github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2109] Firefox and native messaging #1426

New issue

Closed

opened 2026-05-05 08:05:35 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 08:05:35 -06:00

Owner

Originally created by @alkim0 on GitHub (Sep 7, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2109

Hi, somewhat recently, firefox started allowing native apps. However, this requires that another executable be allowed to run in the firefox jail. I'm not quite sure how to do this.

Specifically, I'm trying to use the native app for tridactyl which installs a python script to $HOME/.local/share/tridactyl/native_main.py. Firefox needs to be able to execute this python script (like a shell script, and not as an argument to the interpreter).

I use firejail with a private directory for firefox: firejail --private=~/firefox-jail, and I made sure the python script is installed to the private directory, and I've enabled the firefox-common-addons.profile to allow python. However, I'm continuing to get permission denied errors. Any suggestions?

Originally created by @alkim0 on GitHub (Sep 7, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2109 Hi, somewhat recently, firefox started allowing [native apps](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Native_messaging). However, this requires that another executable be allowed to run in the firefox jail. I'm not quite sure how to do this. Specifically, I'm trying to use the native app for [tridactyl](https://github.com/tridactyl/tridactyl) which installs a python script to `$HOME/.local/share/tridactyl/native_main.py`. Firefox needs to be able to execute this python script (like a shell script, and not as an argument to the interpreter). I use firejail with a private directory for firefox: `firejail --private=~/firefox-jail`, and I made sure the python script is installed to the private directory, and I've enabled the `firefox-common-addons.profile` to allow python. However, I'm continuing to get `permission denied` errors. Any suggestions?

gitea-mirror closed this issue

2026-05-05 08:05:36 -06:00

gitea-mirror commented

2026-05-05 08:05:38 -06:00

Author

Owner

@Vincent43 commented on GitHub (Sep 7, 2018):

Try disabling noexec ${HOME} from /etc/firejail/firefox-common.profile. If you have distro with apparmor then you have to add /{,run/firejail/mnt/oroot/}home/** ix, to /etc/apparmor.d/local/firejail-local as well.

@Vincent43 commented on GitHub (Sep 7, 2018): Try disabling `noexec ${HOME}` from `/etc/firejail/firefox-common.profile`. If you have distro with apparmor then you have to add `/{,run/firejail/mnt/oroot/}home/** ix,` to `/etc/apparmor.d/local/firejail-local` as well.

gitea-mirror commented

2026-05-05 08:05:39 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Oct 3, 2018):

@alkim0 Did @Vincent43's suggestion work?

@chiraag-nataraj commented on GitHub (Oct 3, 2018): @alkim0 Did @Vincent43's suggestion work?

gitea-mirror commented

2026-05-05 08:05:39 -06:00

Author

Owner

@alkim0 commented on GitHub (Oct 7, 2018):

Sorry for the late response, but yes! This does work! Thank you.

@alkim0 commented on GitHub (Oct 7, 2018): Sorry for the late response, but yes! This does work! Thank you.

gitea-mirror commented

2026-05-05 08:05:40 -06:00

Author

Owner

@petRUShka commented on GitHub (Oct 24, 2018):

@Vincent43, could you please tell if it is possible to narrow folders with exec capability.

Idea is to add noexec to all $HOME but some particular directory.

@petRUShka commented on GitHub (Oct 24, 2018): @Vincent43, could you please tell if it is possible to narrow folders with `exec` capability. Idea is to add `noexec` to all `$HOME` but some particular directory.

gitea-mirror commented

2026-05-05 08:05:41 -06:00

Author

Owner

@petRUShka commented on GitHub (Oct 24, 2018):

@alkim0, could you please provide whole configuration changes for native to work?

I've added python and have disabled noexec $HOME but it doesn't work...

noblacklist ${PATH}/python3.7*
noblacklist /usr/lib/python3.7*

@petRUShka commented on GitHub (Oct 24, 2018): @alkim0, could you please provide whole configuration changes for native to work? I've added python and have disabled `noexec $HOME` but it doesn't work... ``` noblacklist ${PATH}/python3.7* noblacklist /usr/lib/python3.7* ```

gitea-mirror commented

2026-05-05 08:05:42 -06:00

Author

Owner

@Vincent43 commented on GitHub (Oct 24, 2018):

@petRUShka you would have to add noexec to all dirs except one which isn't much scalable.

@Vincent43 commented on GitHub (Oct 24, 2018): @petRUShka you would have to add `noexec` to all dirs except one which isn't much scalable.

gitea-mirror commented

2026-05-05 08:05:42 -06:00

Author

Owner

@petRUShka commented on GitHub (Oct 25, 2018):

@Vincent43, sad to hear :(

@petRUShka commented on GitHub (Oct 25, 2018): @Vincent43, sad to hear :(

gitea-mirror referenced this issue

2026-05-05 10:11:04 -06:00

[PR #1426] [MERGED] Apparmor: add local configuration #3956

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1426

No description provided.

Rows
Columns