Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Email part (2) #3849

Merged
merged 13 commits into from
Feb 9, 2021
Merged

Email part (2) #3849

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
a8a8e33
Add whitelisting to mutt; improve geary, new profile for neomutt
bbhtt Dec 28, 2020
a9218d4
Add neomutt to firefg.config
bbhtt Dec 28, 2020
d652bfb
Add Evolution and folks directories coming from evolution data server…
bbhtt Dec 29, 2020
6b9bfad
Fix python; add read-only to editors/cli browsers;re-add cache directory
bbhtt Dec 29, 2020
ad2c61f
Add folks cache directory
bbhtt Dec 29, 2020
144aee2
Improve whitelisting and dbus of Sylpheed and Claws-mail
bbhtt Dec 31, 2020
927ba15
Add seccomp.block-secondary per @rusty-snake
bbhtt Dec 31, 2020
2ef998d
Rearrange and fixes per comments
bbhtt Dec 31, 2020
08bf7ac
Some sorting per @kmk3
bbhtt Dec 31, 2020
548ee9c
Add dbus-system none back to email-common.profile
bbhtt Dec 31, 2020
4d8c7ad
Add ipc-namespace, machine-id
bbhtt Dec 31, 2020
77c3bac
Add seccomp.block-secondary to email-common,mutt,neomutt; add mdwe to…
bbhtt Jan 4, 2021
1e9040e
Some minor changes
bbhtt Jan 9, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions etc/inc/disable-programs.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -316,11 +316,13 @@ blacklist ${HOME}/.config/mpd
blacklist ${HOME}/.config/mps-youtube
blacklist ${HOME}/.config/mpv
blacklist ${HOME}/.config/mupen64plus
blacklist ${HOME}/.config/mutt
blacklist ${HOME}/.config/mutter
blacklist ${HOME}/.config/mypaint
blacklist ${HOME}/.config/nano
blacklist ${HOME}/.config/nautilus
blacklist ${HOME}/.config/nemo
blacklist ${HOME}/.config/neomutt
blacklist ${HOME}/.config/netsurf
blacklist ${HOME}/.config/newsbeuter
blacklist ${HOME}/.config/newsflash
Expand Down Expand Up @@ -898,6 +900,7 @@ blacklist ${HOME}/.cache/evolution
blacklist ${HOME}/.cache/falkon
blacklist ${HOME}/.cache/feedreader
blacklist ${HOME}/.cache/flaska.net/trojita
blacklist ${HOME}/.cache/folks
blacklist ${HOME}/.cache/font-manager
blacklist ${HOME}/.cache/fossamail
blacklist ${HOME}/.cache/fractal
Expand Down
9 changes: 6 additions & 3 deletions etc/profile-a-l/claws-mail.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,13 @@ whitelist ${HOME}/.claws-mail

whitelist /usr/share/doc/claws-mail

# private-bin claws-mail,curl,gpg,gpg2,gpg-agent,gpgsm,gpgme-config,pinentry,pinentry-gtk-2

dbus-user filter
dbus-user.talk ca.desrt.dconf
dbus-user.talk org.gnome.keyring.SystemPrompter
# if you use the notification plugin you need to uncomment the below (or put them in your claws-mail.local)
#ignore dbus-user none
#dbus-user filter
#dbus-user.talk org.freedesktop.Notifications
# dbus-user.talk org.freedesktop.Notifications

# Redirect
include email-common.profile
25 changes: 19 additions & 6 deletions etc/profile-a-l/email-common.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ include email-common.local
#include globals.local

noblacklist ${HOME}/.gnupg
noblacklist ${HOME}/.mozilla
noblacklist ${HOME}/.signature
# when storing mail outside the default ${HOME}/Mail path, 'noblacklist' the custom path in your email-common.local
# and 'blacklist' it in your disable-common.local too so it is kept hidden from other applications
Expand All @@ -17,28 +18,35 @@ noblacklist ${DOCUMENTS}

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc

whitelist ${DOCUMENTS}
whitelist ${DOWNLOADS}
mkfile ${HOME}/.config/mimeapps.list
mkdir ${HOME}/.gnupg
mkfile ${HOME}/.config/mimeapps.list
mkfile ${HOME}/.signature
whitelist ${HOME}/.config/mimeapps.list
whitelist ${HOME}/.mozilla/firefox/profiles.ini
whitelist ${HOME}/.gnupg
whitelist ${HOME}/.signature
whitelist ${DOCUMENTS}
whitelist ${DOWNLOADS}
# when storing mail outside the default ${HOME}/Mail path, 'whitelist' the custom path in your email-common.local
whitelist ${HOME}/Mail

bbhtt marked this conversation as resolved.
Show resolved Hide resolved
whitelist ${RUNUSER}/gnupg
whitelist /usr/share/gnupg
whitelist /usr/share/gnupg2
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
machine-id
netfilter
no3d
nodvd
Expand All @@ -51,22 +59,27 @@ nou2f
novideo
protocol unix,inet,inet6
seccomp
seccomp.block-secondary
shell none
tracelog

# disable-mnt
private-cache
private-dev
private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg
private-tmp

bbhtt marked this conversation as resolved.
Show resolved Hide resolved
dbus-user none
dbus-system none
bbhtt marked this conversation as resolved.
Show resolved Hide resolved

# encrypting and signing email
writable-run-user

dbus-system none

# If you want to read local mail stored in /var/mail, add the following to email-common.local:
#noblacklist /var/mail
#noblacklist /var/spool/mail
#whitelist /var/mail
#whitelist /var/spool/mail
#writable-var

read-only ${HOME}/.mozilla/firefox/profiles.ini
read-only ${HOME}/.signature
79 changes: 67 additions & 12 deletions etc/profile-a-l/geary.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,28 +4,83 @@
# Persistent local customizations
include geary.local
# Persistent global definitions
# added by included profile
#include globals.local

# Users have Geary set to open a browser by clicking a link in an email
# We are not allowed to blacklist browser-specific directories

ignore dbus-user filter
ignore dbus-system none
ignore private-tmp
include globals.local

noblacklist ${HOME}/.cache/evolution
noblacklist ${HOME}/.cache/folks
noblacklist ${HOME}/.cache/geary
noblacklist ${HOME}/.config/evolution
noblacklist ${HOME}/.config/geary
noblacklist ${HOME}/.local/share/evolution
noblacklist ${HOME}/.local/share/geary
noblacklist ${HOME}/.mozilla

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-shell.inc
include disable-xdg.inc

mkdir ${HOME}/.cache/evolution
mkdir ${HOME}/.cache/folks
mkdir ${HOME}/.cache/geary
mkdir ${HOME}/.config/evolution
mkdir ${HOME}/.config/geary
mkdir ${HOME}/.local/share/evolution
mkdir ${HOME}/.local/share/geary
whitelist ${DOWNLOADS}
whitelist ${HOME}/.cache/evolution
whitelist ${HOME}/.cache/folks
whitelist ${HOME}/.cache/geary
whitelist ${HOME}/.config/evolution
whitelist ${HOME}/.config/geary
whitelist ${HOME}/.local/share/evolution
whitelist ${HOME}/.local/share/geary
whitelist ${HOME}/.mozilla/firefox/profiles.ini
whitelist /usr/share/geary
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
machine-id
netfilter
no3d
nodvd
nogroups
nonewprivs
noroot
nosound
notv
nou2f
novideo
protocol unix,inet,inet6
seccomp
seccomp.block-secondary
shell none
tracelog

# disable-mnt
# Add ignore private-bin to geary.local for hyperlink support
bbhtt marked this conversation as resolved.
Show resolved Hide resolved
private-bin geary
private-cache
private-dev
private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg
bbhtt marked this conversation as resolved.
Show resolved Hide resolved
private-tmp

dbus-user filter
dbus-user.own org.gnome.Geary
dbus-user.talk ca.desrt.dconf
dbus-user.talk org.freedesktop.secrets
dbus-user.talk org.gnome.Contacts
dbus-user.talk org.gnome.OnlineAccounts
dbus-user.talk org.gnome.evolution.dataserver.AddressBook10
dbus-user.talk org.gnome.evolution.dataserver.Sources5
dbus-system none

# allow Mozilla browsers
# Redirect
include firefox.profile
read-only ${HOME}/.mozilla/firefox/profiles.ini
87 changes: 87 additions & 0 deletions etc/profile-m-z/mutt.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,22 +1,26 @@
# Firejail profile for mutt
# Description: Text-based mailreader supporting MIME, GPG, PGP and threading
# This file is overwritten after every install/update
quiet
# Persistent local customizations
include mutt.local
# Persistent global definitions
include globals.local

noblacklist /var/mail
noblacklist /var/spool/mail
noblacklist ${DOCUMENTS}
noblacklist ${HOME}/.Mail
noblacklist ${HOME}/.bogofilter
noblacklist ${HOME}/.cache/mutt
noblacklist ${HOME}/.config/mutt
bbhtt marked this conversation as resolved.
Show resolved Hide resolved
noblacklist ${HOME}/.config/nano
noblacklist ${HOME}/.elinks
noblacklist ${HOME}/.emacs
noblacklist ${HOME}/.emacs.d
noblacklist ${HOME}/.gnupg
noblacklist ${HOME}/.mail
noblacklist ${HOME}/.mailcap
noblacklist ${HOME}/.msmtprc
noblacklist ${HOME}/.mutt
noblacklist ${HOME}/.muttrc
Expand All @@ -34,15 +38,82 @@ noblacklist ${HOME}/sent
blacklist /tmp/.X11-unix
blacklist ${RUNUSER}/wayland-*

include allow-perl.inc
include allow-python2.inc
include allow-python3.inc
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are they needed? mutt.profile has disable-interpreters.inc since 3 years.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are some optional functionality for Oauth etc. I will comment them.


include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc
rusty-snake marked this conversation as resolved.
Show resolved Hide resolved

mkdir ${HOME}/.Mail
bbhtt marked this conversation as resolved.
Show resolved Hide resolved
mkdir ${HOME}/.bogofilter
mkdir ${HOME}/.cache/mutt
mkdir ${HOME}/.config/mutt
mkdir ${HOME}/.config/nano
mkdir ${HOME}/.elinks
mkdir ${HOME}/.emacs.d
mkdir ${HOME}/.gnupg
mkdir ${HOME}/.mail
mkdir ${HOME}/.mutt
mkdir ${HOME}/.vim
mkdir ${HOME}/.w3m
mkdir ${HOME}/Mail
mkdir ${HOME}/mail
mkdir ${HOME}/postponed
mkdir ${HOME}/sent
mkfile ${HOME}/.emacs
mkfile ${HOME}/.mailcap
mkfile ${HOME}/.msmtprc
mkfile ${HOME}/.muttrc
mkfile ${HOME}/.nanorc
mkfile ${HOME}/.signature
mkfile ${HOME}/.viminfo
mkfile ${HOME}/.vimrc
whitelist ${DOCUMENTS}
whitelist ${DOWNLOADS}
whitelist ${HOME}/.Mail
whitelist ${HOME}/.bogofilter
whitelist ${HOME}/.cache/mutt
whitelist ${HOME}/.config/mutt
whitelist ${HOME}/.config/nano
whitelist ${HOME}/.elinks
whitelist ${HOME}/.emacs
whitelist ${HOME}/.emacs.d
whitelist ${HOME}/.gnupg
whitelist ${HOME}/.mail
whitelist ${HOME}/.mailcap
whitelist ${HOME}/.msmtprc
whitelist ${HOME}/.mutt
whitelist ${HOME}/.muttrc
whitelist ${HOME}/.nanorc
whitelist ${HOME}/.signature
whitelist ${HOME}/.vim
whitelist ${HOME}/.viminfo
whitelist ${HOME}/.vimrc
bbhtt marked this conversation as resolved.
Show resolved Hide resolved
whitelist ${HOME}/.w3m
whitelist ${HOME}/Mail
whitelist ${HOME}/mail
whitelist ${HOME}/postponed
whitelist ${HOME}/sent
whitelist /usr/share/gnupg
whitelist /usr/share/gnupg2
whitelist /usr/share/mutt
whitelist /var/mail
whitelist /var/spool/mail
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
ipc-namespace
machine-id
netfilter
no3d
nodvd
Expand All @@ -55,8 +126,24 @@ nou2f
novideo
protocol unix,inet,inet6
seccomp
seccomp.block-secondary
shell none
tracelog

# disable-mnt
private-cache
private-dev
private-etc alternatives,ca-certificates,crypto-policies,fonts,gai.conf,gcrypt,gnupg,gnutls,hostname,hosts,hosts.conf,mail,mailname,Mutt,Muttrc,Muttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,terminfo,xdg
private-tmp
writable-run-user
writable-var

dbus-user none
dbus-system none

memory-deny-write-execute

bbhtt marked this conversation as resolved.
Show resolved Hide resolved
read-only ${HOME}/.elinks
read-only ${HOME}/.nanorc
read-only ${HOME}/.signature
read-only ${HOME}/.w3m
Loading