Firejail: vlc whitelist

[Boruch-Baum]

I may be making a newbie error here, but it seems that the default profile for vlc (and I guess clvc) require two whitelist commands in addition to the noblacklist ones:

whitelist ${HOME}/.local/share/vlc
whitelist ${HOME}/.config/vlc

What happens without those commands are that settings aren't persistent, and vlc always opens with a nag screen.

In addition, I think most people would want the following:

whitelist ${HOME}/Videos

[Boruch-Baum]

Actually, looking at the default profile a second time, ALL the noblacklist items there should also have corresponding whitelist ones, no? Like I said, I'm new at this. I tried firejail maybe a year or two ago, and am trying it again now.

[Vincent43]

As you can see vlc doesn't enable whitelisting for $HOME so everything what isn't blacklisted is allowed. You may harden it additionally with various whitelist rules by adding them to /etc/firejail/vlc.local.

[Boruch-Baum]

@Vincent43 : Really? What you write doesn't make sense. You want to say that adding a whitelist rule will provide additional hardening ?!?! It does just the opposite! Also, why are you telling me to add personal rules to /etc/firejail/vlc.local? Shouldn't it be ~/.config/vlc.profile? On a more fundamental level, what you're claiming about whitelist and blacklist is obviously wrong; you seem to have the language backwards. You're also not addressing the central point of this issue, which is that necessary configuration files for vlc are not by default available.

[Vincent43]

You want to say that adding a whitelist rule will provide additional hardening ?!?!

Yes.

Also, why are you telling me to add personal rules to /etc/firejail/vlc.local? Shouldn't it be ~/.config/vlc.profile

Because ~/.config/vlc.profile will overwrite firejail profile completely while /etc/firejail/vlc.local will add those rules to existing profile.

You're also not addressing the central point of this issue, which is that necessary configuration files for vlc are not by default available.

Unfortunately, the central point of this issue is wrong because configuration files for vlc are available by default.

[Boruch-Baum]

@Vincent43

Unfortunately, the central point of this issue is wrong because configuration files for vlc are available by default.

Well, if you want to ignore my report, that's certainly an option for you, but what I am reporting contradicts you.

Because ~/.config/vlc.profile will overwrite firejail profile completely while /etc/firejail/vlc.local will add those rules to existing profile.

The documentation says to place an include /etc/firejail/foo.profile at the beginning of one's personal ~/.config/firejail/foo.profile, no?

You want to say that adding a whitelist rule will provide additional hardening ?!?!

Yes.

A memorable response that I will relish sharing with ALL my friends...

[curiosity-seeker]

A memorable response that I will relish sharing with ALL my friends...

Please do so if you really want to make a fool of yourself. Instead of bashing @Vincent43 who knows exactly what he‘s talking about you should have read the Firejail documentation - and you would know that adding a whitelist command to a profile means that the respective application does not have access to anything that is not explicitly whitelisted.

[Vincent43]

Well, if you want to ignore my report, that's certainly an option for you, but what I am reporting contradicts you.

I'm sorry but your report in not reproducible in current form. You may have something special in your system config or firejail config which causes this but I don't have the crystal ball to know it beforehand.

The documentation says to place an include /etc/firejail/foo.profile at the beginning of one's personal ~/.config/firejail/foo.profile, no?

That could be an option but certainly using /etc/firejail/foo.local or ~/.config/firejail/foo.local (in newer versions) is more appropriate.

A memorable response that I will relish sharing with ALL my friends...

What I can say... it's the simplest answer I could provide for your question and it's true. You said that you are new to firejail and I can say that I use it as long as it publicly exists and contributed many patches for it. Please consider this for further discussion.

[Vincent43]

Closing as it's not reproducible and no submitter feedback for a week.