diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 51858795733..18d1978fc6b 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc @@ -589,6 +589,7 @@ blacklist ${HOME}/.kodi blacklist ${HOME}/.librewolf blacklist ${HOME}/.lincity-ng blacklist ${HOME}/.links +blacklist ${HOME}/.links2 blacklist ${HOME}/.linphone-history.db blacklist ${HOME}/.linphonerc blacklist ${HOME}/.lmmsrc.xml diff --git a/etc/profile-a-l/elinks.profile b/etc/profile-a-l/elinks.profile index 8120725d29e..5a29eb24b59 100644 --- a/etc/profile-a-l/elinks.profile +++ b/etc/profile-a-l/elinks.profile @@ -1,6 +1,7 @@ # Firejail profile for elinks # Description: Advanced text-mode WWW browser # This file is overwritten after every install/update +quiet # Persistent local customizations include elinks.local # Persistent global definitions @@ -8,37 +9,10 @@ include globals.local noblacklist ${HOME}/.elinks -blacklist /tmp/.X11-unix -blacklist ${RUNUSER}/wayland-* +mkdir ${HOME}/.elinks +whitelist ${HOME}/.elinks -include disable-common.inc -include disable-devel.inc -include disable-interpreters.inc -include disable-passwdmgr.inc -include disable-programs.inc -include disable-xdg.inc +private-bin elinks -include whitelist-runuser-common.inc - -caps.drop all -netfilter -no3d -nodvd -nogroups -noinput -nonewprivs -noroot -nosound -notv -nou2f -novideo -protocol unix,inet,inet6 -seccomp -shell none -tracelog - -# private-bin elinks -private-cache -private-dev -# private-etc alternatives,ca-certificates,crypto-policies,pki,ssl -private-tmp +# Redirect +include links-common.profile diff --git a/etc/profile-a-l/links-common.profile b/etc/profile-a-l/links-common.profile new file mode 100644 index 00000000000..cd885b1d497 --- /dev/null +++ b/etc/profile-a-l/links-common.profile @@ -0,0 +1,63 @@ +# This file is overwritten during software install. +# Persistent customizations should go in a .local file. +include links-common.local + +# common profile for links browsers + +blacklist /tmp/.X11-unix +blacklist ${RUNUSER}/wayland-* + +include disable-common.inc +include disable-devel.inc +include disable-exec.inc +include disable-interpreters.inc +include disable-passwdmgr.inc +# Additional noblacklist files/directories (blacklisted in disable-programs.inc) +# used as associated programs can be added in your links-common.local. +include disable-programs.inc +include disable-xdg.inc + +whitelist ${DOWNLOADS} +include whitelist-runuser-common.inc +include whitelist-usr-share-common.inc +include whitelist-var-common.inc + +caps.drop all +ipc-namespace +# Add 'ignore machine-id' to your links-common.local if you want to restrict access to +# the user-configured associated media player. +machine-id +netfilter +# Add 'ignore no3d' to your links-common.local if you want to restrict access to +# the user-configured associated media player. +no3d +nodvd +nogroups +noinput +nonewprivs +noroot +# Add 'ignore nosound' to your links-common.local if you want to restrict access to +# the user-configured associated media player. +nosound +notv +nou2f +novideo +protocol unix,inet,inet6 +seccomp +shell none +tracelog + +disable-mnt +# Add 'private-bin PROGRAM1,PROGRAM2' to your links-common.local if you want to use user-configured programs. +private-bin sh +private-cache +private-dev +private-etc alternatives,ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl +# Add the next line to your links-common.local to allow external media players. +# private-etc alsa,asound.conf,machine-id,openal,pulse +private-tmp + +dbus-user none +dbus-system none + +memory-deny-write-execute diff --git a/etc/profile-a-l/links.profile b/etc/profile-a-l/links.profile index a1eeda14a4e..8ce39cc7fcb 100644 --- a/etc/profile-a-l/links.profile +++ b/etc/profile-a-l/links.profile @@ -9,58 +9,10 @@ include globals.local noblacklist ${HOME}/.links -blacklist /tmp/.X11-unix -blacklist ${RUNUSER}/wayland-* - -include disable-common.inc -include disable-devel.inc -include disable-exec.inc -include disable-interpreters.inc -include disable-passwdmgr.inc -# Additional noblacklist files/directories (blacklisted in disable-programs.inc) -# used as associated programs can be added in your links.local. -include disable-programs.inc -include disable-xdg.inc - mkdir ${HOME}/.links whitelist ${HOME}/.links -whitelist ${DOWNLOADS} -include whitelist-runuser-common.inc -include whitelist-var-common.inc - -caps.drop all -ipc-namespace -# Add 'ignore machine-id' to your links.local if you want to restrict access to -# the user-configured associated media player. -machine-id -netfilter -# Add 'ignore no3d' to your links.local if you want to restrict access to -# the user-configured associated media player. -no3d -nodvd -nogroups -noinput -nonewprivs -noroot -# Add 'ignore nosound' to your links.local if you want to restrict access to -# the user-configured associated media player. -nosound -notv -nou2f -novideo -protocol unix,inet,inet6 -seccomp -shell none -tracelog -disable-mnt -# Add 'private-bin PROGRAM1,PROGRAM2' to your links.local if you want to use user-configured programs. -private-bin links,sh -private-cache -private-dev -private-etc alternatives,ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl -# Add the next line to your links.local to allow external media players. -# private-etc alsa,asound.conf,machine-id,openal,pulse -private-tmp +private-bin links -memory-deny-write-execute +# Redirect +include links-common.profile diff --git a/etc/profile-a-l/links2.profile b/etc/profile-a-l/links2.profile new file mode 100644 index 00000000000..5f91dfcd268 --- /dev/null +++ b/etc/profile-a-l/links2.profile @@ -0,0 +1,18 @@ +# Firejail profile for links2 +# Description: Text WWW browser with a graphic version +# This file is overwritten after every install/update +quiet +# Persistent local customizations +include links2.local +# Persistent global definitions +include globals.local + +noblacklist ${HOME}/.links2 + +mkdir ${HOME}/.links2 +whitelist ${HOME}/.links2 + +private-bin links2 + +# Redirect +include links-common.profile diff --git a/etc/profile-m-z/xlinks.profile b/etc/profile-m-z/xlinks.profile index 7987af280bf..d5e25cfe71f 100644 --- a/etc/profile-m-z/xlinks.profile +++ b/etc/profile-m-z/xlinks.profile @@ -8,7 +8,6 @@ include xlinks.local #include globals.local noblacklist /tmp/.X11-unix -noblacklist ${HOME}/.links include whitelist-common.inc diff --git a/etc/profile-m-z/xlinks2 b/etc/profile-m-z/xlinks2 new file mode 100644 index 00000000000..1ae6a60ca4b --- /dev/null +++ b/etc/profile-m-z/xlinks2 @@ -0,0 +1,20 @@ +# Firejail profile for xlinks2 +# Description: Text WWW browser (X11) +# This file is overwritten after every install/update +# Persistent local customizations +include xlinks2.local +# Persistent global definitions +# added by included profile +#include globals.local + +noblacklist /tmp/.X11-unix + +include whitelist-common.inc + +# if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' +# to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line +private-bin xlinks2 +private-etc fonts + +# Redirect +include links2.profile diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index f0e3a887f17..245e6a4a03e 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config @@ -452,6 +452,7 @@ liferea lightsoff lincity-ng links +links2 linphone lmms lobase @@ -871,6 +872,7 @@ xfce4-notes xfce4-screenshooter xiphos xlinks +xlinks2 xmms xmr-stak xonotic