diff --git a/etc/inc/allow-common-devel.inc b/etc/inc/allow-common-devel.inc index 7cd087b14e7..68e91a09b27 100644 --- a/etc/inc/allow-common-devel.inc +++ b/etc/inc/allow-common-devel.inc @@ -25,3 +25,7 @@ noblacklist ${HOME}/.cargo/registry noblacklist ${HOME}/.cargo/.crates.toml noblacklist ${HOME}/.cargo/.crates2.json noblacklist ${HOME}/.cargo/.package-cache + +# npm +noblacklist ${HOME}/.npm +noblacklist ${HOME}/.npmrc diff --git a/etc/inc/allow-nodejs.inc b/etc/inc/allow-nodejs.inc new file mode 100644 index 00000000000..78a4bed8095 --- /dev/null +++ b/etc/inc/allow-nodejs.inc @@ -0,0 +1,6 @@ +# This file is overwritten during software install. +# Persistent customizations should go in a .local file. +include allow-nodejs.local + +noblacklist ${PATH}/node +noblacklist /usr/include/node diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 7ab11e620e2..13d30ced0d8 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc @@ -758,6 +758,8 @@ blacklist ${HOME}/.neverball blacklist ${HOME}/.newsbeuter blacklist ${HOME}/.newsboat blacklist ${HOME}/.nicotine +blacklist ${HOME}/.npm +blacklist ${HOME}/.npmrc blacklist ${HOME}/.nv blacklist ${HOME}/.nylas-mail blacklist ${HOME}/.openarena diff --git a/etc/profile-m-z/npm.profile b/etc/profile-m-z/npm.profile new file mode 100644 index 00000000000..2136fb443cb --- /dev/null +++ b/etc/profile-m-z/npm.profile @@ -0,0 +1,64 @@ +# Firejail profile for npm +# Description: The Node.js Package Manager +# This file is overwritten after every install/update +# Persistent local customizations +include npm.local +# Persistent global definitions +include globals.local + +blacklist /tmp/.X11-unix +blacklist ${RUNUSER} + +noblacklist ${HOME}/.npm +noblacklist ${HOME}/.npmrc + +noblacklist ${PATH}/bash +noblacklist ${PATH}/dash +noblacklist ${PATH}/sh + +ignore noexec ${HOME} + +include disable-common.inc +include disable-exec.inc +include disable-passwdmgr.inc +include disable-programs.inc +include disable-shell.inc +include disable-xdg.inc + +# If you want whitelisting, change the line below to your npm projects directory +# and uncomment the lines below. +#mkdir ${HOME}/.npm +#mkfile ${HOME}/.npmrc +#whitelist ${HOME}/.npm +#whitelist ${HOME}/.npmrc +#whitelist ${HOME}/Projects +#include whitelist-common.inc +include whitelist-runuser-common.inc +include whitelist-usr-share-common.inc +include whitelist-var-common.inc + +caps.drop all +ipc-namespace +machine-id +netfilter +no3d +nodvd +nogroups +nonewprivs +noroot +nosound +notv +nou2f +novideo +protocol unix,inet,inet6,netlink +seccomp +seccomp.block-secondary +shell none + +disable-mnt +private-dev +private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,xdg +private-tmp + +dbus-user none +dbus-system none