firejail: Configure for #!

Cf hashbang#86

firejail/firejail.config

@@ -19,7 +19,7 @@
 # networking features should also be enabled (network yes).
 # Restricted networking grants access to --interface, --net=ethXXX and
 # --netfilter only to root user. Regular users are only allowed --net=none.
-# restricted-network no
+restricted-network yes
 
 # Enable or disable seccomp support, default enabled.
 # seccomp yes
@@ -34,7 +34,7 @@
 # a user abusing firejail's features to trick a privileged (suid
 # or file capabilities) process into loading code or configuration
 # that is partially under their control.  Default disabled
-# force-nonewprivs no
+force-nonewprivs yes
 
 # Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for
 # a full list of resolutions available on your specific setup.