diff --git a/.etckeeper b/.etckeeper index 588b55b..affebaa 100755 --- a/.etckeeper +++ b/.etckeeper @@ -329,71 +329,6 @@ maybe chmod 0755 'etckeeper/vcs.d' maybe chmod 0755 'etckeeper/vcs.d/50vcs-cmd' maybe chmod 0750 'etc/zsh' maybe chmod 0640 'etc/zsh/zprofile' -maybe chmod 0755 'firejail' -maybe chmod 0644 'firejail/audacious.profile' -maybe chmod 0644 'firejail/bitlbee.profile' -maybe chmod 0644 'firejail/chromium-browser.profile' -maybe chmod 0644 'firejail/chromium.profile' -maybe chmod 0644 'firejail/clementine.profile' -maybe chmod 0644 'firejail/conkeror.profile' -maybe chmod 0644 'firejail/deadbeef.profile' -maybe chmod 0644 'firejail/deluge.profile' -maybe chmod 0644 'firejail/disable-common.inc' -maybe chmod 0644 'firejail/disable-devel.inc' -maybe chmod 0644 'firejail/disable-mgmt.inc' -maybe chmod 0644 'firejail/disable-secret.inc' -maybe chmod 0644 'firejail/dnscrypt-proxy.profile' -maybe chmod 0644 'firejail/dropbox.profile' -maybe chmod 0644 'firejail/empathy.profile' -maybe chmod 0644 'firejail/evince.profile' -maybe chmod 0644 'firejail/fbreader.profile' -maybe chmod 0644 'firejail/filezilla.profile' -maybe chmod 0644 'firejail/firefox.profile' -maybe chmod 0644 'firejail/generic.profile' -maybe chmod 0644 'firejail/gnome-mplayer.profile' -maybe chmod 0644 'firejail/google-chrome-beta.profile' -maybe chmod 0644 'firejail/google-chrome.profile' -maybe chmod 0644 'firejail/google-chrome-stable.profile' -maybe chmod 0644 'firejail/google-chrome-unstable.profile' -maybe chmod 0644 'firejail/hexchat.profile' -maybe chmod 0644 'firejail/icecat.profile' -maybe chmod 0644 'firejail/icedove.profile' -maybe chmod 0644 'firejail/iceweasel.profile' -maybe chmod 0644 'firejail/kmail.profile' -maybe chmod 0644 'firejail/login.users' -maybe chmod 0644 'firejail/mathematica.profile' -maybe chmod 0644 'firejail/Mathematica.profile' -maybe chmod 0644 'firejail/midori.profile' -maybe chmod 0644 'firejail/mupen64plus.profile' -maybe chmod 0644 'firejail/nolocal.net' -maybe chmod 0644 'firejail/opera-beta.profile' -maybe chmod 0644 'firejail/opera.profile' -maybe chmod 0644 'firejail/parole.profile' -maybe chmod 0644 'firejail/pidgin.profile' -maybe chmod 0644 'firejail/qbittorrent.profile' -maybe chmod 0644 'firejail/quassel.profile' -maybe chmod 0644 'firejail/rhythmbox.profile' -maybe chmod 0644 'firejail/rtorrent.profile' -maybe chmod 0644 'firejail/seamonkey-bin.profile' -maybe chmod 0644 'firejail/seamonkey.profile' -maybe chmod 0644 'firejail/server.profile' -maybe chmod 0644 'firejail/skype.profile' -maybe chmod 0644 'firejail/spotify.profile' -maybe chmod 0644 'firejail/steam.profile' -maybe chmod 0644 'firejail/telegram.profile' -maybe chmod 0644 'firejail/thunderbird.profile' -maybe chmod 0644 'firejail/totem.profile' -maybe chmod 0644 'firejail/transmission-gtk.profile' -maybe chmod 0644 'firejail/transmission-qt.profile' -maybe chmod 0644 'firejail/uget-gtk.profile' -maybe chmod 0644 'firejail/unbound.profile' -maybe chmod 0644 'firejail/vlc.profile' -maybe chmod 0644 'firejail/webserver.net' -maybe chmod 0644 'firejail/weechat-curses.profile' -maybe chmod 0644 'firejail/weechat.profile' -maybe chmod 0644 'firejail/whitelist-common.inc' -maybe chmod 0644 'firejail/wine.profile' -maybe chmod 0644 'firejail/xchat.profile' maybe chmod 0755 'fish' maybe chmod 0644 'fish/config.fish' maybe chmod 0755 'fonts' diff --git a/firejail/Mathematica.profile b/firejail/Mathematica.profile deleted file mode 100644 index 3b76afa..0000000 --- a/firejail/Mathematica.profile +++ /dev/null @@ -1,12 +0,0 @@ -# Mathematica profile -whitelist ~/.Mathematica -whitelist ~/.Wolfram Research -whitelist ~/Documents/Wolfram Mathematica -include /etc/firejail/whitelist-common.inc -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -caps.drop all -seccomp -noroot diff --git a/firejail/audacious.profile b/firejail/audacious.profile deleted file mode 100644 index fa9cbbc..0000000 --- a/firejail/audacious.profile +++ /dev/null @@ -1,15 +0,0 @@ -# Audacious profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot - diff --git a/firejail/bitlbee.profile b/firejail/bitlbee.profile deleted file mode 100644 index 4cd24fd..0000000 --- a/firejail/bitlbee.profile +++ /dev/null @@ -1,9 +0,0 @@ -# BitlBee profile -noblacklist /sbin -noblacklist /usr/sbin -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-common.inc -protocol unix,inet,inet6 -private -private-dev -seccomp diff --git a/firejail/chromium-browser.profile b/firejail/chromium-browser.profile deleted file mode 100644 index d989b73..0000000 --- a/firejail/chromium-browser.profile +++ /dev/null @@ -1,2 +0,0 @@ -# Chromium browser profile -include /etc/firejail/chromium.profile diff --git a/firejail/chromium.profile b/firejail/chromium.profile deleted file mode 100644 index 76dc6b2..0000000 --- a/firejail/chromium.profile +++ /dev/null @@ -1,15 +0,0 @@ -# Chromium browser profile -noblacklist ${HOME}/.config/chromium -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc - -# chromium is distributed with a perl script on Arch -# include /etc/firejail/disable-devel.inc -# - -netfilter -whitelist ${DOWNLOADS} -whitelist ~/.config/chromium -whitelist ~/.cache/chromium -include /etc/firejail/whitelist-common.inc diff --git a/firejail/clementine.profile b/firejail/clementine.profile deleted file mode 100644 index e84d8f1..0000000 --- a/firejail/clementine.profile +++ /dev/null @@ -1,14 +0,0 @@ -# Clementine profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot diff --git a/firejail/conkeror.profile b/firejail/conkeror.profile deleted file mode 100644 index e2e55a0..0000000 --- a/firejail/conkeror.profile +++ /dev/null @@ -1,24 +0,0 @@ -# Firejail profile for Mozilla Firefox (Iceweasel in Debian) -noblacklist ${HOME}/.conkeror.mozdev.org -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -caps.drop all -seccomp -protocol unix,inet,inet6 -netfilter -noroot -whitelist ~/.conkeror.mozdev.org -whitelist ~/Downloads -whitelist ~/dwhelper -whitelist ~/.zotero -whitelist ~/.lastpass -whitelist ~/.gtkrc-2.0 -whitelist ~/.vimperatorrc -whitelist ~/.vimperator -whitelist ~/.pentadactylrc -whitelist ~/.pentadactyl -whitelist ~/.conkerorrc - -# common -include /etc/firejail/whitelist-common.inc diff --git a/firejail/deadbeef.profile b/firejail/deadbeef.profile deleted file mode 100644 index 0d6e70a..0000000 --- a/firejail/deadbeef.profile +++ /dev/null @@ -1,15 +0,0 @@ -# DeaDBeeF profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot - diff --git a/firejail/deluge.profile b/firejail/deluge.profile deleted file mode 100644 index 4f76f36..0000000 --- a/firejail/deluge.profile +++ /dev/null @@ -1,17 +0,0 @@ -# deluge profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -netfilter -noroot - - diff --git a/firejail/disable-common.inc b/firejail/disable-common.inc deleted file mode 100644 index 46dd04b..0000000 --- a/firejail/disable-common.inc +++ /dev/null @@ -1,134 +0,0 @@ -# History files in $HOME -blacklist-nolog ${HOME}/.history -blacklist-nolog ${HOME}/.*_history - -# HTTP / FTP / Mail -blacklist-nolog ${HOME}/.adobe -blacklist-nolog ${HOME}/.macromedia -blacklist ${HOME}/.mozilla -blacklist ${HOME}/.icedove -blacklist ${HOME}/.thunderbird -blacklist ${HOME}/.sylpheed-2.0 -blacklist ${HOME}/.config/midori -blacklist ${HOME}/.config/opera -blacklist ${HOME}/.config/opera-beta -blacklist ${HOME}/.config/chromium -blacklist ${HOME}/.config/google-chrome -blacklist ${HOME}/.config/google-chrome-beta -blacklist ${HOME}/.config/google-chrome-unstable -blacklist ${HOME}/.filezilla -blacklist ${HOME}/.config/filezilla -blacklist ${HOME}/.local/share/systemd - -# Instant Messaging -blacklist ${HOME}/.config/hexchat -blacklist ${HOME}/.mcabber -blacklist ${HOME}/.purple -blacklist ${HOME}/.config/psi+ -blacklist ${HOME}/.retroshare -blacklist ${HOME}/.weechat -blacklist ${HOME}/.config/xchat -blacklist ${HOME}/.Skype - -# Cryptocoins -blacklist ${HOME}/.*coin -blacklist ${HOME}/.electrum* -blacklist ${HOME}/wallet.dat - -# VNC -blacklist ${HOME}/.remmina - -# Other -blacklist ${HOME}/.tconn -blacklist ${HOME}/.FBReader -blacklist ${HOME}/.wine - -# X11 session autostart -blacklist ${HOME}/.xinitrc -blacklist ${HOME}/.xprofile -blacklist ${HOME}/.config/autostart -blacklist /etc/xdg/autostart -blacklist ${HOME}/.kde4/Autostart -blacklist ${HOME}/.kde4/share/autostart -blacklist ${HOME}/.kde/Autostart -blacklist ${HOME}/.config/plasma-workspace/shutdown -blacklist ${HOME}/.config/plasma-workspace/env -blacklist ${HOME}/.config/lxsession/LXDE/autostart -blacklist ${HOME}/.fluxbox/startup -blacklist ${HOME}/.config/openbox/autostart -blacklist ${HOME}/.config/openbox/environment - -# VirtualBox -blacklist ${HOME}/.VirtualBox -blacklist ${HOME}/VirtualBox VMs -blacklist ${HOME}/.config/VirtualBox - -# git, subversion -blacklist ${HOME}/.subversion -blacklist ${HOME}/.gitconfig -blacklist ${HOME}/.git-credential-cache - -# var -blacklist /var/spool/cron -blacklist /var/spool/anacron -blacklist /var/run/acpid.socket -blacklist /var/run/minissdpd.sock -blacklist /var/run/rpcbind.sock -blacklist /var/run/mysqld/mysqld.sock -blacklist /var/run/mysql/mysqld.sock -blacklist /var/lib/mysqld/mysql.sock -blacklist /var/lib/mysql/mysql.sock -blacklist /var/run/docker.sock - -# etc -blacklist /etc/cron.* -blacklist /etc/profile.d -blacklist /etc/rc.local -blacklist /etc/anacrontab - -# General startup files -read-only ${HOME}/.xinitrc -read-only ${HOME}/.xserverrc -read-only ${HOME}/.profile - -# Shell startup files -read-only ${HOME}/.bash_login -read-only ${HOME}/.bashrc -read-only ${HOME}/.bash_profile -read-only ${HOME}/.bash_logout -read-only ${HOME}/.zshrc -read-only ${HOME}/.zlogin -read-only ${HOME}/.zprofile -read-only ${HOME}/.zlogout -read-only ${HOME}/.zsh_files -read-only ${HOME}/.tcshrc -read-only ${HOME}/.cshrc -read-only ${HOME}/.csh_files - -# Initialization files that allow arbitrary command execution -read-only ${HOME}/.mailcap -read-only ${HOME}/.exrc -read-only ${HOME}/_exrc -read-only ${HOME}/.vimrc -read-only ${HOME}/_vimrc -read-only ${HOME}/.gvimrc -read-only ${HOME}/_gvimrc -read-only ${HOME}/.vim -read-only ${HOME}/.emacs -read-only ${HOME}/.tmux.conf -read-only ${HOME}/.iscreenrc -read-only ${HOME}/.muttrc -read-only ${HOME}/.mutt/muttrc -read-only ${HOME}/.xmonad -read-only ${HOME}/.xscreensaver - -# The user ~/bin directory can override commands such as ls -read-only ${HOME}/bin - -# disable terminals running as server -blacklist ${PATH}/lxterminal -blacklist ${PATH}/gnome-terminal -blacklist ${PATH}/gnome-terminal.wrapper -blacklist ${PATH}/xfce4-terminal -blacklist ${PATH}/xfce4-terminal.wrapper -blacklist ${PATH}/konsole diff --git a/firejail/disable-devel.inc b/firejail/disable-devel.inc deleted file mode 100644 index 65b31ba..0000000 --- a/firejail/disable-devel.inc +++ /dev/null @@ -1,36 +0,0 @@ -# development tools - -# GCC -blacklist /usr/include -blacklist /usr/bin/gcc* -blacklist /usr/bin/cpp* -blacklist /usr/bin/c9* -blacklist /usr/bin/c8* -blacklist /usr/bin/c++* -blacklist /usr/bin/ld -blacklist /usr/bin/gdb - -# clang/llvm -blacklist /usr/bin/clang* -blacklist /usr/bin/llvm* -blacklist /usb/bin/lldb* -blacklist /usr/lib/llvm* - -# Valgrind -blacklist /usr/bin/valgrind* -blacklist /usr/lib/valgrind - -# Perl -blacklist /usr/bin/perl -blacklist /usr/bin/cpan* -blacklist /usr/share/perl* -blacklist /usr/lib/perl* - -# PHP -blacklist /usr/bin/php* -blacklist /usr/share/php* -blacklist /usr/lib/php* - -# Ruby -blacklist /usr/bin/ruby -blacklist /usr/lib/ruby diff --git a/firejail/disable-mgmt.inc b/firejail/disable-mgmt.inc deleted file mode 100644 index 0a11d67..0000000 --- a/firejail/disable-mgmt.inc +++ /dev/null @@ -1,17 +0,0 @@ -# system directories -blacklist /sbin -blacklist /usr/sbin -blacklist /usr/local/sbin - -# system management -blacklist ${PATH}/umount -blacklist ${PATH}/mount -blacklist ${PATH}/fusermount -blacklist ${PATH}/su -blacklist ${PATH}/sudo -blacklist ${PATH}/xinput -blacklist ${PATH}/evtest -blacklist ${PATH}/xev -blacklist ${PATH}/strace -blacklist ${PATH}/nc -blacklist ${PATH}/ncat diff --git a/firejail/disable-secret.inc b/firejail/disable-secret.inc deleted file mode 100644 index 7d29cda..0000000 --- a/firejail/disable-secret.inc +++ /dev/null @@ -1,23 +0,0 @@ -# HOME directory -blacklist ${HOME}/.ssh -blacklist ${HOME}/.gnome2/keyrings -blacklist ${HOME}/kde4/share/apps/kwallet -blacklist ${HOME}/kde/share/apps/kwallet -blacklist ${HOME}/.local/share/kwalletd -blacklist ${HOME}/.netrc -blacklist ${HOME}/.gnupg -blacklist ${HOME}/*.kdbx -blacklist ${HOME}/*.kdb -blacklist ${HOME}/*.key -blacklist /etc/shadow -blacklist /etc/gshadow -blacklist /etc/passwd- -blacklist /etc/group- -blacklist /etc/shadow- -blacklist /etc/gshadow- -blacklist /etc/passwd+ -blacklist /etc/group+ -blacklist /etc/shadow+ -blacklist /etc/gshadow+ -blacklist /etc/ssh -blacklist /var/backup diff --git a/firejail/dnscrypt-proxy.profile b/firejail/dnscrypt-proxy.profile deleted file mode 100644 index d13bab0..0000000 --- a/firejail/dnscrypt-proxy.profile +++ /dev/null @@ -1,11 +0,0 @@ -# security profile for dnscrypt-proxy -noblacklist /sbin -noblacklist /usr/sbin -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -include /etc/firejail/disable-secret.inc -private -private-dev -seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open - diff --git a/firejail/dropbox.profile b/firejail/dropbox.profile deleted file mode 100644 index 248e3ac..0000000 --- a/firejail/dropbox.profile +++ /dev/null @@ -1,14 +0,0 @@ -# dropbox profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps -seccomp -protocol unix,inet,inet6 -noroot - diff --git a/firejail/empathy.profile b/firejail/empathy.profile deleted file mode 100644 index 984bbc5..0000000 --- a/firejail/empathy.profile +++ /dev/null @@ -1,9 +0,0 @@ -# Empathy profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 diff --git a/firejail/evince.profile b/firejail/evince.profile deleted file mode 100644 index 34d8162..0000000 --- a/firejail/evince.profile +++ /dev/null @@ -1,14 +0,0 @@ -# evince profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot diff --git a/firejail/fbreader.profile b/firejail/fbreader.profile deleted file mode 100644 index f94fc28..0000000 --- a/firejail/fbreader.profile +++ /dev/null @@ -1,17 +0,0 @@ -# fbreader profile -noblacklist ${HOME}/.FBReader -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -netfilter -noroot - diff --git a/firejail/filezilla.profile b/firejail/filezilla.profile deleted file mode 100644 index ba86490..0000000 --- a/firejail/filezilla.profile +++ /dev/null @@ -1,15 +0,0 @@ -# FileZilla profile -noblacklist ${HOME}/.filezilla -noblacklist ${HOME}/.config/filezilla -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot -netfilter - - diff --git a/firejail/firefox.profile b/firejail/firefox.profile deleted file mode 100644 index a210933..0000000 --- a/firejail/firefox.profile +++ /dev/null @@ -1,31 +0,0 @@ -# Firejail profile for Mozilla Firefox (Iceweasel in Debian) -noblacklist ${HOME}/.mozilla -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -caps.drop all -seccomp -protocol unix,inet,inet6,netlink -netfilter -tracelog -noroot -whitelist ${DOWNLOADS} -whitelist ~/.mozilla -whitelist ~/.cache/mozilla/firefox -whitelist ~/dwhelper -whitelist ~/.zotero -whitelist ~/.lastpass -whitelist ~/.vimperatorrc -whitelist ~/.vimperator -whitelist ~/.pentadactylrc -whitelist ~/.pentadactyl -whitelist ~/.keysnail.js -whitelist ~/.config/gnome-mplayer -whitelist ~/.cache/gnome-mplayer/plugin -include /etc/firejail/whitelist-common.inc - -# experimental features -#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse - - diff --git a/firejail/generic.profile b/firejail/generic.profile deleted file mode 100644 index cc40ad2..0000000 --- a/firejail/generic.profile +++ /dev/null @@ -1,16 +0,0 @@ -################################ -# Generic GUI application profile -################################ -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -caps.drop all -seccomp -protocol unix,inet,inet6 -netfilter -noroot - diff --git a/firejail/gnome-mplayer.profile b/firejail/gnome-mplayer.profile deleted file mode 100644 index 0a495b0..0000000 --- a/firejail/gnome-mplayer.profile +++ /dev/null @@ -1,14 +0,0 @@ -# GNOME MPlayer profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot diff --git a/firejail/google-chrome-beta.profile b/firejail/google-chrome-beta.profile deleted file mode 100644 index 6122876..0000000 --- a/firejail/google-chrome-beta.profile +++ /dev/null @@ -1,16 +0,0 @@ -# Google Chrome beta browser profile -noblacklist ${HOME}/.config/google-chrome-beta -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc - -# chromium is distributed with a perl script on Arch -# include /etc/firejail/disable-devel.inc -# - -netfilter -whitelist ${DOWNLOADS} -whitelist ~/.config/google-chrome-beta -whitelist ~/.cache/google-chrome-beta -include /etc/firejail/whitelist-common.inc - diff --git a/firejail/google-chrome-stable.profile b/firejail/google-chrome-stable.profile deleted file mode 100644 index 78c8ca6..0000000 --- a/firejail/google-chrome-stable.profile +++ /dev/null @@ -1,2 +0,0 @@ -# Google Chrome browser profile -include /etc/firejail/google-chrome.profile diff --git a/firejail/google-chrome-unstable.profile b/firejail/google-chrome-unstable.profile deleted file mode 100644 index 7b8b12d..0000000 --- a/firejail/google-chrome-unstable.profile +++ /dev/null @@ -1,16 +0,0 @@ -# Google Chrome unstable browser profile -noblacklist ${HOME}/.config/google-chrome-unstable -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc - -# chromium is distributed with a perl script on Arch -# include /etc/firejail/disable-devel.inc -# - -netfilter -whitelist ${DOWNLOADS} -whitelist ~/.config/google-chrome-unstable -whitelist ~/.cache/google-chrome-unstable -include /etc/firejail/whitelist-common.inc - diff --git a/firejail/google-chrome.profile b/firejail/google-chrome.profile deleted file mode 100644 index 351490d..0000000 --- a/firejail/google-chrome.profile +++ /dev/null @@ -1,15 +0,0 @@ -# Google Chrome browser profile -noblacklist ${HOME}/.config/google-chrome -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc - -# chromium is distributed with a perl script on Arch -# include /etc/firejail/disable-devel.inc -# - -netfilter -whitelist ${DOWNLOADS} -whitelist ~/.config/google-chrome -whitelist ~/.cache/google-chrome -include /etc/firejail/whitelist-common.inc diff --git a/firejail/hexchat.profile b/firejail/hexchat.profile deleted file mode 100644 index 61c9ac5..0000000 --- a/firejail/hexchat.profile +++ /dev/null @@ -1,10 +0,0 @@ -# HexChat profile -noblacklist ${HOME}/.config/hexchat -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot diff --git a/firejail/icecat.profile b/firejail/icecat.profile deleted file mode 100644 index 25d426a..0000000 --- a/firejail/icecat.profile +++ /dev/null @@ -1,2 +0,0 @@ -# Firejail profile for GNU Icecat -include /etc/firejail/firefox.profile diff --git a/firejail/icedove.profile b/firejail/icedove.profile deleted file mode 100644 index 057e0c9..0000000 --- a/firejail/icedove.profile +++ /dev/null @@ -1,3 +0,0 @@ -# Firejail profile for Mozilla Thunderbird (Icedove in Debian) -include /etc/firejail/thunderbird.profile - diff --git a/firejail/iceweasel.profile b/firejail/iceweasel.profile deleted file mode 100644 index e9b3284..0000000 --- a/firejail/iceweasel.profile +++ /dev/null @@ -1,2 +0,0 @@ -# Firejail profile for Mozilla Firefox (Iceweasel in Debian) -include /etc/firejail/firefox.profile diff --git a/firejail/kmail.profile b/firejail/kmail.profile deleted file mode 100644 index 0571375..0000000 --- a/firejail/kmail.profile +++ /dev/null @@ -1,19 +0,0 @@ -# kmail profile -noblacklist ${HOME}/.gnupg -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6,netlink -netfilter -noroot -tracelog - - diff --git a/firejail/login.users b/firejail/login.users deleted file mode 100644 index 5d59690..0000000 --- a/firejail/login.users +++ /dev/null @@ -1,14 +0,0 @@ -# /etc/firejail/login.users - restricted user shell configuration -# -# Each user entry consists of a user name and firejail -# program arguments: -# -# user name: arguments -# -# For example: -# -# netblue:--debug --net=none -# -# The extra arguments are inserted into program command line if firejail -# was started as a login shell. - diff --git a/firejail/mathematica.profile b/firejail/mathematica.profile deleted file mode 100644 index 9410054..0000000 --- a/firejail/mathematica.profile +++ /dev/null @@ -1,2 +0,0 @@ -# Mathematica profile -include /etc/firejail/Mathematica.profile diff --git a/firejail/midori.profile b/firejail/midori.profile deleted file mode 100644 index 77a6fb9..0000000 --- a/firejail/midori.profile +++ /dev/null @@ -1,11 +0,0 @@ -# Midori browser profile -noblacklist ${HOME}/.config/midori -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -caps.drop all -seccomp -protocol unix,inet,inet6 -netfilter - diff --git a/firejail/mupen64plus.profile b/firejail/mupen64plus.profile deleted file mode 100644 index f21c356..0000000 --- a/firejail/mupen64plus.profile +++ /dev/null @@ -1,12 +0,0 @@ -# mupen64plus profile -# manually whitelist ROM files -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -whitelist ${HOME}/.local/share/mupen64plus/ -whitelist ${HOME}/.config/mupen64plus/ -noroot -caps.drop all -seccomp -net none diff --git a/firejail/nolocal.net b/firejail/nolocal.net deleted file mode 100644 index 9c0c6e1..0000000 --- a/firejail/nolocal.net +++ /dev/null @@ -1,25 +0,0 @@ -*filter -:INPUT DROP [0:0] -:FORWARD DROP [0:0] -:OUTPUT ACCEPT [0:0] - -################################################################### -# Client filter rejecting local network traffic, with the exception of DNS traffic -# -# Usage: -# firejail --net=eth0 --netfilter=/etc/firejail/nolocal.net firefox -# -################################################################### - - --A INPUT -i lo -j ACCEPT --A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT --A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT --A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT --A INPUT -p icmp --icmp-type echo-request -j ACCEPT - --A OUTPUT -p udp --dport 53 -j ACCEPT --A OUTPUT -d 192.168.0.0/16 -j DROP --A OUTPUT -d 10.0.0.0/8 -j DROP --A OUTPUT -d 172.16.0.0/12 -j DROP -COMMIT diff --git a/firejail/opera-beta.profile b/firejail/opera-beta.profile deleted file mode 100644 index c1672ab..0000000 --- a/firejail/opera-beta.profile +++ /dev/null @@ -1,13 +0,0 @@ -# Opera-beta browser profile -noblacklist ${HOME}/.config/opera-beta -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -netfilter -whitelist ~/.config/opera-beta -whitelist ${DOWNLOADS} -whitelist ~/.cache/opera-beta -include /etc/firejail/whitelist-common.inc - - diff --git a/firejail/opera.profile b/firejail/opera.profile deleted file mode 100644 index a76806e..0000000 --- a/firejail/opera.profile +++ /dev/null @@ -1,13 +0,0 @@ -# Opera browser profile -noblacklist ${HOME}/.config/opera -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -netfilter -whitelist ~/.config/opera -whitelist ${DOWNLOADS} -whitelist ~/.cache/opera -include /etc/firejail/whitelist-common.inc - - diff --git a/firejail/parole.profile b/firejail/parole.profile deleted file mode 100644 index 24181c8..0000000 --- a/firejail/parole.profile +++ /dev/null @@ -1,17 +0,0 @@ -# Profile for Parole, the default XFCE4 media player -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -private-etc passwd,group,fonts -private-bin parole,dbus-launch -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -caps.drop all -seccomp -protocol unix,inet,inet6 -netfilter -noroot -shell none diff --git a/firejail/pidgin.profile b/firejail/pidgin.profile deleted file mode 100644 index 3dd57b6..0000000 --- a/firejail/pidgin.profile +++ /dev/null @@ -1,11 +0,0 @@ -# Pidgin profile -noblacklist ${HOME}/.purple -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot diff --git a/firejail/qbittorrent.profile b/firejail/qbittorrent.profile deleted file mode 100644 index dd50c77..0000000 --- a/firejail/qbittorrent.profile +++ /dev/null @@ -1,16 +0,0 @@ -# qbittorrent profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -netfilter -noroot - diff --git a/firejail/quassel.profile b/firejail/quassel.profile deleted file mode 100644 index cb97d07..0000000 --- a/firejail/quassel.profile +++ /dev/null @@ -1,10 +0,0 @@ -# Quassel IRC profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot diff --git a/firejail/rhythmbox.profile b/firejail/rhythmbox.profile deleted file mode 100644 index 9fc1fcb..0000000 --- a/firejail/rhythmbox.profile +++ /dev/null @@ -1,14 +0,0 @@ -# Rhythmbox profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot diff --git a/firejail/rtorrent.profile b/firejail/rtorrent.profile deleted file mode 100644 index c2c0356..0000000 --- a/firejail/rtorrent.profile +++ /dev/null @@ -1,10 +0,0 @@ -# rtorrent profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -caps.drop all -seccomp -protocol unix,inet,inet6 -netfilter -noroot diff --git a/firejail/seamonkey-bin.profile b/firejail/seamonkey-bin.profile deleted file mode 100644 index 55b64bd..0000000 --- a/firejail/seamonkey-bin.profile +++ /dev/null @@ -1,30 +0,0 @@ -# Firejail profile for Seamoneky based off Mozilla Firefox -noblacklist ${HOME}/.mozilla -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -caps.drop all -seccomp -protocol unix,inet,inet6,netlink -netfilter -tracelog -noroot -whitelist ${DOWNLOADS} -whitelist ~/.mozilla/seamonkey -whitelist ~/.cache/mozilla/seamonkey -whitelist ~/dwhelper -whitelist ~/.zotero -whitelist ~/.lastpass -whitelist ~/.vimperatorrc -whitelist ~/.vimperator -whitelist ~/.pentadactylrc -whitelist ~/.pentadactyl -whitelist ~/.keysnail.js -whitelist ~/.config/gnome-mplayer -whitelist ~/.cache/gnome-mplayer/plugin -include /etc/firejail/whitelist-common.inc - -# experimental features -#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse - diff --git a/firejail/seamonkey.profile b/firejail/seamonkey.profile deleted file mode 100644 index 55b64bd..0000000 --- a/firejail/seamonkey.profile +++ /dev/null @@ -1,30 +0,0 @@ -# Firejail profile for Seamoneky based off Mozilla Firefox -noblacklist ${HOME}/.mozilla -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -caps.drop all -seccomp -protocol unix,inet,inet6,netlink -netfilter -tracelog -noroot -whitelist ${DOWNLOADS} -whitelist ~/.mozilla/seamonkey -whitelist ~/.cache/mozilla/seamonkey -whitelist ~/dwhelper -whitelist ~/.zotero -whitelist ~/.lastpass -whitelist ~/.vimperatorrc -whitelist ~/.vimperator -whitelist ~/.pentadactylrc -whitelist ~/.pentadactyl -whitelist ~/.keysnail.js -whitelist ~/.config/gnome-mplayer -whitelist ~/.cache/gnome-mplayer/plugin -include /etc/firejail/whitelist-common.inc - -# experimental features -#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse - diff --git a/firejail/server.profile b/firejail/server.profile deleted file mode 100644 index 5471aed..0000000 --- a/firejail/server.profile +++ /dev/null @@ -1,10 +0,0 @@ -# generic server profile -# it allows /sbin and /usr/sbin directories - this is where servers are installed -noblacklist /sbin -noblacklist /usr/sbin -include /etc/firejail/disable-mgmt.inc -private -private-dev -private-tmp -seccomp - diff --git a/firejail/skype.profile b/firejail/skype.profile deleted file mode 100644 index 4d2d042..0000000 --- a/firejail/skype.profile +++ /dev/null @@ -1,11 +0,0 @@ -# Skype profile -noblacklist ${HOME}/.Skype -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -caps.drop all -netfilter -noroot -seccomp -protocol unix,inet,inet6 diff --git a/firejail/spotify.profile b/firejail/spotify.profile deleted file mode 100644 index ea180e0..0000000 --- a/firejail/spotify.profile +++ /dev/null @@ -1,20 +0,0 @@ -# Spotify profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc - -# Whitelist the folders needed by Spotify - This is more restrictive -# than a blacklist though, but this is all spotify requires for -# streaming audio -whitelist ${HOME}/.config/spotify -whitelist ${HOME}/.local/share/spotify -whitelist ${HOME}/.cache/spotify -include /etc/firejail/whitelist-common.inc - -caps.drop all -seccomp -protocol unix,inet,inet6,netlink -netfilter -noroot - diff --git a/firejail/steam.profile b/firejail/steam.profile deleted file mode 100644 index 5b92445..0000000 --- a/firejail/steam.profile +++ /dev/null @@ -1,12 +0,0 @@ -# Steam profile (applies to games/apps launched from Steam as well) -noblacklist ${HOME}/.steam -noblacklist ${HOME}/.local/share/steam -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -caps.drop all -netfilter -noroot -seccomp -protocol unix,inet,inet6 diff --git a/firejail/telegram.profile b/firejail/telegram.profile deleted file mode 100644 index 0312a7a..0000000 --- a/firejail/telegram.profile +++ /dev/null @@ -1,14 +0,0 @@ -# Telegram profile -noblacklist ${HOME}/.TelegramDesktop -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc - -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot - -whitelist ~/Downloads/Telegram Desktop -whitelist ~/.TelegramDesktop diff --git a/firejail/thunderbird.profile b/firejail/thunderbird.profile deleted file mode 100644 index f608f54..0000000 --- a/firejail/thunderbird.profile +++ /dev/null @@ -1,26 +0,0 @@ -# Firejail profile for Mozilla Thunderbird (Icedove in Debian) -noblacklist ${HOME}/.gnupg -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-devel.inc - -# Users have thunderbird set to open a browser by clicking a link in an email -# We are not allowed to blacklist browser-specific directories -#include /etc/firejail/disable-common.inc thunderbird icedove -blacklist ${HOME}/.adobe -blacklist ${HOME}/.macromedia -blacklist ${HOME}/.filezilla -blacklist ${HOME}/.config/filezilla -blacklist ${HOME}/.purple -blacklist ${HOME}/.config/psi+ -blacklist ${HOME}/.remmina -blacklist ${HOME}/.tconn - - -caps.drop all -seccomp -protocol unix,inet,inet6 -netfilter -tracelog -noroot - diff --git a/firejail/totem.profile b/firejail/totem.profile deleted file mode 100644 index 52b9450..0000000 --- a/firejail/totem.profile +++ /dev/null @@ -1,14 +0,0 @@ -# Totem profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot diff --git a/firejail/transmission-gtk.profile b/firejail/transmission-gtk.profile deleted file mode 100644 index a66ab0d..0000000 --- a/firejail/transmission-gtk.profile +++ /dev/null @@ -1,19 +0,0 @@ -# transmission-gtk profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -netfilter -noroot -tracelog - - - diff --git a/firejail/transmission-qt.profile b/firejail/transmission-qt.profile deleted file mode 100644 index ad23c62..0000000 --- a/firejail/transmission-qt.profile +++ /dev/null @@ -1,17 +0,0 @@ -# transmission-qt profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -netfilter -noroot -tracelog - diff --git a/firejail/uget-gtk.profile b/firejail/uget-gtk.profile deleted file mode 100644 index 6d0c5be..0000000 --- a/firejail/uget-gtk.profile +++ /dev/null @@ -1,13 +0,0 @@ -# uGet profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -caps.drop all -seccomp -protocol unix,inet,inet6 -netfilter -noroot -whitelist ${DOWNLOADS} -whitelist ~/.config/uGet -include /etc/firejail/whitelist-common.inc diff --git a/firejail/unbound.profile b/firejail/unbound.profile deleted file mode 100644 index aba5a9b..0000000 --- a/firejail/unbound.profile +++ /dev/null @@ -1,12 +0,0 @@ -# security profile for unbound (https://unbound.net) -noblacklist /sbin -noblacklist /usr/sbin -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -include /etc/firejail/disable-secret.inc -private -private -private-dev -seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open - diff --git a/firejail/vlc.profile b/firejail/vlc.profile deleted file mode 100644 index 37ff293..0000000 --- a/firejail/vlc.profile +++ /dev/null @@ -1,14 +0,0 @@ -# VLC profile -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.pki/nssdb -blacklist ${HOME}/.lastpass -blacklist ${HOME}/.keepassx -blacklist ${HOME}/.password-store -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot diff --git a/firejail/webserver.net b/firejail/webserver.net deleted file mode 100644 index d165e6f..0000000 --- a/firejail/webserver.net +++ /dev/null @@ -1,30 +0,0 @@ -*filter -:INPUT DROP [0:0] -:FORWARD DROP [0:0] -:OUTPUT DROP [0:0] - -################################################################### -# Simple webserver filter -# -# Usage: -# firejail --net=eth0 --ip=192.168.1.105 --netfilter=/etc/firejail/webserver.net /etc/init.d/apache2 start -# firejail --net=eth0 --ip=192.168.1.105 --netfilter=/etc/firejail/webserver.net /etc/init.d/nginx start -# -################################################################### - -# allow webserver traffic --A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT --A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT --A INPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT --A OUTPUT -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT - -# allow incoming ping --A INPUT -p icmp --icmp-type echo-request -j ACCEPT --A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT - -# allow outgoing DNS --A OUTPUT -p udp --dport 53 -j ACCEPT --A INPUT -p udp --sport 53 -j ACCEPT - -COMMIT - diff --git a/firejail/weechat-curses.profile b/firejail/weechat-curses.profile deleted file mode 100644 index f7c1b65..0000000 --- a/firejail/weechat-curses.profile +++ /dev/null @@ -1,2 +0,0 @@ -# Weechat profile (Debian) -include /etc/firejail/weechat.profile diff --git a/firejail/weechat.profile b/firejail/weechat.profile deleted file mode 100644 index 79e3ae7..0000000 --- a/firejail/weechat.profile +++ /dev/null @@ -1,10 +0,0 @@ -# Weechat profile -noblacklist ${HOME}/.weechat -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-secret.inc -caps.drop all -seccomp -protocol unix,inet,inet6 -netfilter -noroot diff --git a/firejail/whitelist-common.inc b/firejail/whitelist-common.inc deleted file mode 100644 index 5a96c7f..0000000 --- a/firejail/whitelist-common.inc +++ /dev/null @@ -1,22 +0,0 @@ -# common whitelist for all profiles - -whitelist ~/.config/mimeapps.list -whitelist ~/.icons -whitelist ~/.config/user-dirs.dirs -read-only ~/.config/user-dirs.dirs -whitelist ~/.asoundrc - -# fonts -whitelist ~/.fonts -whitelist ~/.fonts.d -whitelist ~/.fontconfig -whitelist ~/.fonts.conf -whitelist ~/.fonts.conf.d -whitelist ~/.config/fontconfig -whitelist ~/.cache/fontconfig - -# gtk -whitelist ~/.gtkrc -whitelist ~/.gtkrc-2.0 -whitelist ~/.config/gtk-3.0 -whitelist ~/.themes diff --git a/firejail/wine.profile b/firejail/wine.profile deleted file mode 100644 index 8a7f667..0000000 --- a/firejail/wine.profile +++ /dev/null @@ -1,12 +0,0 @@ -# wine profile -noblacklist ${HOME}/.steam -noblacklist ${HOME}/.local/share/steam -noblacklist ${HOME}/.wine -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -caps.drop all -netfilter -noroot -seccomp diff --git a/firejail/xchat.profile b/firejail/xchat.profile deleted file mode 100644 index 37e1371..0000000 --- a/firejail/xchat.profile +++ /dev/null @@ -1,11 +0,0 @@ -# XChat profile -noblacklist ${HOME}/.config/xchat -include /etc/firejail/disable-mgmt.inc -include /etc/firejail/disable-secret.inc -include /etc/firejail/disable-common.inc -include /etc/firejail/disable-devel.inc -blacklist ${HOME}/.wine -caps.drop all -seccomp -protocol unix,inet,inet6 -noroot diff --git a/packages.txt b/packages.txt index 57d8896..f80ea38 100644 --- a/packages.txt +++ b/packages.txt @@ -118,7 +118,6 @@ fakeroot install figlet install file install findutils install -firejail install fish install fish-common install fontconfig install