search

netblue30 / firejail

Linux namespaces and seccomp-bpf sandbox
https://firejail.wordpress.com
GNU General Public License v2.0
5.83k stars 568 forks source link

profiles: claws-mail: add ~/.cache/claws-mail #6378

Closed glitsj16 closed 5 months ago

glitsj16 commented 5 months ago

It is apparently used by the (widely used) "Fancy" plugin, which "Renders HTML e-mail using the WebKit library".

https://www.claws-mail.org/plugins.php

Relates to #6377.

Note: etc/profile-a-l/email-common.profile contains private-cache.

glitsj16 commented 5 months ago

email-common contains private-cache, so wouldn't these changes be a no-op?

You're absolutely right. This PR makes no sense, my bad.

kmk3 commented 5 months ago

email-common contains private-cache, so wouldn't these changes be a no-op?

You're absolutely right. This PR makes no sense, my bad.

I was confused about the plugin not working without the changes, but the changes themselves seem fine (if they are indeed a no-op with private-cache).

It seems good for documentation purposes, to have it blocked in disable-programs and to make it easier to use the real cache directory (by just using ignore private-cache).

kmk3 commented 5 months ago

@glitsj16

Hello, do you want to continue with this PR?

It's likely possible to click to restore the branch and then to reopen the PR.

glitsj16 commented 5 months ago

@kmk3

Hi, I'll take care of it today. Last days of school exams here, less computer-time for me usually. But it shouldn't take that long to restore and reopen this. Thanks for the reminder!

kmk3 commented 5 months ago

Hi, I'll take care of it today. Last days of school exams here, less computer-time for me usually. But it shouldn't take that long to restore and reopen this. Thanks for the reminder!

Ah I see, I wasn't sure if you had seen previous comment, so I commented again just in case.

Anyway, no hurry on the PR.

Good luck on the exams!

glitsj16 commented 5 months ago

@kmk3

Why the new changes?

Oh, I misunderstood. Thought you'd only wanted to keep the disable-common.inc part and leave private-cache as-is. To avoid more mishaps from my side, do you think it would make more sense to ignore private-cache for CM and use the dedicated whitelisted ~/.cache/claws-mail instead?

kmk3 commented 5 months ago

To avoid more mishaps from my side, do you think it would make more sense to ignore private-cache for CM and use the dedicated whitelisted ~/.cache/claws-mail instead?

I think in general it's good to leave private-cache on by default to help keep sandboxes isolated and to avoid unecessarily reducing the lifespan of storage devices, as IME programs rarely make good use of ~/.cache.

The exceptions would be if the program creates a giant cache (which like private-opt could take too much RAM) or when caching actually makes a positive noticeable difference (like shader caches in certain programs).

Edit: To be clear, I think that the original changes were correct (with the whitelist and without ignore private-cache).