new profile: mocp (#3437)

* Create mocp.profile

* add mocp support to disable-programs.inc

* add mocp support in firecfg.config

* update RELNOTES for mocp

* fix configuration access for mocp

Thanks to @rusty-snake for spotting this.

RELNOTES

@@ -33,7 +33,7 @@ firejail (0.9.63) baseline; urgency=low
  * new profiles: mirrormagic, mrrescue, scorched3d-wrapper, scorchwentbonkers
  * new profiles: seahorse-adventures, wordwarvi, xbill, gnome-klotski
  * new profiles: swell-foop, fdns, five-or-more, steam-runtime, jitsi-meet-desktop
- * new profiles: nicotine, plv
+ * new profiles: nicotine, plv, mocp
  -- netblue30 <netblue30@yahoo.com> Tue, 21 Apr 2020 08:00:00 -0500
 
 firejail (0.9.62) baseline; urgency=low

etc/inc/disable-programs.inc

@@ -671,6 +671,7 @@ blacklist ${HOME}/.mediathek3
 blacklist ${HOME}/.megaglest
 blacklist ${HOME}/.minetest
 blacklist ${HOME}/.mirrormagic
+blacklist ${HOME}/.moc
 blacklist ${HOME}/.moonchild productions/basilisk
 blacklist ${HOME}/.moonchild productions/pale moon
 blacklist ${HOME}/.mozilla

etc/profile-m-z/mocp.profile

@@ -0,0 +1,53 @@
+# Firejail profile for mocp
+# Description: A powerful & easy to use console audio player
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include mocp.local
+# Persistent global definitions
+include globals.local
+
+noblacklist ${HOME}/.moc
+noblacklist ${MUSIC}
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-passwdmgr.inc
+include disable-programs.inc
+include disable-xdg.inc
+
+include whitelist-usr-share-common.inc
+include whitelist-runuser-common.inc
+include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+ipc-namespace
+netfilter
+no3d
+nodvd
+nogroups
+nonewprivs
+noroot
+notv
+nou2f
+novideo
+protocol unix,inet,inet6,netlink
+seccomp
+shell none
+tracelog
+
+private-bin mocp
+private-cache
+private-dev
+private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,machine-id,pki,pulse,resolv.conf,ssl
+private-tmp
+
+dbus-user none
+dbus-system none
+
+memory-deny-write-execute
+read-only ${HOME}
+read-write ${HOME}/.moc

src/firecfg/firecfg.config

@@ -442,6 +442,7 @@ min
 mindless
 minetest
 mirrormagic
+mocp
 mousepad
 mp3splt
 mp3splt-gtk