diff options
Diffstat (limited to 'profiles')
-rw-r--r-- | profiles/qimv.profile | 52 | ||||
-rw-r--r-- | profiles/qtox.local | 2 | ||||
-rw-r--r-- | profiles/toxic.profile | 2 |
3 files changed, 54 insertions, 2 deletions
diff --git a/profiles/qimv.profile b/profiles/qimv.profile new file mode 100644 index 0000000..e3a7500 --- /dev/null +++ b/profiles/qimv.profile @@ -0,0 +1,52 @@ +# Firejail profile for qimv +# Description: Image viewer +# This file is overwritten after every install/update +# Persistent local customizations +include qimv.local +# Persistent global definitions +include globals.local + +# Comment in these two lines to enable testing the binary from ${HOME} +#ignore noexec ${HOME} +#ignore private-bin qimv,imv + +include disable-common.inc +include disable-devel.inc +include disable-exec.inc +include disable-interpreters.inc +include disable-passwdmgr.inc +include disable-programs.inc +include disable-shell.inc + +#include whitelist-common.inc +#include whitelist-var-common.inc + +apparmor +caps.drop all +machine-id +net none +# no3d +nodvd +nogroups +nonewprivs +noroot +nosound +notv +nou2f +novideo +protocol unix +seccomp +shell none +tracelog + +# disable-mnt +private-bin qimv,imv +private-cache +private-dev +private-etc fonts,machine-id,localtime,passwd +private-tmp + +memory-deny-write-execute + +dbus-user none +dbus-system none diff --git a/profiles/qtox.local b/profiles/qtox.local index 8186bdf..8faca83 100644 --- a/profiles/qtox.local +++ b/profiles/qtox.local @@ -1,4 +1,4 @@ -# # qtox alsa audio will work with ipc-namespace, +# # alsa audio will work with ipc-namespace, # # but it hogs the alsa device from other applications ignore ipc-namespace diff --git a/profiles/toxic.profile b/profiles/toxic.profile index 15203b6..8b6bd53 100644 --- a/profiles/toxic.profile +++ b/profiles/toxic.profile @@ -45,8 +45,8 @@ disable-mnt private-bin toxic # private-bin toxic,gpg,pinentry-qt private-cache -private-etc asound.conf,group,localtime,machine-id,resolv.conf private-dev +private-etc asound.conf,group,localtime,machine-id,resolv.conf private-tmp memory-deny-write-execute |