[PR #3926] [MERGED] Disable the webkit2gtk-4.0 sandbox in bijiben #4954

New issue

Closed

opened 2026-05-05 10:29:38 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 10:29:38 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/netblue30/firejail/pull/3926
Author: @rusty-snake
Created: 1/29/2021
Status: ✅ Merged
Merged: 1/31/2021
Merged by: @rusty-snake

Base: master ← Head: disbale-bwrap-in-bijiben

📝 Commits (1)

7455356 Disable the webkit2gtk-4.0 sandbox in bijiben

📊 Changes

1 file changed (+2 additions, -0 deletions)

View changed files

📝 etc/profile-a-l/bijiben.profile (+2 -0)

📄 Description

webkit2gtk uses a bwrap based sandbox by default since 4.0, see #3647.
This is good as it means more security by default on for linux system.
Unfortunately is it not possible to run bwrap inside firejail if bwrap
is started with --unshare-pid --proc /proc at all. In general we should
exclude a program from firecfg until a final solution is found. But
bijiben is special, while epiphany or evolution display random stuff
from the internet is webkit2gtk in bijiben used to display local files
create by the user. Bijiben has a thight profile (net none, whitelist,
private-bin, ...) therefore my decision here was to disable the
webkit2gtk sandbox rather then firejail.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/netblue30/firejail/pull/3926 **Author:** [@rusty-snake](https://github.com/rusty-snake) **Created:** 1/29/2021 **Status:** ✅ Merged **Merged:** 1/31/2021 **Merged by:** [@rusty-snake](https://github.com/rusty-snake) **Base:** `master` ← **Head:** `disbale-bwrap-in-bijiben` --- ### 📝 Commits (1) - [`7455356`](https://github.com/netblue30/firejail/commit/74553569e5311012b7d582c4a2f3c481b876810a) Disable the webkit2gtk-4.0 sandbox in bijiben ### 📊 Changes **1 file changed** (+2 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `etc/profile-a-l/bijiben.profile` (+2 -0) </details> ### 📄 Description webkit2gtk uses a bwrap based sandbox by default since 4.0, see #3647. This is good as it means more security by default on for linux system. Unfortunately is it not possible to run bwrap inside firejail if bwrap is started with --unshare-pid --proc /proc at all. In general we should exclude a program from firecfg until a final solution is found. But bijiben is special, while epiphany or evolution display random stuff from the internet is webkit2gtk in bijiben used to display local files create by the user. Bijiben has a thight profile (net none, whitelist, private-bin, ...) therefore my decision here was to disable the webkit2gtk sandbox rather then firejail. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

gitea-mirror

2026-05-05 10:29:38 -06:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#4954

No description provided.

Rows
Columns