search

netblue30 / firejail

Linux namespaces and seccomp-bpf sandbox
https://firejail.wordpress.com
GNU General Public License v2.0
5.84k stars 569 forks source link

dolphin: cannot start keepassxc #3937

Closed MrFrank17 closed 3 years ago

MrFrank17 commented 3 years ago

Hi,

till now I was starting KeepassXC through the KDE start menu and everything worked as expected. However, if I start it by opening an associated database file in the KDE file browser dolphin, the KeepassXC profile seems not be loaded (eg KeepassXC cannot access its own configuration files in .config). Also it is not listed in firejail --list. Is this expected behavior when starting it within the scope of another application (dolphin in this case)?

Thanks Frank

Related commits:

rusty-snake commented 3 years ago

Is this expected behavior when starting it within the scope of another application (dolphin in this case)?

If this other application is firejailed too, yes.

MrFrank17 commented 3 years ago

Ok, then I guess I can close this issue ... Thanks for the quick reply!

MrFrank17 commented 3 years ago

After closing this issue a question came to my mind, therefore I reopen it and hope @rusty-snake or someone still reads it. To my understanding opening a program from another program still uses the profile of the first one, even if the second has its own. How do you handle in this case file browsers with firejail? All opened files from the file browser (office, pdf, ...) would never use its designated profile. Is the solution to not firejail a file browser?

rusty-snake commented 3 years ago

Is the solution to not firejail a file browser?

Yes. Dolphin is the only file browser in firecfg.config (for any reasons). If you disable thumbnails or sandbox the thumbnailers and don't use it for remote file access e.g. smb, there is no much risk left.

MrFrank17 commented 3 years ago

Edit: I found the firecfg.conf in /usr/lib/x86_64-linux-gnu/firejail and commenting out dolphin works as expected. krunner is already commented out, probably for the exactly same reason.

Do you (or someone else) know which program is doing the thumbnailing in dolphin? This would really be my preferred option to sandbox this process instead of turning of thumbnails all together.

Thanks

rusty-snake commented 3 years ago

Different thumbnail-programs are used depending on the file-format and installing new programs can add additional (krita, xournalpp and mypaint are example that I remember). So I suggest you to disable all thumbnailers expect for mp4,png,jpg,what else you need. IIRC has dolphin many settings for that.

MrFrank17 commented 3 years ago

Yes, dolphin has many options to toggle thumb-nailing. I guess this is more smooth than trying to sandbox the programs ...

rusty-snake commented 3 years ago

I'm closing here due to inactivity, please fell free to request to reopen if you have more questions.