[GH-ISSUE #3291] thunderbird: harden rules that allow Firefox to open links #2068

New issue

Closed

opened 2026-05-05 08:44:24 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 08:44:24 -06:00

Owner

Originally created by @curiosityseeker on GitHub (Mar 22, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3291

The thunderbird.profile contains the following lines:

# Uncomment the next 4 lines or put them in your thunderbird.local to
# allow Firefox to load your profile when clicking a link in an email
#noblacklist ${HOME}/.cache/mozilla
#noblacklist ${HOME}/.mozilla
#whitelist ${HOME}/.cache/mozilla/firefox
#whitelist ${HOME}/.mozilla

These rules are more permissive than necessary, IMO. According to my tests the following modifications work:

noblacklist ${HOME}/.cache/mozilla
noblacklist ${HOME}/.mozilla
whitelist ${HOME}/.cache/mozilla/firefox
whitelist ${HOME}/.mozilla/firefox/profiles.ini
read-only ${HOME}/.mozilla/firefox/profiles.ini

These modifications restrict Thunderbird's access to ~/.mozilla/firefox considerably as would be desirable. I think with these modifications those lines could be uncommented by default.

It would be nice if the whitelist rule for ${HOME}/.cache/mozilla/firefox could be restricted to the relevant sub-folder therein. But since its name depends on the name of the respective Thunderbird profile I don't know how to do that.

Originally created by @curiosityseeker on GitHub (Mar 22, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3291 The `thunderbird.profile` contains the following lines: ``` # Uncomment the next 4 lines or put them in your thunderbird.local to # allow Firefox to load your profile when clicking a link in an email #noblacklist ${HOME}/.cache/mozilla #noblacklist ${HOME}/.mozilla #whitelist ${HOME}/.cache/mozilla/firefox #whitelist ${HOME}/.mozilla ``` These rules are more permissive than necessary, IMO. According to my tests the following modifications work: ``` noblacklist ${HOME}/.cache/mozilla noblacklist ${HOME}/.mozilla whitelist ${HOME}/.cache/mozilla/firefox whitelist ${HOME}/.mozilla/firefox/profiles.ini read-only ${HOME}/.mozilla/firefox/profiles.ini ``` These modifications restrict Thunderbird's access to `~/.mozilla/firefox` considerably as would be desirable. I think with these modifications those lines could be uncommented by default. It would be nice if the whitelist rule for `${HOME}/.cache/mozilla/firefox` could be restricted to the relevant sub-folder therein. But since its name depends on the name of the respective Thunderbird profile I don't know how to do that.

gitea-mirror closed this issue

2026-05-05 08:44:25 -06:00

gitea-mirror commented

2026-05-05 08:44:26 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 22, 2020):

Open a PR ;)

@rusty-snake commented on GitHub (Mar 22, 2020): Open a PR ;)

gitea-mirror commented

2026-05-05 08:44:27 -06:00

Author

Owner

@curiosityseeker commented on GitHub (Apr 4, 2020):

Access to ${HOME}/.cache/mozilla is actually not necessary.

6b8244dc86

@curiosityseeker commented on GitHub (Apr 4, 2020): Access to ${HOME}/.cache/mozilla is actually not necessary. https://github.com/netblue30/firejail/commit/6b8244dc86efe0a34c2033fa866c48578183f8cb

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2068

No description provided.

Rows
Columns