github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #573] Using Firejail by Default #408

New issue

Closed

opened 2026-05-05 05:48:10 -06:00 by gitea-mirror · 13 comments

gitea-mirror commented

2026-05-05 05:48:10 -06:00

Owner

Originally created by @ghost on GitHub (Jun 15, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/573

Originally created by @ghost on GitHub (Jun 15, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/573

gitea-mirror

2026-05-05 05:48:10 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:48:15 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 15, 2016):

Try firecfg which is available since 0.9.40.
It creates symlinks for your profiles in /usr/local/bin, which causes them to get started with firejail automatically.

@reinerh commented on GitHub (Jun 15, 2016): Try firecfg which is available since 0.9.40. It creates symlinks for your profiles in /usr/local/bin, which causes them to get started with firejail automatically.

gitea-mirror commented

2026-05-05 05:48:17 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 15, 2016):

Yes, it's installed by default.

It works when the tools are started by name (via menu/desktop files, etc.), not by absolute path.
When the absolute path is in the desktop file, firejail will not be called.

@reinerh commented on GitHub (Jun 15, 2016): Yes, it's installed by default. It works when the tools are started by name (via menu/desktop files, etc.), not by absolute path. When the absolute path is in the desktop file, firejail will not be called.

gitea-mirror commented

2026-05-05 05:48:18 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 15, 2016):

You put your config like net eth0 into your profile.
Calling firejail over a symlink is like starting firejail with the profile.

But I just see that x11 is not supported for profiles.

@reinerh commented on GitHub (Jun 15, 2016): You put your config like `net eth0` into your profile. Calling firejail over a symlink is like starting firejail with the profile. But I just see that x11 is not supported for profiles.

gitea-mirror commented

2026-05-05 05:48:20 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 15, 2016):

The command line is not affected at all.
If you edit profile files (the default behavior of sandboxed applications in /etc/firejail), you can put net eth0 in, but X11 sandboxing is currently not possible via profiles.

@reinerh commented on GitHub (Jun 15, 2016): The command line is not affected at all. If you edit profile files (the default behavior of sandboxed applications in /etc/firejail), you can put `net eth0` in, but X11 sandboxing is currently not possible via profiles.

gitea-mirror commented

2026-05-05 05:48:22 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 16, 2016):

When launching it with additional parameters you can still see Reading profile /etc/firejail/firefox.profile, so your profile will still be honored.

@reinerh commented on GitHub (Jun 16, 2016): When launching it with additional parameters you can still see `Reading profile /etc/firejail/firefox.profile`, so your profile will still be honored.

gitea-mirror commented

2026-05-05 05:48:25 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 16, 2016):

It means that you can not configure X11 sandboxing in profiles, see also:
https://firejail.wordpress.com/features-3/man-firejail-profile/

@reinerh commented on GitHub (Jun 16, 2016): It means that you can not configure X11 sandboxing in profiles, see also: https://firejail.wordpress.com/features-3/man-firejail-profile/

gitea-mirror commented

2026-05-05 05:48:27 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 16, 2016):

Yes, that works too.
But I find the symlink solution more elegant (if X11 sandboxing is not important).

@reinerh commented on GitHub (Jun 16, 2016): Yes, that works too. But I find the symlink solution more elegant (if X11 sandboxing is not important).

gitea-mirror commented

2026-05-05 05:48:28 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 16, 2016):

It probably depends on the file manager and/or the .desktop files, but in general opening files sandboxed in Evince is possible with the symlink approach (assuming Evince is not started by absolute path).

@reinerh commented on GitHub (Jun 16, 2016): It probably depends on the file manager and/or the .desktop files, but in general opening files sandboxed in Evince is possible with the symlink approach (assuming Evince is not started by absolute path).

gitea-mirror commented

2026-05-05 05:48:31 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 17, 2016):

We don't have support for file managers in this moment. They use full paths to start executables.

@netblue30 commented on GitHub (Jun 17, 2016): We don't have support for file managers in this moment. They use full paths to start executables.

gitea-mirror commented

2026-05-05 05:48:33 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 18, 2016):

It depends on the file manager. Some of them allow you to handle a specific file type with a specific executable. For example for .pdf files, it opens a window where you can choose the executable. In this window you would go an choose /usr/local/bin/evince instead of the regular /usr/bin/evince.

@netblue30 commented on GitHub (Jun 18, 2016): It depends on the file manager. Some of them allow you to handle a specific file type with a specific executable. For example for .pdf files, it opens a window where you can choose the executable. In this window you would go an choose /usr/local/bin/evince instead of the regular /usr/bin/evince.

gitea-mirror commented

2026-05-05 05:48:35 -06:00

Author

Owner

@ghost commented on GitHub (Jun 20, 2016):

I only skimmed this thread, but you can also put a bash alias with your firejail and options prepended to the program name, but that obviously only works for programs started from the shell. Just as another tip.
Or I have some symlinks to firejail in ~/.bin/. (Easier to set symlinks because no root perms are required and I use ~/.bin/ anyway.)

@ghost commented on GitHub (Jun 20, 2016): I only skimmed this thread, but you can also put a bash alias with your firejail and options prepended to the program name, but that obviously only works for programs started from the shell. Just as another tip. Or I have some symlinks to firejail in `~/.bin/`. (Easier to set symlinks because no root perms are required and I use `~/.bin/` anyway.)

gitea-mirror commented

2026-05-05 05:48:35 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 23, 2016):

There is no clean solution at the moment, you will have to do it for each file type. What distro and desktop environment are you using?

@netblue30 commented on GitHub (Jun 23, 2016): There is no clean solution at the moment, you will have to do it for each file type. What distro and desktop environment are you using?

gitea-mirror commented

2026-05-05 05:48:38 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 26, 2016):

Yes, do "sudo apt-get install firejail"

@netblue30 commented on GitHub (Jun 26, 2016): Yes, do "sudo apt-get install firejail"

gitea-mirror referenced this issue

2026-05-05 08:05:07 -06:00

[GH-ISSUE #2097] firecfg: allow for ignoring specific apps #1419

gitea-mirror referenced this issue

2026-05-05 08:26:30 -06:00