github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #259] Write Freedesktop directories, blacklist the rest #181

New issue

Closed

opened 2026-05-05 05:15:46 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 05:15:46 -06:00

Owner

Originally created by @derba on GitHub (Jan 24, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/259

I use Clementine as music player. I would be glad if it could access for read+write ~/.config/Clementine and ~/<localized name for Music> only. The rest should be blacklisted or read-only. How could I achieve that?

The localized name fo Music is returned by Freedesktop's xdg-user-dir MUSIC command. I can used that on command line, but how to set it in global profile?

Originally created by @derba on GitHub (Jan 24, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/259 I use Clementine as music player. I would be glad if it could access for read+write `~/.config/Clementine` and `~/<localized name for Music>` only. The rest should be blacklisted or read-only. How could I achieve that? The localized name fo Music is returned by Freedesktop's `xdg-user-dir MUSIC` command. I can used that on command line, but how to set it in global profile?

gitea-mirror

2026-05-05 05:15:46 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 05:15:50 -06:00

Author

Owner

@nick75e commented on GitHub (Jan 24, 2016):

Hi!

You can use the whitelist option so that only the whitelisted folders will be seen by Clementine, e.g. (in profile files):
whitelist ~/.config/Clementine
whitelist ~/Music
or firejail --whitelist=~/.config/Clementine --whitelist=~/Music clementine
I'm not sure you can set the music folder dynamically (yet?), there is $DOWNLOAD for the download folder but I don't think it exists for the music folder.

Hope it helps

@nick75e commented on GitHub (Jan 24, 2016): Hi! You can use the `whitelist` option so that only the whitelisted folders will be seen by Clementine, e.g. (in profile files): `whitelist ~/.config/Clementine` `whitelist ~/Music` or `firejail --whitelist=~/.config/Clementine --whitelist=~/Music clementine` I'm not sure you can set the music folder dynamically (yet?), there is `$DOWNLOAD` for the download folder but I don't think it exists for the music folder. Hope it helps

gitea-mirror commented

2026-05-05 05:15:52 -06:00

Author

Owner

@derba commented on GitHub (Jan 25, 2016):

Just like one can use ${HOME} in profiles, it would be nice to use logical Freedesktop names e.g. XDG-USER-DIR(MUSIC). I see two use cases:

If you have a server with several users, one using it in English, the other in Spanish, then you do not know how to write Firejail profile correctly.
If a Linux distribution wants to limit e.g. transmission-gtk to be able to access its config and Downloads directories only, then they cannot do it easily even for 1 user with 1 language.

When Firejail is to execute something then on interpreting profiles XDG stuff needs a little extra lookup.

http://freedesktop.org/wiki/Software/xdg-user-dirs/
https://wiki.archlinux.org/index.php/Xdg_user_directories

@derba commented on GitHub (Jan 25, 2016): Just like one can use ${HOME} in profiles, it would be nice to use logical Freedesktop names e.g. XDG-USER-DIR(MUSIC). I see two use cases: 1. If you have a server with several users, one using it in English, the other in Spanish, then you do not know how to write Firejail profile correctly. 2. If a Linux distribution wants to limit e.g. transmission-gtk to be able to access its config and Downloads directories only, then they cannot do it easily even for 1 user with 1 language. When Firejail is to execute something then on interpreting profiles XDG stuff needs a little extra lookup. http://freedesktop.org/wiki/Software/xdg-user-dirs/ https://wiki.archlinux.org/index.php/Xdg_user_directories

gitea-mirror commented

2026-05-05 05:15:54 -06:00

Author

Owner

@derba commented on GitHub (Jan 25, 2016):

Similar issue is discussed at https://l3net.wordpress.com/2015/10/30/firejail-0-9-34-rc1-release-announcement/. See "whitelist Загрузки".

@derba commented on GitHub (Jan 25, 2016): Similar issue is discussed at https://l3net.wordpress.com/2015/10/30/firejail-0-9-34-rc1-release-announcement/. See "whitelist Загрузки".

gitea-mirror commented

2026-05-05 05:15:55 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 25, 2016):

I'll add support for all entries in XDG file. Thanks.

@netblue30 commented on GitHub (Jan 25, 2016): I'll add support for all entries in XDG file. Thanks.

gitea-mirror commented

2026-05-05 05:15:57 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 16, 2018):

@netblue30 It doesn't look like this has happened yet? Only the ${DOWNLOADS} name is supported by looking into ~/.config/user-dirs.dirs. I don't quite trust my C or I would do this myself. I could just copy the existing code for ${DOWNLOADS} and edit it for the other variables...?

@chiraag-nataraj commented on GitHub (Jul 16, 2018): @netblue30 It doesn't look like this has happened yet? Only the `${DOWNLOADS}` name is supported by looking into `~/.config/user-dirs.dirs`. I don't quite trust my C or I would do this myself. I _could_ just copy the existing code for `${DOWNLOADS}` and edit it for the other variables...?

gitea-mirror commented

2026-05-05 05:15:58 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 17, 2018):

Yes, go for it, we'll fix it later when people start complaining.

@netblue30 commented on GitHub (Jul 17, 2018): Yes, go for it, we'll fix it later when people start complaining.

gitea-mirror commented

2026-05-05 05:16:00 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Jul 17, 2018):

@chiraag-nataraj I don't trust my C well enough either, so I usually just open a PR here and ask someone to review it. 😄

@Fred-Barclay commented on GitHub (Jul 17, 2018): @chiraag-nataraj I don't trust my C well enough either, so I usually just open a PR here and ask someone to review it. :smile:

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#181

No description provided.

Rows
Columns