github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2906] How to make firejail run with executable/custom scripts in a folder? #1818

New issue

Closed

opened 2026-05-05 08:29:16 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 08:29:16 -06:00

Owner

Originally created by @MystesofEternity on GitHub (Aug 13, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2906

Hi, I would like to know how to make this work. I think I found this somewhere in the internet but wasn't able to save it, I tried scurrying through the man pages and firejail official website but I couldn't really find it.
The only alternative I could think of is adding the executable scripts' directory to the PATH but if possible I'd rather not do that

Originally created by @MystesofEternity on GitHub (Aug 13, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2906 Hi, I would like to know how to make this work. I think I found this somewhere in the internet but wasn't able to save it, I tried scurrying through the man pages and firejail official website but I couldn't really find it. The only alternative I could think of is adding the executable scripts' directory to the PATH but if possible I'd rather not do that

gitea-mirror closed this issue

2026-05-05 08:29:17 -06:00

gitea-mirror commented

2026-05-05 08:29:19 -06:00

Author

Owner

@ghost commented on GitHub (Aug 13, 2019):

@MystesofEternity Assuming you're referring to something similar to what firejail does with firecfg (placing symlinks in /usr/local/bin so users can easily activate sandboxing from CLI and via clicking in desktop managers menus), I honestly think this always needs access to a directory in your PATH.

Firecfg does offer an option to have this functionality by using a custom dir instead of /usr/local/bin (see the --bindir=directory option in man firecfg). If this is not what you're looking for, an example of what's inside your custom scripts might help.

@ghost commented on GitHub (Aug 13, 2019): @MystesofEternity Assuming you're referring to something similar to what firejail does with firecfg (placing symlinks in /usr/local/bin so users can easily activate sandboxing from CLI and via clicking in desktop managers menus), I honestly think this always needs access to a directory in your PATH. Firecfg does offer an option to have this functionality by using a custom dir instead of /usr/local/bin (see the -`-bindir=directory` option in `man firecfg`). If this is not what you're looking for, an example of what's inside your custom scripts might help.

gitea-mirror commented

2026-05-05 08:29:20 -06:00

Author

Owner

@MystesofEternity commented on GitHub (Aug 13, 2019):

@glitsj16 Thank you for your response! I'm sorry for the confusion but I suppose I should've meant executable binaries that are not part of a program installed through package managers like apt/dnf
An example of this would be the tor browser bundle downloaded directly from the website and unpacked which contains the "start-tor-browser" binary that you have to execute.
Another one would be the minecraft launcher after unpacking the tar.gz archive

Basically, I just want to know how to be able to execute these things without having to include the directories to the PATH. Though if that isn't possible, no real issue here :)

@MystesofEternity commented on GitHub (Aug 13, 2019): @glitsj16 Thank you for your response! I'm sorry for the confusion but I suppose I should've meant executable binaries that are not part of a program installed through package managers like apt/dnf An example of this would be the tor browser bundle downloaded directly from the website and unpacked which contains the "start-tor-browser" binary that you have to execute. Another one would be the minecraft launcher after unpacking the tar.gz archive Basically, I just want to know how to be able to execute these things without having to include the directories to the PATH. Though if that isn't possible, no real issue here :)

gitea-mirror commented

2026-05-05 08:29:21 -06:00

Author

Owner

@ghost commented on GitHub (Aug 13, 2019):

@MystesofEternity No worries, let's try to get you going now I understand what you're trying to achieve. You could try to sandbox tor-browser by running the below command from a terminal (exchanging /path/to/your/start-tor-browser with its actual full path on your machine):

$ firejail --ignore=quiet /path/to/your/start-tor-browser

The --ignore=quiet part isn't strictly needed here, but it gives you a crude idea of what firejail is doing. If the application runs, I would suggest playing around with a bit to test functionality. When things work as you'd like, you can leave that part out and even make a ~/.local/share/my-firejailed-tor-browser.desktop file (pick your own favo unique filename here), placing a working command in the Exec= line. That way you can run it either from CLI or from a desktop manager menu. Basically this routine can be used with any application, provided it has a corresponding firejail profile in your /etc/firejail directory with the exact same name (minus the .profile part).

I'm not familiar with playing minecraft, and I can only see a minetest.profile in our collection of profiles currently, so the above will not work (yet). There's a good chance gaming users/contributors around here can help out with that later on.

Feel free to post any output you get from running the above if things go south.

@ghost commented on GitHub (Aug 13, 2019): @MystesofEternity No worries, let's try to get you going now I understand what you're trying to achieve. You could try to sandbox tor-browser by running the below command from a terminal (exchanging /path/to/your/start-tor-browser with its actual full path on your machine): `$ firejail --ignore=quiet /path/to/your/start-tor-browser` The `--ignore=quiet` part isn't strictly needed here, but it gives you a crude idea of what firejail is doing. If the application runs, I would suggest playing around with a bit to test functionality. When things work as you'd like, you can leave that part out and even make a ~/.local/share/my-firejailed-tor-browser.desktop file (pick your own favo unique filename here), placing a working command in the `Exec=` line. That way you can run it either from CLI or from a desktop manager menu. Basically this routine can be used with any application, provided it has a corresponding firejail profile in your /etc/firejail directory with the exact same name (minus the .profile part). I'm not familiar with playing minecraft, and I can only see a `minetest.profile` in our collection of profiles currently, so the above will not work (yet). There's a good chance gaming users/contributors around here can help out with that later on. Feel free to post any output you get from running the above if things go south.

gitea-mirror commented

2026-05-05 08:29:22 -06:00

Author

Owner

@MystesofEternity commented on GitHub (Aug 13, 2019):

Thank you very much for letting me know all of that! Indeed it doesn't work as needed along with firejail but know just that is fine
Much appreciated!

@MystesofEternity commented on GitHub (Aug 13, 2019): Thank you very much for letting me know all of that! Indeed it doesn't work as needed along with firejail but know just that is fine Much appreciated!

gitea-mirror commented

2026-05-05 08:29:23 -06:00

Author

Owner

@ghost commented on GitHub (Aug 14, 2019):

@MystesofEternity In the explanation/example above I forgot to mention one important thing. If your start-tor-browser isn't in the regular system-wide location, you need to noblacklist its exact location in your $HOME dir (or wherever you placed it). This goes for other applications placed in a non-regular locations too. So the example above should have been:

$ firejail --ignore=quiet --noblacklist=/path/to/your/start-tor-browser /path/to/your/start-tor-browser

@ghost commented on GitHub (Aug 14, 2019): @MystesofEternity In the explanation/example above I forgot to mention one important thing. If your start-tor-browser isn't in the regular system-wide location, you need to `noblacklist` its exact location in your $HOME dir (or wherever you placed it). This goes for other applications placed in a non-regular locations too. So the example above should have been: `$ firejail --ignore=quiet --noblacklist=/path/to/your/start-tor-browser /path/to/your/start-tor-browser`

gitea-mirror commented

2026-05-05 08:29:24 -06:00

Author

Owner

@MystesofEternity commented on GitHub (Aug 15, 2019):

@glitsj16 Hey thanks for clearing that out! I'm glad I forgot to close this issue for that hahaha

@MystesofEternity commented on GitHub (Aug 15, 2019): @glitsj16 Hey thanks for clearing that out! I'm glad I forgot to close this issue for that hahaha

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1818

No description provided.

Rows
Columns