Arch Linux

Zibi1981

Member

From: Poland

Registered: 2008-01-31

Posts: 720

Opera and Vivaldi + Firejail/AppArmor - configuration problem

For a month or so Opera started to have some issues with stability, which was supposedly because of recent glibc update, and affected all Chromium-based browsers (AFAIK). One of the solution is to run Opera or other Chromium-based browser with --disable-seccomp-filter-sandbox option, but that was said to create some security vulnerabilities, hence I decided to use Firejail and AppArmor. I installed both and went through some basic configuration based on Arch's wiki entries.

Unfortunately when I run Opera with options

firejail --apparmor opera --disable-seccomp-filter-sandbox

it doesn't save/remember any settings I change - every single time I run Opera, I have to go through all of it again and again. It seems like Opera can't save its settings to a file on hard disk.

Because of the issues described above I decide to switch to Vivaldi - running it with options

firejail --apparmor /usr/bin/vivaldi-stable --disable-seccomp-filter-sandbox

seems to work OK, but then I have problem with accessing files located on my hard disk - Vivaldi sees only some locations, i.e. only two folders in my ~.

I suppose I have to edit one or two Firejail profiles located in /etc/firejail/ and similarly AppArmor configs, but don't know what exactly to do.

Can anyone help me with this?

---

"... being a Linux user is sort of like living in a house inhabited by a large family of carpenters and architects. Every morning when you wake up, the house is a little different. Maybe there is a new turret, or some walls have moved. Or perhaps someone has temporarily removed the floor under your bed."

MSI Raider GE78HX 13VI-032PL

valera_cr

Member

Registered: 2013-01-12

Posts: 20

Re: Opera and Vivaldi + Firejail/AppArmor - configuration problem

opera fixed from version 67.0.3575.31 and higher

Zibi1981

Member

From: Poland

Registered: 2008-01-31

Posts: 720

Re: Opera and Vivaldi + Firejail/AppArmor - configuration problem

opera fixed from version 67.0.3575.31 and higher

Not in my case - version 67.0.3575.53 still crashing

---

"... being a Linux user is sort of like living in a house inhabited by a large family of carpenters and architects. Every morning when you wake up, the house is a little different. Maybe there is a new turret, or some walls have moved. Or perhaps someone has temporarily removed the floor under your bed."

MSI Raider GE78HX 13VI-032PL

xerxes_

Member

Registered: 2018-04-29

Posts: 1,065

Re: Opera and Vivaldi + Firejail/AppArmor - configuration problem

Does 'firejail --private-home=.config opera' help Opera to see their configs?

Last edited by xerxes_ (2020-03-05 12:57:23)

Zibi1981

Member

From: Poland

Registered: 2008-01-31

Posts: 720

Re: Opera and Vivaldi + Firejail/AppArmor - configuration problem

It seems I found a solution for Vivaldi - an issue where it cannot access certain folders.

1. Copy file /etc/firejail/chromium-common.profile to ~/.config/firejail
2. Edit it adding entries pointing to folders you want to give Vivaldi access to - here's how it looks in my case

(...)whitelist ${DESKTOP}
whitelist ${VIDEOS}
whitelist ${DOCUMENTS}
whitelist ${PICTURES}
whitelist ${MUSIC}
whitelist ${DOWNLOADS}(...)

3. Restart Vivaldi and run it with firejail --apparmor /usr/bin/vivaldi-stable --disable-seccomp-filter-sandbox

Vivaldi and other Chromium-based browsers should now have the rights to save files in the folders you have whitelisted.

---

"... being a Linux user is sort of like living in a house inhabited by a large family of carpenters and architects. Every morning when you wake up, the house is a little different. Maybe there is a new turret, or some walls have moved. Or perhaps someone has temporarily removed the floor under your bed."

MSI Raider GE78HX 13VI-032PL

qinohe

Member

From: Netherlands

Registered: 2012-06-20

Posts: 1,599

Re: Opera and Vivaldi + Firejail/AppArmor - configuration problem

If I understand correct, you're not able to run 'firejail --apparmor opera --seccomp'? which I use for firefox.

I use firefox in combo with PSD this still keeps working with the above command.
However I ask myself the question what the added security is & how secure this actually is..

Does not running the 'sandbox' defeat the purpose of running firejail?