[GH-ISSUE #3655] Simplify profile creating process #2303

New issue

Open

opened 2026-05-05 08:59:37 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 08:59:37 -06:00

Owner

Originally created by @Thaodan on GitHub (Oct 6, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3655

Currently creating an application profile requires creating a long file which contains boilerplate code that is duplicated over every app.
I there should be a way by providing more abstract permissions by moving them to templates that the app profile can than include.
Also it would be useful to restrict the files an profile can include by separating profiles that define permissions from those that request them.

I was thinking of something like a profile for an XDG-App which gives the permission to all XDG-provided config/datata/runtime data just for the app and then permissions for every resource an app can request like Pictures-folder or the internet for example.

Originally created by @Thaodan on GitHub (Oct 6, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3655 Currently creating an application profile requires creating a long file which contains boilerplate code that is duplicated over every app. I there should be a way by providing more abstract permissions by moving them to templates that the app profile can than include. Also it would be useful to restrict the files an profile can include by separating profiles that define permissions from those that request them. I was thinking of something like a profile for an XDG-App which gives the permission to all XDG-provided config/datata/runtime data just for the app and then permissions for every resource an app can request like Pictures-folder or the internet for example.

gitea-mirror commented

2026-05-05 08:59:39 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 9, 2020):

boilerplate code that is duplicated over every app.

There are almost ever some differences (e.g. nosound, no3d). This make it look really the same even it differs all the time. chiraag-natarajs profiles (https://github.com/chiraag-nataraj/firejail-profiles) uses a include common.inc for that.

I there should be a way by providing more abstract permissions by moving them to templates that the app profile can than include.

There are https://github.com/netblue30/firejail/issues/3424 and https://github.com/netblue30/firejail/issues/3412 for which I eagerly wait. However apart from private-etc, D-Bus and thing like Mails-in-/var/spool/mail they don't help here because all the no* are already different things.

@rusty-snake commented on GitHub (Nov 9, 2020): > boilerplate code that is duplicated over every app. There are almost ever some differences (e.g. `nosound`, `no3d`). This make it look really the same even it differs all the time. chiraag-natarajs profiles (https://github.com/chiraag-nataraj/firejail-profiles) uses a `include common.inc` for that. > I there should be a way by providing more abstract permissions by moving them to templates that the app profile can than include. There are https://github.com/netblue30/firejail/issues/3424 and https://github.com/netblue30/firejail/issues/3412 for which I eagerly wait. However apart from `private-etc`, D-Bus and thing like Mails-in-/var/spool/mail they don't help here because all the no* are already different things.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2303

No description provided.

Rows
Columns