From 6bfd5be3cbcfb04215070fa49b4f8285400c2876 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Mon, 7 Dec 2020 07:49:38 -0300
Subject: Feat: firejail profile

---
 config.dot/firejail/git.profile.link | 43 ++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 config.dot/firejail/git.profile.link

diff --git a/config.dot/firejail/git.profile.link b/config.dot/firejail/git.profile.link
new file mode 100644
index 0000000..3a5913a
--- /dev/null
+++ b/config.dot/firejail/git.profile.link
@@ -0,0 +1,43 @@
+# git profile
+quiet
+noblacklist ~/.gitconfig
+noblacklist ~/.ssh
+noblacklist ~/.gnupg
+noblacklist ~/.emacs
+noblacklist ~/.emacs.d
+noblacklist ~/.viminfo
+noblacklist ~/.vim
+
+# allow git to work with some other configs
+noblacklist ${HOME}/.config/autostart
+noblacklist ${HOME}/.mutt
+noblacklist ${HOME}/.muttrc
+noblacklist /etc/ssh
+
+# custom
+noblacklist ~/.custom/gitconfig
+noblacklist ${PATH}/nc
+noblacklist /tmp/ssh-*
+noblacklist ~/.subversion
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-passwdmgr.inc
+
+# allow write operations in non-default folders
+include whitelist-common.local
+
+# allow git to work with dotfiles
+read-write ${HOME}/.dotfiles
+
+caps.drop all
+netfilter
+nonewprivs
+noroot
+nogroups
+nosound
+protocol unix,inet,inet6
+seccomp
+shell none
+
+private-dev
-- 
cgit v1.2.3