diff --git a/README.md b/README.md index f9ee730..702f30a 100644 --- a/README.md +++ b/README.md @@ -96,9 +96,9 @@ as in the third example above. It will not modify any existing user profiles. ### Blacklisting -The `firejail.blacklist` variable is used to generate a list of blacklisted -files and directories at `/usr/local/etc/firejail/disable-more.inc`. This file -is included in most of the provided security profiles, causing those locations +The `firejail.blacklist` variable is used to populate +`/etc/firejail/globals.local` with a list of blacklisted files and directories. +This file is included by all security profiles, causing the specified locations to be inaccessible to jailed programs. ## MAC Spoofing diff --git a/roles/firejail/tasks/main.yml b/roles/firejail/tasks/main.yml index 49f8abd..d3cf339 100644 --- a/roles/firejail/tasks/main.yml +++ b/roles/firejail/tasks/main.yml @@ -13,8 +13,14 @@ - name: Create firejail profile directory file: path=/usr/local/etc/firejail state=directory -- name: Push firejail blacklist include - template: src=disable-more.inc.j2 dest=/usr/local/etc/firejail/disable-more.inc +- name: Verify firejail globals file exists + file: path=/etc/firejail/globals.local state=touch + +- name: Add blacklist to globals + lineinfile: dest=/etc/firejail/globals.local + state=present + line="blacklist {{ item }}" + with_items: "{{ firejail.blacklist }}" - name: Push generic firejail profile copy: src=generic.profile dest=/usr/local/etc/firejail/generic.profile diff --git a/roles/firejail/templates/disable-more.inc.j2 b/roles/firejail/templates/disable-more.inc.j2 deleted file mode 100644 index 860133d..0000000 --- a/roles/firejail/templates/disable-more.inc.j2 +++ /dev/null @@ -1,4 +0,0 @@ -# {{ ansible_managed }} -{% for file in firejail.blacklist %} -blacklist {{ file }} -{% endfor %}