Refactor electron.profile and electron based programs #3807
Conversation
rusty-snake
changed the title
etc/profile-a-l/freetube.profile
Outdated
| @@ -6,26 +6,22 @@ include freetube.local | |||
| # Persistent global definitions | |||
| include globals.local | |||
|
|
|||
| # Disabled until someone reported positive feedback | |||
There was a problem hiding this comment.
I have been running freetube without issues having these in my freetube.local:
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
nou2f
novideo
The nou2f is untested due to not having such hardware.
There was a problem hiding this comment.
If I'm right freetube has no login support at all.
etc/profile-m-z/riot-web.profile
Outdated
| #include globals.local | ||
| include globals.local | ||
|
|
||
| # Disabled until someone reported positive feedback |
There was a problem hiding this comment.
Tested with element-{desktop,web} from Arch community repo. Works fine with the below in riot-web.local:
# WIP 3807
include disable-devel.inc
# shell needed for tray icon
noblacklist ${PATH}/bash
noblacklist ${PATH}/sh
ignore noexec /tmp
whitelist /usr/share/chromium
whitelist /usr/share/webapps/element
include disable-exec.inc
include disable-interpreters.inc
include disable-xdg.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
nou2f
novideo
# shell needed for tray icon
#shell none
disable-mnt
private-cache
private-dev
private-tmp
There was a problem hiding this comment.
two questions
- electron does not
include disable-shell.inc, is it in one of your locals? shell nonejust mean start direct and w/o a shell, but a shell is still present inside the sandbox. Does it really need to be ignored?
There was a problem hiding this comment.
electron does not include disable-shell.inc, is it in one of your locals?
It isn't, nice catch. The relatively long include chain (element-desktop --> riot-desktop --> riot-web --> electron) threw me off here apparently.
shell none just mean start direct and w/o a shell, but a shell is still present inside the sandbox. Does it really need to be ignored?
Ditto as above. I suspect it was a leftover from testing permutations. I can now confirm adding 'shell none' works fine.
To put things straight, element-desktop is working with the below in my riot-web.local:
# WIP 3807
include disable-devel.inc
ignore noexec /tmp
whitelist /usr/share/chromium
whitelist /usr/share/webapps/element
include disable-exec.inc
include disable-interpreters.inc
include disable-xdg.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
nou2f
novideo
shell none
disable-mnt
private-cache
private-dev
private-tmp
```
|
Should it be sufficient to change /etc/firejail/electron.profile riot-web.profile and riot-desktop.profile to get element-desktop working with the latest firejail version in backports in Debian 10 (0.9.64)? I changed these 3 files as well as element-desktop.profile to match the latest versions in this repo and riot-web.local to match the comment above but now I get this error when running |
|
Using profiles from git master with a stable release (even the latest) is nothing what you should expect to work. Anyway ATM it works to use git master profiles in 0.9.64. debian + element-desktop -> #3586. |
Added on commit f4f6767 ("Refactor electron.profile and electron based programs (netblue30#3807)"). This appears to be the only instance of that: $ grep -Fnr 'include-xdg' etc etc/profile-m-z/signal-desktop.profile:9:ignore include-xdg.inc Credits go to syntax highlighting on vim.
Added on commit f4f6767 ("Refactor electron.profile and electron based programs (netblue30#3807)"). This appears to be the only instance of that: $ grep -Fnr 'include-xdg' etc etc/profile-m-z/signal-desktop.profile:9:ignore include-xdg.inc Simply fixing the typo would enable xdg dirs for the first time since the aforementioned commit. But, as talked with @rusty-snake[1], since there has been no negative feedback, and since it's a whitelisting profile, just remove the affected line instead. Credits go to syntax highlighting on vim. [1]: netblue30#4001
see #3806