Profile requests #1139

vesktop: https://github.com/Vencord/Vesktop

Vesktop is a custom Discord App aiming to give you better performance and improve linux support

@glitsj16

I came up with the following profile which could be used to start with:

# Custom FireJail Profile for Vesktop
include globals.local

# allow discord access to config directory
noblacklist ${HOME}/.config/discord
mkdir       ${HOME}/.config/discord
whitelist   ${HOME}/.config/discord

# allow Vencord access to config directory
noblacklist ${HOME}/.config/Vencord
mkdir       ${HOME}/.config/Vencord
whitelist   ${HOME}/.config/Vencord

# allow vesktop access to config directory
noblacklist ${HOME}/.config/vesktop
mkdir       ${HOME}/.config/vesktop
whitelist   ${HOME}/.config/vesktop

include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc

# disable temp
private-tmp
noexec /tmp

# additional restrictions
caps.drop all
netfilter
nodvd
nogroups
nonewprivs
noroot
notv
protocol unix,inet,inet6,netlink

# Below is modified `discord-common.profile`
# ==========================================
include discord-common.local

ignore include disable-interpreters.inc
ignore include disable-xdg.inc
ignore include whitelist-runuser-common.inc
ignore include whitelist-usr-share-common.inc
ignore apparmor
ignore disable-mnt
ignore private-cache
ignore dbus-user none
ignore dbus-system none

ignore noexec ${HOME}
ignore novideo

private-bin bash,cut,echo,egrep,fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh,discord,vesktop
private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl

include electron.profile

It does require vesktop to be run with --no-sandbox because otherwise you get:

The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/Vesktop/chrome-sandbox is owned by root and has mode 4755.

which I'm not sure how to fix.

glitsj16 · 2024-06-16T02:22:48Z

@vinoff @imgurbot12

Here's a vesktop.profile you can test with Firejail 0.9.72. See https://gist.github.com/glitsj16/174ba5da566f3948d1716676e353daf3 for details.

HTH

imgurbot12 · 2024-06-16T03:21:18Z

@vinoff @imgurbot12

Here's a vesktop.profile you can test with Firejail 0.9.72. See https://gist.github.com/glitsj16/174ba5da566f3948d1716676e353daf3 for details.

HTH

Major thanks @glitsj16, testing now but I'm having some issues. Will post in the gist to avoid bloating the convo here.

neurodiverseEsoteric · 2024-07-12T20:06:35Z

@neurodiverseEsoteric

We have floorp.profile now. You can either use firejail-git or wait until it comes down whenever your OS receives the upcoming 0.9.74 release.

I'm running archlinux, the bleeding-edgiest of the bleeding-edges, and it's not up to version 0.9.74 yet?

Also requesting a profile for /usr/bin/webapp-manager, please...

glitsj16 · 2024-07-12T20:25:46Z

@neurodiverseEsoteric

I'm running archlinux, the bleeding-edgiest of the bleeding-edges, and it's not up to version 0.9.74 yet?

On Arch Linux myself. There simply isn't a 0.9.74 release yet. Best you can do is install firejail-git from AUR and keep that in sync with the git commits.

glitsj16 · 2024-07-12T23:34:33Z

@neurodiverseEsoteric

Also requesting a profile for /usr/bin/webapp-manager, please...

I've looked into webapp-manager. Although creating a dedicated Firejail profile for it is possible, it would have to create a very weak sandbox due to the upstream use of hardcoded absolute paths (see below). Also, its support for flatpaks and snaps is problematic in this context: Firejail simply can't sandbox those.

Personally I wouldn't feel comfortable using this app to run web browsers in such a weak sandbox. Other collaborators may of course see this differently and create a webapp-manager.profile in the future. So I'm not saying it won't happen. In any case, stay vigilant when using this app...

https://github.com/linuxmint/webapp-manager/blob/a061d9a4b0b1b0c3707472b93daf7f732cfc939f/usr/lib/webapp-manager/common.py#L174-L230

neurodiverseEsoteric · 2024-07-15T01:21:58Z

@glitsj16 Oh

Utini2000 · 2024-08-19T12:30:39Z

OnlyOffice-Desktopeditors bases on libreoffice.profile:

ignore blacklist ${HOME}/.config/onlyoffice
ignore blacklist ${HOME}/.local/share/onlyoffice
ignore join-or-start libreoffice

whitelist ${HOME}/.config/onlyoffice
whitelist ${HOME}/.config/kdedefaults
whitelist ${HOME}/.local/share/onlyoffice/

include libreoffice.profile

join-or-start onlyoffice-desktopeditors

This works for me just fine.

emerajid · 2024-09-04T17:57:02Z

https://pulsar-edit.dev/
https://pulsar-edit.dev/about.html
https://github.com/pulsar-edit

Not much different from atom.profile, yet a few changes creeped in.

# Firejail profile for uplsar
# Description: A Community-led Hyper-Hackable Text Editor
# This file is overwritten after every install/update
# Persistent local customizations
include pulsar.local
# Persistent global definitions
include globals.local

# Disabled until someone reported positive feedback
ignore include disable-exec.inc
ignore include disable-devel.inc
ignore include disable-interpreters.inc
ignore include disable-xdg.inc
ignore whitelist ${DOWNLOADS}
ignore whitelist ${HOME}/.config/Electron
ignore whitelist ${HOME}/.config/electron*-flag*.conf
ignore include whitelist-common.inc
ignore include whitelist-runuser-common.inc
ignore include whitelist-usr-share-common.inc
ignore include whitelist-var-common.inc
ignore apparmor

disable-mnt
noblacklist ${HOME}/.pulsar
noblacklist ${HOME}/.config/Pulsar

# Allows files commonly used by IDEs
include allow-common-devel.inc

# net none
nosound

# Redirect
include electron.profile

rusty-snake · 2024-09-09T17:56:41Z

16xPrompt by @leodip in #6470

kmk3 · 2024-09-10T11:47:20Z

x2goserver by @mabra in #5837

kmk3 · 2024-09-14T07:07:38Z

prismlauncher by @ipaqmaster in #6381

rusty-snake · 2024-09-19T14:28:31Z

gifsicle and gifski by @salisbury-espinosa in #6481

neurodiverseEsoteric · 2024-09-23T01:07:25Z

I'd like a betterbird.profile, please...

ilikenwf · 2024-10-11T04:13:23Z

@ilikenwf

As an aside, what's the difference between including the hardened electron profile and the normal one?

The following options can be added to the sandbox when your kernel supports unprivileged namespaces (which the tradional,larger distro's have for a while now):

caps.drop all nonewprivs noroot protocol unix,inet,inet6,netlink seccomp !chroot

This results in a significant hardening of the sandbox. So if you can, it's advised to enable it. We shuffled around a few includes in the git version as compared to 0.9.72. The actual hardening needs to be enabled now via blink-common.local that has the one-liner include blink-common-hardened.inc.profile.

Based on the ArmCord packages available in the AUR I've created the below (untested) armcord.profile. It would be awesome if you could test it, but as hinted above, you'll need the firejail-git version to do so.
$ cat ~/.config/firejail/armcord.profile
# Firejail profile for armcord
# Description: Standalone Discord client
# This file is overwritten after every install/update
# Persistent local customizations
include armcord.local
# Persistent global definitions
include globals.local

noblacklist ${HOME}/.config/ArmCord

# sh is needed to allow Firefox to open links
#include allow-bin-sh.inc

ignore noexec ${HOME}

mkdir ${HOME}/.config/ArmCord
whitelist ${HOME}/.config/ArmCord
#whitelist /opt/Armcord
whitelist /opt/armcord
whitelist /usr/share/armcord

# The lines below are needed to find the default Firefox profile name, to allow
# opening links in an existing instance of Firefox (note that it still fails if
# there isn't a Firefox instance running with the default profile; see #5352)
noblacklist ${HOME}/.mozilla
whitelist ${HOME}/.mozilla/firefox/profiles.ini

ignore novideo
private-bin armcord

dbus-user filter
dbus-user.talk io.gitlab.librewolf.*
dbus-user.talk org.cachyos.cachy_browser.*
dbus-user.talk org.freedesktop.Notifications
# Allow D-Bus communication with Firefox for opening links
dbus-user.talk org.mozilla.*
ignore dbus-user none

join-or-start armcord

# Redirect
include electron-common.profile

private-bin armcord breaks it under Archlinux here.

gcb · 2024-11-08T15:38:27Z

syncthing at #6536

update: I've been using this for a month on several machines and working perfectly. I think it is ready for review.

Lonniebiz · 2024-11-08T16:01:51Z

I'd like a profile for Dbeaver:
https://dbeaver.io/

AppImage of Dbeaver:
https://github.com/valicm/dbeaver-ce-appimage/releases/tag/latest

dmitryvakulenko · 2024-11-09T11:47:04Z

I try to make profile for Zed editor but got some issue.

This was referenced Mar 10, 2017

Why not a profile for Tor Messenger #973

Closed

New profiles #1003

Closed

request: a profile for amule #1092

Closed

netblue30 added the enhancement New feature request label Mar 10, 2017

netblue30 mentioned this issue Mar 10, 2017

Profile requests #825

Closed