How to blacklist everything in ${HOME} except for the noblacklisted files in the system profile?

[saltiniroberto]

Say that I have the following system profile P.profile

noblacklist ${HOME}/.config/fileA
noblacklist ${HOME}/.config/fileB

Now, I want to create a user profile that blacklists everything in ${HOME} except for the noblacklisted files in P.profile.

The only way I have found to do so is to whitelist the noblacklisted files, e.g.

whitelist ${HOME}/.config/fileA
whitelist ${HOME}/.config/fileB

Is there any more succinct way to achieve the same result?

[kmk3]

blacklists everything in ${HOME} except for the noblacklisted files

The only way I have found to do so is to whitelist the noblacklisted files,
e.g.

whitelist ${HOME}/.config/fileA
whitelist ${HOME}/.config/fileB

Is there any more succinct way to achieve the same result?

If a path is blacklisted, you need to noblacklist + whitelist it.

Otherwise, you can just whitelist it.

[rusty-snake]

Is there any more succinct way to achieve the same result?

No

Also note that blacklist and whitelist are two different things with different implications.

[saltiniroberto]

Thanks for your answer.

Also note that blacklist and whitelist are two different things with different implications.

Would you be able to expand on this? Thanks.

[rusty-snake]

• Both are implemented using (bind-)mounts, hence they operate on subtrees rather than on paths.
• blacklist denies access to a subtree. It does not say anything about other subtrees.
  • It is only meaningful for subtrees that exist when the sandbox is started.
  • "not allowed" means visible but inaccessible.
• whitelist allows access only to listed subtrees.
  • It is only meaningful for subtrees that exist when the sandbox is started.
  • You can not rename/move whitelisted subtrees.
  • "not allowed" means invisible.