[GH-ISSUE #2507] Profiles not in firecfg

gitea-mirror commented

2026-05-05 08:16:58 -06:00

Owner

Originally created by @SkewedZeppelin on GitHub (Mar 3, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2507

here for reference purposes, after I updated firecfg in f7925af702
should this be a readme in src/firecfg with a comment added to firecfg.config?

commons: electron, clamav, chromium-common, firefox-common
compressors: 7z, 7za, 7zr, acat, adiff, als, apack, arepack, aunpack, bsdcat, bsdcpio, bsdtar, bunzip2, cpio, gtar, gunzip, gzip, lbunzip2, lbzcat, lbzip2, lzcat, lzcmp, lzdiff, lzegrep, lzfgrep, lzgrep, lzip, lzless, lzma, lzmadec, lzmainfo, lzmore, p7zip, tar, unlzma, unrar, unxz, unzip, xz, xzcat, xzcmp, xzdec, xzdiff, xzegrep, xzfgrep, xzgrep, xzless, xzmore
editors: emacs, nano, rnano, rview, rvim, vim, vimcat, vimdiff, vimpager, vimtutor
needs args: webui-aria2, tor, spectre-meltdown-checker, makepkg, cower, itch, fetchmail, aosp
file managers: thunar, Thunar, ranger, pcmanfm, nemo, caja, nautilus
known issues: gnome-ring, git
potential breakage: gpg-agent, gpg, gnome-pie, gnome-keyring-3, gnome-keyring, curl
special: Xvfb, default, server
terminals: x-terminal-emulator
window managers: openbox, i3, fluxbox, devilspie, devilspie2, blackbox, awesome
profiles that could probably be enabled: start-tor-browser.desktop, sftp, scp, file, mpd, gsettings, dconf
profiles included but disabled that could probably be enabled: pycharm-community, pycharm-professional, atom, atom-beta

Relates to:

Originally created by @SkewedZeppelin on GitHub (Mar 3, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2507 here for reference purposes, after I updated firecfg in f7925af7026fa90dd285407c0c869bfaeb3984ad should this be a readme in src/firecfg with a comment added to firecfg.config? - commons: `electron, clamav, chromium-common, firefox-common` - compressors: `7z, 7za, 7zr, acat, adiff, als, apack, arepack, aunpack, bsdcat, bsdcpio, bsdtar, bunzip2, cpio, gtar, gunzip, gzip, lbunzip2, lbzcat, lbzip2, lzcat, lzcmp, lzdiff, lzegrep, lzfgrep, lzgrep, lzip, lzless, lzma, lzmadec, lzmainfo, lzmore, p7zip, tar, unlzma, unrar, unxz, unzip, xz, xzcat, xzcmp, xzdec, xzdiff, xzegrep, xzfgrep, xzgrep, xzless, xzmore` - editors: `emacs, nano, rnano, rview, rvim, vim, vimcat, vimdiff, vimpager, vimtutor` - needs args: `webui-aria2, tor, spectre-meltdown-checker, makepkg, cower, itch, fetchmail, aosp` - file managers: `thunar, Thunar, ranger, pcmanfm, nemo, caja, nautilus` - known issues: `gnome-ring, git` - potential breakage: `gpg-agent, gpg, gnome-pie, gnome-keyring-3, gnome-keyring, curl` - special: `Xvfb, default, server` - terminals: `x-terminal-emulator` - window managers: `openbox, i3, fluxbox, devilspie, devilspie2, blackbox, awesome` - profiles that could probably be enabled: `start-tor-browser.desktop, sftp, scp, file, mpd, gsettings, dconf` - profiles included but disabled that could probably be enabled: `pycharm-community, pycharm-professional, atom, atom-beta` Relates to: * #3095 * #3097 * #4039 * https://github.com/netblue30/firejail/pull/4069#issuecomment-798997164 * #4633 * #6412 * #6477 * #6533 * #6755

gitea-mirror added the

information_old

firecfg

labels 2026-05-05 08:16:58 -06:00

gitea-mirror commented

2026-05-05 08:17:01 -06:00

Author

Owner

@Vincent43 commented on GitHub (Mar 3, 2019):

curl is used during package updates in Arch so I wold rather avoid it in firecfg.

For things which are already enabled in firecfg but IMO shouldn't are: patch which is commonly used during building something and less which breaks manpages in ubuntu due to conflicts with their AppArmor profile (which is enabled by default there).

@Vincent43 commented on GitHub (Mar 3, 2019): `curl` is used during package updates in Arch so I wold rather avoid it in firecfg. For things which are already enabled in `firecfg` but IMO shouldn't are: `patch` which is commonly used during building something and `less` which breaks manpages in ubuntu due to conflicts with their AppArmor profile (which is enabled by default there).

gitea-mirror commented

2026-05-05 08:17:01 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Mar 3, 2019):

@Vincent43 updated for curl

I haven't seen any issues with patch (both on its own, and nested under aosp.profile). I originally added patch because I read it was possible to execute code in it through ed.

less should be safe to remove.

@SkewedZeppelin commented on GitHub (Mar 3, 2019): @Vincent43 updated for curl I haven't seen any issues with patch (both on its own, and nested under aosp.profile). I originally added patch because I read it was possible to execute code in it through `ed`. less should be safe to remove.

gitea-mirror commented

2026-05-05 08:17:02 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Mar 3, 2019):

also thoughts on enabling file? considering the recent CVE-2019-8904, CVE-2019-8905, and CVE-2019-8906

@SkewedZeppelin commented on GitHub (Mar 3, 2019): also thoughts on enabling `file`? considering the recent CVE-2019-8904, CVE-2019-8905, and CVE-2019-8906

gitea-mirror commented

2026-05-05 08:17:03 -06:00

Author

Owner

@Vincent43 commented on GitHub (Mar 4, 2019):

I remember I had issues witch patch when I build packages from AUR on Arch Linux. I don't have opinion about file, perhaps it's something to test.

@Vincent43 commented on GitHub (Mar 4, 2019): I remember I had issues witch `patch` when I build packages from AUR on Arch Linux. I don't have opinion about `file`, perhaps it's something to test.

gitea-mirror commented

2026-05-05 08:17:04 -06:00

Author

Owner

@ghost commented on GitHub (Mar 4, 2019):

My experience with patch on Arch Linux when using makepkg (whether to build from AUR or from a repo PKGBUILD) stem from its profile not having libfakeroot included in private-lib. If memory serves I added libfakeroot to the file profile for the exact same reason. Seeing @Vincent43's comment here reminded me to check my patch.local and I've been using private-lib libfakeroot for over 2 years in there without issues. Apparently I never thought of proposing to add it to the patch profile too. Maybe something to consider.

@ghost commented on GitHub (Mar 4, 2019): My experience with `patch` on Arch Linux when using makepkg (whether to build from AUR or from a repo PKGBUILD) stem from its profile not having `libfakeroot` included in `private-lib`. If memory serves I added libfakeroot to the `file` profile for the exact same reason. Seeing @Vincent43's comment here reminded me to check my patch.local and I've been using `private-lib libfakeroot` for over 2 years in there without issues. Apparently I never thought of proposing to add it to the patch profile too. Maybe something to consider.

gitea-mirror commented

2026-05-05 08:17:06 -06:00

Author

Owner

@ghost commented on GitHub (Mar 8, 2019):

should this be a readme in src/firecfg with a comment added to firecfg.config?

That would be nice to have yes. I went ahead and added ffmpeg redirects, pragha and transmission redirects to firecfg.config in https://github.com/netblue30/firejail/pull/2546. That leaves 2 applications not yet covered here:

gconf (and redirects) from https://github.com/netblue30/firejail/pull/2528 --> might go into profiles that could probably be enabled ?
xxd (which redirects to vim) --> might go into editors?

Hope this helps to to get the proposed readme out in fully updated condition.

@ghost commented on GitHub (Mar 8, 2019): > should this be a readme in src/firecfg with a comment added to firecfg.config? That would be nice to have yes. I went ahead and added ffmpeg redirects, pragha and transmission redirects to firecfg.config in https://github.com/netblue30/firejail/pull/2546. That leaves 2 applications not yet covered here: - gconf (and redirects) from https://github.com/netblue30/firejail/pull/2528 --> might go into `profiles that could probably be enabled `? - xxd (which redirects to vim) --> might go into `editors`? Hope this helps to to get the proposed readme out in fully updated condition.

gitea-mirror commented

2026-05-05 08:17:07 -06:00

Author

Owner

@ghost commented on GitHub (Mar 12, 2019):

Added redirect profiles for lrzip in https://github.com/netblue30/firejail/pull/2574. The included archivers (lrunzip, lrz, lrzcat, lrzip, lrztar, lrzuntar and zpaq) could fit nicely into the compressors category.

@ghost commented on GitHub (Mar 12, 2019): Added redirect profiles for lrzip in https://github.com/netblue30/firejail/pull/2574. The included archivers (lrunzip, lrz, lrzcat, lrzip, lrztar, lrzuntar and zpaq) could fit nicely into the `compressors` category.

gitea-mirror commented

2026-05-05 08:17:08 -06:00

Author

Owner

@seniorm0ment commented on GitHub (Jul 26, 2020):

window managers

Don't think there's one for bspwm btw

@seniorm0ment commented on GitHub (Jul 26, 2020): > window managers Don't think there's one for bspwm btw

Rows
Columns

[GH-ISSUE #2507] Profiles not in firecfg #1630