[GH-ISSUE #2605] Slack now performs log in only via browser

gitea-mirror commented

2026-05-05 08:18:04 -06:00

Owner

Originally created by @viq on GitHub (Mar 18, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2605

Slack just changed how their application works, and you can log in to Slack only via browser, either requiring opening browser from Slack or opening Slack from browser.

I don't know yet what would be a good way to approach this.

Originally created by @viq on GitHub (Mar 18, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2605 Slack just changed how their application works, and you can log in to Slack *only* via browser, either requiring opening browser from Slack or opening Slack from browser. I don't know yet what would be a good way to approach this.

gitea-mirror closed this issue

2026-05-05 08:18:05 -06:00

gitea-mirror commented

2026-05-05 08:18:07 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 20, 2019):

Do they provide a URL to click? Or is it a "Click this button" kind of thing?

@chiraag-nataraj commented on GitHub (May 20, 2019): Do they provide a URL to click? Or is it a "Click this button" kind of thing?

gitea-mirror commented

2026-05-05 08:18:08 -06:00

Author

Owner

@viq commented on GitHub (May 25, 2019):

It's a click this button that does xdg-open, you can't right click to get
URL

On Mon, 20 May 2019, 17:31 ಚಿರಾಗ್ ನಟರಾಜ್, notifications@github.com wrote:

Do they provide a URL to click? Or is it a "Click this button" kind of
thing?

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/netblue30/firejail/issues/2605?email_source=notifications&email_token=AAE4DZOG7C2CYBF2DMK56CDPWK73TA5CNFSM4G7GYAB2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODVZGSHY#issuecomment-494037279,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAE4DZJE6F4JJQ2VOWZJ4R3PWK73TANCNFSM4G7GYABQ
.

@viq commented on GitHub (May 25, 2019): It's a click this button that does xdg-open, you can't right click to get URL On Mon, 20 May 2019, 17:31 ಚಿರಾಗ್ ನಟರಾಜ್, <notifications@github.com> wrote: > Do they provide a URL to click? Or is it a "Click this button" kind of > thing? > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > <https://github.com/netblue30/firejail/issues/2605?email_source=notifications&email_token=AAE4DZOG7C2CYBF2DMK56CDPWK73TA5CNFSM4G7GYAB2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODVZGSHY#issuecomment-494037279>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/AAE4DZJE6F4JJQ2VOWZJ4R3PWK73TANCNFSM4G7GYABQ> > . >

gitea-mirror commented

2026-05-05 08:18:09 -06:00

Author

Owner

@ghost commented on GitHub (May 25, 2019):

@viq The slack profile uses private-bin slack,locale.

It's a click this button that does xdg-open...

Have you tried adding xdg-open to private-bin yet? Either in a slack.local file or from the command-line via --private-bin=xdg-open.

@ghost commented on GitHub (May 25, 2019): @viq The slack profile uses `private-bin slack,locale`. > It's a click this button that does xdg-open... Have you tried adding xdg-open to private-bin yet? Either in a slack.local file or from the command-line via --private-bin=xdg-open.

gitea-mirror commented

2026-05-05 08:18:10 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 28, 2019):

^ I would second @glitsj16. I suspect adding xdg-open to the private-bin invocation should help (although you probably need to have your browser already running, since starting the browser inside the slack sandbox would require loosening it a lot). @viq, can you try and report back? I would, but I exclusively use the webapp.

@chiraag-nataraj commented on GitHub (May 28, 2019): ^ I would second @glitsj16. I suspect adding `xdg-open` to the `private-bin` invocation should help (although you probably need to have your browser already running, since starting the browser inside the `slack` sandbox would require loosening it a lot). @viq, can you try and report back? I would, but I exclusively use the webapp.

gitea-mirror commented

2026-05-05 08:18:12 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jun 4, 2019):

@viq Did @glitsj16's suggestion work?

@chiraag-nataraj commented on GitHub (Jun 4, 2019): @viq Did @glitsj16's suggestion work?

gitea-mirror commented

2026-05-05 08:18:12 -06:00

Author

Owner

@wellsaid commented on GitHub (Jun 4, 2019):

I can confirm the same problem on my system.
I have tried @glitsj16 suggestion by adding xdg-open to /etc/firejail/slack.profile

#private-bin slack,locale
private-bin slack,locale,xdg-open

But it didn't solved the problem for me

@wellsaid commented on GitHub (Jun 4, 2019): I can confirm the same problem on my system. I have tried @glitsj16 suggestion by adding xdg-open to /etc/firejail/slack.profile ``` #private-bin slack,locale private-bin slack,locale,xdg-open ``` But it didn't solved the problem for me

gitea-mirror commented

2026-05-05 08:18:14 -06:00

Author

Owner

@ghost commented on GitHub (Jun 5, 2019):

After some experimenting I could open slack's login in an already running firefox by adding the below in /etc/firejail/slack.local (or ~/.config/firejail/slack.local). Making it start a new browser session would require crippling the profile to the point of insecurity, which is obviously advised against.

# Firejail profile for slack
# Persistent local customizations

# login with firefox
noblacklist ${HOME}/.mozilla
whitelist ${HOME}/.mozilla
private-bin firefox

# xdg-open support in a GNOME session
private-bin basename,cut,egrep,grep,head,readlink,sed,tr,which,xdg-mime,xdg-open

# uncomment the below if you need to support other desktop environments and
# finding all the needed commands for private-bin risks loosing all your hair
#ignore private-bin

As one can deduce from the added comments, this will take some adjusting when your default web browser is not firefox and you happen to run another desktop environment. Make sure you both noblacklist/whitelist needed configuration paths for your default browser and replace 'firefox' with your appropriate browser command in the private-bin option.

If one peeks inside xdg-open, you'll notice it relies on quite a wide array of commands to find the default handler for opening URL's. This makes it rather complex to create a well-balanced firejail profile that works under all possible environments for an application that relies on another application for login purposes. IMHO this goes against the grain of sandboxing by default, be it via firejail or via similar tools. It would make sense (at least it does for me) if we dropped private-bin here to avoid this fine mess.

@ghost commented on GitHub (Jun 5, 2019): After some experimenting I could open slack's login in an `already running firefox` by adding the below in /etc/firejail/slack.local (or ~/.config/firejail/slack.local). Making it `start` a new browser session would require crippling the profile to the point of `insecurity`, which is obviously advised against. ``` # Firejail profile for slack # Persistent local customizations # login with firefox noblacklist ${HOME}/.mozilla whitelist ${HOME}/.mozilla private-bin firefox # xdg-open support in a GNOME session private-bin basename,cut,egrep,grep,head,readlink,sed,tr,which,xdg-mime,xdg-open # uncomment the below if you need to support other desktop environments and # finding all the needed commands for private-bin risks loosing all your hair #ignore private-bin ``` As one can deduce from the added comments, this will take some adjusting when your default web browser is not firefox and you happen to run another desktop environment. Make sure you both noblacklist/whitelist needed `configuration paths` for your default browser and replace 'firefox' with your appropriate `browser command` in the `private-bin` option. If one peeks inside xdg-open, you'll notice it relies on quite a wide array of commands to find the default handler for opening URL's. This makes it rather complex to create a well-balanced firejail profile that works under all possible environments for an application that relies on another application for login purposes. IMHO this goes against the grain of sandboxing by default, be it via firejail or via similar tools. It would make sense (at least it does for me) if we dropped `private-bin` here to avoid this fine mess.

gitea-mirror commented

2026-05-05 08:18:15 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jun 5, 2019):

Honestly, it feels better to run it unsandboxed just for initial login if it means we can tighten the sandbox for normal usage.

@chiraag-nataraj commented on GitHub (Jun 5, 2019): Honestly, it feels better to run it unsandboxed just for initial login if it means we can tighten the sandbox for normal usage.

gitea-mirror referenced this issue

2026-05-05 08:25:02 -06:00

[GH-ISSUE #2792] Wiki: Frequently Asked Questions #1747

gitea-mirror referenced this issue

2026-05-05 08:25:07 -06:00

[GH-ISSUE #2792] Wiki: Frequently Asked Questions #1747

gitea-mirror referenced this issue

2026-05-05 08:25:10 -06:00

[GH-ISSUE #2792] Wiki: Frequently Asked Questions #1747

gitea-mirror referenced this issue

2026-05-05 08:25:13 -06:00

[GH-ISSUE #2792] Wiki: Frequently Asked Questions #1747