github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

Downloads #1977

New issue

Closed

opened 2026-05-05 08:38:25 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 08:38:25 -06:00

Owner

Originally created by @BreakfastSerial on GitHub (Jan 15, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3146

I want to use firejail with Firefox, having a temporary home and an immutable Firefox but keep all Downloads. The use-case isn't for high-security operations, but for daily use, so --ls, --get and --put are not really viable.

I did come across the following related issues:

However none of these resulted in appropriate solutions.

I've tried the following

firejail --read-only=~/.mozilla --whitelist=~/Downloads firefox
This is also mentioned in the man page of firejail, but for me firefox isn't operable like this, as Firefox states "Firefox is already running, but is not responding. To open a new window, you must first close the existing Firefox process, or restart your system.". Even if I use Firefox with the -no-remote parameter.

firejail --private-home=~/.mozilla,~/Downloads --whitelist=~/Downloads firefox
Doesn't allow persistent Downloads.

I've tried setting Firefox to use /downloads (in the root directory) for all downloads, which doesn't seem to be a sane solution, but doesn't work anyways, as downloads fail to said directory without error message.

Is there any way to have to have my downloads directory persistent but have all other modifications discarded when the sandbox is closed?

firejail version 0.9.58.2
Mozilla Firefox 72.0.1
Ubuntu 19.10

Originally created by @BreakfastSerial on GitHub (Jan 15, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3146 I want to use firejail with Firefox, having a temporary home and an immutable Firefox but keep all Downloads. The use-case isn't for high-security operations, but for daily use, so `--ls`, `--get` and `--put` are not really viable. I did come across the following related issues: - https://github.com/netblue30/firejail/issues/3139 - https://github.com/netblue30/firejail/issues/1716 However none of these resulted in appropriate solutions. I've tried the following `firejail --read-only=~/.mozilla --whitelist=~/Downloads firefox` This is also mentioned in the man page of firejail, but for me firefox isn't operable like this, as Firefox states `"Firefox is already running, but is not responding. To open a new window, you must first close the existing Firefox process, or restart your system."`. Even if I use Firefox with the `-no-remote` parameter. `firejail --private-home=~/.mozilla,~/Downloads --whitelist=~/Downloads firefox` Doesn't allow persistent Downloads. I've tried setting Firefox to use `/downloads` (in the root directory) for all downloads, which doesn't seem to be a sane solution, but doesn't work anyways, as downloads fail to said directory without error message. Is there any way to have to have my downloads directory persistent but have all other modifications discarded when the sandbox is closed? firejail version 0.9.58.2 Mozilla Firefox 72.0.1 Ubuntu 19.10

gitea-mirror

2026-05-05 08:38:25 -06:00

closed this issue
added the
question_old
label

gitea-mirror commented

2026-05-05 08:38:28 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 15, 2020):

but for me firefox isn't operable like this, as Firefox states "Firefox is already running, but is not responding. To open a new window, you must first close the existing Firefox process, or restart your system.". Even if I use Firefox with the -no-remote parameter.

With an ro profile this seems reasonable to me.

Is there any way to have to have my downloads directory persistent but have all other modifications discarded when the sandbox is closed?

untested idea:
firejail --profile=firefox --read-only='${HOME}/.mozilla' firefox --no-remote --ProfileManager
Create a new profile in /tmp (private-tmp).

@rusty-snake commented on GitHub (Jan 15, 2020): > but for me firefox isn't operable like this, as Firefox states "Firefox is already running, but is not responding. To open a new window, you must first close the existing Firefox process, or restart your system.". Even if I use Firefox with the -no-remote parameter. With an ro profile this seems reasonable to me. > Is there any way to have to have my downloads directory persistent but have all other modifications discarded when the sandbox is closed? untested idea: `firejail --profile=firefox --read-only='${HOME}/.mozilla' firefox --no-remote --ProfileManager` Create a new profile in /tmp (`private-tmp`).

gitea-mirror commented

2026-05-05 08:38:28 -06:00

Author

Owner

@BreakfastSerial commented on GitHub (Jan 15, 2020):

Thank you for your input.

I've tried the following: firejail --profile=firefox --read-only='${HOME}/.mozilla' firefox -P "custom-user". This resulted in persistent downloads (in ~/Downloads) but also in persistent changes for Firefox! The browser history was written and add-ons changes were stored.

edit: Sorry I've missed the part with the new Firefox profile in /tmp. This seems to increase overhead, every time I start Firefox. If possible, I'd have my fixed Firefox profile, which I prepared outside of firejail and use that "read-only".

@BreakfastSerial commented on GitHub (Jan 15, 2020): Thank you for your input. I've tried the following: `firejail --profile=firefox --read-only='${HOME}/.mozilla' firefox -P "custom-user"`. This resulted in persistent downloads (in ~/Downloads) but also in persistent changes for Firefox! The browser history was written and add-ons changes were stored. edit: Sorry I've missed the part with the new Firefox profile in `/tmp`. This seems to increase overhead, every time I start Firefox. If possible, I'd have my fixed Firefox profile, which I prepared outside of firejail and use that "read-only".

gitea-mirror commented

2026-05-05 08:38:29 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jan 15, 2020):

I don't think firefox can function without being able to write into its config. You could use firejail --overlay-tmpfs --ignore=private-tmp firefox, download things to /tmp and move them somewhere else manually.

@Vincent43 commented on GitHub (Jan 15, 2020): I don't think firefox can function without being able to write into its config. You could use `firejail --overlay-tmpfs --ignore=private-tmp firefox`, download things to `/tmp` and move them somewhere else manually.

gitea-mirror commented

2026-05-05 08:38:31 -06:00

Author

Owner

@BreakfastSerial commented on GitHub (Jan 16, 2020):

That sounds like it would be a reasonable trade-off between usability and security! I'll give it a try, thank you!

@BreakfastSerial commented on GitHub (Jan 16, 2020): That sounds like it would be a reasonable trade-off between usability and security! I'll give it a try, thank you!

gitea-mirror commented

2026-05-05 08:38:32 -06:00

Author

Owner

@dpellegr commented on GitHub (Oct 16, 2020):

Hello,

I am in a similar situation where I need a temporary folder and a persistent folder, both writable from the sandbox.

Unfortunately the workaround proposed by @Vincent43 does not work for me. Indeed am using --private-tmp to store stuff which should be isolated between multiple sandboxes. In addition, as the persistent folder is used for logs (which are continuously written), it would really be better to have them in place, instead of having to periodically synchronize them, with chances of loosing (part of) them.

It doesn't seem conceptually difficult, but I am lost in the myriad of options... Any idea?

@dpellegr commented on GitHub (Oct 16, 2020): Hello, I am in a similar situation where I need a temporary folder and a persistent folder, both writable from the sandbox. Unfortunately the workaround proposed by @Vincent43 does not work for me. Indeed am using `--private-tmp` to store stuff which should be isolated between multiple sandboxes. In addition, as the persistent folder is used for logs (which are continuously written), it would really be better to have them in place, instead of having to periodically synchronize them, with chances of loosing (part of) them. It doesn't seem conceptually difficult, but I am lost in the myriad of options... Any idea?

gitea-mirror commented

2026-05-05 08:38:32 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 20, 2020):

For now you maybe can use --private-cache, which makes ~/.cache a tmpfs. In the future: #3676.

@rusty-snake commented on GitHub (Oct 20, 2020): For now you maybe can use `--private-cache`, which makes ~/.cache a tmpfs. In the future: #3676.

gitea-mirror referenced this issue

2026-05-05 10:14:34 -06:00

[PR #1977] [MERGED] Fix installing skins on qmmp.profile #4144

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1977

No description provided.

Rows
Columns