Firejail: Is there a command to activate single profile or selected profiles ??

[Nokia808]

Hi. I'm a Fedora user currently I use following guide that created by me after nearly 1 year from investigations:

https://forums.fedoraforum.org/showthread.php?313858-Risk-Free-WineHQ-Installation-amp-Usage

(my user name in Fedora forum is User808).

Recently I'm started to interested in Firejail sandboxing program & I like to use it for sandbox of ALL wine applications: ANY windows program installed on WineHQ will run sand boxed by Firejail ......

I search how to do this but I can not find answer ! I found the following command:

sudo firecfg

but it will lead to activated ALL profiles supported by Firejail NOT ONLY WineHQ profile.

Please I like to activate only WineHQ profile so that any Windows application already installed (or will be installed) will be run sand boxed by Firejail by default. How can I do this ?? Is there a specific command for that like:

sudo firecfg wine

Is there such a command or like command ??

[SkewedZeppelin]

sudo firecfg --clean && sudo ln -s /usr/bin/firejail /usr/local/bin/wine will only leave wine enabled

but what is the downside of having all the others sandboxed?

[Nokia808]

@SpotComms

Thank you very much your kind & rapid response !

I would like to suggest for developer of Firejail to simplify this command (creating abbreviation to it) like:
sudo firecfg foo
where foo is name of program (supported program by official profile).

Regarding your question: "but what is the downside of having all the others sandboxed?"
sand boxing meaning limitation in functionality - please correct to me if I'm wrong - like firefox downloads will be deleted just after close firefox if firefox run sandboxed, isn't it ? So, I do not like to run firefox every time by default sand boxed & to me it is enough to use "firejail firefox", but WineHQ is mandatory to me (never allow it to run out of firejail sand box). If I run "sudo firecfg" then GIMP will never be able (by default) to edit any image because it is sand boxed then any image edition will disappear just by exit GIMP.

I have following questions:

1) if I sand box WineHQ by firejail using command you gave to me, then do Irfanview (image program with edit power) & PDF-XChange editor (2 Windows program I like to use on Linux) will still be able to edit images & PDF while WineHQ is sand boxed ?? Does edit will disappear after closing Windows program ??
I mean: I have PDF stored on my laptop in "Documents" folder within my home directory, then can PDF-XChange editor used to edit this PDF while Wine is sandboxed by firejail ?

2) does firetools GUI has option from GUI to activate individual profiles ?

Best.

[SkewedZeppelin]

The default profiles are created with usability in mind. Firefox is allowed persistent access to its config and ~/Downloads; Gimp is allowed persistent access to basically everywhere. The only time Firejail will delete afterwards is when explicitly running with --private.

For your questions...

1. No. Wine has permission to access Documents, it will not be deleted on close
2. Yes, in a way. It will allow you to run programs sandboxed without enabling them system wide, however it does not always show every program Firejail supports.

[Vincent43]

but what is the downside of having all the others sandboxed?

The downside is you may not want some apps sandboxed. Especially things like wget, less, kate, dolphin which are commonly used for daily system administration. Currently I have to clean them manually after I run firecfg.

Option for enabling single items and/or blacklisting some apps for firecfg usage would be nice.

[chiraag-nataraj]

Moving this to #2097.