[GH-ISSUE #3076] Profile Updates #1928

Open
opened 2026-05-05 08:35:41 -06:00 by gitea-mirror · 8 comments
Owner

Originally created by @FOSSONLY on GitHub (Dec 9, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3076

I would like to suggest a manual or automatic update for profiles. It is noted that there are often problems with the profiles. Especially since not all users use the same versions of different programs, and the profiles per version of Firejail are usually adapted to certain program versions. By automatically updating the profiles directly via git, any adjustments to the profiles could be immediately received by the users. This could prevent typical problems with program updates. What do you think?

Originally created by @FOSSONLY on GitHub (Dec 9, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/3076 I would like to suggest a manual or automatic update for profiles. It is noted that there are often problems with the profiles. Especially since not all users use the same versions of different programs, and the profiles per version of Firejail are usually adapted to certain program versions. By automatically updating the profiles directly via git, any adjustments to the profiles could be immediately received by the users. This could prevent typical problems with program updates. What do you think?
gitea-mirror added the
enhancement
label 2026-05-05 08:35:41 -06:00
Author
Owner

@rusty-snake commented on GitHub (Dec 15, 2019):

👍 a way to get profile fixes and enhancements to debian stable for example would be great.

<!-- gh-comment-id:565790865 --> @rusty-snake commented on GitHub (Dec 15, 2019): :+1: a way to get profile fixes and enhancements to debian stable for example would be great.
Author
Owner

@FOSSONLY commented on GitHub (Dec 15, 2019):

Yeah. I mean, theoretically, anyone could do that quickly by hand. Just install git and download the profiles to "/etc/firejail". The idea was to simplify it and make it easier for beginners.

<!-- gh-comment-id:565830443 --> @FOSSONLY commented on GitHub (Dec 15, 2019): Yeah. I mean, theoretically, anyone could do that quickly by hand. Just install git and download the profiles to "/etc/firejail". The idea was to simplify it and make it easier for beginners.
Author
Owner

@rusty-snake commented on GitHub (Dec 15, 2019):

theoretically, anyone could do that quickly by hand.

You missed one point, new/changed options does not work with older firejail binaries.

Example: Debian stable has firejail 0.9.58

  • mdwe breaks all most every GNOME-APP since firejail 0.9.60
  • allow-debuggers works only with firejail master in profiles
  • the seccomp exception syntax
  • ...
<!-- gh-comment-id:565833430 --> @rusty-snake commented on GitHub (Dec 15, 2019): > theoretically, anyone could do that quickly by hand. You missed one point, new/changed options does not work with older firejail binaries. Example: Debian stable has firejail 0.9.58 - mdwe breaks all most every GNOME-APP since firejail 0.9.60 - allow-debuggers works only with firejail master in profiles - the seccomp exception syntax - ...
Author
Owner

@Vincent43 commented on GitHub (Dec 16, 2019):

Yes, there is no guarantee that newer profiles will work with older firejail so shipping those separately isn't possible atm.

<!-- gh-comment-id:566020636 --> @Vincent43 commented on GitHub (Dec 16, 2019): Yes, there is no guarantee that newer profiles will work with older firejail so shipping those separately isn't possible atm.
Author
Owner

@ghost commented on GitHub (Jan 16, 2020):

I'm not sure if all distros offer a firejail-git package like the one from AUR, but we could ask packagers to promote that if they do. I like the idea of a 'rolling-release-kind' firejail, it would offer some interesting opportunities (besides unburdening collaborators a bit regarding issues management/small profile fixes). E.g. https://github.com/netblue30/firejail/pull/3150.

<!-- gh-comment-id:575176643 --> @ghost commented on GitHub (Jan 16, 2020): I'm not sure if all distros offer a firejail-git package like the one from [AUR](https://aur.archlinux.org/packages/firejail-git/), but we could ask packagers to promote that if they do. I like the idea of a 'rolling-release-kind' firejail, it would offer some interesting opportunities (besides unburdening collaborators a bit regarding issues management/small profile fixes). E.g. https://github.com/netblue30/firejail/pull/3150.
Author
Owner

@rusty-snake commented on GitHub (May 6, 2020):

If I look now at the relnotes, IMHO it is not possible to use master profile with a stable firejail after some scripts.

<!-- gh-comment-id:624870015 --> @rusty-snake commented on GitHub (May 6, 2020): If I look now at the relnotes, IMHO it is not possible to use master profile with a stable firejail after some scripts.
Author
Owner

@matu3ba commented on GitHub (May 7, 2020):

@FOSSONLY So your proposal wants to fetch one of the release branches and adjust the paths for each distributions, because the distribution package is out of date?
Thats the job of distribution packagers.

Sadly there dont exist programs or scripts that fetch on what distribution you are and adjust the installation paths/rules for the distro accordingly, because the paths are tracked globally different on every distribution with packet managers.

Maybe you can be more specific what you want to do. Doing things for only a subset of the distributions belongs to anothet project.

<!-- gh-comment-id:625172646 --> @matu3ba commented on GitHub (May 7, 2020): @FOSSONLY So your proposal wants to fetch one of the release branches and adjust the paths for each distributions, because the distribution package is out of date? Thats the job of distribution packagers. Sadly there dont exist programs or scripts that fetch on what distribution you are and adjust the installation paths/rules for the distro accordingly, because the paths are tracked globally different on every distribution with `packet managers`. Maybe you can be more specific what you want to do. Doing things for only a subset of the distributions belongs to anothet project.
Author
Owner

@rusty-snake commented on GitHub (May 7, 2020):

Every distro I know uses /etc/firejail, that's not an issue.

<!-- gh-comment-id:625372524 --> @rusty-snake commented on GitHub (May 7, 2020): Every distro I know uses `/etc/firejail`, that's not an issue.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1928
No description provided.