github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

#3277

New issue

Closed

opened 2026-05-05 09:53:10 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:53:10 -06:00

Owner

Originally created by @ghost on GitHub (Sep 1, 2024).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6457

It is hard to manage a lot of custom profiles. The current solution of looking for profiles in ~/.config/firejail does not solve it because it is not system wide, so apps launched from another user will not use those profiles. For custom, multi-user profile management there should be another directory.

This approach allows much cleaner, system-wide profile changes that mixing a ton of new config files /etc/firejail. For example, to move all the custom changes to a new install requires just copy / pasting the /usr/local/etc/firejail directory

Serious errors can be created when creating profiles in "~./config/firejail" that do not exist outside. For example, a user may have profiles that blacklist private directories such as ~./Private. If one day they accidently run that app using "sudo" then the custom profile in ~/ would not be read and their /Private folder would be read.

My point being that in most use-cases it doesn't make sense to have profiles specific to one user that also is not blocked system-wide. And for these system-wide changes it makes more sense to have a system-wide custom directory to not clutter the /etc/firejail directory.

Describe the solution you'd like

Look for profiles in the following order:

~/.config/firejail
/usr/local/etc/firejail
/etc/firejail

Originally created by @ghost on GitHub (Sep 1, 2024). Original GitHub issue: https://github.com/netblue30/firejail/issues/6457 ### Is your feature request related to a problem? Please describe. It is hard to manage a lot of custom profiles. The current solution of looking for profiles in ~/.config/firejail does not solve it because it is not system wide, so apps launched from another user will not use those profiles. For custom, multi-user profile management there should be another directory. This approach allows much cleaner, system-wide profile changes that mixing a ton of new config files /etc/firejail. For example, to move all the custom changes to a new install requires just copy / pasting the /usr/local/etc/firejail directory Serious errors can be created when creating profiles in "~./config/firejail" that do not exist outside. For example, a user may have profiles that blacklist private directories such as ~./Private. If one day they accidently run that app using "sudo" then the custom profile in ~/ would not be read and their /Private folder would be read. My point being that in most use-cases it doesn't make sense to have profiles specific to one user that also is not blocked system-wide. And for these system-wide changes it makes more sense to have a system-wide custom directory to not clutter the /etc/firejail directory. ### Describe the solution you'd like Look for profiles in the following order: ~/.config/firejail /usr/local/etc/firejail /etc/firejail

gitea-mirror

2026-05-05 09:53:10 -06:00

closed this issue
added the
duplicate
label

gitea-mirror commented

2026-05-05 09:53:13 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 1, 2024):

Duplicated of #4871

Also doubting that /usr/local is the right path.

It conflict if firejail is installed from git with make install into /usr/local.
Does not scale well for different filesystem layouts (e.g. guix) and is not the best/correct choice in file-hierachy/fhs/hier.

If one day they accidently run that app using "sudo" then the custom profile in ~/ would not be read and their /Private folder would be read.

If you accidental run apps using sudo you have a different problem in your op-sec. Also running a app using sudo may allow the app to undo a blacklist.

Also I do not think that this is inside of firejails generally to be assumed thread model given that firejail/firecfg does not stop you from running a program without it using e.g. it's full path.

for these system-wide changes it makes more sense to have a system-wide custom directory to not clutter the [default] directory.

Yes

My point being that in most use-cases it doesn't make sense to have profiles specific to one user that also is not blocked system-wide.

.locals: make sense on per-user basis
.profile: may or may not, there a different thing, the main focus of firejail are single.

@rusty-snake commented on GitHub (Sep 1, 2024): Duplicated of #4871 -- Also doubting that `/usr/local` is the right path. 1. It conflict if firejail is installed from git with `make install` into `/usr/local`. 2. Does not scale well for different filesystem layouts (e.g. guix) and is not the best/correct choice in file-hierachy/fhs/hier. > If one day they accidently run that app using "sudo" then the custom profile in ~/ would not be read and their /Private folder would be read. If you accidental run apps using sudo you have a different problem in your op-sec. Also running a app using sudo may allow the app to undo a `blacklist`. Also I do not think that this is inside of firejails generally to be assumed thread model given that firejail/firecfg does not stop you from running a program without it using e.g. it's full path. > for these system-wide changes it makes more sense to have a system-wide custom directory to not clutter the [default] directory. Yes > My point being that in most use-cases it doesn't make sense to have profiles specific to one user that also is not blocked system-wide. `.local`s: make sense on per-user basis `.profile`: may or may not, there a different thing, the main focus of firejail are single.

gitea-mirror commented

2026-05-05 09:53:14 -06:00

Author

Owner

@kmk3 commented on GitHub (Sep 2, 2024):

Closing as a duplicate of #4871.

Regarding the path, the most appropriate place to put the profiles would
probably be in /usr/share:

https://github.com/netblue30/firejail/issues/4871#issuecomment-1017627638

Such as in /usr/share/firejail/profiles.

@kmk3 commented on GitHub (Sep 2, 2024): Closing as a duplicate of #4871. Regarding the path, the most appropriate place to put the profiles would probably be in /usr/share: * <https://github.com/netblue30/firejail/issues/4871#issuecomment-1017627638> Such as in /usr/share/firejail/profiles.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3277

No description provided.

Rows
Columns