mirror of
https://github.com/Cheviiot/Nivora.git
synced 2026-08-03 15:51:12 +00:00
Александр
73b5e87e95
MAX is the Russian state-affiliated messenger; the official Qt6 client is repacked from download.max.ru with no independent security track record, so it never runs unsandboxed. /usr/bin/max is a wrapper (not a symlink) that always launches through `firejail --profile=max`; the .desktop Exec goes through the same wrapper so there's no launch path that bypasses it. The profile hides the rest of the home directory behind private ~/.config, ~/.cache and ~/.local/share/max subdirectories, drops capabilities, enables seccomp, blocks system D-Bus, and blacklists the standalone crashpad_handler crash-report uploader. Full elimination of first-party telemetry isn't claimed or possible from the sandbox layer alone — documented in LICENSE. Also wires up repo-wide bookkeeping now that all three package changes (telegram-desktop -> telegram rename, vk-messenger, max) are in: README package count/catalog rows, docs/maintenance.md naming table and directory count, and tools/package_updates.sh + tools/validate_repo.py package lists.
54 lines
1.3 KiB
Plaintext
54 lines
1.3 KiB
Plaintext
# Firejail profile for MAX Messenger (Nivora package)
|
|
# MAX is a proprietary Russian messenger; this profile keeps it away from
|
|
# the rest of the user's files and system, and blocks its standalone
|
|
# crash-report uploader.
|
|
|
|
include max.local
|
|
include globals.local
|
|
|
|
noblacklist ${HOME}/.config/max
|
|
noblacklist ${HOME}/.cache/max
|
|
noblacklist ${HOME}/.local/share/max
|
|
|
|
include disable-common.inc
|
|
include disable-devel.inc
|
|
include disable-exec.inc
|
|
include disable-interpreters.inc
|
|
include disable-programs.inc
|
|
include landlock-common.inc
|
|
|
|
mkdir ${HOME}/.config/max
|
|
mkdir ${HOME}/.cache/max
|
|
mkdir ${HOME}/.local/share/max
|
|
whitelist ${HOME}/.config/max
|
|
whitelist ${HOME}/.cache/max
|
|
whitelist ${HOME}/.local/share/max
|
|
include whitelist-common.inc
|
|
include whitelist-run-common.inc
|
|
include whitelist-usr-share-common.inc
|
|
include whitelist-var-common.inc
|
|
|
|
caps.drop all
|
|
netfilter
|
|
nodvd
|
|
nogroups
|
|
nonewprivs
|
|
noroot
|
|
notv
|
|
nou2f
|
|
protocol unix,inet,inet6
|
|
seccomp
|
|
restrict-namespaces
|
|
|
|
disable-mnt
|
|
private-dev
|
|
private-tmp
|
|
|
|
# Chromium/Qt-style standalone crash uploader: no messaging function, only
|
|
# phones home with crash dumps. Block it outright rather than trust a
|
|
# network-level filter.
|
|
blacklist /usr/share/max/bin/crashpad_handler
|
|
blacklist /usr/share/max/bin/max-service/bin/crashpad_handler
|
|
|
|
dbus-system none
|