[GH-ISSUE #3714] How would it be possible to have specified commands run automatically with firejail? (e.g. `youtube-dl` becomes `firejail youtube-dl`)

gitea-mirror commented

2026-05-05 09:01:32 -06:00

Owner

Originally created by @mYnDstrEAm on GitHub (Oct 31, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3714

For example instead of having to write firejail youtube-dl for command-line programs or firejail firefox-esr in apps' launch commands I'd like youtube-dl and firefox-esr (the latter also for any other app that might call this command) to automatically use firejail.

So far I think two options for this are using aliases (e.g. reassigning the command firefox-esr) and firecfg. I'm not sure how firecfg works or whether there are additional options - are there any?

Also I'd prefer not having to assign aliases for this, at least not manually (and one problem with aliases is that it disguises and hides the actual command being run). What would be the best way this could be either implemented as an additional feature in firejail/firecfg or used by the user? I'd like to specify which apps should run with firejail by default and for all others to require firejail being put in front of the command. (Maybe at a later point there could be a user-prompt when running a new software for the first time if there is a firejail profile for its name.)

Originally created by @mYnDstrEAm on GitHub (Oct 31, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3714 For example instead of having to write `firejail youtube-dl` for command-line programs or `firejail firefox-esr` in apps' launch commands I'd like `youtube-dl` and `firefox-esr` (the latter also for any other app that might call this command) to automatically use firejail. So far I think two options for this are **using aliases** (e.g. reassigning the command `firefox-esr`) and **`firecfg`**. I'm not sure how firecfg works or whether there are additional options - are there any? Also I'd prefer not having to assign aliases for this, at least not manually (and one problem with aliases is that it disguises and hides the actual command being run). What would be the best way this could be either implemented as an additional feature in firejail/firecfg or used by the user? I'd like to specify which apps should run with firejail by default and for all others to require `firejail` being put in front of the command. (Maybe at a later point there could be a user-prompt when running a new software for the first time if there is a firejail profile for its name.)

gitea-mirror

2026-05-05 09:01:32 -06:00

closed this issue
added the
question_old
label

gitea-mirror commented

2026-05-05 09:01:35 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Oct 31, 2020):

sudo ln -s /usr/bin/firejail /usr/local/bin/youtube-dl

@SkewedZeppelin commented on GitHub (Oct 31, 2020): sudo ln -s /usr/bin/firejail /usr/local/bin/youtube-dl

gitea-mirror commented

2026-05-05 09:01:36 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 31, 2020):

So far I think two options for this are using aliases

aliases are not applied for desktop starter and non-interactive shells (depending where you set them).

I'm not sure how firecfg works or whether there are additional options - are there any?

On how they work to the user there are some alternatives: https://github.com/netblue30/firejail/issues/3665#issuecomment-707689049.

Under the hud they all do (mostly) the same.

I'd like to specify which apps should run with firejail by default and for all others to require firejail being put in front of the command.

So your goal is that only a few selected programs (e.g. firefox, thunderbird and youtube-dl) are firejailed by default, right?

@rusty-snake commented on GitHub (Oct 31, 2020): > So far I think two options for this are using aliases aliases are not applied for desktop starter and non-interactive shells (depending where you set them). > I'm not sure how firecfg works or whether there are additional options - are there any? On how they work to the user there are some alternatives: https://github.com/netblue30/firejail/issues/3665#issuecomment-707689049. Under the hud they all do (mostly) the same. > I'd like to specify which apps should run with firejail by default and for all others to require firejail being put in front of the command. So your goal is that only a few selected programs (e.g. firefox, thunderbird and youtube-dl) are firejailed by default, right?

gitea-mirror commented

2026-05-05 09:01:37 -06:00

Author

Owner

@mYnDstrEAm commented on GitHub (Oct 31, 2020):

sudo ln -s /usr/bin/firejail /usr/local/bin/youtube-dl

Wouldn't this make youtube-dl become firejail and not firejail youtube-dl? If the target location of the symbolic can be appended like this: I'd like to use the command youtube-dl and not e.g. fjyoutube-dl.

aliases are not applied for desktop starter and non-interactive shells (depending where you set them).

Couldn't they simply be set in the ~/.bashrc file?

On how they work to the user there are some alternatives

Thanks, this looks very useful for this. Even though it doesn't seem to be very convenient / natively well-supported currently.

So your goal is that only a few selected programs (e.g. firefox, thunderbird and youtube-dl) are firejailed by default, right?

Exactly. And that they don't require firejail to be put in front of the command but are launched via the command of the same name and are guaranteed to only run firejailed.

@mYnDstrEAm commented on GitHub (Oct 31, 2020): > sudo ln -s /usr/bin/firejail /usr/local/bin/youtube-dl Wouldn't this make `youtube-dl` become `firejail` and not `firejail youtube-dl`? If the target location of the symbolic can be appended like this: I'd like to use the command `youtube-dl` and not e.g. `fjyoutube-dl`. > aliases are not applied for desktop starter and non-interactive shells (depending where you set them). Couldn't they simply be set in the `~/.bashrc` file? > On how they work to the user there are some alternatives Thanks, this looks very useful for this. Even though it doesn't seem to be very convenient / natively well-supported currently. > So your goal is that only a few selected programs (e.g. firefox, thunderbird and youtube-dl) are firejailed by default, right? Exactly. And that they don't require `firejail` to be put in front of the command but are launched via the command of the same name and are guaranteed to only run firejailed.

gitea-mirror commented

2026-05-05 09:01:38 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 1, 2020):

Couldn't they simply be set in the ~/.bashrc file?

~/.bashrc is only read by interactive non-login shells by default.

Wouldn't this make youtube-dl become firejail

yes, and firejail detects that it is started through a symlink named youtube-dl and will act like firejail youtube-dl.

and are guaranteed to only run firejailed.

You can always start a program by path (=unfirejailed). If you want guarantee, you need to use a LSM like AppArmor or SELinux.

@rusty-snake commented on GitHub (Nov 1, 2020): > Couldn't they simply be set in the ~/.bashrc file? `~/.bashrc` is only read by interactive non-login shells by default. > Wouldn't this make youtube-dl become firejail yes, and firejail detects that it is started through a symlink named youtube-dl and will act like `firejail youtube-dl`. > and are guaranteed to only run firejailed. You can always start a program by path (=unfirejailed). If you want guarantee, you need to use a LSM like AppArmor or SELinux.

gitea-mirror commented

2026-05-05 09:01:38 -06:00

Author

Owner

@mYnDstrEAm commented on GitHub (Nov 1, 2020):

~/.bashrc is only read by interactive non-login shells by default.

I think that would be sufficient in my case. But why not in other shells? Is there a simply way to make it get read by all shells?

Wouldn't this make youtube-dl become firejail

Great - so that's exactly what I was looking for. There's just a problem with running it like this of course: ln: failed to create symbolic link '/usr/local/bin/youtube-dl': File exists so I guess one has to rename youtube-dl to something else first. The problem with that is that it probably will break the updating procedure because after updating it probably is called youtube-dl again.

You can always start a program by path (=unfirejailed). If you want guarantee, you need to use a LSM like AppArmor or SELinux.

Maybe there's a way to make software not executable when starting it via path but only otherwise. This would be tricky I guess. I'm already using AppArmor.

@mYnDstrEAm commented on GitHub (Nov 1, 2020): > ~/.bashrc is only read by interactive non-login shells by default. I think that would be sufficient in my case. But why not in other shells? Is there a simply way to make it get read by all shells? > Wouldn't this make youtube-dl become firejail Great - so that's exactly what I was looking for. There's just a problem with running it like this of course: `ln: failed to create symbolic link '/usr/local/bin/youtube-dl': File exists` so I guess one has to rename youtube-dl to something else first. The problem with that is that it probably will break the updating procedure because after updating it probably is called `youtube-dl` again. > You can always start a program by path (=unfirejailed). If you want guarantee, you need to use a LSM like AppArmor or SELinux. Maybe there's a way to make software not executable when starting it via path but only otherwise. This would be tricky I guess. I'm already using AppArmor.

gitea-mirror commented

2026-05-05 09:01:39 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 1, 2020):

I think that would be sufficient in my case.

This would mean you must start programs in a terminal.

But why not in other shells?

Because bashrc is the starup-file for interactive non-login bash sessions.

Is there a simply way to make it get read by all shells?

There are other starup-files too.

Great - so that's exactly what I was looking for. There's just a problem with running it like this of course: ln: failed to create symbolic link '/usr/local/bin/youtube-dl': File exists so I guess one has to rename youtube-dl to something else first. The problem with that is that it probably will break the updating procedure because after updating it probably is called youtube-dl again.

How did you installed ytdl?

Maybe there's a way to make software not executable when starting it via path but only otherwise.

... and then you make a update and the file is executable again. Uhh, and how should firejail start a program if it is not executable?

@rusty-snake commented on GitHub (Nov 1, 2020): > I think that would be sufficient in my case. This would mean you must start programs in a terminal. > But why not in other shells? Because bashrc is the starup-file for interactive non-login bash sessions. > Is there a simply way to make it get read by all shells? There are other starup-files too. > Great - so that's exactly what I was looking for. There's just a problem with running it like this of course: ln: failed to create symbolic link '/usr/local/bin/youtube-dl': File exists so I guess one has to rename youtube-dl to something else first. The problem with that is that it probably will break the updating procedure because after updating it probably is called youtube-dl again. How did you installed ytdl? > Maybe there's a way to make software not executable when starting it via path but only otherwise. ... and then you make a update and the file is executable again. Uhh, and how should firejail start a program if it is not executable?

gitea-mirror commented

2026-05-05 09:01:40 -06:00

Author

Owner

@mYnDstrEAm commented on GitHub (Nov 1, 2020):

Alright, thanks for the infos!
It's usually updated with pip sudo pip install --upgrade youtube_dl
I guess there's no good way around renaming the file/command.

... and then you make a update and the file is executable again. Uhh, and how should firejail start a program if it is not executable?

Exactly. Maybe it would be possible for Linux/GNU/Debian/other software to have a table of executables that are allowed to be run on the machine with everything else not getting executed even when the executable flag is set. This table could also define the way that the software is allowed to be called with the default option allowing direct calls and otherwise it only allows e.g. certain commands to launch it. Like this:

| command        | location                  | allowed | hash  | access options 
|----------------|---------------------------|---------|-------|--------------------
| youtube-dl     | /usr/local/bin/youtube-dl | x       | ...   | firejail youtube-dl

That's just one idea. Please let me know what you think of it, whether you know if something like it already exists, if you maybe have suggestions for alternative and if you know of a place to best ask about it.

@mYnDstrEAm commented on GitHub (Nov 1, 2020): Alright, thanks for the infos! It's usually updated with pip `sudo pip install --upgrade youtube_dl` I guess there's no good way around renaming the file/command. > ... and then you make a update and the file is executable again. Uhh, and how should firejail start a program if it is not executable? Exactly. Maybe it would be possible for Linux/GNU/Debian/other software to have a table of executables that are allowed to be run on the machine with _everything_ else not getting executed even when the executable flag is set. This table could also define the way that the software is allowed to be called with the default option allowing direct calls and otherwise it only allows e.g. certain commands to launch it. Like this: ``` | command | location | allowed | hash | access options |----------------|---------------------------|---------|-------|-------------------- | youtube-dl | /usr/local/bin/youtube-dl | x | ... | firejail youtube-dl ``` That's just one idea. Please let me know what you think of it, whether you know if something like it already exists, if you maybe have suggestions for alternative and if you know of a place to best [ask](https://security.stackexchange.com/questions/240321/is-there-a-way-to-specify-in-a-table-which-executables-via-locations-hashes) about it.

gitea-mirror commented

2026-05-05 09:01:41 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 1, 2020):

https://github.com/linux-application-whitelisting/fapolicyd

sudo pip install --upgrade --target=/usr/bin youtube-dl

@rusty-snake commented on GitHub (Nov 1, 2020): https://github.com/linux-application-whitelisting/fapolicyd `sudo pip install --upgrade --target=/usr/bin youtube-dl`

gitea-mirror commented

2026-05-05 09:01:41 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 16, 2020):

I'm closing here due to inactivity, please fell free to request to reopen if you have more questions.

@rusty-snake commented on GitHub (Dec 16, 2020): I'm closing here due to inactivity, please fell free to request to reopen if you have more questions.

Rows
Columns

[GH-ISSUE #3714] How would it be possible to have specified commands run automatically with firejail? (e.g. youtube-dl becomes firejail youtube-dl) #2339

[GH-ISSUE #3714] How would it be possible to have specified commands run automatically with firejail? (e.g. `youtube-dl` becomes `firejail youtube-dl`) #2339