> bubblewrap vs. firejail

In case anyone else is curious, I found the following comparison in bubblewrap's repo.

- https://github.com/containers/bubblewrap#related-project-com...

I'm gonna try both and see which one I like. Thanks for this info! You're sure living up to your user name there. (:

To comment on the Pulseaudio bit from the link: you will want "keep-config-pulse" and "whitelist ${HOME}/.config/pulse/*".

> You're sure living up to your user name there. (:

You are too kind, thank you!

So do you configure firejail to give each app their own separate, permanent home directories? Like "firejail --private=/home/user/firejails/discord discord", "firejail --private=/home/user/firejails/chromium chromium", and so on?

I have my own Discord.profile!

This is my ~/.config/firejail/Discord.profile[1]:

  include disable-common.inc
  include disable-devel.inc
  include disable-interpreters.inc
  include disable-shell.inc

  noblacklist /sys/fs
  noblacklist /sys/module

  keep-config-pulse
  keep-dev-shm

  name discord
  apparmor
  caps.drop all
  caps.keep sys_admin,sys_chroot
  netfilter
  nodvd
  #nogroups
  #noinput
  nonewprivs
  noroot
  notv
  #nou2f
  #novideo
  protocol unix,inet,inet6
  #shell none

  disable-mnt
  private-cache
  #private-tmp

  noexec /tmp

  dbus-user filter
  dbus-user.talk org.freedesktop.Notifications

  private-bin Discord,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,tr,xdg-mime,xdg-open,zsh,gzip,wget,curl,notify-send
  private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl

  noblacklist /usr/lib/discord/
  whitelist ${HOME}/.config/discord
  read-write ${HOME}/.config/discord
  whitelist ${DOWNLOADS}
  whitelist ${HOME}/.config/pulse/*

  include whitelist-common.inc
  include whitelist-var-common.inc
  include whitelist-run-common.inc
  include whitelist-runuser-common.inc

I have some things commented out but you could probably uncomment most.

Some has this, too:

  disable-mnt
  private-dev
  private-cache

  env http_proxy=socks5://127.0.0.1:9050
  env https_proxy=socks5://127.0.0.1:9050

FWIW, once you start whitelisting, it will only have access to those directories and files only, so Discord has no access to anything other than its own directory and ${DOWNLOADS}, which I should probably change.

You should check out the default profiles for many programs / apps under directory "/etc/firejail".

[1] You run it via "firejail Discord" or "firejail ./Discord" if you name it "Discord.profile".

This is great. Thanks for the detailed reply!

It was not THAT detailed and it makes me feel a bit guilty, so if you have any questions let me know.

FYI you can search your comment history with hn.algolia.com:

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

Thank you, exactly what I have been looking for!