commit firejail stuff

13 files changed, 126 insertions, 14 deletions

diff --git a/.config/firejail/calibre.local b/.config/firejail/calibre.local
new file mode 100644
index 0000000..46b4dc2
--- /dev/null
+++ b/.config/firejail/calibre.local
@@ -0,0 +1,9 @@
+
+include qtwlfix.inc
+#include x11fy.inc
+
+whitelist ${HOME}/Documents/bookcloud3
+whitelist ${HOME}/Downloads/inbox
+whitelist ${HOME}/.config/calibre
+
+ignore protocol unix,inet,inet6,netlink
diff --git a/.config/firejail/default.local b/.config/firejail/default.local
new file mode 100644
index 0000000..bfade50
--- /dev/null
+++ b/.config/firejail/default.local
@@ -0,0 +1,27 @@
+
+apparmor
+machine-id
+net none
+
+no3d
+nodvd
+nogroups
+nosound
+notv
+nou2f
+novideo
+
+shell none
+tracelog
+
+disable-mnt
+private
+private-cache
+private-dev
+
+private-etc alternatives,fonts,machine-id
+private-opt none
+private-tmp
+
+dbus-user none
+dbus-system none
diff --git a/.config/firejail/discord.local b/.config/firejail/discord.local
new file mode 100644
index 0000000..15b3ef9
--- /dev/null
+++ b/.config/firejail/discord.local
@@ -0,0 +1,40 @@
+
+include x11fy.inc
+
+dbus-user filter
+dbus-user.talk org.freedesktop.Notifications
+dbus-user.talk org.freedesktop.portal.*
+dbus-system none
+
+#ignore nogroups
+
+# we want webcam
+ignore novideo
+# can't do anything without network
+ignore net none
+# TODO is this needed?
+# ignore memory-deny-write-execute
+
+#ignore apparmor
+#ignore noexec ${HOME}
+
+whitelist ${HOME}/.config/discord
+whitelist ${HOME}/.gtkrc-2.0
+whitelist ${HOME}/.themes
+#whitelist ${DOWNLOADS}
+
+# appindicator breaks without this
+# ignore private-tmp
+
+# hide a bunch of stuff
+# blacklist /tmp/wl-copy*
+# blacklist /tmp/nvim*
+# blacklist /tmp/go-build*
+# blacklist /tmp/gopls*
+# blacklist /tmp/lua-language-server*
+# blacklist /tmp/ssh*
+# blacklist /tmp/waybar*
+# blacklist /tmp/sway*
+# blacklist /tmp/keepass*
+# blacklist /tmp/fzf-interactive*
+
diff --git a/.config/firejail/firefox.local b/.config/firejail/firefox.local
new file mode 100644
index 0000000..caf5469
--- /dev/null
+++ b/.config/firejail/firefox.local
@@ -0,0 +1,6 @@
+
+ignore dbus-user none
+dbus-user filter
+dbus-user.talk org.freedesktop.Notifications
+dbus-user.talk org.freedesktop.portal.*
+dbus-system none
diff --git a/.config/firejail/gimp.local b/.config/firejail/gimp.local
new file mode 100644
index 0000000..f9b29ce
--- /dev/null
+++ b/.config/firejail/gimp.local
@@ -0,0 +1,3 @@
+
+whitelist /usr/lib64/*
+env LD_PRELOAD=/usr/lib64/libwayland-client.so:/usr/lib64/libwayland-server.so:/usr/lib64/libwayland-cursor.so:/usr/lib64/libwayland-egl.so:/usr/lib64/libgdk-3.so:/usr/lib64/libgdk_pixbuf-2.0.so
diff --git a/.config/firejail/kdenlive.local b/.config/firejail/kdenlive.local
new file mode 100644
index 0000000..1191a73
--- /dev/null
+++ b/.config/firejail/kdenlive.local
@@ -0,0 +1,9 @@
+
+include qtwlfix.inc
+blacklist /usr/share/fonts/noto-emoji
+
+env QT_QPA_PLATFORM=xcb
+ignore net none
+
+#whitelist /usr/lib64/*
+#env LD_PRELOAD=/usr/lib64/libwayland-client.so:/usr/lib64/libwayland-egl.so:/usr/lib64/qt5/plugins/platforms/libqwayland-egl.so:/usr/lib64/qt5/plugins/wayland-shell-integration/libfullscreen-shell-v1.so:/usr/lib64/qt5/plugins/wayland-shell-integration/libxdg-shell.so:/usr/lib64/qt5/plugins/wayland-shell-integration/libxdg-shell-v5.so:/usr/lib64/qt5/plugins/wayland-shell-integration/libxdg-shell-v6.so:/usr/lib64/libQt5WaylandClient.so
diff --git a/.config/firejail/lossless-cut.local b/.config/firejail/lossless-cut.local
new file mode 100644
index 0000000..351231f
--- /dev/null
+++ b/.config/firejail/lossless-cut.local
@@ -0,0 +1,2 @@
+include x11fy.inc
+#include whitelist-runuser-common.inc
diff --git a/.config/firejail/osu.profile b/.config/firejail/osu.profile
new file mode 100644
index 0000000..afdb7e3
--- /dev/null
+++ b/.config/firejail/osu.profile
@@ -0,0 +1,6 @@
+
+include whitelist-common.inc
+include whitelist-runuser-common.inc
+
+whitelist ${HOME}/.cache/thumbnails
+whitelist ${HOME}/.local/share/osu
diff --git a/.config/firejail/slack.local b/.config/firejail/slack.local
new file mode 100644
index 0000000..4bc95b2
--- /dev/null
+++ b/.config/firejail/slack.local
@@ -0,0 +1,12 @@
+include x11fy.inc
+
+# ignore dbus-user none
+dbus-user filter
+dbus-user.talk org.freedesktop.Notifications
+dbus-user.talk org.freedesktop.portal.*
+#dbus-system none
+
+# allow opening links via portal
+whitelist ${HOME}/bin
+ignore noexec ${HOME}
+private-bin slack,gdbus
diff --git a/.config/firejail/spotify.local b/.config/firejail/spotify.local
index 6e8287c..b412965 100644
--- a/.config/firejail/spotify.local
+++ b/.config/firejail/spotify.local
@@ -1,10 +1,8 @@
-include libva.inc
+include portal.inc
+dbus-user.own org.mpris.MediaPlayer2.spotify
 
-ignore private-etc
+include libva.inc
 include qtwlfix.inc
 
-ignore dbus-user none
-dbus-user filter
-dbus-user.own org.mpris.MediaPlayer2.spotify
-dbus-user.talk org.freedesktop.Notifications
-dbus-system none
+#ignore private-etc
+ignore private-tmp
diff --git a/.config/firejail/telegram.local b/.config/firejail/telegram.local
index 986cccf..20468f1 100644
--- a/.config/firejail/telegram.local
+++ b/.config/firejail/telegram.local
@@ -5,7 +5,4 @@ include qtwlfix.inc
 env QT_QPA_PLATFORMTHEME=gtk3
 
 blacklist /usr/share/fonts/noto*
-whitelist /var/lib/syncthing/Sync
-whitelist /var/lib/syncthing/Sync/*
-
 #private-bin telegram-desktop
diff --git a/.config/firejail/tor-browser.local b/.config/firejail/tor-browser.local
new file mode 100644
index 0000000..9d520b2
--- /dev/null
+++ b/.config/firejail/tor-browser.local
@@ -0,0 +1,2 @@
+
+whitelist /opt/torbrowser
diff --git a/.config/firejail/zoom.local b/.config/firejail/zoom.local
index 1436432..8a39b93 100644
--- a/.config/firejail/zoom.local
+++ b/.config/firejail/zoom.local
@@ -1,10 +1,11 @@
 
 #include qtwlfix.inc
 include portal.inc
+#private-bin gdbus,wl-copy,notify-send
 
-#private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl,os-release
+private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl,os-release
+
+# fix screensharing
+env XDG_CURRENT_DESKTOP=GNOME
 
-#env XDG_SESSION_TYPE=wayland
-#env XDG_CURRENT_DESKTOP=GNOME
-# env QT_QPA_PLATFORM=wayland
 env XDG_CACHE_HOME=/tmp/