Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Various profiles #3561

Merged
merged 2 commits into from
Sep 2, 2020
Merged

Various profiles #3561

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
02de03e
Various profiles
bbhtt Jul 30, 2020
a959bbe
Various fixes # 1
bbhtt Jul 31, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions etc/inc/disable-programs.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,6 +255,7 @@ blacklist ${HOME}/.config/katerc
blacklist ${HOME}/.config/kateschemarc
blacklist ${HOME}/.config/katesyntaxhighlightingrc
blacklist ${HOME}/.config/katevirc
blacklist ${HOME}/.config/kazam
blacklist ${HOME}/.config/kdeconnect
blacklist ${HOME}/.config/kdenliverc
blacklist ${HOME}/.config/kfindrc
Expand Down Expand Up @@ -308,6 +309,7 @@ blacklist ${HOME}/.config/nomacs
blacklist ${HOME}/.config/obs-studio
blacklist ${HOME}/.config/okularpartrc
blacklist ${HOME}/.config/okularrc
blacklist ${HOME}/.config/onboard
blacklist ${HOME}/.config/onionshare
blacklist ${HOME}/.config/onlyoffice
blacklist ${HOME}/.config/opera
Expand Down
54 changes: 54 additions & 0 deletions etc/profile-a-l/kazam.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
# Firejail profile for kazam
# Description: Screen capture tool
# This file is overwritten after every install/update
# Persistent local customizations
include kazam.local
# Persistent global definitions
include globals.local

ignore noexec ${HOME}
rusty-snake marked this conversation as resolved.
Show resolved Hide resolved

noblacklist ${PICTURES}
noblacklist ${VIDEOS}
noblacklist ${HOME}/.config/kazam

include allow-python2.inc
include allow-python3.inc

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-passwdmgr.inc
include disable-shell.inc
include disable-xdg.inc

whitelist /usr/share/kazam
include whitelist-runuser-common.inc
rusty-snake marked this conversation as resolved.
Show resolved Hide resolved
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
net none
nodvd
nogroups
nonewprivs
noroot
notv
nou2f
novideo
protocol unix
seccomp
shell none
tracelog

disable-mnt
# private-bin kazam,python*
private-cache
private-dev
private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,machine-id,pulse,selinux,X11,xdg
private-tmp

dbus-system none
65 changes: 65 additions & 0 deletions etc/profile-m-z/menulibre.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,65 @@
# Firejail profile for menulibre
# Description: Create desktop and menu launchers easily
# This file is overwritten after every install/update
# Persistent local customizations
include menulibre.local
# Persistent global definitions
include globals.local

include allow-python2.inc
include allow-python3.inc

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-passwdmgr.inc
include disable-xdg.inc

# Whitelist your system icon directory,varies by distro
whitelist /usr/share/app-info
whitelist /usr/share/desktop-directories
whitelist /usr/share/icons
whitelist /usr/share/menulibre
whitelist /var/lib/app-info/icons
# Flatpak desktop directory
whitelist /var/lib/flatpak/exports/share/applications
whitelist /var/lib/flatpak/exports/share/icons
# Snap desktop directory

include whitelist-runuser-common.inc
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wusc?

whitelist?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Half of the list is not being populated with desktop entries, tried adding whitelist /usr/share/applications
whitelist /usr/share/menulibre with wusc.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Works the following? If not try with --build. If thats still don't work, leave it.

whitelist /usr/share/applications
whitelist /usr/share/menulibre
whitelist /usr/share/desktop-directories
include wusc.inc

Copy link
Contributor Author

@bbhtt bbhtt Jul 31, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Works,thanks but some of the entries have no icon picture. Tried adding ~/.local/share/icons,/usr/share/icons,pixmaps,mime etc. Build doesn't give anything more than this. Also I don't use flatpak or snap but where are their desktop files stored? We may need to whitelist those too,

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

flatpak: /var/lib/flatpak/exports/share/{applications,icons} and ~/.local/share/flatpak/exports/share/{applications,icons}

some of the entries have no icon picture.

Are these icons specified by name or by path?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you locate for the name?

Copy link
Contributor Author

@bbhtt bbhtt Jul 31, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found them. Most of them are in, /var/lib/app-info/icons/. Does this vary by distro?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fedora seems to use /usr/share/app-info/.

Copy link
Contributor Author

@bbhtt bbhtt Jul 31, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arch uses /usr/share/icons/ in hicolor.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FWIW:

  • Snap: don't use bubblewrap
  • flatpak: relies on bubblewrap
  • nautilus: runs thumbnailers in a sandbox with a read-only filesystem

include whitelist-usr-share-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
machine-id
net none
nodvd
no3d
nogroups
nonewprivs
noroot
nosound
notv
nou2f
novideo
protocol unix
seccomp
shell none
tracelog

disable-mnt
private-cache
private-dev
private-etc alternatives,dconf,fonts,gtk-3.0,locale.alias,locale.conf,mime.types,nsswitch.conf,passwd,pki,selinux,X11,xdg
private-tmp

dbus-user none
dbus-system none

read-write ${HOME}/.config/menus
read-write ${HOME}/.gnome/apps
read-write ${HOME}/.local/share/applications
read-write ${HOME}/.local/share/flatpak/exports
57 changes: 57 additions & 0 deletions etc/profile-m-z/musictube.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
# Firejail profile for musictube
# Description: Stream music
# This file is overwritten after every install/update
# Persistent local customizations
include musictube.local
# Persistent global definitions
include globals.local

noblacklist ${HOME}/.cache/Flavio Tordini
noblacklist ${HOME}/.config/Flavio Tordini
noblacklist ${HOME}/.local/share/Flavio Tordini

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-shell.inc
include disable-xdg.inc

mkdir ${HOME}/.cache/Flavio Tordini
mkdir ${HOME}/.config/Flavio Tordini
mkdir ${HOME}/.local/share/Flavio Tordini
whitelist ${HOME}/.cache/Flavio Tordini
whitelist ${HOME}/.config/Flavio Tordini
whitelist ${HOME}/.local/share/Flavio Tordini
whitelist /usr/share/musictube
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
netfilter
nodvd
nogroups
nonewprivs
noroot
notv
nou2f
novideo
protocol unix,inet,inet6,netlink
seccomp
shell none
tracelog

disable-mnt
private-bin musictube
private-cache
private-dev
private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg
private-tmp

dbus-user none
dbus-system none
55 changes: 55 additions & 0 deletions etc/profile-m-z/onboard.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
# Firejail profile for onboard
# Description: On-screen keyboard
# This file is overwritten after every install/update
# Persistent local customizations
include onboard.local
# Persistent global definitions
include globals.local

noblacklist ${HOME}/.config/onboard

include allow-python2.inc
include allow-python3.inc

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-passwdmgr.inc
include disable-shell.inc
include disable-xdg.inc

mkdir ${HOME}/.config/onboard
whitelist ${HOME}/.config/onboard
whitelist /usr/share/onboard
include whitelist-common.inc
include whitelist-usr-share-common.inc
include whitelist-runuser-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
machine-id
net none
nodvd
no3d
nogroups
nonewprivs
noroot
notv
nou2f
novideo
protocol unix
seccomp
shell none
tracelog

disable-mnt
private-cache
private-bin onboard,python*,tput
private-dev
private-etc alternatives,dbus-1,dconf,fonts,gtk-2.0,gtk-3.0,locale,locale.alias,locale.conf,mime.types,selinux,X11,xdg
private-tmp

dbus-system none
4 changes: 4 additions & 0 deletions src/firecfg/firecfg.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -368,6 +368,7 @@ kalgebra
kalgebramobile
karbon
kate
kazam
kcalc
# kdeinit4
kdenlive
Expand Down Expand Up @@ -449,6 +450,7 @@ megaglest_editor
meld
mencoder
mendeleydesktop
menulibre
meteo-qt
midori
min
Expand Down Expand Up @@ -494,6 +496,7 @@ mupdf-x11-curl
mupen64plus
muraster
musescore
musictube
musixmatch
mutool
mutt
Expand Down Expand Up @@ -525,6 +528,7 @@ ocenaudio
odt2txt
oggsplt
okular
onboard
onionshare-gui
ooffice
ooviewdoc
Expand Down