github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2024] New profile for Gradio #1363

New issue

Closed

opened 2026-05-05 07:55:50 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 07:55:50 -06:00

Owner

Originally created by @Bundy01 on GitHub (Jul 3, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2024

I created this profile:

# Firejail profile for gradio
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/gradio.local
# Persistent global definitions
include /etc/firejail/globals.local

noblacklist ${HOME}/.local/share/gradio
mkdir ${HOME}/.local/share/gradio
whitelist ${HOME}/.local/share/gradio

include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

include /etc/firejail/whitelist-common.inc

caps.drop all
netfilter
no3d
nodvd
nogroups
nonewprivs
noroot
notv
novideo
protocol unix,inet,inet6
seccomp
shell none

private-tmp
noexec /tmp

Is it safe enough?
If it's okay, I can do a pull-request if no one else does. If I have to do this, are there any other files to edit separately etc.?

Originally created by @Bundy01 on GitHub (Jul 3, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2024 I created this profile: ``` # Firejail profile for gradio # This file is overwritten after every install/update # Persistent local customizations include /etc/firejail/gradio.local # Persistent global definitions include /etc/firejail/globals.local noblacklist ${HOME}/.local/share/gradio mkdir ${HOME}/.local/share/gradio whitelist ${HOME}/.local/share/gradio include /etc/firejail/disable-common.inc include /etc/firejail/disable-devel.inc include /etc/firejail/disable-interpreters.inc include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-programs.inc include /etc/firejail/whitelist-common.inc caps.drop all netfilter no3d nodvd nogroups nonewprivs noroot notv novideo protocol unix,inet,inet6 seccomp shell none private-tmp noexec /tmp ``` Is it safe enough? If it's okay, I can do a pull-request if no one else does. If I have to do this, are there any other files to edit separately `etc`.?

gitea-mirror closed this issue

2026-05-05 07:55:51 -06:00

gitea-mirror commented

2026-05-05 07:55:52 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Jul 3, 2018):

That is fine. As a nitpick the whitelist line should be right above the whitelist-common line. You can add more like the following:

include /etc/firejail/whitelist-var-common.inc
noexec ${HOME}

and maybe even a private-etc like

private-etc asound.conf,ca-certificates,fonts,host.conf,hostname,hosts,pulse,resolv.conf,ssl,pki,crypto-policies,gtk-3.0,xdg,machine-id

As for a pull request, just the profile is OK and one of us will usually do the rest. But for reference on a new profile the following usually get updated:

README: to credit the contributor for adding the profile
README.md: add the profile to the "## New profiles" section, or a new line if there isn't room
RELNOTES: add the profile to the "new profiles: " section or a new line if there isn't room
src/firecfg/firecfg.config: add the profile to the list of profiles enabled by default when running firecfg
etc/disable-programs.inc: add any noblacklist paths here to prevent other jailed programs from accessing them

a good example of that is here 62077c459f

@SkewedZeppelin commented on GitHub (Jul 3, 2018): That is fine. As a nitpick the whitelist line should be right above the whitelist-common line. You can add more like the following: ``` include /etc/firejail/whitelist-var-common.inc noexec ${HOME} ``` and maybe even a private-etc like ``` private-etc asound.conf,ca-certificates,fonts,host.conf,hostname,hosts,pulse,resolv.conf,ssl,pki,crypto-policies,gtk-3.0,xdg,machine-id ``` As for a pull request, just the profile is OK and one of us will usually do the rest. But for reference on a new profile the following usually get updated: - README: to credit the contributor for adding the profile - README.md: add the profile to the "## New profiles" section, or a new line if there isn't room - RELNOTES: add the profile to the "new profiles: " section or a new line if there isn't room - src/firecfg/firecfg.config: add the profile to the list of profiles enabled by default when running firecfg - etc/disable-programs.inc: add any noblacklist paths here to prevent other jailed programs from accessing them a good example of that is here 62077c459f3a3e61b80338304a5a37e6c8538d64

gitea-mirror commented

2026-05-05 07:55:53 -06:00

Author

Owner

@Bundy01 commented on GitHub (Jul 3, 2018):

Okay,
I added the three lines you recommended.
I will make the pull-request tomorrow (etc) :)

@Bundy01 commented on GitHub (Jul 3, 2018): Okay, I added the three lines you recommended. I will make the pull-request tomorrow (etc) :)

gitea-mirror referenced this issue

2026-05-05 10:10:33 -06:00

[PR #1363] [MERGED] Allow ~/.netrc for youtube-dl #3927

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1363

No description provided.

Rows
Columns