Firejail: playonlinux + wine + firejail

[tinmanx]

Question 1: how exactly would you run firejail with playonlinux when wine is being run by playonlinux? Do you need to also configure the wine executable with firejail if only using playonlinux?

Question 2: @Vincent43 you mention here https://github.com/netblue30/firejail/issues/2219#issuecomment-434025708 that the default profile uses blacklists for wine and should use them if you store important files in various non-standard locations, so for example you would need to blacklist a location such as /media since it wouldnt be included?
Why isnt everything blacklisted by default and only whitelist what you want?

[rusty-snake]

1. playonlinux has a profile, so firejail playonlinux is enough. Or after you ran sudo firecfg you can just run playonlinux.

[rusty-snake]

In firejail you need to different between noblacklist and whitelist

Why isnt everything blacklisted by default and only whitelist what you want?

That would mean that the user muss interact with it so that it's work. IMHO it is better if it work out-of-the-box and the user can interact for more security.

[Vincent43]

It would be nice to use a whitelist for only specific elements by default but wine is quite special - it can run unlimited number of apps and it's hard to predict what they need to access (all XDG dirs at minimum I guess). Still I recommend to use whitelist locally and adjust it for your environment.

[rusty-snake]

@tinmanx I'm going to close this for now because of inactivity. Please fell free to reopen if you have more questions.