helpers/DATA/atril/apparmor-profile

+# vim:syntax=apparmor
+
+# evince is not written with application confinement in mind and is designed to
+# operate within a trusted desktop session where anything running within the
+# user's session is trusted. That said, evince will often process untrusted
+# input (PDFs, images, etc). Ideally evince would be written in such a way that
+# image processing is separate from the main process and that processing
+# happens in a restrictive sandbox, but unfortunately that is not currently the
+# case. Because evince will process untrusted input, this profile aims to
+# provide some hardening, but considering evince's design and other factors such
+# as X, gsettings, accessibility, translations, DBus session and system
+# services, etc, complete confinement is not possible.
+
+#include <tunables/global>
+
+/usr/bin/atril {
+  #include <abstractions/audio>
+  #include <abstractions/bash>
+  #include <abstractions/cups-client>
+  #include <abstractions/dbus-accessibility>
+  #include <abstractions/atril>
+  #include <abstractions/ibus>
+  #include <abstractions/nameservice>
+
+  #include <abstractions/ubuntu-browsers>
+  #include <abstractions/ubuntu-console-browsers>
+  #include <abstractions/ubuntu-email>
+  #include <abstractions/ubuntu-console-email>
+  #include <abstractions/ubuntu-media-players>
+
+  # allow atril to spawn browsers distributed as snaps (LP: #1794064)
+  #include <abstractions/snap_browsers>
+
+  # For now, let atril talk to any session services over dbus. We can
+  # blacklist any problematic ones (but note, evince uses libsecret :\)
+  #include <abstractions/dbus-session>
+
+  #include <abstractions/dbus-strict>
+  dbus (receive) bus=system,
+  # Allow getting information from various system services
+  dbus (send)
+      bus=system
+      member="Get*"
+      peer=(label=unconfined),
+  # Allow talking to avahi with whatever polkit allows
+  dbus (send)
+      bus=system
+      interface="org.freedesktop.Avahi{,.*}",
+  # Allow talking to colord with whatever polkit allows
+  dbus (send)
+      bus=system
+      interface="org.freedesktop.ColorManager{,.*}",
+
+  # Terminals for using console applications. These abstractions should ideally
+  # have 'ix' to restrict access to what only atril is allowed to do
+  #include <abstractions/ubuntu-gnome-terminal>
+
+  # By default, we won't support launching a terminal program in Xterm or
+  # KDE's konsole. It opens up too many unnecessary files for most users.
+  # People who need this functionality can uncomment the following:
+  ##include <abstractions/ubuntu-xterm>
+  ##include <abstractions/ubuntu-konsole>
+
+  /usr/bin/atril rmPx,
+  /usr/bin/atril-previewer Px,
+  /usr/bin/yelp Cx -> sanitized_helper,
+  /usr/bin/bug-buddy px,
+  # 'Show Containing Folder' (LP: #1022962)
+  /usr/bin/nautilus Cx -> sanitized_helper, # Gnome
+  /usr/bin/pcmanfm Cx -> sanitized_helper,  # LXDE
+  /usr/bin/krusader Cx -> sanitized_helper, # KDE
+  /usr/bin/thunar Cx -> sanitized_helper,   # XFCE
+
+  # Print Dialog
+  /usr/lib/@{multiarch}/libproxy/*/pxgsettings Cx -> sanitized_helper,
+
+  # For Xubuntu to launch the browser
+  #include <abstractions/exo-open>
+
+  # For text attachments
+  /usr/bin/gedit ixr,
+
+  # For Send to
+  /usr/bin/nautilus-sendto Cx -> sanitized_helper,
+
+  # GLib desktop launch helper (used under the hood by g_app_info_launch)
+  /usr/lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rmix,
+  /usr/bin/env ixr,
+
+  # allow directory listings (ie 'r' on directories) so browsing via the file
+  # dialog works
+  / r,
+  /**/ r,
+
+  # This is need for saving files in your home directory without an extension.
+  # Changing this to '@{HOME}/** r' makes it require an extension and more
+  # secure (but with 'rw', we still have abstractions/private-files-strict in
+  # effect).
+  owner @{HOME}/** rw,
+  owner /media/**  rw,
+  owner @{HOME}/.local/share/gvfs-metadata/** l,
+  owner /{,var/}run/user/*/gvfs-metadata/** l,
+
+  # Maybe add to an abstraction?
+  /etc/dconf/**                                       r,
+  owner @{HOME}/.cache/dconf/user                     rw,
+  owner @{HOME}/.config/dconf/user                    r,
+  owner @{HOME}/.config/enchant/*                     rk,
+  owner /{,var/}run/user/*/dconf/                     w,
+  owner /{,var/}run/user/*/dconf/user                 rw,
+  owner /{,var/}run/user/*/dconf-service/keyfile/     w,
+  owner /{,var/}run/user/*/dconf-service/keyfile/user rw,
+
+  owner /{,var/}run/user/*/at-spi2-*/   rw,
+  owner /{,var/}run/user/*/at-spi2-*/** rw,
+
+  # Allow access to the non-abstract D-Bus socket used by at-spi > 2.42.0
+  #   https://gitlab.gnome.org/GNOME/at-spi2-core/-/issues/43
+  owner /{,var/}run/user/*/at-spi/bus* rw,
+
+  # from http://live.gnome.org/Evince/SupportedDocumentFormats. Allow
+  # read and write for all supported file formats
+  /**.[aA][iI]         rw,
+  /**.[bB][mM][pP]     rw,
+  /**.[dD][jJ][vV][uU] rw,
+  /**.[dD][vV][iI]     rw,
+  /**.[gG][iI][fF]     rw,
+  /**.[jJ][pP][gG]     rw,
+  /**.[jJ][pP][eE][gG] rw,
+  /**.[oO][dD][pP]     rw,
+  /**.[fFpP][dD][fF]   rw,
+  /**.[pP][nN][mM]     rw,
+  /**.[pP][nN][gG]     rw,
+  /**.[pP][sS]         rw,
+  /**.[eE][pP][sS]     rw,
+  /**.[tT][iI][fF]     rw,
+  /**.[tT][iI][fF][fF] rw,
+  /**.[xX][pP][mM]     rw,
+  /**.[gG][zZ]         rw,
+  /**.[bB][zZ]2        rw,
+  /**.[cC][bB][rRzZ7]  rw,
+  /**.[xX][zZ]         rw,
+
+  # atril creates a temporary stream file like '.goutputstream-XXXXXX' in the
+  # directory a file is saved. This allows that behavior.
+  owner /**/.goutputstream-* w,
+
+  # allow atril to spawn browsers distributed as snaps (LP: #1794064)
+  /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/bin/snap mrCx -> snap_browsers,
+}
+
+/usr/bin/atril-previewer {
+  #include <abstractions/audio>
+  #include <abstractions/bash>
+  #include <abstractions/cups-client>
+  #include <abstractions/dbus-accessibility>
+  #include <abstractions/atril>
+  #include <abstractions/ibus>
+  #include <abstractions/nameservice>
+
+  #include <abstractions/ubuntu-browsers>
+  #include <abstractions/ubuntu-console-browsers>
+  #include <abstractions/ubuntu-email>
+  #include <abstractions/ubuntu-console-email>
+  #include <abstractions/ubuntu-media-players>
+
+  # For now, let atril talk to any session services over dbus. We can
+  # blacklist any problematic ones (but note, evince uses libsecret :\)
+  #include <abstractions/dbus-session>
+
+  #include <abstractions/dbus-strict>
+  dbus (receive) bus=system,
+  # Allow getting information from various system services
+  dbus (send)
+      bus=system
+      member="Get*"
+      peer=(label=unconfined),
+  # Allow talking to avahi with whatever polkit allows
+  dbus (send)
+      bus=system
+      interface="org.freedesktop.Avahi{,.*}",
+  # Allow talking to colord with whatever polkit allows
+  dbus (send)
+      bus=system
+      interface="org.freedesktop.ColorManager{,.*}",
+
+
+  # Terminals for using console applications. These abstractions should ideally
+  # have 'ix' to restrict access to what only atril is allowed to do
+  #include <abstractions/ubuntu-gnome-terminal>
+
+  # By default, we won't support launching a terminal program in Xterm or
+  # KDE's konsole. It opens up too many unnecessary files for most users.
+  # People who need this functionality can uncomment the following:
+  ##include <abstractions/ubuntu-xterm>
+
+  /usr/bin/atril-previewer mr,
+  /usr/bin/yelp Cx -> sanitized_helper,
+  /usr/bin/bug-buddy px,
+
+  # Lenient, but remember we still have abstractions/private-files-strict in
+  # effect). Write is needed for 'print to file' from the previewer.
+  @{HOME}/ r,
+  @{HOME}/** rw,
+
+  # Maybe add to an abstraction?
+  owner /{,var/}run/user/*/dconf/          w,
+  owner /{,var/}run/user/*/dconf/user      rw,
+}
+
+/usr/bin/atril-thumbnailer {
+  #include <abstractions/base>
+  #include <abstractions/private-files-strict>
+
+  #include <abstractions/fonts>
+  deny @{HOME}/.{,cache/}fontconfig/** wl,
+  deny @{HOME}/missfont.log wl,
+
+  #include <abstractions/dbus-session-strict>
+  dbus (receive) bus=session,
+  dbus (send)
+    bus=session
+    path="/org/gtk/vfs/mounttracker"
+    interface="org.gtk.vfs.MountTracker"
+    member="ListMountableInfo"
+    peer=(label=unconfined),
+
+  # updating gvfs-metadata for thumbnails is unneeded, so explicitly deny it
+  deny dbus (send)
+    bus=session
+    path="/org/gtk/vfs/metadata"
+    interface="org.gtk.vfs.Metadata"
+    member="GetTreeFromDevice"
+    peer=(label=unconfined),
+  deny @{HOME}/.local/share/gvfs-metadata/* r,
+
+  dbus (send)
+    bus=session
+    path="/org/gtk/vfs/Daemon"
+    interface="org.gtk.vfs.Daemon"
+    member="List*"
+    peer=(label=unconfined),
+
+  # The thumbnailer doesn't need access to everything in the nameservice
+  # abstraction. Allow reading of /etc/passwd and /etc/group, but suppress
+  # logging denial of nsswitch.conf.
+  /etc/passwd r,
+  /etc/group r,
+  deny /etc/nsswitch.conf r,
+
+  # TCP/UDP network access for NFS
+  network inet  stream,
+  network inet6 stream,
+  network inet  dgram,
+  network inet6 dgram,
+
+  /etc/papersize r,
+
+  /usr/bin/atril-thumbnailer mr,
+
+  /etc/texmf/ r,
+  /etc/texmf/** r,
+  /etc/xpdf/* r,
+
+  /usr/bin/gs-esp ixr,
+  # Silence these denials since 'no new privs' drops transitions to
+  # sanitized_helper, we don't want all those perms in the thumbnailer
+  # and the thumbnailer generates thumbnails without these just fine.
+  deny /usr/bin/mktexpk x,
+  deny /usr/bin/mktextfm x,
+  deny /usr/bin/dvipdfm x,
+  deny /usr/bin/dvipdfmx x,
+  deny /usr/bin/mkofm x,
+
+  # supported archivers
+  /{usr/,}bin/gzip ixr,
+  /{usr/,}bin/bzip2 ixr,
+  /usr/bin/unrar* ixr,
+  /usr/bin/unzip ixr,
+  /usr/bin/7zr ixr,
+  /usr/lib/p7zip/7zr ixr,
+  /usr/bin/7za ixr,
+  /usr/lib/p7zip/7za ixr,
+  /usr/bin/zipnote ixr,
+  /{usr/,}bin/tar ixr,
+  /usr/bin/xz ixr,
+
+  # miscellaneous access for the above
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/mountinfo r,
+  /sys/devices/system/cpu/ r,
+
+  # allow read access to anything in /usr/share, for plugins and input methods
+  /usr/local/share/** r,
+  /usr/share/** r,
+  /usr/lib/ghostscript/** mr,
+  /var/lib/ghostscript/** r,
+  /var/lib/texmf/** r,
+
+  # from http://live.gnome.org/Evince/SupportedDocumentFormats. Allow
+  # read for all supported file formats
+  /**.[bB][mM][pP]     r,
+  /**.[dD][jJ][vV][uU] r,
+  /**.[dD][vV][iI]     r,
+  /**.[gG][iI][fF]     r,
+  /**.[jJ][pP][gG]     r,
+  /**.[jJ][pP][eE][gG] r,
+  /**.[oO][dD][pP]     r,
+  /**.[fFpP][dD][fF]   r,
+  /**.[pP][nN][mM]     r,
+  /**.[pP][nN][gG]     r,
+  /**.[pP][sS]         r,
+  /**.[eE][pP][sS]     r,
+  /**.[eE][pP][sS][fFiI23] r,
+  /**.[tT][iI][fF]     r,
+  /**.[tT][iI][fF][fF] r,
+  /**.[xX][pP][mM]     r,
+  /**.[gG][zZ]         r,
+  /**.[bB][zZ]2        r,
+  /**.[cC][bB][rRzZ7]  r,
+  /**.[xX][zZ]         r,
+
+  owner @{HOME}/.texlive*/** r,
+  owner @{HOME}/.texmf*/** r,
+  owner @{HOME}/.local/share/{,flatpak/exports/share/}mime/** r,
+  owner @{HOME}/.local/share/{,flatpak/exports/share/}mime/** r,
+
+  # With the network rules above, this allows data exfiltration for files
+  # not covered by private-files-strict.
+  @{HOME}/ r,
+  owner @{HOME}/[^.]** r,
+  owner /media/**  r,
+
+  owner /tmp/.gnome_desktop_thumbnail* w,
+  owner /tmp/gnome-desktop-* rw,
+  owner /tmp/atril-thumbnailer*/{,**} rw,
+  
+  # these happen post pivot_root
+  / r,
+  deny /missfont.log w,
+
+  # Add apparmor rule for mate's caja - LP#1798091
+  owner /tmp/.mate_desktop_thumbnail* w,
+  owner /tmp/mate-desktop-thumbnailer* w,
+
+  # Fix thumbnail issue #915024
+  owner @{HOME}/.cache/thumbnails/** rw,
+  owner /tmp/atril-thumbnailer* rw,
+
+}

helpers/DATA/atril/apparmor-profile.abstraction

+# vim:syntax=apparmor
+#
+# abstraction used by atril binaries
+#
+
+  #include <abstractions/gnome>
+  #include <abstractions/p11-kit>
+  #include <abstractions/ubuntu-helpers>
+
+  @{PROC}/[0-9]*/fd/ r,
+  @{PROC}/[0-9]*/mountinfo r,
+  owner @{PROC}/[0-9]*/auxv r,
+  owner @{PROC}/[0-9]*/status r,
+
+  # Doesn't seem to be required, but noisy. Maybe allow 'r' for 'b*' if needed.
+  # Possibly move to an abstraction if anything else needs it.
+  deny /run/udev/data/** r,
+
+  # move out to the gnome abstraction if anyone else needs these
+  /etc/udev/udev.conf r,
+  /sys/devices/**/block/**/uevent r,
+
+  # apport
+  /etc/default/apport r,
+
+  # XFCE
+  /etc/xfce4/defaults.list r,
+
+  # Lubuntu
+  /etc/xdg/lubuntu/applications/defaults.list r,
+
+  # atril specific
+  /etc/ r,
+  /etc/fstab r,
+  /etc/texmf/ r,
+  /etc/texmf/** r,
+  /etc/xpdf/* r,
+  owner @{HOME}/.config/atril/   rw,
+  owner @{HOME}/.config/atril/** rwkl,
+
+  /usr/bin/gs-esp ixr,
+  /usr/bin/mktexpk Cx -> sanitized_helper,
+  /usr/bin/mktextfm Cx -> sanitized_helper,
+  /usr/bin/dvipdfm Cx -> sanitized_helper,
+  /usr/bin/dvipdfmx Cx -> sanitized_helper,
+
+  # gio-launch-desktop was replaced by a very small shell script
+  /{usr/,}bin/{dash,bash} ixr,
+ 
+  # supported archivers
+  /{usr/,}bin/gzip ixr,
+  /{usr/,}bin/bzip2 ixr,
+  /usr/bin/unrar* ixr,
+  /usr/bin/unzip ixr,
+  /usr/bin/7zr ixr,
+  /usr/lib/p7zip/7zr ixr,
+  /usr/bin/7za ixr,
+  /usr/lib/p7zip/7za ixr,
+  /usr/bin/zipnote ixr,
+  /{usr/,}bin/tar ixr,
+  /usr/bin/xz ixr,
+
+  # allow read access to anything in /usr/share, for plugins and input methods
+  /usr/local/share/** r,
+  /usr/share/** r,
+  /usr/lib/ghostscript/** mr,
+  /var/lib/ghostscript/** r,
+  /var/lib/texmf/{,**} r,
+
+  # from http://live.gnome.org/Evince/SupportedDocumentFormats. Allow
+  # read for all supported file formats
+  /**.[aA][iI]         r,
+  /**.[bB][mM][pP]     r,
+  /**.[dD][jJ][vV][uU] r,
+  /**.[dD][vV][iI]     r,
+  /**.[gG][iI][fF]     r,
+  /**.[jJ][pP][gG]     r,
+  /**.[jJ][pP][eE][gG] r,
+  /**.[oO][dD][pP]     r,
+  /**.[fFpP][dD][fF]   r,
+  /**.[pP][nN][mM]     r,
+  /**.[pP][nN][gG]     r,
+  /**.[pP][sS]         r,
+  /**.[eE][pP][sS]     r,
+  /**.[eE][pP][sS][fFiI23] r,
+  /**.[tT][iI][fF]     r,
+  /**.[tT][iI][fF][fF] r,
+  /**.[xX][pP][mM]     r,
+  /**.[gG][zZ]         r,
+  /**.[bB][zZ]2        r,
+  /**.[cC][bB][rRzZ7]  r,
+  /**.[xX][zZ]         r,
+
+  # Use abstractions/private-files instead of abstractions/private-files-strict
+  # and add the sensitive files manually to work around LP: #451422. The goal
+  # is to disallow access to the .mozilla folder in general, but to allow
+  # access to the Cache directory, which the browser may tell atril to open
+  # from directly.
+
+  #include <abstractions/private-files>
+  audit deny @{HOME}/.gnupg/{,**} mrwkl,
+  audit deny @{HOME}/.ssh/{,**} mrwkl,
+  audit deny @{HOME}/.gnome2_private/{,**} mrwkl,
+  audit deny @{HOME}/.gnome2/ w,
+  audit deny @{HOME}/.gnome2/keyrings/{,**} mrwkl,
+  audit deny @{HOME}/.kde/{,share/,share/apps/} w,
+  audit deny @{HOME}/.kde/share/apps/kwallet/{,**} mrwkl,
+  audit deny @{HOME}/.pki/{,nssdb/} w,
+  audit deny @{HOME}/.pki/nssdb/{,**} wl,
+
+  audit deny @{HOME}/.mozilla/{,**/} w,
+  audit deny @{HOME}/.mozilla/*/*/* mrwkl,
+  audit deny @{HOME}/.mozilla/**/bookmarkbackups/{,**} mrwkl,
+  audit deny @{HOME}/.mozilla/**/chrome/{,**} mrwkl,
+  audit deny @{HOME}/.mozilla/**/extensions/{,**} mrwkl,
+  audit deny @{HOME}/.mozilla/**/gm_scripts/{,**} mrwkl,
+
+  audit deny @{HOME}/.config/ w,
+  audit deny @{HOME}/.config/chromium/{,**} mrwkl,
+  audit deny @{HOME}/.config/evolution/{,**} mrwkl,
+  audit deny @{HOME}/.evolution/{,**} mrwkl,
+  audit deny @{HOME}/.kde/{,share/,share/apps/} w,
+  audit deny @{HOME}/.kde/share/config/{,**} mrwkl,
+  audit deny @{HOME}/.kde/share/apps/kmail/{,**} mrwkl,
+  audit deny @{HOME}/.{,mozilla-}thunderbird/{,**/} w,
+  audit deny @{HOME}/.{,mozilla-}thunderbird/*/* mrwkl,
+  audit deny @{HOME}/.{,mozilla-}thunderbird/*/[^C][^a][^c][^h][^e]*/{,**} mrwkl,

helpers/DATA/atril/atril.apport

+'''apport package hook for atril
+
+(c) 2024 Luis Guzmán
+Author:
+Luis Guzmán <ark@switnet.org>
+based on evince's hook
+
+'''
+
+from apport.hookutils import *
+from os import path
+import re
+
+def add_info(report):
+    attach_conffiles(report, 'atril')
+    attach_related_packages(report, ['apparmor', 'libapparmor1',
+        'libapparmor-perl', 'apparmor-utils', 'auditd', 'libaudit1'])
+
+    attach_mac_events(report, ['/usr/bin/atril',
+                               '/usr/bin/atril-previewer',
+                               '/usr/bin/atril-thumbnailer'])

helpers/DATA/atril/patches/add_install_profiles_rules.patch

+diff --git a/debian/rules b/debian/rules
+old mode 100755
+new mode 100644
+index 8a7ff87..655c574
+--- a/debian/rules
++++ b/debian/rules
+@@ -52,3 +52,9 @@ override_dh_auto_configure:
+ 
+ get-orig-source:
+ 	uscan --noconf --force-download --rename --download-current-version --destdir=..
++
++execute_after_dh_install:
++	install -m 0644 -D debian/apparmor-profile debian/atril/etc/apparmor.d/usr.bin.atril
++	install -m 0644 -D debian/apparmor-profile.abstraction debian/atril/etc/apparmor.d/abstractions/atril
++	install -m 0644 -D debian/atril.apport debian/atril/usr/share/apport/package-hooks/source_atril.py
++	dh_apparmor --profile-name=usr.bin.atril -patril
+
+diff --git a/debian/control b/debian/control
+index f5bda53..6d72cc9 100644
+--- a/debian/control
++++ b/debian/control
+@@ -9,6 +9,7 @@ Uploaders: Mike Gabriel <sunweaver@debian.org>,
+            Vangelis Mouhtsis <vangelis@gnugr.org>,
+            Martin Wimpress <code@flexion.org>,
+ Build-Depends: debhelper-compat (= 13),
++               dh-apparmor,
+                dpkg-dev (>= 1.16.1.1),
+                gobject-introspection,
+                intltool,

helpers/DATA/ayatana-indicator-sound/fix_volume_change_notification.patch

+Patch based on https://github.com/AyatanaIndicators/ayatana-indicator-sound/pull/92
+For Trisquel 11.0, Aramo - ayatana-indicator-sound - 22.2.0-2
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index ac370b2..095c953 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,5 +1,5 @@
+-project(ayatana-indicator-sound C CXX)
+-cmake_minimum_required(VERSION 3.13)
++cmake_minimum_required (VERSION 3.13)
++project (ayatana-indicator-sound VERSION 22.2.0 LANGUAGES C CXX)
+ 
+ if(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
+     SET(CMAKE_INSTALL_PREFIX "/usr" CACHE PATH "..." FORCE)
+@@ -7,8 +7,6 @@ endif(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
+ 
+ set(CMAKE_MODULE_PATH "${CMAKE_SOURCE_DIR}/cmake" "${CMAKE_MODULE_PATH}")
+ 
+-set(PACKAGE ${CMAKE_PROJECT_NAME})
+-set(PROJECT_VERSION 22.2.0)
+ find_package(PkgConfig REQUIRED)
+ include(GNUInstallDirs)
+ include(UseVala)
+diff --git a/src/info-notification.vala b/src/info-notification.vala
+index ce92a2a..3a36e52 100644
+--- a/src/info-notification.vala
++++ b/src/info-notification.vala
+@@ -1,6 +1,6 @@
+ /*
+  * Copyright 2015 Canonical Ltd.
+- * Copyright 2021 Robert Tari
++ * Copyright 2021-2023 Robert Tari
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License as published by
+@@ -30,22 +30,26 @@ public class IndicatorSound.InfoNotification: Notification
+     public void show (VolumeControl.ActiveOutput active_output,
+                       double volume,
+                       bool is_high_volume) {
+-        if (!notify_server_supports ("x-canonical-private-synchronous"))
+-            return;
+ 
+         /* Determine Label */
+-            unowned string volume_label = get_notification_label (active_output);
++            string volume_label = get_notification_label (active_output);
+ 
+         /* Choose an icon */
+         unowned string icon = get_volume_notification_icon (active_output, volume, is_high_volume);
+ 
+         /* Reset the notification */
+         var n = _notification;
++
++        uint nChars = ((int32)((volume * 20) + 0.5)).clamp(0, 20);
++        volume_label += "\n";
++
++        for (uint nChar = 0; nChar < nChars; nChar++)
++        {
++            volume_label += "◼";
++        }
++
+         n.update (_("Volume"), volume_label, icon);
+         n.clear_hints();
+-        n.set_hint ("x-lomiri-non-shaped-icon", "true");
+-        n.set_hint ("x-canonical-private-synchronous", "true");
+-        n.set_hint ("x-lomiri-value-bar-tint", is_high_volume ? "true" : "false");
+         n.set_hint ("value", ((int32)((volume * 100.0) + 0.5)).clamp(0, 100));
+         show_notification ();
+     }
+diff --git a/src/warn-notification.vala b/src/warn-notification.vala
+index 6a08431..203758e 100644
+--- a/src/warn-notification.vala
++++ b/src/warn-notification.vala
+@@ -1,5 +1,6 @@
+ /*
+  * Copyright 2015 Canonical Ltd.
++ * Copyright 2021-2023 Robert Tari
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License as published by
+@@ -15,6 +16,7 @@
+  *
+  * Authors:
+  *      Charles Kerr <charles.kerr@canonical.com>
++ *      Robert Tari <robert@tari.in>
+  */
+ 
+ public class IndicatorSound.WarnNotification: Notification
+@@ -31,9 +33,6 @@ public class IndicatorSound.WarnNotification: Notification
+             _("Volume"),
+             _("Allow volume above safe level?\nHigh volume can damage your hearing."),
+             "audio-volume-high");
+-        n.set_hint ("x-lomiri-non-shaped-icon", "true");
+-        n.set_hint ("x-lomiri-snap-decisions", "true");
+-        n.set_hint ("x-lomiri-private-affirmative-tint", "true");
+         n.closed.connect ((n) => {
+             n.clear_actions ();
+         });
+diff --git a/tests/integration/indicator-sound-test-base.cpp b/tests/integration/indicator-sound-test-base.cpp
+index 3ecd856..eb4ee8c 100644
+--- a/tests/integration/indicator-sound-test-base.cpp
++++ b/tests/integration/indicator-sound-test-base.cpp
+@@ -1,6 +1,6 @@
+ /*
+  * Copyright 2015 Canonical Ltd.
+- * Copyright 2021 Robert Tari
++ * Copyright 2021-2023 Robert Tari
+  *
+  * This program is free software: you can redistribute it and/or modify it
+  * under the terms of the GNU General Public License version 3, as published
+@@ -72,7 +72,7 @@ void IndicatorSoundTestBase::SetUp()
+                             "GetCapabilities",
+                             "",
+                             "as",
+-                            "ret = ['actions', 'body', 'body-markup', 'icon-static', 'image/svg+xml', 'x-canonical-private-synchronous', 'x-canonical-append', 'x-canonical-private-icon-only', 'x-canonical-truncation', 'private-synchronous', 'append', 'private-icon-only', 'truncation']"
++                            "ret = ['actions', 'body', 'body-markup', 'icon-static', 'image/svg+xml', 'private-synchronous', 'append', 'private-icon-only', 'truncation']"
+                          ).waitForFinished();
+ 
+     int waitedTime = 0;
+@@ -647,14 +647,8 @@ void IndicatorSoundTestBase::checkVolumeNotification(double volume, QString cons
+     QVariantMap hints;
+     ASSERT_TRUE(qDBusArgumentToMap(args.at(6), hints));
+     ASSERT_TRUE(hints.contains("value"));
+-    ASSERT_TRUE(hints.contains("x-lomiri-non-shaped-icon"));
+-    ASSERT_TRUE(hints.contains("x-lomiri-value-bar-tint"));
+-    ASSERT_TRUE(hints.contains("x-canonical-private-synchronous"));
+ 
+     EXPECT_EQ(volume*100, hints["value"]);
+-    EXPECT_EQ(true, hints["x-lomiri-non-shaped-icon"]);
+-    EXPECT_EQ(isLoud, hints["x-lomiri-value-bar-tint"]);
+-    EXPECT_EQ(true, hints["x-canonical-private-synchronous"]);
+ }
+ 
+ void IndicatorSoundTestBase::checkHighVolumeNotification(QVariantList call)
+diff --git a/tests/notifications-mock.h b/tests/notifications-mock.h
+index 49b2e66..3ae8da5 100644
+--- a/tests/notifications-mock.h
++++ b/tests/notifications-mock.h
+@@ -1,6 +1,6 @@
+ /*
+  * Copyright 2015 Canonical Ltd.
+- * Copyright 2021 Robert Tari
++ * Copyright 2021-2023 Robert Tari
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License as published by
+@@ -31,7 +31,7 @@ class NotificationsMock
+         DbusTestDbusMockObject * baseobj = nullptr;
+ 
+     public:
+-        NotificationsMock (const std::vector<std::string>& capabilities = {"actions", "body", "body-markup", "icon-static", "image/svg+xml", "x-canonical-private-synchronous", "x-canonical-append", "x-canonical-private-icon-only", "x-canonical-truncation", "private-synchronous", "append", "private-icon-only", "truncation"}) {
++        NotificationsMock (const std::vector<std::string>& capabilities = {"actions", "body", "body-markup", "icon-static", "image/svg+xml", "private-synchronous", "append", "private-icon-only", "truncation"}) {
+             mock = dbus_test_dbus_mock_new("org.freedesktop.Notifications");
+             dbus_test_task_set_bus(DBUS_TEST_TASK(mock), DBUS_TEST_SERVICE_BUS_SESSION);
+             dbus_test_task_set_name(DBUS_TEST_TASK(mock), "Notify");
+diff --git a/tests/notifications-test.cc b/tests/notifications-test.cc
+index a9fa55d..92f4672 100644
+--- a/tests/notifications-test.cc
++++ b/tests/notifications-test.cc
+@@ -1,6 +1,6 @@
+ /*
+  * Copyright 2015-2016 Canonical Ltd.
+- * Copyright 2021 Robert Tari
++ * Copyright 2021-2023 Robert Tari
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License as published by
+@@ -259,7 +259,6 @@ TEST_F(NotificationsTest, VolumeChanges) {
+     EXPECT_EQ("ayatana-indicator-sound", notev[0].app_name);
+     EXPECT_EQ("Volume", notev[0].summary);
+     EXPECT_EQ(0, notev[0].actions.size());
+-    EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-canonical-private-synchronous"]);
+     EXPECT_GVARIANT_EQ("@i 50", notev[0].hints["value"]);
+ 
+     /* Set a different volume */
+@@ -432,7 +431,6 @@ TEST_F(NotificationsTest, DISABLED_HighVolume) {
+     ASSERT_EQ(1, notev.size());
+     EXPECT_EQ("Volume", notev[0].summary);
+     EXPECT_EQ("Speakers", notev[0].body);
+-    EXPECT_GVARIANT_EQ("@s 'false'", notev[0].hints["x-lomiri-value-bar-tint"]);
+ 
+     /* Set high volume with volume change */
+     notifications->clearNotifications();
+@@ -443,7 +441,6 @@ TEST_F(NotificationsTest, DISABLED_HighVolume) {
+     ASSERT_LT(0, notev.size()); /* This passes with one or two since it would just be an update to the first if a second was sent */
+     EXPECT_EQ("Volume", notev[0].summary);
+     EXPECT_EQ("Speakers", notev[0].body);
+-    EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-lomiri-value-bar-tint"]);
+ 
+     /* Move it back */
+     volume_warning_mock_set_high_volume(VOLUME_WARNING_MOCK(volumeWarning.get()), false);
+@@ -513,7 +510,6 @@ TEST_F(NotificationsTest, DISABLED_ExtendendVolumeNotification) {
+     EXPECT_EQ("ayatana-indicator-sound", notev[0].app_name);
+     EXPECT_EQ("Volume", notev[0].summary);
+     EXPECT_EQ(0, notev[0].actions.size());
+-    EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-canonical-private-synchronous"]);
+     EXPECT_GVARIANT_EQ("@i 50", notev[0].hints["value"]);
+ 
+     /* Allow an amplified volume */
+@@ -628,14 +624,10 @@ TEST_F(NotificationsTest, DISABLED_TriggerWarning) {
+         if (warning_expected) {
+             EXPECT_TRUE(volume_warning_get_active(volumeWarning.get()));
+             ASSERT_EQ(1, notev.size());
+-            EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-lomiri-snap-decisions"]);
+-            EXPECT_GVARIANT_EQ(nullptr, notev[0].hints["x-canonical-private-synchronous"]);
+         }
+         else {
+             EXPECT_FALSE(volume_warning_get_active(volumeWarning.get()));
+             ASSERT_EQ(1, notev.size());
+-            EXPECT_GVARIANT_EQ(nullptr, notev[0].hints["x-lomiri-snap-decisions"]);
+-            EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-canonical-private-synchronous"]);
+         }
+ 
+     } // multimedia_active

helpers/DATA/base-installer/archs/amd64.sh

+arch_get_kernel_flavour () {
+	echo amd64
+}
+
+arch_check_usable_kernel () {
+	if echo "$1" | grep -q -e "signed" -e "edge" -e "hwe-16.04"; then return 1; fi
+	if echo "$1" | grep -Eq -- "-(server|generic|virtual|xen|preempt|rt)(-.*)?$"; then return 0; fi
+
+	return 1
+}
+
+arch_get_kernel () {
+
+	echo "linux-generic"
+	echo "linux-image-generic"
+
+	echo "linux-generic-hwe-20.04"
+	echo "linux-image-generic-hwe-20.04"
+
+        echo "linux-lowlatency"
+        echo "linux-image-lowlatency"
+
+        echo "linux-lowlatency-hwe-20.04"
+        echo "linux-image-lowlatency-hwe-20.04"
+
+        echo "linux-oem-20.04"
+        echo "linux-image-oem-20.04"
+
+        echo "linux-virtual"
+        echo "linux-image-virtual"
+
+        echo "linux-image-extra-virtual"
+	echo "linux-virtual-hwe-20.04"
+
+	echo "linux-image-virtual-hwe-20.04"
+	echo "linux-image-extra-virtual-hwe-20.04"
+}

helpers/DATA/base-installer/archs/i386.sh

+arch_get_kernel_flavour () {
+	# Should we offer an amd64 kernel?
+	if grep -q '^flags.*\blm\b' "$CPUINFO"; then
+		echo 686-pae amd64 686 586
+	# Should we offer a PAE kernel?
+	elif grep -q '^flags.*\bpae\b' "$CPUINFO"; then
+		echo 686-pae 686 586
+	# Should we offer a 686 kernel?
+	elif grep -q '^flags.*\bfpu\b.*\btsc\b.*\bcx8\b.*\bcmov\b' "$CPUINFO"; then
+		echo 686 586
+	else
+		echo 586
+	fi
+}
+
+arch_check_usable_kernel () {
+        if echo "$1" | grep -q -e "signed" -e "edge" -e "hwe-16.04"; then return 1; fi
+	local NAME="$1"
+
+	set -- $2
+	while [ $# -ge 1 ]; do
+		case "$1:$NAME" in
+		    *-dbg)
+			return 1
+			;;
+		    *-"$1"-pae)
+			# Don't allow -pae suffix, as this requires an
+			# extra CPU feature
+			;;
+		    *:*-"$1" | *:*-"$1"-*)
+			# Allow any other hyphenated suffix
+			return 0
+			;;
+		    686-*:*-generic | 686-*:*-generic-*)
+			return 0
+			;;
+		    686-*:*-virtual | 686-*:*-virtual-*)
+			return 0
+			;;
+		esac
+		shift
+	done
+	return 1
+}
+
+arch_get_kernel () {
+	imgbase="linux-image"
+
+	set -- $1
+	while [ $# -ge 1 ]; do
+		case $1 in
+		    686-*)
+			echo "linux-generic"
+			echo "linux-image-generic"
+			echo "linux-virtual"
+			echo "linux-image-virtual"
+			break
+			;;
+		esac
+		shift
+	done
+}

helpers/DATA/base-installer/kernel_update_list.patch

+--- source/library.sh	2022-07-14 15:09:08.482389439 -0500
++++ source/library.sh_upd	2022-07-14 15:19:40.056073944 -0500
+@@ -345,9 +345,15 @@
+ 
+ kernel_update_list () {
+ 	# Use 'uniq' to avoid listing the same kernel more then once
+-	chroot /target apt-cache search "^(kernel|$KERNEL_NAME)-image" | \
+-	cut -d" " -f1 | grep -v "linux-image-2.6" | uniq > "$KERNEL_LIST.unfiltered"
+-	kernels=`sort -r "$KERNEL_LIST.unfiltered" | tr '\n' ' ' | sed -e 's/ $//'`
++	(set +e;
++	# Hack to get the metapackages in the right order; should be
++	# replaced by something better at some point.
++	chroot /target apt-cache search ^linux- | grep '^linux-\(amd64\|686\|k7\|generic\|lowlatency\|server\|virtual\|preempt\|rt\|xen\|oem-20.04\|power\|cell\|omap\|omap4\|keystone\)';
++	chroot /target apt-cache search ^linux-image- | grep -v '^linux-image-[2-9]\.';
++	chroot /target apt-cache search ^kfreebsd-image;
++	chroot /target apt-cache search ^gnumach-image) | \
++	cut -d" " -f1 | uniq > "$KERNEL_LIST.unfiltered"
++	kernels=`< "$KERNEL_LIST.unfiltered" tr '\n' ' ' | sed -e 's/ $//'`
+ 	for candidate in $kernels; do
+ 		if [ -n "$FLAVOUR" ]; then
+ 			if arch_check_usable_kernel "$candidate" "$FLAVOUR"; then

helpers/DATA/bleachbit/bleachbit-FSDG.patch

+diff -ru a/bleachbit.spec b/bleachbit.spec
+--- a/bleachbit.spec	2020-03-22 21:42:04.000000000 +0100
++++ b/bleachbit.spec	2021-06-25 23:06:33.113952262 +0200
+@@ -72,7 +72,7 @@
+ Delete traces of your activities and other junk files to free disk
+ space and maintain privacy.  BleachBit identifies and erases
+ broken menu entries, cache, cookies, localizations, recent document
+-lists, and temporary files in Firefox, Google Chrome, Flash, and 60
++lists, and temporary files in Firefox, LibreOffice and 60
+ other applications.
+ 
+ Shred files to prevent recovery, and wipe free disk space to
+diff -ru a/cleaners/localizations.xml b/cleaners/localizations.xml
+--- a/cleaners/localizations.xml	2020-03-22 21:42:04.000000000 +0100
++++ b/cleaners/localizations.xml	2021-06-25 23:06:33.117952276 +0200
+@@ -6,9 +6,6 @@
+        the parent element, so <path location="/usr"><path location="share"/></path>
+        effects elements in /usr/share.-->
+     <path location="/usr/lib">
+-      <!-- This filter deletes /usr/lib/chromium/locales/*.pak, where * is every
+-           valid locale not specifically excluded in the configuration.-->
+-      <path location="chromium/locales" filter="*.pak"/>
+       <path location="libreoffice/share">
+         <path location="autocorr" filter="acor_*.dat"/>
+         <path location="fingerprint" filter="*.lm"/>
+diff -ru a/debian/bleachbit.1 b/debian/bleachbit.1
+--- a/debian/bleachbit.1	2020-04-01 06:08:31.000000000 +0200
++++ b/debian/bleachbit.1	2021-06-25 23:06:33.117952276 +0200
+@@ -8,8 +8,8 @@
+ BleachBit deletes unnecessary files to free valuable disk space,
+ maintain privacy, and remove junk. Rid your system of old clutter
+ including cache, temporary files, cookies, and broken shortcuts.
+-It wipes clean Bash, Beagle, Epiphany, Firefox, Flash, Java, KDE,
+-OpenOffice.org, Opera, RealPlayer, rpmbuild, VIM, XChat, and more.
++It wipes clean Bash, Beagle, Epiphany, Firefox, Java, KDE,
++OpenOffice.org, RealPlayer, rpmbuild, VIM, XChat, and more.
+ .PP
+ This is the command line interface for BleachBit.
+ .SH OPTIONS
+diff -ru a/debian/control b/debian/control
+--- a/debian/control	2020-04-01 06:08:31.000000000 +0200
++++ b/debian/control	2021-06-25 23:06:33.117952276 +0200
+@@ -29,8 +29,8 @@
+  privacy, and remove junk. It removes cache, Internet history, temporary files,
+  cookies, and broken shortcuts.
+  .
+- It handles cleaning of Adobe Reader, Bash, Beagle, Epiphany, Firefox, Flash,
+- GIMP, Google Earth, Java, KDE, OpenOffice.org, Opera, RealPlayer, rpmbuild,
++ It handles cleaning of Bash, Beagle, Epiphany, Firefox,
++ GIMP, Java, KDE, OpenOffice.org, RealPlayer, rpmbuild,
+  Second Life Viewer, VIM, XChat, and more.
+  .
+  Beyond simply erasing junk files, BleachBit wipes free disk space (to hide
+diff -ru a/doc/cleaner_markup_language.xsd b/doc/cleaner_markup_language.xsd
+--- a/doc/cleaner_markup_language.xsd	2020-03-22 21:42:04.000000000 +0100
++++ b/doc/cleaner_markup_language.xsd	2021-06-25 23:06:33.117952276 +0200
+@@ -125,11 +125,6 @@
+                             <xs:enumeration value="apt.clean"/>
+                             <xs:enumeration value="apt.autoclean"/>
+                             <xs:enumeration value="apt.autoremove"/>
+-                            <xs:enumeration value="chrome.autofill"/>
+-                            <xs:enumeration value="chrome.databases_db"/>
+-                            <xs:enumeration value="chrome.favicons"/>
+-                            <xs:enumeration value="chrome.history"/>
+-                            <xs:enumeration value="chrome.keywords"/>
+                             <xs:enumeration value="delete"/>
+                             <xs:enumeration value="dnf.autoremove"/>
+                             <xs:enumeration value="dnf.clean_all"/>
+diff -ru source/PKG-INFO source_fix/PKG-INFO
+--- a/PKG-INFO	2021-11-13 15:05:48.000000000 -0600
++++ b/PKG-INFO	2022-04-10 16:28:47.450145458 -0500
+@@ -7,5 +7,5 @@
+ Author-email: andrew@bleachbit.org
+ License: GPLv3
+ Download-URL: https://www.bleachbit.org/download
+-Description: BleachBit frees space and maintains privacy by quickly wiping files you don't need and didn't know you had. Supported applications include Edge, Firefox, Google Chrome, VLC, and many others.
++Description: BleachBit frees space and maintains privacy by quickly wiping files you don't need and didn't know you had. Supported applications include Firefox, VLC, and many others.
+ Platform: Linux and Windows; Python v2.6 and 2.7; GTK v3.12+
+diff -ru source/setup.py source_fix/setup.py
+--- a/setup.py	2021-11-13 15:05:47.000000000 -0600
++++ b/setup.py	2022-04-10 16:34:51.418739031 -0500
+@@ -47,7 +47,7 @@
+ import bleachbit.FileUtilities
+ 
+ APP_NAME = "BleachBit - Free space and maintain privacy"
+-APP_DESCRIPTION = "BleachBit frees space and maintains privacy by quickly wiping files you don't need and didn't know you had. Supported applications include Edge, Firefox, Google Chrome, VLC, and many others."
++APP_DESCRIPTION = "BleachBit frees space and maintains privacy by quickly wiping files you don't need and didn't know you had. Supported applications include Firefox, VLC, and many others."
+ 
+ #
+ # begin win32com.shell workaround for py2exe

helpers/DATA/bleachbit/icecat.xml

+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    BleachBit
+    Copyright (C) 2013-2014 Andrew Ziem
+    http://bleachbit.sourceforge.net
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+-->
+<cleaner id="icecat_xml">
+  <label>Icecat (XML)</label>
+  <description>Web browser</description>
+  <running type="exe">icecat.exe</running>
+  <running type="exe">icecat-bin</running>
+  <option id="cache">
+    <label>Cache</label>
+    <description>Delete the web cache, which reduces time to display revisited pages</description>
+    <action command="delete" search="walk.files" path="~/.mozilla/icecat*/*/Cache/"/>
+    <action command="delete" search="walk.files" path="$localappdata\Mozilla\Icecat\Profiles\*\Cache\"/>
+    <action command="delete" search="walk.files" path="$localappdata\Mozilla\Icecat\Profiles\*\OfflineCache\"/>
+    <action command="delete" search="walk.files" path="$localappdata\Mozilla\Icecat\Profiles\*\mozilla-media-cache\"/>
+    <action command="delete" search="walk.files" path="$localappdata\Mozilla\Icecat\Profiles\*\startupCache\"/>
+    
+    <!-- Windows 8 -->
+    <action command="delete" search="walk.files" path="$localappdata\Mozilla\Icecat\Profiles\*\jumpListCache\"/> 
+    
+    <!-- Also matches thumbnails-old -->
+    <action command="delete" search="walk.files" path="$localappdata\Mozilla\Icecat\Profiles\*\thumbnails*\"/>
+    
+    <!-- https://bugzilla.mozilla.org/show_bug.cgi?id=239254 -->
+    <action command="delete" search="walk.files" path="~/.cache/mozilla/icecat*/*/"/>
+    
+    <!-- Favicon cache (stored when you drag & drop a page into a folder. Windows-only(?).) -->
+    <action command="delete" search="walk.files" path="$localappdata\Mozilla\Icecat\Profiles\*\shortcutCache\"/>
+  </option>
+  <option id="cookies">
+    <label>Cookies</label>
+    <description>Delete cookies, which contain information such as web site preferences, authentication, and tracking identification</description>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/cookies.sqlite"/>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/cookies.txt"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\cookies.sqlite"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\cookies.txt"/>
+  </option>
+  <option id="crash_reports">
+    <label>Crash reports</label>
+    <description>Delete the files</description>
+    <action command="delete" search="walk.files" path="~/.mozilla/icecat*/Crash Reports/"/>
+    <action command="delete" search="walk.files" path="$APPDATA\Mozilla\Icecat\Crash Reports\"/>
+  </option>
+  <option id="dom">
+    <label>DOM Storage</label>
+    <description>Delete HTML5 cookies</description>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/webappsstore.sqlite"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\webappsstore.sqlite"/>
+  </option>
+  <option id="download_history">
+    <label>Download history</label>
+    <description>List of files downloaded</description>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/downloads.sqlite"/>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/downloads.rdf"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\downloads.sqlite"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\downloads.rdf"/>
+  </option>
+  <option id="forms">
+    <label>Form history</label>
+    <description>A history of forms entered in web sites and in the Search bar</description>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/formhistory.sqlite"/>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/formhistory.dat"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\formhistory.sqlite"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\formhistory.dat"/>
+  </option>
+  <option id="passwords">
+    <label>Passwords</label>
+    <description>A database of usernames and passwords as well as a list of sites that should not store passwords</description>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/signons.sqlite"/>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/signons.txt"/>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/signons[2-3].txt"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\signons.sqlite"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\signons.txt"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\signons[2-3].txt"/>
+  </option>
+  <option id="session_restore">
+    <label>Session restore</label>
+    <description>Loads the initial session after the browser closes or crashes</description>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/sessionstore.js"/>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/sessionstore.bak"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\sessionstore.js"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\sessionstore.bak"/>
+  </option>
+  <option id="site_preferences">
+    <label>Site preferences</label>
+    <description>Settings for individual sites</description>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/content-prefs.sqlite"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\content-prefs.sqlite"/>
+  </option>
+  <option id="url_history">
+    <label>URL history</label>
+    <description>List of visited web pages</description>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/places.sqlite"/>
+    <action command="delete" search="glob" path="~/.mozilla/icecat*/*/history.dat"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\places.sqlite"/>
+    <action command="delete" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\history.dat"/>
+  </option>
+  <option id="vacuum">
+    <label>Vacuum</label>
+    <description>Clean database fragmentation to reduce space and improve speed without removing any data</description>
+    <action command="sqlite.vacuum" search="glob" path="~/.mozilla/icecat*/*/*.sqlite"/>
+    <action command="sqlite.vacuum" search="glob" path="$APPDATA\Mozilla\Icecat\Profiles\*\*.sqlite"/>
+    <action command="sqlite.vacuum" search="glob" path="$localappdata\Mozilla\Icecat\Profiles\*\*.sqlite"/>
+  </option>
+</cleaner>