Bug#822693: Feature Request: Automatically starting programs under firejail

2016-04-28 Thread Reiner Herrmann
Hi!

Thanks for your suggestion!

On Tue, Apr 26, 2016 at 06:54:07PM +0200, ban...@openmailbox.org wrote:
> At the moment there is no way to make all programs start with firejail
> automatically. Beginner users can't be expected to start a terminal every
> time they want to launch a program. This usability problem can be a hurdle
> for widespread adoption.

For better usability for beginners there is a graphical frontend called
'firetools' available.

> The suggestion in firejail documentation is to create a symlink between a
> binary's folder and firejail but unfortunately this solution is not
> maintainable on its own because package upgrades will overwrite the
> symlinks.

The upcoming upstream release of firejail (0.9.40) will also include
a helper tool called firecfg. This will create the symlinks for you
in /usr/local/bin (which comes by default before /usr/bin and /bin in PATH),
and are also not touched by package management.
I think this is a simple and usable way to let your programs start with
firejail.

Would this be also an acceptable solution for you?

Kind regards,
  Reiner


signature.asc
Description: Digital signature


Bug#822693: Feature Request: Automatically starting programs under firejail

2016-04-26 Thread bancfc

Package: firejail
Version: 0.9.38-1
Severity: wishlist

At the moment there is no way to make all programs start with firejail 
automatically. Beginner users can't be expected to start a terminal 
every time they want to launch a program. This usability problem can be 
a hurdle for widespread adoption.


The suggestion in firejail documentation is to create a symlink between 
a binary's folder and firejail but unfortunately this solution is not 
maintainable on its own because package upgrades will overwrite the 
symlinks.


I propose instead for a set of (optionally enabled) dpkg wrapper scripts 
that rely on config-package-dev to maintain symlinks of the protected 
programs across package updates. config-package-dev uses the dpkg-divert 
operation for moving packaged files to alternative locations.


https://debathena.mit.edu/config-packages/