From 92f5234580a064b485bde38f340bd6a975942dbf Mon Sep 17 00:00:00 2001
From: James Allen <james@sharelatex.com>
Date: Mon, 9 May 2016 14:44:49 +0100
Subject: [PATCH] Add convert firejail profile

---
 services/filestore/firejail/convert.profile | 39 +++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 services/filestore/firejail/convert.profile

diff --git a/services/filestore/firejail/convert.profile b/services/filestore/firejail/convert.profile
new file mode 100644
index 0000000000..c1e073aa4b
--- /dev/null
+++ b/services/filestore/firejail/convert.profile
@@ -0,0 +1,39 @@
+# Convert (ImageMagick profile)
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-mgmt.inc
+include /etc/firejail/disable-secret.inc
+
+read-only /bin
+blacklist /boot
+blacklist /dev
+read-only /etc
+read-only /home
+read-only /lib
+read-only /lib64
+blacklist /media
+blacklist /mnt
+blacklist /opt
+blacklist /root
+blacklist /run
+blacklist /sbin
+blacklist /selinux
+blacklist /src
+blacklist /sys
+read-only /usr
+blacklist /var
+
+caps.drop all
+noroot
+nogroups
+protocol unix
+net none
+private-tmp
+private-dev
+shell none
+seccomp.keep access,arch_prctl,brk,chown,clone,close,dup,execve,exit_group,fcntl,fstat,futex,getcwd,getdents,getrlimit,getrusage,lseek,mmap,mprotect,munmap,nanosleep,open,openat,prctl,read,readlink,rt_sigaction,rt_sigprocmask,sched_getaffinity,set_robust_list,set_tid_address,stat,symlink,times,unlink,unshare,wait4,write
+
+rlimit-fsize 524288000 #500Mb
+rlimit-nproc 100
+rlimit-nofile 100
\ No newline at end of file