All of the documentation resides at the Silktorrent wiki.

#!/usr/bin/env bash
#--------------------------------------------------------------------------
# Initial author: martin.vahi@softf1.com
# This file is in public domain.
#==========================================================================
S_FP_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
#--------------------------------------------------------------------------
# For copy-pasting to the ~/.bashrc
#
#     alias mmmv_cre_git_clone="cp $PATH_TO_THE<$S_FP_DIR>/pull_new_version_from_git_repository ./; mkdir -p ./the_repository_clones;"
#
#--------------------------------------------------------------------------


fun_assert_exists_on_path_t1 () {
    local S_NAME_OF_THE_EXECUTABLE=$1 # first function argument
    local S_TMP_0="\`which $S_NAME_OF_THE_EXECUTABLE 2>/dev/null\`"
    local S_TMP_1=""
    local S_TMP_2="S_TMP_1=$S_TMP_0"
    eval ${S_TMP_2}
    if [ "$S_TMP_1" == "" ] ; then
        echo ""
        echo "This bash script requires the \"$S_NAME_OF_THE_EXECUTABLE\" to be on the PATH."
        echo ""
        exit 1 # exit with error
    fi
} # fun_assert_exists_on_path_t1

fun_assert_exists_on_path_t1 "ruby"
fun_assert_exists_on_path_t1 "grep"
fun_assert_exists_on_path_t1 "date"
fun_assert_exists_on_path_t1 "git"


#--------------------------------------------------------------------------
S_TMP_0="`uname -a | grep -E [Ll]inux`"
if [ "$S_TMP_0" == "" ]; then
    S_TMP_0="`uname -a | grep -E [Bb][Ss][Dd]`"
    if [ "$S_TMP_0" == "" ]; then
        echo ""
        echo "  The classical command line utilities at "
        echo "  different operating systems, for example, Linux and BSD,"
        echo "  differ. This script is designed to run only on Linux and BSD."
        echo "  If You are willing to risk that some of Your data "
        echo "  is deleted and/or Your operating system instance"
        echo "  becomes permanently flawed, to the point that "
        echo "  it will not even boot, then You may edit the Bash script that "
        echo "  displays this error message by modifying the test that "
        echo "  checks for the operating system type."
        echo ""
        echo "  If You do decide to edit this Bash script, then "
        echo "  a recommendation is to test Your modifications "
        echo "  within a virtual machine or, if virtual machines are not"
        echo "  an option, as some new operating system user that does not have "
        echo "  any access to the vital data/files."
        echo "  GUID=='2df484c3-13f2-4796-99ac-91d0305090e7'"
        echo ""
        echo "  Aborting script without doing anything."
        echo ""
        exit 1 # exit with error
    fi
fi


#--------------------------------------------------------------------------

S_TIMESTAMP="`date +%Y`_`date +%m`_`date +%d`_T_`date +%H`h_`date +%M`min_`date +%S`s"
S_FP_ARCHIVE="$S_FP_DIR/archives/$S_TIMESTAMP"
mkdir -p $S_FP_ARCHIVE
S_FP_THE_REPOSITORY_CLONES="$S_FP_DIR/the_repository_clones"
mkdir -p $S_FP_THE_REPOSITORY_CLONES


AR_REPO_FOLDER_NAMES=()

fun_assemble_array_of_repository_clone_folder_names () {
    cd $S_FP_THE_REPOSITORY_CLONES
    local S_TMP_0="`ruby -e \"ar=Array.new; Dir.glob('*').each{|x| if File.directory? x then ar<<x end}; puts(ar.to_s.gsub('[','(').gsub(']',')').gsub(',',' '))\"`"
    cd $S_FP_DIR
    local S_TMP_1="AR_REPO_FOLDER_NAMES=$S_TMP_0"
    eval ${S_TMP_1}
} # fun_assemble_array_of_repository_clone_folder_names 

fun_assemble_array_of_repository_clone_folder_names 


fun_update () {
    local S_FP_FUNC_UPDATE_ORIG="`pwd`"
    for s_iter in ${AR_REPO_FOLDER_NAMES[@]}; do
         S_FOLDER_NAME_OF_THE_LOCAL_COPY="$s_iter"
         echo ""
         echo "            Archiving a copy of $S_FOLDER_NAME_OF_THE_LOCAL_COPY"
         cp -f -R $S_FP_THE_REPOSITORY_CLONES/$S_FOLDER_NAME_OF_THE_LOCAL_COPY $S_FP_ARCHIVE/
         cd $S_FP_THE_REPOSITORY_CLONES/$S_FOLDER_NAME_OF_THE_LOCAL_COPY
         echo "Checking out a newer version of $S_FOLDER_NAME_OF_THE_LOCAL_COPY"
         #--------
         # downloads the newest version of the software to that folder.
         git pull --recurse-submodules 
         #----
         # http://stackoverflow.com/questions/1030169/easy-way-pull-latest-of-all-submodules
         git submodule update --init --recursive
         #--------
         cd $S_FP_DIR
    done
    cd $S_FP_FUNC_UPDATE_ORIG
} # fun_update 

 
fun_update # is a call to the function
echo ""

#==========================================================================

2b9677bd2d15077766db70bfedb0a30d4994f8c3		branch 'master' of https://github.com/SpotComms/FirejailProfileGenerator

ref: refs/heads/master

2b9677bd2d15077766db70bfedb0a30d4994f8c3

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = https://github.com/SpotComms/FirejailProfileGenerator.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
	remote = origin
	merge = refs/heads/master

Unnamed repository; edit this file 'description' to name the repository.

#!/bin/sh
#
# An example hook script to check the commit log message taken by
# applypatch from an e-mail message.
#
# The hook should exit with non-zero status after issuing an
# appropriate message if it wants to stop the commit.  The hook is
# allowed to edit the commit message file.
#
# To enable this hook, rename this file to "applypatch-msg".

. git-sh-setup
test -x "$GIT_DIR/hooks/commit-msg" &&
	exec "$GIT_DIR/hooks/commit-msg" ${1+"$@"}
:

#!/bin/sh
#
# An example hook script to check the commit log message.
# Called by "git commit" with one argument, the name of the file
# that has the commit message.  The hook should exit with non-zero
# status after issuing an appropriate message if it wants to stop the
# commit.  The hook is allowed to edit the commit message file.
#
# To enable this hook, rename this file to "commit-msg".

# Uncomment the below to add a Signed-off-by line to the message.
# Doing this in a hook is a bad idea in general, but the prepare-commit-msg
# hook is more suited to it.
#
# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p')
# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1"

# This example catches duplicate Signed-off-by lines.

test "" = "$(grep '^Signed-off-by: ' "$1" |
	 sort | uniq -c | sed -e '/^[ 	]*1[ 	]/d')" || {
	echo >&2 Duplicate Signed-off-by lines.
	exit 1
}

#!/bin/sh
#
# An example hook script to prepare a packed repository for use over
# dumb transports.
#
# To enable this hook, rename this file to "post-update".

exec git update-server-info

#!/bin/sh
#
# An example hook script to verify what is about to be committed
# by applypatch from an e-mail message.
#
# The hook should exit with non-zero status after issuing an
# appropriate message if it wants to stop the commit.
#
# To enable this hook, rename this file to "pre-applypatch".

. git-sh-setup
test -x "$GIT_DIR/hooks/pre-commit" &&
	exec "$GIT_DIR/hooks/pre-commit" ${1+"$@"}
:

#!/bin/sh
#
# An example hook script to verify what is about to be committed.
# Called by "git commit" with no arguments.  The hook should
# exit with non-zero status after issuing an appropriate message if
# it wants to stop the commit.
#
# To enable this hook, rename this file to "pre-commit".

if git rev-parse --verify HEAD >/dev/null 2>&1
then
	against=HEAD
else
	# Initial commit: diff against an empty tree object
	against=4b825dc642cb6eb9a060e54bf8d69288fbee4904
fi

# If you want to allow non-ASCII filenames set this variable to true.
allownonascii=$(git config --bool hooks.allownonascii)

# Redirect output to stderr.
exec 1>&2

# Cross platform projects tend to avoid non-ASCII filenames; prevent
# them from being added to the repository. We exploit the fact that the
# printable range starts at the space character and ends with tilde.
if [ "$allownonascii" != "true" ] &&
	# Note that the use of brackets around a tr range is ok here, (it's
	# even required, for portability to Solaris 10's /usr/bin/tr), since
	# the square bracket bytes happen to fall in the designated range.
	test $(git diff --cached --name-only --diff-filter=A -z $against |
	  LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0
then
	cat <<\EOF
Error: Attempt to add a non-ASCII file name.

This can cause problems if you want to work with people on other platforms.

To be portable it is advisable to rename the file.

If you know what you are doing you can disable this check using:

  git config hooks.allownonascii true
EOF
	exit 1
fi

# If there are whitespace errors, print the offending file names and fail.
exec git diff-index --check --cached $against --

#!/bin/sh

# An example hook script to verify what is about to be pushed.  Called by "git
# push" after it has checked the remote status, but before anything has been
# pushed.  If this script exits with a non-zero status nothing will be pushed.
#
# This hook is called with the following parameters:
#
# $1 -- Name of the remote to which the push is being done
# $2 -- URL to which the push is being done
#
# If pushing without using a named remote those arguments will be equal.
#
# Information about the commits which are being pushed is supplied as lines to
# the standard input in the form:
#
#   <local ref> <local sha1> <remote ref> <remote sha1>
#
# This sample shows how to prevent push of commits where the log message starts
# with "WIP" (work in progress).

remote="$1"
url="$2"

z40=0000000000000000000000000000000000000000

IFS=' '
while read local_ref local_sha remote_ref remote_sha
do
	if [ "$local_sha" = $z40 ]
	then
		# Handle delete
		:
	else
		if [ "$remote_sha" = $z40 ]
		then
			# New branch, examine all commits
			range="$local_sha"
		else
			# Update to existing branch, examine new commits
			range="$remote_sha..$local_sha"
		fi

		# Check for WIP commit
		commit=`git rev-list -n 1 --grep '^WIP' "$range"`
		if [ -n "$commit" ]
		then
			echo "Found WIP commit in $local_ref, not pushing"
			exit 1
		fi
	fi
done

exit 0

#!/bin/sh
#
# Copyright (c) 2006, 2008 Junio C Hamano
#
# The "pre-rebase" hook is run just before "git rebase" starts doing
# its job, and can prevent the command from running by exiting with
# non-zero status.
#
# The hook is called with the following parameters:
#
# $1 -- the upstream the series was forked from.
# $2 -- the branch being rebased (or empty when rebasing the current branch).
#
# This sample shows how to prevent topic branches that are already
# merged to 'next' branch from getting rebased, because allowing it
# would result in rebasing already published history.

publish=next
basebranch="$1"
if test "$#" = 2
then
	topic="refs/heads/$2"
else
	topic=`git symbolic-ref HEAD` ||
	exit 0 ;# we do not interrupt rebasing detached HEAD
fi

case "$topic" in
refs/heads/??/*)
	;;
*)
	exit 0 ;# we do not interrupt others.
	;;
esac

# Now we are dealing with a topic branch being rebased
# on top of master.  Is it OK to rebase it?

# Does the topic really exist?
git show-ref -q "$topic" || {
	echo >&2 "No such branch $topic"
	exit 1
}

# Is topic fully merged to master?
not_in_master=`git rev-list --pretty=oneline ^master "$topic"`
if test -z "$not_in_master"
then
	echo >&2 "$topic is fully merged to master; better remove it."
	exit 1 ;# we could allow it, but there is no point.
fi

# Is topic ever merged to next?  If so you should not be rebasing it.
only_next_1=`git rev-list ^master "^$topic" ${publish} | sort`
only_next_2=`git rev-list ^master           ${publish} | sort`
if test "$only_next_1" = "$only_next_2"
then
	not_in_topic=`git rev-list "^$topic" master`
	if test -z "$not_in_topic"
	then
		echo >&2 "$topic is already up-to-date with master"
		exit 1 ;# we could allow it, but there is no point.
	else
		exit 0
	fi
else
	not_in_next=`git rev-list --pretty=oneline ^${publish} "$topic"`
	/usr/bin/perl -e '
		my $topic = $ARGV[0];
		my $msg = "* $topic has commits already merged to public branch:\n";
		my (%not_in_next) = map {
			/^([0-9a-f]+) /;
			($1 => 1);
		} split(/\n/, $ARGV[1]);
		for my $elem (map {
				/^([0-9a-f]+) (.*)$/;
				[$1 => $2];
			} split(/\n/, $ARGV[2])) {
			if (!exists $not_in_next{$elem->[0]}) {
				if ($msg) {
					print STDERR $msg;
					undef $msg;
				}
				print STDERR " $elem->[1]\n";
			}
		}
	' "$topic" "$not_in_next" "$not_in_master"
	exit 1
fi

exit 0

################################################################

This sample hook safeguards topic branches that have been
published from being rewound.

The workflow assumed here is:

 * Once a topic branch forks from "master", "master" is never
   merged into it again (either directly or indirectly).

 * Once a topic branch is fully cooked and merged into "master",
   it is deleted.  If you need to build on top of it to correct
   earlier mistakes, a new topic branch is created by forking at
   the tip of the "master".  This is not strictly necessary, but
   it makes it easier to keep your history simple.

 * Whenever you need to test or publish your changes to topic
   branches, merge them into "next" branch.

The script, being an example, hardcodes the publish branch name
to be "next", but it is trivial to make it configurable via
$GIT_DIR/config mechanism.

With this workflow, you would want to know:

(1) ... if a topic branch has ever been merged to "next".  Young
    topic branches can have stupid mistakes you would rather
    clean up before publishing, and things that have not been
    merged into other branches can be easily rebased without
    affecting other people.  But once it is published, you would
    not want to rewind it.

(2) ... if a topic branch has been fully merged to "master".
    Then you can delete it.  More importantly, you should not
    build on top of it -- other people may already want to
    change things related to the topic as patches against your
    "master", so if you need further changes, it is better to
    fork the topic (perhaps with the same name) afresh from the
    tip of "master".

Let's look at this example:

		   o---o---o---o---o---o---o---o---o---o "next"
		  /       /           /           /
		 /   a---a---b A     /           /
		/   /               /           /
	       /   /   c---c---c---c B         /
	      /   /   /             \         /
	     /   /   /   b---b C     \       /
	    /   /   /   /             \     /
    ---o---o---o---o---o---o---o---o---o---o---o "master"


A, B and C are topic branches.

 * A has one fix since it was merged up to "next".

 * B has finished.  It has been fully merged up to "master" and "next",
   and is ready to be deleted.

 * C has not merged to "next" at all.

We would want to allow C to be rebased, refuse A, and encourage
B to be deleted.

To compute (1):

	git rev-list ^master ^topic next
	git rev-list ^master        next

	if these match, topic has not merged in next at all.

To compute (2):

	git rev-list master..topic

	if this is empty, it is fully merged to "master".

#!/bin/sh
#
# An example hook script to prepare the commit log message.
# Called by "git commit" with the name of the file that has the
# commit message, followed by the description of the commit
# message's source.  The hook's purpose is to edit the commit
# message file.  If the hook fails with a non-zero status,
# the commit is aborted.
#
# To enable this hook, rename this file to "prepare-commit-msg".

# This hook includes three examples.  The first comments out the
# "Conflicts:" part of a merge commit.
#
# The second includes the output of "git diff --name-status -r"
# into the message, just before the "git status" output.  It is
# commented because it doesn't cope with --amend or with squashed
# commits.
#
# The third example adds a Signed-off-by line to the message, that can
# still be edited.  This is rarely a good idea.

case "$2,$3" in
  merge,)
    /usr/bin/perl -i.bak -ne 's/^/# /, s/^# #/#/ if /^Conflicts/ .. /#/; print' "$1" ;;

# ,|template,)
#   /usr/bin/perl -i.bak -pe '
#      print "\n" . `git diff --cached --name-status -r`
#	 if /^#/ && $first++ == 0' "$1" ;;

  *) ;;
esac

# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p')
# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1"

#!/bin/sh
#
# An example hook script to blocks unannotated tags from entering.
# Called by "git receive-pack" with arguments: refname sha1-old sha1-new
#
# To enable this hook, rename this file to "update".
#
# Config
# ------
# hooks.allowunannotated
#   This boolean sets whether unannotated tags will be allowed into the
#   repository.  By default they won't be.
# hooks.allowdeletetag
#   This boolean sets whether deleting tags will be allowed in the
#   repository.  By default they won't be.
# hooks.allowmodifytag
#   This boolean sets whether a tag may be modified after creation. By default
#   it won't be.
# hooks.allowdeletebranch
#   This boolean sets whether deleting branches will be allowed in the
#   repository.  By default they won't be.
# hooks.denycreatebranch
#   This boolean sets whether remotely creating branches will be denied
#   in the repository.  By default this is allowed.
#

# --- Command line
refname="$1"
oldrev="$2"
newrev="$3"

# --- Safety check
if [ -z "$GIT_DIR" ]; then
	echo "Don't run this script from the command line." >&2
	echo " (if you want, you could supply GIT_DIR then run" >&2
	echo "  $0 <ref> <oldrev> <newrev>)" >&2
	exit 1
fi

if [ -z "$refname" -o -z "$oldrev" -o -z "$newrev" ]; then
	echo "usage: $0 <ref> <oldrev> <newrev>" >&2
	exit 1
fi

# --- Config
allowunannotated=$(git config --bool hooks.allowunannotated)
allowdeletebranch=$(git config --bool hooks.allowdeletebranch)
denycreatebranch=$(git config --bool hooks.denycreatebranch)
allowdeletetag=$(git config --bool hooks.allowdeletetag)
allowmodifytag=$(git config --bool hooks.allowmodifytag)

# check for no description
projectdesc=$(sed -e '1q' "$GIT_DIR/description")
case "$projectdesc" in
"Unnamed repository"* | "")
	echo "*** Project description file hasn't been set" >&2
	exit 1
	;;
esac

# --- Check types
# if $newrev is 0000...0000, it's a commit to delete a ref.
zero="0000000000000000000000000000000000000000"
if [ "$newrev" = "$zero" ]; then
	newrev_type=delete
else
	newrev_type=$(git cat-file -t $newrev)
fi

case "$refname","$newrev_type" in
	refs/tags/*,commit)
		# un-annotated tag
		short_refname=${refname##refs/tags/}
		if [ "$allowunannotated" != "true" ]; then
			echo "*** The un-annotated tag, $short_refname, is not allowed in this repository" >&2
			echo "*** Use 'git tag [ -a | -s ]' for tags you want to propagate." >&2
			exit 1
		fi
		;;
	refs/tags/*,delete)
		# delete tag
		if [ "$allowdeletetag" != "true" ]; then
			echo "*** Deleting a tag is not allowed in this repository" >&2
			exit 1
		fi
		;;
	refs/tags/*,tag)
		# annotated tag
		if [ "$allowmodifytag" != "true" ] && git rev-parse $refname > /dev/null 2>&1
		then
			echo "*** Tag '$refname' already exists." >&2
			echo "*** Modifying a tag is not allowed in this repository." >&2
			exit 1
		fi
		;;
	refs/heads/*,commit)
		# branch
		if [ "$oldrev" = "$zero" -a "$denycreatebranch" = "true" ]; then
			echo "*** Creating a branch is not allowed in this repository" >&2
			exit 1
		fi
		;;
	refs/heads/*,delete)
		# delete branch
		if [ "$allowdeletebranch" != "true" ]; then
			echo "*** Deleting a branch is not allowed in this repository" >&2
			exit 1
		fi
		;;
	refs/remotes/*,commit)
		# tracking branch
		;;
	refs/remotes/*,delete)
		# delete tracking branch
		if [ "$allowdeletebranch" != "true" ]; then
			echo "*** Deleting a tracking branch is not allowed in this repository" >&2
			exit 1
		fi
		;;
	*)
		# Anything else (is there anything else?)
		echo "*** Update hook: unknown type of update to ref $refname of type $newrev_type" >&2
		exit 1
		;;
esac

# --- Finished
exit 0

# git ls-files --others --exclude-from=.git/info/exclude
# Lines that start with '#' are comments.
# For a project mostly in C, the following would be a good set of
# exclude patterns (uncomment them if you want to use them):
# *.[oa]
# *~

0000000000000000000000000000000000000000 2b9677bd2d15077766db70bfedb0a30d4994f8c3 Martin Vahi <martin.vahi@softf1.com> 1483805513 +0200	clone: from https://github.com/SpotComms/FirejailProfileGenerator.git

0000000000000000000000000000000000000000 2b9677bd2d15077766db70bfedb0a30d4994f8c3 Martin Vahi <martin.vahi@softf1.com> 1483805513 +0200	clone: from https://github.com/SpotComms/FirejailProfileGenerator.git

0000000000000000000000000000000000000000 2b9677bd2d15077766db70bfedb0a30d4994f8c3 Martin Vahi <martin.vahi@softf1.com> 1483805513 +0200	clone: from https://github.com/SpotComms/FirejailProfileGenerator.git

# pack-refs with: peeled fully-peeled 
2b9677bd2d15077766db70bfedb0a30d4994f8c3 refs/remotes/origin/master

2b9677bd2d15077766db70bfedb0a30d4994f8c3

ref: refs/remotes/origin/master

bin
.settings
.classpath
.project

<!--	This file is part of FirejailProfileGenerator.
  
	FirejailProfileGenerator is free software: you can redistribute it and/or modify
	it under the terms of the GNU General Public License as published by
	the Free Software Foundation, either version 2 of the License, or
	(at your option) any later version.

	FirejailProfileGenerator is distributed in the hope that it will be useful,
	but WITHOUT ANY WARRANTY; without even the implied warranty of
	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
	GNU General Public License for more details.

	You should have received a copy of the GNU General Public License
	along with FirejailProfileGenerator.  If not, see <http://www.gnu.org/licenses/>.
-->

<applications>

	<application>
		<name>default</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<genoptions>nodevel</genoptions>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>generic-5</name>
		<aliases>audacious # clementine # corebird</aliases>
		<mode>blacklist</mode>
		<options>caps.drop all # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>defaultw</name>
		<aliases>gnome-contacts # gnome-clocks # gnome-calendar # gnome-calculator # pithos # gnome-characters</aliases>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>defaultnd</name>
		<aliases>pdfsam</aliases>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
	</application>

	<application>
		<name>server</name>
		<mode>blacklist</mode>
		<options>private # private-dev # nosound # private-tmp # seccomp # no3d</options>
		<genoptions>nodevel</genoptions>
		<noblacklistexplicit>/sbin # /usr/sbin</noblacklistexplicit>
	</application>

	<application>
		<name>snap</name>
		<mode>blacklist</mode>
		<options>caps.keep chown,sys_admin</options>
		<genoptions>nodevel</genoptions>
		<paths>${HOME}/snap # ${DOWNLOADS}</paths>
	</application>

	<application>
		<name>generic-13</name>
		<aliases>less # strings</aliases>
		<mode>blacklist</mode>
		<options>quiet # tracelog # net none # shell none # private-dev # nosound # caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
	</application>

	<application>
		<name>generic-compression</name>
		<aliases>tar # gtar # unrar # gzip # unzip # xz # xzdec # 7z</aliases>
		<mode>blacklist</mode>
		<options>quiet # tracelog # net none # shell none # private-bin sh,tar,gtar,compress,gzip,lzma,xz,bzip2,lbzip2,lzip,lzop,unrar,unzip,xzdec,7z # private-dev # private-etc passwd,group,localtime # hostname tar # nosound # caps.drop all # netfilter # nonewprivs # protocol unix,inet,inet6 # seccomp # no3d</options>
		<noblacklistexplicit>/sbin # /usr/sbin</noblacklistexplicit>
	</application>

	<application>
		<name>0ad</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nogroups # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # shell none # tracelog # private-dev # private-tmp</options>
		<paths>${HOME}/.cache/0ad # ${HOME}/.config/0ad # ${HOME}/.local/share/0ad</paths>
	</application>

	<application>
		<name>atril</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nonewprivs # nogroups # noroot # nosound # protocol unix # seccomp # shell none # tracelog # private-bin atril, atril-previewer, atril-thumbnailer # private-dev # private-tmp</options>
		<paths>${HOME}/.config/atril</paths>
	</application>

	<application>
		<name>audacity</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # nogroups # noroot # protocol unix # seccomp # shell none # tracelog # private-bin audacity # private-dev # private-tmp</options>
		<paths>${HOME}/.audacity-data</paths>
	</application>

	<application>
		<name>aweather</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # nogroups # noroot # nosound # protocol unix,inet,inet6 # seccomp # shell none # tracelog # private-bin aweather # private-dev # private-tmp</options>
		<paths>${HOME}/.config/aweather</paths>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>bitlbee</name>
		<mode>blacklist</mode>
		<options>netfilter # nonewprivs # private # private-dev # protocol unix,inet,inet6 # seccomp # nosound # read-write /var/lib/bitlbee</options>
		<noblacklistexplicit>/sbin # /usr/sbin</noblacklistexplicit>
	</application>

	<application>
		<name>brave</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp</options>
		<paths>${HOME}/.config/brave # ${DOWNLOADS}</paths>
	</application>

	<application>
		<name>cherrytree</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # nosound # seccomp # protocol unix,inet,inet6,netlink # tracelog</options>
		<noblacklistexplicit>/usr/bin/python2* # /usr/bin/python3*</noblacklistexplicit>
		<paths>${HOME}/.config/cherrytree</paths>
	</application>

	<application>
		<name>chromium</name>
		<aliases>chromium-browser</aliases>
		<mode>whitelist</mode>
		<options>netfilter</options>
		<genoptions>nodevel</genoptions>
		<paths>${DOWNLOADS} # ${HOME}/.config/chromium # ${HOME}/.cache/chromium # ${HOME}/.pki</paths>
		<files>${HOME}/.config/chromium-flags.conf</files>
	</application>

	<application>
		<name>chromium-dev</name>
		<mode>whitelist</mode>
		<options>netfilter</options>
		<genoptions>nodevel</genoptions>
		<paths>${DOWNLOADS} # ${HOME}/.config/chromium-dev # ${HOME}/.cache/chromium-dev # ${HOME}/.pki</paths>
		<files>${HOME}/.config/chromium-flags.conf</files>
	</application>

	<application>
		<name>cmus</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # private-bin cmus # private-etc group # shell none</options>
		<paths>${HOME}/.config/cmus</paths>
	</application>

	<application>
		<name>deadbeef</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.config/deadbeef</paths>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>deluge</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # private-tmp # protocol unix,inet,inet6 # seccomp # shell none # private-dev # nosound</options>
		<genoptions>nodevel</genoptions>
	</application>

	<application>
		<name>dillo</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # tracelog</options>
		<paths>${HOME}/.dillo # ${HOME}/.fltk # ${DOWNLOADS}</paths>
	</application>

	<application>
		<name>dnscrypt-proxy</name>
		<mode>blacklist</mode>
		<options>no3d # private # private-dev # nosound # seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open</options>
		<noblacklistexplicit>/sbin # /usr/sbin</noblacklistexplicit>
	</application>

	<application>
		<name>mumble</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # nogroups # noroot # protocol unix,inet,inet6 # seccomp # shell none # tracelog # private-bin mumble # private-tmp</options>
		<paths>${HOME}/.config/Mumble # ${HOME}/.local/share/data/Mumble # ${HOME}/.local/share/Mumble</paths>
	</application>

	<application>
		<name>multimc5</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6</options>
		<paths>${HOME}/.multimc5 # ${HOME}/.local/share/multimc5</paths>
	</application>

	<application>
		<name>eog</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # nogroups # protocol unix # seccomp # shell none # private-bin eog # private-dev # private-etc fonts # private-tmp # nosound</options>
		<paths>${HOME}/.config/eog # ${HOME}/.cache/champlain</paths>
	</application>

	<application>
		<name>atom</name>
		<aliases>atom-beta</aliases>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # nogroups # noroot # nosound # protocol unix,inet,inet6,netlink # seccomp # shell none # private-dev # private-tmp</options>
		<genoptions>nodevel</genoptions>
		<paths>${HOME}/.atom # ${HOME}/.config/Atom</paths>
	</application>

	<application>
		<name>libreoffice</name>
		<aliases>localc # lodraw # loffice # lofromtemplate # loimpress # lomath # loweb # lowriter # soffice</aliases>
		<mode>blacklist</mode>
		<options>caps.drop all # net none # nogroups # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # tracelog # private-dev</options>
		<paths>${HOME}/.config/libreoffice</paths>
		<noblacklistexplicit>/usr/local/sbin</noblacklistexplicit>
	</application>

	<application>
		<name>dnsmasq</name>
		<mode>blacklist</mode>
		<options>no3d # caps # netfilter # nonewprivs # private # private-dev # nosound # protocol unix,inet,inet6,netlink # seccomp</options>
		<noblacklistexplicit>/sbin # /usr/sbin</noblacklistexplicit>
	</application>

	<application>
		<name>dosbox</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nogroups # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # shell none # tracelog # private-bin dosbox # private-dev # private-tmp</options>
		<paths>${HOME}/.dosbox</paths>
	</application>

	<application>
		<name>dropbox</name>
		<mode>whitelist</mode>
		<options>caps.drop all # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.config/autostart # ${HOME}/Dropbox # ${HOME}/.dropbox-dist</paths>
		<files>${HOME}/.config/autostart/dropbox.desktop</files>
	</application>

	<application>
		<name>eom</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nogroups # nonewprivs # noroot # nosound # protocol unix # seccomp # shell none # tracelog # private-bin eom # private-dev # private-tmp</options>
		<paths>${HOME}/.config/mate/eom</paths>
	</application>

	<application>
		<name>epiphany</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.config/epiphany # ${HOME}/.cache/epiphany # ${HOME}/.local/share/epiphany # ${DOWNLOADS}</paths>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>evince</name>
		<mode>blacklist</mode>
		<options>netfilter # caps.drop all # nonewprivs # nogroups # noroot # nosound # protocol unix # seccomp # shell none # private-etc fonts # private-bin evince,evince-previewer,evince-thumbnailer # private-dev # tracelog</options>
	</application>

	<application>
		<name>fbreader</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # shell none # private-tmp # private-bin fbreader,FBReader # private-dev # nosound</options>
		<paths>${HOME}/.FBReader</paths>
	</application>

	<application>
		<name>file</name>
		<mode>blacklist</mode>
		<options>no3d # private-tmp # quiet # tracelog # net none # shell none # private-bin file # private-dev # private-etc magic.mgc,magic,localtime # hostname file # nosound # caps.drop all # netfilter # nonewprivs # protocol unix,inet,inet6 # seccomp</options>
	</application>

	<application>
		<name>filezilla</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # nosound # protocol unix,inet,inet6 # seccomp # shell none # private-tmp # private-bin filezilla,uname,sh,python,lsb_release,fzputtygen,fzsftp # private-dev # nosound</options>
		<paths>${HOME}/.filezilla # ${HOME}/.config/filezilla</paths>
	</application>

	<application>
		<name>firefox</name>
		<aliases>firefox-esr # iceweasel</aliases>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # tracelog # private-dev # private-tmp</options>
		<paths>${DOWNLOADS} # ${HOME}/.mozilla # ${HOME}/.cache/mozilla # ${HOME}/.pki</paths>
	</application>

	<application>
		<name>icecat</name>
		<aliases>icecat-launcher</aliases>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # tracelog</options>
		<paths>${DOWNLOADS} # ${HOME}/.mozilla # ${HOME}/.cache/mozilla # ${HOME}/.pki </paths>
	</application>

	<application>
		<name>seamonkey</name>
		<aliases>seamonkey-bin</aliases>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # tracelog</options>
		<paths>${DOWNLOADS} # ${HOME}/.mozilla/seamonkey # ${HOME}/.cache/mozilla # ${HOME}/.pki</paths>
	</application>

	<application>
		<name>abrowser</name>
		<aliases></aliases>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # tracelog</options>
		<paths>${DOWNLOADS} # ${HOME}/.mozilla # ${HOME}/.cache/mozilla # ${HOME}/.pki</paths>
	</application>

	<application>
		<name>cyberfox</name>
		<aliases>Cyberfox</aliases>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # tracelog</options>
		<paths>${DOWNLOADS} # ${HOME}/.pki # ${HOME}/.8pecxstudios # ${HOME}/.cache/8pecxstudios</paths>
	</application>

	<application>
		<name>palemoon</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # tracelog</options>
		<paths>${DOWNLOADS} # ${HOME}/.pki # ${HOME}/.moonchild productions # ${HOME}/.cache/moonchild productions</paths>
	</application>

	<application>
		<name>conkeror</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # tracelog</options>
		<paths>${DOWNLOADS} # ${HOME}/.pki # ${HOME}/.conkeror.mozdev.org </paths>
	</application>

	<application>
		<name>thunderbird</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # tracelog</options>
		<paths>${DOWNLOADS} # ${HOME}/.mozilla # ${HOME}/.cache/mozilla # ${HOME}/.pki # ${HOME}/.gnupg # ${HOME}/.thunderbird # ${HOME}/.cache/thunderbird</paths>
	</application>

	<application>
		<name>icedove</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # tracelog</options>
		<paths>${DOWNLOADS} # ${HOME}/.mozilla # ${HOME}/.cache/mozilla # ${HOME}/.pki # ${HOME}/.gnupg # ${HOME}/.icedove # ${HOME}/.cache/icedove</paths>
	</application>

	<application>
		<name>slimjet</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp</options>
		<genoptions>nodevel</genoptions>
		<paths>${DOWNLOADS} # ${HOME}/.config/slimjet # ${HOME}/.cache/slimjet # ${HOME}/.pki</paths>
	</application>

	<application>
		<name>franz</name>
		<mode>blacklist</mode>
		<options>caps.drop all # seccomp # protocol unix,inet,inet6,netlink # netfilter # #tracelog # nonewprivs # noroot</options>
		<paths>${HOME}/.config/Franz # ${HOME}/.cache/Franz # ${HOME}/.pki</paths>
	</application>

	<application>
		<name>gitter</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nogroups # nonewprivs # noroot # nosound # protocol unix,inet,inet6,netlink # seccomp # shell none # private-bin gitter # private-dev # private-tmp</options>
		<paths>${HOME}/.config/Gitter</paths>
	</application>

	<application>
		<name>gnome-chess</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nogroups # nonewprivs # noroot # nosound # protocol unix # seccomp # shell none # tracelog # private-bin fairymax,gnome-chess,hoichess # private-dev # private-etc fonts,gnome-chess # private-tmp</options>
		<paths>${HOME}/.local/share/gnome-chess</paths>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>gnome-mplayer</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nogroups # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # shell none # private-bin gnome-mplayer # private-dev # private-tmp</options>
	</application>

	<application>
		<name>google-chrome</name>
		<aliases>google-chrome-stable</aliases>
		<mode>whitelist</mode>
		<options>netfilter</options>
		<genoptions>nodevel</genoptions>
		<paths>${DOWNLOADS} # ${HOME}/.config/google-chrome # ${HOME}/.cache/google-chrome # ${HOME}/.pki</paths>
	</application>

	<application>
		<name>google-chrome-beta</name>
		<mode>whitelist</mode>
		<options>netfilter</options>
		<genoptions>nodevel</genoptions>
		<paths>${DOWNLOADS} # ${HOME}/.config/google-chrome-beta # ${HOME}/.cache/google-chrome-beta # ${HOME}/.pki</paths>
	</application>

	<application>
		<name>google-chrome-unstable</name>
		<mode>whitelist</mode>
		<options>netfilter</options>
		<genoptions>nodevel</genoptions>
		<paths>${DOWNLOADS} # ${HOME}/.config/google-chrome-unstable # ${HOME}/.cache/google-chrome-unstable # ${HOME}/.pki</paths>
	</application>

	<application>
		<name>google-play-music-desktop-player</name>
		<mode>whitelist</mode>
		<options>caps.drop all # nonewprivs # noroot # netfilter # protocol unix,inet,inet6,netlink # seccomp</options>
		<paths>${HOME}/.config/Google Play Music Desktop Player</paths>
	</application>

	<application>
		<name>gpredict</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nogroups # nonewprivs # noroot # nosound # protocol unix,inet,inet6 # seccomp # shell none # tracelog # private-bin gpredict # private-etc fonts,resolv.conf # private-dev # private-tmp</options>
		<paths>${HOME}/.config/Gpredict</paths>
	</application>

	<application>
		<name>gthumb</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nogroups # nonewprivs # noroot # nosound # protocol unix # seccomp # shell none # tracelog # private-bin gthumb # private-dev # private-tmp</options>
		<paths>${HOME}/.config/gthumb</paths>
	</application>

	<application>
		<name>gwenview</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nonewprivs # noroot # nogroups # private-dev # protocol unix # seccomp # nosound</options>
		<paths>${HOME}/.kde/share/apps/gwenview</paths>
		<files>${HOME}/.kde/share/config/gwenviewrc</files>
	</application>

	<application>
		<name>hedgewars</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nogroups # nonewprivs # noroot # seccomp # tracelog # private-dev # private-tmp</options>
		<paths>${HOME}/.hedgewars</paths>
	</application>

	<application>
		<name>hexchat</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nogroups # nonewprivs # noroot # nosound # protocol unix,inet,inet6 # seccomp # shell none # tracelog # private-bin hexchat # private-dev # private-tmp</options>
		<paths>${HOME}/.config/hexchat</paths>
	</application>

	<application>
		<name>gajim</name>
		<mode>whitelist</mode>
		<options>read-only ${HOME}/.local/lib/python2.7/site-packages # caps.drop all # netfilter # nonewprivs # nogroups # noroot # protocol unix,inet,inet6 # seccomp # shell none # private-dev</options>
		<paths>${HOME}/.cache/gajim # ${HOME}/.local/share/gajim # ${HOME}/.config/gajim # ${DOWNLOADS} # ${HOME}/.local/lib/python2.7/site-packages</paths>
	</application>

	<application>
		<name>inox</name>
		<mode>whitelist</mode>
		<options>netfilter</options>
		<genoptions>nodevel</genoptions>
		<paths>${DOWNLOADS} # ${HOME}/.config/inox # ${HOME}/.cache/inox # ${HOME}/.pki</paths>
	</application>

	<application>
		<name>jitsi</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nonewprivs # nogroups # noroot # protocol unix,inet,inet6 # seccomp # shell none # tracelog # private-tmp</options>
		<paths>${HOME}/.jitsi</paths>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>kmail</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # nogroups # noroot # protocol unix,inet,inet6,netlink # seccomp # tracelog # private-dev</options>
		<paths>${HOME}/.gnupg</paths>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>konversation</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nogroups # noroot # seccomp # protocol unix,inet,inet6 # private-tmp</options>
	</application>

	<application>
		<name>lxterminal</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # protocol unix,inet,inet6 # seccomp</options>
		<genoptions>nodevel</genoptions>
	</application>

	<application>
		<name>Mathematica</name>
		<aliases>mathematica</aliases>
		<mode>whitelist</mode>
		<options>caps.drop all # nonewprivs # noroot # seccomp</options>
		<paths>${HOME}/.Mathematica # ${HOME}/.Wolfram Research # ${HOME}/Documents/Wolfram Mathematica</paths>
	</application>

	<application>
		<name>mcabber</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol inet,inet6 # seccomp # private-bin mcabber # private-etc null # private-dev # shell none # nosound</options>
		<paths>${HOME}/.mcabber</paths>
		<files>${HOME}/.mcabberrc</files>
	</application>

	<application>
		<name>midori</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.config/midori # ${HOME}/.cache/midori # ${DOWNLOADS}</paths>
	</application>

	<application>
		<name>mpv</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # shell none # private-bin mpv,youtube-dl,python2.7</options>
		<paths>${HOME}/.config/mpv</paths>
	</application>

	<application>
		<name>mupen64plus</name>
		<mode>whitelist</mode>
		<options>caps.drop all # net none # nonewprivs # noroot # seccomp</options>
		<paths>${HOME}/.config/mupen64plus # ${HOME}/.local/share/mupen64plus</paths>
	</application>

	<application>
		<name>netsurf</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # tracelog</options>
		<paths>${HOME}/.config/netsurf # ${HOME}/.cache/netsurf # ${DOWNLOADS}</paths>
	</application>

	<application>
		<name>okular</name>
		<mode>blacklist</mode>
		<options>read-only ${HOME}/.kde/share/config/kdeglobals # caps.drop all # nonewprivs # nogroups # noroot # private-dev # protocol unix # seccomp # nosound</options>
		<paths>${HOME}/.kde/share/apps/okular</paths>
		<files>${HOME}/.kde/share/config/okularrc # ${HOME}/.kde/share/config/okularpartrc</files>
	</application>

	<application>
		<name>opera</name>
		<mode>whitelist</mode>
		<options>netfilter</options>
		<paths>${HOME}/.opera # ${HOME}/.cache/opera # ${HOME}/.config/opera # ${DOWNLOADS} # ${HOME}/.pki</paths>
	</application>

	<application>
		<name>opera-beta</name>
		<mode>whitelist</mode>
		<options>netfilter</options>
		<paths>${HOME}/.opera-beta # ${HOME}/.cache/opera-beta # ${HOME}/.config/opera-beta # ${DOWNLOADS} # ${HOME}/.pki</paths>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>parole</name>
		<mode>blacklist</mode>
		<options>private-etc passwd,group,fonts # private-bin parole,dbus-launch # caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # shell none</options>
	</application>

	<application>
		<name>pidgin</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # nogroups # noroot # protocol unix,inet,inet6 # seccomp # shell none # tracelog # private-bin pidgin # private-dev # private-tmp</options>
		<paths>${HOME}/.purple</paths>
	</application>

	<application>
		<name>pix</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nonewprivs # nogroups # noroot # nosound # protocol unix # seccomp # shell none # tracelog # private-bin pix # private-dev # private-tmp</options>
		<paths>${HOME}/.config/pix # ${HOME}/.local/share/pix</paths>
	</application>

	<application>
		<name>empathy</name>
		<mode>whitelist</mode>
		<options>caps.drop all # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # nogroups</options>
		<paths>${DOWNLOADS} # ${HOME}/.cache/champlain # ${HOME}/.local/share/Empathy # ${HOME}/.local/share/telepathy # ${HOME}/.local/share/TpLogger # ${HOME}/.config/telepathy-account-widgets # ${HOME}/.cache/telepathy # ${HOME}/.purple</paths>
	</application>

	<application>
		<name>polari</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${DOWNLOADS} # ${HOME}/.local/share/Empathy # ${HOME}/.local/share/telepathy # ${HOME}/.local/share/TpLogger # ${HOME}/.config/telepathy-account-widgets # ${HOME}/.cache/telepathy # ${HOME}/.purple</paths>
	</application>

	<application>
		<name>psi-plus</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${DOWNLOADS} # ${HOME}/.config/psi+ # ${HOME}/.local/share/psi+</paths>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>qbittorrent</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # nosound # protocol unix,inet,inet6 # seccomp # private-dev # nosound # private-tmp</options>
	</application>

	<application>
		<name>qtox</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # nogroups # noroot # protocol unix,inet,inet6 # seccomp # shell none # tracelog # private-bin qtox # private-tmp</options>
		<paths>${HOME}/.config/tox # ${DOWNLOADS}</paths>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>quassel</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nonewprivs # noroot # netfilter # protocol unix,inet,inet6 # seccomp</options>
	</application>

	<application>
		<name>quiterss</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # nogroups # noroot # private-bin quiterss # private-dev # nosound # protocol unix,inet,inet6 # seccomp # shell none # tracelog</options>
		<paths>${HOME}/.config/QuiteRss # ${HOME}/.config/QuiteRssrc # ${HOME}/.cache/QuiteRss # ${HOME}/.local/share/QuiteRss</paths>
		<files>${HOME}/quiterssfeeds.opml</files>
	</application>

	<application>
		<name>qutebrowser</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # tracelog</options>
		<paths>${HOME}/.config/qutebrowser # ${HOME}/.cache/qutebrowser # ${DOWNLOADS}</paths>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>rhythmbox</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nogroups # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # shell none # tracelog # private-bin rhythmbox # private-dev # private-tmp</options>
	</application>

	<!--TODO ADD PATHS (EVEN IN BLACKLIST, IT PREVENTS OTHER FIREJAILED APPS FROM ACCESSING)-->
	<application>
		<name>rtorrent</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # nosound # protocol unix,inet,inet6 # seccomp # shell none # private-bin rtorrent # private-dev # nosound # private-tmp</options>
	</application>

	<application>
		<name>skype</name>
		<mode>whitelist</mode>
		<options>noexec ${HOME}/ # noexec /tmp/ # caps.drop all # protocol inet,inet6,unix # seccomp # noroot # private-etc resolv.conf,hosts,fonts,pulse # private-bin skype,bash # ipc-namespace</options>
		<paths>${HOME}/.Skype # ${DOWNLOADS}</paths>
	</application>

	<application>
		<name>skypeforlinux</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # noroot # seccomp # protocol unix,inet,inet6,netlink</options>
		<genoptions>nodevel</genoptions>
		<paths>${HOME}/.config/skypeforlinux</paths>
	</application>

	<application>
		<name>slack</name>
		<mode>whitelist</mode>
		<options>protocol unix,inet,inet6,netlink # private-dev # private-tmp # private-etc fonts,resolv.conf,ld.so.conf,ld.so.cache,localtime # name slack # blacklist /var # caps.drop all # seccomp # netfilter # nonewprivs # nogroups # noroot # shell none # private-bin slack</options>
		<paths>${HOME}/.config/Slack # ${DOWNLOADS}</paths>
	</application>

	<application>
		<name>spotify</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nogroups # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # shell none # private-bin spotify # private-etc fonts,machine-id,pulse,resolv.conf # private-dev # private-tmp # blacklist ${HOME}/.Xauthority # blacklist ${HOME}/.bashrc # blacklist /boot # blacklist /lost+found # blacklist /media # blacklist /mnt # blacklist /opt # blacklist /root # blacklist /sbin # blacklist /srv # blacklist /sys # blacklist /var</options>
		<paths>${HOME}/.config/spotify # ${HOME}/.cache/spotify # ${HOME}/.local/share/spotify</paths>
	</application>

	<application>
		<name>ssh</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # quiet</options>
		<paths>${HOME}/.ssh # /tmp/ssh-*</paths>
	</application>

	<!-- TODO ADD MORE GAMES AND CONVERT TO WHITELIST -->
	<application>
		<name>steam</name>
		<aliases>steam-native</aliases>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp</options>
		<paths>${HOME}/.steampath # ${HOME}/.steampid # ${HOME}/.steam # ${HOME}/.local/share/Steam # ${HOME}/.local/share/steam # ${HOME}/My Games # ${HOME}/.killingfloor # ${HOME}/.local/share/aspyr-media # ${HOME}/.local/share/feral-interactive # ${HOME}/.local/share/3909/PapersPlease # ${HOME}/.local/share/SuperHexagon # ${HOME}/.local/share/vulkan # ${HOME}/.local/share/vpltd # ${HOME}/.nv # ${HOME}/.local/share/Terraria # ${HOME}/.local/share/cdprojektred</paths>
	</application>

	<application>
		<name>stellarium</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nogroups # nonewprivs # noroot # nosound # protocol unix,inet,inet6,netlink # seccomp # shell none # tracelog # private-bin stellarium # private-dev # private-tmp</options>
		<paths>${HOME}/.stellarium # ${HOME}/.config/stellarium</paths>
	</application>

	<application>
		<name>telegram</name>
		<aliases>Telegram</aliases>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.TelegramDesktop</paths>
	</application>

	<application>
		<name>totem</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nonewprivs # noroot # netfilter # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.config/totem # ${HOME}/.local/share/totem</paths>
	</application>

	<application>
		<name>transmission-cli</name>
		<aliases>transmission-qt # transmission-gtk</aliases>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # nosound # protocol unix,inet,inet6 # seccomp # shell none # tracelog # private-dev # private-tmp</options>
		<paths>${HOME}/.config/transmission # ${HOME}/.cache/transmission</paths>
	</application>

	<application>
		<name>uget-gtk</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # shell none # private-bin uget-gtk # private-dev # nosound # private-tmp</options>
		<paths>${HOME}/.config/uGet # ${DOWNLOADS}</paths>
	</application>

	<application>
		<name>unbound</name>
		<mode>blacklist</mode>
		<options>private # private-dev # nosound # seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open</options>
		<noblacklistexplicit>/sbin # /usr/sbin</noblacklistexplicit>
	</application>

	<application>
		<name>vivaldi</name>
		<aliases>vivaldi-beta</aliases>
		<mode>whitelist</mode>
		<options>netfilter</options>
		<paths>${DOWNLOADS} # ${HOME}/.config/vivaldi # ${HOME}/.cache/vivaldi # ${HOME}/.pki</paths>
	</application>

	<application>
		<name>vlc</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nogroups # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # shell none # private-bin vlc,cvlc,nvlc,rvlc,qvlc,svlc # private-dev # private-tmp</options>
		<paths>${HOME}/.config/vlc</paths>
	</application>

	<application>
		<name>warzone2100</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nogroups # nonewprivs # noroot # protocol unix,inet,inet6,netlink # seccomp # shell none # tracelog # private-bin warzone2100 # private-dev # private-tmp</options>
		<paths>${HOME}/.warzone2100-3.1</paths>
	</application>

	<application>
		<name>weechat</name>
		<aliases>weechat-curses</aliases>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.weechat</paths>
	</application>

	<application>
		<name>wesnoth</name>
		<mode>whitelist</mode>
		<options>caps.drop all # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # private-dev</options>
		<paths>${HOME}/.config/wesnoth # ${HOME}/.cache/wesnoth # ${HOME}/.local/share/wesnoth</paths>
	</application>

	<application>
		<name>wine</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # seccomp</options>
		<paths>${HOME}/.wine # ${HOME}/.wine64</paths>
	</application>

	<application>
		<name>xchat</name>
		<mode>whitelist</mode>
		<options>caps.drop all # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.config/xchat # ${DOWNLOADS}</paths>
	</application>

	<application>
		<name>xplayer</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # nogroups # noroot # protocol unix,inet,inet6 # seccomp # shell none # tracelog # private-bin xplayer,xplayer-audio-preview,xplayer-video-thumbnailer # private-dev # private-tmp</options>
		<paths>${HOME}/.config/xplayer # ${HOME}/.local/share/xplayer</paths>
	</application>

	<application>
		<name>xreader</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nogroups # nonewprivs # noroot # nosound # protocol unix # seccomp # shell none # tracelog # private-bin xreader, xreader-previewer, xreader-thumbnailer # private-dev # private-tmp</options>
		<paths>${HOME}/.config/xreader # ${HOME}/.cache/xreader # ${HOME}/.local/share/xreader</paths>
	</application>

	<application>
		<name>xviewer</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nogroups # nonewprivs # noroot # nosound # protocol unix # seccomp # shell none # tracelog # private-dev # private-bin xviewer # private-tmp</options>
		<paths>${HOME}/.config/xviewer</paths>
	</application>

	<application>
		<name>uudeview</name>
		<mode>blacklist</mode>
		<options>quiet # tracelog # net none # shell none # private-bin uudeview # private-dev # private-etc nonexisting_fakefile_for_empty_etc # hostname uudeview # nosound # caps.drop all # netfilter # nonewprivs # protocol unix,inet,inet6 # seccomp</options>
	</application>

	<application>
		<name>teamspeak3</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.ts3client # ${DOWNLOADS}</paths>
	</application>

	<application>
		<name>linphone</name>
		<mode>whitelist</mode>
		<options>caps.drop all # noroot # seccomp</options>
		<paths>${DOWNLOADS}</paths>
		<files>${HOME}/.linphonerc # ${HOME}/.linphone-history.db</files>
	</application>

	<application>
		<name>mpd</name>
		<mode>blacklist</mode>
		<options>private-dev # private-bin mpd,bash # caps.drop all # noroot # seccomp</options>
		<files>${HOME}/.mpdconf</files>
	</application>

	<application>
		<name>openshot</name>
		<mode>blacklist</mode>
		<options>private-bin openshot,python # private-dev # noroot # protocol unix # shell none # seccomp # caps.drop all # nonewprivs # noroot</options>
		<paths>${HOME}/.openshot # ${HOME}/.openshot_qt</paths>
	</application>

	<application>
		<name>scribus</name>
		<mode>blacklist</mode>
		<options>private-bin scribus,gs # private-dev # noroot # protocol unix # shell none # seccomp # caps.drop all</options>
		<paths>${HOME}/.scribus</paths>
	</application>

	<application>
		<name>virtualbox</name>
		<mode>blacklist</mode>
		<options>caps.drop all</options>
		<paths>${HOME}/.config/VirtualBox # ${HOME}/.VirtualBox # ${HOME}/VirtualBox VMs</paths>
		<noblacklistexplicit>/dev/vboxdrv # /dev/vboxdrvu # /dev/vboxnetctl # /usr/bin/virtualbox</noblacklistexplicit>
	</application>

	<application>
		<name>gnome-2048</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.local/share/gnome-2048</paths>
	</application>

	<application>
		<name>gnome-maps</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.cache/champlain</paths>
		<files>${HOME}/.local/.share/maps-places.json</files>
	</application>

	<application>
		<name>gnome-music</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.local/share/gnome-music</paths>
	</application>

	<application>
		<name>lollypop</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.local/share/lollypop</paths>
	</application>

	<application>
		<name>gnome-weather</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.cache/libgweather</paths>
	</application>

	<application>
		<name>xonotic</name>
		<aliases>xonotic-sdl # xonotic-glx</aliases>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.xonotic</paths>
	</application>

	<application>
		<name>arduino</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/Arduino # ${HOME}/.arduino15</paths>
	</application>

	<application>
		<name>bless</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<paths>${HOME}/.config/bless</paths>
	</application>

	<application>
		<name>jd-gui</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<files>${HOME}/.config/jd-gui.cfg</files>
	</application>

	<application>
		<name>redshift</name>
		<aliases>redshift-gtk</aliases>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp</options>
		<files>${HOME}/.config/redshift.conf</files>
	</application>

	<application>
		<name>mupdf</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nogroups # nonewprivs # noroot # nosound # protocol unix # seccomp # netfilter # shell none # tracelog # private-bin mupdf,sh,tempfile,rm # private-tmp # private-dev # read-only ${HOME}</options>
	</application>

	<application>
		<name>qpdfview</name>
		<mode>blacklist</mode>
		<options>caps.drop all # ipc-namespace # net none # noexec ${HOME} # noexec /tmp # nogroups # nonewprivs # noroot # nosound # private-bin qpdfview # private-dev # private-etc fonts,X11,alternatives # private-tmp # protocol unix # </options>
		<paths>${HOME}/.config/qpdfview # ${HOME}/.local/share/qpdfview</paths>
	</application>

	<application>
		<name>luminance-hdr</name>
		<aliases>luminance-hdr-cli</aliases>
		<mode>blacklist</mode>
		<genoptions>nodevel</genoptions>
		<options>caps.drop all # ipc-namespace # net none # noexec ${HOME} # noexec /tmp # nogroups # noroot # nosound # private-bin luminance-hdr,luminance-hdr-cli,align_image_stack # private-dev # private-etc fonts,X11,alternatives # seccomp # shell none</options>
		<paths>${HOME}/.LuminanceHDR # ${HOME}/.config/Luminance</paths>
	</application>

	<application>
		<name>synfigstudio</name>
		<mode>blacklist</mode>
		<options>caps.drop all # ipc-namespace # net none # noexec ${HOME} # noexec /tmp # noroot # private-bin synfigstudio # private-dev # private-etc fonts,X11,synfig,synfig_modules.cfg # seccomp # shell none</options>
		<paths>${HOME}/.synfig</paths>
	</application>

	<application>
		<name>brackets</name>
		<mode>blacklist</mode>
		<options>private-bin bash,brackets,readlink,dirname,google-chrome,cat # private-dev</options>
		<noblacklistexplicit>/opt/brackets # /opt/google</noblacklistexplicit>
		<paths>${HOME}/.config/Brackets</paths>
	</application>

	<application>
		<name>gimp</name>
		<mode>blacklist</mode>
		<genoptions>nodevel</genoptions>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix # seccomp # private-dev # private-tmp # noexec ${HOME} # noexec /tmp # nogroups # nosound</options>
		<paths>${HOME}/.gimp*</paths>
	</application>

	<application>
		<name>inkscape</name>
		<mode>blacklist</mode>
		<genoptions>nodevel</genoptions>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix # seccomp # private-dev # private-tmp # noexec ${HOME} # noexec /tmp # nogroups # nosound</options>
		<paths>${HOME}/.inkscape</paths>
	</application>

	<application>
		<name>lmms</name>
		<mode>blacklist</mode>
		<options>private-dev # private-etc fonts,pulse # noexec /home # noexec /tmp # shell none # seccomp # caps.drop all # net none # noroot # nogroups # ipc-namespace</options>
		<files>${HOME}/.lmmsrc.xml</files>
	</application>

	<application>
		<name>cin</name>
		<mode>blacklist</mode>
		<options>caps.drop all # ipc-namespace # net none # noexec /home # noexec /tmp # nogroups # noroot # private-bin cin # private-dev # private-etc fonts,pulse # seccomp # shell none</options>
		<paths>${HOME}/.bcast5</paths>
	</application>

	<application>
		<name>feh</name>
		<mode>blacklist</mode>
		<options>caps.drop all # seccomp # protocol unix # netfilter # net none # nonewprivs # noroot # nogroups # nosound # shell none # private-bin feh # private-dev # private-etc feh # private-tmp</options>
	</application>

	<application>
		<name>zathura</name>
		<mode>blacklist</mode>
		<options>caps.drop all # seccomp # protocol unix # netfilter # nonewprivs # noroot # nogroups # nosound # net none # private-tmp # shell none # private-bin zathura # private-dev # private-etc fonts # whitelist /tmp/.X11-unix # read-only ~/ # read-write ~/.local/share/zathura/</options>
		<paths>${HOME}/.config/zathura # ${HOME}/.local/share/zathura</paths>
	</application>

	<application>
		<name>ranger</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # net none # nonewprivs # noroot # nogroups # protocol unix # seccomp # nosound # private-tmp # private-dev</options>
		<noblacklistexplicit>/usr/bin/perl # /usr/share/perl* # /usr/lib/perl*</noblacklistexplicit>
	</application>

	<application>
		<name>keepass</name>
		<mode>blacklist</mode>
		<options>caps.drop all # nogroups # nonewprivs # noroot # nosound # protocol unix,inet,inet6 # seccomp # netfilter # shell none # private-tmp # private-dev</options>
		<paths>${HOME}/.config/keepass # ${HOME}/.keepass</paths>
	</application>

	<application>
		<name>keepassx</name>
		<aliases>keepassx2</aliases>
		<mode>blacklist</mode>
		<options>caps.drop all # nogroups # nonewprivs # noroot # nosound # protocol unix # seccomp # netfilter # shell none # private-tmp # private-dev </options>
		<paths>${HOME}/.config/keepassx # ${HOME}/.keepassx</paths>
	</application>

	<application>
		<name>calligra</name>
		<aliases>calligraauthor # calligraconverter # calligraflow # calligraplan # calligraplanwork # calligrasheets # calligrastage # calligrawords</aliases>
		<mode>blacklist</mode>
		<options>private-bin calligra,calligraauthor,calligraconverter,calligraflow,calligraplan,calligraplanwork,calligrasheets,calligrastage,calligrawords,dbus-launch # private-dev # private-etc fonts,passwd,alternatives,X11 # noexec /home # noexec /tmp # shell none # seccomp # caps.drop all # net none # noroot # nogroups # ipc-namespace</options>
		<noblacklistexplicit>/tmp/dbus_session_socket</noblacklistexplicit>
	</application>

	<application>
		<name>blender</name>
		<mode>blacklist</mode>
		<options>private-bin blender # private-dev # private-etc pulse # noexec /home # noexec /tmp # shell none # seccomp # caps.drop all # net none # noroot # nogroups # ipc-namespace</options>
		<paths>${HOME}/.config/blender</paths>
	</application>

	<application>
		<name>google-earth</name>
		<mode>whitelist</mode>
		<options>private-bin google-earth,sh,grep,sed,ls,dirname # private-dev # private-etc fonts,resolv.conf,X11,alternatives,pulse # noexec /home # noexec /tmp # shell none # seccomp # caps.drop all # noroot # nogroups # ipc-namespace</options>
		<paths>${HOME}/.googleearth/Cache/ # ${HOME}/.googleearth/Temp/ # ${HOME}/.config/Google</paths>
		<files>${HOME}/.googleearth/myplaces.kml # ${HOME}/.googleearth/myplaces.backup.kml</files>
	</application>

	<application>
		<name>flowblade</name>
		<mode>blacklist</mode>
		<options>private-bin python,flowblade # private-dev # private-etc pulse,fonts,alternatives,X11 # noexec /home # noexec /tmp # shell none # seccomp # caps.drop all # net none # noroot # nogroups # ipc-namespace # nonewprivs</options>
		<paths>${HOME}/.flowblade # ${HOME}/.config/flowblade</paths>
	</application>

	<application>
		<name>kdenlive</name>
		<mode>blacklist</mode>
		<options>private-bin kdenlive,kdenlive_render,dbus-launch,melt,ffmpeg,ffplay,ffprobe,dvdauthor,genisoimage,vlc,xine,kdeinit5,kshell5,kdeinit5_shutdown,kdeinit5_wrapper,kdeinit4,kshell4,kdeinit4_shutdown,kdeinit4_wrapper # private-dev # private-etc fonts,alternatives,X11,pulse,passwd # shell none # seccomp # caps.drop all # net none # noroot # nogroups</options>
		<noblacklistexplicit>/tmp/dbus_session_socket</noblacklistexplicit>
	</application>

	<application>
		<name>natron</name>
		<mode>blacklist</mode>
		<options>private-bin natron # private-etc fonts,X11,pulse # whitelist /tmp/.X11-unix/ # noexec ${HOME} # noexec /tmp # shell none # ipc-namespace</options>
		<paths>${HOME}/.Natron # ${HOME}/.cache/INRIA # ${HOME}/.config/INRIA</paths>
		<noblacklistexplicit>/opt/natron/</noblacklistexplicit>
	</application>

	<application>
		<name>darktable</name>
		<mode>blacklist</mode>
		<options>private-bin darktable # private-dev # private-etc fonts,X11,alternatives # noexec ${HOME} # noexec /tmp # shell none # seccomp # caps.drop all # net none # noroot # nosound # nogroups # ipc-namespace</options>
		<paths>${HOME}/.config/darktable # ${HOME}/.cache/darktable</paths>
	</application>

	<application>
		<name>zart</name>
		<mode>blacklist</mode>
		<options>private-bin zart,ffmpeg,melt,ffprobe,ffplay # private-etc fonts,X11 # private-dev # noexec ${HOME} # noexec /tmp # shell none # noroot # ipc-namespace # net none # seccomp # caps.drop all</options>
	</application>

	<application>
		<name>shotcut</name>
		<mode>blacklist</mode>
		<options>private-bin shotcut,melt,qmelt,nice # private-dev # private-etc X11,alternatives,pulse,fonts # noexec ${HOME} # noexec /tmp # shell none # seccomp # caps.drop all # net none # noroot # nogroups</options>
		<paths>${HOME}/.config/Meltytech</paths>
	</application>

	<application>
		<name>mutt</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nogroups # nonewprivs # noroot # nosound # protocol unix,inet,inet6 # seccomp # shell none # private-dev</options>
		<paths>${HOME}/.cache/mutt</paths>
		<files>${HOME}/.mutt # ${HOME}/.muttrc # ${DOWNLOADS}</files>
		<noblacklistexplicit>${HOME}/.mail # ${HOME}/.mailcap # ${HOME}/.gnupg</noblacklistexplicit>
	</application>

	<application>
		<name>claws-mail</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # nogroups # nosound # protocol unix,inet,inet6 # seccomp # shell none # private-dev # private-tmp</options>
		<paths>${HOME}/.claws-mail # ${DOWNLOADS}</paths>
		<noblacklistexplicit>${HOME}/.signature # ${HOME}/.gnupg</noblacklistexplicit>
	</application>

	<application>
		<name>git</name>
		<mode>blacklist</mode>
		<options>quiet # caps.drop all # netfilter # nonewprivs # noroot # nogroups # nosound # protocol unix,inet,inet6 # seccomp # shell none # private-dev</options>
		<noblacklistexplicit>${HOME}/.gitconfig # ${HOME}/.ssh # ${HOME}/.gnupg</noblacklistexplicit>
	</application>

	<application>
		<name>ricochet</name>
		<mode>whitelist</mode>
		<options>private-bin ricochet,tor # private-dev # private-etc fonts,tor,X11,alternatives # noexec /home # noexec /tmp # shell none # seccomp # caps.drop all # noroot # nogroups # ipc-namespace</options>
		<paths>${HOME}/.local/share/Ricochet # ${DOWNLOADS}</paths>
	</application>

	<application>
		<name>xpdf</name>
		<mode>blacklist</mode>
		<options>caps.drop all # shell none # nonewprivs # noroot # protocol unix # seccomp # private-dev # private-tmp # net none</options>
		<files>${HOME}/.xpdfrc</files>
	</application>

	<application>
		<name>evolution</name>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # nogroups # protocol unix,inet,inet6 # seccomp # shell none # private-dev # private-tmp # nosound</options>
		<paths>${DOWNLOADS} # ${HOME}/.config/evolution # ${HOME}/.local/share/evolution # ${HOME}/.cache/evolution # ${HOME}/.pki # ${HOME}/.gnupg</paths>
	</application>

	<application>
		<name>ardour5</name>
		<aliases>ardour4</aliases>
		<mode>whitelist</mode>
		<options>blacklist /usr/local/bin # blacklist /boot # blacklist /media # blacklist /mnt # blacklist /opt # private-bin sh,ardour5,ardour5-copy-mixer,ardour5-export,ardour5-fix_bbtppq,grep,sed,ldd,nm # private-dev # private-etc pulse,X11,alternatives,ardour4,ardour5,fonts # private-tmp # noexec /home # noexec /tmp # shell none # seccomp # caps.drop all # net none # noroot # nogroups # ipc-namespace</options>
		<paths>${DOWNLOADS} # ${HOME}/Documents # ${HOME}/.config/ardour4 # ${HOME}/.config/ardour5 # ${HOME}/.lv2 # ${HOME}/.vst</paths>
	</application>

	<application>
		<name>torbrowser-launcher</name>
		<aliases>start-tor-browser</aliases>
		<mode>whitelist</mode>
		<options>blacklist /usr/local/bin # blacklist /boot # blacklist /media # blacklist /mnt # blacklist /opt # private-bin bash,grep,sed,tail,torbrowser-launcher,python,env,gpg,id,readlink,dirname,test,mkdir,ln,sed,cp,rm,zenity,kdialog,xmessage,gxmessage,getconf,file,expr # whitelist /dev/dri # whitelist /dev/full # whitelist /dev/null # whitelist /dev/ptmx # whitelist /dev/pts # whitelist /dev/random # whitelist /dev/shm # whitelist /dev/snd # whitelist /dev/tty # whitelist /dev/urandom # whitelist /dev/video0 # whitelist /dev/zero # private-etc X11,alternatives,pulse,resolv.conf,fonts,ssl # private-tmp # noexec /tmp # shell none # seccomp # noroot # caps.drop all</options>
		<paths>${DOWNLOADS} # ${HOME}/.local/share/torbrowser # ${HOME}/.config/torbrowser # ${HOME}/.cache/torbrowser</paths>
	</application>

	<application>
		<name>xiphos</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nogroups # nonewprivs # noroot # nosound # protocol unix,inet,inet6 # seccomp # shell none # tracelog # private-bin xiphos # private-etc fonts,resolv.conf,sword # private-dev # private-tmp</options>
		<paths>${HOME}/.sword # ${HOME}/.xiphos</paths>
	</application>

	<application>
		<name>display</name>
		<mode>blacklist</mode>
		<options>caps.drop all # seccomp # protocol unix # netfilter # net none # nonewprivs # noroot # nogroups # nosound # shell none # x11 xorg # private-bin display  # private-tmp # private-dev # private-etc none # </options>
	</application>

	<application>
		<name>wire</name>
		<aliases>Wire</aliases>
		<mode>blacklist</mode>
		<options>caps.drop all # netfilter # nonewprivs # nogroups # noroot # protocol unix,inet,inet6,netlink # seccomp # shell none # private-tmp # private-dev</options>
		<paths>${DOWNLOADS} # ${HOME}/.config/Wire # ${HOME}/.config/wire</paths>
	</application>

	<application>
		<name>zoom</name>
		<mode>whitelist</mode>
		<options>caps.drop all # netfilter # nonewprivs # noroot # protocol unix,inet,inet6 # seccomp # private-tmp</options>
		<paths>${HOME}/.zoom</paths>
		<files>${HOME}/.config/zoomus.conf</files>
	</application>

</applications>

                    GNU GENERAL PUBLIC LICENSE
                       Version 2, June 1991

 Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

                            Preamble

  The licenses for most software are designed to take away your
freedom to share and change it.  By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users.  This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it.  (Some other Free Software Foundation software is covered by
the GNU Lesser General Public License instead.)  You can apply it to
your programs, too.

  When we speak of free software, we are referring to freedom, not
price.  Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.

  To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.

  For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have.  You must make sure that they, too, receive or can get the
source code.  And you must show them these terms so they know their
rights.

  We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.

  Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software.  If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.

  Finally, any free program is threatened constantly by software
patents.  We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary.  To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.

  The precise terms and conditions for copying, distribution and
modification follow.

                    GNU GENERAL PUBLIC LICENSE
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

  0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License.  The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language.  (Hereinafter, translation is included without limitation in
the term "modification".)  Each licensee is addressed as "you".

Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope.  The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.

  1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.

You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.

  2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:

    a) You must cause the modified files to carry prominent notices
    stating that you changed the files and the date of any change.

    b) You must cause any work that you distribute or publish, that in
    whole or in part contains or is derived from the Program or any
    part thereof, to be licensed as a whole at no charge to all third
    parties under the terms of this License.

    c) If the modified program normally reads commands interactively
    when run, you must cause it, when started running for such
    interactive use in the most ordinary way, to print or display an
    announcement including an appropriate copyright notice and a
    notice that there is no warranty (or else, saying that you provide
    a warranty) and that users may redistribute the program under
    these conditions, and telling the user how to view a copy of this
    License.  (Exception: if the Program itself is interactive but
    does not normally print such an announcement, your work based on
    the Program is not required to print an announcement.)

These requirements apply to the modified work as a whole.  If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works.  But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.

Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.

In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.

  3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:

    a) Accompany it with the complete corresponding machine-readable
    source code, which must be distributed under the terms of Sections
    1 and 2 above on a medium customarily used for software interchange; or,

    b) Accompany it with a written offer, valid for at least three
    years, to give any third party, for a charge no more than your
    cost of physically performing source distribution, a complete
    machine-readable copy of the corresponding source code, to be
    distributed under the terms of Sections 1 and 2 above on a medium
    customarily used for software interchange; or,

    c) Accompany it with the information you received as to the offer
    to distribute corresponding source code.  (This alternative is
    allowed only for noncommercial distribution and only if you
    received the program in object code or executable form with such
    an offer, in accord with Subsection b above.)

The source code for a work means the preferred form of the work for
making modifications to it.  For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable.  However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.

If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.

  4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License.  Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.

  5. You are not required to accept this License, since you have not
signed it.  However, nothing else grants you permission to modify or
distribute the Program or its derivative works.  These actions are
prohibited by law if you do not accept this License.  Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.

  6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions.  You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.

  7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License.  If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all.  For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.

If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.

It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices.  Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.

This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.

  8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded.  In such case, this License incorporates
the limitation as if written in the body of this License.

  9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time.  Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.

Each version is given a distinguishing version number.  If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation.  If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.

  10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission.  For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this.  Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.

                            NO WARRANTY

  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.

  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.

                     END OF TERMS AND CONDITIONS

            How to Apply These Terms to Your New Programs

  If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.

  To do so, attach the following notices to the program.  It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.

    <one line to give the program's name and a brief idea of what it does.>
    Copyright (C) <year>  <name of author>

    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License along
    with this program; if not, write to the Free Software Foundation, Inc.,
    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

Also add information on how to contact you by electronic and paper mail.

If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:

    Gnomovision version 69, Copyright (C) year name of author
    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
    This is free software, and you are welcome to redistribute it
    under certain conditions; type `show c' for details.

The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License.  Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.

You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary.  Here is a sample; alter the names:

  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
  `Gnomovision' (which makes passes at compilers) written by James Hacker.

  <signature of Ty Coon>, 1 April 1989
  Ty Coon, President of Vice

This General Public License does not permit incorporating your program into
proprietary programs.  If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library.  If this is what you want to do, use the GNU Lesser General
Public License instead of this License.

Firejail Profile Generator
==========

Goals
------
- Increase restrictions
- Reduce work needed by hand
- Streamline profiles
- Support more programs

End Goal
--------
- For the firejail project to perform what this program does internally

Profile Credits
-------
- Most profiles by [netblue30](https://github.com/netblue30/) and [Firejail contributors](https://raw.githubusercontent.com/netblue30/firejail/master/README) from https://github.com/netblue30/firejail/tree/master/etc
- Ardour 5, Blender, Brackets, Calligra, Cinelerra, Darktable, Flowblade, Gimp, Google Earth, InkScape, Kdenlive, LinPhone, LMMS, Luminance, mpd, OpenShot, Ricochet, Scribus, Shotcut, Skype, Synfig Studio, Tor Browser Bundle, VirtualBox by chiraag-nataraj from https://github.com/chiraag-nataraj/firejail-profiles
- TeamSpeak profile by melvinvermeeren from https://aur.archlinux.org/packages/firejail-profiles
- Natron, Zart profile by [triceratops1](https://github.com/triceratops1)
- Arduino, Bless, eog, Gnome 2048, Gnome Calculator, Gnome Calendar, Gnome Characters, Gnome Clocks, Gnome Contacts, Gnome Maps, Gnome Music, Gnome Weather, JD-GUI, Lollypop, MultiMC5, Mumble, PDFSam, Pithos, Redshift, Xonotic by SpotComms

Testing
-------
- See https://github.com/SpotComms/FirejailProfileGenerator/issues/1

#
#Profile for abrowser:
#

include /etc/firejail/abrowser.profile

#
#Profile for 0ad
#

#No Blacklist Paths
noblacklist ${HOME}/.cache/0ad
noblacklist ${HOME}/.config/0ad
noblacklist ${HOME}/.local/share/0ad

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
mkdir ${HOME}/.cache/0ad
whitelist ${HOME}/.cache/0ad
mkdir ${HOME}/.config/0ad
whitelist ${HOME}/.config/0ad
mkdir ${HOME}/.local/share/0ad
whitelist ${HOME}/.local/share/0ad
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
private-dev
private-tmp
protocol unix,inet,inet6
seccomp
shell none
tracelog

#
#Profile for generic-compression:7z
#

include /etc/firejail/generic-compression.profile

#
#Profile for cyberfox:Cyberfox
#

include /etc/firejail/cyberfox.profile

#
#Profile for Mathematica
#

#No Blacklist Paths
noblacklist ${HOME}/.Mathematica
noblacklist ${HOME}/.Wolfram Research
noblacklist ${HOME}/Documents/Wolfram Mathematica

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
mkdir ${HOME}/.Mathematica
whitelist ${HOME}/.Mathematica
mkdir ${HOME}/.Wolfram Research
whitelist ${HOME}/.Wolfram Research
mkdir ${HOME}/Documents/Wolfram Mathematica
whitelist ${HOME}/Documents/Wolfram Mathematica
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
nonewprivs
noroot
seccomp

#
#Profile for telegram:Telegram
#

include /etc/firejail/telegram.profile

#
#Profile for wire:Wire
#

include /etc/firejail/wire.profile

#
#Profile for abrowser
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/mozilla
noblacklist ${HOME}/.mozilla
noblacklist ${HOME}/.pki

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.cache/mozilla
whitelist ${HOME}/.cache/mozilla
mkdir ${HOME}/.mozilla
whitelist ${HOME}/.mozilla
mkdir ${HOME}/.pki
whitelist ${HOME}/.pki
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6,netlink
seccomp
tracelog

#
#Profile for ardour5:ardour4
#

include /etc/firejail/ardour5.profile

#
#Profile for ardour5
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.config/ardour4
noblacklist ${HOME}/.config/ardour5
noblacklist ${HOME}/.lv2
noblacklist ${HOME}/.vst
noblacklist ${HOME}/Documents

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.config/ardour4
whitelist ${HOME}/.config/ardour4
mkdir ${HOME}/.config/ardour5
whitelist ${HOME}/.config/ardour5
mkdir ${HOME}/.lv2
whitelist ${HOME}/.lv2
mkdir ${HOME}/.vst
whitelist ${HOME}/.vst
mkdir ${HOME}/Documents
whitelist ${HOME}/Documents
include /etc/firejail/whitelist-common.inc

#Options
blacklist /boot
blacklist /media
blacklist /mnt
blacklist /opt
blacklist /usr/local/bin
caps.drop all
ipc-namespace
net none
noexec /home
noexec /tmp
nogroups
noroot
private-bin sh,ardour5,ardour5-copy-mixer,ardour5-export,ardour5-fix_bbtppq,grep,sed,ldd,nm
private-dev
private-etc pulse,X11,alternatives,ardour4,ardour5,fonts
private-tmp
seccomp
shell none

#
#Profile for arduino
#

#No Blacklist Paths
noblacklist ${HOME}/.arduino15
noblacklist ${HOME}/Arduino

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
mkdir ${HOME}/.arduino15
whitelist ${HOME}/.arduino15
mkdir ${HOME}/Arduino
whitelist ${HOME}/Arduino
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for atom:atom-beta
#

include /etc/firejail/atom.profile

#
#Profile for atom
#

#No Blacklist Paths
noblacklist ${HOME}/.atom
noblacklist ${HOME}/.config/Atom

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
nosound
private-dev
private-tmp
protocol unix,inet,inet6,netlink
seccomp
shell none

#
#Profile for atril
#

#No Blacklist Paths
noblacklist ${HOME}/.config/atril

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
nogroups
nonewprivs
noroot
nosound
private-bin atril, atril-previewer, atril-thumbnailer
private-dev
private-tmp
protocol unix
seccomp
shell none
tracelog

#
#Profile for generic-5:audacious
#

include /etc/firejail/generic-5.profile

#
#Profile for audacity
#

#No Blacklist Paths
noblacklist ${HOME}/.audacity-data

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
private-bin audacity
private-dev
private-tmp
protocol unix
seccomp
shell none
tracelog

#
#Profile for aweather
#

#No Blacklist Paths
noblacklist ${HOME}/.config/aweather

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
mkdir ${HOME}/.config/aweather
whitelist ${HOME}/.config/aweather
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
nosound
private-bin aweather
private-dev
private-tmp
protocol unix,inet,inet6
seccomp
shell none
tracelog

#
#Profile for bitlbee
#

#No Blacklist Explicit Paths
noblacklist /sbin
noblacklist /usr/sbin

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
netfilter
nonewprivs
nosound
private
private-dev
protocol unix,inet,inet6
read-write /var/lib/bitlbee
seccomp

#
#Profile for blender
#

#No Blacklist Paths
noblacklist ${HOME}/.config/blender

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
ipc-namespace
net none
noexec /home
noexec /tmp
nogroups
noroot
private-bin blender
private-dev
private-etc pulse
seccomp
shell none

#
#Profile for bless
#

#No Blacklist Paths
noblacklist ${HOME}/.config/bless

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for brackets
#

#No Blacklist Explicit Paths
noblacklist /opt/brackets
noblacklist /opt/google

#No Blacklist Paths
noblacklist ${HOME}/.config/Brackets

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
private-bin bash,brackets,readlink,dirname,google-chrome,cat
private-dev

#
#Profile for brave
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.config/brave

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.config/brave
whitelist ${HOME}/.config/brave
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6,netlink
seccomp

#
#Profile for calligra
#

#No Blacklist Explicit Paths
noblacklist /tmp/dbus_session_socket

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
ipc-namespace
net none
noexec /home
noexec /tmp
nogroups
noroot
private-bin calligra,calligraauthor,calligraconverter,calligraflow,calligraplan,calligraplanwork,calligrasheets,calligrastage,calligrawords,dbus-launch
private-dev
private-etc fonts,passwd,alternatives,X11
seccomp
shell none

#
#Profile for calligra:calligraauthor
#

include /etc/firejail/calligra.profile

#
#Profile for calligra:calligraconverter
#

include /etc/firejail/calligra.profile

#
#Profile for calligra:calligraflow
#

include /etc/firejail/calligra.profile

#
#Profile for calligra:calligraplan
#

include /etc/firejail/calligra.profile

#
#Profile for calligra:calligraplanwork
#

include /etc/firejail/calligra.profile

#
#Profile for calligra:calligrasheets
#

include /etc/firejail/calligra.profile

#
#Profile for calligra:calligrastage
#

include /etc/firejail/calligra.profile

#
#Profile for calligra:calligrawords
#

include /etc/firejail/calligra.profile

#
#Profile for cherrytree
#

#No Blacklist Explicit Paths
noblacklist /usr/bin/python2*
noblacklist /usr/bin/python3*

#No Blacklist Paths
noblacklist ${HOME}/.config/cherrytree

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
nosound
protocol unix,inet,inet6,netlink
seccomp
tracelog

#
#Profile for chromium:chromium-browser
#

include /etc/firejail/chromium.profile

#
#Profile for chromium-dev
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/chromium-dev
noblacklist ${HOME}/.config/chromium-dev
noblacklist ${HOME}/.pki
noblacklist ${HOME}/.config/chromium-flags.conf

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.cache/chromium-dev
whitelist ${HOME}/.cache/chromium-dev
mkdir ${HOME}/.config/chromium-dev
whitelist ${HOME}/.config/chromium-dev
mkdir ${HOME}/.pki
whitelist ${HOME}/.pki
mkfile ${HOME}/.config/chromium-flags.conf
whitelist ${HOME}/.config/chromium-flags.conf
include /etc/firejail/whitelist-common.inc

#Options
netfilter

#
#Profile for chromium
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/chromium
noblacklist ${HOME}/.config/chromium
noblacklist ${HOME}/.pki
noblacklist ${HOME}/.config/chromium-flags.conf

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.cache/chromium
whitelist ${HOME}/.cache/chromium
mkdir ${HOME}/.config/chromium
whitelist ${HOME}/.config/chromium
mkdir ${HOME}/.pki
whitelist ${HOME}/.pki
mkfile ${HOME}/.config/chromium-flags.conf
whitelist ${HOME}/.config/chromium-flags.conf
include /etc/firejail/whitelist-common.inc

#Options
netfilter

#
#Profile for cin
#

#No Blacklist Paths
noblacklist ${HOME}/.bcast5

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
ipc-namespace
net none
noexec /home
noexec /tmp
nogroups
noroot
private-bin cin
private-dev
private-etc fonts,pulse
seccomp
shell none

#
#Profile for claws-mail
#

#No Blacklist Explicit Paths
noblacklist ${HOME}/.gnupg
noblacklist ${HOME}/.signature

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.claws-mail

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
nosound
private-dev
private-tmp
protocol unix,inet,inet6
seccomp
shell none

#
#Profile for generic-5:clementine
#

include /etc/firejail/generic-5.profile

#
#Profile for cmus
#

#No Blacklist Paths
noblacklist ${HOME}/.config/cmus

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
private-bin cmus
private-etc group
protocol unix,inet,inet6
seccomp
shell none

#
#Profile for conkeror
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.conkeror.mozdev.org 
noblacklist ${HOME}/.pki

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.conkeror.mozdev.org 
whitelist ${HOME}/.conkeror.mozdev.org 
mkdir ${HOME}/.pki
whitelist ${HOME}/.pki
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6,netlink
seccomp
tracelog

#
#Profile for generic-5:corebird
#

include /etc/firejail/generic-5.profile

#
#Profile for cyberfox
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.8pecxstudios
noblacklist ${HOME}/.cache/8pecxstudios
noblacklist ${HOME}/.pki

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.8pecxstudios
whitelist ${HOME}/.8pecxstudios
mkdir ${HOME}/.cache/8pecxstudios
whitelist ${HOME}/.cache/8pecxstudios
mkdir ${HOME}/.pki
whitelist ${HOME}/.pki
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6,netlink
seccomp
tracelog

#
#Profile for darktable
#

#No Blacklist Paths
noblacklist ${HOME}/.cache/darktable
noblacklist ${HOME}/.config/darktable

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
ipc-namespace
net none
noexec ${HOME}
noexec /tmp
nogroups
noroot
nosound
private-bin darktable
private-dev
private-etc fonts,X11,alternatives
seccomp
shell none

#
#Profile for deadbeef
#

#No Blacklist Paths
noblacklist ${HOME}/.config/deadbeef

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for default
#

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for defaultnd
#

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for defaultw
#

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for deluge
#

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
nosound
private-dev
private-tmp
protocol unix,inet,inet6
seccomp
shell none

#
#Profile for dillo
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.dillo
noblacklist ${HOME}/.fltk

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.dillo
whitelist ${HOME}/.dillo
mkdir ${HOME}/.fltk
whitelist ${HOME}/.fltk
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6
seccomp
tracelog

blacklist ${HOME}/.8pecxstudios
blacklist ${HOME}/.FBReader
blacklist ${HOME}/.LuminanceHDR
blacklist ${HOME}/.Mathematica
blacklist ${HOME}/.Natron
blacklist ${HOME}/.Skype
blacklist ${HOME}/.TelegramDesktop
blacklist ${HOME}/.VirtualBox
blacklist ${HOME}/.Wolfram Research
blacklist ${HOME}/.arduino15
blacklist ${HOME}/.atom
blacklist ${HOME}/.audacity-data
blacklist ${HOME}/.bcast5
blacklist ${HOME}/.cache/0ad
blacklist ${HOME}/.cache/8pecxstudios
blacklist ${HOME}/.cache/Franz
blacklist ${HOME}/.cache/INRIA
blacklist ${HOME}/.cache/QuiteRss
blacklist ${HOME}/.cache/champlain
blacklist ${HOME}/.cache/chromium
blacklist ${HOME}/.cache/chromium-dev
blacklist ${HOME}/.cache/darktable
blacklist ${HOME}/.cache/epiphany
blacklist ${HOME}/.cache/evolution
blacklist ${HOME}/.cache/gajim
blacklist ${HOME}/.cache/google-chrome
blacklist ${HOME}/.cache/google-chrome-beta
blacklist ${HOME}/.cache/google-chrome-unstable
blacklist ${HOME}/.cache/icedove
blacklist ${HOME}/.cache/inox
blacklist ${HOME}/.cache/libgweather
blacklist ${HOME}/.cache/midori
blacklist ${HOME}/.cache/moonchild productions
blacklist ${HOME}/.cache/mozilla
blacklist ${HOME}/.cache/mutt
blacklist ${HOME}/.cache/netsurf
blacklist ${HOME}/.cache/opera
blacklist ${HOME}/.cache/opera-beta
blacklist ${HOME}/.cache/qutebrowser
blacklist ${HOME}/.cache/slimjet
blacklist ${HOME}/.cache/spotify
blacklist ${HOME}/.cache/telepathy
blacklist ${HOME}/.cache/thunderbird
blacklist ${HOME}/.cache/torbrowser
blacklist ${HOME}/.cache/transmission
blacklist ${HOME}/.cache/vivaldi
blacklist ${HOME}/.cache/wesnoth
blacklist ${HOME}/.cache/xreader
blacklist ${HOME}/.claws-mail
blacklist ${HOME}/.config/0ad
blacklist ${HOME}/.config/Atom
blacklist ${HOME}/.config/Brackets
blacklist ${HOME}/.config/Franz
blacklist ${HOME}/.config/Gitter
blacklist ${HOME}/.config/Google
blacklist ${HOME}/.config/Google Play Music Desktop Player
blacklist ${HOME}/.config/Gpredict
blacklist ${HOME}/.config/INRIA
blacklist ${HOME}/.config/Luminance
blacklist ${HOME}/.config/Meltytech
blacklist ${HOME}/.config/Mumble
blacklist ${HOME}/.config/QuiteRss
blacklist ${HOME}/.config/QuiteRssrc
blacklist ${HOME}/.config/Slack
blacklist ${HOME}/.config/VirtualBox
blacklist ${HOME}/.config/Wire
blacklist ${HOME}/.config/ardour4
blacklist ${HOME}/.config/ardour5
blacklist ${HOME}/.config/atril
blacklist ${HOME}/.config/autostart
blacklist ${HOME}/.config/autostart/dropbox.desktop
blacklist ${HOME}/.config/aweather
blacklist ${HOME}/.config/blender
blacklist ${HOME}/.config/bless
blacklist ${HOME}/.config/brave
blacklist ${HOME}/.config/cherrytree
blacklist ${HOME}/.config/chromium
blacklist ${HOME}/.config/chromium-dev
blacklist ${HOME}/.config/chromium-flags.conf
blacklist ${HOME}/.config/cmus
blacklist ${HOME}/.config/darktable
blacklist ${HOME}/.config/deadbeef
blacklist ${HOME}/.config/eog
blacklist ${HOME}/.config/epiphany
blacklist ${HOME}/.config/evolution
blacklist ${HOME}/.config/filezilla
blacklist ${HOME}/.config/flowblade
blacklist ${HOME}/.config/gajim
blacklist ${HOME}/.config/google-chrome
blacklist ${HOME}/.config/google-chrome-beta
blacklist ${HOME}/.config/google-chrome-unstable
blacklist ${HOME}/.config/gthumb
blacklist ${HOME}/.config/hexchat
blacklist ${HOME}/.config/inox
blacklist ${HOME}/.config/jd-gui.cfg
blacklist ${HOME}/.config/keepass
blacklist ${HOME}/.config/keepassx
blacklist ${HOME}/.config/libreoffice
blacklist ${HOME}/.config/mate/eom
blacklist ${HOME}/.config/midori
blacklist ${HOME}/.config/mpv
blacklist ${HOME}/.config/mupen64plus
blacklist ${HOME}/.config/netsurf
blacklist ${HOME}/.config/opera
blacklist ${HOME}/.config/opera-beta
blacklist ${HOME}/.config/pix
blacklist ${HOME}/.config/psi+
blacklist ${HOME}/.config/qpdfview
blacklist ${HOME}/.config/qutebrowser
blacklist ${HOME}/.config/redshift.conf
blacklist ${HOME}/.config/skypeforlinux
blacklist ${HOME}/.config/slimjet
blacklist ${HOME}/.config/spotify
blacklist ${HOME}/.config/stellarium
blacklist ${HOME}/.config/telepathy-account-widgets
blacklist ${HOME}/.config/torbrowser
blacklist ${HOME}/.config/totem
blacklist ${HOME}/.config/tox
blacklist ${HOME}/.config/transmission
blacklist ${HOME}/.config/uGet
blacklist ${HOME}/.config/vivaldi
blacklist ${HOME}/.config/vlc
blacklist ${HOME}/.config/wesnoth
blacklist ${HOME}/.config/wire
blacklist ${HOME}/.config/xchat
blacklist ${HOME}/.config/xplayer
blacklist ${HOME}/.config/xreader
blacklist ${HOME}/.config/xviewer
blacklist ${HOME}/.config/zathura
blacklist ${HOME}/.config/zoomus.conf
blacklist ${HOME}/.conkeror.mozdev.org 
blacklist ${HOME}/.dillo
blacklist ${HOME}/.dosbox
blacklist ${HOME}/.dropbox-dist
blacklist ${HOME}/.filezilla
blacklist ${HOME}/.flowblade
blacklist ${HOME}/.fltk
blacklist ${HOME}/.gimp*
blacklist ${HOME}/.gnupg
blacklist ${HOME}/.googleearth/Cache/
blacklist ${HOME}/.googleearth/Temp/
blacklist ${HOME}/.googleearth/myplaces.backup.kml
blacklist ${HOME}/.googleearth/myplaces.kml
blacklist ${HOME}/.hedgewars
blacklist ${HOME}/.icedove
blacklist ${HOME}/.inkscape
blacklist ${HOME}/.jitsi
blacklist ${HOME}/.kde/share/apps/gwenview
blacklist ${HOME}/.kde/share/apps/okular
blacklist ${HOME}/.kde/share/config/gwenviewrc
blacklist ${HOME}/.kde/share/config/okularpartrc
blacklist ${HOME}/.kde/share/config/okularrc
blacklist ${HOME}/.keepass
blacklist ${HOME}/.keepassx
blacklist ${HOME}/.killingfloor
blacklist ${HOME}/.linphone-history.db
blacklist ${HOME}/.linphonerc
blacklist ${HOME}/.lmmsrc.xml
blacklist ${HOME}/.local/.share/maps-places.json
blacklist ${HOME}/.local/lib/python2.7/site-packages
blacklist ${HOME}/.local/share/0ad
blacklist ${HOME}/.local/share/3909/PapersPlease
blacklist ${HOME}/.local/share/Empathy
blacklist ${HOME}/.local/share/Mumble
blacklist ${HOME}/.local/share/QuiteRss
blacklist ${HOME}/.local/share/Ricochet
blacklist ${HOME}/.local/share/Steam
blacklist ${HOME}/.local/share/SuperHexagon
blacklist ${HOME}/.local/share/Terraria
blacklist ${HOME}/.local/share/TpLogger
blacklist ${HOME}/.local/share/aspyr-media
blacklist ${HOME}/.local/share/cdprojektred
blacklist ${HOME}/.local/share/data/Mumble
blacklist ${HOME}/.local/share/epiphany
blacklist ${HOME}/.local/share/evolution
blacklist ${HOME}/.local/share/feral-interactive
blacklist ${HOME}/.local/share/gajim
blacklist ${HOME}/.local/share/gnome-2048
blacklist ${HOME}/.local/share/gnome-chess
blacklist ${HOME}/.local/share/gnome-music
blacklist ${HOME}/.local/share/lollypop
blacklist ${HOME}/.local/share/multimc5
blacklist ${HOME}/.local/share/mupen64plus
blacklist ${HOME}/.local/share/pix
blacklist ${HOME}/.local/share/psi+
blacklist ${HOME}/.local/share/qpdfview
blacklist ${HOME}/.local/share/spotify
blacklist ${HOME}/.local/share/steam
blacklist ${HOME}/.local/share/telepathy
blacklist ${HOME}/.local/share/torbrowser
blacklist ${HOME}/.local/share/totem
blacklist ${HOME}/.local/share/vpltd
blacklist ${HOME}/.local/share/vulkan
blacklist ${HOME}/.local/share/wesnoth
blacklist ${HOME}/.local/share/xplayer
blacklist ${HOME}/.local/share/xreader
blacklist ${HOME}/.local/share/zathura
blacklist ${HOME}/.lv2
blacklist ${HOME}/.mcabber
blacklist ${HOME}/.mcabberrc
blacklist ${HOME}/.moonchild productions
blacklist ${HOME}/.mozilla
blacklist ${HOME}/.mozilla/seamonkey
blacklist ${HOME}/.mpdconf
blacklist ${HOME}/.multimc5
blacklist ${HOME}/.mutt
blacklist ${HOME}/.muttrc
blacklist ${HOME}/.nv
blacklist ${HOME}/.openshot
blacklist ${HOME}/.openshot_qt
blacklist ${HOME}/.opera
blacklist ${HOME}/.opera-beta
blacklist ${HOME}/.pki
blacklist ${HOME}/.pki 
blacklist ${HOME}/.purple
blacklist ${HOME}/.scribus
blacklist ${HOME}/.ssh
blacklist ${HOME}/.steam
blacklist ${HOME}/.steampath
blacklist ${HOME}/.steampid
blacklist ${HOME}/.stellarium
blacklist ${HOME}/.sword
blacklist ${HOME}/.synfig
blacklist ${HOME}/.thunderbird
blacklist ${HOME}/.ts3client
blacklist ${HOME}/.vst
blacklist ${HOME}/.warzone2100-3.1
blacklist ${HOME}/.weechat
blacklist ${HOME}/.wine
blacklist ${HOME}/.wine64
blacklist ${HOME}/.xiphos
blacklist ${HOME}/.xonotic
blacklist ${HOME}/.xpdfrc
blacklist ${HOME}/.zoom
blacklist ${HOME}/Arduino
blacklist ${HOME}/Documents/Wolfram Mathematica
blacklist ${HOME}/Dropbox
blacklist ${HOME}/My Games
blacklist ${HOME}/VirtualBox VMs
blacklist ${HOME}/quiterssfeeds.opml
blacklist ${HOME}/snap
blacklist /tmp/ssh-*
blacklist ${HOME}/.*coin
blacklist ${HOME}/.electrum*
blacklist ${HOME}/.gitconfig
blacklist ${HOME}/.git-credential-cache
blacklist ${HOME}/.msmtprc
blacklist ${HOME}/.mutt/muttrc
blacklist ${HOME}/.muttrc
blacklist ${HOME}/.retroshare
blacklist ${HOME}/.subversion
blacklist ${HOME}/.sylpheed-2.0
blacklist ${HOME}/.tconn
blacklist ${HOME}/wallet.dat
blacklist /tmp/ssh-*

#
#Profile for display
#

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
net none
netfilter
nogroups
nonewprivs
noroot
nosound
private-bin display 
private-dev
private-etc none
private-tmp
protocol unix
seccomp
shell none
x11 xorg

#
#Profile for dnscrypt-proxy
#

#No Blacklist Explicit Paths
noblacklist /sbin
noblacklist /usr/sbin

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
no3d
nosound
private
private-dev
seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open

#
#Profile for dnsmasq
#

#No Blacklist Explicit Paths
noblacklist /sbin
noblacklist /usr/sbin

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps
netfilter
no3d
nonewprivs
nosound
private
private-dev
protocol unix,inet,inet6,netlink
seccomp

#
#Profile for dosbox
#

#No Blacklist Paths
noblacklist ${HOME}/.dosbox

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
private-bin dosbox
private-dev
private-tmp
protocol unix,inet,inet6
seccomp
shell none
tracelog

#
#Profile for dropbox
#

#No Blacklist Paths
noblacklist ${HOME}/.config/autostart
noblacklist ${HOME}/.dropbox-dist
noblacklist ${HOME}/Dropbox
noblacklist ${HOME}/.config/autostart/dropbox.desktop

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
mkdir ${HOME}/.config/autostart
whitelist ${HOME}/.config/autostart
mkdir ${HOME}/.dropbox-dist
whitelist ${HOME}/.dropbox-dist
mkdir ${HOME}/Dropbox
whitelist ${HOME}/Dropbox
mkfile ${HOME}/.config/autostart/dropbox.desktop
whitelist ${HOME}/.config/autostart/dropbox.desktop
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for empathy
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/champlain
noblacklist ${HOME}/.cache/telepathy
noblacklist ${HOME}/.config/telepathy-account-widgets
noblacklist ${HOME}/.local/share/Empathy
noblacklist ${HOME}/.local/share/TpLogger
noblacklist ${HOME}/.local/share/telepathy
noblacklist ${HOME}/.purple

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.cache/champlain
whitelist ${HOME}/.cache/champlain
mkdir ${HOME}/.cache/telepathy
whitelist ${HOME}/.cache/telepathy
mkdir ${HOME}/.config/telepathy-account-widgets
whitelist ${HOME}/.config/telepathy-account-widgets
mkdir ${HOME}/.local/share/Empathy
whitelist ${HOME}/.local/share/Empathy
mkdir ${HOME}/.local/share/TpLogger
whitelist ${HOME}/.local/share/TpLogger
mkdir ${HOME}/.local/share/telepathy
whitelist ${HOME}/.local/share/telepathy
mkdir ${HOME}/.purple
whitelist ${HOME}/.purple
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
nogroups
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for eog
#

#No Blacklist Paths
noblacklist ${HOME}/.cache/champlain
noblacklist ${HOME}/.config/eog

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
nosound
private-bin eog
private-dev
private-etc fonts
private-tmp
protocol unix
seccomp
shell none

#
#Profile for eom
#

#No Blacklist Paths
noblacklist ${HOME}/.config/mate/eom

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
nogroups
nonewprivs
noroot
nosound
private-bin eom
private-dev
private-tmp
protocol unix
seccomp
shell none
tracelog

#
#Profile for epiphany
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/epiphany
noblacklist ${HOME}/.config/epiphany
noblacklist ${HOME}/.local/share/epiphany

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.cache/epiphany
whitelist ${HOME}/.cache/epiphany
mkdir ${HOME}/.config/epiphany
whitelist ${HOME}/.config/epiphany
mkdir ${HOME}/.local/share/epiphany
whitelist ${HOME}/.local/share/epiphany
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
protocol unix,inet,inet6
seccomp

#
#Profile for evince
#

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
nosound
private-bin evince,evince-previewer,evince-thumbnailer
private-dev
private-etc fonts
protocol unix
seccomp
shell none
tracelog

#
#Profile for evolution
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/evolution
noblacklist ${HOME}/.config/evolution
noblacklist ${HOME}/.gnupg
noblacklist ${HOME}/.local/share/evolution
noblacklist ${HOME}/.pki

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
nosound
private-dev
private-tmp
protocol unix,inet,inet6
seccomp
shell none

#
#Profile for fbreader
#

#No Blacklist Paths
noblacklist ${HOME}/.FBReader

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
nosound
private-bin fbreader,FBReader
private-dev
private-tmp
protocol unix,inet,inet6
seccomp
shell none

#
#Profile for feh
#

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
net none
netfilter
nogroups
nonewprivs
noroot
nosound
private-bin feh
private-dev
private-etc feh
private-tmp
protocol unix
seccomp
shell none

#
#Profile for file
#

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
hostname file
net none
netfilter
no3d
nonewprivs
nosound
private-bin file
private-dev
private-etc magic.mgc,magic,localtime
private-tmp
protocol unix,inet,inet6
quiet
seccomp
shell none
tracelog

#
#Profile for filezilla
#

#No Blacklist Paths
noblacklist ${HOME}/.config/filezilla
noblacklist ${HOME}/.filezilla

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
nosound
nosound
private-bin filezilla,uname,sh,python,lsb_release,fzputtygen,fzsftp
private-dev
private-tmp
protocol unix,inet,inet6
seccomp
shell none

#
#Profile for firefox:firefox-esr
#

include /etc/firejail/firefox.profile

#
#Profile for firefox
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/mozilla
noblacklist ${HOME}/.mozilla
noblacklist ${HOME}/.pki

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.cache/mozilla
whitelist ${HOME}/.cache/mozilla
mkdir ${HOME}/.mozilla
whitelist ${HOME}/.mozilla
mkdir ${HOME}/.pki
whitelist ${HOME}/.pki
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
private-dev
private-tmp
protocol unix,inet,inet6,netlink
seccomp
tracelog

#
#Profile for flowblade
#

#No Blacklist Paths
noblacklist ${HOME}/.config/flowblade
noblacklist ${HOME}/.flowblade

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
ipc-namespace
net none
noexec /home
noexec /tmp
nogroups
nonewprivs
noroot
private-bin python,flowblade
private-dev
private-etc pulse,fonts,alternatives,X11
seccomp
shell none

#
#Profile for franz
#

#No Blacklist Paths
noblacklist ${HOME}/.cache/Franz
noblacklist ${HOME}/.config/Franz
noblacklist ${HOME}/.pki

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
#tracelog
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6,netlink
seccomp

#
#Profile for gajim
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/gajim
noblacklist ${HOME}/.config/gajim
noblacklist ${HOME}/.local/lib/python2.7/site-packages
noblacklist ${HOME}/.local/share/gajim

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.cache/gajim
whitelist ${HOME}/.cache/gajim
mkdir ${HOME}/.config/gajim
whitelist ${HOME}/.config/gajim
mkdir ${HOME}/.local/lib/python2.7/site-packages
whitelist ${HOME}/.local/lib/python2.7/site-packages
mkdir ${HOME}/.local/share/gajim
whitelist ${HOME}/.local/share/gajim
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
private-dev
protocol unix,inet,inet6
read-only ${HOME}/.local/lib/python2.7/site-packages
seccomp
shell none

#
#Profile for generic-13
#

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
net none
netfilter
nonewprivs
noroot
nosound
private-dev
protocol unix,inet,inet6
quiet
seccomp
shell none
tracelog

#
#Profile for generic-5
#

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for generic-compression
#

#No Blacklist Explicit Paths
noblacklist /sbin
noblacklist /usr/sbin

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
hostname tar
net none
netfilter
no3d
nonewprivs
nosound
private-bin sh,tar,gtar,compress,gzip,lzma,xz,bzip2,lbzip2,lzip,lzop,unrar,unzip,xzdec,7z
private-dev
private-etc passwd,group,localtime
protocol unix,inet,inet6
quiet
seccomp
shell none
tracelog

#
#Profile for gimp
#

#No Blacklist Paths
noblacklist ${HOME}/.gimp*

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc

#Options
caps.drop all
netfilter
noexec ${HOME}
noexec /tmp
nogroups
nonewprivs
noroot
nosound
private-dev
private-tmp
protocol unix
seccomp

#
#Profile for git
#

#No Blacklist Explicit Paths
noblacklist ${HOME}/.gitconfig
noblacklist ${HOME}/.gnupg
noblacklist ${HOME}/.ssh

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
nosound
private-dev
protocol unix,inet,inet6
quiet
seccomp
shell none

#
#Profile for gitter
#

#No Blacklist Paths
noblacklist ${HOME}/.config/Gitter

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
nosound
private-bin gitter
private-dev
private-tmp
protocol unix,inet,inet6,netlink
seccomp
shell none

#
#Profile for gnome-2048
#

#No Blacklist Paths
noblacklist ${HOME}/.local/share/gnome-2048

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
mkdir ${HOME}/.local/share/gnome-2048
whitelist ${HOME}/.local/share/gnome-2048
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for defaultw:gnome-calculator
#

include /etc/firejail/defaultw.profile

#
#Profile for defaultw:gnome-calendar
#

include /etc/firejail/defaultw.profile

#
#Profile for defaultw:gnome-characters
#

include /etc/firejail/defaultw.profile

#
#Profile for gnome-chess
#

#No Blacklist Paths
noblacklist ${HOME}/.local/share/gnome-chess

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
nogroups
nonewprivs
noroot
nosound
private-bin fairymax,gnome-chess,hoichess
private-dev
private-etc fonts,gnome-chess
private-tmp
protocol unix
seccomp
shell none
tracelog

#
#Profile for defaultw:gnome-clocks
#

include /etc/firejail/defaultw.profile

#
#Profile for defaultw:gnome-contacts
#

include /etc/firejail/defaultw.profile

#
#Profile for gnome-maps
#

#No Blacklist Paths
noblacklist ${HOME}/.cache/champlain
noblacklist ${HOME}/.local/.share/maps-places.json

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for gnome-mplayer
#

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
nogroups
nonewprivs
noroot
private-bin gnome-mplayer
private-dev
private-tmp
protocol unix,inet,inet6
seccomp
shell none

#
#Profile for gnome-music
#

#No Blacklist Paths
noblacklist ${HOME}/.local/share/gnome-music

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for gnome-weather
#

#No Blacklist Paths
noblacklist ${HOME}/.cache/libgweather

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
mkdir ${HOME}/.cache/libgweather
whitelist ${HOME}/.cache/libgweather
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for google-chrome-beta
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/google-chrome-beta
noblacklist ${HOME}/.config/google-chrome-beta
noblacklist ${HOME}/.pki

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.cache/google-chrome-beta
whitelist ${HOME}/.cache/google-chrome-beta
mkdir ${HOME}/.config/google-chrome-beta
whitelist ${HOME}/.config/google-chrome-beta
mkdir ${HOME}/.pki
whitelist ${HOME}/.pki
include /etc/firejail/whitelist-common.inc

#Options
netfilter

#
#Profile for google-chrome:google-chrome-stable
#

include /etc/firejail/google-chrome.profile

#
#Profile for google-chrome-unstable
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/google-chrome-unstable
noblacklist ${HOME}/.config/google-chrome-unstable
noblacklist ${HOME}/.pki

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.cache/google-chrome-unstable
whitelist ${HOME}/.cache/google-chrome-unstable
mkdir ${HOME}/.config/google-chrome-unstable
whitelist ${HOME}/.config/google-chrome-unstable
mkdir ${HOME}/.pki
whitelist ${HOME}/.pki
include /etc/firejail/whitelist-common.inc

#Options
netfilter

#
#Profile for google-chrome
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/google-chrome
noblacklist ${HOME}/.config/google-chrome
noblacklist ${HOME}/.pki

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.cache/google-chrome
whitelist ${HOME}/.cache/google-chrome
mkdir ${HOME}/.config/google-chrome
whitelist ${HOME}/.config/google-chrome
mkdir ${HOME}/.pki
whitelist ${HOME}/.pki
include /etc/firejail/whitelist-common.inc

#Options
netfilter

#
#Profile for google-earth
#

#No Blacklist Paths
noblacklist ${HOME}/.config/Google
noblacklist ${HOME}/.googleearth/Cache/
noblacklist ${HOME}/.googleearth/Temp/
noblacklist ${HOME}/.googleearth/myplaces.backup.kml
noblacklist ${HOME}/.googleearth/myplaces.kml

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
mkdir ${HOME}/.config/Google
whitelist ${HOME}/.config/Google
mkdir ${HOME}/.googleearth/Cache/
whitelist ${HOME}/.googleearth/Cache/
mkdir ${HOME}/.googleearth/Temp/
whitelist ${HOME}/.googleearth/Temp/
mkfile ${HOME}/.googleearth/myplaces.backup.kml
whitelist ${HOME}/.googleearth/myplaces.backup.kml
mkfile ${HOME}/.googleearth/myplaces.kml
whitelist ${HOME}/.googleearth/myplaces.kml
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
ipc-namespace
noexec /home
noexec /tmp
nogroups
noroot
private-bin google-earth,sh,grep,sed,ls,dirname
private-dev
private-etc fonts,resolv.conf,X11,alternatives,pulse
seccomp
shell none

#
#Profile for google-play-music-desktop-player
#

#No Blacklist Paths
noblacklist ${HOME}/.config/Google Play Music Desktop Player

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
mkdir ${HOME}/.config/Google Play Music Desktop Player
whitelist ${HOME}/.config/Google Play Music Desktop Player
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6,netlink
seccomp

#
#Profile for gpredict
#

#No Blacklist Paths
noblacklist ${HOME}/.config/Gpredict

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
mkdir ${HOME}/.config/Gpredict
whitelist ${HOME}/.config/Gpredict
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
nosound
private-bin gpredict
private-dev
private-etc fonts,resolv.conf
private-tmp
protocol unix,inet,inet6
seccomp
shell none
tracelog

#
#Profile for generic-compression:gtar
#

include /etc/firejail/generic-compression.profile

#
#Profile for gthumb
#

#No Blacklist Paths
noblacklist ${HOME}/.config/gthumb

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
nogroups
nonewprivs
noroot
nosound
private-bin gthumb
private-dev
private-tmp
protocol unix
seccomp
shell none
tracelog

#
#Profile for gwenview
#

#No Blacklist Paths
noblacklist ${HOME}/.kde/share/apps/gwenview
noblacklist ${HOME}/.kde/share/config/gwenviewrc

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
nogroups
nonewprivs
noroot
nosound
private-dev
protocol unix
seccomp

#
#Profile for generic-compression:gzip
#

include /etc/firejail/generic-compression.profile

#
#Profile for hedgewars
#

#No Blacklist Paths
noblacklist ${HOME}/.hedgewars

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
mkdir ${HOME}/.hedgewars
whitelist ${HOME}/.hedgewars
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
private-dev
private-tmp
seccomp
tracelog

#
#Profile for hexchat
#

#No Blacklist Paths
noblacklist ${HOME}/.config/hexchat

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
mkdir ${HOME}/.config/hexchat
whitelist ${HOME}/.config/hexchat
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
nosound
private-bin hexchat
private-dev
private-tmp
protocol unix,inet,inet6
seccomp
shell none
tracelog

#
#Profile for icecat:icecat-launcher
#

include /etc/firejail/icecat.profile

#
#Profile for icecat
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/mozilla
noblacklist ${HOME}/.mozilla
noblacklist ${HOME}/.pki 

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.cache/mozilla
whitelist ${HOME}/.cache/mozilla
mkdir ${HOME}/.mozilla
whitelist ${HOME}/.mozilla
mkdir ${HOME}/.pki 
whitelist ${HOME}/.pki 
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6,netlink
seccomp
tracelog

#
#Profile for icedove
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/icedove
noblacklist ${HOME}/.cache/mozilla
noblacklist ${HOME}/.gnupg
noblacklist ${HOME}/.icedove
noblacklist ${HOME}/.mozilla
noblacklist ${HOME}/.pki

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.cache/icedove
whitelist ${HOME}/.cache/icedove
mkdir ${HOME}/.cache/mozilla
whitelist ${HOME}/.cache/mozilla
mkdir ${HOME}/.gnupg
whitelist ${HOME}/.gnupg
mkdir ${HOME}/.icedove
whitelist ${HOME}/.icedove
mkdir ${HOME}/.mozilla
whitelist ${HOME}/.mozilla
mkdir ${HOME}/.pki
whitelist ${HOME}/.pki
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6,netlink
seccomp
tracelog

#
#Profile for firefox:iceweasel
#

include /etc/firejail/firefox.profile

#
#Profile for inkscape
#

#No Blacklist Paths
noblacklist ${HOME}/.inkscape

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc

#Options
caps.drop all
netfilter
noexec ${HOME}
noexec /tmp
nogroups
nonewprivs
noroot
nosound
private-dev
private-tmp
protocol unix
seccomp

#
#Profile for inox
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.cache/inox
noblacklist ${HOME}/.config/inox
noblacklist ${HOME}/.pki

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkdir ${HOME}/.cache/inox
whitelist ${HOME}/.cache/inox
mkdir ${HOME}/.config/inox
whitelist ${HOME}/.config/inox
mkdir ${HOME}/.pki
whitelist ${HOME}/.pki
include /etc/firejail/whitelist-common.inc

#Options
netfilter

#
#Profile for jd-gui
#

noblacklist ${HOME}/.config/jd-gui.cfg

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for jitsi
#

#No Blacklist Paths
noblacklist ${HOME}/.jitsi

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
nogroups
nonewprivs
noroot
private-tmp
protocol unix,inet,inet6
seccomp
shell none
tracelog

#
#Profile for kdenlive
#

#No Blacklist Explicit Paths
noblacklist /tmp/dbus_session_socket

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
net none
nogroups
noroot
private-bin kdenlive,kdenlive_render,dbus-launch,melt,ffmpeg,ffplay,ffprobe,dvdauthor,genisoimage,vlc,xine,kdeinit5,kshell5,kdeinit5_shutdown,kdeinit5_wrapper,kdeinit4,kshell4,kdeinit4_shutdown,kdeinit4_wrapper
private-dev
private-etc fonts,alternatives,X11,pulse,passwd
seccomp
shell none

#
#Profile for keepass
#

#No Blacklist Paths
noblacklist ${HOME}/.config/keepass
noblacklist ${HOME}/.keepass

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
nosound
private-dev
private-tmp
protocol unix,inet,inet6
seccomp
shell none

#
#Profile for keepassx
#

#No Blacklist Paths
noblacklist ${HOME}/.config/keepassx
noblacklist ${HOME}/.keepassx

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
nosound
private-dev 
private-tmp
protocol unix
seccomp
shell none

#
#Profile for keepassx:keepassx2
#

include /etc/firejail/keepassx.profile

#
#Profile for kmail
#

#No Blacklist Paths
noblacklist ${HOME}/.gnupg

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nogroups
nonewprivs
noroot
private-dev
protocol unix,inet,inet6,netlink
seccomp
tracelog

#
#Profile for konversation
#

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nogroups
noroot
private-tmp
protocol unix,inet,inet6
seccomp

#
#Profile for generic-13:less
#

include /etc/firejail/generic-13.profile

#
#Profile for libreoffice
#

#No Blacklist Explicit Paths
noblacklist /usr/local/sbin

#No Blacklist Paths
noblacklist ${HOME}/.config/libreoffice

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
net none
nogroups
nonewprivs
noroot
private-dev
protocol unix,inet,inet6
seccomp
tracelog

#
#Profile for linphone
#

#No Blacklist Paths
noblacklist ${DOWNLOADS}
noblacklist ${HOME}/.linphone-history.db
noblacklist ${HOME}/.linphonerc

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Whitelist Paths
whitelist ${DOWNLOADS}
mkfile ${HOME}/.linphone-history.db
whitelist ${HOME}/.linphone-history.db
mkfile ${HOME}/.linphonerc
whitelist ${HOME}/.linphonerc
include /etc/firejail/whitelist-common.inc

#Options
caps.drop all
noroot
seccomp

#
#Profile for lmms
#

noblacklist ${HOME}/.lmmsrc.xml

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
ipc-namespace
net none
noexec /home
noexec /tmp
nogroups
noroot
private-dev
private-etc fonts,pulse
seccomp
shell none

#
#Profile for libreoffice:localc
#

include /etc/firejail/libreoffice.profile

#
#Profile for libreoffice:lodraw
#

include /etc/firejail/libreoffice.profile

#
#Profile for libreoffice:loffice
#

include /etc/firejail/libreoffice.profile

#
#Profile for libreoffice:lofromtemplate
#

include /etc/firejail/libreoffice.profile

#
#Profile for libreoffice:loimpress
#

include /etc/firejail/libreoffice.profile

#
#Profile for lollypop
#

#No Blacklist Paths
noblacklist ${HOME}/.local/share/lollypop

#Blacklist Paths
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-devel.inc

#Options
caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6
seccomp

#
#Profile for libreoffice:lomath
#

include /etc/firejail/libreoffice.profile

#
#Profile for libreoffice:loweb
#

include /etc/firejail/libreoffice.profile