1

How can I disable the --noprofile option in Firejail? For example, is it possible to disable the use of this option in firejail.config so that no one can use it.

2
  • Why would you want to?
    – Time4Tea
    Apr 26 '20 at 19:14
  • As in, use of firejail is not mandatory, right (unless you run the whole user login session through it)? So, can't any user simply elect not to run their program with firejail anyway?
    – Time4Tea
    May 2 '20 at 13:35
1

Firejail does contain a way to restrict user sessions, but it probably is too coarse for what you want to do.

Open file /etc/firejail/login.users and specify sandbox options for each user, for example:

username: --noprofile --private-tmp --private-dev --caps.drop=all --seccomp=!chroot 

Then change the user shell to /usr/bin/firejail in /etc/passwd. This way the entire user session runs in one and the same Firejail sandbox. Note that you usually won't be able to run sudo and friends in that session, so be careful to not lock yourself out.

For original documentation see man firejail-login.

If a one-size-fits-all sandbox is not what you need, better check out proper Mandatory Access Control (MAC) systems like AppArmor, SELinux or Tomoyo.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.