search

netblue30 / firejail

Linux namespaces and seccomp-bpf sandbox
https://firejail.wordpress.com
GNU General Public License v2.0
5.72k stars 559 forks source link

mediathekview: program does not work #4839

Open Spacewalker2 opened 2 years ago

Spacewalker2 commented 2 years ago

Hello,

I added the stuff below to my mediathekview.profile and it started working again.

ignore noexec /tmp

noblacklist ${HOME}/.openjfx
read-only ${HOME}/.openjfx
whitelist ${HOME}/.mediathek3
whitelist ${DOWNLOADS}
kmk3 commented 2 years ago

@Spacewalker2 commented on Jan 7:

Hello,

I added the stuff below to my mediathekview.profile and it started working again.

ignore noexec /tmp

noblacklist ${HOME}/.openjfx
read-only ${HOME}/.openjfx
whitelist ${HOME}/.mediathek3
whitelist ${DOWNLOADS}

Nice. Would you like to open a pull request for that?

I'm not sure about whitelist ${DOWNLOADS}, but the rest seems alright.

glitsj16 commented 2 years ago

Odd, we don't blacklist ${HOME}/.openjfx anywhere AFAICT. Is that something you have added to a globals.local or any of the disable-foo.local files?

Spacewalker2 commented 2 years ago

You are right. It works without the OpenJFX lines. My fault this was probably a leftover from testing the profile sorry. About whitelist ${DOWNLOADS} your are right this isn't necessary either but I thought since MediathekView is also for downloading stuff having your download folder around couldn't hurt. I would have probably created a pull request in the first place but my branching skill could be more sophisticated. I would give it a try if you want but hopefully I don't create a mess.

I guess this reduces everything to two line then.

ignore noexec /tmp
whitelist ${HOME}/.mediathek3
glitsj16 commented 2 years ago

That happens, no poblem. And I personally understand whitelisting ${DOWNLOADS} with an app like this, but that's something you can easily do via mediathekview.local.

I would have probably created a pull request in the first place but my branching skill could be more sophisticated. I would give it a try if you want but hopefully I don't create a mess.

In the end it's up to you offcourse, but it's a chance to learn something new. Use the fork GUI on github, create a new branch like 'mediathekview-fix' using the dropdown and edit mediathekview.profile. When that's done you click the 'pull request' item and it will do its thing. We are always here to help you through this. And you get the credit for the changes :-). Just think about trying it, no need to rush or feel uncomfortable doing this. Thanks for bringing this to our attention, we need users to do so to keep our profiles up-to-snuff!

Spacewalker2 commented 2 years ago

Thanks. I didn't even know this is possible direct on GitHub.

glitsj16 commented 2 years ago

I've just reviewed the PR and added a suggestion. Also, if you could test the other remarks, that would be awesome. We don't meet many users of this profile so it's an opportunity to see if we can harden it some more. I think I added the mediathekview.profile a long time ago and have moved to a non-java app called QMediathekView since (which has a firejail profile too). Just a FYI if you'd want to ever get rid of java apps...

Spacewalker2 commented 2 years ago

I will look into the stuff and help with the hardening. At the moment I'm in my work office. I have to deal with this in the evening or on Monday. I rely on the subscription functionality of MediathekView a lot but I think QMediathekView is of some use on other machines. Thanks for the advice!

Spacewalker2 commented 2 years ago

Sorry I got all your messages but I'm a little bit unsure of what to test exactly. Having the stuff in one message will probably help already.