Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow --dbus-user=none on the command line for profiles with dbus-user filter #3408

Closed
rusty-snake opened this issue May 7, 2020 · 1 comment · Fixed by #3406
Closed
Assignees

Comments

@rusty-snake
Copy link
Collaborator

I just tried to start firefox with --private and --dbus-user=none and it failed because firefox.profile sets dbus-user filter and firejail does not allow relaxing the policy. Error: Cannot relax dbus-user policy, it is already set to block. IMHO the must common case is that a user wants to deny dbus access per run or default and add dbus-user none to xxx.local or the command line and shouldn't need to also add ignore dbus-user filter.

@kris7t
Copy link
Collaborator

kris7t commented May 8, 2020

The idea was to prevent setting a weaker DBus policy without explicitly authorizing the weakening with --ignore. But it seems I was a bit overzealous, as this effectively prevents strengthening the policy (if the (--dbus-user= options are not in the right order) also.

I think it would be safe to downgrade this to a warning, and keep the stricter policy of the two specified. I'll add this to #3406.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants