mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #1139] Profile requests #789
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#789
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @netblue30 on GitHub (Mar 10, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1139
Issue to ask for and discuss about new profiles.
Progress is tracked in: https://github.com/users/netblue30/projects/7
latex2*,pdf*,rst2*,pod2,pcp2pdf,wkhtmltopdf, ...)disable-sys.incto restrict access to files in/sys/{block,bus,class,dev,devices,kernel}io.elementary.calculator)io.elementary.calendario.elementary.calendar-daemonio.elementary.camera)io.elementary.capnet-assist)io.elementary.code)io.elementary.filesio.elementary.files-daemonio.elementary.files-pkexecio.elementary.music)io.elementary.photos) - Based on the old Shotwell codeio.elementary.terminal)io.elementary.videos)gnome-podcasts)passgopasskbfsfuse(not sure if this one makes sense...)keybasekeybase-guiykmanykman-guigzdoom)quake)rrootage)Resolved
gnome-online-minersGhetto-skypeTbb PPAGnome-boxesTor MessengerTemaviewerhttps://github.com/netblue30/firejail/issues/825#issuecomment-250977527qemu-system-*qemu-kvm@nyancat18 commented on GitHub (Mar 22, 2017):
macrofusion
hugin
imagej
geary
@nyancat18 commented on GitHub (Mar 22, 2017):
https://sourceforge.net/projects/macrofusion/
http://hugin.sourceforge.net/
https://imagej.nih.gov/ij/
@Fred-Barclay commented on GitHub (Mar 22, 2017):
@rekixex does #1154 work for you?
@magistryo commented on GitHub (Mar 24, 2017):
Hey donosaurus - where is you GUI ?? Wery needed firewall like that - app goes to internet -> wirewall asks - > allow/deny/create rule.
@Fred-Barclay commented on GitHub (Mar 26, 2017):
@rekixex gpicview has been added:
b51d44a29a😄@nyancat18 commented on GitHub (Mar 30, 2017):
1 brl-cad (a millitary-veteran CAD..but common at civilian enviorments)
2 freecad (a civil-use CAD)3 dia (from gnome)4 fontforge@mustaqimM commented on GitHub (Apr 10, 2017):
Nylas Email client
Wire Chat client
@Fred-Barclay
@Fred-Barclay commented on GitHub (Apr 12, 2017):
@mustaqimM We actually already have a Wire profile. 😄
@mustaqimM commented on GitHub (Apr 13, 2017):
@Fred-Barclay Thanks for that, for some reason it wasn't in the AUR package, so now I'm using the git one. I'm having trouble creating a profile for
Nylas Mail, I getBy the way, it's an electron app.
@Fred-Barclay commented on GitHub (Apr 13, 2017):
Sure, I'll take a look at it. Can you open a new issue, post the profile you're currently using, and @Fred-Barclay me so I'll get a notification?
@Micha-Btz commented on GitHub (May 1, 2017):
would be nice to have profiles for
tvbrowserand jdownloader2 :-)@ghost commented on GitHub (May 10, 2017):
Hi, I would like to make a restrictive version of the "transmission-gtk.profile". As of now, it has access to all folders within my home folder, and I would like to restrict it to a "Torrents" folder only in the home folder. How would I go about doing that? My current transmission-gtk profile is the following:
@netblue30 commented on GitHub (May 10, 2017):
The easiest way would be to start the sandbox with a different user home directory - /home/username/Torrents in your case. Create an empty ~/Torrents directory (mkdir ~/Torrents) and in your profile file add "private ~/Torrents" at the end of the file.
@qazip commented on GitHub (May 11, 2017):
Profile requests:
@nyancat18 commented on GitHub (May 13, 2017):
cherrytree (a onenote-like app for linux)
vym/freemind
@netblue30 commented on GitHub (May 13, 2017):
@qazip - Wire is already in, grab he profile from here: https://github.com/netblue30/firejail/blob/master/etc/wire.profile
@nyancat18 - cherytree is in: https://github.com/netblue30/firejail/blob/master/etc/cherrytree.profile\
@hThoreau - If you just use the default profile, is that one working?
Blacklist violations are logged in system log - /var/log/syslog or /var/log/messages depending on your distribution
@nyancat18 commented on GitHub (May 14, 2017):
thanks @netblue30
but freemind/vym :D
@qazip commented on GitHub (May 14, 2017):
@netblue30 oh, that's weird. I don't have that file for some reason. Shouldn't I have (I've firejail 0.9.44.10).
@qazip commented on GitHub (May 21, 2017):
Another profile request:
@breznak commented on GitHub (May 25, 2017):
InSync
https://www.insynchq.com/
variety
http://peterlevi.com/variety/
KDE connect
https://community.kde.org/KDEConnect
RedShifthttps://wiki.archlinux.org/index.php/redshift
and
Y PPA Manager
https://launchpad.net/y-ppa-manager
Would be nice to have too.
@nyancat18 commented on GitHub (May 25, 2017):
cinepaint
@nyancat18 commented on GitHub (May 25, 2017):
jahshakavr
@qazip commented on GitHub (May 27, 2017):
@nyancat18 commented on GitHub (May 28, 2017):
@razip youtube-dl
@ghanan commented on GitHub (Jun 2, 2017):
Would be great if we had a profile which allow us to simulate the installation of programs, as "Arkose" used to do. Look: https://stgraber.org/category/arkose/
Maybe it could be implemented using some overlayfs.
@Fred-Barclay commented on GitHub (Jun 2, 2017):
@rekixex Catfish has been added:
67a6d8712fI'll try to work on Cheese as well.
@netblue30 commented on GitHub (Jun 4, 2017):
@ghanan - it is quite easy, this is an example using OpenShot video editor:
In a terminal start a overlayfs sandbox (you would need a kernel 3.18 or better):
In a different terminal, join the sandbox as root and install the program - I am using apt-get on Debian:
Back in the first terminal run the program
Once you close both sandboxes, overlayfs is disabled and openshot disappears.
@pemartins1 commented on GitHub (Jun 28, 2017):
I saw it's already on the list but nevertheless I'd like to request a profile for Geary Email Client (https://github.com/GNOME/geary).
Thank you very much and keep up with the good work.
@ghost commented on GitHub (Jun 29, 2017):
I'm using the nautilus profile provided here in the etc folder. It blocks the extensions clamtk-gnome (5.24-1) and nautilus-compare (0.0.4+po1-1), though other extensions that I also have installed, nautilus-wipe (0.3-1) and onionshare (0.9.2-1), work fine. Therefore, I ask for an amendment to nautilus' profile that could allow it to use these extensions as well. Thank you.
@startx2017 commented on GitHub (Jun 29, 2017):
@rekixex - KWrite: https://github.com/netblue30/firejail/blob/master/etc/kwrite.profile
@pemartins1 - Geary: https://github.com/netblue30/firejail/blob/master/etc/geary.profile
@ghost commented on GitHub (Jul 10, 2017):
Requesting a profile for soulseekqt ( a few links because the download page hasn't been updated yet, and the last two are direct links )
http://www.soulseekqt.net/news/
https://groups.google.com/d/msg/soulseek-discussion/lOvh7PoOKR0/uIZKRFZmCQAJ
https://www.dropbox.com/s/b8st8jznojbus0b/SoulseekQt-2017-2-20-Ubuntu17-64bit.tgz (x86_64)
https://www.dropbox.com/s/m12bxp0bjl6iqo9/SoulseekQt-2017-2-20-Ubuntu17-32bit.tgz (i686)
@ghost commented on GitHub (Jul 10, 2017):
Tribler, a onion routing torrent client: https://github.com/Tribler/tribler
@nyancat18 commented on GitHub (Jul 11, 2017):
utox (a light tox client)
@wiredrunner commented on GitHub (Jul 15, 2017):
Enpass password manager, enpass.io
@KernelFreeze commented on GitHub (Jul 28, 2017):
Minecraft Server (Java), only allow java and server files
@loopified commented on GitHub (Aug 13, 2017):
Discord.
@Fred-Barclay commented on GitHub (Nov 8, 2017):
@wiredrunner Enpass added in
78b6a1d4b0😄@pemartins1 commented on GitHub (Dec 7, 2017):
I'd like to make another request, this time for Leonflix (http://leonflix.net/). It's not open source so this one's better be Firejailed.
Thanks for everything once again!
@SkewedZeppelin commented on GitHub (Dec 7, 2017):
@pemartins1 see https://github.com/netblue30/firejail/pull/1613#issuecomment-340260231
@viq commented on GitHub (Jan 5, 2018):
Lightly tested discord profile in #1715
@idnovic commented on GitHub (Mar 3, 2018):
add vs code
@Fred-Barclay commented on GitHub (Mar 4, 2018):
@idnovic VS Code added in
f6502ebf23😁@punksta commented on GitHub (Mar 21, 2018):
Would like to have upwork desktop profile and base profile for other time tracking systems.
Nice to have:
@chiraag-nataraj commented on GitHub (May 4, 2018):
Copying from #1878: Coyim (suggested by @bn0785ac)
@pemartins1 commented on GitHub (Jun 4, 2018):
Minitube
https://flavio.tordini.org/minitube
@pemartins1 commented on GitHub (Jun 26, 2018):
Cantata
https://github.com/CDrummond/cantata
@iskunk commented on GitHub (Oct 18, 2018):
I have put together a profile for Citra (Nintendo 3DS game system emulator), and would like to contribute it.
(Note that the
private-devline might be uncommented once #2203 is resolved.)@qazip commented on GitHub (Oct 19, 2018):
qownnotes: https://github.com/pbek/QOwnNotes
@Fred-Barclay commented on GitHub (Oct 19, 2018):
@qazip Can you try this profile for qownnotes?
@Vincent43 commented on GitHub (Oct 19, 2018):
@Fred-Barclay I tested Qownotes profile and it works good. I wonder if we should add:
@qazip commented on GitHub (Nov 28, 2018):
feedreader (https://github.com/jangernert/FeedReader)
@SkewedZeppelin commented on GitHub (Nov 28, 2018):
@qazip feedreader was added a few days ago in
cc898c1902@reinerh commented on GitHub (Dec 1, 2018):
In #2273 profiles for Quake3 and UrbanTerror have been requested.
@qazip commented on GitHub (Jan 2, 2019):
Anki (https://apps.ankiweb.net/index.html)
@q3cpma commented on GitHub (Jan 14, 2019):
Hello, a profile for makemkv (https://www.makemkv.com/) would be nice since it's one of the only GNU/Linux proprietary softwares without alternative.
@SkewedZeppelin commented on GitHub (Jan 15, 2019):
@q3cpma there is handbrake which seems to do the same and already has an existing profile
@q3cpma commented on GitHub (Jan 15, 2019):
On Mon, Jan 14, 2019 at 06:48:26PM -0800, SkewedZeppelin wrote:
Hello, it's absolutely not the same, MakeMKV is used to decrypt BDs.
@rusty-snake commented on GitHub (Jan 15, 2019):
Maybe mpv can this if libdvdcss is installed.
EDIT: or other libs.
See: https://wiki.archlinux.org/index.php/Blu-ray
@q3cpma commented on GitHub (Jan 15, 2019):
On Tue, Jan 15, 2019 at 07:37:54AM -0800, rusty-snake wrote:
Well, no, since libdvdcss is for DVDs (like its name implies). libaacs and
libbdplus exist for this purpose, but I don't know any tool that uses them for
backup, sadly.
@ghost commented on GitHub (Jan 16, 2019):
the default konversation profile do not contains the
netlinkprotocol so the logs are spammed with errors, i'm not sure about the consequences for the app or if it's intended by the profile author.netfilterin warzone2100 profile is breaking the game hosting function for me, not sure if it's because i'm using --net eth0 --ip.. to bypass my vpn@Vincent43 commented on GitHub (Jan 16, 2019):
@Lockdis konvrsation profile is fixed in master now, thx.
@ghost commented on GitHub (Jan 18, 2019):
https://github.com/netblue30/firejail/blob/master/etc/flameshot.profile
flameshot is not working (the application hang and refuse to take screenshot, i can't find errors in log) for me with the default profile, by removing
memory-deny-write-executeit works@Vincent43 commented on GitHub (Jan 18, 2019):
@Lockdis fixed in master, thx.
6e8ced5fbd@brakenow commented on GitHub (Jan 18, 2019):
Mellowplayer please. :-) It depends on flashplayer.
@qazip commented on GitHub (Jan 24, 2019):
Fractal (It's a matrix client: https://gitlab.gnome.org/GNOME/fractal)
@qazip commented on GitHub (Feb 3, 2019):
Quaternion (It's a matrix client: https://github.com/QMatrixClient/Quaternion/)
@cyrinux commented on GitHub (Feb 12, 2019):
Stubby https://github.com/getdnsapi/stubby, a dns resolver, think a profile like unbound maybe?
@schtobia commented on GitHub (Feb 16, 2019):
webui-aria2, the popular web UI for the aria2 download manager, has now also a profile. (Could be included via PR.)
@Fred-Barclay commented on GitHub (Feb 16, 2019):
@schtobia Please open the PR! It'd be great to have this. 😉
@ghost commented on GitHub (Mar 13, 2019):
Postfix
Specifically the smtp executable. Seems non-trivial; this script fails with a useless error message:
(edit)
If I run that script directly from the CLI,
firejailgives: "invalid whitelist path: /etc/aliases". If I remove that whitelist entry,firejailcomplains about the next one.. and so on. The only pathfirejailallows me to whitelist from the above list is/var/lib/postfix(thedata_directory).SpamAssassin
There are data leaks, so sandboxing S/A is important for security. I've not tried the default config so I'm not sure if a profile is needed but there are essential config files so I guess it's likely.
@ghost commented on GitHub (Mar 13, 2019):
@libBletchley Did you try the
serverprofile yet for PostFix/smtp? The default profile is a generic GUI one (like it says inside the file). On another note, IMHO it would be more appropriate for a daemon like smtp to use native systemd hardening techniques.@ghost commented on GitHub (Mar 13, 2019):
@glitsj16 I didn't know about
server.profile. Maybe I'll try that and add port 25 loosening in the netfilter. I plan to use firejail to force it through a Tor middlebox so systemd changes wouldn't be sufficient.@ghost commented on GitHub (Mar 18, 2019):
I have a working
smtp.profile. Note that it was tested in a firejail that is isolated on a Tor middlebox. I've removed anything Tor-specific but did not test it that way. Anyway, this is the profile if someone wants to integrate it. Note thatpostfix_smtp.profilemay be a better name.Postfix/smtp seems to write to
/var/logwithout any issues, even though it's not whitelisted. I'm not sure how that's possible.@alien2003 commented on GitHub (Mar 22, 2019):
bitwarden
@CodeArtisan00 commented on GitHub (Mar 26, 2019):
LyxKile
SpectacleAvidemuxVmware-Workstation@ghost commented on GitHub (Mar 28, 2019):
RTV
@johnp commented on GitHub (May 8, 2019):
llpp
foliate@TheDarkTrumpet commented on GitHub (May 20, 2019):
Added pull request https://github.com/netblue30/firejail/pull/2710
@rusty-snake commented on GitHub (May 30, 2019):
Requested in #2731 by @jose1711
@jose1711 commented on GitHub (May 30, 2019):
please add
autotrace- it has a high number of CVE's assigned (https://www.cvedetails.com/vulnerability-list/vendor_id-12987/product_id-26551/year-2017/opov-1/Autotrace-Project-Autotrace.html)@Fred-Barclay commented on GitHub (May 31, 2019):
@jose1711 this autotrace? https://github.com/autotrace/autotrace
@SkewedZeppelin commented on GitHub (May 31, 2019):
@Fred-Barclay that seems to be an unoffical fork of the original
http://autotrace.sourceforge.net/
fedora ships a patched version of the original
arch aur has the unofficial
debian used to ship the original
gentoo doesn't ship either
https://blogs.gentoo.org/ago/2017/05/20/autotrace-multiple-vulnerabilities-the-autotrace-nightmare/
@Fred-Barclay commented on GitHub (Jun 3, 2019):
@qazip can you try this profile for jerry-chess?
@qazip commented on GitHub (Jun 4, 2019):
@Fred-Barclay, I no longer use jerry-chess. But I'll see if I can test it sometime this week!
@rusty-snake commented on GitHub (Jun 18, 2019):
Last Update: 2017-03-08 (tor-browser 6.x.x)
No Support for Ubuntu 17.10, 18.04, 18.10, 19.04
firejail --noprofile gnome-boxesdon't work.UPDTE:
firejail --noprofile --writable-var gnome-boxescan start VMs but if you shutdown them, gnome-boxes coredumps.cannot be jailed by firejail because it has only binaries in libexec that are started via dbus.
I suggest to close these requests.
@rusty-snake commented on GitHub (Jun 25, 2019):
closed everything expect gnome-boxes (
firejail --noprofile --writable-var gnome-boxesworks) I will write a profile this week.@qazip Have you found the time
@qazip commented on GitHub (Jun 25, 2019):
No, sorry. I tried to install jerry from AUR but it's giving an error. I don't want to compile it myself..
But if it works for you, it probably works for me too!
@rusty-snake commented on GitHub (Jun 30, 2019):
Give up writing a profile for gnome-boxes, poweroff a VM always ends in a coredump.
@rusty-snake commented on GitHub (Aug 20, 2019):
FreeTube requested in #2918 by @MystesofEternity
@Niklas974 commented on GitHub (Aug 29, 2019):
I would appreciate a profile for zotero (Reference management software)
@matu3ba commented on GitHub (Sep 27, 2019):
neovim, setup script (or adding to firecfg) for desktop files for AppImage in
$HOME/.local/bin@svc88 commented on GitHub (Sep 30, 2019):
Please can make profile for Sia-UI .appimage https://gitlab.com/NebulousLabs/Sia-UI/-/releases
thank you so much
@rusty-snake commented on GitHub (Oct 5, 2019):
Draft for RTV
@Fred-Barclay commented on GitHub (Oct 5, 2019):
@rusty-snake Looks good! One thing, on Arch I need to add
sh,xdg-settingsto private-bin for the rtv.profile to work. 😉@ghost commented on GitHub (Oct 27, 2019):
amuled is the deamon version of amule.
I run it like this:
firejail --private-bin=amuled --profile=/etc/firejail/amule.profile /usr/bin/amuled@dandelionred commented on GitHub (Nov 3, 2019):
Profile request: mattermost desktop client
@rusty-snake commented on GitHub (Dec 14, 2019):
WPS-Office (http://www.wps.com/)
[Moved form #3040]
@necopinus commented on GitHub (Jan 6, 2020):
Some profile requests... This looks like the right place to post them, but if I should open a separate ticket(s), just let me know.
The Elementary OS's Pantheon desktop is really nice. While the project is planning to move towards using Flatpaks for their major apps, the change doesn't seem imminent and having pre-defined jails would be awesome for those of us running Pantheon on non Elementary OS systems.
io.elementary.calculator)io.elementary.calendario.elementary.calendar-daemonio.elementary.camera)io.elementary.capnet-assist)io.elementary.code)io.elementary.filesio.elementary.files-daemonio.elementary.files-pkexecio.elementary.music)io.elementary.photos) - Based on the old Shotwell codeio.elementary.terminal)io.elementary.videos)Some other profiles that would be awesome to have:
gnome-podcasts)passgopasskbfsfuse(not sure if this one makes sense...)keybasekeybase-guiykmanykman-guigzdoom)quake)rrootage)@svc88 commented on GitHub (Jan 6, 2020):
@rusty-snake any update on supporting this profile?
@svc88 commented on GitHub (Jan 6, 2020):
Also:
https://www.tweaking4all.com/home-theatre/rename-my-tv-series-v2/
Renames TV Series, code is not open source, so ideally a profile would be needed to block everything but internet and main folder where all TV Series lies.
I tried running default profile but i get these errors:
@ghost commented on GitHub (Jan 6, 2020):
@svc88 That sounds like you're missing sqlite. Do you have it installed?
@rusty-snake commented on GitHub (Jan 19, 2020):
@johnp can you test this profile for foliate. (firejail 0.9.62+)
foliate.profile
Update: Added in
df1c73a0@rusty-snake commented on GitHub (Jan 21, 2020):
@youknow10 can you test this profile for WPS Office. (firejail 0.9.62+)
wps.profile
wpp.profile
@youknow16 commented on GitHub (Jan 23, 2020):
@rusty-snake , they seem to work fine. Thanks.
Isn't it better to block the network with "net none"?
Also, there are two more programs there (wpspdf and et)
@rusty-snake commented on GitHub (Jan 23, 2020):
As a user opt-in, sure. However, it has some networking features (cloud 🤧 backup, help/manual, internal browser (based on chrome 68 🤒 🤢 😵 💀 )).
@rusty-snake commented on GitHub (Jan 29, 2020):
@youknow10
cc57e0c@ericschdt commented on GitHub (Feb 9, 2020):
I would like to request a profile for the deepin-screen-recorder and Joplin.
@rusty-snake commented on GitHub (Mar 21, 2020):
mate-terminal requested in #3289 by @trancemind65.
@ghost commented on GitHub (Mar 21, 2020):
@trancemind65 Sandboxing a terminal emulator without making it unusable would be difficult. Due to their nature they require access to a wide and rather unpredictable set of commands (other applications) and restricting filesystem access would cause all kinds of impracticalities. That's why firejail blacklists them in /etc/firejail/disable-common.inc, mate-terminal included. Have a look inside that file to get the idea. Unless you have a very limited and predictable use-case it wouldn't be worth the effort IMHO.
@ghost commented on GitHub (Mar 21, 2020):
please a FireJail profile for Mate-Terminal, thanks!
@ghost commented on GitHub (Mar 23, 2020):
thanks for the info @ glitsj16.
@Atrate commented on GitHub (Mar 26, 2020):
If I want to push a fix to a profile should I just make a PR or do I need to post it in this issue?
@rusty-snake commented on GitHub (Mar 26, 2020):
make a PR -- in general if you have a finish patch a PR is easier to review while issues are better to discuss before coding.
@ghost commented on GitHub (Apr 4, 2020):
I would like to request a profile for shortwave the replacement of Gradio application.
@rusty-snake commented on GitHub (Apr 4, 2020):
@chrpinedo can you test this profile.
shortwave.profile
@ghost commented on GitHub (Apr 5, 2020):
@rusty-snake it seems to work right. I had to comment the line
#include whitelist-runuser-common.incbecause that file doesn't exist in my version 0.9.62-1 ArchLinux. I don't know if I can provide you with some kind of debugging information. Thanks!@rusty-snake commented on GitHub (Apr 5, 2020):
You can check if there are no missing whitelist paths.
Terminal1:
firejail --profile=path/to/shortwave.profile --name=shortwave --private shortwaveTerminal2:
firejail --join=shortwave ls -RaFor whitelist-runuser-common.inc you can use these lines (just add to the profile if you want).
@ghost commented on GitHub (Apr 10, 2020):
Hi @rusty-snake ! To check your two commands I had to disable
shell noneandprivate-bin shortwavebecause I was unable to get a shell inside the firejail or to run als -Racommand.Regarding your
whitelist-runuser-common.incfile I guess If I should activate it, I don't understand quite well if it would be useful and for which. For integration with GNOME ?Second, I propose one change to your profile:
~/.cache/gstreamer-1.0directory (it appears with ls -Ra in a private firejail running shortwave).shortwave.profile.txt
@rusty-snake commented on GitHub (Apr 10, 2020):
Thanks for your answer. wruc restricts the files available under /run/user/UID (= it is for hardening). You can copy it or wait for the next firejail release.
Regarding
.cache/gstreamer-1.0, IDT that it breaks something if it is not whitelisted. There are more programs also using/creating it and didn't have it whitelisted. Anywayprivate-cachemakes~/.cachea tmpfs.I can't open your attachment (trouble after the FFX 75 update I guess), if there is anything important.
@ghost commented on GitHub (Apr 10, 2020):
@rusty-snake don't worry about my attachment it only adds the noblacklist/mkdir/whitelist for the
.cache/gstreamer-1.0directory that it is no useful because ofprivate-cache, as you said. Thanks for your comments!@rusty-snake commented on GitHub (Jul 16, 2020):
Asbru requested by @NRGLine4Sec in #3512.
@svc88 commented on GitHub (Jul 18, 2020):
Homebank - [new profile request]
Homebank is a personal finance manager. Ive looked at a lot of them around and none of them come close to what this offers(includes crypto support) so its worth the firejail setup.
Its a simple installation via apt-get.
Homebank also updates the currencies online, so is it possible to allow incoming connections to update the currencies but at the same time block all outgoing connections with netfilters for protection?
As many apps, i dont trust this much without firejail, so Il really appreciate if you can help push this in the front of the queue.
http://homebank.free.fr/en/downloads.php
https://code.launchpad.net/homebank
@bbhtt commented on GitHub (Jul 18, 2020):
@svc88 Can you try this? homebank.txt Couldn't check the conversion rates online, even without Firejail it says "not found". I don't have any experience using this software, so you might want to tinker it. Under Firejail 0.9.62 the profile for firefox hasn't whitelisted the
/usr/share/doc, so you won't be able to open contents.@svc88 commented on GitHub (Jul 19, 2020):
@kortewegdevries thank you so much. It works on my side. You have to add a few currencies in the Currency preferences and then choose a base currency (default USD), after that close and re-open homebank and go back into the currency dialog box you will see the currencies are being updated.
Here is my log file, not sure if these dconf errors are normal though?
My other question is, if incoming connections are denied by default with 'netfilters' and outgoing connections are allowed does that mean that if the program for example had a backdoor wouldnt it still be able to upload content back to their servers with an "outgoing connection" ?
@rusty-snake commented on GitHub (Jul 19, 2020):
Notes on the homeback profile:
dbus-system nonecan likely be enabledipc-namespacecan cause issuesinclude whitelist-runuser-common.inccan likely be enabledinclude disable-xdg.inccan likely be enabled. needs to be moved at the end of the block${HOME}/.config/homebankneeds a mkdir, noblacklist, blacklistblacklist /tmp/.X11-unix: is this a gui or a cli program??!If the come from a file-open dialog they can be ignored
Only if you use
net foobar0and only if they are no response (i.e. a new connection).And only IPv4.
yes
You need to allow outgoing-connections to request the new currencies. netfilter can not be used to only allow connections for currencies, since it do not know anything about the data being send.
@bbhtt commented on GitHub (Jul 19, 2020):
It has a manual or contents and online resources. I don't know if they're needed.
0.9.62 doesn't have those profiles/controls. I kept them uncommented to suit owns version, and I didn't run it under latest.
Fixed...? What should I blacklist under
/.config?@rusty-snake commented on GitHub (Jul 19, 2020):
I would suggest that you open a PR with it, so we can bring it upstream. A PR is easier when reviewing.
@svc88 commented on GitHub (Jul 19, 2020):
No, browser is not needed at all (unless you want to click on the help/about page) - So no none of that is important. So you can remove private-bin.
This is a gui program so you disable
blacklist /tmp/.X11-unix(right?)Thanks for confirming, i think its best if you kill the whole network altogether with net none (for now at least) There will be a popup saying "Cannot resolve frankfurter.app" when opening Homebank as it will try to get the currency updates, but i can deal with that until i ask the dev to make the currency updates optional.
Im really not sure how to open a PR, would appreciate if one of you can open it so that we can continue there? I think the profile @kortewegdevries posted just needs small changes as we said
@MrFrank17 commented on GitHub (Jul 23, 2020):
I tried to create a profile for the pcloud client (www.pcloud.com). It looks like that at the moment:
protocol unix,inet,inet6,netlink,packet noblacklist ${PATH}/fusermount whitelist ${HOME}/.config/pcloud whitelist ${HOME}/.pcloud whitelist ${HOME}/.local/share/applications/appimagekit-pcloud.desktop whitelist ${HOME}/.config/pulse noblacklist ${HOME}/pCloudDrive include default.profileIt is partly working - the syncing works for me so far.
The client additionally mounts the cloud data in a separate local folder - this is not working.
If you want to try to create a pcloud profile, you can use that as a starting ground.
@rusty-snake commented on GitHub (Jul 23, 2020):
Background: even --noprofile and --profile=noprofile.profile did not help (https://github.com/netblue30/firejail/issues/2748#issuecomment-660551208 and the following).
@bbhtt commented on GitHub (Jul 28, 2020):
@MrFrank17 Can you check if this profile works?
pcloud.txt
: Downloads~$ firejail --profile=pcloud.profile --appimage pcloudboth should be in same Downloads folder,I don't understand how this works. There's a pcloudrive in Home,I select any folder to upload to the cloud,then select a folder within
pclouddrivethen sync seems to work. But I don't see where this is downloaded/mounted.There's currently a buffer overflow while running the program.
Also why is a terminal on the list, do we make profiles for them?
@MrFrank17 commented on GitHub (Jul 28, 2020):
I had to comment
include whitelist-runuser-common.inc(not found) anddbus-system noneThat is the output:
output.txt
Yes, the
pclouddrivein HOME shall show the cloud files. This is what I meant with "mounted folder" - sorry, if that was confusing. However, it still does not work.Yes, syncing works for me as well.
Sorry, not sure what you mean with that:
@bbhtt commented on GitHub (Jul 29, 2020):
Oh okay, now I understand, it's probably an encrypted vdisk image that gets mounted through the application only.
@neirenoir commented on GitHub (Aug 23, 2020):
I would like to request a profile for Unity Hub (and Unity, by extension).
@mYnDstrEAm commented on GitHub (Oct 29, 2020):
A profile for Lutris would be great. It's a very useful and popular software (a GNU/Linux flagship like GIMP) and firejailing it would make a lot of sense (running untrusted roms / games etc).
Might not be simple to get everything running fine due to its expansive support for many emulators (some of which may already have a firejail profile) and Wine but a profile to make changes to would be useful too. The profile could be very permissive at first. It would be best if it was a very stringent profile but made sure that everything it launches, launches with firejail and has a working firejail-profile.
#3483
@vargn commented on GitHub (Nov 10, 2020):
A profile for the discord TUI Cordless would be nice.
https://github.com/Bios-Marcel/cordless
@bbros-dev commented on GitHub (Dec 1, 2020):
A profile for socat would be useful as a starting point for allowing customizations.
@heli-aviator commented on GitHub (Jan 4, 2021):
I would love a profile for
If possible, I would love to see that we could firejail/sandbox i.e. the downloads folder for opening downloaded content. I have no idea if this is possible.
@ghost commented on GitHub (Jan 5, 2021):
@heli-aviator I added tutanota-desktop.profile in git. It would be awesome if you could test it. To do so you'll need to replicate the commits from https://github.com/netblue30/firejail/pull/3870/files. Download the profile and save it as ${HOME}/.config/firejail/tutanota-desktop.profile. Start it by running
firejail --ignore=quiet tutanota-desktopin a terminal and check for errors etc. If it's working as expected you can add it to your firecfg.cfg or wait until a new firejail release does so. Feel free to open a new issue if you have more questions on tutanota-desktop.@rusty-snake commented on GitHub (Jan 5, 2021):
… and https://github.com/netblue30/firejail/blob/master/etc/profile-a-l/electron.profile.
To not break other programs which include electron.profile, copy the content of electron.profile (here on master) at the end of you tutanota-desktop.profile.
Is the "Signal app" somthing else then signal-desktop?
@rptaylor commented on GitHub (Jan 6, 2021):
Would be great to have a profile for https://github.com/lensapp/lens
It's an electron app distributed via AppImage; I tried a number of options including
firejail --appimage --private --net=none --x11 --profile=/etc/firejail/electron.profile ./Lens-4.0.6.AppImagebut it did not work.https://github.com/lensapp/lens/issues/1905
@rusty-snake commented on GitHub (Jan 8, 2021):
firejail --private --net=none --ignore='noexec /tmp' --appimage --profile=electron Lens-4.0.6.AppImageallows me to start lens. I don't use kubernetes/lens so I can not write a full profile or tell if lens works with this command, but it starts with it.Notes:
--ignore='noexec /tmp': they seem to map(?) something from /tmp and then execute it.(Fedora 32; firejail from git)
@hariceratops commented on GitHub (Jan 16, 2021):
Would like to have a profile for Obsidian
Link to the application's site : https://obsidian.md/
Currently while running the application with firejail yields the following log
firejail --appimage obsidian.appimage
Mounting appimage type 2
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
** Note: you can use --noprofile to disable default.profile **
Parent pid 6611, child pid 6614
** Warning: dropping all Linux capabilities **
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Child process initialized in 108.17 ms
Parent is shutting down, bye...
AppImage unmounted
@rusty-snake commented on GitHub (Jan 16, 2021):
obsidian.profile draft
@hariceratops commented on GitHub (Jan 16, 2021):
Ran it with firejail --profile=/etc/firejail/obsidian.profile --apparmor obsidian.apparmor
The application doesnt launch though, the log looks like below
Reading profile /etc/firejail/obsidian.profile
Reading profile /etc/firejail/electron.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Mounting appimage type 2
Parent pid 10764, child pid 10767
** Warning: dropping all Linux capabilities **
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Child process initialized in 116.48 ms
Parent is shutting down, bye...
AppImage unmounted
@rusty-snake commented on GitHub (Jan 16, 2021):
This draft (just based on the permission of the flatpak and the fact that it is an electron program) requires the electron.profile from master. If you use firejail 0.9.64 you can copy the electron.profile from master to ~/.config/firejail/electron.profile. (This will then likely break other electron based programs, so just for testing).
@ZachIndigo commented on GitHub (Jan 29, 2021):
I would request librewolf. I have written a rough one, but having an official one would be nice.
librewolf.txt
@rusty-snake commented on GitHub (Jan 29, 2021):
Draft based on @BenEvolent333 profile.
librewolf.profile
@CodeArtisan00 commented on GitHub (Jan 30, 2021):
avidemux.profile
Should I add or omit something? It would be great if someone may test it.
@rusty-snake commented on GitHub (Jan 30, 2021):
@Neo00001 open a PR with it after applying the nitpicks below.
If it works and nothing is borken, everything can stay.
mkdirs for the dotfiles@CodeArtisan00 commented on GitHub (Jan 30, 2021):
yep
doing it
@matu3ba commented on GitHub (Feb 7, 2021):
luarocks would be great, as neovim and other programs will or do include it for packaging. see here.
@ghost commented on GitHub (Feb 27, 2021):
add mpv in firefox-common-addons
there's an extension, that allows to launch an url with mpv (with youtube-dl)
https://addons.mozilla.org/en-US/firefox/addon/play-with/
Just add:
in firefox-common-addons.inc
@rusty-snake commented on GitHub (Feb 27, 2021):
@pirate486743186 for firefox-common-addons you can always open a PR 😉 . Anyway both are already in:
437be33f40/etc/inc/firefox-common-addons.inc (L76-L91)@ghost commented on GitHub (Feb 27, 2021):
it's all commented out...
playwith uses a clever little hack, it pretends to be downloading a playlist as a file, then you configure firefox to automatically launch mpv with it.
it only needs the mpv profile for convenience. No external client.
It doesn't need all that crap. (python3 is already allowed higher)
@rusty-snake commented on GitHub (Feb 27, 2021):
IMHO we can (or should) move the
noblacklist/whiteliststuff up and make it default.👍 can be removed there
@ghost commented on GitHub (Mar 1, 2021):
add pipe-viewer/gtk-pipe-viewer
create a common profile for youtube-viewer, straw-viewer and pipe viewer
they are virtually identical
and add
whitelist ${HOME}/.cache/youtube-dl/youtube-sigfuncs
and
private-bin xterm
and remove
dbus-user none
it needs a terminal for some features, it tries to autodetect it from $TERM
the default is xterm, so that should cover most cases.
it complains about dbus in the terminal, but i don't see anything broken.
@ghost commented on GitHub (Mar 4, 2021):
https://github.com/netblue30/firejail/pull/4064
corrections for newsbeuter
it needs .local/share/newsbeuter
it should not create .newsbeuter
it should ignore configuration of newsboat specific folders
corrections for newsboat
needs .local and .config
needs access to newsbeuter folders, for migration
it shouldn't create .newsboat
probably add w3m in private-bin
@corngoblin commented on GitHub (Mar 30, 2021):
I'd like a Stremio profile
@ghost commented on GitHub (Apr 12, 2021):
Hi there, can we put the following to the list:
cointop(https://github.com/miguelmota/cointop)irssi(https://irssi.org/)swaywm (https://github.com/swaywm/sway)easytag(https://sourceforge.net/projects/easytag/)mbsync(https://isync.sourceforge.io/mbsync.html)Bitwig Studio(/opt/bitwig-studiois used on linux distributions, trial is available at https://www.bitwig.com/download/)Last but not least for now:
VSCodium(it needs dir from ~/.config as well, so just amend /etc/firejail/vscodium.profile)@ghost commented on GitHub (Apr 12, 2021):
@vatonbero Can you provide the full path that is missing so we can fix this please? Just for the record, if that's a bug in the current vscodium.profile it would get more attention / get properly tagged as a bug etcetera if you open a seperate issue for it. Thanks for informing us though!
@ghost commented on GitHub (Apr 12, 2021):
Thank you for the reply. I have opened one bug report however i must say that i still cannot determine if this is a bug or not. Here is the report https://github.com/netblue30/firejail/issues/4183
@ghost commented on GitHub (Apr 13, 2021):
A couple more:
radicalecal/card dav server (https://radicale.org)solvespaceused for parametric modeling (https://solvespace.com/)librecad2d cad program (https://librecad.org/)screenmultiplexer (https://www.gnu.org/software/screen/). Addtmuxeasytagmedia tagger (https://sourceforge.net/projects/easytag/)@rusty-snake commented on GitHub (Apr 14, 2021):
sway is already in #4164
@ghost commented on GitHub (Apr 14, 2021):
A bit more:
khardcli carddav client (https://github.com/scheibler/khard)vdirsyncercalendar and contact sync (https://github.com/pimutils/vdirsyncer)@chomwitt commented on GitHub (Apr 25, 2021):
I'd like a profile on:
@sak96 commented on GitHub (May 3, 2021):
for joplin-appimage following profile seems working.
and following desktop
@rusty-snake commented on GitHub (May 3, 2021):
joplin.profile based on @sak96's post above
@sak96 commented on GitHub (May 4, 2021):
i think there are three variants in (cli + desktop/ui + appimage) of joplin avialable. will test the above profile against all of them.
Thanks @rusty-snake
@sak96 commented on GitHub (May 4, 2021):
joplin cli
cli uses bash script which runs main.js in
/usr/share/joplin/using node.Points for improvement
can bash be restricted ?.Note: editor access required like vim is there any generic profile for the same.
profile for cli
joplin desktop
Desktop uses bash script which runs
/usr/share/joplin-desktop/@joplinapp-desktopusing node.Points for improvement
can bash be restricted ? is the no exec restricted enought ? can we resuse joplin cli to use this ?.profile for desktop
@rusty-snake commented on GitHub (May 4, 2021):
Fell free to open a PR with them.
Sorting, ordering, disable-programs and so on are explained in the pull request template and CONTRIBUTING.md
I would be surprised if /usr/share/foo is writeable as regular users. leave the
read-onlyand the trailing slash.Never
noexeced.Use "Redirect"
I would joplin-cli make redirect to joplin-desktop (and not desktop redirect cli because of the next)
joplin-cli needs no x11/wayland and no xdgruntimedir(?), right:
private-etctemplates can be found in profile.template too.@sak96 commented on GitHub (May 5, 2021):
is there any profile to enable editors ?
like vim/emac/gvim/code all at once ?
the joplin cli requires you to use some editor.
Never
noexeced.could you explain this comment as well.
@rusty-snake commented on GitHub (May 5, 2021):
No. It's not possible to allow anything necessary to run editors by e.g.
include allow-editors.inc. But have a look at mutt.profileThere is no
noexec /usr/share/joplin-desktop/@joplinapp-desktop.@sak96 commented on GitHub (May 5, 2021):
This line was required
noexec /usr/share/joplin-desktop/@joplinapp-desktop.This is the actual desktop app executable. without this i get
permission denied error.Also one more query i had was what is diffrence between
noblacklistandwhitelist.if i use
noblacklist ${HOME}/.vimfollowed bywhitelist ${HOME}/.config/joplinthen~/.vimdoesn't show up in the sandbox.if i use
noblacklistboth places then all elements in home directory are visible for the app (including~/my_personal_folder).if i use
whitelistboth place then only .vim and required config shows up.The effects it has are in /usr/share/joplin are more visible as whitelist will erase all other directories in /usr/share, which had negative effect on vim.
@ghost commented on GitHub (May 5, 2021):
@sak96 Turning 'the actual desktop app executable' into noexec doesn't make any sense. Please follow @rusty-snake's advice and open a PR. That'll give everyone a much better view on all relevant files, and the whole view at that (which is important too). This thread is for profile requests only, not for actually creating one (or several). We're happy to help, it's just easier to follow on a PR view in the GitHub UI. On a side note, why not use vim with its own sandbox profile instead of mixing things in a joplin profile?
@samsaraswheel commented on GitHub (May 18, 2021):
Profile request:
Nice to have please.
cryptomatorThis is a client side encryption tool like Boxcryptor (https://cryptomator.org/ and https://community.cryptomator.org/)The linux version is in an Appimage java based package format.
The
firejail --appimage "cryptomator.appimage"command works, you can create mounts, but you can't open any encrypted mounts in other file locations or usb. Comes up with a bunch of java resource call denied errors and FUSE no access errors.I think it shouldn't be too much to setup. Seccomp especially would be nice. Playing around with some whitelist settings but haven't got a working profile yet. If anyone has one please add.
Edit:
referring documentation section 3.6 EncFS and SSHFS from https://firejail.wordpress.com/documentation-2/basic-usage/?like_comment=579
I think this may have something to do with it.
@rusty-snake commented on GitHub (May 18, 2021):
FTR: FUSE mounts must be mounted
allow_rootorallow_other. Otherwise firejail isn't allowed to access them.@Area51Kacz commented on GitHub (May 30, 2021):
Edge browser (Microsoft Browser) https://www.microsoftedgeinsider.com/en-us/download?platform=linux-deb
https://aur.archlinux.org/packages/microsoft-edge-beta-bin/
@christianskou07 commented on GitHub (Jun 4, 2021):
SRBMiner https://www.srbminer.com/ or https://github.com/doktor83/SRBMiner-Multi
NBMiner https://nbminer.com/ or https://github.com/NebuTech/NBMiner
Would be extremely convenient to have as neither of them are open sourced, hence the need for firejail.
@ghost commented on GitHub (Jun 6, 2021):
I'm suprised that "gh" isn't here
it's a cli for github, by github.
https://cli.github.com
@reinerh commented on GitHub (Jun 16, 2021):
Hypnotix, user-friendly streaming application.
@rusty-snake commented on GitHub (Jul 26, 2021):
Fwknop requested in #4423 by @osevan
@ilikenwf commented on GitHub (Aug 20, 2021):
A profile for Hamsket, a fork of Rambox would be nice.
It is another electron application, and so far I'm unsure how to get around disabling it's own sandbox to use with firejail, though.
@rusty-snake commented on GitHub (Aug 20, 2021):
electron.profile works together with electron's sandbox. (since 0.9.64 IIRC)
So a profile for it can be small like
grep "^include electron.profile" /etc/firejail/*.profileto see profiles for other electron programs.EDIT: U can use all (usual) firejail commands except
caps.drop all,nonewprivs,noroot,protocol,seccomp*,memory-deny-write-executefor electron programs.@antidot0 commented on GitHub (Sep 2, 2021):
Unfortunately webex is a mandatory for students and teachers, at least in my country. It would be great if there was an option to use it with firejail.
@laplasa commented on GitHub (Sep 22, 2021):
Veloren and Airshipper
https://veloren.net/
https://github.com/veloren/veloren
https://github.com/veloren/Airshipper
@rusty-snake commented on GitHub (Sep 22, 2021):
@laplasa can you try
airshipper.profile
@rusty-snake commented on GitHub (Nov 12, 2021):
openstego by @Rult in #4677
@rusty-snake commented on GitHub (Nov 21, 2021):
etcher and Ventoy by @Lonniebiz in #4704
@Rult commented on GitHub (Nov 22, 2021):
waifu2x-converter-cpp doesn't see my GPU even with
--noprofile.After running the program without firejail it temporarily picks up the GPU and later runs with firejail as intended until system reboot.
Test GPU visibility:
waifu2x-converter-cpp --list-processorTest image processing:
waifu2x-converter-cpp -i some_small_picture.jpg -o output_pic.jpgAs its only purpose is an image processing,
openstegoprofile could be used as a base (but it doesn't need Java or any GUI).@rusty-snake commented on GitHub (Nov 29, 2021):
MEGAsync by @firejailaddssecuirty in #4721
@rusty-snake commented on GitHub (Jan 2, 2022):
Notable in #4813 by @githlp
@CaseOf commented on GitHub (Jan 6, 2022):
I’m using seafile-client on this profile, which seems to work.
@rusty-snake commented on GitHub (Jan 6, 2022):
Remove
ipc-namespacEinclude disable-passwdmgr.incAdd
blacklist /usr/libexecif you haveand open a PR.
@CaseOf commented on GitHub (Jan 6, 2022):
I did add lines 8 and 9 because I was blacklisting these in disable-programs, is it ok?
@rusty-snake commented on GitHub (Jan 6, 2022):
Yes, that's the way you do it, blacklist in dp.inc and noblacklist in the profile.
IDK what's in ${HOME}/Seafile but maybe it would be better to blacklist it (instead of only .seafile-data).
@CaseOf commented on GitHub (Jan 6, 2022):
it is supposed to sync libraries in that directory.
@CaseOf commented on GitHub (Jan 6, 2022):
adding disable-shell.inc prevents seafile to run…
@rusty-snake commented on GitHub (Jan 6, 2022):
...
private-bin seafile-applet,seaf-daemon,seaf-clithere's no shell???
@CaseOf commented on GitHub (Jan 6, 2022):
seaf-cli is a python shell script
@CaseOf commented on GitHub (Jan 6, 2022):
4b375fa016what’s your opinion?
@rusty-snake commented on GitHub (Jan 6, 2022):
Remove
add it to firecfg.config and open the PR
@CaseOf commented on GitHub (Jan 6, 2022):
ah no3d was a question, it can work when this is set but when starting from shell, it says it cant reach opengl stuff it would.
what to do in this case?
libGL error: MESA-LOADER: failed to retrieve device information6a1f6d60e3@kmk3 commented on GitHub (Jan 9, 2022):
retroshare by @osevan in #4842.
@Futureknows commented on GitHub (May 11, 2022):
Aether (non snap version from https://getaether.net/download/)
@KOLANICH commented on GitHub (May 30, 2022):
rust-analyzer(called from such apps as kate and qtcreator, it's an LSP server), access to ~/.cargo/registry is needed.@rusty-snake commented on GitHub (May 30, 2022):
Starting point for rust-analyzer.profile: https://github.com/netblue30/firejail/blob/master/etc/profile-a-l/cargo.profile
@KOLANICH commented on GitHub (May 30, 2022):
Yeah, I have tried to add
noblacklist ~/.cargo/registryintokate.localwithout any success.@ghost commented on GitHub (May 30, 2022):
@KOLANICH
${HOME}/.cargo/registry is not blacklisted anywhere, but ${HOME}/.cargo is. As it happens there's been a merge recently relating to the kate.profile that includes
allow-common-devel.inc, which doesnoblacklist ${HOME}/.cargo. You might want to integrate those changes in your profile or build from git.@KOLANICH commented on GitHub (May 30, 2022):
In fact my first action if I have any profile issues is to rebuild from git, but it hasn't helped. But thanks, I'll try to add
noblacklist ${HOME}/.cargo.@kmk3 commented on GitHub (May 31, 2022):
(Offtopic)
@glitsj16 commented on May 30:
Looks like GitHub mangled part of the text; I opened an issue for this:
@Lonniebiz commented on GitHub (May 31, 2022):
Please add FireDM to the list:
@Lonniebiz commented on GitHub (Jun 26, 2022):
Notepadqq:
https://www.appimagehub.com/p/1233488/
@Lonniebiz commented on GitHub (Jul 25, 2022):
OnlyOffice
Download the AppImage here:
https://www.onlyoffice.com/download-desktop.aspx?from=default#desktop
@korason7117 commented on GitHub (Aug 17, 2022):
Bottles:
https://usebottles.com/
@0x020B commented on GitHub (Aug 17, 2022):
"Legal computer viruses" in China
QQ
https://im.qq.com/linuxqq/download.html
Wechat
https://www.ubuntukylin.com/applications/106-cn.html
Tencent Meeting
https://source.meeting.qq.com/download/
dingtalk
https://alidocs.dingtalk.com/i/p/nb9XJlJ7QbxN8GyA/docs/ROGpvEna5YQWmaPgQ156W4ykmK3zoB27
feishu
https://www.feishu.cn/download
Baidu NetDisk
https://pan.baidu.com/download
360 Secure Browser
https://browser.360.net/gc/index.html?src=se
@jian-lin commented on GitHub (Aug 30, 2022):
nyxt: a keyboard-driven web browser designed for power users
@alkim0 commented on GitHub (Sep 1, 2022):
viu: terminal image viewer
This is what I'm currently using, but it could probably be tightened:
@rusty-snake commented on GitHub (Sep 1, 2022):
Open a PR with it. There's nothing much which can be hardened beside your comments.
include disable-proc.inc$HOME(follow the instructions in the template)machine-idread-only ${HOME}@mYnDstrEAm commented on GitHub (Sep 3, 2022):
muffon: desktop music streaming browser
An alternative to the nuclear music player which still is too bugged to use and already has a fj profile. It probably only needs a few tweaks to that profile.
@DNDEBUG commented on GitHub (Nov 18, 2022):
Vscape/Runescape
very cool game
can't run with firejail
@bruceleerabbit commented on GitHub (Dec 14, 2022):
Kalium installer
Kalium app
Kalium is a Java—Gradle project distributed as a self-installing package. Gradle is the executable used for installation and after installation later invocations should cause the app to execute. So in principle there should be a profile for running for the purpose of installation & a separate profile for the purpose of running the (already installed) app.
@rusty-snake commented on GitHub (Dec 19, 2022):
olive by @anomalocaris452 in #5534
@anomalocaris452 commented on GitHub (Dec 19, 2022):
could we add yed too?
its very close to visio + on linux u only get dia (abandonware) + karbon + lodraw there
@anomalocaris452 commented on GitHub (Dec 23, 2022):
@rusty-snake new request
Enve-animator (a cute ktoon tier app) https://maurycyliebner.github.io/
Wick Editor (its LITERALLY Hype/Animate but open source kek) https://www.wickeditor.com/#/download/
And Olive Should be Olive 0.2 (0.1 its unsupported + no github commits cz devs are only on 0.2)
@bruceleerabbit commented on GitHub (Dec 23, 2022):
hydroxide
@anomalocaris452 commented on GitHub (Dec 24, 2022):
opentoonz https://opentoonz.github.io/e/
tahoma2d https://tahoma2d.org/
tupi https://tupitube.com/
@anomalocaris452 commented on GitHub (Dec 30, 2022):
google web designer
firejail its importanat cz it literally relies on abandonware libraries >)
@vinoff commented on GitHub (Mar 24, 2023):
WhatsApp Desktop: https://aur.archlinux.org/packages/whatsapp-nativefier
@Dyras commented on GitHub (Apr 7, 2023):
Mullvad Browser:
https://mullvad.net/en/download/browser/linux
https://github.com/mullvad/mullvad-browser
It's based on Tor Browser.
@ghost commented on GitHub (Apr 7, 2023):
@Dyras I'm sure we'll be including a profile for Mullvad Browser soonish. At the moment it's not fully clear yet how distro's will package it. In the mean time you can try these, which I tested for the AUR's mullvad-browser-bin.
@kirasok commented on GitHub (Jun 4, 2023):
bukubrow support for firefox
bukubrow is a WebExtension for Buku, a command-line bookmark manager
@ghost commented on GitHub (Jun 6, 2023):
@kirasok After installing the bukubrow WebExtension in your Firefox and placing files from its native messaging host counterpart into ~/.mozilla/native-messaging-hosts, you should be good to go. You might need to add
whitelist ${HOME}/.local/share/bukuto your ~/.config/firejail/firefox.local to access buku's bookmarks.db. Not sure if an additionalread-only ${HOME}/.local/share/bukuis needed, but that's easily determined when using the WebExtension.It's not clear to me if your request includes a Firejail profile for
bukuitself. Just out of curiosity I've played with it and created a preliminary profile for it. As buku heavily relies on the EDITOR and/or VISUAL environment variables to determine your preferred text editor, it's a bit tricky to cover all options in a Firejail profile. So I only added support fornanoby default. If you decide to try it with another text editor, read the comments inside about supportinggeditand adapt accordingly. Here's the buku.profile. I have zero familiarity with buku, and I haven't tested it very thoroughly, but it's a start... Please communicate there for now if you need help. We can open a PR to bring it into Firejail later.@FOSSProponent9436 commented on GitHub (Jun 10, 2023):
SVPManager / Installer https://www.svp-team.com/
@MikeNavy commented on GitHub (Jun 20, 2023):
Hi,
I request a profile to be added for VMware Workstation Player.
Product page: https://www.vmware.com/content/vmware/vmware-published-sites/us/products/workstation-player/workstation-player-evaluation.html.html
("VMware Player" and "VMware Workstation" have been merged in "VMware Workstation Player" years ago, and "VMware Player" no longer exists; today existing products are "VMware Workstation Player" and "VMware Workstation Pro")
See https://github.com/netblue30/firejail/issues/5861,
vmplayercannot use existing "vmware-player.profile" or "vmware.profile".Regards,
MN
@svc88 commented on GitHub (Jul 1, 2023):
Hi
Please can i request RSSGuard profile, https://github.com/martinrotter/rssguard/releases
They use appimage
@ghost commented on GitHub (Jul 2, 2023):
@svc88 I've put together this
rssguard.profile. Can you test if it works and offers the functionalities you expect? Personally I don't use any of these online feed services and didn't want to create any accounts so there might be some extra options needed in the profile. Basics and Adblock activation via node do seem to work okay, that I've tested. The app is quite verbose on CLI so you should be able to catch any errors while testing.UPDATE: opened #5881 to bring this in.
@celenityy commented on GitHub (Aug 8, 2023):
I'd really appreciate profiles for Heroic Games Launcher & Prism Launcher
@vinoff commented on GitHub (Sep 13, 2023):
A profile for BEEPER would be great. https://www.beeper.com/
@ghost commented on GitHub (Sep 13, 2023):
@vinoff I had a look at
beeperand put together a minimally/crudely tested profile. Didn't feel like signing up (just a personal thing with sharing a phone number etcetera). You can find it here. I've based the profile on what I could determine via the beeper-latest-bin from the AUR.Apparently the
beeper.desktopfile disables chrome-sandbox by using the below Exec line:IMO this isn't the most secure thing to do, so I'd advise to try this app while removing that
--no-sandboxflag and see if things break. Just my $ 0.02 :-)If you could test Beeper when actually using it, that would be great. We could consider adding the profile (adjusted where needed) later. Don't feel comfortable doing so when I haven't done that properly. HTH
@jtrv commented on GitHub (Sep 15, 2023):
a profile for tidal-hifi would be great.
So far I have this, I'll try to open a PR later:
@marek22k commented on GitHub (Sep 22, 2023):
I would be happy about a profile for Eclipse.
@Lonniebiz commented on GitHub (Nov 3, 2023):
Pinokio allows you to play around with all the awesome new open source AI models that are rapidly coming out these days. It allows you to install, run, and automate any AI applications and models automatically and effortlessly.
I'm very eager to try it out via AppImage, but I need a firejail profile for it. This video claims it is already self-contained, but I'd feel more comfortable if firejail ensured that containment. I don't want the AI to break out and take over my computer!
Anyway, I'm really looking forward to there being a profile for this AppImage. Thank you in advance.
@Lonniebiz commented on GitHub (Nov 26, 2023):
Pulsar:
https://pulsar-edit.dev/
AppImage is available here:
https://pulsar-edit.dev/download.html#regular-releases
This is live fork of the (discontinued) Atom text editor. Atom was made by GitHub's original owners. Microsoft purchased GitHub and "sunset" the project on December 15, 2022. It is a fantastic text editor for web development. I'm so happy to see it forked.
The profile will likely be very similar to the one already created for Atom:
/etc/firejail/atom.profile
However, from running it in a virtual machine, I see at least two changes that are needed; its config file folder location:
~/.config/Pulsar --> I wish everything was kept here, but there's also:
~/.pulsar -----------> I noticed that addon packages are kept in this location.
I'd love to see a Pulsar profile located here:
/etc/firejail/pulsar.profile
I achieved a custom profile that launches Pulsar, but it can likely be improved to be less permissive. I'm still learning.
@marek22k commented on GitHub (Nov 30, 2023):
I would be happy about a profile for Nyxt.
@ghost commented on GitHub (Nov 30, 2023):
@marek22k Can you try nyxt with
--noprofileand--profile=noprofileplease? I'm afraid it might be bubblewrapped as mentioned in #6103 and #3647. If not we can start designing a profile for it.@marek22k commented on GitHub (Nov 30, 2023):
What does it mean that it is in bwrap? Why can't Firejail build Sandox around bwrap?
@Lonniebiz commented on GitHub (Nov 30, 2023):
Sielo: https://sielo.app/
This web browser has some innovative features. I'm especially interested in what they call tabs spaces, which essentially allows you to tile multiple webpages within a single window. They provide a portable AppImage for download, and that's what I'd like a Firejail profile for.
@ghost commented on GitHub (Nov 30, 2023):
@marek22k
So the --noprofile test confirms that bubblewrap refuses to play along with firejail. Two options left though.
(1) Behind the scenes --noprofile uses /etc/default.profile, which includes disable-common.inc. The latter file blacklists
{PATH}/bwrap. Try `firejail --noprofile --noblacklist=/usr/bin/bwrap /usr/bin/nyxt. (2) Also run$ firejail --profile=noprofile /usr/bin/nyxt`. This is the weakest possible firejail profile. It does not block access to ${PATH}/bwrap like --noprofile does. If it still fails, we can't sandbox nyxt with firejail due to incompatibilities between the two.@marek22k commented on GitHub (Nov 30, 2023):
Too bad firejail and bwrap don't work together. firejail blocks file access for browsers by default except for the download folder, bwrap doesn't do that. I'll see if I can find some bwrap documentation somewhere where I can set this.
@ghost commented on GitHub (Nov 30, 2023):
@marek22k Yup, those incompatibilities are indeed a pain. Maybe you can try containing nyxt with bubblejail, which is bubblewrap-based.
@rusty-snake commented on GitHub (Nov 30, 2023):
No. It is more like --profile=/dev/null (I.e. empty.profile).
Longer firejail+bwrap discussions should happen in a new Discussion.
@marek22k commented on GitHub (Dec 6, 2023):
I would be happy about a profile for Apache NetBeans IDE.
Maybe something like the following:
@ilikenwf commented on GitHub (Feb 15, 2024):
I'd like a profile for Armcord, as it seems hamsket is not developed anymore. As an aside, what's the difference between including the hardened electron profile and the normal one?
Either way, something like the following (it uses gio for opening links).
@0xn1h1Lo commented on GitHub (Feb 21, 2024):
I have tweaked some electron profile for Joplin (distributed as appimage). Happy to share my file with the notes of what I tried and didn't. A cleaned up version below (i removed all comments):
Then launching with:
firejail --appimage --profile=joplin --nosound /path/to/Joplin.AppImage@ghost commented on GitHub (Feb 21, 2024):
@dev-uhuru Nice! Feel free to open a PR for joplin.profile. We can help work out any specifics for the non-appimage version (if there are any). Thanks for sharing.
@RundownRhino commented on GitHub (Mar 22, 2024):
I recently set up KDE connect and plasma-browser-integration for firefox (Linux Mint 21.2) and it seems that the comments in the profile are slightly outdated.
In addition to these lines in firefox.local:
(and to
ignore dbus-user noneandinclude firefox-common-addons.profilein firefox-common.local), after investigating viafirejail --profile=firefox.profile --dbus-user.log firefoxI found out I also needed to enable this dbus route:This should probably be added to the comment in
firefox.local, if someone can replicate this issue.@ghost commented on GitHub (Mar 22, 2024):
@RundownRhino Thanks for reporting. Comments are prone to gather dust as software moves on. Can you open a PR for it?
@RundownRhino commented on GitHub (Mar 23, 2024):
@glitsj16 Opened a PR. As a side note, it seems
include firefox-common-addons.profileis not necessary for this extension to work, but rather breaks all firefox sound when enabled. Not sure why, maybe from theignore whitelists that it does.@konstantin1722 commented on GitHub (Apr 16, 2024):
Hi, I have sketched out a profile for Obsidian, I needed it urgently. I've been looking into it for a couple of hours, so I think more knowledgeable people will suggest improvements. But it already works for appimage and binary.
There's a resolution for git, as I'm using the Obsidian plugin for git.
Launch commands:
I left some things commented out as I didn't fully understand them. I'm interested in a discussion on this profile, anyone have any tips for improvement?
UPD: #6314
@kmk3 commented on GitHub (Apr 16, 2024):
Please open a pull request for it; this issue is not a good place for reviews.
@tmarplatt commented on GitHub (May 9, 2024):
I humbly request profile support for DaVinci Resolve for Linux, a non-linear video editor application. It requires input and gpu dev access. It is released as a self-contained AppImage executable.
The file is free to download but the website may hide the download link and ask you to register before download.
I've not managed to get it working on Linux Mint 21.3. It seems to require elevated privileges and it looks like that conflicts with
--appimage.@ghost commented on GitHub (May 9, 2024):
@tmarplatt
I've looked into 'DaVinci Resolve for Linux'. Don't have the hardware to actually use it, but there are a few things you might try.
First of all, its
notthe program itself that's distributed asAppImage, but itsinstaller. That ties in to your remark that it requires elevated privileges. Anything that wants to install files to the system-wide directories (e.g. /opt/DaVinciResolve) will need sudo, nothing new or unexpected there. The foo.run file (the AppImage) also supports installing into your ${HOME} via the -C switch (see ./foo.run -h for details). TL;DR Install the program first and after doing so you can start testing/creating a firejail profile for it.Other observations. This is not your 'common' application, and there seem to be loads of potential roadblocks (not very surprising with proprietary software). I consulted the Arch Wiki page while investigating, might be helpful on your Linux Mint too: https://wiki.archlinux.org/title/DaVinci_Resolve. There are several AUR packages available that you can look at for guidance on how to get it properly installed (if you're familiar with Arch Linux's PKGBUILD format).
To save some time and hair-pulling you can
check upfrontif Firejail is actually able to sandbox DaVinci Resolve properly by running it via thenoprofile.profile. Depending on where you've installed that could look likefirejail --profile=noprofile /opt/resolve/bin/resolve. If the program doesn't work with that profile it will not be possible to use Firejail for sandboxing it.Far from ideal and very likely a lot of moving parts. The PDF that came with the download actually mentions 'Installing DaVinci Resolve’s Rocky Linux ISO' in a VM. IMO that's going to be the easier route.
HTH
@vinoff commented on GitHub (May 25, 2024):
vesktop: https://github.com/Vencord/Vesktop
Vesktop is a custom Discord App aiming to give you better performance and improve linux support
@ghost commented on GitHub (May 25, 2024):
@vinoff
We'll look into
vesktop. In the mean time it would be very helpful if you could provide some details on this program. Especially, as it is a Discord clone, my first thoughts are to try to integrate a vesktop.profile into our existingdiscord-common.profile. Can you tell us where vesktop stores its data? E.g. does it also use ${HOME}/.config/discord or does it have its own dedicated location? Also interesting to know would be the path under which vesktop's executable is installed (/opt/vesktop or somewhere else)?HTH
@ilikenwf commented on GitHub (May 30, 2024):
This works but netfilter needs removed otherwise.
@ghost commented on GitHub (May 30, 2024):
@ilikenwf
The following options can be added to the sandbox when your kernel supports
unprivileged namespaces(which the tradional,larger distro's have for a while now):caps.drop all
nonewprivs
noroot
protocol unix,inet,inet6,netlink
seccomp !chroot
This results in a significant hardening of the sandbox. So if you can, it's advised to enable it.
We shuffled around a few includes in the git version as compared to 0.9.72. The actual hardening needs to be enabled now via
blink-common.localthat has the one-linerinclude blink-common-hardened.inc.profile.Based on the ArmCord packages available in the AUR I've created the below (untested) armcord.profile. It would be awesome if you could test it, but as hinted above, you'll need the firejail-git version to do so.
@neurodiverseEsoteric commented on GitHub (May 31, 2024):
Floorp?
@ghost commented on GitHub (May 31, 2024):
@neurodiverseEsoteric
We have floorp.profile now. You can either use firejail-git or wait until it comes down whenever your OS receives the upcoming
0.9.74release.@neurodiverseEsoteric commented on GitHub (May 31, 2024):
oh ok thanks
@imgurbot12 commented on GitHub (Jun 16, 2024):
@glitsj16
I came up with the following profile which could be used to start with:
It does require vesktop to be run with
--no-sandboxbecause otherwise you get:which I'm not sure how to fix.
@ghost commented on GitHub (Jun 16, 2024):
@vinoff @imgurbot12
Here's a
vesktop.profileyou can test with Firejail0.9.72. See https://gist.github.com/glitsj16/174ba5da566f3948d1716676e353daf3 for details.HTH
@imgurbot12 commented on GitHub (Jun 16, 2024):
Major thanks @glitsj16, testing now but I'm having some issues. Will post in the gist to avoid bloating the convo here.
@neurodiverseEsoteric commented on GitHub (Jul 12, 2024):
I'm running archlinux, the bleeding-edgiest of the bleeding-edges, and it's not up to version 0.9.74 yet?
Also requesting a profile for
/usr/bin/webapp-manager, please...@ghost commented on GitHub (Jul 12, 2024):
@neurodiverseEsoteric
On Arch Linux myself. There simply isn't a 0.9.74 release yet. Best you can do is install firejail-git from AUR and keep that in sync with the git commits.
@ghost commented on GitHub (Jul 12, 2024):
@neurodiverseEsoteric
I've looked into webapp-manager. Although creating a dedicated Firejail profile for it is possible, it would have to create a very weak sandbox due to the upstream use of
hardcoded absolute paths(see below). Also, its support forflatpaksandsnapsis problematic in this context: Firejail simply can't sandbox those.Personally I wouldn't feel comfortable using this app to run web browsers in such a weak sandbox. Other collaborators may of course see this differently and create a webapp-manager.profile in the future. So I'm not saying it won't happen. In any case, stay vigilant when using this app...
a061d9a4b0/usr/lib/webapp-manager/common.py (L174-L230)@neurodiverseEsoteric commented on GitHub (Jul 15, 2024):
@glitsj16 Oh
@Utini2000 commented on GitHub (Aug 19, 2024):
OnlyOffice-Desktopeditors bases on libreoffice.profile:
This works for me just fine.
@rusty-snake commented on GitHub (Sep 4, 2024):
latest VSCodium on debian 11 requested in #6461 by @MiltiadisKoutsokeras.
@emerajid commented on GitHub (Sep 4, 2024):
https://pulsar-edit.dev/
https://pulsar-edit.dev/about.html
https://github.com/pulsar-edit
Not much different from atom.profile, yet a few changes creeped in.
@rusty-snake commented on GitHub (Sep 9, 2024):
16xPrompt by @leodip in #6470
@kmk3 commented on GitHub (Sep 10, 2024):
x2goserver by @mabra in #5837
@kmk3 commented on GitHub (Sep 14, 2024):
prismlauncher by @ipaqmaster in #6381
@rusty-snake commented on GitHub (Sep 19, 2024):
gifsicle and gifski by @salisbury-espinosa in #6481
@neurodiverseEsoteric commented on GitHub (Sep 23, 2024):
I'd like a betterbird.profile, please...
@ilikenwf commented on GitHub (Oct 11, 2024):
private-bin armcordbreaks it under Archlinux here.@gcb commented on GitHub (Nov 8, 2024):
syncthing at #6536
update: I've been using this for a month on several machines and working perfectly. I think it is ready for review.
@Lonniebiz commented on GitHub (Nov 8, 2024):
I'd like a profile for Dbeaver:
https://dbeaver.io/
AppImage of Dbeaver:
https://github.com/valicm/dbeaver-ce-appimage/releases/tag/latest
@dmitryvakulenko commented on GitHub (Nov 9, 2024):
I try to make profile for Zed editor in #6541.
@ilikenwf commented on GitHub (Jan 2, 2025):
Armcord has apparently either been renamed or migrated to "Legcord." - to support both, copy, paste, and renaming is required as everywhere we'd see "armcord," "legcord" needs to be used instead.
@py-cyberuser commented on GitHub (Feb 17, 2025):
Add Profile
Add a profile for hyprland
Though at first I thought firejail can't deal with wayland compositor, surprisingly I find sway profile which means actually it's possible . I would appreciate if hyprland profile can be added.
Thanks for all your works!
@rusty-snake commented on GitHub (Feb 19, 2025):
betterbird by @PWungsten in #6651
@vinoff commented on GitHub (Feb 23, 2025):
Request:
@rusty-snake commented on GitHub (May 2, 2025):
LMStudio by @saltiniroberto in #6731
@gcb commented on GitHub (May 5, 2025):
Gradle in #6726
@neurodiverseEsoteric commented on GitHub (Jul 5, 2025):
I'd like a profile for Goofcord (the better Discord desktop), please, as
--noprofileexposes the home filesystem despite--private=and using the discord profile breaks whitelisting of directories for some reason...@cameronj86 commented on GitHub (Jul 8, 2025):
TradingView and/or any banking/financial application as a baseline that I can use as a template for my broker's app.
@ghost commented on GitHub (Jul 12, 2025):
A profile for llama-server from https://github.com/ggml-org/llama.cpp and firefox that could be used together inside a network namespace.
So I could run -name llama flag with the profile when I launch llama-server and the use —join flag when I run firefox, to be able to access the UI
@BooniChan commented on GitHub (Jul 26, 2025):
A profile for KVIrc would be great!
Kvirc is an IRC client written in c++/QT and with KDE support. It has a lot of features like: scripting, python & pearl support, themes etc etc and always found it better than the mainstream ones like Konversation.
Thank you!
@gcb commented on GitHub (Jul 28, 2025):
i'm testing all kde-ish clients for the last decade, trying to move from my terminal old client, and had never heard of that one. will create a profile for it when i try it out soon-ish.
@mYnDstrEAm commented on GitHub (Oct 1, 2025):
Please make a profile for manyverse, a crossplatform client for scuttlebut
@rusty-snake commented on GitHub (Oct 12, 2025):
gemini-cli by @aminvakil in #6935
@cameronj86 commented on GitHub (Jan 8, 2026):
^ On a related note, Claude Code
(and/or perhaps a
llm-cli-common.profile)@DoS007 commented on GitHub (Feb 1, 2026):
DaVinci Resolve 20, the best/most proffessional video editing software for linux available (the not-studio edition is for "free")
@Raneded commented on GitHub (Feb 21, 2026):
Can we have WebCord profile please?
@aminvakil commented on GitHub (Feb 26, 2026):
opencode (https://github.com/anomalyco/opencode)
That being said, I completely forgot https://github.com/netblue30/firejail/pull/6936 :)
@fpaty6820-ship-it commented on GitHub (Mar 11, 2026):
Zrythm https://www.zrythm.org/es/index.htm
Storyboarder https://wonderunit.com/storyboarder/
Fricción https://github.com/friction2d/friction/
Envié
https://maurycyliebner.github.io/
Olive https://www.olivevideoeditor.org/
@fpaty6820-ship-it commented on GitHub (Mar 11, 2026):
Gaffer: www.gafferhq.org
Glaxnimate: glaxnimate.mattbas.org
Stirling PDF https://www.stirling.com/
Appflowy https://joplinapp.org/