From 975f0b3b1a194b5611741bacf6800421ed37a6b7 Mon Sep 17 00:00:00 2001 From: glitsj16 Date: Wed, 27 May 2020 16:59:35 +0000 Subject: [PATCH 1/5] Create mocp.profile --- etc/profile-m-z/mocp.profile | 52 ++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 etc/profile-m-z/mocp.profile diff --git a/etc/profile-m-z/mocp.profile b/etc/profile-m-z/mocp.profile new file mode 100644 index 00000000000..b70f84b0106 --- /dev/null +++ b/etc/profile-m-z/mocp.profile @@ -0,0 +1,52 @@ +# Firejail profile for mocp +# Description: A powerful & easy to use console audio player +# This file is overwritten after every install/update +quiet +# Persistent local customizations +include mocp.local +# Persistent global definitions +include globals.local + +noblacklist ${HOME}/.moc +noblacklist ${MUSIC} + +include disable-common.inc +include disable-devel.inc +include disable-exec.inc +include disable-interpreters.inc +include disable-passwdmgr.inc +include disable-programs.inc +include disable-xdg.inc + +include whitelist-usr-share-common.inc +include whitelist-runuser-common.inc +include whitelist-var-common.inc + +apparmor +caps.drop all +ipc-namespace +netfilter +no3d +nodvd +nogroups +nonewprivs +noroot +notv +nou2f +novideo +protocol unix,inet,inet6,netlink +seccomp +shell none +tracelog + +private-bin mocp +private-cache +private-dev +private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,machine-id,pki,pulse,resolv.conf,ssl +private-tmp + +dbus-user none +dbus-system none + +memory-deny-write-execute +read-only ${HOME} From f6e41c0d36fa3a236fc3193da6d2d296c734a061 Mon Sep 17 00:00:00 2001 From: glitsj16 Date: Wed, 27 May 2020 17:01:58 +0000 Subject: [PATCH 2/5] add mocp support to disable-programs.inc --- etc/inc/disable-programs.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 3b49d60a839..89bfa540ebe 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc @@ -671,6 +671,7 @@ blacklist ${HOME}/.mediathek3 blacklist ${HOME}/.megaglest blacklist ${HOME}/.minetest blacklist ${HOME}/.mirrormagic +blacklist ${HOME}/.moc blacklist ${HOME}/.moonchild productions/basilisk blacklist ${HOME}/.moonchild productions/pale moon blacklist ${HOME}/.mozilla From f8fb75b472f11e34b45f0d836de441f20abcbace Mon Sep 17 00:00:00 2001 From: glitsj16 Date: Wed, 27 May 2020 17:05:52 +0000 Subject: [PATCH 3/5] add mocp support in firecfg.config --- src/firecfg/firecfg.config | 1 + 1 file changed, 1 insertion(+) diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index cb7da3fa74f..251b239050c 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config @@ -442,6 +442,7 @@ min mindless minetest mirrormagic +mocp mousepad mp3splt mp3splt-gtk From 3f511cf1e54fbb6a34759d8256628fdc7cf9a367 Mon Sep 17 00:00:00 2001 From: glitsj16 Date: Wed, 27 May 2020 17:07:05 +0000 Subject: [PATCH 4/5] update RELNOTES for mocp --- RELNOTES | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RELNOTES b/RELNOTES index 390464622a1..9f97f8ab10a 100644 --- a/RELNOTES +++ b/RELNOTES @@ -33,7 +33,7 @@ firejail (0.9.63) baseline; urgency=low * new profiles: mirrormagic, mrrescue, scorched3d-wrapper, scorchwentbonkers * new profiles: seahorse-adventures, wordwarvi, xbill, gnome-klotski * new profiles: swell-foop, fdns, five-or-more, steam-runtime, jitsi-meet-desktop - * new profiles: nicotine, plv + * new profiles: nicotine, plv, mocp -- netblue30 Tue, 21 Apr 2020 08:00:00 -0500 firejail (0.9.62) baseline; urgency=low From 3a09c1f37bcfa685e53b34e0be752af4f9ff9e4a Mon Sep 17 00:00:00 2001 From: glitsj16 Date: Wed, 27 May 2020 17:31:02 +0000 Subject: [PATCH 5/5] fix configuration access for mocp Thanks to @rusty-snake for spotting this. --- etc/profile-m-z/mocp.profile | 1 + 1 file changed, 1 insertion(+) diff --git a/etc/profile-m-z/mocp.profile b/etc/profile-m-z/mocp.profile index b70f84b0106..6fc7a4d67f5 100644 --- a/etc/profile-m-z/mocp.profile +++ b/etc/profile-m-z/mocp.profile @@ -50,3 +50,4 @@ dbus-system none memory-deny-write-execute read-only ${HOME} +read-write ${HOME}/.moc