qutebrowser.profile 1.57 KB
Newer Older
Tad's avatar
Tad committed
1
# Firejail profile for qutebrowser
2
# Description: Keyboard-driven, vim-like browser based on PyQt5
Tad's avatar
Tad committed
3 4
# This file is overwritten after every install/update
# Persistent local customizations
5
include qutebrowser.local
Tad's avatar
Tad committed
6
# Persistent global definitions
7
include globals.local
8

9 10 11
noblacklist ${HOME}/.cache/qutebrowser
noblacklist ${HOME}/.config/qutebrowser
noblacklist ${HOME}/.local/share/qutebrowser
Tad's avatar
Tad committed
12

13 14 15 16 17 18
# Allow python (blacklisted by disable-interpreters.inc)
noblacklist ${PATH}/python2*
noblacklist ${PATH}/python3*
noblacklist /usr/lib/python2*
noblacklist /usr/lib/python3*

19 20 21
# with >=llvm-4 mesa drivers need llvm stuff
noblacklist /usr/lib/llvm*

22 23 24 25
include disable-common.inc
include disable-devel.inc
include disable-interpreters.inc
include disable-programs.inc
Tad's avatar
Tad committed
26

27 28 29
mkdir ${HOME}/.cache/qutebrowser
mkdir ${HOME}/.config/qutebrowser
mkdir ${HOME}/.local/share/qutebrowser
Tad's avatar
Tad committed
30
whitelist ${DOWNLOADS}
31 32 33
whitelist ${HOME}/.cache/qutebrowser
whitelist ${HOME}/.config/qutebrowser
whitelist ${HOME}/.local/share/qutebrowser
34
include whitelist-common.inc
35 36 37

caps.drop all
netfilter
Tad's avatar
Tad committed
38
nodvd
39
nonewprivs
40
noroot
Tad's avatar
Tad committed
41
notv
42
protocol unix,inet,inet6,netlink
43 44 45
# blacklisting of chroot system calls breaks qt webengine
seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
# tracelog