github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 22:01:33 -06:00

[GH-ISSUE #2370] Suggestion for basic usage documentation #1579

New issue

Closed

opened 2026-05-05 08:14:16 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 08:14:16 -06:00

Owner

Originally created by @saddy001 on GitHub (Jan 27, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2370

You might be interested in the experiences from a new users perspective, who took a first glance at the docs. The range of functions in firejail seem to be quite heavy, so please consider that reading it all first might not be the usual case for a new user, that wants to do some tests on the side.
I have here an untrusted application that I want to sandbox. I read the "2.2 Basic Usage" section in the docs where I'm more or less advised to "just run it" with $ firejail application.

What I'm asking myself is:
If I run it like that, what damage could it do?

Can it access my local file system?
Can it access the internet?
Can it modify any system files?

If it depends on an application profile that might be used:

Will firejail apply profiles automatically (the firejail log output suggests this) and if so, what rule determines which profile is applied (the application name?) ?
A hint "please look into the profile that you can find here" would then be appreciated

I think a great place for the above answers would be the 2.2 Basic Usage section.

Originally created by @saddy001 on GitHub (Jan 27, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2370 You might be interested in the experiences from a new users perspective, who took a first glance at the docs. The range of functions in firejail seem to be quite heavy, so please consider that reading it all first might not be the usual case for a new user, that wants to do some tests on the side. I have here an untrusted application that I want to sandbox. I read the "2.2 Basic Usage" section in the docs where I'm more or less advised to "just run it" with _$ firejail application_. What I'm asking myself is: If I run it like that, what damage could it do? - Can it access my local file system? - Can it access the internet? - Can it modify any system files? If it depends on an application profile that might be used: - Will firejail apply profiles automatically (the firejail log output suggests this) and if so, what rule determines which profile is applied (the application name?) ? - A hint "please look into the profile that you can find here" would then be appreciated I think a great place for the above answers would be the 2.2 Basic Usage section.

gitea-mirror closed this issue

2026-05-05 08:14:17 -06:00

gitea-mirror commented

2026-05-05 08:14:18 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Jan 27, 2019):

There is a lot to answer here, but quickly:

Will firejail apply profiles automatically (the firejail log output suggests this) and if so,[...] ?

You can enable a large selection of profiles using sudo firecfg. The list of profiles enabled by firecfg is in src/firecfg/firecfg.config. This list is manually maintained as there are included profiles which should not be enabled by default as they are for advanced uses or need extra configuration on top.

what rule determines which profile is applied (the application name?)

yes the application name, there are many "alias" profiles to support variation by distros get enabled

A hint "please look into the profile that you can find here" would then be appreciated

Profiles are fairly simple, mostly everything is allowed by default (as in a blank profile), you will have to read the manpages (firejail-profile) to learn about all the functions, and then go through and read whatever profile to determine how restrictive it is. Profiles are installed to /etc/firejail by default.

All of the profiles shipped with firejail are meant to be restrictive without breaking any critical functionality. There are however some programs of higher risk in which the profiles for them are much more restrictive and might break some common aspects in the choice of security.

The whole documentation for this project definitely needs to be improved, but it is all our fault. Although there are countless (many incorrect) blog and forum posts about the project which don't help the confusion. See #2090

tl;dr

apt install firejail
sudo firecfg

and most of your programs will be seamlessly sandboxed
most programs like browsers and chat clients will only be able to access your downloads folder (to upload/save things)

@SkewedZeppelin commented on GitHub (Jan 27, 2019): There is a lot to answer here, but quickly: > Will firejail apply profiles automatically (the firejail log output suggests this) and if so,[...] ? You can enable a large selection of profiles using `sudo firecfg`. The list of profiles enabled by firecfg is in `src/firecfg/firecfg.config`. This list is manually maintained as there are included profiles which should not be enabled by default as they are for advanced uses or need extra configuration on top. > what rule determines which profile is applied (the application name?) yes the application name, there are many "alias" profiles to support variation by distros get enabled > A hint "please look into the profile that you can find here" would then be appreciated Profiles are fairly simple, mostly everything is allowed by default (as in a blank profile), you will have to read the manpages (`firejail-profile`) to learn about all the functions, and then go through and read whatever profile to determine how restrictive it is. Profiles are installed to `/etc/firejail` by default. All of the profiles shipped with firejail are meant to be restrictive without breaking any critical functionality. There are however some programs of higher risk in which the profiles for them are much more restrictive and might break some common aspects in the choice of security. The whole documentation for this project definitely needs to be improved, but it is all our fault. Although there are countless (many incorrect) blog and forum posts about the project which don't help the confusion. See #2090 tl;dr ``` apt install firejail sudo firecfg ``` and most of your programs will be seamlessly sandboxed most programs like browsers and chat clients will only be able to access your downloads folder (to upload/save things)

gitea-mirror commented

2026-05-05 08:14:19 -06:00

Author

Owner

@saddy001 commented on GitHub (Mar 14, 2019):

Ok thanks. I'd prefer a "restrict everything and then permit things step by step" kind of default policy, but that might be my personal taste.

@saddy001 commented on GitHub (Mar 14, 2019): Ok thanks. I'd prefer a "restrict everything and then permit things step by step" kind of default policy, but that might be my personal taste.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1579

No description provided.

Rows
Columns