github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3323] Can't open links from hexchat #2086

New issue

Closed

opened 2026-05-05 08:45:37 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 08:45:37 -06:00

Owner

Originally created by @ibahnasy on GitHub (Apr 6, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3323

When running hexchat with firejail, it's not possible to launch links directly.

Originally created by @ibahnasy on GitHub (Apr 6, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3323 When running hexchat with firejail, it's not possible to launch links directly.

gitea-mirror closed this issue

2026-05-05 08:45:38 -06:00

gitea-mirror commented

2026-05-05 08:45:39 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 6, 2020):

#1718
https://github.com/netblue30/firejail/issues/1770#issuecomment-364498100

@rusty-snake commented on GitHub (Apr 6, 2020): #1718 https://github.com/netblue30/firejail/issues/1770#issuecomment-364498100

gitea-mirror commented

2026-05-05 08:45:40 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 6, 2020):

@other_collaborator, we must document the "open links from foo does not work". Or we must answer it for the rest of our live.

#3308
#2228
#2047
#1955
#3311
#…

@rusty-snake commented on GitHub (Apr 6, 2020): @other_collaborator, we must document the "open links from foo does not work". Or we must answer it for the rest of our live. #3308 #2228 #2047 #1955 #3311 #…

gitea-mirror commented

2026-05-05 08:45:41 -06:00

Author

Owner

@ghost commented on GitHub (Apr 6, 2020):

we must document the "open links from foo does not work". Or we must answer it for the rest of our live

@rusty-snake Very true. IMO the best we can do is to actually implement a secure way for users to open links from foo in browsers, regardless of documentation. Something along the lines of what I tried to convey here. Although the stuff linked in that comment is outdated, I have been using a few very simple shell scripts and geckodriver to implement basic URL inter-sandbox communication with mozilla-based web browsers for a long time now. Recently I have improved these scripts to avoid having to rely on D-Bus alltogether, in both the scripts and firejail profiles. A bit swamped at the moment to start a WIP PR for it, but reading your message here reminded me I must bite the bullet and go public soonish and see what the firejail community thinks about it...

@ghost commented on GitHub (Apr 6, 2020): > we must document the "open links from foo does not work". Or we must answer it for the rest of our live @rusty-snake Very true. IMO the best we can do is to actually implement a `secure` way for users to open links from foo in browsers, regardless of documentation. Something along the lines of what I tried to convey [here](https://github.com/netblue30/firejail/issues/2228#issuecomment-436518756). Although the stuff linked in that comment is outdated, I have been using a few very simple shell scripts and [geckodriver](https://github.com/mozilla/geckodriver) to implement basic URL inter-sandbox communication with mozilla-based web browsers for a long time now. Recently I have improved these scripts to `avoid` having to rely on `D-Bus` alltogether, in both the scripts and firejail profiles. A bit swamped at the moment to start a WIP PR for it, but reading your message here reminded me I must bite the bullet and go public soonish and see what the firejail community thinks about it...

gitea-mirror commented

2026-05-05 08:45:42 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 7, 2020):

@glitsj16 with #3265 a dbus-user.talk org.mozilla.firefox.* rule is enough.
Problem1: profiles with private-bin
Problem2: /usr/bin/firefox is a shell script in Ubuntu/Fedora/Arch/… and adding bash to private-bin relaxes the sandbox.

# globals.local
dbus-user filter
dbus-user.talk org.mozilla.firefox.*
ignore dbus-user none
ignore nodbus

# post-globals.local -- does not exists upstream
# conndition does not exists
?HAS_PRIVATE_BIN: private-bin basename,bash,cat,dirname,expr,false,firefox,firefox-wayland,ln,mkdir,pidof,rm,rmdir,sed,sh,tclsh,true,uname

@rusty-snake commented on GitHub (Apr 7, 2020): @glitsj16 with #3265 a `dbus-user.talk org.mozilla.firefox.*` rule is enough. Problem1: profiles with `private-bin` Problem2: /usr/bin/firefox is a shell script in Ubuntu/Fedora/Arch/… and adding bash to private-bin relaxes the sandbox. ``` # globals.local dbus-user filter dbus-user.talk org.mozilla.firefox.* ignore dbus-user none ignore nodbus # post-globals.local -- does not exists upstream # conndition does not exists ?HAS_PRIVATE_BIN: private-bin basename,bash,cat,dirname,expr,false,firefox,firefox-wayland,ln,mkdir,pidof,rm,rmdir,sed,sh,tclsh,true,uname ```

gitea-mirror commented

2026-05-05 08:45:43 -06:00

Author

Owner

@ghost commented on GitHub (Apr 7, 2020):

@rusty-snake Yes, the new D-Bus filters definately improve the situation. The scripts I'm refering to are doing there job outside the sandbox, apllications inside are agnostic to their existence. A wrapper for /usr/bin/firefox intercepts calls to it and dispenses a drop file containing the URL request. Not much different than what the GNOME portal system is doing actually. The work done by @kris7t in this regard is the best thing happening for firejail in a long while! Nevertheless I wouldn't mind D-Bus succumbing to a corona infection, being the security nightmare it is 😀.

@ghost commented on GitHub (Apr 7, 2020): @rusty-snake Yes, the new D-Bus filters definately improve the situation. The scripts I'm refering to are doing there job outside the sandbox, apllications inside are agnostic to their existence. A wrapper for /usr/bin/firefox intercepts calls to it and dispenses a drop file containing the URL request. Not much different than what the GNOME portal system is doing actually. The work done by @kris7t in this regard is the best thing happening for firejail in a long while! Nevertheless I wouldn't mind D-Bus succumbing to a corona infection, being the security nightmare it is :grinning:.

gitea-mirror commented

2026-05-05 08:45:44 -06:00

Author

Owner

@rusty-snake commented on GitHub (May 6, 2020):

I'm closing here due to inactivity, please fell free to reopen if you have more questions.

@rusty-snake commented on GitHub (May 6, 2020): I'm closing here due to inactivity, please fell free to reopen if you have more questions.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2086

No description provided.

Rows
Columns