# Persistent global definitions go here
include /etc/firejail/globals.local

# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/poi.local

noblacklist ~/.cache/smolbote
noblacklist ~/.config/smolbote
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

whitelist ${DOWNLOADS}
mkdir ~/.cache/smolbote
whitelist ~/.cache/smolbote
mkdir ~/.config/smolbote/
whitelist ~/.config/smolbote/


## caps.drop all - Removes the ability to call programs usually run only by root. Ex - chown, setuid
caps.drop all

## netfilter - Creates a simple but restrictive iptables firewall for any --net device created. Does nothing if --net is not used.
## Commented out because netfliter somehow breaks smolbote if used alone.
netfilter

## nogroups - The program can only see the current user's main group. Always applied if the program is run as root.
nogroups

##  nownewprivs - Prevents Child processes from requesting additional priviledges. If --seccomp is enabled, --nonewprivs is redundant.
nonewprivs

## noroot - The program can only see the current user. Requires kernel 3.8 or higher. Mutually exclusive with --chroot or --overlay or running as root.
noroot

## protocol - Only allows sockets of the following types. Not supported on i386 architecture.
protocol unix,inet,inet6,netlink

## seccomp - Blacklists a large swath of syscalls from being accessible.
seccomp

## shell - Run the program directly, without a user shell.
shell none

## tracelog - Log all viloations to syslog
tracelog


## private-bin - Creates a virtual /bin directory containing only temporary copies of the following executables.
# bash required to launch from kde kickoff menu
#private-bin bash,poi

## private-dev - Create a virtual /dev directory. Only dri,  null,  full,  zero,  tty,  pts, ptmx, random, snd, urandom, video, log and shm devices are available.
private-dev

## private-etc - Creates a virtual /etc directory containing only temporary copies of the following files and directories.
#private-etc nsswitch.conf,resolv.conf

## private-tmp - Creates a virtual /tmp directory to prevent the program from accessing the /tmp files from other programs.
private-tmp


## noexec - Prevent execution of files in the specified locations
noexec ${HOME}
noexec /tmp


include /etc/firejail/whitelist-common.inc