firefox: cannot launch with --private=<dir>

[kiselina2]

I guess I have to be doing something wrong since I cant find anyone else having this problem. I want to have persistent folder for launching firefox so that I can configure my firefox profiles.

Reading through https://firejail.wordpress.com/documentation-2/firefox-guide/ I saw the usage of firejail --private=/home/username/work firefox -no-remote &. When I try to set the --private option it will always work only the first time (until the dir contains .mozilla). When I try to open it second time, Ill always get "Your Firefox profile cannot be loaded. It may be missing or inaccessible."

running:
Arch Linux
6.9.2-arch1-1
firejail 0.9.72-3

[glitsj16]

If you happen to use firecfg it's advised to use full paths. The /usr/local/bin/firefox has precedence and the symlink then implies Firejail will try the sandbox twice.

Try:

$ firejail --private=${HOME}/my-firefox-home /usr/bin/firefox

Side note: be aware of #903 (as explained in man firejail)

[kiselina2]

I am getting closer. The full command I used was firejail --private="\${HOME}/browser_sandbox/" --profile="\${HOME}/.config/firejail/my.profile" -- firefox . Because I also wanted to whitelist a folder I needed to have access to.

my.profile content:

include firefox-common.profile
whitelist ${HOME}/.something⏎ 

Now I am at the point where the command works with either the --private=<dir> option or --profile=<profile> option, but not both.

[glitsj16]

Because I also wanted to whitelist a folder I needed to have access to.
whitelist ${HOME}/.something

Does ~/.something reside on your regular filesystem? Or did you create that inside the sandbox'es new HOME (~/browser_sandbox/something in your example)?

[glitsj16]

regular filesystem

When you use --private=

the sandbox will regard that as your new ${HOME}. Which implies that whitelisting ~/.something that resides in your regular filesystem is invisible to the sandbox. You have a few options:

• move ~/.something to the private ~/browser_sandbox
• use ~/.something as the private dir location instead of ~/browser_sandbox
• bind mount ~/.something to a path inside the private dir via regular mount

HTH

[kiselina2]

I could mount it, but isnt there another way? I dont really need to change the home dir. The only reason I am using --private is so that I have persistent .mozilla directory.

[glitsj16]

The default Firefox profile offers good protection. And it is persistent by default. The --private and --private-home options are for 'throwaway', one-time web-browsing. I'd stick to the defaults, then you can easily whitelist ${HOME}/.something. Even cherry-pick what you give read/write or read-only access in tthat location.

Extra protection can be provided by using hardened Firefox preferences (like arkenfox or betterfox for example), controlling javascript usage, uBo etc.)

[kiselina2]

I am already using arkenfox, thats why I need that persistent .mozilla directory. When I didn't use --private=<dir> then it was created every time I launched firefox, meaning my profile was "default-release" or something like that. I can't change any settings cause the changes will be wiped.

[glitsj16]

I'm confused. Been using arkenfox myself like forever in combination with Firejail. So I guess I don't understand what the problem is, sorry.

Here's a setup you can compare:

$ cat ~/.mozilla/firefox/profiles.ini
[Profile1]
Name=hardened
IsRelative=1
Path=hardened
Default=1

[Profile0]
Name=default
IsRelative=1
Path=default
Default=0

[General]
StartWithLastProfile=1
Version=2

[Install85DBFE385BFDD8A5]
Default=hardened

$ cat ~/.mozilla/firefox/installs.ini
[85DBFE385BFDD8A5]
Default=hardened
Locked=1

Given the above you can start a sandboxed Firefox instance with its desired profile like this:

$ firejail /usr/bin/firefox -P default
$ firejail /usr/bin/firefox -P hardened

[rusty-snake]

Guess the problem is the usage of a profile with a single whitelist statement instead of a .local.