk org.gnome.keyring.*
82 dbus-user.talk org.gnome.seahorse.*
83 dbus-user.talk org.mozilla.*
7284 dbus-system none
73
74 # If you want to read local mail stored in /var/mail, add the following to email-common.local:
75 #noblacklist /var/mail
76 #noblacklist /var/spool/mail
77 #whitelist /var/mail
78 #whitelist /var/spool/mail
79 #writable-var
8085
8186 read-only ${HOME}/.mozilla/firefox/profiles.ini
8287 read-only ${HOME}/.signature
88 restrict-namespaces
+2
-0
etc/profile-a-l/empathy.profile less more
2323
2424 private-cache
2525 private-tmp
26
27 restrict-namespaces
+1
-0
etc/profile-a-l/enchant.profile less more
5454 dbus-system none
5555
5656 memory-deny-write-execute
57 restrict-namespaces
+2
-0
etc/profile-a-l/engrampa.profile less more
3737 dbus-user filter
3838 dbus-user.talk ca.desrt.dconf
3939 dbus-system none
40
41 restrict-namespaces
+1
-0
etc/profile-a-l/enpass.profile less more
5858 private-tmp
5959
6060 #memory-deny-write-execute - breaks on Arch (see issue #1803)
61 restrict-namespaces
+2
-0
etc/profile-a-l/eo-common.profile less more
4848 private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload
4949 private-lib eog,eom,gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.*
5050 private-tmp
51
52 restrict-namespaces
+2
-0
etc/profile-a-l/ephemeral.profile less more
6060 # breaks preferences
6161 # dbus-user none
6262 # dbus-system none
63
64 restrict-namespaces
+2
-0
etc/profile-a-l/epiphany.profile less more
3333 notv
3434 protocol unix,inet,inet6
3535 seccomp
36
37 restrict-namespaces
+1
-0
etc/profile-a-l/equalx.profile less more
5959 dbus-system none
6060
6161 memory-deny-write-execute
62 restrict-namespaces
+2
-0
etc/profile-a-l/etr.profile less more
5252
5353 dbus-user none
5454 dbus-system none
55
56 restrict-namespaces
+2
-0
etc/profile-a-l/evince.profile less more
6363 dbus-user.talk org.gtk.vfs.Daemon
6464 dbus-user.talk org.gtk.vfs.Metadata
6565 dbus-system none
66
67 restrict-namespaces
+2
-0
etc/profile-a-l/evolution.profile less more
4242 private-dev
4343 private-tmp
4444 writable-var
45
46 restrict-namespaces
+1
-0
etc/profile-a-l/exiftool.profile less more
5353 dbus-system none
5454
5555 memory-deny-write-execute
56 restrict-namespaces
+2
-0
etc/profile-a-l/falkon.profile less more
5252 # dbus-user filter
5353 # dbus-user.own org.kde.Falkon
5454 dbus-system none
55
56 # restrict-namespaces
+2
-0
etc/profile-a-l/fbreader.profile less more
3535 private-bin fbreader,FBReader
3636 private-dev
3737 private-tmp
38
39 restrict-namespaces
+1
-0
etc/profile-a-l/fdns.profile less more
4646 private-tmp
4747
4848 memory-deny-write-execute
49 restrict-namespaces
+2
-0
etc/profile-a-l/feedreader.profile less more
5555 #dbus-user.talk org.freedesktop.Notifications
5656 #dbus-user.talk org.gnome.OnlineAccounts
5757 dbus-system none
58
59 restrict-namespaces
+2
-0
etc/profile-a-l/feh.profile less more
3939
4040 dbus-user none
4141 dbus-system none
42
43 restrict-namespaces
+2
-0
etc/profile-a-l/ferdi.profile less more
4343 disable-mnt
4444 private-dev
4545 private-tmp
46
47 # restrict-namespaces
+2
-0
etc/profile-a-l/fetchmail.profile less more
3030
3131 #private-bin bash,chmod,fetchmail,procmail
3232 private-dev
33
34 restrict-namespaces
+1
-0
etc/profile-a-l/ffmpeg.profile less more
5353 dbus-system none
5454
5555 # memory-deny-write-execute - it breaks old versions of ffmpeg
56 restrict-namespaces
+2
-0
etc/profile-a-l/file-manager-common.profile less more
4848
4949 #dbus-user none
5050 #dbus-system none
51
52 restrict-namespaces
+2
-0
etc/profile-a-l/file-roller.profile less more
4545 # private-tmp
4646
4747 dbus-system none
48
49 restrict-namespaces
+1
-0
etc/profile-a-l/file.profile less more
4343
4444 memory-deny-write-execute
4545 read-only ${HOME}
46 restrict-namespaces
+2
-0
etc/profile-a-l/filezilla.profile less more
4040 private-bin bash,filezilla,fzputtygen,fzsftp,lsb_release,python*,sh,uname,zsh
4141 private-dev
4242 private-tmp
43
44 restrict-namespaces
+4
-0
etc/profile-a-l/firefox-common.profile less more
3434 include whitelist-var-common.inc
3535
3636 apparmor
37 # Fixme!
38 apparmor-replace
3739 caps.drop all
3840 # machine-id breaks pulse audio; add it to your firefox-common.local if sound is not required.
3941 #machine-id
6769 # Gnome connector, KDE connect and power management on KDE Plasma.
6870 dbus-user none
6971 dbus-system none
72
73 #restrict-namespaces
+2
-0
etc/profile-a-l/flameshot.profile less more
6464 ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
6565 ?ALLOW_TRAY: dbus-user.own org.kde.*
6666 dbus-system none
67
68 restrict-namespaces
+1
-0
etc/profile-a-l/flowblade.profile less more
3434 private-dev
3535 private-tmp
3636
37 restrict-namespaces
+2
-1
etc/profile-a-l/fluxbox.profile less more
1313 netfilter
1414 noroot
1515 protocol unix,inet,inet6
16 seccomp
16 seccomp !chroot
1717
18 #restrict-namespaces
+1
-0
etc/profile-a-l/font-manager.profile less more
5353 private-tmp
5454
5555 #memory-deny-write-execute - breaks on Arch (see issue #1803)
56 restrict-namespaces
+1
-0
etc/profile-a-l/fontforge.profile less more
3737 private-dev
3838 private-tmp
3939
40 restrict-namespaces
+2
-0
etc/profile-a-l/fractal.profile less more
5454 dbus-user.talk org.freedesktop.Notifications
5555 dbus-user.talk org.freedesktop.secrets
5656 dbus-system none
57
58 restrict-namespaces
+2
-0
etc/profile-a-l/franz.profile less more
4343 disable-mnt
4444 private-dev
4545 private-tmp
46
47 # restrict-namespaces
+2
-0
etc/profile-a-l/freecad.profile less more
4141
4242 dbus-user none
4343 dbus-system none
44
45 restrict-namespaces
+2
-0
etc/profile-a-l/freeciv.profile less more
4343
4444 dbus-user none
4545 dbus-system none
46
47 restrict-namespaces
+2
-0
etc/profile-a-l/freecol.profile less more
5454
5555 dbus-user none
5656 dbus-system none
57
58 restrict-namespaces
+2
-0
etc/profile-a-l/freemind.profile less more
4949
5050 dbus-user none
5151 dbus-system none
52
53 restrict-namespaces
+1
-0
etc/profile-a-l/freshclam.profile less more
3232 writable-var-log
3333
3434 memory-deny-write-execute
35 restrict-namespaces
+2
-0
etc/profile-a-l/frogatto.profile less more
4848
4949 dbus-user none
5050 dbus-system none
51
52 restrict-namespaces
+2
-0
etc/profile-a-l/frozen-bubble.profile less more
4545
4646 dbus-user none
4747 dbus-system none
48
49 restrict-namespaces
+1
-0
etc/profile-a-l/ftp.profile less more
5050
5151 memory-deny-write-execute
5252 noexec ${HOME}
53 restrict-namespaces
+1
-0
etc/profile-a-l/funnyboat.profile less more
5151 dbus-system none
5252
5353 memory-deny-write-execute
54 restrict-namespaces
+1
-0
etc/profile-a-l/gajim.profile less more
7474 # Add the next line to your gajim.local to enable location plugin support.
7575 #dbus-system.talk org.freedesktop.GeoClue2
7676
77 restrict-namespaces
7778 join-or-start gajim
+1
-0
etc/profile-a-l/galculator.profile less more
4949 dbus-system none
5050
5151 #memory-deny-write-execute - breaks on Arch (see issue #1803)
52 restrict-namespaces
+1
-0
etc/profile-a-l/gapplication.profile less more
6969
7070 memory-deny-write-execute
7171 read-only ${HOME}
72 restrict-namespaces
+2
-0
etc/profile-a-l/gcloud.profile less more
3939
4040 dbus-user none
4141 dbus-system none
42
43 restrict-namespaces
+1
-0
etc/profile-a-l/gconf.profile less more
5757 private-tmp
5858
5959 memory-deny-write-execute
60 restrict-namespaces
+1
-0
etc/profile-a-l/gdu.profile less more
3636 dbus-system none
3737
3838 memory-deny-write-execute
39 restrict-namespaces
3940
4041 # gdu has built-in delete (d), empty (e) dir/file support and shell spawning (b) features.
4142 # Depending on workflow and use case the sandbox can be hardened by adding the
+2
-0
etc/profile-a-l/geany.profile less more
3131 private-cache
3232 private-dev
3333 private-tmp
34
35 restrict-namespaces
+2
-0
etc/profile-a-l/geary.profile less more
8787 dbus-user.talk org.gnome.evolution.dataserver.AddressBook10
8888 dbus-user.talk org.gnome.evolution.dataserver.Sources5
8989 ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
90 dbus-user.talk org.mozilla.*
9091 dbus-system none
9192
9293 read-only ${HOME}/.mozilla/firefox/profiles.ini
94 restrict-namespaces
+2
-0
etc/profile-a-l/gedit.profile less more
4848 # makes settings immutable
4949 # dbus-user none
5050 # dbus-system none
51
52 restrict-namespaces
+1
-0
etc/profile-a-l/geekbench.profile less more
5454
5555 read-only ${HOME}
5656 read-write ${HOME}/.geekbench5
57 restrict-namespaces
+2
-0
etc/profile-a-l/geeqie.profile less more
3333
3434 # private-bin geeqie
3535 private-dev
36
37 restrict-namespaces
+2
-0
etc/profile-a-l/gfeeds.profile less more
6666 dbus-user.own org.gabmus.gfeeds
6767 dbus-user.talk ca.desrt.dconf
6868 dbus-system none
69
70 restrict-namespaces
+1
-0
etc/profile-a-l/gget.profile less more
5555 dbus-system none
5656
5757 memory-deny-write-execute
58 restrict-namespaces
+2
-0
etc/profile-a-l/ghostwriter.profile less more
5555
5656 dbus-user filter
5757 dbus-system none
58
59 #restrict-namespaces
+2
-0
etc/profile-a-l/gimp.profile less more
6262
6363 dbus-user none
6464 dbus-system none
65
66 restrict-namespaces
+1
-0
etc/profile-a-l/gist.profile less more
5757 dbus-system none
5858
5959 memory-deny-write-execute
60 restrict-namespaces
+2
-0
etc/profile-a-l/git-cola.profile less more
8383
8484 # Add 'ignore read-only ${HOME}/.ssh' to your git-cola.local if you need to allow hosts.
8585 read-only ${HOME}/.ssh
86
87 restrict-namespaces
+1
-0
etc/profile-a-l/git.profile less more
6464 private-dev
6565
6666 memory-deny-write-execute
67 restrict-namespaces
+2
-0
etc/profile-a-l/gitg.profile less more
6060 # Add the next line to your gitg.local if you need keyring access.
6161 #dbus-user.talk org.freedesktop.secrets
6262 dbus-system none
63
64 restrict-namespaces
+1
-0
etc/profile-a-l/gitter.profile less more
4040 private-dev
4141 private-tmp
4242
43 restrict-namespaces
+2
-0
etc/profile-a-l/gjs.profile less more
4141 private-dev
4242 # private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl
4343 private-tmp
44
45 restrict-namespaces
+2
-0
etc/profile-a-l/gl-117.profile less more
4747
4848 dbus-user none
4949 dbus-system none
50
51 restrict-namespaces
+2
-0
etc/profile-a-l/glaxium.profile less more
4747
4848 dbus-user none
4949 dbus-system none
50
51 restrict-namespaces
+1
-0
etc/profile-a-l/globaltime.profile less more
3333 private-dev
3434 private-tmp
3535
36 restrict-namespaces
+1
-0
etc/profile-a-l/gmpc.profile less more
5050 # dbus-system none
5151
5252 # memory-deny-write-execute - breaks on Arch
53 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-books.profile less more
4242 private-dev
4343 private-tmp
4444
45 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-builder.profile less more
3636 private-dev
3737
3838 read-write ${HOME}/.bash_history
39 restrict-namespaces
+2
-0
etc/profile-a-l/gnome-calculator.profile less more
5151 dbus-user.own org.gnome.Calculator
5252 dbus-user.talk ca.desrt.dconf
5353 dbus-system none
54
55 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-calendar.profile less more
5959 #dbus-system.talk org.freedesktop.GeoClue2
6060
6161 read-only ${HOME}
62 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-characters.profile less more
5555 # dbus-system none
5656
5757 read-only ${HOME}
58 restrict-namespaces
+2
-0
etc/profile-a-l/gnome-chess.profile less more
5050 private-dev
5151 private-etc alternatives,dconf,fonts,gnome-chess,gtk-3.0,ld.so.cache,ld.so.preload
5252 private-tmp
53
54 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-clocks.profile less more
4343 private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,pkcs11,pki,ssl
4444 private-tmp
4545
46 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-contacts.profile less more
3737 private-dev
3838 private-tmp
3939
40 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-documents.profile less more
4040 private-dev
4141 private-tmp
4242
43 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-font-viewer.profile less more
3434 private-dev
3535 private-tmp
3636
37 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-hexgl.profile less more
4848
4949 read-only ${HOME}
5050 read-write ${HOME}/.cache/mesa_shader_cache
51 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-keyring.profile less more
5858 dbus-system none
5959
6060 memory-deny-write-execute
61 restrict-namespaces
+2
-0
etc/profile-a-l/gnome-latex.profile less more
4949 private-etc alternatives,dconf,fonts,gtk-3.0,latexmk.conf,ld.so.cache,ld.so.preload,login.defs,passwd,texlive
5050
5151 dbus-system none
52
53 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-logs.profile less more
5050
5151 # Add 'ignore read-only ${HOME}' to your gnome-logs.local if you export logs to a file under your ${HOME}.
5252 read-only ${HOME}
53 restrict-namespaces
+2
-0
etc/profile-a-l/gnome-maps.profile less more
7272 dbus-system filter
7373 #dbus-system.talk org.freedesktop.NetworkManager
7474 dbus-system.talk org.freedesktop.GeoClue2
75
76 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-mplayer.profile less more
3030 private-dev
3131 private-tmp
3232
33 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-music.profile less more
4343 private-etc alternatives,asound.conf,dconf,fonts,fonts,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,pulse,selinux,xdg
4444 private-tmp
4545
46 restrict-namespaces
+2
-0
etc/profile-a-l/gnome-nettool.profile less more
4545
4646 dbus-user none
4747 dbus-system none
48
49 #restrict-namespaces
+2
-0
etc/profile-a-l/gnome-passwordsafe.profile less more
5858 dbus-user.own org.gnome.PasswordSafe
5959 dbus-user.talk ca.desrt.dconf
6060 dbus-system none
61
62 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-photos.profile less more
3939 private-dev
4040 private-tmp
4141
42 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-pie.profile less more
3737 private-tmp
3838
3939 memory-deny-write-execute
40 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-pomodoro.profile less more
5555
5656 read-only ${HOME}
5757 read-write ${HOME}/.local/share/gnome-pomodoro
58 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-recipes.profile less more
4949 private-lib gdk-pixbuf-2.0,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,libgnutls.so.*,libjpeg.so.*,libp11-kit.so.*,libproxy.so.*,librsvg-2.so.*
5050 private-tmp
5151
52 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-ring.profile less more
2929 # private-dev
3030 private-tmp
3131
32 restrict-namespaces
+0
-1
etc/profile-a-l/gnome-schedule.profile less more
6060 private-cache
6161 private-dev
6262 writable-var
63
+2
-0
etc/profile-a-l/gnome-screenshot.profile less more
4747 dbus-user.own org.gnome.Screenshot
4848 dbus-user.talk org.gnome.Shell.Screenshot
4949 dbus-system none
50
51 restrict-namespaces
+2
-0
etc/profile-a-l/gnome-sound-recorder.profile less more
4040 private-dev
4141 private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,openal,pango,pulse,xdg
4242 private-tmp
43
44 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-system-log.profile less more
5252 memory-deny-write-execute
5353 # Add 'ignore read-only ${HOME}' to your gnome-system-log.local if you export logs to a file under your ${HOME}.
5454 read-only ${HOME}
55 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-todo.profile less more
6060 #dbus-system.talk org.freedesktop.login1
6161
6262 read-only ${HOME}
63 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-twitch.profile less more
3636 private-dev
3737 private-tmp
3838
39 restrict-namespaces
+1
-0
etc/profile-a-l/gnome-weather.profile less more
4545 # private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl
4646 private-tmp
4747
48 restrict-namespaces
+2
-0
etc/profile-a-l/gnome_games-common.profile less more
4545 dbus-user filter
4646 dbus-user.talk ca.desrt.dconf
4747 dbus-system none
48
49 restrict-namespaces
+2
-0
etc/profile-a-l/gnote.profile less more
5656 dbus-user.own org.gnome.Gnote
5757 dbus-user.talk ca.desrt.dconf
5858 dbus-system none
59
60 restrict-namespaces
+2
-0
etc/profile-a-l/gnubik.profile less more
4646
4747 dbus-user none
4848 dbus-system none
49
50 restrict-namespaces
+2
-0
etc/profile-a-l/godot.profile less more
4141
4242 dbus-user none
4343 dbus-system none
44
45 restrict-namespaces
+2
-0
etc/profile-a-l/goldendict.profile less more
5454
5555 dbus-user none
5656 dbus-system none
57
58 restrict-namespaces
+2
-0
etc/profile-a-l/goobox.profile less more
3131 private-dev
3232 # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl
3333 # private-tmp
34
35 restrict-namespaces
+1
-0
etc/profile-a-l/google-earth.profile less more
3838 private-dev
3939 private-opt google
4040
41 restrict-namespaces
+2
-0
etc/profile-a-l/google-play-music-desktop-player.profile less more
3838 disable-mnt
3939 private-dev
4040 private-tmp
41
42 restrict-namespaces
+2
-0
etc/profile-a-l/googler-common.profile less more
5757
5858 dbus-user none
5959 dbus-system none
60
61 restrict-namespaces
+2
-0
etc/profile-a-l/gpa.profile less more
2929
3030 # private-bin gpa,gpg
3131 private-dev
32
33 restrict-namespaces
+3
-1
etc/profile-a-l/gpg-agent.profile less more
4545 seccomp
4646 tracelog
4747
48 # private-bin gpg-agent,gpg
48 # private-bin gpg-agent
4949 private-cache
5050 private-dev
51
52 restrict-namespaces
+2
-1
etc/profile-a-l/gpg.profile less more
4141 seccomp
4242 tracelog
4343
44 # private-bin gpg,gpg-agent
44 # private-bin gpg
4545 private-cache
4646 private-dev
4747
5050 # installing/upgrading archlinux-keyring extremely slow.
5151 read-write /etc/pacman.d/gnupg
5252 read-write /usr/share/pacman/keyrings
53 restrict-namespaces
+1
-0
etc/profile-a-l/gpicview.profile less more
4747 dbus-system none
4848
4949 memory-deny-write-execute
50 restrict-namespaces
+1
-0
etc/profile-a-l/gpredict.profile less more
3737 private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl
3838 private-tmp
3939
40 restrict-namespaces
+2
-0
etc/profile-a-l/gradio.profile less more
5151 dbus-user.own org.mpris.MediaPlayer2.gradio
5252 dbus-user.talk ca.desrt.dconf
5353 dbus-system none
54
55 restrict-namespaces
+2
-0
etc/profile-a-l/gramps.profile less more
4747
4848 dbus-user none
4949 dbus-system none
50
51 restrict-namespaces
+2
-0
etc/profile-a-l/gravity-beams-and-evaporating-stars.profile less more
4343
4444 dbus-user none
4545 dbus-system none
46
47 restrict-namespaces
+2
-0
etc/profile-a-l/gthumb.profile less more
3333 private-cache
3434 private-dev
3535 private-tmp
36
37 restrict-namespaces
+1
-0
etc/profile-a-l/gtk-update-icon-cache.profile less more
5252 dbus-system none
5353
5454 memory-deny-write-execute
55 restrict-namespaces
+1
-0
etc/profile-a-l/guayadeque.profile less more
3131 private-dev
3232 private-tmp
3333
34 restrict-namespaces
+1
-0
etc/profile-a-l/gucharmap.profile less more
5050 # dbus-system none
5151
5252 read-only ${HOME}
53 restrict-namespaces
+2
-0
etc/profile-a-l/guvcview.profile less more
5151
5252 dbus-user none
5353 dbus-system none
54
55 restrict-namespaces
+1
-0
etc/profile-a-l/gwenview.profile less more
5151 # dbus-system none
5252
5353 # memory-deny-write-execute
54 restrict-namespaces
+2
-0
etc/profile-a-l/handbrake.profile less more
3535
3636 dbus-user none
3737 dbus-system none
38
39 restrict-namespaces
+2
-0
etc/profile-a-l/hashcat.profile less more
4242
4343 dbus-user none
4444 dbus-system none
45
46 restrict-namespaces
+1
-0
etc/profile-a-l/hasher-common.profile less more
5555
5656 memory-deny-write-execute
5757 read-only ${HOME}
58 restrict-namespaces
+2
-0
etc/profile-a-l/hedgewars.profile less more
3434 disable-mnt
3535 private-dev
3636 private-tmp
37
38 restrict-namespaces
+1
-0
etc/profile-a-l/hexchat.profile less more
5454 private-tmp
5555
5656 # memory-deny-write-execute - breaks python
57 restrict-namespaces
+2
-0
etc/profile-a-l/highlight.profile less more
4040
4141 dbus-user none
4242 dbus-system none
43
44 restrict-namespaces
+1
-0
etc/profile-a-l/homebank.profile less more
5555 dbus-system none
5656
5757 # memory-deny-write-execute
58 restrict-namespaces
+1
-0
etc/profile-a-l/host.profile less more
4848 dbus-system none
4949
5050 memory-deny-write-execute
51 restrict-namespaces
+2
-0
etc/profile-a-l/hugin.profile less more
4444
4545 dbus-user none
4646 dbus-system none
47
48 restrict-namespaces
+2
-0
etc/profile-a-l/hyperrogue.profile less more
4747
4848 dbus-user none
4949 dbus-system none
50
51 restrict-namespaces
+2
-0
etc/profile-a-l/i2prouter.profile less more
6868 private-dev
6969 private-etc alternatives,ca-certificates,crypto-policies,dconf,group,hostname,hosts,i2p,java-10-openjdk,java-11-openjdk,java-12-openjdk,java-13-openjdk,java-8-openjdk,java-9-openjdk,java-openjdk,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,resolv.conf,ssl
7070 private-tmp
71
72 restrict-namespaces
+2
-1
etc/profile-a-l/i3.profile less more
1313 netfilter
1414 noroot
1515 protocol unix,inet,inet6
16 seccomp
16 seccomp !chroot
1717
18 #restrict-namespaces
+2
-0
etc/profile-a-l/iagno.profile less more
3636
3737 # dbus-user none
3838 # dbus-system none
39
40 restrict-namespaces
+1
-0
etc/profile-a-l/idea.sh.profile less more
3838 # private-tmp
3939
4040 noexec /tmp
41 restrict-namespaces
+2
-0
etc/profile-a-l/imagej.profile less more
3737
3838 dbus-user none
3939 dbus-system none
40
41 restrict-namespaces
+1
-0
etc/profile-a-l/img2txt.profile less more
4949 dbus-system none
5050
5151 memory-deny-write-execute
52 restrict-namespaces
+1
-0
etc/profile-a-l/impressive.profile less more
5353
5454 read-only ${HOME}
5555 read-write ${HOME}/.cache/mesa_shader_cache
56 restrict-namespaces
+1
-0
etc/profile-a-l/imv.profile less more
5353 dbus-system none
5454
5555 read-only ${HOME}
56 restrict-namespaces
+1
-0
etc/profile-a-l/inkscape.profile less more
5959 dbus-system none
6060
6161 # memory-deny-write-execute
62 restrict-namespaces
+2
-0
etc/profile-a-l/io.github.lainsce.Notejot.profile less more
5656 dbus-user.own io.github.lainsce.Notejot
5757 dbus-user.talk ca.desrt.dconf
5858 dbus-system none
59
60 restrict-namespaces
+1
-0
etc/profile-a-l/ipcalc.profile less more
5858
5959 # memory-deny-write-execute
6060 # read-only ${HOME}
61 restrict-namespaces
+1
-0
etc/profile-a-l/itch.profile less more
3838 private-tmp
3939
4040 noexec /tmp
41 restrict-namespaces
+1
-0
etc/profile-a-l/jami-gnome.profile less more
3838 private-tmp
3939
4040 env QT_QPA_PLATFORM=xcb
41 restrict-namespaces
+2
-0
etc/profile-a-l/jd-gui.profile less more
4040
4141 dbus-user none
4242 dbus-system none
43
44 restrict-namespaces
+1
-0
etc/profile-a-l/jerry.profile less more
3939 dbus-system none
4040
4141 memory-deny-write-execute
42 restrict-namespaces
+2
-0
etc/profile-a-l/jitsi.profile less more
2727 disable-mnt
2828 private-cache
2929 private-tmp
30
31 restrict-namespaces
+2
-0
etc/profile-a-l/jumpnbump.profile less more
4444
4545 dbus-user none
4646 dbus-system none
47
48 restrict-namespaces
+2
-0
etc/profile-a-l/k3b.profile less more
3434
3535 private-dev
3636 # private-tmp
37
38 # restrict-namespaces - breaks privileged helpers
+1
-0
etc/profile-a-l/kaffeine.profile less more
3939 private-dev
4040 private-tmp
4141
42 restrict-namespaces
+2
-0
etc/profile-a-l/kalgebra.profile less more
4545
4646 dbus-user none
4747 dbus-system none
48
49 # restrict-namespaces
+1
-0
etc/profile-a-l/kate.profile less more
5959 # dbus-user none
6060 # dbus-system none
6161
62 restrict-namespaces
6263 join-or-start kate
+2
-0
etc/profile-a-l/kazam.profile less more
5151 private-tmp
5252
5353 dbus-system none
54
55 restrict-namespaces
+1
-0
etc/profile-a-l/kcalc.profile less more
6666 dbus-system none
6767
6868 #memory-deny-write-execute
69 restrict-namespaces
+1
-0
etc/profile-a-l/kdeinit4.profile less more
3333 private-dev
3434 private-tmp
3535
36 restrict-namespaces
+2
-0
etc/profile-a-l/kdenlive.profile less more
3737
3838 # dbus-user none
3939 # dbus-system none
40
41 restrict-namespaces
+2
-0
etc/profile-a-l/kdiff3.profile less more
5454
5555 dbus-user none
5656 dbus-system none
57
58 restrict-namespaces
+1
-0
etc/profile-a-l/keepass.profile less more
4242 private-dev
4343 private-tmp
4444
45 restrict-namespaces
+1
-0
etc/profile-a-l/keepassx.profile less more
4646 dbus-system none
4747
4848 memory-deny-write-execute
49 restrict-namespaces
+2
-0
etc/profile-a-l/keepassxc.profile less more
105105 dbus-system filter
106106 dbus-system.talk org.freedesktop.login1
107107
108 restrict-namespaces
109
108110 # Mutex is stored in /tmp by default, which is broken by private-tmp.
109111 join-or-start keepassxc
+2
-0
etc/profile-a-l/kfind.profile less more
4343
4444 # dbus-user none
4545 # dbus-system none
46
47 restrict-namespaces
+1
-0
etc/profile-a-l/kget.profile less more
4040 private-tmp
4141
4242 # memory-deny-write-execute
43 restrict-namespaces
+1
-0
etc/profile-a-l/kid3.profile less more
4444 dbus-system none
4545
4646 memory-deny-write-execute
47 restrict-namespaces
+1
-0
etc/profile-a-l/kino.profile less more
3333 private-dev
3434 private-tmp
3535
36 restrict-namespaces
+2
-0
etc/profile-a-l/kiwix-desktop.profile less more
4747
4848 dbus-user none
4949 dbus-system none
50
51 # restrict-namespaces
+2
-0
etc/profile-a-l/klatexformula.profile less more
4141
4242 dbus-user none
4343 dbus-system none
44
45 restrict-namespaces
+2
-0
etc/profile-a-l/klavaro.profile less more
5050
5151 dbus-user none
5252 dbus-system none
53
54 restrict-namespaces
+2
-0
etc/profile-a-l/kmail.profile less more
6161 # private-tmp - interrupts connection to akonadi, breaks opening of email attachments
6262 # writable-run-user is needed for signing and encrypting emails
6363 writable-run-user
64
65 # restrict-namespaces
+1
-0
etc/profile-a-l/kmplayer.profile less more
3737 private-dev
3838 private-tmp
3939
40 restrict-namespaces
+2
-0
etc/profile-a-l/kodi.profile less more
5050
5151 private-dev
5252 private-tmp
53
54 restrict-namespaces
+1
-0
etc/profile-a-l/konversation.profile less more
4242 private-tmp
4343
4444 # memory-deny-write-execute
45 restrict-namespaces
+1
-0
etc/profile-a-l/kopete.profile less more
3636 private-tmp
3737 writable-var
3838
39 restrict-namespaces
+2
-0
etc/profile-a-l/krita.profile less more
4747
4848 # dbus-user none
4949 # dbus-system none
50
51 restrict-namespaces
+2
-0
etc/profile-a-l/krunner.profile less more
3434 seccomp
3535
3636 # private-cache
37
38 restrict-namespaces
+1
-0
etc/profile-a-l/ktorrent.profile less more
6666
6767 deterministic-shutdown
6868 # memory-deny-write-execute
69 restrict-namespaces
+2
-0
etc/profile-a-l/ktouch.profile less more
4949
5050 dbus-user none
5151 dbus-system none
52
53 restrict-namespaces
+1
-0
etc/profile-a-l/kube.profile less more
7777 dbus-system none
7878
7979 read-only ${HOME}/.mozilla/firefox/profiles.ini
80 restrict-namespaces
+2
-0
etc/profile-a-l/kwin_x11.profile less more
4343 private-dev
4444 private-etc alternatives,drirc,fonts,kde5rc,ld.so.cache,ld.so.preload,machine-id,xdg
4545 private-tmp
46
47 restrict-namespaces
+1
-0
etc/profile-a-l/kwrite.profile less more
5151 # dbus-user none
5252 # dbus-system none
5353
54 restrict-namespaces
5455 join-or-start kwrite
+2
-0
etc/profile-a-l/latex-common.profile less more
3737
3838 dbus-user none
3939 dbus-system none
40
41 restrict-namespaces
+1
-0
etc/profile-a-l/leafpad.profile less more
3737 private-lib
3838 private-tmp
3939
40 restrict-namespaces
+1
-0
etc/profile-a-l/less.profile less more
4747 memory-deny-write-execute
4848 read-only ${HOME}
4949 read-write ${HOME}/.lesshst
50 restrict-namespaces
+1
-0
etc/profile-a-l/librecad.profile less more
4646 dbus-system none
4747
4848 memory-deny-write-execute
49 restrict-namespaces
+1
-0
etc/profile-a-l/libreoffice.profile less more
5353
5454 dbus-system none
5555
56 restrict-namespaces
5657 join-or-start libreoffice
+2
-0
etc/profile-a-l/lifeograph.profile less more
5353 dbus-user filter
5454 dbus-user.talk ca.desrt.dconf
5555 dbus-system none
56
57 restrict-namespaces
+2
-0
etc/profile-a-l/liferea.profile less more
5858 # Add the next line to your liferea.local if you use the 'Libsecret Support' plugin.
5959 #dbus-user.talk org.freedesktop.secrets
6060 dbus-system none
61
62 restrict-namespaces
+2
-0
etc/profile-a-l/lincity-ng.profile less more
4444
4545 dbus-user none
4646 dbus-system none
47
48 restrict-namespaces
+1
-0
etc/profile-a-l/links-common.profile less more
5858 dbus-system none
5959
6060 memory-deny-write-execute
61 restrict-namespaces
+1
-0
etc/profile-a-l/linphone.profile less more
4646 private-dev
4747 private-tmp
4848
49 restrict-namespaces
+43
-0
etc/profile-a-l/linuxqq.profile less more
0 # Firejail profile for linuxqq
1 # Description: IM client based on Electron
2 # This file is overwritten after every install/update
3 # Persistent local customizations
4 include linuxqq.local
5 # Persistent global definitions
6 include globals.local
7
8 noblacklist ${HOME}/.config/QQ
9 noblacklist ${HOME}/.mozilla
10
11 include allow-bin-sh.inc
12
13 include disable-shell.inc
14
15 mkdir ${HOME}/.config/QQ
16 whitelist ${HOME}/.config/QQ
17 whitelist ${HOME}/.mozilla/firefox/profiles.ini
18 whitelist ${DESKTOP}
19
20 ignore apparmor
21 noprinters
22
23 # If you don't need/want to save anything to disk you can add `private` to your linuxqq.local.
24 #private
25 private-etc alsa,alternatives,ca-certificates,crypto-policies,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,nsswitch.conf,os-release,passwd,pki,pulse,resolv.conf,ssl,xdg
26 private-opt QQ
27
28 dbus-user filter
29 dbus-user.talk org.freedesktop.Notifications
30 dbus-user.talk org.freedesktop.portal.Desktop
31 dbus-user.talk org.freedesktop.portal.Fcitx
32 dbus-user.talk org.freedesktop.portal.IBus
33 dbus-user.talk org.freedesktop.ScreenSaver
34 dbus-user.talk org.gnome.Mutter.IdleMonitor
35 ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
36 dbus-user.talk org.mozilla.*
37 ignore dbus-user none
38
39 read-only ${HOME}/.mozilla/firefox/profiles.ini
40
41 # Redirect
42 include electron.profile
+2
-0
etc/profile-a-l/lmms.profile less more
3636
3737 dbus-user none
3838 dbus-system none
39
40 restrict-namespaces
+1
-0
etc/profile-a-l/lollypop.profile less more
3838 private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg
3939 private-tmp
4040
41 restrict-namespaces
+2
-0
etc/profile-a-l/lugaru.profile less more
4848
4949 dbus-user none
5050 dbus-system none
51
52 restrict-namespaces
+1
-0
etc/profile-a-l/luminance-hdr.profile less more
3535 private-dev
3636 private-tmp
3737
38 restrict-namespaces
+2
-0
etc/profile-a-l/lutris.profile less more
7979 dbus-user.own net.lutris.Lutris
8080 dbus-user.talk com.feralinteractive.GameMode
8181 dbus-system none
82
83 restrict-namespaces
+1
-0
etc/profile-a-l/lximage-qt.profile less more
3434 private-dev
3535 private-tmp
3636
37 restrict-namespaces
+1
-0
etc/profile-a-l/lxmusic.profile less more
3636 private-dev
3737 private-tmp
3838
39 restrict-namespaces
+2
-0
etc/profile-a-l/lynx.profile less more
3838 private-dev
3939 # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl
4040 private-tmp
41
42 restrict-namespaces
+2
-0
etc/profile-m-z/Maelstrom.profile less more
4242
4343 dbus-user none
4444 dbus-system none
45
46 #restrict-namespaces
+2
-0
etc/profile-m-z/Mathematica.profile less more
2626 noroot
2727 notv
2828 seccomp
29
30 restrict-namespaces
+2
-0
etc/profile-m-z/PCSX2.profile less more
5252
5353 dbus-user none
5454 dbus-system none
55
56 #restrict-namespaces
+24
-1
etc/profile-m-z/QMediathekView.profile less more
2626 include disable-shell.inc
2727 include disable-xdg.inc
2828
29 mkdir ${HOME}/.config/QMediathekView
30 mkdir ${HOME}/.local/share/QMediathekView
31 whitelist ${HOME}/.config/QMediathekView
32 whitelist ${HOME}/.local/share/QMediathekView
33
34 whitelist ${DOWNLOADS}
35 whitelist ${VIDEOS}
36
37 whitelist ${HOME}/.config/mpv
38 whitelist ${HOME}/.config/smplayer
39 whitelist ${HOME}/.config/totem
40 whitelist ${HOME}/.config/vlc
41 whitelist ${HOME}/.config/xplayer
42 whitelist ${HOME}/.local/share/totem
43 whitelist ${HOME}/.local/share/xplayer
44 whitelist ${HOME}/.mplayer
2945 whitelist /usr/share/qtchooser
46 include whitelist-common.inc
47 include whitelist-run-common.inc
48 include whitelist-runuser-common.inc
3049 include whitelist-usr-share-common.inc
3150 include whitelist-var-common.inc
3251
52 apparmor
3353 caps.drop all
3454 netfilter
3555 # no3d
3757 nogroups
3858 noinput
3959 nonewprivs
60 noprinters
4061 noroot
4162 notv
4263 nou2f
4364 novideo
44 protocol unix,inet,inet6,netlink
65 protocol unix,inet,inet6
4566 seccomp
4667 tracelog
4768
4970 private-bin mplayer,mpv,QMediathekView,smplayer,totem,vlc,xplayer
5071 private-cache
5172 private-dev
73 private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,login.defs,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl
5274 private-tmp
5375
5476 dbus-user none
5577 dbus-system none
5678
5779 #memory-deny-write-execute - breaks on Arch (see issue #1803)
80 restrict-namespaces
+1
-0
etc/profile-m-z/QOwnNotes.profile less more
5151 private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hosts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl
5252 private-tmp
5353
54 restrict-namespaces
+2
-0
etc/profile-m-z/Viber.profile less more
3333 private-bin awk,bash,dig,sh,Viber
3434 private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,mailcap,nsswitch.conf,pki,proxychains.conf,pulse,resolv.conf,ssl,X11
3535 private-tmp
36
37 # restrict-namespaces
+1
-0
etc/profile-m-z/XMind.profile less more
3434 private-tmp
3535 private-dev
3636
37 restrict-namespaces
+2
-0
etc/profile-m-z/Xephyr.profile less more
3939 private-dev
4040 # private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,nsswitch.conf,resolv.conf
4141 #private-tmp
42
43 restrict-namespaces
+2
-0
etc/profile-m-z/Xvfb.profile less more
4343 private-dev
4444 private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.preload,nsswitch.conf,resolv.conf
4545 private-tmp
46
47 restrict-namespaces
+2
-0
etc/profile-m-z/ZeGrapher.profile less more
4444
4545 dbus-user none
4646 dbus-system none
47
48 restrict-namespaces
+2
-0
etc/profile-m-z/macrofusion.profile less more
4141
4242 dbus-user none
4343 dbus-system none
44
45 restrict-namespaces
+2
-0
etc/profile-m-z/magicor.profile less more
4848
4949 dbus-user none
5050 dbus-system none
51
52 restrict-namespaces
+1
-0
etc/profile-m-z/makepkg.profile less more
5757 private-tmp
5858
5959 memory-deny-write-execute
60 restrict-namespaces
+1
-0
etc/profile-m-z/man.profile less more
6464 memory-deny-write-execute
6565 read-only ${HOME}
6666 #read-only /tmp # breaks mandoc (see #4927)
67 restrict-namespaces
+2
-0
etc/profile-m-z/manaplus.profile less more
4747
4848 dbus-user none
4949 dbus-system none
50
51 restrict-namespaces
+2
-0
etc/profile-m-z/marker.profile less more
5959 dbus-user.own com.github.fabiocolacio.marker
6060 dbus-user.talk ca.desrt.dconf
6161 dbus-system none
62
63 restrict-namespaces
+1
-0
etc/profile-m-z/masterpdfeditor.profile less more
3737 private-etc alternatives,fonts,ld.so.cache,ld.so.preload
3838 private-tmp
3939
40 restrict-namespaces
+1
-0
etc/profile-m-z/mate-calc.profile less more
4949 dbus-system none
5050
5151 memory-deny-write-execute
52 restrict-namespaces
+1
-0
etc/profile-m-z/mate-color-select.profile less more
3737 private-tmp
3838
3939 memory-deny-write-execute
40 restrict-namespaces
+1
-0
etc/profile-m-z/mate-dictionary.profile less more
4141 private-tmp
4242
4343 memory-deny-write-execute
44 restrict-namespaces
+2
-0
etc/profile-m-z/mcabber.profile less more
3030 private-bin mcabber
3131 private-dev
3232 private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,pki,ssl
33
34 restrict-namespaces
+1
-0
etc/profile-m-z/mcomix.profile less more
6969 read-write ${HOME}/.local/share
7070 # used by mcomix <= 1.2, tip, make a symbolic link to .cache/thumbnails
7171 read-write ${HOME}/.thumbnails
72 restrict-namespaces
+1
-0
etc/profile-m-z/mdr.profile less more
5151 dbus-system none
5252
5353 memory-deny-write-execute
54 restrict-namespaces
+1
-0
etc/profile-m-z/mediainfo.profile less more
4848 dbus-system none
4949
5050 memory-deny-write-execute
51 restrict-namespaces
+1
-0
etc/profile-m-z/mediathekview.profile less more
5050 private-dev
5151 private-tmp
5252
53 restrict-namespaces
+2
-0
etc/profile-m-z/megaglest.profile less more
5252
5353 dbus-user none
5454 dbus-system none
55
56 restrict-namespaces
+1
-0
etc/profile-m-z/meld.profile less more
7777 private-tmp
7878
7979 read-only ${HOME}/.ssh
80 restrict-namespaces
+2
-0
etc/profile-m-z/mendeleydesktop.profile less more
4646
4747 dbus-user none
4848 dbus-system none
49
50 restrict-namespaces
+1
-0
etc/profile-m-z/menulibre.profile less more
6060 read-write ${HOME}/.gnome/apps
6161 read-write ${HOME}/.local/share/applications
6262 read-write ${HOME}/.local/share/flatpak/exports
63 restrict-namespaces
+1
-0
etc/profile-m-z/meteo-qt.profile less more
5050 dbus-system none
5151
5252 memory-deny-write-execute
53 restrict-namespaces
+2
-0
etc/profile-m-z/midori.profile less more
6161
6262 disable-mnt
6363 private-tmp
64
65 restrict-namespaces
+1
-0
etc/profile-m-z/mindless.profile less more
4747 dbus-system none
4848
4949 memory-deny-write-execute
50 restrict-namespaces
+2
-0
etc/profile-m-z/minecraft-launcher.profile less more
5555
5656 dbus-user none
5757 dbus-system none
58
59 restrict-namespaces
+2
-0
etc/profile-m-z/minetest.profile less more
6060
6161 dbus-user none
6262 dbus-system none
63
64 restrict-namespaces
+2
-0
etc/profile-m-z/minitube.profile less more
5757
5858 dbus-user none
5959 dbus-system none
60
61 restrict-namespaces
+2
-0
etc/profile-m-z/mirage.profile less more
5757
5858 dbus-user none
5959 dbus-system none
60
61 restrict-namespaces
+2
-0
etc/profile-m-z/mirrormagic.profile less more
4747
4848 dbus-user none
4949 dbus-system none
50
51 restrict-namespaces
+1
-0
etc/profile-m-z/mocp.profile less more
4949 memory-deny-write-execute
5050 read-only ${HOME}
5151 read-write ${HOME}/.moc
52 restrict-namespaces
+2
-0
etc/profile-m-z/mousepad.profile less more
3636 private-dev
3737 private-lib
3838 private-tmp
39
40 restrict-namespaces
+2
-0
etc/profile-m-z/mp3splt-gtk.profile less more
4040
4141 dbus-user none
4242 dbus-system none
43
44 restrict-namespaces
+3
-2
etc/profile-m-z/mp3splt.profile less more
4545 private-etc alternatives,ld.so.cache,ld.so.preload
4646 private-tmp
4747
48 memory-deny-write-execute
49
5048 dbus-user none
5149 dbus-system none
50
51 memory-deny-write-execute
52 restrict-namespaces
+1
-0
etc/profile-m-z/mpDris2.profile less more
5454 #memory-deny-write-execute - breaks on Arch (see issue #1803)
5555
5656 read-only ${HOME}
57 restrict-namespaces
+1
-0
etc/profile-m-z/mpd.profile less more
4040 private-dev
4141 private-tmp
4242
43 restrict-namespaces
+1
-0
etc/profile-m-z/mpg123.profile less more
4141 dbus-system none
4242
4343 memory-deny-write-execute
44 restrict-namespaces
+2
-0
etc/profile-m-z/mplayer.profile less more
3636 private-bin mplayer
3737 private-dev
3838 private-tmp
39
40 restrict-namespaces
+1
-0
etc/profile-m-z/mpsyt.profile less more
6767
6868 dbus-user none
6969 dbus-system none
70 restrict-namespaces
+2
-0
etc/profile-m-z/mpv.profile less more
8585
8686 dbus-user none
8787 dbus-system none
88
89 restrict-namespaces
+2
-0
etc/profile-m-z/mrrescue.profile less more
5555
5656 dbus-user none
5757 dbus-system none
58
59 restrict-namespaces
+2
-0
etc/profile-m-z/ms-office.profile less more
3939
4040 dbus-user none
4141 dbus-system none
42
43 restrict-namespaces
+2
-0
etc/profile-m-z/mtpaint.profile less more
4545
4646 dbus-user none
4747 dbus-system none
48
49 restrict-namespaces
+1
-0
etc/profile-m-z/multimc5.profile less more
4848 private-dev
4949 private-tmp
5050
51 # restrict-namespaces
+1
-0
etc/profile-m-z/mumble.profile less more
4141 private-tmp
4242
4343 #memory-deny-write-execute - breaks on Arch (see issue #1803)
44 restrict-namespaces
+1
-0
etc/profile-m-z/mupdf.profile less more
4343
4444 memory-deny-write-execute
4545 read-only ${HOME}
46 restrict-namespaces
+2
-0
etc/profile-m-z/mupen64plus.profile less more
3030
3131 dbus-user none
3232 dbus-system none
33
34 restrict-namespaces
+2
-0
etc/profile-m-z/musescore.profile less more
3838
3939 # private-bin musescore,mscore
4040 private-tmp
41
42 # restrict-namespaces
+2
-0
etc/profile-m-z/musictube.profile less more
5353
5454 dbus-user none
5555 dbus-system none
56
57 restrict-namespaces
+1
-0
etc/profile-m-z/musixmatch.profile less more
3434 private-dev
3535 private-etc alternatives,asound.conf,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,machine-id,pki,pulse,ssl
3636
37 # restrict-namespaces
+1
-0
etc/profile-m-z/mutt.profile less more
145145 read-only ${HOME}/.nanorc
146146 read-only ${HOME}/.signature
147147 read-only ${HOME}/.w3m
148 restrict-namespaces
+2
-0
etc/profile-m-z/mypaint.profile less more
4646
4747 dbus-user none
4848 dbus-system none
49
50 restrict-namespaces
+1
-0
etc/profile-m-z/nano.profile less more
5555 dbus-system none
5656
5757 memory-deny-write-execute
58 restrict-namespaces
+2
-0
etc/profile-m-z/natron.profile less more
3333
3434 dbus-user none
3535 dbus-system none
36
37 restrict-namespaces
+1
-0
etc/profile-m-z/ncdu.profile less more
3434 dbus-system none
3535
3636 memory-deny-write-execute
37 restrict-namespaces
+2
-0
etc/profile-m-z/neochat.profile less more
6161 ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
6262 dbus-user.talk org.kde.kwalletd5
6363 dbus-system none
64
65 restrict-namespaces
+1
-0
etc/profile-m-z/neomutt.profile less more
128128 read-only ${HOME}/.nanorc
129129 read-only ${HOME}/.signature
130130 read-only ${HOME}/.w3m
131 restrict-namespaces
+1
-0
etc/profile-m-z/netactview.profile less more
5151 dbus-system none
5252
5353 memory-deny-write-execute
54 restrict-namespaces
+2
-0
etc/profile-m-z/nethack-vultures.profile less more
4141
4242 dbus-user none
4343 dbus-system none
44
45 #restrict-namespaces
+1
-0
etc/profile-m-z/nethack.profile less more
4343 dbus-system none
4444
4545 #memory-deny-write-execute
46 #restrict-namespaces
+2
-0
etc/profile-m-z/netsurf.profile less more
3131 tracelog
3232
3333 disable-mnt
34
35 restrict-namespaces
+2
-0
etc/profile-m-z/neverball.profile less more
4747
4848 dbus-user none
4949 dbus-system none
50
51 restrict-namespaces
+1
-0
etc/profile-m-z/newsboat.profile less more
5858 dbus-system none
5959
6060 memory-deny-write-execute
61 restrict-namespaces
+2
-0
etc/profile-m-z/newsflash.profile less more
5656 #dbus-user.own com.gitlab.newsflash
5757 #dbus-user.talk org.freedesktop.Notifications
5858 dbus-system none
59
60 restrict-namespaces
+2
-0
etc/profile-m-z/nextcloud.profile less more
6868 dbus-user.talk org.freedesktop.secrets
6969 ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
7070 dbus-system none
71
72 restrict-namespaces
+2
-0
etc/profile-m-z/nheko.profile less more
5555 # Add the next line to your nheko.local to enable notification support.
5656 #dbus-user.talk org.freedesktop.Notifications
5757 dbus-system none
58
59 restrict-namespaces
+2
-0
etc/profile-m-z/nicotine.profile less more
5858
5959 dbus-user none
6060 dbus-system none
61
62 restrict-namespaces
+1
-0
etc/profile-m-z/nitroshare.profile less more
4848 # dbus-system none
4949
5050 # memory-deny-write-execute
51 restrict-namespaces
+1
-0
etc/profile-m-z/nodejs-common.profile less more
9999
100100 # Add the next line to your nodejs-common.local if you prefer to disable gatsby telemetry.
101101 #env GATSBY_TELEMETRY_DISABLED=1
102 restrict-namespaces
+2
-0
etc/profile-m-z/nomacs.profile less more
4141 private-dev
4242 private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.preload,login.defs,machine-id,pki,resolv.conf,ssl
4343 private-tmp
44
45 restrict-namespaces
+1
-0
etc/profile-m-z/notify-send.profile less more
5656
5757 memory-deny-write-execute
5858 read-only ${HOME}
59 restrict-namespaces
+1
-0
etc/profile-m-z/nslookup.profile less more
5151 dbus-system none
5252
5353 memory-deny-write-execute
54 restrict-namespaces
+1
-0
etc/profile-m-z/nvim.profile less more
5050 read-write ${HOME}/.local/state/nvim
5151 read-write ${HOME}/.vim
5252 read-write ${HOME}/.vimrc
53 restrict-namespaces
+2
-0
etc/profile-m-z/nylas.profile less more
3434 seccomp
3535
3636 private-dev
37
38 restrict-namespaces
+2
-0
etc/profile-m-z/nyx.profile less more
5050
5151 dbus-user none
5252 dbus-system none
53
54 restrict-namespaces
+1
-0
etc/profile-m-z/obs.profile less more
3939 private-dev
4040 private-tmp
4141
42 restrict-namespaces
+2
-0
etc/profile-m-z/ocenaudio.profile less more
5858
5959 dbus-user none
6060 dbus-system none
61
62 restrict-namespaces
+1
-0
etc/profile-m-z/odt2txt.profile less more
4343 dbus-system none
4444
4545 read-only ${HOME}
46 restrict-namespaces
+1
-0
etc/profile-m-z/okular.profile less more
6868
6969 # memory-deny-write-execute
7070
71 restrict-namespaces
7172 join-or-start okular
+2
-0
etc/profile-m-z/onboard.profile less more
5252 private-tmp
5353
5454 dbus-system none
55
56 restrict-namespaces
+1
-0
etc/profile-m-z/onionshare-gui.profile less more
6464 dbus-system none
6565
6666 memory-deny-write-execute
67 restrict-namespaces
+2
-0
etc/profile-m-z/open-invaders.profile less more
3838
3939 dbus-user none
4040 dbus-system none
41
42 restrict-namespaces
+2
-0
etc/profile-m-z/openarena.profile less more
4646
4747 dbus-user none
4848 dbus-system none
49
50 restrict-namespaces
+2
-1
etc/profile-m-z/openbox.profile less more
1313 netfilter
1414 noroot
1515 protocol unix,inet,inet6
16 seccomp
16 seccomp !chroot
1717
1818 read-only ${HOME}/.config/openbox/autostart
1919 read-only ${HOME}/.config/openbox/environment
20 #restrict-namespaces
+2
-0
etc/profile-m-z/opencity.profile less more
4444
4545 dbus-user none
4646 dbus-system none
47
48 restrict-namespaces
+2
-0
etc/profile-m-z/openclonk.profile less more
4444
4545 dbus-user none
4646 dbus-system none
47
48 restrict-namespaces
+2
-0
etc/profile-m-z/openmw.profile less more
5757
5858 dbus-user none
5959 dbus-system none
60
61 restrict-namespaces
+2
-0
etc/profile-m-z/openshot.profile less more
4545
4646 dbus-user filter
4747 dbus-system none
48
49 restrict-namespaces
+2
-0
etc/profile-m-z/openstego.profile less more
5454
5555 dbus-user none
5656 dbus-system none
57
58 restrict-namespaces
+2
-0
etc/profile-m-z/openttd.profile less more
4444
4545 dbus-user none
4646 dbus-system none
47
48 restrict-namespaces
+1
-0
etc/profile-m-z/orage.profile less more
3535 private-dev
3636 private-tmp
3737
38 restrict-namespaces
+2
-0
etc/profile-m-z/ostrichriders.profile less more
4646
4747 dbus-user none
4848 dbus-system none
49
50 restrict-namespaces
+2
-0
etc/profile-m-z/otter-browser.profile less more
5555 private-tmp
5656
5757 dbus-system none
58
59 # restrict-namespaces
+3
-0
etc/profile-m-z/palemoon.profile less more
2121 #private-etc palemoon
2222 #private-opt palemoon
2323
24 restrict-namespaces
25 ignore restrict-namespaces
26
2427 # Redirect
2528 include firefox-common.profile
+1
-0
etc/profile-m-z/pandoc.profile less more
5555 dbus-system none
5656
5757 memory-deny-write-execute
58 restrict-namespaces
+2
-0
etc/profile-m-z/parole.profile less more
2626 private-bin dbus-launch,parole
2727 private-cache
2828 private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd,pki,pulse,ssl
29
30 restrict-namespaces
+1
-0
etc/profile-m-z/patch.profile less more
4747 dbus-system none
4848
4949 memory-deny-write-execute
50 restrict-namespaces
+1
-0
etc/profile-m-z/pavucontrol.profile less more
5252
5353 # mdwe is broken under Wayland, but works under Xorg.
5454 #memory-deny-write-execute
55 restrict-namespaces
+2
-0
etc/profile-m-z/pcsxr.profile less more
5252
5353 dbus-user none
5454 dbus-system none
55
56 restrict-namespaces
+1
-0
etc/profile-m-z/pdfchain.profile less more
3939 dbus-system none
4040
4141 memory-deny-write-execute
42 restrict-namespaces
+2
-0
etc/profile-m-z/pdfmod.profile less more
4040
4141 dbus-user none
4242 dbus-system none
43
44 restrict-namespaces
+2
-0
etc/profile-m-z/pdfsam.profile less more
4040
4141 dbus-user none
4242 dbus-system none
43
44 restrict-namespaces
+2
-0
etc/profile-m-z/pdftotext.profile less more
5252
5353 dbus-user none
5454 dbus-system none
55
56 restrict-namespaces
+1
-0
etc/profile-m-z/peek.profile less more
5858 dbus-system none
5959
6060 memory-deny-write-execute
61 restrict-namespaces
+2
-0
etc/profile-m-z/penguin-command.profile less more
3838
3939 dbus-user none
4040 dbus-system none
41
42 restrict-namespaces
+2
-0
etc/profile-m-z/photoflare.profile less more
4646
4747 dbus-user none
4848 dbus-system none
49
50 restrict-namespaces
+1
-0
etc/profile-m-z/picard.profile less more
3939 private-dev
4040 private-tmp
4141
42 restrict-namespaces
+2
-0
etc/profile-m-z/pidgin.profile less more
4444 private-cache
4545 private-dev
4646 private-tmp
47
48 restrict-namespaces
+2
-0
etc/profile-m-z/pinball.profile less more
5151
5252 dbus-user none
5353 dbus-system none
54
55 restrict-namespaces
+1
-0
etc/profile-m-z/ping-hardened.inc.profile less more
88 seccomp
99
1010 memory-deny-write-execute
11 restrict-namespaces
+1
-0
etc/profile-m-z/ping.profile less more
6767 dbus-system none
6868
6969 read-only ${HOME}
70 #restrict-namespaces
+2
-0
etc/profile-m-z/pingus.profile less more
5353
5454 dbus-user none
5555 dbus-system none
56
57 restrict-namespaces
+2
-0
etc/profile-m-z/pinta.profile less more
3737
3838 dbus-user none
3939 dbus-system none
40
41 restrict-namespaces
+2
-0
etc/profile-m-z/pioneer.profile less more
4343
4444 dbus-user none
4545 dbus-system none
46
47 restrict-namespaces
+1
-0
etc/profile-m-z/pithos.profile less more
3939 private-dev
4040 private-tmp
4141
42 restrict-namespaces
+1
-0
etc/profile-m-z/pitivi.profile less more
3838 private-dev
3939 private-tmp
4040
41 restrict-namespaces
+2
-0
etc/profile-m-z/pix.profile less more
3333 private-cache
3434 private-dev
3535 private-tmp
36
37 restrict-namespaces
+1
-0
etc/profile-m-z/pkglog.profile less more
5555 read-only /var/log/apt/history.log
5656 read-only /var/log/dnf.rpm.log
5757 read-only /var/log/pacman.log
58 restrict-namespaces
+1
-0
etc/profile-m-z/pluma.profile less more
4747 # dbus-user none
4848 # dbus-system none
4949
50 restrict-namespaces
5051 join-or-start pluma
+1
-0
etc/profile-m-z/plv.profile less more
5656 read-only ${HOME}
5757 read-write ${HOME}/.config/PacmanLogViewer
5858 read-only /var/log/pacman.log
59 restrict-namespaces
+1
-0
etc/profile-m-z/pngquant.profile less more
5252 dbus-system none
5353
5454 memory-deny-write-execute
55 restrict-namespaces
+1
-0
etc/profile-m-z/polari.profile less more
4848 private-dev
4949 private-tmp
5050
51 restrict-namespaces
+2
-0
etc/profile-m-z/ppsspp.profile less more
4747
4848 dbus-user none
4949 dbus-system none
50
51 restrict-namespaces
+1
-0
etc/profile-m-z/pragha.profile less more
3434 private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg
3535 private-tmp
3636
37 restrict-namespaces
+1
-0
etc/profile-m-z/profanity.profile less more
4949 dbus-system none
5050
5151 memory-deny-write-execute
52 restrict-namespaces
+2
-0
etc/profile-m-z/psi-plus.profile less more
4141 disable-mnt
4242 private-dev
4343 private-tmp
44
45 # restrict-namespaces
+2
-0
etc/profile-m-z/psi.profile less more
7474
7575 dbus-user none
7676 dbus-system none
77
78 #restrict-namespaces
+1
-0
etc/profile-m-z/pybitmessage.profile less more
4242 private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,hosts,ld.so.cache,ld.so.preload,localtime,pki,pki,PyBitmessage,PyBitmessage.conf,resolv.conf,selinux,sni-qt.conf,ssl,system-fips,Trolltech.conf,xdg
4343 private-tmp
4444
45 restrict-namespaces
+1
-0
etc/profile-m-z/qbittorrent.profile less more
6262 dbus-system none
6363
6464 # memory-deny-write-execute - problems on Arch, see #1690 on GitHub repo
65 restrict-namespaces
+1
-0
etc/profile-m-z/qcomicbook.profile less more
6363 read-write ${HOME}/.local/share/PawelStolowski
6464 #to allow ${HOME}/.local/share/recently-used.xbel
6565 read-write ${HOME}/.local/share
66 restrict-namespaces
+1
-0
etc/profile-m-z/qemu-launcher.profile less more
2424 private-tmp
2525
2626 noexec /tmp
27 restrict-namespaces
+1
-0
etc/profile-m-z/qemu-system-x86_64.profile less more
2323 private-tmp
2424
2525 noexec /tmp
26 restrict-namespaces
+2
-0
etc/profile-m-z/qgis.profile less more
5555
5656 dbus-user none
5757 dbus-system none
58
59 restrict-namespaces
+1
-0
etc/profile-m-z/qlipper.profile less more
3434 private-dev
3535 private-tmp
3636
37 restrict-namespaces
+2
-0
etc/profile-m-z/qmmp.profile less more
3535
3636 dbus-user none
3737 dbus-system none
38
39 restrict-namespaces
+2
-0
etc/profile-m-z/qnapi.profile less more
5151
5252 dbus-user none
5353 dbus-system none
54
55 restrict-namespaces
+2
-0
etc/profile-m-z/qpdfview.profile less more
4242 # needs D-Bus when started from a file manager
4343 # dbus-user none
4444 # dbus-system none
45
46 restrict-namespaces
+11
-0
etc/profile-m-z/qq.profile less more
0 # Firejail profile for qq
1 # Description: IM client based on Electron
2 # This file is overwritten after every install/update
3 # Persistent local customizations
4 include qq.local
5 # Persistent global definitions
6 # added by included profile
7 #include globals.local
8
9 # Redirect
10 include linuxqq.profile
+1
-0
etc/profile-m-z/qrencode.profile less more
5353 dbus-system none
5454
5555 memory-deny-write-execute
56 restrict-namespaces
+1
-0
etc/profile-m-z/qtox.profile less more
4848 dbus-system none
4949
5050 #memory-deny-write-execute - breaks on Arch (see issue #1803)
51 restrict-namespaces
+2
-0
etc/profile-m-z/quassel.profile less more
2323
2424 private-cache
2525 private-tmp
26
27 # restrict-namespaces
+2
-0
etc/profile-m-z/quaternion.profile less more
5050
5151 dbus-user none
5252 dbus-system none
53
54 restrict-namespaces
+1
-0
etc/profile-m-z/quiterss.profile less more
5151 private-dev
5252 # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl,X11
5353
54 restrict-namespaces
+2
-0
etc/profile-m-z/quodlibet.profile less more
6262 private-tmp
6363
6464 dbus-system none
65
66 restrict-namespaces
+3
-1
etc/profile-m-z/qutebrowser.profile less more
4747 protocol unix,inet,inet6,netlink
4848 # blacklisting of chroot system calls breaks qt webengine
4949 seccomp !chroot,!name_to_handle_at
50 # tracelog
50 #tracelog
5151
5252 disable-mnt
5353 private-cache
6464 # with the above lines (might depend on the portal implementation).
6565 #ignore noroot
6666 dbus-system none
67
68 #restrict-namespaces
+1
-0
etc/profile-m-z/raincat.profile less more
4545 dbus-user none
4646 dbus-system none
4747
48 restrict-namespaces
+3
-1
etc/profile-m-z/rambox.profile less more
3434 # electron-based application, needing chroot
3535 #seccomp
3636 seccomp !chroot
37 # tracelog
37 #tracelog
38
39 #restrict-namespaces
+2
-0
etc/profile-m-z/redeclipse.profile less more
4444
4545 dbus-user none
4646 dbus-system none
47
48 restrict-namespaces
+2
-0
etc/profile-m-z/rednotebook.profile less more
6262
6363 dbus-user none
6464 dbus-system none
65
66 restrict-namespaces
+1
-0
etc/profile-m-z/redshift.profile less more
4949 dbus-system none
5050
5151 memory-deny-write-execute
52 restrict-namespaces
+1
-0
etc/profile-m-z/regextester.profile less more
5151
5252 # never write anything
5353 read-only ${HOME}
54 restrict-namespaces
+1
-0
etc/profile-m-z/remmina.profile less more
4141 private-dev
4242 private-tmp
4343
44 restrict-namespaces
+2
-0
etc/profile-m-z/retroarch.profile less more
5050
5151 dbus-user none
5252 dbus-system none
53
54 restrict-namespaces
+2
-0
etc/profile-m-z/rhythmbox.profile less more
6262 dbus-user.talk org.gnome.SettingsDaemon.MediaKeys
6363 dbus-system filter
6464 dbus-system.talk org.freedesktop.Avahi
65
66 restrict-namespaces
+1
-0
etc/profile-m-z/ricochet.profile less more
3838 private-dev
3939 #private-etc alternatives,alternatives,ca-certificates,crypto-policies,fonts,pki,ssl,tor,X11
4040
41 restrict-namespaces
+2
-0
etc/profile-m-z/ripperx.profile less more
3939
4040 dbus-user none
4141 dbus-system none
42
43 restrict-namespaces
+1
-0
etc/profile-m-z/ristretto.profile less more
3838 private-dev
3939 private-tmp
4040
41 restrict-namespaces
+2
-0
etc/profile-m-z/rpcs3.profile less more
5858
5959 dbus-user none
6060 dbus-system none
61
62 restrict-namespaces
+1
-0
etc/profile-m-z/rsync-download_only.profile less more
5454 dbus-system none
5555
5656 memory-deny-write-execute
57 restrict-namespaces
+1
-0
etc/profile-m-z/rtin.profile less more
44 # Persistent local customizations
55 include rtin.local
66
7 # Redirect
78 include tin.profile
+2
-0
etc/profile-m-z/rtorrent.profile less more
3030 private-cache
3131 private-dev
3232 private-tmp
33
34 restrict-namespaces
+2
-0
etc/profile-m-z/rtv.profile less more
6161
6262 dbus-user none
6363 dbus-system none
64
65 restrict-namespaces
+1
-0
etc/profile-m-z/sayonara.profile less more
3232 private-dev
3333 private-tmp
3434
35 restrict-namespaces
+2
-0
etc/profile-m-z/scallion.profile less more
4040
4141 dbus-user none
4242 dbus-system none
43
44 restrict-namespaces
+2
-0
etc/profile-m-z/scorched3d.profile less more
4646
4747 dbus-user none
4848 dbus-system none
49
50 restrict-namespaces
+2
-0
etc/profile-m-z/scorchwentbonkers.profile less more
4646
4747 dbus-user none
4848 dbus-system none
49
50 restrict-namespaces
+2
-0
etc/profile-m-z/scribus.profile less more
6060
6161 dbus-user none
6262 dbus-system none
63
64 restrict-namespaces
+2
-0
etc/profile-m-z/sdat2img.profile less more
4040
4141 dbus-user none
4242 dbus-system none
43
44 restrict-namespaces
+2
-0
etc/profile-m-z/seafile-applet.profile less more
5858
5959 dbus-user none
6060 dbus-system none
61
62 restrict-namespaces
+2
-0
etc/profile-m-z/seahorse-adventures.profile less more
5151
5252 dbus-user none
5353 dbus-system none
54
55 restrict-namespaces
+3
-0
etc/profile-m-z/seahorse-daemon.profile less more
77 # added by included profile
88 #include globals.local
99
10 blacklist ${RUNUSER}/wayland-*
11 include disable-X11.inc
12
1013 memory-deny-write-execute
1114
1215 # Redirect
+0
-4
etc/profile-m-z/seahorse-tool.profile less more
66 # added by included profile
77 #include globals.local
88
9 # private-etc workaround for: #2877
10 private-etc alternatives,firejail,ld.so.cache,ld.so.preload,login.defs,passwd
11 private-tmp
12
139 # Redirect
1410 include seahorse.profile
+5
-3
etc/profile-m-z/seahorse.profile less more
44 include seahorse.local
55 # Persistent global definitions
66 include globals.local
7
8 blacklist /tmp/.X11-unix
97
108 noblacklist ${HOME}/.gnupg
119
5856 disable-mnt
5957 private-cache
6058 private-dev
61 private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssh,ssl,X11
59 private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,login.defs,nsswitch.conf,pango,passwd,pkcs11,pki,protocols,resolv.conf,rpc,services,ssh,ssl,xdg
60 private-tmp
6261 writable-run-user
6362
6463 dbus-user filter
6564 dbus-user.own org.gnome.seahorse
6665 dbus-user.own org.gnome.seahorse.Application
66 dbus-user.talk ca.desrt.dconf
6767 dbus-user.talk org.freedesktop.secrets
6868 dbus-system none
69
70 restrict-namespaces
+2
-0
etc/profile-m-z/seamonkey.profile less more
5656 disable-mnt
5757 # private-etc adobe,alternatives,asound.conf,ca-certificates,crypto-policies,firefox,fonts,group,gtk-2.0,hostname,hosts,iceweasel,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,ssl
5858 writable-run-user
59
60 restrict-namespaces
+4
-4
etc/profile-m-z/server.profile less more
8282 # private-lib
8383 # private-opt none
8484 private-tmp
85 # writable-run-user
86 # writable-var
87 # writable-var-log
8588
8689 dbus-user none
8790 # dbus-system none
8992 # deterministic-shutdown
9093 # memory-deny-write-execute
9194 # read-only ${HOME}
92 # restrict-namespaces
93 # writable-run-user
94 # writable-var
95 # writable-var-log
95 restrict-namespaces
+2
-0
etc/profile-m-z/servo.profile less more
4545
4646 dbus-user none
4747 dbus-system none
48
49 restrict-namespaces
+2
-0
etc/profile-m-z/shellcheck.profile less more
4848
4949 dbus-user none
5050 dbus-system none
51
52 restrict-namespaces
+2
-0
etc/profile-m-z/shortwave.profile less more
4646 private-dev
4747 private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gconf,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,ssl,X11,xdg
4848 private-tmp
49
50 restrict-namespaces
+2
-0
etc/profile-m-z/shotcut.profile less more
3434
3535 dbus-user none
3636 dbus-system none
37
38 restrict-namespaces
+2
-0
etc/profile-m-z/shotwell.profile less more
5656 dbus-user.talk ca.desrt.dconf
5757 dbus-user.talk org.gtk.vfs.UDisks2VolumeMonitor
5858 dbus-system none
59
60 restrict-namespaces
+2
-0
etc/profile-m-z/signal-cli.profile less more
4747 # Does not work with all Java configurations. You will notice immediately, so you might want to give it a try
4848 #private-etc alternatives,ca-certificates,crypto-policies,dbus-1,host.conf,hostname,hosts,java-10-openjdk,java-7-openjdk,java-8-openjdk,java-9-openjdk,java.conf,machine-id,nsswitch.conf,passwd,pki,protocols,resolv.conf,rpc,services,ssl
4949 private-tmp
50
51 restrict-namespaces
+1
-0
etc/profile-m-z/silentarmy.profile less more
3636 private-opt none
3737 private-tmp
3838
39 restrict-namespaces
+2
-0
etc/profile-m-z/simple-scan.profile less more
3737 # private-dev
3838 # private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl
3939 # private-tmp
40
41 restrict-namespaces
+2
-0
etc/profile-m-z/simplescreenrecorder.profile less more
3535 private-cache
3636 private-dev
3737 private-tmp
38
39 restrict-namespaces
+2
-0
etc/profile-m-z/simutrans.profile less more
3838
3939 dbus-user none
4040 dbus-system none
41
42 restrict-namespaces
+2
-0
etc/profile-m-z/skanlite.profile less more
3232
3333 # dbus-user none
3434 # dbus-system none
35
36 restrict-namespaces
+1
-0
etc/profile-m-z/slashem.profile less more
4343 dbus-system none
4444
4545 #memory-deny-write-execute
46 #restrict-namespaces
+2
-0
etc/profile-m-z/smplayer.profile less more
5151 # problems with KDE
5252 # dbus-user none
5353 # dbus-system none
54
55 restrict-namespaces
+1
-0
etc/profile-m-z/smtube.profile less more
4444 private-dev
4545 private-tmp
4646
47 restrict-namespaces
+2
-0
etc/profile-m-z/smuxi-frontend-gnome.profile less more
5151
5252 dbus-user none
5353 dbus-system none
54
55 restrict-namespaces
+2
-0
etc/profile-m-z/softmaker-common.profile less more
4646
4747 dbus-user none
4848 dbus-system none
49
50 restrict-namespaces
+1
-0
etc/profile-m-z/sol.profile less more
4343 dbus-system none
4444
4545 # memory-deny-write-execute
46 restrict-namespaces
+2
-0
etc/profile-m-z/songrec.profile less more
5050
5151 dbus-user none
5252 dbus-system none
53
54 restrict-namespaces
+2
-0
etc/profile-m-z/sound-juicer.profile less more
3939
4040 # dbus-user none
4141 # dbus-system none
42
43 restrict-namespaces
+1
-0
etc/profile-m-z/soundconverter.profile less more
4646 private-dev
4747 private-tmp
4848
49 restrict-namespaces
+2
-0
etc/profile-m-z/spectacle.profile less more
6464 #dbus-user.talk org.kde.JobViewServer
6565 #dbus-user.talk org.kde.kglobalaccel
6666 dbus-system none
67
68 restrict-namespaces
+2
-0
etc/profile-m-z/spectral.profile less more
5252 # Add the next line to your spectral.local to enable notification support.
5353 #dbus-user.talk org.freedesktop.Notifications
5454 dbus-system none
55
56 restrict-namespaces
+3
-1
etc/profile-m-z/spectre-meltdown-checker.profile less more
99
1010 noblacklist ${PATH}/mount
1111 noblacklist ${PATH}/umount
12 noblacklist /proc/config.gz
1213
1314 # Allow perl (blacklisted by disable-interpreters.inc)
1415 include allow-perl.inc
4041
4142 disable-mnt
4243 private
43 private-bin awk,bzip2,cat,coreos-install,cpucontrol,cut,dd,dirname,dmesg,dnf,echo,grep,gunzip,gz,gzip,head,id,kldload,kldstat,liblz4-tool,lzop,mktemp,modinfo,modprobe,mount,nm,objdump,od,perl,printf,readelf,rm,sed,seq,sh,sort,spectre-meltdown-checker,spectre-meltdown-checker.sh,stat,strings,sysctl,tail,test,toolbox,tr,uname,which,xz-utils
44 private-bin awk,basename,bzip2,cat,coreos-install,cpucontrol,cut,dd,dirname,dmesg,dnf,echo,grep,gunzip,gz,gzip,head,id,kldload,kldstat,liblz4-tool,lzop,mktemp,modinfo,modprobe,mount,nm,objdump,od,perl,printf,ps,readelf,rm,sed,seq,sh,sort,spectre-meltdown-checker,spectre-meltdown-checker.sh,stat,strings,sysctl,tail,test,toolbox,tr,uname,unzstd,which,xz-utils
4445 private-cache
4546 private-tmp
4647
4849 dbus-system none
4950
5051 memory-deny-write-execute
52 restrict-namespaces
+2
-0
etc/profile-m-z/spotify.profile less more
5252 # dbus needed for MPRIS
5353 # dbus-user none
5454 # dbus-system none
55
56 restrict-namespaces
+1
-0
etc/profile-m-z/sqlitebrowser.profile less more
4848 # dbus-system none
4949
5050 #memory-deny-write-execute - breaks on Arch (see issue #1803)
51 restrict-namespaces
+2
-0
etc/profile-m-z/ssh-agent.profile less more
3232
3333 dbus-user none
3434 dbus-system none
35
36 restrict-namespaces
+1
-0
etc/profile-m-z/ssh.profile less more
5050
5151 deterministic-shutdown
5252 memory-deny-write-execute
53 restrict-namespaces
+75
-0
etc/profile-m-z/ssmtp.profile less more
0 # Firejail profile for ssmtp
1 # Description: Extremely simple MTA to get mail off the system to a mailhub
2 # This file is overwritten after every install/update
3 quiet
4 # Persistent local customizations
5 include ssmtp.local
6 # Persistent global definitions
7 include globals.local
8
9 blacklist ${RUNUSER}
10 blacklist /usr/libexec
11
12 noblacklist /etc/logcheck
13 noblacklist /etc/ssmtp
14 noblacklist /sbin
15 noblacklist /usr/sbin
16
17 noblacklist ${DOCUMENTS}
18 include disable-common.inc
19 include disable-devel.inc
20 include disable-exec.inc
21 include disable-interpreters.inc
22 include disable-proc.inc
23 include disable-programs.inc
24 include disable-shell.inc
25 include disable-xdg.inc
26 include disable-X11.inc
27
28 mkfile ${HOME}/dead.letter
29 whitelist ${HOME}/dead.letter
30 whitelist ${DOCUMENTS}
31 whitelist ${DOWNLOADS}
32 include whitelist-common.inc
33 include whitelist-run-common.inc
34 include whitelist-runuser-common.inc
35 include whitelist-usr-share-common.inc
36 include whitelist-var-common.inc
37
38 apparmor
39 caps.drop all
40 ipc-namespace
41 machine-id
42 netfilter
43 no3d
44 nodvd
45 #nogroups breaks app
46 noinput
47 nonewprivs
48 noprinters
49 #noroot breaks app
50 nosound
51 notv
52 nou2f
53 novideo
54 protocol unix,inet,inet6
55 seccomp
56 seccomp.block-secondary
57 tracelog
58
59 disable-mnt
60 # private works but then we lose ${HOME}/dead.letter
61 # which is useful to get notified on mail issues
62 #private
63 private-bin mailq,newaliases,sendmail,ssmtp
64 private-cache
65 private-dev
66 private-tmp
67
68 dbus-user none
69 dbus-system none
70
71 memory-deny-write-execute
72 restrict-namespaces
73 read-only ${HOME}
74 read-write ${HOME}/dead.letter
+2
-0
etc/profile-m-z/standardnotes-desktop.profile less more
4141
4242 dbus-user none
4343 dbus-system none
44
45 # restrict-namespaces
+3
-2
etc/profile-m-z/steam.profile less more
177177 private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,lsb-release,machine-id,mime.types,nvidia,os-release,passwd,pki,pulse,resolv.conf,services,ssl,vulkan
178178 private-tmp
179179
180 # dbus-user none
181 # dbus-system none
180 #dbus-user none
181 #dbus-system none
182182
183183 read-only ${HOME}/.config/MangoHud
184 #restrict-namespaces
+1
-0
etc/profile-m-z/stellarium.profile less more
4242 private-dev
4343 private-tmp
4444
45 restrict-namespaces
+2
-0
etc/profile-m-z/strawberry.profile less more
4545 private-tmp
4646
4747 dbus-system none
48
49 restrict-namespaces
+1
-0
etc/profile-m-z/strings.profile less more
5353
5454 memory-deny-write-execute
5555 read-only ${HOME}
56 restrict-namespaces
+1
-0
etc/profile-m-z/subdownloader.profile less more
4949 dbus-system none
5050
5151 #memory-deny-write-execute - breaks on Arch (see issue #1803)
52 restrict-namespaces
+2
-0
etc/profile-m-z/supertux2.profile less more
4848
4949 dbus-user none
5050 dbus-system none
51
52 restrict-namespaces
+2
-0
etc/profile-m-z/supertuxkart.profile less more
5959
6060 dbus-user none
6161 dbus-system none
62
63 restrict-namespaces
+1
-0
etc/profile-m-z/surf.profile less more
3535 private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,ld.so.cache,ld.so.preload,machine-id,passwd,pki,resolv.conf,ssl
3636 private-tmp
3737
38 restrict-namespaces
+1
-0
etc/profile-m-z/sushi.profile less more
4444 read-only /run/mount
4545 read-only /run/media
4646 read-only ${HOME}
47 restrict-namespaces
+2
-0
etc/profile-m-z/sway.profile less more
1616 noroot
1717 protocol unix,inet,inet6
1818 seccomp
19
20 restrict-namespaces
+0
-7
etc/profile-m-z/sylpheed.profile less more
1414
1515 # private-bin curl,gpg,gpg2,gpg-agent,gpgsm,pinentry,pinentry-gtk-2,sylpheed
1616
17 dbus-user filter
18 dbus-user.talk ca.desrt.dconf
19 dbus-user.talk org.freedesktop.secrets
20 dbus-user.talk org.gnome.keyring.SystemPrompter
21 # Add the next line to your sylpheed.local to enable notifications.
22 # dbus-user.talk org.freedesktop.Notifications
23
2417 # Redirect
2518 include email-common.profile
+2
-0
etc/profile-m-z/synfigstudio.profile less more
3535
3636 dbus-user none
3737 dbus-system none
38
39 restrict-namespaces
+1
-0
etc/profile-m-z/sysprof.profile less more
7373 dbus-user.talk ca.desrt.dconf
7474
7575 # memory-deny-write-execute - breaks on Arch
76 restrict-namespaces
+1
-0
etc/profile-m-z/tcpdump.profile less more
4343 private-tmp
4444
4545 memory-deny-write-execute
46 restrict-namespaces
+1
-0
etc/profile-m-z/teamspeak3.profile less more
3838 private-dev
3939 private-tmp
4040
41 # restrict-namespaces
+2
-0
etc/profile-m-z/teeworlds.profile less more
4242
4343 dbus-user none
4444 dbus-system none
45
46 restrict-namespaces
+2
-0
etc/profile-m-z/telegram.profile less more
5555 dbus-user.talk org.gnome.Mutter.IdleMonitor
5656 dbus-user.talk org.freedesktop.ScreenSaver
5757 dbus-system none
58
59 restrict-namespaces
+1
-0
etc/profile-m-z/telnet.profile less more
5050
5151 memory-deny-write-execute
5252 noexec ${HOME}
53 restrict-namespaces
+2
-0
etc/profile-m-z/terasology.profile less more
4444
4545 dbus-user none
4646 dbus-system none
47
48 restrict-namespaces
+1
-0
etc/profile-m-z/tilp.profile less more
3131 private-etc alternatives,fonts,ld.so.cache,ld.so.preload
3232 private-tmp
3333
34 restrict-namespaces
+1
-0
etc/profile-m-z/tin.profile less more
6464 dbus-system none
6565
6666 memory-deny-write-execute
67 restrict-namespaces
+2
-0
etc/profile-m-z/tmux.profile less more
4141
4242 dbus-user none
4343 dbus-system none
44
45 restrict-namespaces
+2
-0
etc/profile-m-z/tor.profile less more
4747 private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,passwd,pki,ssl,tor
4848 private-tmp
4949 writable-var
50
51 restrict-namespaces
+2
-0
etc/profile-m-z/torbrowser-launcher.profile less more
6262
6363 dbus-user none
6464 dbus-system none
65
66 #restrict-namespaces
+2
-0
etc/profile-m-z/torcs.profile less more
4444
4545 dbus-user none
4646 dbus-system none
47
48 restrict-namespaces
+2
-0
etc/profile-m-z/totem.profile less more
5656 # makes settings immutable
5757 # dbus-user none
5858 dbus-system none
59
60 restrict-namespaces
+2
-0
etc/profile-m-z/tracker.profile less more
3535 # private-bin tracker
3636 # private-dev
3737 # private-tmp
38
39 restrict-namespaces
+1
-0
etc/profile-m-z/transgui.profile less more
5151 dbus-system none
5252
5353 memory-deny-write-execute
54 restrict-namespaces
+1
-0
etc/profile-m-z/transmission-common.profile less more
4949 dbus-system none
5050
5151 memory-deny-write-execute
52 restrict-namespaces
+2
-0
etc/profile-m-z/tremulous.profile less more
4949
5050 dbus-user none
5151 dbus-system none
52
53 restrict-namespaces
+1
-0
etc/profile-m-z/trojita.profile less more
6060 dbus-system none
6161
6262 read-only ${HOME}/.mozilla/firefox/profiles.ini
63 restrict-namespaces
+1
-0
etc/profile-m-z/truecraft.profile less more
3535 private-dev
3636 private-tmp
3737
38 restrict-namespaces
+2
-0
etc/profile-m-z/tuxguitar.profile less more
4242
4343 private-dev
4444 private-tmp
45
46 restrict-namespaces
+2
-0
etc/profile-m-z/tvbrowser.profile less more
4949
5050 dbus-user none
5151 dbus-system none
52
53 restrict-namespaces
+2
-0
etc/profile-m-z/udiskie.profile less more
4141 private-dev
4242 private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,xdg
4343 private-tmp
44
45 restrict-namespaces
+2
-0
etc/profile-m-z/uefitool.profile less more
3535
3636 dbus-user none
3737 dbus-system none
38
39 restrict-namespaces
+2
-0
etc/profile-m-z/uget-gtk.profile less more
3535 private-bin uget-gtk
3636 private-dev
3737 private-tmp
38
39 restrict-namespaces
+1
-0
etc/profile-m-z/unbound.profile less more
5151 dbus-system none
5252
5353 memory-deny-write-execute
54 restrict-namespaces
+1
-0
etc/profile-m-z/unf.profile less more
5555 dbus-system none
5656
5757 memory-deny-write-execute
58 restrict-namespaces
+1
-0
etc/profile-m-z/unknown-horizons.profile less more
4040
4141 # doesn't work - maybe all Tcl/Tk programs have this problem
4242 # memory-deny-write-execute
43 restrict-namespaces
+1
-0
etc/profile-m-z/utox.profile less more
4545 private-tmp
4646
4747 memory-deny-write-execute
48 restrict-namespaces
+2
-0
etc/profile-m-z/uudeview.profile less more
4343
4444 dbus-user none
4545 dbus-system none
46
47 restrict-namespaces
+2
-0
etc/profile-m-z/uzbl-browser.profile less more
3838 protocol unix,inet,inet6
3939 seccomp
4040 tracelog
41
42 restrict-namespaces
+1
-0
etc/profile-m-z/viewnior.profile less more
4949 dbus-system none
5050
5151 #memory-deny-write-execute - breaks on Arch (see issues #1803 and #1808)
52 restrict-namespaces
+1
-0
etc/profile-m-z/viking.profile less more
3333 private-dev
3434 private-tmp
3535
36 restrict-namespaces
+2
-0
etc/profile-m-z/vim.profile less more
3131 seccomp
3232
3333 private-dev
34
35 restrict-namespaces
+2
-0
etc/profile-m-z/vlc.profile less more
5252 ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
5353 dbus-user.talk org.mpris.MediaPlayer2.Player
5454 dbus-system none
55
56 restrict-namespaces
+2
-0
etc/profile-m-z/vmware-view.profile less more
5353
5454 dbus-user none
5555 dbus-system none
56
57 restrict-namespaces
+1
-0
etc/profile-m-z/vym.profile less more
3232 private-dev
3333 private-tmp
3434
35 restrict-namespaces
+1
-0
etc/profile-m-z/w3m.profile less more
6767 dbus-system none
6868
6969 memory-deny-write-execute
70 restrict-namespaces
+2
-0
etc/profile-m-z/warmux.profile less more
5252
5353 dbus-user none
5454 dbus-system none
55
56 restrict-namespaces
+2
-0
etc/profile-m-z/warsow.profile less more
5353
5454 dbus-user none
5555 dbus-system none
56
57 restrict-namespaces
+2
-0
etc/profile-m-z/warzone2100.profile less more
4646 private-bin bash,dash,sh,warzone2100,which
4747 private-dev
4848 private-tmp
49
50 restrict-namespaces
+2
-0
etc/profile-m-z/webstorm.profile less more
4141 private-cache
4242 private-dev
4343 private-tmp
44
45 restrict-namespaces
+2
-0
etc/profile-m-z/webui-aria2.profile less more
3535
3636 dbus-user none
3737 dbus-system none
38
39 restrict-namespaces
+2
-0
etc/profile-m-z/weechat.profile less more
2727 # no private-bin support for various reasons:
2828 # Plugins loaded: alias, aspell, charset, exec, fifo, guile, irc,
2929 # logger, lua, perl, python, relay, ruby, script, tcl, trigger, xferloading plugins
30
31 restrict-namespaces
+2
-0
etc/profile-m-z/wesnoth.profile less more
3535
3636 private-dev
3737 private-tmp
38
39 restrict-namespaces
+1
-0
etc/profile-m-z/wget.profile less more
6060 dbus-system none
6161
6262 memory-deny-write-execute
63 restrict-namespaces
+1
-0
etc/profile-m-z/whois.profile less more
5353 dbus-system none
5454
5555 memory-deny-write-execute
56 restrict-namespaces
+2
-0
etc/profile-m-z/widelands.profile less more
4444
4545 dbus-user none
4646 dbus-system none
47
48 restrict-namespaces
+2
-0
etc/profile-m-z/wine.profile less more
3939 seccomp
4040
4141 private-dev
42
43 restrict-namespaces
+2
-0
etc/profile-m-z/wireshark.profile less more
5151
5252 dbus-user none
5353 dbus-system none
54
55 #restrict-namespaces
+2
-0
etc/profile-m-z/wordwarvi.profile less more
4848
4949 dbus-user none
5050 dbus-system none
51
52 restrict-namespaces
+2
-0
etc/profile-m-z/wps.profile less more
4545
4646 dbus-user none
4747 dbus-system none
48
49 #restrict-namespaces
+1
-0
etc/profile-m-z/x-terminal-emulator.profile less more
2020 dbus-system none
2121
2222 noexec /tmp
23 restrict-namespaces
+1
-0
etc/profile-m-z/x2goclient.profile less more
4747 dbus-system none
4848
4949 #memory-deny-write-execute
50 restrict-namespaces
+1
-0
etc/profile-m-z/xbill.profile less more
5050
5151 memory-deny-write-execute
5252 read-only ${HOME}
53 restrict-namespaces
+2
-0
etc/profile-m-z/xcalc.profile less more
3939
4040 dbus-user none
4141 dbus-system none
42
43 restrict-namespaces
+2
-0
etc/profile-m-z/xchat.profile less more
2020 seccomp
2121
2222 # private-bin requires perl, python*, etc.
23
24 restrict-namespaces
+1
-0
etc/profile-m-z/xed.profile less more
5050
5151 # xed uses python plugins, memory-deny-write-execute breaks python
5252 # memory-deny-write-execute
53 restrict-namespaces
+2
-0
etc/profile-m-z/xfburn.profile less more
2727 # private-bin xfburn
2828 # private-dev
2929 # private-tmp
30
31 restrict-namespaces
+1
-0
etc/profile-m-z/xfce4-dict.profile less more
3636 private-dev
3737 private-tmp
3838
39 restrict-namespaces
+1
-0
etc/profile-m-z/xfce4-mixer.profile less more
5353 dbus-system none
5454
5555 # memory-deny-write-execute - breaks on Arch
56 restrict-namespaces
+1
-0
etc/profile-m-z/xfce4-notes.profile less more
3838 private-dev
3939 private-tmp
4040
41 restrict-namespaces
+1
-0
etc/profile-m-z/xfce4-screenshooter.profile less more
4747 dbus-system none
4848
4949 # memory-deny-write-execute -- see #3790
50 restrict-namespaces
+2
-0
etc/profile-m-z/xiphos.profile less more
4747 private-dev
4848 private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssli,sword,sword.conf
4949 private-tmp
50
51 restrict-namespaces
+0
-20
etc/profile-m-z/xlinks2 less more
0 # Firejail profile for xlinks2
1 # Description: Text WWW browser (X11)
2 # This file is overwritten after every install/update
3 # Persistent local customizations
4 include xlinks2.local
5 # Persistent global definitions
6 # added by included profile
7 #include globals.local
8
9 noblacklist /tmp/.X11-unix
10
11 include whitelist-common.inc
12
13 # if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2'
14 # to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line
15 private-bin xlinks2
16 private-etc alternatives,fonts,ld.so.cache,ld.so.preload
17
18 # Redirect
19 include links2.profile
+20
-0
etc/profile-m-z/xlinks2.profile less more
0 # Firejail profile for xlinks2
1 # Description: Text WWW browser (X11)
2 # This file is overwritten after every install/update
3 # Persistent local customizations
4 include xlinks2.local
5 # Persistent global definitions
6 # added by included profile
7 #include globals.local
8
9 noblacklist /tmp/.X11-unix
10
11 include whitelist-common.inc
12
13 # if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2'
14 # to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line
15 private-bin xlinks2
16 private-etc alternatives,fonts,ld.so.cache,ld.so.preload
17
18 # Redirect
19 include links2.profile
+2
-0
etc/profile-m-z/xmms.profile less more
2828
2929 private-bin xmms
3030 private-dev
31
32 restrict-namespaces
+1
-0
etc/profile-m-z/xmr-stak.profile less more
4242 private-tmp
4343
4444 memory-deny-write-execute
45 restrict-namespaces
+1
-0
etc/profile-m-z/xonotic.profile less more
5252
5353 read-only ${HOME}
5454 read-write ${HOME}/.xonotic
55 restrict-namespaces
+2
-0
etc/profile-m-z/xournal.profile less more
4747
4848 dbus-user none
4949 dbus-system none
50
51 restrict-namespaces
+1
-0
etc/profile-m-z/xpdf.profile less more
4141 dbus-system none
4242
4343 memory-deny-write-execute
44 restrict-namespaces
+2
-0
etc/profile-m-z/xplayer.profile less more
4646 # makes settings immutable
4747 # dbus-user none
4848 # dbus-system none
49
50 restrict-namespaces
+2
-0
etc/profile-m-z/xpra.profile less more
5050 private-dev
5151 # private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,machine-id,nsswitch.conf,resolv.conf,X11,xpra
5252 private-tmp
53
54 restrict-namespaces
+1
-0
etc/profile-m-z/xreader.profile less more
4141 private-tmp
4242
4343 memory-deny-write-execute
44 restrict-namespaces
+1
-0
etc/profile-m-z/xviewer.profile less more
4545 # dbus-system none
4646
4747 memory-deny-write-execute
48 restrict-namespaces
+2
-0
etc/profile-m-z/yelp.profile less more
7373 # your yelp.local if you need PDF printing support.
7474 #noblacklist ${DOCUMENTS}
7575 #whitelist ${DOCUMENTS}
76
77 restrict-namespaces
+2
-0
etc/profile-m-z/youtube-dl-gui.profile less more
5252
5353 dbus-user none
5454 dbus-system none
55
56 restrict-namespaces
+1
-0
etc/profile-m-z/youtube-dl.profile less more
6363 dbus-system none
6464
6565 #memory-deny-write-execute - breaks on Arch (see issue #1803)
66 restrict-namespaces
+2
-0
etc/profile-m-z/youtube-viewers-common.profile less more
6666 dbus-user.talk org.mozilla.*
6767
6868 dbus-system none
69
70 restrict-namespaces
+1
-1
etc/profile-m-z/ytmdesktop.profile less more
00 # Firejail profile for ytmdesktop
1 # Description: Unofficial electron based desktop warpper for YouTube Music
1 # Description: Unofficial electron based desktop wrapper for YouTube Music
22 # This file is overwritten after every install/update
33 # Persistent local customizations
44 include youtube.local
+1
-0
etc/profile-m-z/zaproxy.profile less more
4343 private-dev
4444 private-tmp
4545
46 restrict-namespaces
+2
-0
etc/profile-m-z/zart.profile less more
3434
3535 dbus-user none
3636 dbus-system none
37
38 restrict-namespaces
+1
-0
etc/profile-m-z/zathura.profile less more
5858 read-only ${HOME}
5959 read-write ${HOME}/.config/zathura
6060 read-write ${HOME}/.local/share/zathura
61 restrict-namespaces
+1
-0
etc/profile-m-z/zeal.profile less more
6868 dbus-system none
6969
7070 # memory-deny-write-execute - breaks on Arch
71 restrict-namespaces
+2
-0
etc/profile-m-z/zim.profile less more
6767
6868 dbus-user none
6969 dbus-system none
70
71 restrict-namespaces
+2
-0
etc/profile-m-z/zulip.profile less more
4444 private-dev
4545 private-etc alternatives,asound.conf,fonts,ld.so.cache,ld.so.preload,machine-id
4646 private-tmp
47
48 restrict-namespaces
+1
-1
etc/templates/profile.template less more
213213 # - In order to make dconf work (when used by the app) you need to allow
214214 # 'ca.desrt.dconf' even when not allowed by flatpak.
215215 # Notes and policies about addresses can be found at
216 # <https://github.com/netblue30/firejail/wiki/Restrict-D-Bus>
216 # <https://github.com/netblue30/firejail/wiki/Restrict-DBus>
217217 #dbus-user filter
218218 #dbus-user.own com.github.netblue30.firejail
219219 #dbus-user.talk ca.desrt.dconf
+3
-0
src/firecfg/firecfg.config less more
129129 cawbird
130130 celluloid
131131 chafa
132 chatterino
132133 checkbashisms
133134 cheese
134135 cherrytree
477478 links
478479 links2
479480 linphone
481 linuxqq
480482 lmms
481483 lobase
482484 localc
691693 qmmp
692694 qnapi
693695 qpdfview
696 qq
694697 qt-faststart
695698 qtox
696699 quadrapassel
+2
-0
src/firejail/checkcfg.c less more
5050 cfg_val[i] = 1; // most of them are enabled by default
5151 cfg_val[CFG_RESTRICTED_NETWORK] = 0; // disabled by default
5252 cfg_val[CFG_FORCE_NONEWPRIVS] = 0;
53 cfg_val[CFG_ETC_HIDE_BLACKLISTED] = 0;
5354 cfg_val[CFG_PRIVATE_BIN_NO_LOCAL] = 0;
5455 cfg_val[CFG_FIREJAIL_PROMPT] = 0;
5556 cfg_val[CFG_DISABLE_MNT] = 0;
114115 PARSE_YESNO(CFG_TRACELOG, "tracelog")
115116 PARSE_YESNO(CFG_XEPHYR_WINDOW_TITLE, "xephyr-window-title")
116117 PARSE_YESNO(CFG_OVERLAYFS, "overlayfs")
118 PARSE_YESNO(CFG_ETC_HIDE_BLACKLISTED, "etc-hide-blacklisted")
117119 PARSE_YESNO(CFG_PRIVATE_BIN, "private-bin")
118120 PARSE_YESNO(CFG_PRIVATE_BIN_NO_LOCAL, "private-bin-no-local")
119121 PARSE_YESNO(CFG_PRIVATE_CACHE, "private-cache")
+5
-0
src/firejail/chroot.c less more
118118 int parentfd = safer_openat(-1, rootdir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
119119 if (parentfd == -1)
120120 errExit("safer_openat");
121
122 if (faccessat(parentfd, ".", X_OK, 0) != 0) {
123 fprintf(stderr, "Error: no search permission on chroot directory\n");
124 exit(1);
125 }
121126 // rootdir has to be owned by root and is not allowed to be generally writable,
122127 // this also excludes /tmp and friends
123128 struct stat s;
+3
-0
src/firejail/firejail.h less more
338338 extern int arg_appimage; // appimage
339339 extern int arg_apparmor; // apparmor
340340 extern char *apparmor_profile; // apparmor profile
341 extern bool apparmor_replace; // whether apparmor should replace the profile (legacy behavior)
341342 extern int arg_allow_debuggers; // allow debuggers
342343 extern int arg_x11_block; // block X11
343344 extern int arg_x11_xorg; // use X11 security extension
353354 extern int arg_deterministic_exit_code; // always exit with first child's exit status
354355 extern int arg_deterministic_shutdown; // shut down the sandbox if first child dies
355356 extern int arg_keep_fd_all; // inherit all file descriptors to sandbox
357 extern int arg_netlock; // netlocker
356358
357359 typedef enum {
358360 DBUS_POLICY_ALLOW, // Allow unrestricted access to the bus
808810 CFG_FORCE_NONEWPRIVS,
809811 CFG_XEPHYR_WINDOW_TITLE,
810812 CFG_OVERLAYFS,
813 CFG_ETC_HIDE_BLACKLISTED,
811814 CFG_PRIVATE_BIN,
812815 CFG_PRIVATE_BIN_NO_LOCAL,
813816 CFG_PRIVATE_CACHE,
+1
-1
src/firejail/fs.c less more
161161 fs_logger2("blacklist-nolog", fname);
162162
163163 // files in /etc will be reprocessed during /etc rebuild
164 if (strncmp(fname, "/etc/", 5) == 0) {
164 if (checkcfg(CFG_ETC_HIDE_BLACKLISTED) && strncmp(fname, "/etc/", 5) == 0) {
165165 ProfileEntry *prf = malloc(sizeof(ProfileEntry));
166166 if (!prf)
167167 errExit("malloc");
+7
-1
src/firejail/fs_etc.c less more
263263
264264 void fs_rebuild_etc(void) {
265265 int have_dhcp = 1;
266 if (cfg.dns1 == NULL && !any_dhcp())
266 if (cfg.dns1 == NULL && !any_dhcp()) {
267 // Disabling this option ensures that updates to files using
268 // rename(2) propagate into the sandbox, in order to avoid
269 // breaking /etc/resolv.conf (issue #5010).
270 if (!checkcfg(CFG_ETC_HIDE_BLACKLISTED))
271 return;
267272 have_dhcp = 0;
273 }
268274
269275 if (arg_debug)
270276 printf("rebuilding /etc directory\n");
+6
-1
src/firejail/main.c less more
133133 int arg_appimage = 0; // appimage
134134 int arg_apparmor = 0; // apparmor
135135 char *apparmor_profile = NULL; // apparmor profile
136 bool apparmor_replace = false; // apparmor profile
136137 int arg_allow_debuggers = 0; // allow debuggers
137138 int arg_x11_block = 0; // block X11
138139 int arg_x11_xorg = 0; // use X11 security extension
157158 int arg_tab = 0;
158159 int login_shell = 0;
159160 int just_run_the_shell = 0;
161 int arg_netlock = 0;
160162
161163 int parent_to_child_fds[2];
162164 int child_to_parent_fds[2];
10511053 int lockfd_directory = -1;
10521054 int custom_profile = 0; // custom profile loaded
10531055 int arg_caps_cmdline = 0; // caps requested on command line (used to break out of --chroot)
1054 int arg_netlock = 0;
10551056 char **ptr;
10561057
10571058
13811382 else if (strncmp(argv[i], "--apparmor=", 11) == 0) {
13821383 arg_apparmor = 1;
13831384 apparmor_profile = argv[i] + 11;
1385 }
1386 else if (strncmp(argv[i], "--apparmor-replace", 18) == 0) {
1387 arg_apparmor = 1;
1388 apparmor_replace = true;
13841389 }
13851390 #endif
13861391 else if (strncmp(argv[i], "--protocol=", 11) == 0) {
+26
-0
src/firejail/profile.c less more
654654 #endif
655655 return 0;
656656 }
657 else if (strcmp(ptr, "netlock") == 0) {
658 #ifdef HAVE_NETWORK
659 if (checkcfg(CFG_NETWORK)) {
660 arg_netlock = 1;
661 }
662 else
663 warning_feature_disabled("networking");
664 #endif
665 return 0;
666 }
657667 else if (strncmp(ptr, "netns ", 6) == 0) {
658668 #ifdef HAVE_NETWORK
659669 if (checkcfg(CFG_NETWORK)) {
951961 apparmor_profile = strdup(ptr + 9);
952962 if (!apparmor_profile)
953963 errExit("strdup");
964 #endif
965 return 0;
966 }
967
968 if (strcmp(ptr, "apparmor-replace") == 0) {
969 #ifdef HAVE_APPARMOR
970 arg_apparmor = 1;
971 apparmor_replace = true;
972 #endif
973 return 0;
974 }
975
976 if (strcmp(ptr, "apparmor-stack") == 0) {
977 #ifdef HAVE_APPARMOR
978 arg_apparmor = 1;
979 apparmor_replace = false;
954980 #endif
955981 return 0;
956982 }
+8
-1
src/firejail/sandbox.c less more
129129 static void set_apparmor(void) {
130130 EUID_ASSERT();
131131 if (checkcfg(CFG_APPARMOR) && arg_apparmor) {
132 if (aa_stack_onexec(apparmor_profile)) {
132 int res = 0;
133 if(apparmor_replace){
134 fwarning("Replacing profile instead of stacking it. It is a legacy behavior that can result in relaxation of the protection. It is here as a temporary measure to unbreak the software that has been broken by switching to the stacking behavior.\n");
135 res = aa_change_onexec(apparmor_profile);
136 } else {
137 res = aa_stack_onexec(apparmor_profile);
138 }
139 if (res) {
133140 fwarning("Cannot confine the application using AppArmor.\n"
134141 "Maybe firejail-default AppArmor profile is not loaded into the kernel.\n"
135142 "As root, run \"aa-enforce firejail-default\" to load it.\n");
+0
-1
src/firejail/usage.c less more
211211 " --private-srv=file,directory - build a new /srv in a temporary filesystem.\n"
212212 " --profile=filename|profile_name - use a custom profile.\n"
213213 " --profile.print=name|pid - print the name of profile file.\n"
214 " --profile-path=directory - use this directory to look for profile files.\n"
215214 " --protocol=protocol,protocol,protocol - enable protocol filter.\n"
216215 " --protocol.print=name|pid - print the protocol filter.\n"
217216 #ifdef HAVE_FILE_TRANSFER
+3
-1
src/fnettrace/static-ip-map less more
15851585 16.162.0.0/15 Amazon
15861586 16.168.0.0/15 Amazon
15871587 16.170.0.0/15 Amazon
1588 18.32.0.0/11 Amazon
15881589 18.60.0.0/15 Amazon
1589 18.64.0.0/14 Amazon
1590 18.64.0.0/10 Amazon
15901591 18.100.0.0/15 Amazon
15911592 18.102.0.0/16 Amazon
15921593 18.116.0.0/14 Amazon
1594 18.128.0.0/9 Amazon
15931595 18.130.0.0/16 Amazon
15941596 18.132.0.0/14 Amazon
15951597 18.136.0.0/16 Amazon
+17
-2
src/fseccomp/namespaces.c less more
132132 RETURN_ALLOW
133133 #endif
134134 };
135 write_to_file(fd, filter, sizeof(filter));
135 if (sizeof(filter))
136 write_to_file(fd, filter, sizeof(filter));
136137
137138 filter_end_blacklist(fd);
138139
187188 RETURN_ALLOW
188189 #endif
189190 };
190 write_to_file(fd, filter, sizeof(filter));
191
192 // For Debian 10 and older, the size of the filter[] array will be 0.
193 // The following filter will end up being generated:
194 //
195 // FILE: /run/firejail/mnt/seccomp/seccomp.namespaces.32
196 // line OP JT JF K
197 // =================================
198 // 0000: 20 00 00 00000004 ld data.architecture
199 // 0001: 15 01 00 40000003 jeq ARCH_32 0003 (false 0002)
200 // 0002: 06 00 00 7fff0000 ret ALLOW
201 // 0003: 20 00 00 00000000 ld data.syscall-number
202 // 0004: 06 00 00 7fff0000 ret ALLOW
203 //
204 if (sizeof(filter))
205 write_to_file(fd, filter, sizeof(filter));
191206
192207 filter_end_blacklist(fd);
193208
+4
-0
src/man/firejail-profile.txt less more
976976 \fBnetfilter filename
977977 If a new network namespace is created, enabled the network filter in filename.
978978
979 .TP
980 \fBnetlock
981 Generate a custom network filter and enable it.
982
979983
980984 .TP
981985 \fBnetmask address
+1
-1
src/man/firejail.txt less more
30633063 .br
30643064 $ firejail \-\-noprofile \-\-whitelist=~/.mozilla
30653065 .br
3066 $ firejail \-\-whitelist=/tmp/.X11-unix --whitelist=/dev/null
3066 $ firejail \-\-whitelist=/tmp/.X11-unix \-\-whitelist=/dev/null
30673067 .br
30683068 $ firejail "\-\-whitelist=/home/username/My Virtual Machines"
30693069 .br
+13
-1
src/profstats/main.c less more
2424 static int cnt_profiles = 0;
2525 static int cnt_apparmor = 0;
2626 static int cnt_seccomp = 0;
27 static int cnt_restrict_namespaces = 0;
2728 static int cnt_caps = 0;
2829 static int cnt_dbus_system_none = 0;
2930 static int cnt_dbus_user_none = 0;
6869 static int arg_noroot = 0;
6970 static int arg_print_blacklist = 0;
7071 static int arg_print_whitelist = 0;
72 static int arg_restrict_namespaces = 0;
7173
7274 static char *profile = NULL;
7375
9092 printf(" --print-whitelist - print all --private and --whitelist for a profile\n");
9193 printf(" --seccomp - print profiles without seccomp\n");
9294 printf(" --memory-deny-write-execute - print profiles without \"memory-deny-write-execute\"\n");
95 printf(" --restrict-namespaces - print profiles without \"restrict-namespaces\"\n");
9396 printf(" --whitelist-home - print profiles whitelisting home directory\n");
9497 printf(" --whitelist-var - print profiles without \"include whitelist-var-common.inc\"\n");
9598 printf(" --whitelist-runuser - print profiles without \"include whitelist-runuser-common.inc\" or \"blacklist ${RUNUSER}\"\n");
151154
152155 if (strncmp(ptr, "seccomp", 7) == 0)
153156 cnt_seccomp++;
157 if (strncmp(ptr, "restrict-namespaces", 19) == 0)
158 cnt_restrict_namespaces++;
154159 else if (strncmp(ptr, "caps", 4) == 0)
155160 cnt_caps++;
156161 else if (strncmp(ptr, "include disable-exec.inc", 24) == 0)
241246 arg_caps = 1;
242247 else if (strcmp(argv[i], "--seccomp") == 0)
243248 arg_seccomp = 1;
249 else if (strcmp(argv[i], "--restrict-namespaces") == 0)
250 arg_restrict_namespaces = 1;
244251 else if (strcmp(argv[i], "--memory-deny-write-execute") == 0)
245252 arg_mdwx = 1;
246253 else if (strcmp(argv[i], "--noexec") == 0)
290297 for (i = start; i < argc; i++) {
291298 cnt_profiles++;
292299
293 // watch seccomp
300 int restrict_namespaces = cnt_restrict_namespaces;
294301 int seccomp = cnt_seccomp;
295302 int caps = cnt_caps;
296303 int apparmor = cnt_apparmor;
333340 cnt_whitelistrunuser = whitelistrunuser + 1;
334341 if (cnt_seccomp > (seccomp + 1))
335342 cnt_seccomp = seccomp + 1;
343 if (cnt_restrict_namespaces > (restrict_namespaces + 1))
344 cnt_seccomp = restrict_namespaces + 1;
336345 if (cnt_dbus_user_none > (dbususernone + 1))
337346 cnt_dbus_user_none = dbususernone + 1;
338347 if (cnt_dbus_user_filter > (dbususerfilter + 1))
352361 printf("No caps found in %s\n", argv[i]);
353362 if (arg_seccomp && seccomp == cnt_seccomp)
354363 printf("No seccomp found in %s\n", argv[i]);
364 if (arg_restrict_namespaces && restrict_namespaces == cnt_restrict_namespaces)
365 printf("No restrict-namespaces found in %s\n", argv[i]);
355366 if (arg_noexec && noexec == cnt_noexec)
356367 printf("No include disable-exec.inc found in %s\n", argv[i]);
357368 if (arg_noroot && noroot == cnt_noroot)
396407 printf(" noexec\t\t\t%d (include disable-exec.inc)\n", cnt_noexec);
397408 printf(" noroot\t\t\t%d\n", cnt_noroot);
398409 printf(" memory-deny-write-execute\t%d\n", cnt_mdwx);
410 printf(" restrict-namespaces\t\t%d\n", cnt_restrict_namespaces);
399411 printf(" apparmor\t\t\t%d\n", cnt_apparmor);
400412 printf(" private-bin\t\t\t%d\n", cnt_privatebin);
401413 printf(" private-dev\t\t\t%d\n", cnt_privatedev);
+4
-4
test/filters/apparmor.exp less more
2929 }
3030 expect {
3131 timeout {puts "TESTING ERROR 3\n";exit}
32 "AppArmor: firejail-default enforce"
32 "AppArmor: firejail-default//&unconfined enforce"
3333 }
3434 expect {
3535 timeout {puts "TESTING ERROR 4\n";exit}
3737 }
3838 expect {
3939 timeout {puts "TESTING ERROR 5\n";exit}
40 "AppArmor: firejail-default enforce"
40 "AppArmor: firejail-default//&unconfined enforce"
4141 }
4242 after 100
4343
4444 send -- "firejail --apparmor.print=test1\r"
4545 expect {
4646 timeout {puts "TESTING ERROR 6\n";exit}
47 "AppArmor: firejail-default enforce"
47 "AppArmor: firejail-default//&unconfined enforce"
4848 }
4949 after 100
5050
5151 send -- "firejail --apparmor.print=test2\r"
5252 expect {
5353 timeout {puts "TESTING ERROR 7\n";exit}
54 "AppArmor: firejail-default enforce"
54 "AppArmor: firejail-default//&unconfined enforce"
5555 }
5656 after 100
5757
+10
-0
test/filters/filters.sh less more
2727 ./memwrexe-32.exp
2828 else
2929 echo "TESTING SKIP: memwrexe binary only running on x86_64 and i686."
30 fi
31
32 if [[ $(uname -m) == "x86_64" ]]; then
33 echo "TESTING: restrict-namespaces (test/filters/namespaces.exp)"
34 ./namespaces.exp
35 elif [[ $(uname -m) == "i686" ]]; then
36 echo "TESTING: restrict-namespaces (test/filters/namespaces-32.exp)"
37 ./namespaces-32.exp
38 else
39 echo "TESTING SKIP: namespaces binary only running on x86_64 and i686."
3040 fi
3141
3242 echo "TESTING: debug options (test/filters/debug.exp)"
test/filters/namespaces less more
Binary diff not shown
test/filters/namespaces-32 less more
Binary diff not shown
+173
-0
test/filters/namespaces-32.exp less more
0 #!/usr/bin/expect -f
1 # This file is part of Firejail project
2 # Copyright (C) 2014-2022 Firejail Authors
3 # License GPL v2
4
5 set timeout 10
6 spawn $env(SHELL)
7 match_max 100000
8
9 #
10 # clone
11 #
12
13 send -- "firejail --noprofile ./namespaces-32 clone cgroup,ipc,mnt,net,pid,user,uts\r"
14 expect {
15 timeout {puts "TESTING ERROR 0\n";exit}
16 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
17 }
18 expect {
19 timeout {puts "TESTING ERROR 1\n";exit}
20 "clone successful"
21 }
22 after 100
23
24 send -- "firejail --noprofile --restrict-namespaces ./namespaces-32 clone user\r"
25 expect {
26 timeout {puts "TESTING ERROR 2\n";exit}
27 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
28 }
29 expect {
30 timeout {puts "TESTING ERROR 3\n";exit}
31 "Error: clone: Operation not permitted"
32 }
33 after 100
34
35 send -- "firejail --noprofile --restrict-namespaces=user ./namespaces-32 clone user\r"
36 expect {
37 timeout {puts "TESTING ERROR 4\n";exit}
38 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
39 }
40 expect {
41 timeout {puts "TESTING ERROR 5\n";exit}
42 "Error: clone: Operation not permitted"
43 }
44 after 100
45
46 send -- "firejail --noprofile --restrict-namespaces=user ./namespaces-32 clone cgroup,ipc,mnt,net,pid,user,uts\r"
47 expect {
48 timeout {puts "TESTING ERROR 6\n";exit}
49 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
50 }
51 expect {
52 timeout {puts "TESTING ERROR 7\n";exit}
53 "Error: clone: Operation not permitted"
54 }
55 after 100
56
57 send -- "firejail --noprofile --restrict-namespaces=cgroup,ipc ./namespaces-32 clone cgroup\r"
58 expect {
59 timeout {puts "TESTING ERROR 8\n";exit}
60 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
61 }
62 expect {
63 timeout {puts "TESTING ERROR 9\n";exit}
64 "Error: clone: Operation not permitted"
65 }
66 after 100
67
68 send -- "firejail --noprofile --restrict-namespaces=cgroup,ipc ./namespaces-32 clone ipc\r"
69 expect {
70 timeout {puts "TESTING ERROR 10\n";exit}
71 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
72 }
73 expect {
74 timeout {puts "TESTING ERROR 11\n";exit}
75 "Error: clone: Operation not permitted"
76 }
77 after 100
78
79 send -- "firejail --noprofile --restrict-namespaces=cgroup,ipc ./namespaces-32 clone mnt,net,pid,uts\r"
80 expect {
81 timeout {puts "TESTING ERROR 12\n";exit}
82 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
83 }
84 expect {
85 timeout {puts "TESTING ERROR 13\n";exit}
86 "clone successful"
87 }
88 after 100
89
90 #
91 # unshare
92 #
93
94 send -- "firejail --noprofile ./namespaces-32 unshare cgroup,ipc,mnt,net,pid,user,uts\r"
95 expect {
96 timeout {puts "TESTING ERROR 14\n";exit}
97 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
98 }
99 expect {
100 timeout {puts "TESTING ERROR 15\n";exit}
101 "unshare successful"
102 }
103 after 100
104
105 send -- "firejail --noprofile --restrict-namespaces ./namespaces-32 unshare user\r"
106 expect {
107 timeout {puts "TESTING ERROR 16\n";exit}
108 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
109 }
110 expect {
111 timeout {puts "TESTING ERROR 17\n";exit}
112 "Error: unshare: Operation not permitted"
113 }
114 after 100
115
116 send -- "firejail --noprofile --restrict-namespaces=user ./namespaces-32 unshare user\r"
117 expect {
118 timeout {puts "TESTING ERROR 18\n";exit}
119 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
120 }
121 expect {
122 timeout {puts "TESTING ERROR 19\n";exit}
123 "Error: unshare: Operation not permitted"
124 }
125 after 100
126
127 send -- "firejail --noprofile --restrict-namespaces=user ./namespaces-32 unshare cgroup,ipc,mnt,net,pid,user,uts\r"
128 expect {
129 timeout {puts "TESTING ERROR 20\n";exit}
130 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
131 }
132 expect {
133 timeout {puts "TESTING ERROR 21\n";exit}
134 "Error: unshare: Operation not permitted"
135 }
136 after 100
137
138 send -- "firejail --noprofile --restrict-namespaces=cgroup,ipc ./namespaces-32 unshare cgroup\r"
139 expect {
140 timeout {puts "TESTING ERROR 22\n";exit}
141 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
142 }
143 expect {
144 timeout {puts "TESTING ERROR 23\n";exit}
145 "Error: unshare: Operation not permitted"
146 }
147 after 100
148
149 send -- "firejail --noprofile --restrict-namespaces=cgroup,ipc ./namespaces-32 unshare ipc\r"
150 expect {
151 timeout {puts "TESTING ERROR 24\n";exit}
152 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
153 }
154 expect {
155 timeout {puts "TESTING ERROR 25\n";exit}
156 "Error: unshare: Operation not permitted"
157 }
158 after 100
159
160 send -- "firejail --noprofile --restrict-namespaces=cgroup,ipc ./namespaces-32 unshare mnt,net,pid,uts\r"
161 expect {
162 timeout {puts "TESTING ERROR 26\n";exit}
163 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
164 }
165 expect {
166 timeout {puts "TESTING ERROR 27\n";exit}
167 "unshare successful"
168 }
169
170
171 after 100
172 puts "\nall done\n"
+96
-0
test/filters/namespaces.c less more
0 #define _GNU_SOURCE
1 #include <errno.h>
2 #include <sched.h>
3 #include <signal.h>
4 #include <stdio.h>
5 #include <stdlib.h>
6 #include <string.h>
7 #include <sys/mman.h>
8 #include <unistd.h>
9
10 #ifndef CLONE_NEWTIME
11 #define CLONE_NEWTIME 0x00000080
12 #endif
13
14 #define STACK_SIZE 1024 * 1024
15
16 static int usage() {
17 fprintf(stderr, "Usage: namespaces <system call>[clone,unshare] <list of namespaces>[cgroup,ipc,mnt,net,pid,time,user,uts]\n");
18 exit(1);
19 }
20
21 static void die(const char *msg) {
22 fprintf(stderr, "Error: %s: %s\n", msg, strerror(errno));
23 exit(1);
24 }
25
26 static int ns_flags(const char *list) {
27 int flags = 0;
28
29 char *dup = strdup(list);
30 if (!dup)
31 die("cannot allocate memory");
32
33 char *token = strtok(dup, ",");
34 while (token) {
35 if (strcmp(token, "cgroup") == 0)
36 flags |= CLONE_NEWCGROUP;
37 else if (strcmp(token, "ipc") == 0)
38 flags |= CLONE_NEWIPC;
39 else if (strcmp(token, "net") == 0)
40 flags |= CLONE_NEWNET;
41 else if (strcmp(token, "mnt") == 0)
42 flags |= CLONE_NEWNS;
43 else if (strcmp(token, "pid") == 0)
44 flags |= CLONE_NEWPID;
45 else if (strcmp(token, "time") == 0)
46 flags |= CLONE_NEWTIME;
47 else if (strcmp(token, "user") == 0)
48 flags |= CLONE_NEWUSER;
49 else if (strcmp(token, "uts") == 0)
50 flags |= CLONE_NEWUTS;
51 else
52 usage();
53
54 token = strtok(NULL, ",");
55 }
56
57 free(dup);
58 return flags;
59 }
60
61 static int child(void *arg) {
62 (void) arg;
63
64 fprintf(stderr, "clone successful\n");
65 return 0;
66 }
67
68 int main (int argc, char **argv) {
69 if (argc != 3)
70 usage();
71
72 int flags = ns_flags(argv[2]);
73 if (getuid() != 0)
74 flags |= CLONE_NEWUSER;
75
76 if (strcmp(argv[1], "clone") == 0) {
77 void *stack = mmap(NULL, STACK_SIZE, PROT_READ | PROT_WRITE,
78 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
79 if (stack == MAP_FAILED)
80 die("mmap");
81
82 if (clone(child, stack + STACK_SIZE, flags | SIGCHLD, NULL) < 0)
83 die("clone");
84 }
85 else if (strcmp(argv[1], "unshare") == 0) {
86 if (unshare(flags))
87 die("unshare");
88
89 fprintf(stderr, "unshare successful\n");
90 }
91 else
92 usage();
93
94 return 0;
95 }
+173
-0
test/filters/namespaces.exp less more
0 #!/usr/bin/expect -f
1 # This file is part of Firejail project
2 # Copyright (C) 2014-2022 Firejail Authors
3 # License GPL v2
4
5 set timeout 10
6 spawn $env(SHELL)
7 match_max 100000
8
9 #
10 # clone
11 #
12
13 send -- "firejail --noprofile ./namespaces clone cgroup,ipc,mnt,net,pid,user,uts\r"
14 expect {
15 timeout {puts "TESTING ERROR 0\n";exit}
16 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
17 }
18 expect {
19 timeout {puts "TESTING ERROR 1\n";exit}
20 "clone successful"
21 }
22 after 100
23
24 send -- "firejail --noprofile --restrict-namespaces ./namespaces clone user\r"
25 expect {
26 timeout {puts "TESTING ERROR 2\n";exit}
27 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
28 }
29 expect {
30 timeout {puts "TESTING ERROR 3\n";exit}
31 "Error: clone: Operation not permitted"
32 }
33 after 100
34
35 send -- "firejail --noprofile --restrict-namespaces=user ./namespaces clone user\r"
36 expect {
37 timeout {puts "TESTING ERROR 4\n";exit}
38 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
39 }
40 expect {
41 timeout {puts "TESTING ERROR 5\n";exit}
42 "Error: clone: Operation not permitted"
43 }
44 after 100
45
46 send -- "firejail --noprofile --restrict-namespaces=user ./namespaces clone cgroup,ipc,mnt,net,pid,user,uts\r"
47 expect {
48 timeout {puts "TESTING ERROR 6\n";exit}
49 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
50 }
51 expect {
52 timeout {puts "TESTING ERROR 7\n";exit}
53 "Error: clone: Operation not permitted"
54 }
55 after 100
56
57 send -- "firejail --noprofile --restrict-namespaces=cgroup,ipc ./namespaces clone cgroup\r"
58 expect {
59 timeout {puts "TESTING ERROR 8\n";exit}
60 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
61 }
62 expect {
63 timeout {puts "TESTING ERROR 9\n";exit}
64 "Error: clone: Operation not permitted"
65 }
66 after 100
67
68 send -- "firejail --noprofile --restrict-namespaces=cgroup,ipc ./namespaces clone ipc\r"
69 expect {
70 timeout {puts "TESTING ERROR 10\n";exit}
71 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
72 }
73 expect {
74 timeout {puts "TESTING ERROR 11\n";exit}
75 "Error: clone: Operation not permitted"
76 }
77 after 100
78
79 send -- "firejail --noprofile --restrict-namespaces=cgroup,ipc ./namespaces clone mnt,net,pid,uts\r"
80 expect {
81 timeout {puts "TESTING ERROR 12\n";exit}
82 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
83 }
84 expect {
85 timeout {puts "TESTING ERROR 13\n";exit}
86 "clone successful"
87 }
88 after 100
89
90 #
91 # unshare
92 #
93
94 send -- "firejail --noprofile ./namespaces unshare cgroup,ipc,mnt,net,pid,user,uts\r"
95 expect {
96 timeout {puts "TESTING ERROR 14\n";exit}
97 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
98 }
99 expect {
100 timeout {puts "TESTING ERROR 15\n";exit}
101 "unshare successful"
102 }
103 after 100
104
105 send -- "firejail --noprofile --restrict-namespaces ./namespaces unshare user\r"
106 expect {
107 timeout {puts "TESTING ERROR 16\n";exit}
108 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
109 }
110 expect {
111 timeout {puts "TESTING ERROR 17\n";exit}
112 "Error: unshare: Operation not permitted"
113 }
114 after 100
115
116 send -- "firejail --noprofile --restrict-namespaces=user ./namespaces unshare user\r"
117 expect {
118 timeout {puts "TESTING ERROR 18\n";exit}
119 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
120 }
121 expect {
122 timeout {puts "TESTING ERROR 19\n";exit}
123 "Error: unshare: Operation not permitted"
124 }
125 after 100
126
127 send -- "firejail --noprofile --restrict-namespaces=user ./namespaces unshare cgroup,ipc,mnt,net,pid,user,uts\r"
128 expect {
129 timeout {puts "TESTING ERROR 20\n";exit}
130 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
131 }
132 expect {
133 timeout {puts "TESTING ERROR 21\n";exit}
134 "Error: unshare: Operation not permitted"
135 }
136 after 100
137
138 send -- "firejail --noprofile --restrict-namespaces=cgroup,ipc ./namespaces unshare cgroup\r"
139 expect {
140 timeout {puts "TESTING ERROR 22\n";exit}
141 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
142 }
143 expect {
144 timeout {puts "TESTING ERROR 23\n";exit}
145 "Error: unshare: Operation not permitted"
146 }
147 after 100
148
149 send -- "firejail --noprofile --restrict-namespaces=cgroup,ipc ./namespaces unshare ipc\r"
150 expect {
151 timeout {puts "TESTING ERROR 24\n";exit}
152 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
153 }
154 expect {
155 timeout {puts "TESTING ERROR 25\n";exit}
156 "Error: unshare: Operation not permitted"
157 }
158 after 100
159
160 send -- "firejail --noprofile --restrict-namespaces=cgroup,ipc ./namespaces unshare mnt,net,pid,uts\r"
161 expect {
162 timeout {puts "TESTING ERROR 26\n";exit}
163 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
164 }
165 expect {
166 timeout {puts "TESTING ERROR 27\n";exit}
167 "unshare successful"
168 }
169
170
171 after 100
172 puts "\nall done\n"
+67
-14
test/filters/protocol.exp less more
99 send -- "firejail --noprofile --protocol=unix --debug\r"
1010 expect {
1111 timeout {puts "TESTING ERROR 1\n";exit}
12 "0009: 20 00 00 00000000 ld data.syscall-number"
12 "0009: 20 00 00 00000000"
1313 }
1414 expect {
1515 timeout {puts "TESTING ERROR 2\n";exit}
16 "000a: 15 01 00 00000029 jeq socket 000c (false 000b)"
16 "000f: 20 00 00 00000010"
1717 }
1818 expect {
1919 timeout {puts "TESTING ERROR 3\n";exit}
20 "000b: 06 00 00 7fff0000 ret ALLOW"
20 "0010: 15 00 01 00000001"
2121 }
2222 expect {
2323 timeout {puts "TESTING ERROR 4\n";exit}
24 "000c: 20 00 00 00000010 ld data.args"
24 "0011: 06 00 00 7fff0000"
2525 }
2626 expect {
2727 timeout {puts "TESTING ERROR 5\n";exit}
28 "000d: 15 00 01 00000001 jeq 1 000e (false 000f)"
29 }
30 expect {
31 timeout {puts "TESTING ERROR 6\n";exit}
32 "000e: 06 00 00 7fff0000 ret ALLOW"
33 ""
34 }
35 expect {
36 timeout {puts "TESTING ERROR 7\n";exit}
37 "000f: 06 00 00 0005005f ret ERRNO(95)"
28 "0012: 06 00 00 0005005f"
3829 }
3930
4031 after 100
4132 send -- "exit\r"
33 sleep 1
34
35 send -- "firejail --noprofile --protocol=bluetooth --debug\r"
36 expect {
37 timeout {puts "TESTING ERROR 11\n";exit}
38 "0009: 20 00 00 00000000"
39 }
40 expect {
41 timeout {puts "TESTING ERROR 12\n";exit}
42 "000f: 20 00 00 00000010"
43 }
44 expect {
45 timeout {puts "TESTING ERROR 13\n";exit}
46 "0010: 15 00 01 0000001f"
47 }
48 expect {
49 timeout {puts "TESTING ERROR 14\n";exit}
50 "0011: 06 00 00 7fff0000"
51 }
52 expect {
53 timeout {puts "TESTING ERROR1 5\n";exit}
54 "0012: 06 00 00 0005005f"
55 }
56
57 after 100
58 send -- "exit\r"
59 sleep 1
60
61 send -- "firejail --noprofile --protocol=inet,inet6 --debug\r"
62 expect {
63 timeout {puts "TESTING ERROR 31\n";exit}
64 "0009: 20 00 00 00000000"
65 }
66 expect {
67 timeout {puts "TESTING ERROR 32\n";exit}
68 "000f: 20 00 00 00000010"
69 }
70 expect {
71 timeout {puts "TESTING ERROR 33\n";exit}
72 "0010: 15 00 01 00000002"
73 }
74 expect {
75 timeout {puts "TESTING ERROR 34\n";exit}
76 "0011: 06 00 00 7fff0000"
77 }
78 expect {
79 timeout {puts "TESTING ERROR1 35\n";exit}
80 "0012: 15 00 01 0000000a"
81 }
82 expect {
83 timeout {puts "TESTING ERROR 36\n";exit}
84 "0013: 06 00 00 7fff0000"
85 }
86 expect {
87 timeout {puts "TESTING ERROR 37\n";exit}
88 "0014: 06 00 00 0005005f"
89 }
90
91 after 100
92 send -- "exit\r"
93
94
4295 after 100
4396 puts "\nall done\n"
+2
-2
test/filters/seccomp-run-files.exp less more
2323 send -- "ls -l /run/firejail/mnt/seccomp | grep -c seccomp\r"
2424 expect {
2525 timeout {puts "TESTING ERROR 3\n";exit}
26 "6"
26 "8"
2727 }
2828 send -- "exit\r"
2929 sleep 1
8989 send -- "ls -l /run/firejail/mnt/seccomp | grep -c seccomp\r"
9090 expect {
9191 timeout {puts "TESTING ERROR 18\n";exit}
92 "8"
92 "10"
9393 }
9494 send -- "exit\r"
9595 sleep 1
+3
-13
test/fs/fs.sh less more
4343 echo "TESTING: read/write /var/tmp (test/fs/fs_var_tmp.exp)"
4444 ./fs_var_tmp.exp
4545 rm -f /var/tmp/_firejail_test_file
46
47 if [[ $(uname -m) == "x86_64" ]]; then
48 fjconfig=/etc/firejail/firejail.config
49 printf 'private-lib yes\n' | sudo tee -a "$fjconfig" >/dev/null
50 echo "TESTING: private-lib (test/fs/private-lib.exp)"
51 ./private-lib.exp
52 printf '%s\n' "$(sed '/^private-lib yes$/d' "$fjconfig")" |
53 sudo tee "$fjconfig" >/dev/null
54 else
55 echo "TESTING SKIP: private-lib test implemented only for x86_64."
56 fi
5746
5847 echo "TESTING: read/write /var/lock (test/fs/fs_var_lock.exp)"
5948 ./fs_var_lock.exp
152141 ./whitelist.exp
153142 rm -fr ~/_firejail_test_*
154143
155 echo "TESTING: whitelist dev, var(test/fs/whitelist-dev.exp)"
156 ./whitelist-dev.exp
144 # TODO: whitelist /dev broken in 0.9.72
145 #echo "TESTING: whitelist dev, var(test/fs/whitelist-dev.exp)"
146 #./whitelist-dev.exp
157147
158148 echo "TESTING: whitelist noexec (test/fs/whitelist-noexec.exp)"
159149 ./whitelist-noexec.exp
+1
-1
test/fs/option_blacklist_file.exp less more
2121 send -- "cat /etc/passwd;echo done\r"
2222 expect {
2323 timeout {puts "TESTING ERROR 1\n";exit}
24 "No such file or directory"
24 "Permission denied"
2525 }
2626 expect {
2727 timeout {puts "TESTING ERROR 2\n";exit}
+0
-48
test/fs/private-lib.exp less more
0 #!/usr/bin/expect -f
1 # This file is part of Firejail project
2 # Copyright (C) 2014-2022 Firejail Authors
3 # License GPL v2
4
5
6 set timeout 10
7 spawn $env(SHELL)
8 match_max 100000
9
10 send -- "firejail --private-lib --private-bin=sh,bash,dash,ps,grep,ls,find,echo,stty \r"
11 expect {
12 timeout {puts "TESTING ERROR 1\n";exit}
13 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
14 }
15 after 100
16 send -- "stty -echo\r"
17 after 100
18
19 send -- "cd /bin; find .\; echo done\r"
20 expect {
21 timeout {puts "TESTING ERROR 2\n";exit}
22 # "grep" {puts "TESTING ERROR 3\n";exit}
23 "rm" {puts "TESTING ERROR 3\n";exit}
24 "cp" {puts "TESTING ERROR 4\n";exit}
25 "done"
26 }
27 after 100
28
29 send -- "cd /lib; find .\r"
30 expect {
31 timeout {puts "TESTING ERROR 5\n";exit}
32 "./modules" {puts "TESTING ERROR 6\n";exit}
33 "./firmware" {puts "TESTING ERROR 7\n";exit}
34 "libc.so"
35 }
36 after 100
37
38 send -- "cd /usr/lib; find .\r"
39 expect {
40 timeout {puts "TESTING ERROR 8\n";exit}
41 "grub" {puts "TESTING ERROR 9\n";exit}
42 "mozilla" {puts "TESTING ERROR 10\n";exit}
43 "libdl.so"
44 }
45 after 100
46
47 puts "\nall done\n"
+1
-1
test/fs/whitelist-empty.exp less more
66 spawn $env(SHELL)
77 match_max 100000
88
9 send -- "firejail --whitelist=~/blablabla --whitelist=/tmp/blablabla --whitelist=/media/blablabla --whitelist=/var/blablabla --whitelist=/dev/blablabla --whitelist=/opt/blablabla\r"
9 send -- "firejail --whitelist=~/blablabla --whitelist=/tmp/blablabla --whitelist=/media/blablabla --whitelist=/var/blablabla --whitelist=/opt/blablabla\r"
1010 expect {
1111 timeout {puts "TESTING ERROR 0\n";exit}
1212 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
+48
-0
test/private-lib/private-lib.exp less more
0 #!/usr/bin/expect -f
1 # This file is part of Firejail project
2 # Copyright (C) 2014-2022 Firejail Authors
3 # License GPL v2
4
5
6 set timeout 10
7 spawn $env(SHELL)
8 match_max 100000
9
10 send -- "firejail --private-lib --private-bin=sh,bash,dash,ps,grep,ls,find,echo,stty \r"
11 expect {
12 timeout {puts "TESTING ERROR 1\n";exit}
13 -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
14 }
15 after 100
16 send -- "stty -echo\r"
17 after 100
18
19 send -- "cd /bin; find .\; echo done\r"
20 expect {
21 timeout {puts "TESTING ERROR 2\n";exit}
22 # "grep" {puts "TESTING ERROR 3\n";exit}
23 "rm" {puts "TESTING ERROR 3\n";exit}
24 "cp" {puts "TESTING ERROR 4\n";exit}
25 "done"
26 }
27 after 100
28
29 send -- "cd /lib; find .\r"
30 expect {
31 timeout {puts "TESTING ERROR 5\n";exit}
32 "./modules" {puts "TESTING ERROR 6\n";exit}
33 "./firmware" {puts "TESTING ERROR 7\n";exit}
34 "libc.so"
35 }
36 after 100
37
38 send -- "cd /usr/lib; find .\r"
39 expect {
40 timeout {puts "TESTING ERROR 8\n";exit}
41 "grub" {puts "TESTING ERROR 9\n";exit}
42 "mozilla" {puts "TESTING ERROR 10\n";exit}
43 "libdl.so"
44 }
45 after 100
46
47 puts "\nall done\n"
+12
-0
test/private-lib/private-lib.sh less more
1717 echo "TESTING SKIP: $app not found"
1818 fi
1919 done
20
21 if [[ $(uname -m) == "x86_64" ]]; then
22 fjconfig=/etc/firejail/firejail.config
23 printf 'private-lib yes\n' | sudo tee -a "$fjconfig" >/dev/null
24 echo "TESTING: private-lib (test/fs/private-lib.exp)"
25 ./private-lib.exp
26 printf '%s\n' "$(sed '/^private-lib yes$/d' "$fjconfig")" |
27 sudo tee "$fjconfig" >/dev/null
28 else
29 echo "TESTING SKIP: private-lib test implemented only for x86_64."
30 fi
31
+306
-0
test/utils/~ less more
0 <!DOCTYPE html>
1 <html lang="en">
2 <head>
3 <meta charset="utf-8">
4 <title>Debian -- The Universal Operating System </title>
5 <link rel="author" href="mailto:webmaster@debian.org">
6 <meta name="Description" content="Debian is an operating system and a distribution of Free Software. It is maintained and updated through the work of many users who volunteer their time and effort.">
7 <meta name="Generator" content="WML 2.32.0">
8 <meta name="Modified" content="2022-12-25 23:27:38">
9 <meta name="viewport" content="width=device-width">
10 <meta name="mobileoptimized" content="300">
11 <meta name="HandheldFriendly" content="true">
12 <link rel="alternate" type="application/rss+xml"
13 title="Debian News" href="News/news">
14 <link rel="alternate" type="application/rss+xml"
15 title="Debian Project News" href="News/weekly/dwn">
16 <link rel="alternate" type="application/rss+xml"
17 title="Debian Security Advisories (titles only)" href="security/dsa">
18 <link rel="alternate" type="application/rss+xml"
19 title="Debian Security Advisories (summaries)" href="security/dsa-long">
20 <link href="./debhome.css" rel="stylesheet" type="text/css">
21 <link href="./startpage.css" rel="stylesheet" type="text/css">
22 <link href="./5img-carousel-slider.css" rel="stylesheet" type="text/css">
23 <link href="./debian-en.css" rel="stylesheet" type="text/css" media="all">
24 <link rel="shortcut icon" href="favicon.ico">
25 <meta name="Keywords" content="debian, GNU, linux, unix, open source, free, DFSG">
26 <link rel="search" type="application/opensearchdescription+xml" title="Debian website search" href="./search.en.xml">
27 </head>
28 <body>
29 <div id="header">
30 <div id="upperheader">
31 <div id="logo">
32 <a href="./" title="Debian Home"><img src="./Pics/openlogo-50.png" alt="Debian" width="50" height="61"></a>
33 </div> <!-- end logo -->
34 <div id="searchbox">
35 <form name="p" method="get" action="https://search.debian.org/cgi-bin/omega">
36 <p>
37 <input type="hidden" name="DB" value="en">
38 <input name="P" value="" size="14">
39 <input type="submit" value="Search">
40 </p>
41 </form>
42 </div> <!-- end sitetools -->
43 </div> <!-- end upperheader -->
44 <!--UdmComment-->
45 <div id="navbar">
46 <p class="hidecss"><a href="#content">Skip Quicknav</a></p>
47 <ul>
48 <!-- Link to Debian's own Social Media resources -->
49 <li><a href="https://bits.debian.org/" title="Bits from Debian">Blog</a></li>
50 <li><a href="https://micronews.debian.org" title="Micronews from Debian">Micronews</a></li>
51 <li><a href="https://planet.debian.org/" title="The Planet of Debian">Planet</a></li>
52 </ul>
53 </div> <!-- end navbar -->
54 <p id="breadcrumbs">&nbsp; </p>
55 </div> <!-- end header -->
56 <!--/UdmComment-->
57 <section>
58 <div id="splash">
59 <h1>Debian</h1>
60 </div>
61 <!-- The first row of columns on the site. -->
62 <div class="row">
63 <div class="column column-left">
64 <div style="text-align: center">
65 <h1>The Community</h1>
66 <h2>Debian is a Community of People!</h2>
67 <!-- The following div is containing the static image carousel.
68 Currently made of five images. -->
69 <div class="wrapper">
70 <input checked type="radio" name="slider" id="slide1">
71 <input type="radio" name="slider" id="slide2">
72 <input type="radio" name="slider" id="slide3">
73 <input type="radio" name="slider" id="slide4">
74 <input type="radio" name="slider" id="slide5">
75 <div class="slider-wrapper">
76 <div class="inner">
77 <article>
78 <div class="info bottom-right">
79 <h3>DC22 Group Photo</h3>
80 </div>
81 <img src="Pics/debconf22_group_photo.jpg" alt="DebConf22 Group Photo" width="851" height="575">
82 </article>
83 <article>
84 <div class="info top-left">
85 <h3>Mini DebConf Regensburg 2021</h3>
86 </div>
87 <img src="Pics//mini-dc21-regensburg.jpg" alt="Group photo of the MiniDebConf in Regensburg 2021" width="1024" height="576">
88 </article>
89 <article>
90 <div class="info top-left">
91 <h3>Screenshot Calamares Installer</h3>
92 </div>
93 <img src="Pics/calamares-bullseye.png" alt="Screenshot from the Calamares installer" width="1024" height="576">
94 </article>
95 <article>
96 <div class="info top-left">
97 <h3>Debian is like a Swiss Army Knife</h3>
98 </div>
99 <img src="Pics/debian-swiss-knife-hands-1024x576.jpg" alt="Debian is like a Swiss Army Knife" width="1024" height="576">
100 </article>
101 <article>
102 <div class="info top-left">
103 <h3>People have fun with Debian</h3>
104 </div>
105 <img src="Pics/debian-funny-people-1024x576.jpg" alt="Debian people at Debconf18 in Hsinchu really having fun" width="1024" height="576">
106 </article>
107 </div> <!-- .inner -->
108 </div> <!-- .slider-wrapper -->
109 <div class="slider-prev-next-control">
110 <label for="slide1"></label>
111 <label for="slide2"></label>
112 <label for="slide3"></label>
113 <label for="slide4"></label>
114 <label for="slide5"></label>
115 </div> <!-- .slider-prev-next-control -->
116 <div class="slider-dot-control">
117 <label for="slide1"></label>
118 <label for="slide2"></label>
119 <label for="slide3"></label>
120 <label for="slide4"></label>
121 <label for="slide5"></label>
122 </div> <!-- .slider-dot-control -->
123 </div>
124 </div>
125 <div class="row">
126 <div class="community column">
127 <a href="intro/people" aria-hidden="true">
128 <img src="Pics/users.svg" width="512" alt="">
129 </a>
130 </div>
131 <div class="styled-href-blue column-4-parts">
132 <h2><a href="intro/people">People</a></h2>
133 <p>Who we are and what we do</p>
134 </div>
135 </div>
136 <div class="row">
137 <div class="community column">
138 <a href="intro/philosophy" aria-hidden="true">
139 <img src="Pics/heartbeat.svg" width="512" alt="">
140 </a>
141 </div>
142 <div class="styled-href-blue column-4-parts">
143 <h2><a href="intro/philosophy">Our Philosophy</a></h2>
144 <p>Why we do it, and how we do it</p>
145 </div>
146 </div>
147 <div class="row">
148 <div class="community column">
149 <a href="devel/join/" aria-hidden="true">
150 <img src="Pics/user-plus.svg" width="512" alt="">
151 </a>
152 </div>
153 <div class="styled-href-blue column-4-parts">
154 <h2><a href="devel/join/">Get Involved, Contribute</a></h2>
155 <p>How you can join us!</p>
156 </div>
157 </div>
158 <div class="row">
159 <div class="community column">
160 <a href="intro/index#community" aria-hidden="true">
161 <img src="Pics/list.svg" width="512" alt="">
162 </a>
163 </div>
164 <div class="styled-href-blue column-4-parts">
165 <h2><a href="intro/index#community">More...</a></h2>
166 <p>Additional information about the Debian community</p>
167 </div>
168 </div>
169 </div>
170 <div class="column column-right">
171 <div style="text-align: center">
172 <h1>The Operating System</h1>
173 <h2>Debian is a complete Free Operating System!</h2>
174 <div class="os-img-container">
175 <img src="Pics/debian-logo-1024x576.png" alt="Debian" width="1024" height="576">
176 <a href="./download" class="os-dl-btn">Download</a>
177 </div>
178 </div>
179 <div class="row">
180 <div class="community column">
181 <a href="intro/why_debian" aria-hidden="true">
182 <img src="Pics/trophy.svg" width="512" alt="">
183 </a>
184 </div>
185 <div class="styled-href-blue column-4-parts">
186 <h2><a href="intro/why_debian">Why Debian</a></h2>
187 <p>What makes Debian special</p>
188 </div>
189 </div>
190 <div class="row">
191 <div class="community column">
192 <a href="support" aria-hidden="true">
193 <img src="Pics/life-ring.svg" width="512" alt="">
194 </a>
195 </div>
196 <div class="styled-href-blue column-4-parts">
197 <h2><a href="support">User Support</a></h2>
198 <p>Getting help and documentation</p>
199 </div>
200 </div>
201 <div class="row">
202 <div class="community column">
203 <a href="security/" aria-hidden="true">
204 <img src="Pics/security.svg" width="512" alt="">
205 </a>
206 </div>
207 <div class="styled-href-blue column-4-parts">
208 <h2><a href="security/">Security Updates</a></h2>
209 <p>Debian Security Advisories (DSA)</p>
210 </div>
211 </div>
212 <div class="row">
213 <div class="community column">
214 <a href="intro/index#software" aria-hidden="true">
215 <img src="Pics/list.svg" width="512" alt="">
216 </a>
217 </div>
218 <div class="styled-href-blue column-4-parts">
219 <h2><a href="intro/index#software">More...</a></h2>
220 <p>Further links to downloads and software</p>
221 </div>
222 </div>
223 </div>
224 </div>
225 <hr>
226 <!-- An optional row highlighting events happening now, such as releases, point releases, debconf and minidebconfs, and elections (dpl, GRs...). -->
227 <!-- The next row of columns on the site. -->
228 <!-- The News will be selected by the press team. -->
229 <div class="row">
230 <div class="column styled-href-blue column-left">
231 <div style="text-align: center">
232 <h1>Project News</h1>
233 <h2>News and Announcements about Debian</h2>
234 </div>
235 <div class="project-news"><time datetime="2022-12-17" class="date-as-calendar position-em size1_25x"><span class="day">17</span><span class="month">December</span><span class="year">2022</span></time><div class="project-news-content"><a href="News/2022/20221217">Updated Debian 11: 11.6 released</a></div></div>
236 <div class="project-news"><time datetime="2022-09-10" class="date-as-calendar position-em size1_25x"><span class="day">10</span><span class="month">September</span><span class="year">2022</span></time><div class="project-news-content"><a href="News/2022/20220910">Updated Debian 10: 10.13 released</a></div></div>
237 <div class="project-news"><time datetime="2022-08-07" class="date-as-calendar position-em size1_25x"><span class="day">07</span><span class="month">August</span><span class="year">2022</span></time><div class="project-news-content"><a href="News/2022/20220807">Ownership of <q>debian.community</q> domain</a></div></div>
238 <div class="project-news"><time datetime="2022-07-24" class="date-as-calendar position-em size1_25x"><span class="day">24</span><span class="month">July</span><span class="year">2022</span></time><div class="project-news-content"><a href="News/2022/20220724">DebConf22 closes in Prizren and DebConf23 dates announced</a></div></div>
239 <!-- No more News entries behind this line! -->
240 <div class="project-news">
241 <div class="end-of-list-arrow"></div>
242 <div class="project-news-content project-news-content-end">
243 <a href="News">All the news</a> &emsp;&emsp;
244 <a class="rss_logo" style="float: none" href="News/news">RSS</a>
245 </div>
246 </div>
247 </div>
248 </div>
249 <div class="clr"></div>
250 </section> <!-- end content -->
251 <footer>
252 <hr class="hidecss">
253 <!--UdmComment-->
254 <div id="pageLang">
255 <div id="langSelector">
256 This page is also available in the following languages:
257 <div id="langContainer">
258 <a href="index.ar.html" title="Arabic" hreflang="ar" lang="ar" rel="alternate">&#1593;&#1585;&#1576;&#1610;&#1577;&nbsp;(Arabiya)</a>
259 <a href="index.bg.html" title="Bulgarian" hreflang="bg" lang="bg" rel="alternate">&#1041;&#1098;&#1083;&#1075;&#1072;&#1088;&#1089;&#1082;&#1080;&nbsp;(B&#601;lgarski)</a>
260 <a href="index.ca.html" title="Catalan" hreflang="ca" lang="ca" rel="alternate">catal&agrave;</a>
261 <a href="index.da.html" title="Danish" hreflang="da" lang="da" rel="alternate">dansk</a>
262 <a href="index.de.html" title="German" hreflang="de" lang="de" rel="alternate">Deutsch</a>
263 <a href="index.el.html" title="Greek" hreflang="el" lang="el" rel="alternate">&#917;&#955;&#955;&#951;&#957;&#953;&#954;&#940;&nbsp;(Ellinika)</a>
264 <a href="index.es.html" title="Spanish" hreflang="es" lang="es" rel="alternate">espa&ntilde;ol</a>
265 <a href="index.fa.html" title="Persian" hreflang="fa" lang="fa" rel="alternate">&#x0641;&#x0627;&#x0631;&#x0633;&#x06cc;&nbsp;(Farsi)</a>
266 <a href="index.fr.html" title="French" hreflang="fr" lang="fr" rel="alternate">fran&ccedil;ais</a>
267 <a href="index.gl.html" title="Galician" hreflang="gl" lang="gl" rel="alternate">Galego</a>
268 <a href="index.hy.html" title="Armenian" hreflang="hy" lang="hy" rel="alternate">&#1344;&#1377;&#1397;&#1381;&#1408;&#1381;&#1398;&nbsp;(hayeren)</a>
269 <a href="index.id.html" title="Indonesian" hreflang="id" lang="id" rel="alternate">Indonesia</a>
270 <a href="index.it.html" title="Italian" hreflang="it" lang="it" rel="alternate">Italiano</a>
271 <a href="index.ko.html" title="Korean" hreflang="ko" lang="ko" rel="alternate">&#54620;&#44397;&#50612;&nbsp;(Korean)</a>
272 <a href="index.hu.html" title="Hungarian" hreflang="hu" lang="hu" rel="alternate">magyar</a>
273 <a href="index.nl.html" title="Dutch" hreflang="nl" lang="nl" rel="alternate">Nederlands</a>
274 <a href="index.nb.html" title="Norwegian" hreflang="nb" lang="nb" rel="alternate">norsk&nbsp;(bokm&aring;l)</a>
275 <a href="index.pl.html" title="Polish" hreflang="pl" lang="pl" rel="alternate">polski</a>
276 <a href="index.pt.html" title="Portuguese" hreflang="pt" lang="pt" rel="alternate">Portugu&ecirc;s</a>
277 <a href="index.ru.html" title="Russian" hreflang="ru" lang="ru" rel="alternate">&#1056;&#1091;&#1089;&#1089;&#1082;&#1080;&#1081;&nbsp;(Russkij)</a>
278 <a href="index.fi.html" title="Finnish" hreflang="fi" lang="fi" rel="alternate">suomi</a>
279 <a href="index.sv.html" title="Swedish" hreflang="sv" lang="sv" rel="alternate">svenska</a>
280 <a href="index.vi.html" title="Vietnamese" hreflang="vi" lang="vi" rel="alternate">Ti&#7871;ng Vi&#7879;t</a>
281 <a href="index.uk.html" title="Ukrainian" hreflang="uk" lang="uk" rel="alternate">&#1091;&#1082;&#1088;&#1072;&#1111;&#1085;&#1089;&#1100;&#1082;&#1072;&nbsp;(ukrajins'ka)</a>
282 <a href="index.zh-cn.html" title="Chinese (China)" hreflang="zh-CN" lang="zh-CN" rel="alternate">&#20013;&#25991;(&#31616;)</a>
283 <a href="index.zh-hk.html" title="Chinese (Hong Kong)" hreflang="zh-HK" lang="zh-HK" rel="alternate">&#20013;&#25991;(HK)</a>
284 <a href="index.zh-tw.html" title="Chinese (Taiwan)" hreflang="zh-TW" lang="zh-TW" rel="alternate">&#20013;&#25991;(&#32321;)</a>
285 </div>
286 How to set <a href="./intro/cn">the default document language</a>
287 </div></div><!--/UdmComment-->
288 <hr>
289 <!--UdmComment-->
290 <div id="fineprint">
291 <p>See our <a href="./contact">contact page</a> to get in touch. Web site source code is <a href="https://salsa.debian.org/webmaster-team/webwml">available</a>.</p>
292 <p>
293 Last Modified: Sun, Jul 24 21:07:25 UTC 2022
294 &emsp;
295 Last Built: Sun, Dec 25 23:27:38 UTC 2022
296 <br>
297 Copyright &copy; 1997-2022
298 <a href="https://www.spi-inc.org/">SPI</a> and others; See <a href="./license" rel="copyright">license terms</a><br>
299 Debian is a registered <a href="./trademark">trademark</a> of Software in the Public Interest, Inc.
300 </p>
301 </div>
302 <!--/UdmComment-->
303 </footer> <!-- end footer -->
304 </body>
305 </html>