github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5241] Disable creation of wrapper for single binary #2933

New issue

Closed

opened 2026-05-05 09:35:43 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:35:43 -06:00

Owner

Originally created by @WhyNotHugo on GitHub (Jul 7, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5241

I have a system hook that runs firecfg each time a file is installed into /usr/bin.

However, this re-creates some link in /usr/local/bin that I don't want because sandboxing those applications is problematic.

I do want the links for most binaries, but I want a few exceptions.

Describe the solution you'd like

Some form of configuration file where I can specify names to skip when running firecfg.

Describe alternatives you've considered

Deleting the profiles should be possible, but since those are provided by firejail, they'll get reinstalled on update. I'm not a fan of altering / deleting package-provided files anyway.

It should be possible to instruct the package manager to ignore installing unwanted profiles, but that's not very portable and sounds like a big hack.

Additional context

I mostly want to disable to link in /usr/local/bin/ for some programs where the sandbox does not work well for me or still needs to be refined more.

Originally created by @WhyNotHugo on GitHub (Jul 7, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5241 ### Is your feature request related to a problem? Please describe. I have a system hook that runs `firecfg` each time a file is installed into `/usr/bin`. However, this re-creates some link in `/usr/local/bin` that I don't want because sandboxing those applications is problematic. I do want the links for _most_ binaries, but I want a few exceptions. ### Describe the solution you'd like Some form of configuration file where I can specify names to skip when running `firecfg`. ### Describe alternatives you've considered Deleting the profiles should be possible, but since those are provided by `firejail`, they'll get reinstalled on update. I'm not a fan of altering / deleting package-provided files anyway. It should be possible to instruct the package manager to ignore installing unwanted profiles, but that's not very portable and sounds like a big hack. ### Additional context I mostly want to disable to link in `/usr/local/bin/` for some programs where the sandbox does not work well for me or still needs to be refined more.

gitea-mirror

2026-05-05 09:35:43 -06:00

closed this issue
added the
firecfg

duplicate
labels

gitea-mirror commented

2026-05-05 09:35:46 -06:00

Author

Owner

@reinerh commented on GitHub (Jul 7, 2022):

firecfg is only creating symlinks for programs/profiles that are mentioned in /etc/firejail/firecfg.config. Does this solve your problem?

@reinerh commented on GitHub (Jul 7, 2022): firecfg is only creating symlinks for programs/profiles that are mentioned in `/etc/firejail/firecfg.config`. Does this solve your problem?

gitea-mirror commented

2026-05-05 09:35:48 -06:00

Author

Owner

@WhyNotHugo commented on GitHub (Jul 7, 2022):

Kinda... but not really.

I don't like the idea of mutating files provided by system packages (firejail in this case). It makes maintenance and setting up new hosts a bit tricky. For example, the file cannot be provided by a configuration meta-package because the file conflicts (owned by both).

Are you open to discussing more flexible solutions?

One possible approach is putting the file in /usr/share/factory/etc/firejail/firecfg.config and installing it via tmpfiles.d. So if the file is absent, it gets copied to /etc/firejail/firecfg.config at startup, but otherwise is left alone.

Another possible approach is to have a /etc/firejail/firecfg.d/ and place drop-in files in there which can exclude provides (via !mpv, for example).

@WhyNotHugo commented on GitHub (Jul 7, 2022): Kinda... but not really. I don't like the idea of mutating files provided by system packages (`firejail` in this case). It makes maintenance and setting up new hosts a bit tricky. For example, the file cannot be provided by a configuration meta-package because the file conflicts (owned by both). Are you open to discussing more flexible solutions? One possible approach is putting the file in `/usr/share/factory/etc/firejail/firecfg.config` and installing it via `tmpfiles.d`. So if the file is absent, it gets copied to `/etc/firejail/firecfg.config` at startup, but otherwise is left alone. Another possible approach is to have a `/etc/firejail/firecfg.d/` and place drop-in files in there which can exclude provides (via `!mpv`, for example).

gitea-mirror commented

2026-05-05 09:35:48 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 7, 2022):

Duplicate of #2097

@rusty-snake commented on GitHub (Jul 7, 2022): Duplicate of #2097

gitea-mirror referenced this issue

2026-05-05 10:23:02 -06:00

[PR #2960] [MERGED] Update SkypeForLinux profile for latest version #4596

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2933

No description provided.

Rows
Columns