Can't open links from hexchat

[ibahnasy]

When running hexchat with firejail, it's not possible to launch links directly.

[rusty-snake]

#1718
#1770 (comment)

[rusty-snake]

@other_collaborator, we must document the "open links from foo does not work". Or we must answer it for the rest of our live.

#3308
#2228
#2047
#1955
#3311
#…

[glitsj16]

we must document the "open links from foo does not work". Or we must answer it for the rest of our live

@rusty-snake Very true. IMO the best we can do is to actually implement a secure way for users to open links from foo in browsers, regardless of documentation. Something along the lines of what I tried to convey here. Although the stuff linked in that comment is outdated, I have been using a few very simple shell scripts and geckodriver to implement basic URL inter-sandbox communication with mozilla-based web browsers for a long time now. Recently I have improved these scripts to avoid having to rely on D-Bus alltogether, in both the scripts and firejail profiles. A bit swamped at the moment to start a WIP PR for it, but reading your message here reminded me I must bite the bullet and go public soonish and see what the firejail community thinks about it...

[rusty-snake]

@glitsj16 with #3265 a dbus-user.talk org.mozilla.firefox.* rule is enough.
Problem1: profiles with private-bin
Problem2: /usr/bin/firefox is a shell script in Ubuntu/Fedora/Arch/… and adding bash to private-bin relaxes the sandbox.

# globals.local
dbus-user filter
dbus-user.talk org.mozilla.firefox.*
ignore dbus-user none
ignore nodbus

# post-globals.local -- does not exists upstream
# conndition does not exists
?HAS_PRIVATE_BIN: private-bin basename,bash,cat,dirname,expr,false,firefox,firefox-wayland,ln,mkdir,pidof,rm,rmdir,sed,sh,tclsh,true,uname

[glitsj16]

@rusty-snake Yes, the new D-Bus filters definately improve the situation. The scripts I'm refering to are doing there job outside the sandbox, apllications inside are agnostic to their existence. A wrapper for /usr/bin/firefox intercepts calls to it and dispenses a drop file containing the URL request. Not much different than what the GNOME portal system is doing actually. The work done by @kris7t in this regard is the best thing happening for firejail in a long while! Nevertheless I wouldn't mind D-Bus succumbing to a corona infection, being the security nightmare it is 😀.

[rusty-snake]

I'm closing here due to inactivity, please fell free to reopen if you have more questions.