github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1120] Keepass section in browser profiles #769

New issue

Closed

opened 2026-05-05 06:37:33 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 06:37:33 -06:00

Owner

Originally created by @SYN-cook on GitHub (Mar 1, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1120

I was playing around with KeePass and browser extensions (KeeFox, PassIFox and ChromeIPass) today, and I found that the following section was obsolete in the Firefox and Chrome profiles:

# lastpass, keepass
# for keepass we additionally need to whitelist our .kdbx password database
whitelist ~/.keepass
whitelist ~/.config/keepass
whitelist ~/.config/KeePass

Everything worked nicely without... Since Keepass configuration files are blacklisted via disable-passwdmgr.inc, and blacklisting was never disabled, it seems the code in this section was anyways always broken (already before #993). So do I miss something here, or is this section safe to remove?

We should probably remove these lines if they are not absolutely necessary (I could prepare a pull request. And I would also introduce noblacklist ~/.lastpass into the browser profiles, so that LastPass is finally able to write local backups from Firefox).

Originally created by @SYN-cook on GitHub (Mar 1, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1120 I was playing around with KeePass and browser extensions (KeeFox, PassIFox and ChromeIPass) today, and I found that the following section was obsolete in the Firefox and Chrome profiles: `# lastpass, keepass` `# for keepass we additionally need to whitelist our .kdbx password database` `whitelist ~/.keepass` `whitelist ~/.config/keepass` `whitelist ~/.config/KeePass` Everything worked nicely without... Since Keepass configuration files are blacklisted via disable-passwdmgr.inc, and blacklisting was never disabled, it seems the code in this section was anyways always broken (already before #993). So do I miss something here, or is this section safe to remove? We should probably remove these lines if they are not absolutely necessary (I could prepare a pull request. And I would also introduce `noblacklist ~/.lastpass` into the browser profiles, so that LastPass is finally able to write local backups from Firefox).

gitea-mirror

2026-05-05 06:37:33 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 06:37:39 -06:00

Author

Owner

@SYN-cook commented on GitHub (Mar 1, 2017):

This seems to be related to #1095. My password database is 1. blacklisted and 2. not whitelisted for the browser, and still I can use it with the browser extensions.

Apparently the extensions don't access the password database directly, but communicate with Keepass (as the server) via http or via json-rpc. With a networking namespace, the connection is lost between KeeFox extension and Keepass server.

I have found only one extension for Chrome that demands direct access to the password store (although it actually discourages using offline password stores) and at the same time has a notable userbase. If we unblacklist and whitelist $HOME/*.kdb(x) for browsers and keep asking users to whitelist their password databases, it would be mostly only for this extension.

@SYN-cook commented on GitHub (Mar 1, 2017): This seems to be related to #1095. My password database is 1. blacklisted and 2. not whitelisted for the browser, and still I can use it with the browser extensions. Apparently the extensions don't access the password database directly, but communicate with Keepass (as the server) [via http](https://github.com/pfn/keepasshttp) or [via json-rpc](https://github.com/luckyrat/KeeFox/wiki/en-%7C-Technical-%7C-KeePassRPC-detail). With a networking namespace, the connection is lost between KeeFox extension and Keepass server. I have found only [one extension](https://chrome.google.com/webstore/detail/ckp-keepass-integration-f/lnfepbjehgokldcaljagbmchhnaaogpc) for Chrome that demands direct access to the password store (although it actually discourages using offline password stores) and at the same time has a notable userbase. If we unblacklist and whitelist $HOME/*.kdb(x) for browsers and keep asking users to whitelist their password databases, it would be mostly only for this extension.

gitea-mirror commented

2026-05-05 06:37:42 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 3, 2017):

Send a pull request, I'll merge it.

@netblue30 commented on GitHub (Mar 3, 2017): Send a pull request, I'll merge it.

gitea-mirror referenced this issue

2026-05-05 10:07:12 -06:00

[PR #769] [MERGED] xpra fix #3749

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#769

No description provided.

Rows
Columns