0

My machine is home desktop(personal) running Debian Buster with i3 window manager. I recently installed firejail with apt install firejail* firetools and also downloaded the new Firefox 83 browser from Firefox official website. I can run the firefox binary as a non-firejail user, as in, navigating to the new firefox directory and running [user@debian]:$ ./firefox It works fine and all. However, if I try doing, firejail --noprofile --seccomp --private --nonewprivs /home/user/downloads/firefox/firefox it says, the file firefox isn't executable. Running ls -l on the executable returns that it is executable. Then I copied the whole new firefox directory to /tmp/ then opened a new firejail bash session with firejail --seccomp --private --nonewprivs bash, then started a sandboxed bash session. Then copied the firefox directory from /tmp/ to $HOME and tried running the firefox binary from there, and it says permission denied The file was executable, and was owned by same user. What am I doing wrong here.

Improve this question
3
  • Maybe you're trying to run a 32bit firefox on your 64bit system or vice versa? I've tried your command and it works here, however Firefox cannot open any websites. You'll definitely need to use firefox.profile or something similar.
    – Artem S. Tashkinov
    Dec 2, 2020 at 9:35
  • I've managed to run the new firefox 83 in firejail issuing firejail --secccomp --noprofile --apparmor --caps.drop=all --x11=xorg --private --nonewprivs before that, I copied the firefox directory to /tmp and started it from there. Copying the diriectory back to home inside firejail made it non-execuatble again. Now only way for me to run it is to copy the directory to tmp. What commands did you issue? Were you able to run new firefox directly from the directory without copying the direcoty over to anywhere else
    – atheros
    Dec 2, 2020 at 17:46
  • The Firefox release from Mozilla is what I've been using since the late 90s, only it was called Netscape Navigator back then. I have it installed in /opt/firefox and it starts from there just fine under firejail, albeit it cannot open websites. Haven't tried any other directories.
    – Artem S. Tashkinov
    Dec 3, 2020 at 7:48

1 Answer 1

Reset to default
0

The firejail documentation states:

Use –private Firejail option to start with a factory default browser configuration, and an empty home directory.

So running firejail --private bash then ls ~ should show empty. Are you sure it said "the file firefox isnt' executable" at that point?

I am trying to do the exact same thing as you. The two options I can see are:

  1. Modify/make a custom /etc/firejail/firefox-common.profile which calls a modified disable-exec.inc which doesn't include the line: noexec ${HOME}

or

  1. Put the firefox83 directory in /opt/ and run it from there.

The first option reduces security and may be overwritten by a new firefox install.

I went with the second option.

If there is a way to exempt a directory from the later noexec instruction that would be ideal... anyone?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .