overleaf/services/filestore/firejail/convert.profile

# Convert (ImageMagick profile)

include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-mgmt.inc
include /etc/firejail/disable-secret.inc

read-only /bin
blacklist /boot
blacklist /dev
read-only /etc
read-only /home
read-only /lib
read-only /lib64
blacklist /media
blacklist /mnt
blacklist /opt
blacklist /root
read-only /run
blacklist /sbin
blacklist /selinux
blacklist /src
blacklist /sys
read-only /usr
blacklist /var

caps.drop all
noroot
nogroups
protocol unix
net none
private-tmp
private-dev
shell none
seccomp.keep access,arch_prctl,brk,chown,clone,close,dup,execve,exit_group,fcntl,fstat,futex,getcwd,getdents,getegid,geteuid,getgid,getpeername,getpgrp,getpid,getppid,getrlimit,getrusage,getuid,ioctl,lseek,mmap,mprotect,munmap,nanosleep,open,openat,prctl,read,readlink,rt_sigaction,rt_sigprocmask,sched_getaffinity,set_robust_list,set_tid_address,stat,symlink,times,uname,unlink,unshare,wait4,write,madvise

rlimit-fsize 524288000 #500Mb
rlimit-nproc 200
rlimit-nofile 100
Add convert firejail profile 2016-05-09 13:44:49 +00:00			`# Convert (ImageMagick profile)`

			`include /etc/firejail/disable-common.inc`
			`include /etc/firejail/disable-devel.inc`
			`include /etc/firejail/disable-mgmt.inc`
			`include /etc/firejail/disable-secret.inc`

			`read-only /bin`
			`blacklist /boot`
			`blacklist /dev`
			`read-only /etc`
			`read-only /home`
			`read-only /lib`
			`read-only /lib64`
			`blacklist /media`
			`blacklist /mnt`
			`blacklist /opt`
			`blacklist /root`
Tweak convert profile to work on api-2 2016-05-10 16:50:46 +00:00			`read-only /run`
Add convert firejail profile 2016-05-09 13:44:49 +00:00			`blacklist /sbin`
			`blacklist /selinux`
			`blacklist /src`
			`blacklist /sys`
			`read-only /usr`
			`blacklist /var`

			`caps.drop all`
			`noroot`
			`nogroups`
			`protocol unix`
			`net none`
			`private-tmp`
			`private-dev`
			`shell none`
Update firejail profile to allow pdf previews for templates to work 2016-05-10 13:34:48 +00:00			`seccomp.keep access,arch_prctl,brk,chown,clone,close,dup,execve,exit_group,fcntl,fstat,futex,getcwd,getdents,getegid,geteuid,getgid,getpeername,getpgrp,getpid,getppid,getrlimit,getrusage,getuid,ioctl,lseek,mmap,mprotect,munmap,nanosleep,open,openat,prctl,read,readlink,rt_sigaction,rt_sigprocmask,sched_getaffinity,set_robust_list,set_tid_address,stat,symlink,times,uname,unlink,unshare,wait4,write,madvise`
Add convert firejail profile 2016-05-09 13:44:49 +00:00
			`rlimit-fsize 524288000 #500Mb`
Update firejail profile to allow pdf previews for templates to work 2016-05-10 13:34:48 +00:00			`rlimit-nproc 200`
Add convert firejail profile 2016-05-09 13:44:49 +00:00			`rlimit-nofile 100`