Releases · netblue30/firejail

30 Jul 11:19

SkewedZeppelin

0.9.76

622c59f

Release 0.9.76 Latest

Latest

firejail (0.9.76) baseline; urgency=low

feature: use globbing in hardcoded numbered /dev paths (#2723 #6704)
feature: add warn command (#6710)
feature: use non-blocking flock calls (#6761)
modif: block TPM devices & turn notpm command into keep-dev-tpm (#6698)
modif: improve error messages in mountinfo.c (#6711)
modif: use "Error:" in errExit message (#6716)
modif: keep tss group if keep-dev-tpm is used (#6718)
modif: keep /dev/tpmrm devices if keep-dev-tpm is used (#6719)
modif: keep tcm/tcmrm devices if keep-dev-tpm is used (#6724)
modif: improve "Failed mount" error messages in util.c (#6747)
modif: improve fcopy error messages in check() (#6801)
modif: fcopy: try normal case first instead of last in check() (#6804)
modif: improve new network namespace error message (#6824)
modif: improve error messages in sandbox.c/sbox.c (#6825)
bugfix: fix flock debug messages going to stderr (#6712)
bugfix: add missing selinux relabeling for /dev paths (#6734)
bugfix: fix potential deadlock with flock + SIGTSTP (#6729 #6750)
bugfix: fcopy: add /usr/share + "runner:root" exception to fix CI (#6797
#6803)
bugfix: fcopy: allow /etc/resolv.conf owned by systemd-resolve (#4545
#6808)
bugfix: fix "Not enforcing Landlock" message always being printed (#6806)
bugfix: add NULL check for cmdline in find_child() (#6840)
build: use TARNAME in SYSCONFDIR/VARDIR (#6713)
build: add localstatedir and use in VARDIR (#6715)
build: replace SYSCONFDIR with @sysconfdir@ (#6737)
ci: upgrade debian:buster to debian:bullseye (#6832)
docs: improve URL formatting in man pages (#6706)
docs: clarify --private bug in man pages (#6805)
docs: fix man formatting of landlock.enforce (#6807)
profiles: split commands that increase/reduce access (#6687)
profiles: firefox: add comment about creating PWA shortcuts (#6689)
profiles: add more xorg paths (#6708)
profiles: fix include of deprecated disable-X11.inc (uppercase) (#6709)
profiles: godot: remove noinput so gamepads work (#6707)
profiles: remove mkdir ~/.pki (#6732)
profiles: mpv: remove mkfile ~/.netrc (#6735)
profiles: curl: allow ~/.netrc (#6736)
profiles: discord-common: add env to private-bin (#6738)
profiles: firecfg: disable checksum programs (#6755)
profiles: rssguard: allow lua (#6758 #6759)
profiles: wine: allow python to fix Epic Games Launcher (#6762 #6763)
profiles: wusc: add /usr/share/xkeyboard-config-2 (#6773 #6775)
profiles: chafa: quiet output (#6777)
profiles: ripperx/sound-juicer: fix profile name typos (#6780)
profiles: ani-cli: add mpv to private-etc for plugins access (#6779)
profiles: use private-etc groups in more profiles (#6783)
profiles: firecfg: disable foliate (#6784)
profiles: finish converting private-opt to whitelist (#6785)
profiles: replace hosts.conf with host.conf in private-etc (#6791)
profiles: makedeb: allow dpkg (#6816)
profiles: kate: fix network access (#6815 #6823)
profiles: keepassxc: add x11 group to private-etc (#6827 #6828)
profiles: allow org.kde.kwalletd6 for Plasma 6 systems (#6819)
profiles: xreader: disable no3d to fix startup (#6829)
profiles: firefox: add alternative tridactylrc path (#6720 #6721)
new profile: ansel (#6751)
-- netblue30 [email protected] Wed, 30 Jul 2025 11:00:00 -0500

A note about the different signing key:

Due to an xorg change, many/most xorg programs were rendered completely broken
when running under 0.9.74:

#6773

This was fixed in 0.9.76:

#6775

Usually the releases are created by @netblue30, but we could not get in contact
with @netblue30 for over a month, so to avoid leaving firejail in a broken
state for many common programs for too long (and since the release contains
mostly bugfixes), we (@kmk3 and @SkewedZeppelin) chose to release 0.9.76.

As a result, this release is signed by @SkewedZeppelin instead of @netblue30.

For details, see the following discussions:

Signed by @netblue30 on Aug 17, 2025

Contributors

SkewedZeppelin, netblue30, and kmk3

Assets 4

25 Mar 13:49

netblue30

0.9.74

c3cc7d3

Release 0.9.74

firejail (0.9.74) baseline; urgency=low

security: fix sscanf rv checks (CodeQL) (#6184)
feature: private-etc rework: improve handling of /etc/resolv.conf and add
private-etc groups (#6400 #5518 #5608 #5609 #5629 #5638 #5641 #5642 #5643
#5650 #5681 #5737 #5844 #5989 #6016 #6104 #5655 #6435 #6514 #6515)
feature: Add "keep-shell-rc" command and option (#1127 #5634)
feature: Print the argument when failing with "too long arguments" (#5677)
feature: a random hostname is assigned to each sandbox unless
overwritten using --hostname command
feature: add IPv6 support for --net.print option
feature: QUIC (HTTP/3) support in --nettrace
feature: add seccomp filters for --restrict-namespaces
feature: stats support for --nettrace
feature: add doas support in firecfg and jailcheck (#5899 #5900)
feature: firecfg: add firecfg.d & add ignore command (#2097 #5245 #5876
#6153 #6268)
feature: expand simple macros in more commands (--chroot= --netfilter=
--netfilter6= --trace=) (#6032 #6109)
feature: add Landlock support (#5269 #6078 #6115 #6125 #6187 #6195 #6200
#6228 #6260 #6302 #6305)
feature: add support for comm, coredump, and prctl procevents in firemon
(#6414 #6415)
feature: add notpm command & keep tpm devices in private-dev (#6379 #6390)
feature: fshaper.sh: support tc on NixOS (#6426 #6431)
feature: add aarch64 syscalls (#5821 #6574)
feature: add --disable-sandbox-check configure flag (#6592)
feature: block /dev/ntsync & add keep-dev-ntsync command (#6655 #6660)
modif: Stop forwarding own double-dash to the shell (#5599 #5600)
modif: Prevent sandbox name (--name=) and host name (--hostname=)
from containing only digits (#5578 #5741)
modif: Escape control characters of the command line (#5613)
modif: Allow mostly only ASCII letters and digits for sandbox name
(--name=) and host name (--hostname=) (#5708 #5856)
modif: make private-lib a configure-time option, disabled by default (see
--enable-private-lib) (#5727 #5732)
modif: Improve --version/--help & print version on startup (#5829 #6172)
modif: improve errExit error messages (#5871)
modif: drop deprecated 'shell' option references (#5894)
modif: keep pipewire group unless nosound is used (#5992 #5993)
modif: fcopy: use lstat when copying directory (#5378 #5957)
modif: private-dev: keep /dev/kfd unless no3d is used (#6380)
modif: keep /sys/module/nvidia* if prop driver and no no3d (#6372 #6387)
modif: clarify error messages in profile.c (#6605)
modif: keep plugdev group unless nou2f is used (#6664)
removal: firemon: remove --interface option (it duplicates the firejail
--net.print= option) (0e48f99)
removal: remove support for LTS and firetunnel (db09546)
bugfix: fix --hostname and --hosts-file commands
bugfix: fix examples in firejail-local AppArmor profile (#5717)
bugfix: arp.c: ensure positive timeout on select(2) (#5806)
bugfix: Wrong syscall names for s390_pci_mmio_read and s390_pci_mmio_write
(#5965 #5976)
bugfix: firejail --ls reports wrong file sizes for large files (#5982
#6086)
bugfix: fix startup race condition for /run/firejail directory (#6307)
bugfix: fix various resource leaks (#6367)
bugfix: profstats: fix restrict-namespaces max count (#6369)
bugfix: remove --noautopulse from --help and zsh comp (#6401)
bugfix: parse --debug before using it (#6579)
bugfix: fix possible memory leak in fs_home.c (#6598)
bugfix: do not interact with dbus directory if dbus proxy is disabled
(#6591)
bugfix: firecfg: check full .desktop filename in check_profile() (#6674)
build: auto-generate syntax files (#5627)
build: mark all phony targets as such (#5637)
build: mkdeb.sh: pass all arguments to ./configure (#5654)
build: deb: enable apparmor by default & remove deb-apparmor (#5668)
build: Fix whitespace and add .editorconfig (#5674)
build: remove for loop initial declarations to fix building with old
compilers (#5778)
build: enable compiler warnings by default (#5842)
build: remove -mretpoline and NO_EXTRA_CFLAGS (#5859)
build: disable all built-in implicit make rules (#5864)
build: organize and standardize make vars and targets (#5866)
build: fix seccomp filters and man pages always being rebuilt when running
make (#5156 #5898)
build: fix hardcoded make & remove unnecessary distclean targets (#5911)
build: dist and asc improvements (#5916)
build: fix some shellcheck issues & use config.sh in more scripts (#5927)
build: firecfg.config sorting improvements (#5942)
build: codespell improvements (#5955)
build: add missing makefile dep & syntax improvements (#5956)
build: sort.py: use case-sensitive sorting (#6070)
build: mkrpm.sh: append instead of override configure args (#6126)
build: use CPPFLAGS instead of INCLUDE in compile targets (#6159)
build: use full paths on compile/link targets (#6158)
build: automatically generate header dependencies (#6164)
build: improve main clean target (#6186)
build: mkrpm.sh improvements (#6196)
build: move errExit macro into inline function (#6217)
build: allow overriding certain tools & sync targets with CI (#6222)
build: reduce hardcoding and inconsistencies & add installcheck target
(#6230 #6620)
build: sort.py: filter empty and duplicate items (#6261)
build: fix "warning: "_FORTIFY_SOURCE" redefined" (#6282 #6283)
build: sort.py: add -h/-i/-n/-- options (#6290 #6339 #6562)
build: add strip target and simplify install targets (#6342)
build: remove clean dependency from cppcheck targets (#6343)
build: allow overriding common tools (#6354)
build: standardize install commands (#6366)
build: improve reliability/portability of date command usage (#6403 #6404)
build: sort.py: strip whitespace in profiles (#6556)
build: sort.py: fix whitespace in entire profile (#6593)
build: sort.py: quote diff lines (#6594)
build: remove cppcheck-old target/job (#6676)
ci: always update the package db before installing packages (#5742)
ci: fix codeql unable to download its own bundle (#5783)
ci: split configure/build/install commands on gitlab (#5784)
ci: fix swapped name/email arguments in debian_ci (#5795)
ci: formatting and misc improvements (#5802)
ci: run for every branch instead of just master (#5815)
ci: upgrade debian:stretch to debian:buster (#5818)
ci: standardize apt-get update/install & misc improvements (#5857)
ci: Update step-security/harden-runner and update allowed endpoints (#5953)
ci: whitelist paths, reorganize workflows & speed-up tests (#5960 #6627)
ci: fix dependabot duplicated workflow runs (#5984)
ci: allow running workflows manually (#6026)
ci: add timeout limits (#6178)
ci: make dependabot updates monthly and bump PR limit (#6338)
contrib/syntax: remove 'text/plain' from firejail-profile.lang.in (#6057
#6059)
contrib/vim: match profile files more broadly (#5850)
contrib/vim: add ftplugin file (based on cfg.vim) (#6680)
test: split individual test groups in github workflows
test: add chroot, appimage and network tests in github workflows
docs: remove apparmor options in --help when building without apparmor
support (#5589)
docs: fix typos (#5693)
docs: markdown formatting and misc improvements (#5757)
docs: add uninstall instructions to README.md (#5812)
docs: add precedence info to manpage & fix noblacklist example (#6358
#6359)
docs: bug_report.md: use absolute path in 'steps to reproduce' (#6382)
docs: man: format and sort some private- items (#6398)
docs: man: improve blacklist/whitelist examples with spaces (#6425)
docs: add build_issue.md issue template (#6423)
docs: man: sort commands (firejail.1) (#6451)
docs: man: fix bold in command TPs (#6472)
docs: man: fix wrong escapes (#6474)
docs: github: streamline environment in issue templates (#6471 #6607)
docs: fix typos of --enable-selinux configure option (#6526)
docs: clarify intro and build section in README (#6524)
docs: clarify that other tools may not be in PPA (#6407)
docs: use GitHub issues as the bug reporting address (#6525)
docs: update distribution table & add note in SECURITY.md (#6624)
docs: clarify unmaintained status of overlayfs in configure.ac (#6632)
docs: improve whitelist and blacklist descriptions in man pages (#6622)
docs: note that --build may generate a non-functional profile (#6653)
legal: selinux.c: Split Copyright notice & use same license as upstream
(#5667)
profiles: qutebrowser: fix links not opening in the existing instance
(#5601 #5618)
profiles: clarify userns comments (#5686)
profiles: bulk rename electron to electron-common (#5700)
profiles: streamline seccomp socket comment (#5735)
profiles: drop hostname option from all profiles (#5702)
profiles: move read-only config entries to disable-common.inc (#5763)
profiles: standardize on just "GTK" on comments (#5794)
profiles: bleachbit: allow erasing Trash contents (#5337 #5902)
profiles: improvements to profiles using private (#5946)
profiles: standardize commented code and eol comments (#5987)
profiles: disable-common: add more suid programs (#6049 #6051 #6052)
profiles: replace private-opt with whitelist & document private-opt issues
(#6021)
profiles: drop paths already in wusc (#6218)
profiles: deny access to ~/.config/autostart (#6257)
profiles: replace x11 socket blacklist with disable-X11.inc (#6286)
profiles: sort blacklist sections (#6289)
profiles: rename dis...

Assets 6

16 Jan 16:02

netblue30

0.9.72

2551bc7

Release 0.9.72

feature: On failing to remount a fuse filesystem, give warning instead of
erroring out (#5240 #5242)
feature: Update syscall tables and seccomp groups (#5188)
feature: improve force-nonewprivs security guarantees (#5217 #5271)
feature: add support for restricting the creation of Linux namespaces
(--restrict-namespaces, --restrict-namespaces=), implemented as a seccomp
filter for both 64 and 32 bit architectures (#4939 #5259)
feature: add support for custom AppArmor profiles (--apparmor=) (#5274
#5316 #5317 #5475)
feature: add support for ICMP in nettrace
feature: add --dnstrace, --icmptrace, and --snitrace commands
feature: Add basic gtksourceview language-spec (file type detection/syntax
highlighting for profiles) (#5502)
feature: add restrict-namespaces to (almost) all applicable profiles (#5440
#5537)
feature: add support for netlock in profile files
modif: removed --cgroup= command (#5190 #5200)
modif: set --shell=none as the default (#5190)
modif: removed --shell= command (#5190 #5196 #5209)
modif: disabled firetunnel by default in configure.ac (#5190)
modif: disabled chroot by default in /etc/firejail/firejail.config (#5190)
modif: disabled private-lib by default in /etc/firejail/firejail.config
(#5190 #5216)
modif: disabled tracelog by default in /etc/firejail/firejail.config
(#5190)
modif: removed grsecurity support
modif: stop hiding blacklisted files in /etc by default and add a new
etc-hide-blacklisted option to firejail.config that enables the previous
behavior (disabled by default) (#5010 #5230 #5591 #5595)
bugfix: Flood of seccomp audit log entries (#5207)
bugfix: --netlock does not work (Error: no valid sandbox) (#5312)
build: deduplicate configure-time vars into new config files (#5140 #5284)
build: fix file mode of shell scripts (644 -> 755) (#5206)
build: reduce autoconf input files from 32 to 2 (#5219)
build: add dist build directory to .gitignore (#5248)
build: add autoconf auto-generation comment to input files (#5251)
build: Add files make uninstall forgot to remove (#5283)
build: add and use TARNAME instead of NAME for paths (#5310)
build: only install ids.config when --enable-ids is set (#5356 #5357)
build: Remove deprecated syntax and modernize shell test scripts (#5370)
build: Fix musl warnings (#5421 #5431)
build: sort.py improvements (#5429)
build: deduplicate makefiles (#5478)
build: fix formatting and misc in configure (#5488)
build: actually set LDFLAGS/LIBS & stop overriding CFLAGS/LDFLAGS (#5504)
build: make shell commands more portable in firejail.vim (#5577)
ci: bump ubuntu to 22.04 and use newer compilers / analyzers (#5275)
ci: ignore git-related paths and the project license (#5249)
ci: Harden GitHub Actions (StepSecurity) (#5439)
ci: sort and ignore more paths (#5481)
ci: whitelist needed endpoints and block access to sudo (#5485)
docs: fix typos (#5189 #5349)
docs: mention risk of SUID binaries and also firejail-users(5) (#5288
#5290)
docs: set vim filetype on man pages for syntax highlighting (#5296)
docs: note that blacklist/whitelist follow symlinks (#5344)
docs: Add IRC channel info to README.md (#5361)
docs: man: Note that some commands can be disabled in firejail.config
(#5366)
docs: Add gist note to bug_report.md (#5398)
docs: clarify that --appimage should appear before --profile (#5402 #5451)
docs: add more Firefox examples to the firejail-local AppArmor profile
(#5493)
docs: Fix broken Restrict-DBus wiki link on profile.template (#5554)
docs: Remove invalid --profile-path from --help (#5585 #5586)
new profiles: gdu, makedeb, gtk-lbry-viewer, lbry-viewer, tuir, chafa,
new profiles: godot3, cinelerra-gg, tesseract, avidemux3_qt5,
new profiles: avidemux3_cli, avidemux3_jobs_qt5, ssmtp, chatterino,
new profiles: linuxqq, qq, electron-hardened.inc.profile,

Assets 7

09 Jun 15:14

netblue30

0.9.70

b4b08d2

Release 0.9.70

security: CVE-2022-31214 - root escalation in --join logic
Reported by Matthias Gerstner, working exploit code was provided to our
development team. In the same time frame, the problem was independently
reported by Birk Blechschmidt. Full working exploit code was also provided.
feature: enable shell tab completion with --tab (#4936)
feature: disable user profiles at compile time (#4990)
feature: Allow resolution of .local names with avahi-daemon in the apparmor
profile (#5088)
feature: always log seccomp errors (#5110)
feature: firecfg --guide, guided user configuration (#5111)
feature: --oom, kernel OutOfMemory-killer (#5122)
modif: --ids feature needs to be enabled at compile time (#5155)
modif: --nettrace only available to root user
rework: whitelist restructuring (#4985)
rework: firemon, speed up and lots of fixes
bugfix: --private-cwd not expanding macros, broken hyperrogue (#4910)
bugfix: nogroups + wrc prints confusing messages (#4930 #4933)
bugfix: openSUSE Leap - whitelist-run-common.inc (#4954)
bugfix: fix printing in evince (#5011)
bugfix: gcov: fix gcov functions always declared as dummy (#5028)
bugfix: Stop warning on safe supplementary group clean (#5114)
build: remove ultimately unused INSTALL and RANLIB check macros (#5133)
build: mkdeb.sh.in: pass remaining arguments to ./configure (#5154)
ci: replace centos (EOL) with almalinux (#4912)
ci: fix --version not printing compile-time features (#5147)
ci: print version after install & fix apparmor support on build_apparmor
(#5148)
docs: Refer to firejail.config in configuration files (#4916)
docs: firejail.config: add warning about allow-tray (#4946)
docs: mention that the protocol command accumulates (#5043)
docs: mention inconsistent homedir bug involving --private=dir (#5052)
docs: mention capabilities(7) on --caps (#5078)
new profiles: onionshare, onionshare-cli, opera-developer, songrec
new profiles: node-gyp, npx, semver, ping-hardened
removed profiles: nvm

Assets 7

06 Feb 13:45

netblue30

0.9.68

0845233

Release 0.9.68

security: on Ubuntu, the PPA is now recommended over the distro package
(see README.md) (#4748)
security: bugfix: private-cwd leaks access to the entire filesystem
(#4780); reported by Hugo Osvaldo Barrera
feature: remove (some) environment variables with auth-tokens (#4157)
feature: ALLOW_TRAY condition (#4510 #4599)
feature: add basic Firejail support to AppArmor base abstraction (#3226
#4628)
feature: intrusion detection system (--ids-init, --ids-check)
feature: deterministic shutdown command (--deterministic-exit-code,
--deterministic-shutdown) (#928 #3042 #4635)
feature: noprinters command (#4607 #4827)
feature: network monitor (--nettrace)
feature: network locker (--netlock) (#4848)
feature: whitelist-ro profile command (#4740)
feature: disable pipewire with --nosound (#4855)
feature: Unset TMP if it doesn't exist inside of sandbox (#4151)
feature: Allow apostrophe in whitelist and blacklist (#4614)
feature: AppImage support in --build command (#4878)
modifs: exit code: distinguish fatal signals by adding 128 (#4533)
modifs: firecfg.config is now installed to /etc/firejail/ (#408 #4669)
modifs: close file descriptors greater than 2 (--keep-fd) (#4845)
modifs: nogroups now stopped causing certain system groups to be dropped,
which are now controlled by the relevant "no" options instead (such as
nosound -> drop audio group), which fixes device access issues on systems
not using (e)logind (such as with seatd) (#4632 #4725 #4732 #4851)
removal: --disable-whitelist at compile time
removal: whitelist=yes/no in /etc/firejail/firejail.config
bugfix: Fix sndio support (#4362 #4365)
bugfix: Error mounting tmpfs (MS_REMOUNT flag not being cleared) (#4387)
bugfix: --build clears the environment (#4460 #4467)
bugfix: firejail hangs with net parameter (#3958 #4476)
bugfix: Firejail does not work with a custom hosts file (#2758 #4560)
bugfix: --tracelog and --trace override /etc/ld.so.preload (#4558 #4586)
bugfix: PATH_MAX is undeclared on musl libc (#4578 #4579 #4583 #4606)
bugfix: firejail symlinks are not skipped with private-bin + globs (#4626)
bugfix: Firejail rejects empty arguments (#4395)
bugfix: firecfg does not work with symlinks (discord.desktop) (#4235)
bugfix: Seccomp list output goes to stdout instead of stderr (#4328)
bugfix: private-etc does not work with symlinks (#4887)
bugfix: Hardware key not detected on keepassxc (#4883)
build: allow building with address sanitizer (#4594)
build: Stop linking pthread (#4695)
build: Configure cleanup and improvements (#4712)
ci: add profile checks for sorting disable-programs.inc and
firecfg.config and for the required arguments in private-etc (#2739 #4643)
ci: pin GitHub actions to SHAs and use Dependabot to update them (#4774)
docs: Add new command checklist to CONTRIBUTING.md (#4413)
docs: Rework bug report issue template and add both a question and a
feature request template (#4479 #4515 #4561)
docs: fix contradictory descriptions of machine-id ("preserves" vs
"spoofs") (#4689)
docs: Document that private-bin and private-etc always accumulate (#4078)
new includes: whitelist-run-common.inc (#4288), disable-X11.inc (#4462)
new includes: disable-proc.inc (#4521)
removed includes: disable-passwordmgr.inc (#4454 #4461)
new profiles: microsoft-edge-beta, clion-eap, lifeograph, zim
new profiles: io.github.lainsce.Notejot, rednotebook, gallery-dl
new profiles: yt-dlp, goldendict, goldendict, bundle, cmake
new profiles: make, meson, pip, codium, telnet, ftp, OpenStego
new profiles: imv, retroarch, torbrowser, CachyBrowser,
new profiles: notable, RPCS3, wget2, raincat, conitop, 1passwd,
new profiles: Seafile, neovim, com.github.tchx84.Flatseal

Assets 7

19 Jan 14:43

netblue30

0.9.68rc1

9903aaa

Release 0.9.68rc1 Pre-release

Pre-release

exit code: distinguish fatal signals by adding 128 (#4533)
close file descriptors greater than 2 (--keep-fd) (#4845)
intrusion detection system (--ids-init, --ids-check)
deterministic shutdown (--deterministic-exit-code,
--deterministic-shutdown) (#4635)
noprinters command (#4607 #4827)
network monitor (--nettrace)
network locker (--netlock)
whitelist-ro profile command
build: firecfg.config is now installed to /etc/firejail/ (#4669)
removed --disable-whitelist at compile time
removed whitelist=yes/no in /etc/firejail/firejail.config
new condition: ALLOW_TRAY (#4510 #4599)
remove (some) environment variables with auth-tokens (#4157)
new includes: whitelist-run-common.inc (#4288), disable-X11.inc (#4462)
removed includes: disable-passwordmgr.inc (#4461)
new profiles: microsoft-edge-beta, clion-eap, lifeograph, zim
new profiles: io.github.lainsce.Notejot, rednotebook, gallery-dl
new profiles: yt-dlp, goldendict, goldendict, bundle, cmake
new profiles: make, meson, pip, codium, telnet, ftp, OpenStego
new profiles: imv, retroarch, torbrowser, CachyBrowser,
new profiles: notable, RPCS3, wget2, raincat,