Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

harden mpg123.profile #3438

Merged
merged 2 commits into from
May 27, 2020
Merged

harden mpg123.profile #3438

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5bbfb04
harden mpg123.profile
glitsj16 May 27, 2020
0b10985
drop nodvd from mpg123.profile
glitsj16 May 27, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions etc/profile-m-z/mpg123.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
# Firejail profile for mpg123
# Description: MPEG audio player/decoder
# This file is overwritten after every install/update
quiet
# Persistent local customizations
include mpg123.local
# Persistent global definitions
include globals.local

noblacklist ${MUSIC}
noblacklist ${VIDEOS}

include disable-common.inc
include disable-devel.inc
Expand All @@ -23,19 +23,24 @@ include whitelist-var-common.inc
apparmor
caps.drop all
netfilter
no3d
nodvd
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nodvd also includes (audio) cd.

Copy link
Collaborator Author

@glitsj16 glitsj16 May 27, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rusty-snake Indeed. I assumed that audio CD's are not in a compatible format for mpg123 to process directly. So a decoded WAV or MP3 file would reside on the regular filesystem instead. But I forgot about archived audio files. Can't test due to having exchanged my laptop's CD/DVD drive for an extra SSD years ago. I'll remove the nodvd, it's a minor change anyway.

nogroups
nonewprivs
noroot
notv
nou2f
novideo
protocol unix,inet,inet6,netlink
seccomp
shell none
tracelog

#private-bin mpg123*
private-dev
private-tmp

memory-deny-write-execute

dbus-user none
dbus-system none

memory-deny-write-execute