3 ms·

So do you configure firejail to give each app their own separate, permanent home directories? Like "firejail --private=/home/user/firejails/discord discord", "f

So do you configure firejail to give each app their own separate, permanent home directories? Like "firejail --private=/home/user/firejails/discord discord", "firejail --private=/home/user/firejails/chromium chromium", and so on?

johnisgood 1y ago
I have my own Discord.profile! This is my ~/.config/firejail/Discord.profile[1]: include disable-common.inc include disable-devel.inc include disable-interpreters.inc include disable-shell.inc noblacklist /sys/fs noblacklist /sys/module keep-config-pulse keep-dev-shm name discord apparmor caps.drop all caps.keep sys_admin,sys_chroot netfilter nodvd #nogroups #noinput nonewprivs noroot notv #nou2f #novideo protocol unix,inet,inet6 #shell none disable-mnt private-cache #private-tmp noexec /tmp dbus-user filter dbus-user.talk org.freedesktop.Notifications private-bin Discord,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,tr,xdg-mime,xdg-open,zsh,gzip,wget,curl,notify-send private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl noblacklist /usr/lib/discord/ whitelist ${HOME}/.config/discord read-write ${HOME}/.config/discord whitelist ${DOWNLOADS} whitelist ${HOME}/.config/pulse/* include whitelist-common.inc include whitelist-var-common.inc include whitelist-run-common.inc include whitelist-runuser-common.inc I have some things commented out but you could probably uncomment most. Some has this, too: disable-mnt private-dev private-cache env http_proxy=socks5://127.0.0.1:9050 env https_proxy=socks5://127.0.0.1:9050 FWIW, once you start whitelisting, it will only have access to those directories and files only, so Discord has no access to anything other than its own directory and ${DOWNLOADS}, which I should probably change. You should check out the default profiles for many programs / apps under directory "/etc/firejail". [1] You run it via "firejail Discord" or "firejail ./Discord" if you name it "Discord.profile".
- rufugee 1y ago
  This is great. Thanks for the detailed reply!
  - johnisgood 1y ago
    It was not THAT detailed and it makes me feel a bit guilty, so if you have any questions let me know.

johnisgood 1y ago

I have my own Discord.profile! This is my ~/.config/firejail/Discord.profile[1]: include disable-common.inc include disable-devel.inc include disable-interpreters.inc include disable-shell.inc noblacklist /sys/fs noblacklist /sys/module keep-config-pulse keep-dev-shm name discord apparmor caps.drop all caps.keep sys_admin,sys_chroot netfilter nodvd #nogroups #noinput nonewprivs noroot notv #nou2f #novideo protocol unix,inet,inet6 #shell none disable-mnt private-cache #private-tmp noexec /tmp dbus-user filter dbus-user.talk org.freedesktop.Notifications private-bin Discord,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,tr,xdg-mime,xdg-open,zsh,gzip,wget,curl,notify-send private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl noblacklist /usr/lib/discord/ whitelist ${HOME}/.config/discord read-write ${HOME}/.config/discord whitelist ${DOWNLOADS} whitelist ${HOME}/.config/pulse/* include whitelist-common.inc include whitelist-var-common.inc include whitelist-run-common.inc include whitelist-runuser-common.inc I have some things commented out but you could probably uncomment most. Some has this, too: disable-mnt private-dev private-cache env http_proxy=socks5://127.0.0.1:9050 env https_proxy=socks5://127.0.0.1:9050 FWIW, once you start whitelisting, it will only have access to those directories and files only, so Discord has no access to anything other than its own directory and ${DOWNLOADS}, which I should probably change. You should check out the default profiles for many programs / apps under directory "/etc/firejail". [1] You run it via "firejail Discord" or "firejail ./Discord" if you name it "Discord.profile".

rufugee 1y ago
This is great. Thanks for the detailed reply!
- johnisgood 1y ago
  It was not THAT detailed and it makes me feel a bit guilty, so if you have any questions let me know.