[GH-ISSUE #3215] Clicking an URL in Dino launches Firefox with new profile

gitea-mirror commented

2026-05-05 08:40:53 -06:00

Owner

Originally created by @ericschdt on GitHub (Feb 9, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3215

As Dino has the same issues, I tried the same solution as in https://github.com/netblue30/firejail/issues/2892, i.e. I added

noblacklist ${HOME}/.cache/mozilla 
noblacklist ${HOME}/.mozilla 
whitelist ${HOME}/.cache/mozilla/firefox 
whitelist ${HOME}/.mozilla

to dino.profile, but now I only see the Firefox Icon at the mouse cursor and after a few seconds it vanishes and that's it.

Then I tried to add
include firefox-common.profile and private-bin firefox as well, but with no improvements overall.

Any idea?

Originally created by @ericschdt on GitHub (Feb 9, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3215 As Dino has the same issues, I tried the same solution as in https://github.com/netblue30/firejail/issues/2892, i.e. I added ``` noblacklist ${HOME}/.cache/mozilla noblacklist ${HOME}/.mozilla whitelist ${HOME}/.cache/mozilla/firefox whitelist ${HOME}/.mozilla ``` to `dino.profile`, but now I only see the Firefox Icon at the mouse cursor and after a few seconds it vanishes and that's it. Then I tried to add `include firefox-common.profile` and `private-bin firefox` as well, but with no improvements overall. Any idea?

gitea-mirror closed this issue

2026-05-05 08:40:54 -06:00

gitea-mirror commented

2026-05-05 08:40:56 -06:00

Author

Owner

@ericschdt commented on GitHub (Feb 9, 2020):

Current dino.profile:

# Firejail profile for dino
# Description: Modern XMPP Chat Client using GTK+/Vala
# This file is overwritten after every install/update
# Persistent local customizations
include dino.local
# Persistent global definitions
include globals.local

noblacklist ${HOME}/.local/share/dino

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc

mkdir ${HOME}/.local/share/dino
whitelist ${HOME}/.local/share/dino
whitelist ${HOME}/.local/share/dino/files
whitelist ${DOWNLOADS}
include whitelist-common.inc

# Firefox
noblacklist ${HOME}/.cache/mozilla 
noblacklist ${HOME}/.mozilla 
noblacklist ${HOME}/.mozilla/firefox
whitelist ${HOME}/.cache/mozilla
whitelist ${HOME}/.mozilla
whitelist ${HOME}/.mozilla/firefox
include firefox-common.profile


caps.drop all
netfilter
no3d
nodvd
nogroups
nonewprivs
noroot
nosound
notv
nou2f
novideo
protocol unix,inet,inet6
seccomp
shell none

disable-mnt
#private-bin dino,gio-launch-desktop,gwenview
private-bin gpgsm,gpg,gpgconf,gwenview,gio-launch-desktop,dino,bash,firejail,firefox
private-dev
# private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl -- breaks server connection
private-tmp

@ericschdt commented on GitHub (Feb 9, 2020): Current dino.profile: ``` # Firejail profile for dino # Description: Modern XMPP Chat Client using GTK+/Vala # This file is overwritten after every install/update # Persistent local customizations include dino.local # Persistent global definitions include globals.local noblacklist ${HOME}/.local/share/dino include disable-common.inc include disable-devel.inc include disable-exec.inc include disable-interpreters.inc include disable-passwdmgr.inc include disable-programs.inc mkdir ${HOME}/.local/share/dino whitelist ${HOME}/.local/share/dino whitelist ${HOME}/.local/share/dino/files whitelist ${DOWNLOADS} include whitelist-common.inc # Firefox noblacklist ${HOME}/.cache/mozilla noblacklist ${HOME}/.mozilla noblacklist ${HOME}/.mozilla/firefox whitelist ${HOME}/.cache/mozilla whitelist ${HOME}/.mozilla whitelist ${HOME}/.mozilla/firefox include firefox-common.profile caps.drop all netfilter no3d nodvd nogroups nonewprivs noroot nosound notv nou2f novideo protocol unix,inet,inet6 seccomp shell none disable-mnt #private-bin dino,gio-launch-desktop,gwenview private-bin gpgsm,gpg,gpgconf,gwenview,gio-launch-desktop,dino,bash,firejail,firefox private-dev # private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl -- breaks server connection private-tmp ```

gitea-mirror commented

2026-05-05 08:40:57 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 9, 2020):

noblacklist must come before blacklist.

=> Move you firefox block over the include disable-*-block.

@rusty-snake commented on GitHub (Feb 9, 2020): `noblacklist` **must** come before `blacklist`. => Move you firefox block over the `include disable-*`-block.

gitea-mirror commented

2026-05-05 08:40:58 -06:00

Author

Owner

@ericschdt commented on GitHub (Feb 9, 2020):

Done and restarted dino but the issue persists.

@ericschdt commented on GitHub (Feb 9, 2020): Done and restarted dino but the issue persists.

gitea-mirror commented

2026-05-05 08:40:59 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 9, 2020):

Is firefox running when you try to open links? Is anything in the journal?

If firefox is not already running, it is started in the sandbox. But the dino profile is to restrictive to start firefox.

@rusty-snake commented on GitHub (Feb 9, 2020): Is firefox running when you try to open links? Is anything in the journal? If firefox is not already running, it is started in the sandbox. But the dino profile is to restrictive to start firefox.

gitea-mirror commented

2026-05-05 08:40:59 -06:00

Author

Owner

@ericschdt commented on GitHub (Feb 9, 2020):

Is firefox running when you try to open links?

Firefox is already running.

Is anything in the journal?

You mean journalctl -fa? Nope, or where should I look?
Also firejail --debug dino does not give a hint when I click a link.

Here's the Dino debug log: dino_debug.log

@ericschdt commented on GitHub (Feb 9, 2020): > Is firefox running when you try to open links? Firefox is already running. > Is anything in the journal? You mean `journalctl -fa`? Nope, or where should I look? Also `firejail --debug dino` does not give a hint when I click a link. Here's the Dino debug log: [dino_debug.log](https://github.com/netblue30/firejail/files/4177123/dino_debug.log)

gitea-mirror commented

2026-05-05 08:41:00 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 9, 2020):

For me firejail firefox-wayland --new-tab example.com is broken, can you try this also on your system. If this does not work, the issue isn't in the dino profile.

@rusty-snake commented on GitHub (Feb 9, 2020): For me `firejail firefox-wayland --new-tab example.com` is broken, can you try this also on your system. If this does not work, the issue isn't in the dino profile.

gitea-mirror commented

2026-05-05 08:41:00 -06:00

Author

Owner

@ericschdt commented on GitHub (Feb 9, 2020):

I'm not on wayland, but under X11 firejail firefox --new-tab example.com works for me.

firejail firefox --new-tab example.com
Reading profile /home/user/.config/firejail/firefox.profile
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /home/user/.config/firejail/firefox-common.profile
Reading profile /home/user/.config/firejail/firefox-common-addons.inc
Reading profile /etc/firejail/allow-python3.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 5737, child pid 5738
12 programs installed in 46.96 ms
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Post-exec seccomp protector enabled
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 295.59 ms

Parent is shutting down, bye...

@ericschdt commented on GitHub (Feb 9, 2020): I'm not on wayland, but under X11 `firejail firefox --new-tab example.com` works for me. ``` firejail firefox --new-tab example.com Reading profile /home/user/.config/firejail/firefox.profile Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /home/user/.config/firejail/firefox-common.profile Reading profile /home/user/.config/firejail/firefox-common-addons.inc Reading profile /etc/firejail/allow-python3.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 5737, child pid 5738 12 programs installed in 46.96 ms Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Post-exec seccomp protector enabled Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Child process initialized in 295.59 ms Parent is shutting down, bye... ```

gitea-mirror commented

2026-05-05 08:41:01 -06:00

Author

Owner

@ericschdt commented on GitHub (Feb 9, 2020):

Not sure what actually did it, but Dino seems to be pretty happy with the following profile

# Firejail profile for dino
# Description: Modern XMPP Chat Client using GTK+/Vala
# This file is overwritten after every install/update
# Persistent local customizations
include dino.local
# Persistent global definitions
include globals.local

# Dino
noblacklist ${HOME}/.local/share/dino

# Firefox
noblacklist ${HOME}/.cache/mozilla 
noblacklist ${HOME}/.mozilla 
noblacklist ${HOME}/.mozilla/firefox
whitelist ${HOME}/.cache/mozilla
whitelist ${HOME}/.mozilla
whitelist ${HOME}/.mozilla/firefox
include firefox-common.profile

# disable-*
include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc

# Dino specific
mkdir ${HOME}/.local/share/dino
whitelist ${HOME}/.local/share/dino
whitelist ${HOME}/.local/share/dino/files
whitelist ${DOWNLOADS}

caps.drop all
netfilter
no3d
nodvd
nogroups
nonewprivs
noroot
nosound
notv
nou2f
novideo
protocol unix,inet,inet6
seccomp
shell none

disable-mnt
private-bin gpgsm,gpg,gpgconf,gwenview,gio-launch-desktop,dino,bash,firejail
private-dev
private-tmp

@ericschdt commented on GitHub (Feb 9, 2020): Not sure what actually did it, but Dino seems to be pretty happy with the following profile ``` # Firejail profile for dino # Description: Modern XMPP Chat Client using GTK+/Vala # This file is overwritten after every install/update # Persistent local customizations include dino.local # Persistent global definitions include globals.local # Dino noblacklist ${HOME}/.local/share/dino # Firefox noblacklist ${HOME}/.cache/mozilla noblacklist ${HOME}/.mozilla noblacklist ${HOME}/.mozilla/firefox whitelist ${HOME}/.cache/mozilla whitelist ${HOME}/.mozilla whitelist ${HOME}/.mozilla/firefox include firefox-common.profile # disable-* include disable-common.inc include disable-devel.inc include disable-exec.inc include disable-interpreters.inc include disable-passwdmgr.inc include disable-programs.inc # Dino specific mkdir ${HOME}/.local/share/dino whitelist ${HOME}/.local/share/dino whitelist ${HOME}/.local/share/dino/files whitelist ${DOWNLOADS} caps.drop all netfilter no3d nodvd nogroups nonewprivs noroot nosound notv nou2f novideo protocol unix,inet,inet6 seccomp shell none disable-mnt private-bin gpgsm,gpg,gpgconf,gwenview,gio-launch-desktop,dino,bash,firejail private-dev private-tmp ```

Rows
Columns

[GH-ISSUE #3215] Clicking an URL in Dino launches Firefox with new profile #2013