Firejail: Brave not saving settings

[qazip]

Brave has now a new browser (https://github.com/brave/brave-browser) and the firejail profile seems to not work well with this version.

When opening brave using the default firejail profile, we get the message: "You are using an unsupported command-line flag: --no-sandbox. Stability and security will suffer".

Also, while using firejail, the brave browser is not saving settings. Any idea how I could fix this?

[rusty-snake]

Works it with firejail --no-profile brave-browser?

[qazip]

firejail --noprofile brave seems to work..

[Fred-Barclay]

Hi @qazip
Please try this:

firejail --profile=/etc/firejail/brave.profile --whitelist=${HOME}/.config/BraveSoftware brave

Also, what version of firejail and Linux distro do you use?
Thanks!
Fred

[qazip]

Hey @Fred-Barclay,

That doesn't seem to work. Settings are still not saved (and there's still that message in the browser).

firejail --version                                                                            
firejail version 0.9.56

Compile time support:
    - AppArmor support is disabled
    - AppImage support is enabled
    - chroot support is enabled
    - file and directory whitelisting support is enabled
    - file transfer support is enabled
    - networking support is enabled
    - overlayfs support is enabled
    - private-home support is enabled
    - seccomp-bpf support is enabled
    - user namespace support is enabled
    - X11 sandboxing support is enabled

Using antergos.

[SkewedZeppelin]

@qazip please try the following:

firejail --name=brave --private --profile=/etc/firejail/brave.profile brave

firejail --join=brave bash
$ tree # paste the output of this

that should show what the new paths are

[qazip]

@SkewedZeppelin, first command doesn't save settings. Second command just outputs this:

Error: cannot find sandbox brave

[rusty-snake]

@qazip Did you execute the second command before the first one ended?

[qazip]

I did it both ways. Separetely, I get the error I mentioned. Doing it while the previous command is running gives:

Switching to pid 17376, the first child process inside the sandbox

[rusty-snake]

When you see this output, you are in a shell in the sandbox, type tree and copy the output to here.
Example:

Switching to pid 7144, the first child process inside the sandbox
Child process initialized in 12.29 ms
[USER@host ~]$ tree
.
..
.config
[...]
5 directories, 2 files

[qazip]

After installing tree and doing that:

.

0 directories, 0 files

[rusty-snake]

But brave was still running? With this command firejail --name=brave --private --profile=/etc/firejail/brave.profile brave.

[qazip]

Yes, brave was still running..

[SkewedZeppelin]

@qazip apologies, can you do tree -lha to show all the dotfiles

[rusty-snake]

@qazip general: You can hide it with creating a plain/text-file and use the "Attach files by dragging & dropping, selecting them, or pasting from the clipboard." field.

[qazip]

Sorry about that @rusty-snake, I thought I could hide it behind a tag somehow. I've deleted the comment. Please see attachment.

brave_firejail.txt

[SkewedZeppelin]

Hah @Fred-Barclay already fixed this issue a month ago. It just isn't in 0.9.56. See a41b2019e9fa4e86bc3083fecc50ae015235065a

The command above probably didn't work for you because the directory didn't exist, so it still got deleted.

And GitHub does have spoiler support, see https://github.com/dear-github/dear-github/issues/166#issuecomment-236342209

[qazip]

Ah, ya, running brave once without firejail so the folder BraveSoftware gets created and then doing:

firejail --profile=/etc/firejail/brave.profile --whitelist=${HOME}/.config/BraveSoftware brave

does fix the issue. I am sorry I didn't notice sooner that BraveSoftware was not created, my bad. Hopefully the new version gets released soon.. Thank you guys.

[Fred-Barclay]

@SkewedZeppelin I've added the changes to /etc-fixes/0.9.56. Should we also push to the LTSbase branch?

[SkewedZeppelin]

@startx2017 do you have any guidelines for when we should push to LTSbase?

[Vincent43]

Is there a distro/project which uses our LTS?

[Fred-Barclay]

@Vincent43 I keep seeing people on Mint running 0.9.56LTS.

Not entirely sure where it's coming from (the version in the repos is 0.9.38 for Mint 18.x and 0.9.52 for Mint 19.x).

[Vincent43]

It seems that users are getting it on their own from https://sourceforge.net/projects/firejail/files/LTS/