github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1675] Is there a command to activate single profile or selected profiles ?? #1134

New issue

Closed

opened 2026-05-05 07:30:50 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 07:30:50 -06:00

Owner

Originally created by @Nokia808 on GitHub (Dec 12, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1675

Hi. I'm a Fedora user currently I use following guide that created by me after nearly 1 year from investigations:

https://forums.fedoraforum.org/showthread.php?313858-Risk-Free-WineHQ-Installation-amp-Usage

(my user name in Fedora forum is User808).

Recently I'm started to interested in Firejail sandboxing program & I like to use it for sandbox of ALL wine applications: ANY windows program installed on WineHQ will run sand boxed by Firejail ......

I search how to do this but I can not find answer ! I found the following command:

sudo firecfg

but it will lead to activated ALL profiles supported by Firejail NOT ONLY WineHQ profile.

Please I like to activate only WineHQ profile so that any Windows application already installed (or will be installed) will be run sand boxed by Firejail by default. How can I do this ?? Is there a specific command for that like:

sudo firecfg wine

Is there such a command or like command ??

Originally created by @Nokia808 on GitHub (Dec 12, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1675 Hi. I'm a Fedora user currently I use following guide that created by me after nearly 1 year from investigations: https://forums.fedoraforum.org/showthread.php?313858-Risk-Free-WineHQ-Installation-amp-Usage (my user name in Fedora forum is User808). -------------------------------------------------- Recently I'm started to interested in Firejail sandboxing program & I like to use it for sandbox of ALL wine applications: ANY windows program installed on WineHQ will run sand boxed by Firejail ...... I search how to do this but I can not find answer ! I found the following command: sudo firecfg but it will lead to activated ALL profiles supported by Firejail NOT ONLY WineHQ profile. Please I like to activate only WineHQ profile so that any Windows application already installed (or will be installed) will be run sand boxed by Firejail by default. How can I do this ?? Is there a specific command for that like: sudo firecfg wine Is there such a command or like command ??

gitea-mirror

2026-05-05 07:30:50 -06:00

closed this issue
added the
enhancement

firecfg

duplicate

question_old
labels

gitea-mirror commented

2026-05-05 07:30:54 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Dec 12, 2017):

sudo firecfg --clean && sudo ln -s /usr/bin/firejail /usr/local/bin/wine will only leave wine enabled

but what is the downside of having all the others sandboxed?

@SkewedZeppelin commented on GitHub (Dec 12, 2017): `sudo firecfg --clean && sudo ln -s /usr/bin/firejail /usr/local/bin/wine` will only leave wine enabled but what is the downside of having all the others sandboxed?

gitea-mirror commented

2026-05-05 07:30:55 -06:00

Author

Owner

@Nokia808 commented on GitHub (Dec 13, 2017):

@SpotComms

Thank you very much your kind & rapid response !

I would like to suggest for developer of Firejail to simplify this command (creating abbreviation to it) like:
sudo firecfg foo
where foo is name of program (supported program by official profile).

Regarding your question: "but what is the downside of having all the others sandboxed?"
sand boxing meaning limitation in functionality - please correct to me if I'm wrong - like firefox downloads will be deleted just after close firefox if firefox run sandboxed, isn't it ? So, I do not like to run firefox every time by default sand boxed & to me it is enough to use "firejail firefox", but WineHQ is mandatory to me (never allow it to run out of firejail sand box). If I run "sudo firecfg" then GIMP will never be able (by default) to edit any image because it is sand boxed then any image edition will disappear just by exit GIMP.

I have following questions:

if I sand box WineHQ by firejail using command you gave to me, then do Irfanview (image program with edit power) & PDF-XChange editor (2 Windows program I like to use on Linux) will still be able to edit images & PDF while WineHQ is sand boxed ?? Does edit will disappear after closing Windows program ??
I mean: I have PDF stored on my laptop in "Documents" folder within my home directory, then can PDF-XChange editor used to edit this PDF while Wine is sandboxed by firejail ?
does firetools GUI has option from GUI to activate individual profiles ?

Best.

@Nokia808 commented on GitHub (Dec 13, 2017): @SpotComms Thank you very much your kind & rapid response ! I would like to suggest for developer of Firejail to simplify this command (creating abbreviation to it) like: sudo firecfg foo where foo is name of program (supported program by official profile). Regarding your question: "but what is the downside of having all the others sandboxed?" sand boxing meaning limitation in functionality - please correct to me if I'm wrong - like firefox downloads will be deleted just after close firefox if firefox run sandboxed, isn't it ? So, I do not like to run firefox every time by default sand boxed & to me it is enough to use "firejail firefox", but WineHQ is mandatory to me (never allow it to run out of firejail sand box). If I run "sudo firecfg" then GIMP will never be able (by default) to edit any image because it is sand boxed then any image edition will disappear just by exit GIMP. I have following questions: 1) if I sand box WineHQ by firejail using command you gave to me, then do Irfanview (image program with edit power) & PDF-XChange editor (2 Windows program I like to use on Linux) will still be able to edit images & PDF while WineHQ is sand boxed ?? Does edit will disappear after closing Windows program ?? I mean: I have PDF stored on my laptop in "Documents" folder within my home directory, then can PDF-XChange editor used to edit this PDF while Wine is sandboxed by firejail ? 2) does firetools GUI has option from GUI to activate individual profiles ? Best.

gitea-mirror commented

2026-05-05 07:30:56 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Dec 13, 2017):

The default profiles are created with usability in mind. Firefox is allowed persistent access to its config and ~/Downloads; Gimp is allowed persistent access to basically everywhere. The only time Firejail will delete afterwards is when explicitly running with --private.

For your questions...

No. Wine has permission to access Documents, it will not be deleted on close
Yes, in a way. It will allow you to run programs sandboxed without enabling them system wide, however it does not always show every program Firejail supports.

@SkewedZeppelin commented on GitHub (Dec 13, 2017): The default profiles are created with usability in mind. Firefox is allowed persistent access to its config and ~/Downloads; Gimp is allowed persistent access to basically everywhere. The only time Firejail will delete afterwards is when explicitly running with `--private`. For your questions... 1. No. Wine has permission to access Documents, it will not be deleted on close 2. Yes, in a way. It will allow you to run programs sandboxed without enabling them system wide, however it does not always show every program Firejail supports.

gitea-mirror commented

2026-05-05 07:30:58 -06:00

Author

Owner

@Vincent43 commented on GitHub (Dec 15, 2017):

but what is the downside of having all the others sandboxed?

The downside is you may not want some apps sandboxed. Especially things like wget, less, kate, dolphin which are commonly used for daily system administration. Currently I have to clean them manually after I run firecfg.

Option for enabling single items and/or blacklisting some apps for firecfg usage would be nice.

@Vincent43 commented on GitHub (Dec 15, 2017): > but what is the downside of having all the others sandboxed? The downside is you may not want some apps sandboxed. Especially things like wget, less, kate, dolphin which are commonly used for daily system administration. Currently I have to clean them manually after I run `firecfg`. Option for enabling single items and/or blacklisting some apps for `firecfg` usage would be nice.

gitea-mirror commented

2026-05-05 07:30:59 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 30, 2018):

Moving this to #2097.

@chiraag-nataraj commented on GitHub (Sep 30, 2018): Moving this to #2097.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1134

No description provided.

Rows
Columns