firefox profiles include logic (whitelisting in ${RUNUSER})

[glitsj16]

After merging #5486 I was going over our firefox profiles to double-check if I overlooked something by adding whitelist ${RUNUSER}/psd/*firefox* in firefox.profile. I wonder if we need to add an override for this in firefox-common-addons.profile, like we do with ignore whitelist ${RUNUSER}/*firefox*. Got a bit confused by the include logic (which can become even more complex when users enable KeepasXC Plugin support) and I'm seeking some clarification/confirmation.

Let me explain by giving an example of how a future firefox-common-addons.profile could look like.

$ cat /etc/firejail/firefox-common-addons.profile

[...]
ignore whitelist ${RUNUSER}/*firefox*
ignore whitelist ${RUNUSER}/psd/*firefox*    <-- ***do we need this here?***
# Add one of the following options to your firefox-common-addons.local if you enabled KeePassXC Plugin support.    <-- do we need this here?
#ignore whitelist ${RUNUSER}/kpxc_server    <-- ***do we need this here?***
#ignore whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer    <-- ***do we need this here?***
ignore include whitelist-runuser-common.inc
[...]

I do hope it is clear what I'm asking :-)

[kmk3]

Yes, if the point of ignore whitelist ${RUNUSER}/*firefox* in
firefox-common-addons.profile is to prevent whitelisting in ${RUNUSER}, then
indeed all whitelist ${RUNUSER}/* commands in firefox.profile should be
ignored in firefox-common-addons.profile.

Good catch!

[glitsj16]

@kmk3 Thanks for having a look at this! I've opened #5497 for it.