github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5937] Profile report: Visual Studio Code #3137

New issue

Open

opened 2026-05-05 09:46:21 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:46:21 -06:00

Owner

Originally created by @krokodyl1220 on GitHub (Aug 2, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5937

As a follow-up from the previous issue I wanted to report on configuration from the code profile. For reference, these are the lines from the default profile (as of 0.9.72) from code.profile:

# Disabled until someone reported positive feedback
ignore include disable-devel.inc
ignore include disable-exec.inc
ignore include disable-interpreters.inc
ignore include disable-xdg.inc
ignore whitelist ${DOWNLOADS}
ignore whitelist ${HOME}/.config/Electron
ignore whitelist ${HOME}/.config/electron*-flag*.conf
ignore include whitelist-common.inc
ignore include whitelist-runuser-common.inc
ignore include whitelist-usr-share-common.inc
ignore include whitelist-var-common.inc
ignore apparmor
ignore disable-mnt
ignore dbus-user none
ignore dbus-system none

My test scenario / use case for verification:

VS Code launched from the desktop shortcut created with firecfg
installed extensions: cortex-debug, python, cmake, c/c++
editor used for writing embedded code in c/c++ and debugging on the target using the hardware debug probe (ST-Link V2) connected to the system before starting the VSCode
OS: Fedora 38 with latest updates
VS Code is able to reach MS Servers, check for update and install extensions

In my code.local file I also added hardening options from the previous discussions:

ignore private-dev #required for USB debugger connection

caps.drop all
nonewprivs
noroot
protocol unix,inet,inet6,netlink
seccomp !chroot

Below is the list of options that I enabled and did not notice any issues during a few days of work:

include whitelist-runuser-common.inc
include whitelist-var-common.inc
apparmor # Probably needs another check, since Fedora uses selinux instead
disable-mnt
dbus-user none
dbus-system none

Below is the list of options that have some side-effects when using VS Code as a full IDE, but may be suitable if one is to use the software only as a text editor:

include disable-devel.inc # Broke the cmake extension
include disable-interpreters.inc # Disabled acces to python from terminal

And finally, below is the list of options that have undesireable effects:

include disable-exec.inc # Broke the cpptools extension
include disable-xdg.inc # Breaks access to ~/Documents
whitelist ${DOWNLOADS} # Breaks editor customization and extensions
whitelist ${HOME}/.config/Electron # Breaks editor customization and extensions
whitelist ${HOME}/.config/electron*-flag*.conf # Breaks editor customization and extensions
include whitelist-common.inc # Breaks editor customization and extensions
include whitelist-usr-share-common.inc # Breaks something in path - when starting code from terminal the message 'no suitable executable found'

If any more information or testing is required please let me know.

Originally created by @krokodyl1220 on GitHub (Aug 2, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/5937 As a follow-up from the previous issue I wanted to report on configuration from the `code` profile. For reference, these are the lines from the default profile (as of 0.9.72) from `code.profile`: ```bash # Disabled until someone reported positive feedback ignore include disable-devel.inc ignore include disable-exec.inc ignore include disable-interpreters.inc ignore include disable-xdg.inc ignore whitelist ${DOWNLOADS} ignore whitelist ${HOME}/.config/Electron ignore whitelist ${HOME}/.config/electron*-flag*.conf ignore include whitelist-common.inc ignore include whitelist-runuser-common.inc ignore include whitelist-usr-share-common.inc ignore include whitelist-var-common.inc ignore apparmor ignore disable-mnt ignore dbus-user none ignore dbus-system none ``` My test scenario / use case for verification: - VS Code launched from the desktop shortcut created with `firecfg` - installed extensions: cortex-debug, python, cmake, c/c++ - editor used for writing embedded code in c/c++ and debugging on the target using the hardware debug probe (ST-Link V2) connected to the system before starting the VSCode - OS: Fedora 38 with latest updates - VS Code is able to reach MS Servers, check for update and install extensions In my code.local file I also added hardening options from the previous discussions: ```bash ignore private-dev #required for USB debugger connection caps.drop all nonewprivs noroot protocol unix,inet,inet6,netlink seccomp !chroot ``` Below is the list of options that I enabled and did not notice any issues during a few days of work: ```bash include whitelist-runuser-common.inc include whitelist-var-common.inc apparmor # Probably needs another check, since Fedora uses selinux instead disable-mnt dbus-user none dbus-system none ``` Below is the list of options that have some side-effects when using VS Code as a full IDE, but may be suitable if one is to use the software only as a text editor: ```bash include disable-devel.inc # Broke the cmake extension include disable-interpreters.inc # Disabled acces to python from terminal ``` And finally, below is the list of options that have undesireable effects: ```bash include disable-exec.inc # Broke the cpptools extension include disable-xdg.inc # Breaks access to ~/Documents whitelist ${DOWNLOADS} # Breaks editor customization and extensions whitelist ${HOME}/.config/Electron # Breaks editor customization and extensions whitelist ${HOME}/.config/electron*-flag*.conf # Breaks editor customization and extensions include whitelist-common.inc # Breaks editor customization and extensions include whitelist-usr-share-common.inc # Breaks something in path - when starting code from terminal the message 'no suitable executable found' ``` If any more information or testing is required please let me know.

gitea-mirror commented

2026-05-05 09:46:23 -06:00

Author

Owner

@ghost commented on GitHub (Aug 2, 2023):

Thanks for taking the time to test and report, much appreciated.

include disable-devel.inc # Broke the cmake extension
include disable-interpreters.inc # Disabled acces to python from terminal

Both these includes don't make much sense in VS Code, we'll keep them disabled.

include disable-exec.inc # Broke the cpptools extension

Adding ignore noexec ${HOME} and maybe also ignore noexec ${RUNUSER} should cover this.

include disable-xdg.inc # Breaks access to ~/Documents

An additional whitelist ${DOCUMENTS} could take care of that. But as your other remarks indicate, it seems that trying to implement a whitelisting profile for VS Code is probably not a very good idea.

Let's wait a bit to give fellow collaborators the time to reflect on your observations. In any case we have a much better view on the best way forward now thanks to your efforts.

Regards

@ghost commented on GitHub (Aug 2, 2023): Thanks for taking the time to test and report, much appreciated. > include disable-devel.inc # Broke the cmake extension include disable-interpreters.inc # Disabled acces to python from terminal Both these includes don't make much sense in VS Code, we'll keep them disabled. > include disable-exec.inc # Broke the cpptools extension Adding `ignore noexec ${HOME}` and maybe also `ignore noexec ${RUNUSER}` should cover this. > include disable-xdg.inc # Breaks access to ~/Documents An additional `whitelist ${DOCUMENTS}` could take care of that. But as your other remarks indicate, it seems that trying to implement a whitelisting profile for VS Code is probably not a very good idea. Let's wait a bit to give fellow collaborators the time to reflect on your observations. In any case we have a much better view on the best way forward now thanks to your efforts. Regards

gitea-mirror commented

2026-05-05 09:46:24 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 2, 2023):

apparmor dies the same as noexec ${HOME}
blocking DBus could be problematic too

The rest sounds leggit.

@rusty-snake commented on GitHub (Aug 2, 2023): - apparmor dies the same as `noexec ${HOME}` - blocking DBus could be problematic too The rest sounds leggit.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3137

No description provided.

Rows
Columns