New profile for CoyIM

[botherder]

I have created here a first profile for CoyIM. I have tried to make it as restrictive as I could and follow the guidelines of the template. It is however the first firejail profile I create, so any input or feedback would be very welcome.

[SkewedZeppelin]

mostly good aside from minor things

[rusty-snake]

I have tried to make it as restrictive as I could and follow the guidelines of the template. It is however the first firejail profile I create, so any input or feedback would be very welcome.

It's always better to make more review steps and have a profile 😄 . So here're my inputs.

• Can we use include whitelist-runuser-common.inc, include whitelist-usr-share-common.inc, include whitelist-var-common.inc?
• Add blacklist ${HOME}/.config/coyim to disable-programs.inc
• Add coyim to src/firecfg/firecfg.config.

[botherder]

I have added the suggested changes.

[botherder]

It's always better to make more review steps and have a profile . So here're my inputs.

Thank you for your feedback.

• Can we use include whitelist-runuser-common.inc, include whitelist-usr-share-common.inc, include whitelist-var-common.inc?

What's the rulebook regarding the inclusion of whitelist-*? Isn't it preferable to avoid adding additional inclusions if they are not necessary to the proper functioning of the application?

[rusty-snake]

What's the rulebook regarding the inclusion of whitelist-*? Isn't it preferable to avoid adding additional inclusions if they are not necessary to the proper functioning of the application?

whitelist-common.inc (wc): Should always be used for whitelisting profiles. It provides things such as bookmarks in file-selection dialogs and custom GTK/QT themes, icon themes, .... (exception: commandline-program which only read ~/.foorc)
whitelist-runuser-common.inc (wruc), whitelist-usr-share-common.inc (wusc) and whitelist-var-common.inc (wvc): including these profiles add restrictions because they enabled whitelisting in these locations.

edit: wusc maybe need something like whitelist /usr/share/CoyIM.
edit2: compare firejail ls /usr/share and firejail --profile=default.profile --profile=/etc/firejail/whitelist-usr-share-common.inc ls /usr/share.

[rusty-snake]

Had you found time to test CoyIM with wruc, wusc and wvc.

[botherder]

Yep, works fine.

[netblue30]

merged, thanks!