## --- CUT HERE ---
## This is a generic template to help you create profiles.
## PRs welcome at https://github.com/netblue30/firejail/.
##
## Rules to follow:
##  - Lines starting with `## ` (such as this line) are documentation comments
##    for the template and should not be copied to the profile.
##  - Lines starting with `# ` are comments that belong to a section and should
##    be copied together with the section if relevant (such as the `# Allow`
##    comments).
##  - Lines starting with `#` (no space) are often used in profiles.
##  - Lines starting with `##` (no space) are only needed in special situations
##    (only copy the line if it is relevant).
##  - Make the profile as restrictive as possible while still keeping the
##    program useful (e.g. a program that is unable to save the user's work is
##    considered bad practice).
##  - Dedicate ample time (based on the complexity of the application) to
##    profile testing before submitting a pull request.
##  - Keep the sections structure, use a single empty line as separator.
##  - Entries within sections are alphabetically sorted.
##  - Consider putting the program name into src/firecfg/firecfg.config (keep
##    the list sorted) but beware to not do this for essential utilities as
##    this may *break* the OS! (related discussion:
##    https://github.com/netblue30/firejail/issues/2507).
##
## Sections structure:
##   HEADER
##   COMMENTS
##   IGNORES
##   NOBLACKLISTS
##   ALLOW INCLUDES
##   BLACKLISTS
##   DISABLE INCLUDES
##   NOWHITELISTS
##   MKDIRS
##   WHITELISTS
##   WHITELIST INCLUDES
##   OPTIONS (caps*, net*, no*, protocol, seccomp*)
##   PRIVATE OPTIONS (disable-mnt, private-*, writable-*)
##   DBUS FILTER
##   SPECIAL OPTIONS (mdwx, noexec, read-only, join-or-start)
##   REDIRECT INCLUDES
##
## The following macros may be used in path names to substitute common
## locations:
##   ${CFG} # usually /etc/firejail
##   ${DESKTOP}
##   ${DOCUMENTS}
##   ${DOWNLOADS}
##   ${HOME} # user's home
##   ${MUSIC}
##   ${PATH} # contents of PATH env var
##   ${PICTURES}
##   ${PROJECTS}
##   ${PUBLICSHARE}
##   ${RUNUSER} # /run/user/UID
##   ${TEMPLATES}
##   ${VIDEOS}
##
## Check contents of ~/.config/user-dirs.dirs to see how they translate to
## actual paths.
##
## --- CUT HERE ---
# Firejail profile for PROGRAM_NAME
# Description: DESCRIPTION OF THE PROGRAM
# This file is overwritten after every install/update
##quiet
# Persistent local customizations
include PROFILE.local
# Persistent global definitions
include globals.local

##ignore noexec ${HOME}
##ignore noexec /tmp

##warn foo

## It is common practice to add files/dirs containing program-specific
## configuration (often ${HOME}/PROGRAMNAME or ${HOME}/.config/PROGRAMNAME)
## into disable-programs.inc (keep list sorted) and then disable blacklisting
## below.
##
## One way to retrieve the files a program uses is:
##  - Launch binary with --private naming a sandbox:
##      `firejail --name=test --ignore=private-bin [--profile=PROFILE] --private BINARY`
##
##  - Work with the program, make some configuration changes and save them,
##    open new documents, install plugins if they exist, etc.
##
##  - Join the sandbox with bash:
##      `firejail --join=test bash`
##
##  - Look what has changed and use that information to populate blacklist and
##    whitelist sections:
##      `ls -aR`
#noblacklist PATH

# Allow /bin/sh (blacklisted by disable-shell.inc)
#include allow-bin-sh.inc

# Allows files commonly used by IDEs
#include allow-common-devel.inc

# Allow gjs (blacklisted by disable-interpreters.inc)
#include allow-gjs.inc

# Allow java (blacklisted by disable-devel.inc)
#include allow-java.inc

# Allow lua (blacklisted by disable-interpreters.inc)
#include allow-lua.inc

# Allow nodejs (blacklisted by disable-interpreters.inc)
#include allow-nodejs.inc

# Allow opengl-game wrapper script (distribution-specific)
#include allow-opengl-game.inc

# Allow perl (blacklisted by disable-interpreters.inc)
#include allow-perl.inc

# Allow php (blacklisted by disable-interpreters.inc)
#include allow-php.inc

# Allow python (blacklisted by disable-interpreters.inc)
#include allow-python2.inc
#include allow-python3.inc

# Allow ruby (blacklisted by disable-interpreters.inc)
#include allow-ruby.inc

# Allow ssh (blacklisted by disable-common.inc)
#include allow-ssh.inc

##blacklist PATH
## Disable Wayland.
#blacklist ${RUNUSER}/wayland-*
## Disable RUNUSER (CLI only; supersedes Disable Wayland).
#blacklist ${RUNUSER}
## Remove the next blacklist if your system has no /usr/libexec dir,
## otherwise try to add it.
#blacklist /usr/libexec

## disable-*.inc includes.
## Remove disable-write-mnt.inc if you set disable-mnt.
#include disable-common.inc
#include disable-devel.inc
#include disable-exec.inc
#include disable-interpreters.inc
#include disable-proc.inc
#include disable-programs.inc
#include disable-shell.inc
#include disable-write-mnt.inc
#include disable-x11.inc
#include disable-xdg.inc

## This section often mirrors noblacklist section above. The idea is
## that if a user feels too restricted (e.g. unable to save files into
## home directory) they may disable whitelist (nowhitelist)
## in PROFILE.local but still be protected by BLACKLISTS section
## (explanation at https://github.com/netblue30/firejail/issues/1569).
#mkdir PATH
##mkfile PATH
#whitelist PATH
#include whitelist-common.inc
#include whitelist-run-common.inc
#include whitelist-runuser-common.inc
#include whitelist-usr-share-common.inc
#include whitelist-var-common.inc

## Landlock commands.
##landlock.fs.read PATH
##landlock.fs.write PATH
##landlock.fs.makeipc PATH
##landlock.fs.makedev PATH
##landlock.fs.execute PATH
##include landlock-common.inc

## Commands that increase access to resources.
##
## Note: Keep this in sync with ../../etc/profile-m-z/noprofile.profile.
##allow-debuggers
##allusers
##keep-config-pulse
##keep-dev-ntsync
##keep-dev-shm
##keep-dev-tpm
##keep-fd all
##keep-shell-rc
##keep-var-tmp
##writable-etc
##writable-run-user
##writable-var
##writable-var-log

## Commands that reduce access to resources.
##allow-bwrap # likely to cause breakage (see #6906)
#apparmor
#caps.drop all
##caps.keep CAPS
##hostname NAME
##hostname-randomize
## (CLI only)
##ipc-namespace
## Breaks audio and sometimes dbus-related functions.
#machine-id
## Use 'net none' or 'netfilter'.
#net none
#netfilter
#no3d
##nodbus # deprecated, use 'dbus-user none' and 'dbus-system none', see below
#nodvd
#nogroups
#noinput
#nonewprivs
#noprinters
#noroot
#nosound
#notv
#nou2f
#novideo
## Remove each unneeded protocol:
##  - unix is usually needed
##  - inet,inet6 only if internet access is required (see 'net none'/'netfilter' above)
##  - netlink is rarely needed
##  - packet and bluetooth almost never
#protocol unix,inet,inet6,netlink,packet,bluetooth
#seccomp
##seccomp !chroot
##seccomp.drop SYSCALLS # see syscalls.txt
#seccomp.block-secondary
##seccomp-error-action log # only for debugging seccomp issues
## Prefer 'x11 none' instead of 'disable-x11.inc' if 'net none' is set.
##x11 none

#disable-mnt
##private
## It's common practice to refer to the python executable(s) in private-bin
## with `python*`, which covers both v2 and v3.
#private-bin PROGRAMS
#private-cache
#private-dev
#private-etc FILES
## private-etc templates (see also #1734, #2093):
##   Common: alternatives,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,xdg
##     Extra: group,magic,magic.mgc,passwd
##   3D: bumblebee,drirc,glvnd,nvidia
##   Audio: alsa,asound.conf,machine-id,pulse
##   D-Bus: dbus-1,machine-id
##   GUI: fonts,pango,X11
##   GTK: dconf,gconf,gtk-2.0,gtk-3.0
##   KDE: kde4rc,kde5rc
##   Networking: ca-certificates,crypto-policies,host.conf,hostname,hosts,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl
##     Extra: gai.conf,proxychains.conf
##   Qt: Trolltech.conf
##private-lib LIBS
## Note: private-opt copies the entire path(s) to RAM, which may break
## file-copy-limit in firejail.config (see firejail(1)), so for new profiles
## use 'whitelist /opt/NAME' instead of 'private-opt NAME'.
##private-opt NAME
#private-tmp

## Since 0.9.63 also a more granular control of dbus is supported.
## To get the dbus-addresses an application needs access to you can
## check with flatpak (when the application is distributed that way):
##   `flatpak remote-info --show-metadata flathub <APP-ID>`
## Notes:
##  - flatpak implicitly allows an app to own <APP-ID> on the session bus
##  - Some features like native notifications are implemented as portal too.
##  - In order to make dconf work (when used by the app) you need to allow
##    'ca.desrt.dconf' even when not allowed by flatpak.
## Notes and policies about addresses can be found at:
## <https://github.com/netblue30/firejail/wiki/Restrict-DBus>
#dbus-user filter
#dbus-user.own com.github.netblue30.firejail
#dbus-user.talk ca.desrt.dconf
#dbus-user.talk org.freedesktop.Notifications
#dbus-system none

## Note: read-only entries should usually go in disable-common.inc (especially
## entries for configuration files that allow arbitrary command execution).
##deterministic-shutdown
##env VAR=VALUE
##join-or-start NAME
#memory-deny-write-execute
##noexec PATH
##read-only ${HOME}
##read-write ${HOME}
#restrict-namespaces
