mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3191] How to configure applications to automatically go through firejail? #1995
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1995
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Joe23232 on GitHub (Jan 28, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3191
I wanted to know how do I configure certain applications to go through firejail, even through the launcher, for example if on KDE, if I click on
firefox, I want it to open through firejail, how do I configure this?@smitsohu commented on GitHub (Jan 28, 2020):
Create a symbolic link:
sudo ln -s /usr/bin/firejail /usr/local/bin/firefoxYou may also want to take a look at
man 1 firecfg@Joe23232 commented on GitHub (Jan 28, 2020):
How does it get firefox to run through firejail if I launched it through KDE? I just want to understand this better.
@smitsohu commented on GitHub (Jan 28, 2020):
It works because on your system
/usr/local/binprecedes/usr/binin the PATH environment variable. This way, if you typefirefoxin bash or click an icon in the desktop manager of your choice, what is executed is not /usr/bin/firefox but /usr/local/bin/firefox -> /usr/bin/firejail. Then Firejail learns about the original command by looking at the command line parameters, or argv[0] more specifically. That's the magic!@ghost commented on GitHub (Jan 28, 2020):
Programs implement default application associations in different ways. While command-line programs traditionally use environment variables, graphical applications - or GUI apps - tend to use the XDG MIME Applications specification. This is a common Linux standard (a convention) using .desktop files in
/usr/share/applicationsto deliver the 'magic'. It also offers a per-user location to over-ride what is in that system-wide path:~/.local/share/applications. These .desktop files contain instructions on how to execute a specific application.If you take a look inside, you'll notice an 'Exec=blahblah' line, e.g. 'Exec=firefox %U', which in human-speak means "start Firefox by executing the command 'firefox', and append whatever text string follows" - a URL in this context. Easy peasy, let's hit it already - I hear you think. But wait, there's a problem to be solved first. What happens when there are several commands on the system called 'firefox'? Where exactly can we find all these, and decide which one to actually execute?
Machines can figure this all out and solve the problem by - you guessed it - relying on another (set of) standard convention(s). The relevant one in this context being
PATH: a limited set of possible locations where executable files can be found. You can check what your OS has predefined by running the below in a terminal:Like hordes of hungry beasts, machines start scanning through this collection of predefined locations, eagerly looking for something to execute. No matter how fast (or slow) this happens, this process seems to follow the same 'internal logic': let's not waste too much resources here and always execute the command from whatever location we find first so we can move on and take a rest already.
Scanning stops, beasts happily tiptoe off to greener, shadier pastures and, whammo, a new thingie appears that looks like we can actually use it to surf that WWW everybody is on about! In the grand order of things, hopefully
/usr/local/bin/firefoxis found first, hence executed. By creating symbolic links under a location - /usr/local/bin - that precedes other usual suspects - /usr/bin - firejail is able to ensure that your application - firefox - will now be sandboxed. Ugh!@Joe23232 commented on GitHub (Jan 29, 2020):
I see, so like since firejail knows that the link is named as
firefox, therefore it will know to open up firefox, am I correct?Through firetools I configured firefox to not have access to the Desktop's files and it does work fine when I launch firefox either by firejail or firetools. However after adding the symblink in the specified directory, when I launch firefox through KDE's start menu, I can still access the Desktop's files. Is there a way to fix this?
@ghost commented on GitHub (Jan 29, 2020):
Correct.
It might be a conflict between firetools and firecfg if you previously also tried that, not 100% sure. I'd recommend sticking to one of the GUI tools to avoid clashes. Just try using your favorite GUI tool to undo all changes you've made so far and start afresh. That can also be achieved thru a file manager or in a terminal (so CLI). Be careful not to remove something from ~/.local/share/applications that you put there yourself (and isn't related to firejail). Making a quick local backup of that path is always a good idea. It will enable you to experiment with firejail and related GUI tools without having to worry about making unrecoverable changes to your system. Please contact us here again if fixing this doesn't work as expected.
@Joe23232 commented on GitHub (Jan 30, 2020):
@glitsj16
I haven't used firecfg. I only used firetools to change firefox's permission.
Is there something alternative to firetools?
What am I supposed to remove though to start fresh?
@ghost commented on GitHub (Jan 30, 2020):
In that case the problem with firefox must be something else. If you could post details here about your firejail and firetools version, files created by firetools in ~/.config/firejail/ to customize firefox and the content of ~/.local/share/applications/firefox.desktop we can determine what is going wrong. Let's not remove anything yet. We can tackle that later.
@Joe23232 commented on GitHub (Jan 30, 2020):
Hmm strange, surprisingly when I typed
cd ~/.config/firejail/and then typedlsthefirejailfile does not even exist, but there is afirejail-uirc, do you want me to post contents in that file instead?Also in
~/.local/share/there is noapplicationsdirectory. I am using Arch Linux (EndeavourOS) so is the directory structure different or something?@ghost commented on GitHub (Jan 30, 2020):
Ah, yes do post that
firejail-uircfile, I've not used firetools before so that would be interesting to see. While your at it, also post output of$ ls -lA /usr/local/binNo I think it simple means firetools isn't using that directory to locally override /usr/share/applications.
@Joe23232 commented on GitHub (Jan 30, 2020):
@glitsj16 Under the
firejail-uircfile.After executing
ls -lA /usr/local/binI get this.Oh I see.
So is there something I can do to fix this problem that I am having?
@ghost commented on GitHub (Jan 30, 2020):
Did some more research on firetools. Apparently it uses
~/.config/firetoolsto store files. So you should have a firefox related file under that dir that you can post here.@Joe23232 commented on GitHub (Jan 30, 2020):
Ok so under
~/.config/firetoolsI have this filefstats.configand when I output the file's content I get this.So what does this mean?
@ghost commented on GitHub (Jan 30, 2020):
Looks like window size dimensions. Nothing profile related at least. Is that the only file in that dir?
@Joe23232 commented on GitHub (Jan 30, 2020):
Ok so I typed
ls -laand here is the output.Why does it say
total 12what does that mean?@ghost commented on GitHub (Jan 30, 2020):
That's directory information. In the manual page of the 'ls' command (man ls) you can find detailed explanations. But again, nothing helpful to fix your issue. Let me suggest something. For now, close the firetools GUI and disable it from autostarting. We will temporarily use the firecfg command to create the necessary files and I'll explain how you can get the same settings for firefox to not show specific files you want to keep out of the sandbox in a minute. Using firecfg will ensure your applications are getting sandboxed, no matter how/which desktop environment you decide to use. It's the firejail native tool to do so. Up for it?
@Joe23232 commented on GitHub (Jan 30, 2020):
How do I disable it from autostarting?
Thanks mate I am up for it. I will just run
firecfg, is that what you want me to do right now?Should I remove
firefoxfrom/usr/local/bin?@ghost commented on GitHub (Jan 30, 2020):
To disable firetools from autostarting when you boot your machine you should have 2 options. Either find a setting in the GUI itself to do so. Or open ~/.config/autostart/firetools.desktop and show the content here.
@Joe23232 commented on GitHub (Jan 30, 2020):
This file doesn't appear to exist
~/.config/autostart/firetools.desktopShould I remove
firefoxfrom/usr/local/bin?@ghost commented on GitHub (Jan 30, 2020):
OK. Proceed with running the commands below.
Start by cleaning firejail symlinks first, that will take care of firefox symlink as well as any others you might have.
$ sudo firecfg --clean
Next, set up symlinks and desktop files
$ sudo firecfg
@Joe23232 commented on GitHub (Jan 30, 2020):
Ok done that, now what do I do now?
@ghost commented on GitHub (Jan 30, 2020):
$ firecfg --list
@Joe23232 commented on GitHub (Jan 30, 2020):
This is the output I got when I ran
sudo firecfgThere appears to be an error@ghost commented on GitHub (Jan 30, 2020):
The error you see is AppArmor related. What kernel is your EndeavourOS using? Type 'uname -r' to find out.
@Joe23232 commented on GitHub (Jan 30, 2020):
Does firejail use apparmor?
This is the output I get after running
uname -r5.4.15-arch1-1@ghost commented on GitHub (Jan 30, 2020):
OK, the stock arch linux kernel, which is fine.
$ firejail --version
@Joe23232 commented on GitHub (Jan 30, 2020):
I ran it
@ghost commented on GitHub (Jan 30, 2020):
To test if AppArmor has been correctly enabled:
$ aa-enabled
@Joe23232 commented on GitHub (Jan 30, 2020):
After running it
No - disabled at boot.@ghost commented on GitHub (Jan 30, 2020):
OK, that's something you will need to fix later. Follow the Arch wiki page instructions at https://wiki.archlinux.org/index.php/AppArmor. But don't do that just yet. It needs a reboot and to avoid several reboots we are going to test your firefox first. Close all running instances of the browser and start a new one:
$ firejail --ignore=quiet firefox
And check if you see directories/files in the 'Open File' dialog that you would like to hide in the sandbox like you mentioned earlier.
@ghost commented on GitHub (Jan 30, 2020):
Take your time. As we seem to be in a chat-like communication right now, we'll get things sorted shortly. Just ask and/or describe anything that looks weird when you use your Firefox as usual. I'm on babysit backup this afternoon, but it looks as if I can stay online here to guide you thru this. I'll let you know if that changes.
@Joe23232 commented on GitHub (Jan 30, 2020):
Thanks for the link I will try it out later as you said.
Unfortunately I had to do a force shutdown as my system became completely laggy and unsable when running firefox via the specified command.
Ok so after running
firejail --ignore=quiet firefoxagain, and it appears that I can't access theDesktopfiles.Oh I see mate, sorry for taking so long to respond as mentioned earlier my system just screwed up on me. By the way I am using a virtualbox as I just want to test things out before I put all this on my real machine.
@ghost commented on GitHub (Jan 30, 2020):
No problem. That's a wise thing to do actually!
So, after shutting down firefox again, try to test your (KDE) menus, desktop icons and other ways you have on your system to start Firefox to see if they all work properly and firejailed. The latter you can always check via
$ firejail --tree
You should see a firefox entree in the list. If you do you're allright.
@Joe23232 commented on GitHub (Jan 30, 2020):
A few days back for some weird reason KDE completely screwed up and showed absolutely nothing after running
firecfgand after when I logged out. I am not too sure if it was because offirecfgor it was to do with how I was messing around with the themes. So I had to reinstall EndeavourOS.I closed firefox and I opened it via the start menu on KDE and surprisingly I can't access any files on the Desktop.
I did that but i don't see any firefox entry. Here is the output.
Strange is there something wrong with how it is being sandboxed?
@ghost commented on GitHub (Jan 30, 2020):
Let's see what happened. After running the previous 'sudo firecfg' command, it reported creating /home/test/.local/share/applications/firefox.desktop (see your output posted above). Can you post the content of that file?
@Joe23232 commented on GitHub (Jan 30, 2020):
Oh I see
Yeah sure mate
@ghost commented on GitHub (Jan 30, 2020):
What is your $PATH?
$ echo $PATH
Let's unclutter that file a bit to make it easier to read. Replace the content with the below.
@Joe23232 commented on GitHub (Jan 30, 2020):
/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perlSo you want me to
nanointo that file and replace the content and put this content in instead, is that what you mean? What will change if I replace the contents other than the readability?@ghost commented on GitHub (Jan 30, 2020):
PATH looks fine, stock Arch output.
Correct. Other than readability I took out the '# converted by firecfg' line and changed the 'Exec=...' lines. The former should protect the file from being overwritten by future 'sudo firecfg' runs. We have some issues reported on that not working well for certain applications. The latter means taking manual control to ensure your Firefox will always run sandboxed now. At least that's what it should do once you make the edits in nano. So proceed with the edits and test your Firefox browser start routines again, double-checking with the 'firejail --tree' command to confirm it is actually sandboxed now.
Don't worry about changing the content. If this doesn't fix your firefox you can always remove that file and regenerate it by running 'sudo firecfg' again. Apologies for editing/updating my comments here. It could help others that look thru the issues here in the future.
@Joe23232 commented on GitHub (Jan 30, 2020):
Oh ok nice.
Do I have to do this to replace all the
*.desktop's file's contents and add what you have specified?What does the
firefox.desktopfile do anyways, and what happens when it is overwritten? Isn't the same information being overwritten to the same file?One error, for some weird reason I can make changes using
nanobut when I am using a text editor (calledkate) if I save a change it does not allow me and shows me this error message.Additionally I did change the write permissions and allowed the file to be written by any user and the same issue still persists.
The reason why I am not using
nanois cause how do I highlight all the texts?@Joe23232 commented on GitHub (Jan 30, 2020):
Sorry I have to go for now I will be available in around 10 hours time. Thanks for all your help :)
@ghost commented on GitHub (Jan 30, 2020):
I'll add a comment explaining a few things regarding your prior comment and what to do next etcetera. We can pick this up again later. Glad to help.
@ghost commented on GitHub (Jan 30, 2020):
No. In fact it shouldn't be needed at all. But due to some firecfg issues (see e.g. #3179) that are still not fixed or in-progress you currently need this workaround. If you notice any other of your installed applications not getting sandboxed properly (via 'firejail --tree') this routine is a way to take manual control and (try to) fix things.
Like @smitsohu and myself explained in the beginning of this thread, the
firefox.desktopfile instructs your OS which command to execute (which additional arguments when specified) and - by explicitly specifying 'Exec=firejail firefox ...' - guarantee running all your supported applications through firejail. Taking out that '# converted by firecfg' line is a safeguard against future overwrites by running 'sudo firecfg', which would regenerate another 'broken' desktop file for firefox in this case. Annoying, but hopefully the firecfg tool will be fixed soon and situations like these become unnecessary.The 'weird' reason here is actually firejail itself :) In the list you posted in https://github.com/netblue30/firejail/issues/3191#issuecomment-580224583 you can see 'kate created'. That means that your 'kate' editor is now being run through firejail (as are all the applications listed in that output).
Changing file permissions (outside the sandbox on your real filesystem) won't help here. The 'problem' is that the default /etc/firejail/kate.profile contains 'include disable-common.inc', which in turn has
read-only ${HOME}/.local/share/applications(see lines 304-307 of /etc/firejail/disable-common.inc). So 'kate' - being unaware it is being run through firejail - tries to write into a location that is read-only inside the sandbox, fails to do so and shows an error window.This is all 'standard' firejail behaviour: restrict a profile as much as possible while keeping it reasonably functional for the user. You will have to get used to being in control, believe it or not :). It is you - as the firejail user - that has to decide if/when/how to make changes to these defaults as specified in the profiles under /etc/firejail. Not that firejail is trying to shift blame or responsibility for something not working as expected into your shoes, or anything of the sort. Quite the contrary IMHO. Purposely designing things this way forces users to being more aware of how their specific setup uses the firejail sandboxing techniques and not lull them into a false 'install and forget' kind of security disaster. After all, firejail is just another set of tools. Luckily it tries to be (self-)aware of this and provides a convention to use overrides via
.localfiles.If you decide to keep using 'kate' firejailed and want to allow it saving files under ~/.local/share/applications you have 2 options. Either create
/etc/firejail/kate.localor~/.config/firejail/kate.local. The former is a system-wide override - affecting all firejail users on your system, the latter a per-user override - only affecting your specific user ID account.To be honest I don't know that OTOH. Manual pages and internet searches to the rescue...
@ghost commented on GitHub (Jan 30, 2020):
To conclude our session for today, here are 2 reminders.
firetoolsfrom autostarting (you can decide later to remove it with pacman and use firecfg instead - or keep it and set it up for autostart by changing 'false' to 'true' in the third line below)see https://wiki.archlinux.org/index.php/AppArmor
Enjoy experimenting!
@Joe23232 commented on GitHub (Jan 31, 2020):
@glitsj16
Hopefully it gets fixed soon.
Oh sorry I should have read it again.
Oh I get it lol.
I understand, I just didn't realise
katewas being sandboxed.Is there a way to use
firecfgto specify which applications should get sandboxed? Because I don't want to sandbox all applications, just the ones that I specify?@ghost commented on GitHub (Jan 31, 2020):
No, in its current design firecfg doesn't allow that functionality. More granular control has been requested before, see #3016. I remembered showing a custom script in that issue, which still works fine, but depends heavily on your workflow. Maybe using https://github.com/rahiel/firectl instead of firecfg is the way to go for you in that case.
@Joe23232 commented on GitHub (Jan 31, 2020):
@glitsj16
I did a
sudo firecfg --cleanto clear out all the files from being sandboxed.I installed
firectlviayay -S firectl(sincefirectlwas not in the official archlinux repository) and installed it. Firefox seems to get sandboxed but with chromium (I instealled chromium after runningfirecfgand runningsudo firecfg --clean) and chromium does not get sandboxed at all when I typedsudo firectl enable chromium.I ran
firectl statusand I get this output.through firejail chromium is being sandboxed which is good but not through
firectland when I launch it through KDE.I am not too sure why chromium is not working?
@ghost commented on GitHub (Jan 31, 2020):
Can you post the current content of /usr/share/applications/chromium.desktop please?
As I understand it,
firectlprepends "firejail" to the Exec line of the system-wide desktop files. So you need to make absolutely sure there are no overlapping .desktop files with the same name in your~/.local/share/applicationsdirectory. Perhapsfirecfgdidn't clean everything there. Check that path, remove every .desktop file and try to usefirectlagain to disable/enable what you want.I've started work on a
firecfg-ng(firecfg next-generation) to avoid all this messy, headache-inducing stuff. It will have disable/enable functionality cfr. firectl, as well as fixes for all currently known/reported firecfg bugs and issues. This will take a while, but I wanted to inform you nonetheless.On a similar note, if your list of applications you always want to be firejailed isn't too long, I suggest you drop tools like firectl/firecfg completely and setup symlinks (in /usr/local/bin) and edited .desktop files (in ~/.local/share/applications) yourself manually. In the end that looks to be the more manageable solution to all this IMHO. And even when the list is long(er), doing the work manually and keeping a file with info of what you always run through firejail isn't that complicated. It's what I've been doing ever since starting to use firejail for what that's worth...
@rusty-snake commented on GitHub (Jan 31, 2020):
I started a firecfg.py, maybe we should collaborate to avoid duplicated work.
@Joe23232 commented on GitHub (Jan 31, 2020):
@glitsj16
Sure mate.
Where could all the *.desktop files be located?
I am having issues with chromium. After running
sudo firecfg --cleanandrm firefox.desktopin this directory~/.local/share/applicationsand after runningsudo firectl enable chromiumit does get sandboxed but even if I disable it chromium is still being sandboxed.Oh nice I hope it works out :)
I could try that but what do I put inside the *.desktop file?
I wish I could help you out but I have basic programming skills, unless if this is easy to code?
@rusty-snake commented on GitHub (Jan 31, 2020):
Working way to fix .desktop files: https://gist.github.com/rusty-snake/3e4b8f8555e942d2964a181d4a5f64a0#file-firecfg-py
@ghost commented on GitHub (Jan 31, 2020):
@rusty-snake Yeah, I saw your nice Python script, works fine on a test sample for me. And I would definately like to collaborate on this firecfg mess. Give me a day to do some more extensive testing and I'll keep everybody informed on firecfg-ng in #2624 . For now it is just a simple
shellscript wrapper around firecfg, building on what I added to the discussion in #3016. I opted for a shell script becauseAllthough I really like your script, IMHO doing it in Python might hinder acceptance due to dependency decisions or keep it in contrib forever, both of which wouldn't serve the main goal here: to unbreak firecfg for regular users. Obviously the best solution would be to fix the
Ccode in firecfg itself. None of the more capable C coders here seem to have an interest, are not yet aware of firecfg's broken state or simply don't have the time to do all work. This is not a critique, just a personal observation on the current situation. I do understand there's plenty of other work to be done on the C codebase to keep busy for a while :)@ghost commented on GitHub (Jan 31, 2020):
@Joe23232
Under ~/.local/share/applications.
The /usr/share/applications/chromium.desktop file looks fine to me. It has all the necessary 'Exec=' lines pointing to 'firejail /usr/bin/chromium', which is the way firectl works. I don't know why your chromium is still being sandboxed after disabling it in firectl. Unless there's still a ~/.local/share/applications/chromium.desktop on your system. If it is, take it out, together with any lingering firejail symlinks in /usr/local/bin.
You can always use @rusty-snake's script too as he suggested. I didn't want to confuse your situation even more by adding another alternative to using firecfg and firectl :).
@rusty-snake commented on GitHub (Jan 31, 2020):
@glitsj16 as a very first preview:
6f210201c5My goal about dependencies is to only require python3.6 (or what ever python version it will end). No pip, no other third-party python packages, the standart librarys are big enough.
Reasons for the python decision
or as own project forever ;)
@ghost commented on GitHub (Jan 31, 2020):
@rusty-snake Thanks for the link and clarifying your reasons to go with Python. I wouldn't mind such a dependency being added to firejail, we have other Pythons in contrib. But I'm not a package manager :). It was a long day for me and I need a break. I'll keep you informed on the firefox-ng script, should be able to put something out during the weekend.
@Joe23232 commented on GitHub (Feb 3, 2020):
Sure mate, but is @rusty-snake's script stable? Or is it still in testing phase?
@Joe23232 commented on GitHub (Feb 3, 2020):
@rusty-snake Just out of curiosity, if you used Rust instead of Python, would it run faster the script that you are writing?
@rusty-snake commented on GitHub (Feb 3, 2020):
Stable: https://gist.github.com/rusty-snake/3e4b8f8555e942d2964a181d4a5f64a0
sudo firecfg).KEEP_EXISTING = True(L51).Prieview (do not use): https://github.com/rusty-snake/firecfg.py/tree/0.0.0-preview
Sure. However, there are more python developers in the world (and in the firejail community) and my intention was no one man show. The python version runs in under one second and firecfg is usually only executed after installing/removing software.
@Joe23232 commented on GitHub (Feb 3, 2020):
But
firecfgstill has bugs right?This is the next updated version of
firecfg, right?@rusty-snake commented on GitHub (Feb 3, 2020):
Yes, that's only an alternative for
firecfg --fixNope, currently this is just a personal project from me. Maybe it will replace firecfg in the future if wished or is shipped with the C-firecfg / in contrib.
@Joe23232 commented on GitHub (Feb 5, 2020):
@rusty-snake
Oh ok so everytime I want to contain a program I have to run
firecfg --fix, right?Is this ready to use by any chance? If so I just have to build it and it will work, right?
@rusty-snake commented on GitHub (Feb 8, 2020):
If you install/remove software with a firejail profile you should run
sudo firecfgwhich will create/remove the symlinks and fix the desktop-files if necessary.Give it some time ;)
@rusty-snake commented on GitHub (Apr 1, 2020):
I'm closing here due to inactivity, please fell free to reopen if you have more questions.
@Joe23232 commented on GitHub (Apr 1, 2020):
For some weird reason I didn't get your notification or something, sorry I forgot to respond to it if I did :)