github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3412] Support bash like alias #2142

New issue

Open

opened 2026-05-05 08:49:05 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 08:49:05 -06:00

Owner

Originally created by @rusty-snake on GitHub (May 11, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3412

A alias statement like in bash can be very handy.

Example

alias notrash=blacklist ${HOME}/.local/share/Trash
alias dbus:notifications=|
dbus-user.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notification
dbus-user.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notification

Why?

Easier maintenance of profiles.

New command like notrash (see #3081) can be implemented w/o touching C-code.

Performance:
Firejail profile becoming harder to maintain a cross distros, getting new features (such as dbus). To deal with that we add more include allow-*.inc commands. include will always cause a disk I/O even for small things. If we now also add dbus-*.inc files (see https://github.com/netblue30/firejail/pull/3406#issuecomment-625455112) which makes sense form the maintenance standpoint, we get more and more files to open just for a few lines.

My firefox.profile has already 22 profiles included.

Alternatives

Instead of a new profile option we could also use a aliasen.xml (or what ever the name/file-type is) in /etc/firejail and ~/.config/firejail.

Originally created by @rusty-snake on GitHub (May 11, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3412 A `alias` statement like in bash can be very handy. #### Example ``` alias notrash=blacklist ${HOME}/.local/share/Trash alias dbus:notifications=| dbus-user.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notification dbus-user.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notification ``` #### Why? Easier maintenance of profiles. New command like `notrash` (see #3081) can be implemented w/o touching C-code. Performance: Firejail profile becoming harder to maintain a cross distros, getting new features (such as dbus). To deal with that we add more `include allow-*.inc` commands. `include` will always cause a disk I/O even for small things. If we now also add `dbus-*.inc` files (see https://github.com/netblue30/firejail/pull/3406#issuecomment-625455112) which makes sense form the maintenance standpoint, we get more and more files to open just for a few lines. _My firefox.profile has already 22 profiles included._ #### Alternatives Instead of a new profile option we could also use a `aliasen.xml` (or what ever the name/file-type is) in `/etc/firejail` and `~/.config/firejail`.

gitea-mirror added the

enhancement

label 2026-05-05 08:49:05 -06:00

gitea-mirror commented

2026-05-05 08:49:07 -06:00

Author

Owner

@ghost commented on GitHub (May 11, 2020):

Personally I really like the aliases idea! Besides the already mentioned complexity/maintenance/performance issues, IMO we face a real need to come up with a syntax format that would also work on the command-line. Something like firejail --notrash --dbus=notifications foo is manageable and reasonably clear as to what it does exactly, which I can't say of the longer format.

@ghost commented on GitHub (May 11, 2020): Personally I really like the aliases idea! Besides the already mentioned complexity/maintenance/performance issues, IMO we face a real need to come up with a syntax format that would also work on the command-line. Something like `firejail --notrash --dbus=notifications foo` is manageable and reasonably clear as to what it does exactly, which I can't say of the longer format.

gitea-mirror commented

2026-05-05 08:49:08 -06:00

Author

Owner

@rusty-snake commented on GitHub (May 12, 2020):

I was already thinking about splitting everything regarding the filesystem (blacklist, whitelist, disable-mnt, tmpfs, private-bin, ...) into a low-level-profile-language and a high-level one. Profiles would be written in the high-level-language which will have all things like notrash, nodesktop, private-gnupg (#2786), allusers, private-dev, .... Options like nonewprivs exists in both and are unchanged. The high-level-language would be parsed by a plugin/helper-program (which can be sandboxed, chrooted, setuid=nodboy, ...) which generated the low-level-commands (only blacklist, tmpfs (needs restrictions which paths can be tmpfsed[1]), bind (need restriction too), and nonewprivs, seccomp, mdwe, ...) which is then applied by firejail. This allows faster implementing of new options, less code running with uid=0,euid=nobody.

[1] example: tmpfs is always allowed in $HOME, for /etc only if nonewprivs is set, ...

@rusty-snake commented on GitHub (May 12, 2020): I was already thinking about splitting everything regarding the filesystem (blacklist, whitelist, disable-mnt, tmpfs, private-bin, ...) into a low-level-profile-language and a high-level one. Profiles would be written in the high-level-language which will have all things like notrash, nodesktop, private-gnupg (#2786), allusers, private-dev, .... Options like nonewprivs exists in both and are unchanged. The high-level-language would be parsed by a plugin/helper-program (which can be sandboxed, chrooted, setuid=nodboy, ...) which generated the low-level-commands (only blacklist, tmpfs (needs restrictions which paths can be tmpfsed[1]), bind (need restriction too), and nonewprivs, seccomp, mdwe, ...) which is then applied by firejail. This allows faster implementing of new options, less code running with uid=0,euid=nobody. [1] example: tmpfs is always allowed in $HOME, for /etc only if nonewprivs is set, ...

gitea-mirror referenced this issue

2026-05-05 10:15:59 -06:00

[PR #2199] [MERGED] Fix #2142: Firefox appimage fails because it needs non-default seccomp #4220

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2142

No description provided.

Rows
Columns