mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3453] [Question not a bug] About Firefox under firejail #2170
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2170
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Nokia808 on GitHub (Jun 6, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3453
Hi dear. It is not a bug.
My default command to run my Firefox on my Fedora 32 is "firefox %u"
I like to run firefox under firejail & to obtain more security I like to run it with "-no-remote"
I tried the following:
$ firejail firefox %u -no-remote
& I got an error: Firefox opened with blank screen within it following error message "file %u not found"
I think it is just that my way to write command was wrong due to wrong place of "%u" ...
Kindly, just to dictate the command here in correct way ...
Thanks.
@rusty-snake commented on GitHub (Jun 6, 2020):
%uis a thing special to .desktop files and has no meaning in bash, therefore it is forwarded to firefox, where it has too no meaning.Use
$ firejail firerfox --no-remote
or if you executed firecfg
$ firefox --no-remote
@Nokia808 commented on GitHub (Jun 6, 2020):
@rusty-snake
Thank you for replay.
But I need to edit Firefox entry from within my Cinnamon applications menu editor. In this case how I should write the command? Kindly, see the following screenshot:
@rusty-snake commented on GitHub (Jun 6, 2020):
If you executed firecfg:
firefox --no-remote %u
otherwise
firejail firefox --no-remote %u
%xin desktop files is usually the last part of the Exec key.@Nokia808 commented on GitHub (Jun 6, 2020):
It is clear now. I will close this issue.
But only further question - though not on topic - I have an AppImage program (jitsi-meet-x86_64.AppImage) which is based on chromium. I like to use same approach (from within application menu where I'm already created for it an entry manually). All what I have is just to start command by "firejail". It has no %u. But do I have to use -no-remote command to get additional security or -no-remote only for browsers ?
By the way: -no-remote or --no-remote ? In your blog you used -no-remote while here you using --no-remote
@ghost commented on GitHub (Jun 6, 2020):
Hi, I see where you could be a bit confused. The --no-remote parameter is Firefox-specific, it does not offer any additional firejail security. You can see all the parameters it supports if you run 'firefox --help'. Basically when you start firefox with --no-remote (or -no-remote, I believe it supports both formats), each time you try to open a hyperlink from another application, a new firefox instance will be started, which might not be what you want. So I suggest you try it and if you don't like it you can remove the --no-remote option. Doing so will not affect the security offered by firejail.
I think the above also answers your jitsi-meet question. If a program doesn't have %u in its .desktop file that means it does not accept specific start parameters (like a URL for a web browser).
So if you executed firecfg
jitsi-meet-desktop
otherwise
firejail --appimage jitsi-meet-desktop
@Nokia808 commented on GitHub (Jun 6, 2020):
@glitsj16
Dear I made mistake in name of jitsi package. It's full name is:
jitsi-meet-x86_64.AppImage
I will correct it in previous post.
So, it will be:
firejail --appimage jitsi-meet-x86_64.AppImageregarding Firefox & --no-remote , if I'm NOT USING "firecfg" & only use "firejail firefox %u" from within applications menu then how it will be safe it I will open Firefox from other application like click on a link within chat message? In the last scenario click link within chat application should it leading to open new Firefox instance in the default non-firejail because firecfg not run ?
I understood from post in blog - please correct to me - that "--no-remote" (or "-no-remote") is designated to overcome the last behaviour ....
@rusty-snake commented on GitHub (Jun 6, 2020):
Yes, maybe you need in addition to specific the profile:
firejail --profile=jitsi-meet-desktop --appimage jitsi-meet-x86_64.AppImageGUI-Programs usually also use the .desktop file. If firefox is started w/o
--no-remotethe link will be opened in the running firefox.@Nokia808 commented on GitHub (Jun 6, 2020):
@rusty-snake
No it is very clear now. If not using "--no-remote" (only "firejail firefox %u") then any external referral to Firefox will opened within safe runing Firefox WHICH IS ALREADY SUNDBOX. But if "--no-remote" is used (firejail firefox -no-remote %u) then any external referral for Firefox will lead to open NEW Firefox instance WHICH ALSO SANDBOX. So, using/nonusing "--no-remote" will not change level of security offered by firejail to Firefox .....