How does whitelisting work / How to access ~/Desktop in firefox?

[Raj2032]

If I were to cat firefox.profile:

test@test-virtualbox ~/.config/firejail> cat firefox.profile 
# Firejail profile for firefox
# Description: Safe and easy web browser from Mozilla
# This file is overwritten after every install/update
# Persistent local customizations
include firefox.local
# Persistent global definitions
include globals.local

# NOTE: sandboxing web browsers is as important as it is complex. Users might be
# interested in creating custom profiles depending on use case (e.g. one for
# general browsing, another for banking, ...). Consult our FAQ/issue tracker for more
# info. Here are a few links to get you going.
# https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#firefox-doesnt-open-in-a-new-sandbox-instead-it-opens-a-new-tab-in-an-existing-firefox-instance
# https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#how-do-i-run-two-instances-of-firefox
# https://github.com/netblue30/firejail/issues/4206#issuecomment-824806968

noblacklist ${HOME}/.cache/mozilla
noblacklist ${HOME}/.mozilla
noblacklist ${RUNUSER}/*firefox*
noblacklist ${RUNUSER}/psd/*firefox*

blacklist /usr/libexec

mkdir ${HOME}/.cache/mozilla/firefox
mkdir ${HOME}/.mozilla
whitelist ${HOME}/.cache/mozilla/firefox
whitelist ${HOME}/.mozilla

# Add one of the following whitelist options to your firefox.local to enable KeePassXC Plugin support.
# NOTE: start KeePassXC before Firefox and keep it open to allow communication between them.
#whitelist ${RUNUSER}/kpxc_server
#whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer

whitelist /usr/share/doc
whitelist /usr/share/firefox
whitelist /usr/share/gnome-shell/search-providers/firefox-search-provider.ini
whitelist /usr/share/gtk-doc/html
whitelist /usr/share/mozilla
whitelist /usr/share/webext
whitelist ${RUNUSER}/*firefox*
whitelist ${RUNUSER}/psd/*firefox*
include whitelist-usr-share-common.inc

# firefox requires a shell to launch on Arch - add the next line to your firefox.local to enable private-bin.
#private-bin bash,dbus-launch,dbus-send,env,firefox,sh,which
# Fedora uses shell scripts to launch firefox - add the next line to your firefox.local to enable private-bin.
#private-bin basename,bash,cat,dirname,expr,false,firefox,firefox-wayland,getenforce,ln,mkdir,pidof,restorecon,rm,rmdir,sed,sh,tclsh,true,uname
# Add the next line to your firefox.local to enable private-etc support - note that this must be enabled in your firefox-common.local too.
#private-etc firefox

dbus-user filter
dbus-user.own org.mozilla.*
dbus-user.own org.mpris.MediaPlayer2.firefox.*
# Add the next line to your firefox.local to enable native notifications.
#dbus-user.talk org.freedesktop.Notifications
# Add the next line to your firefox.local to allow inhibiting screensavers.
#dbus-user.talk org.freedesktop.ScreenSaver
# Add the next lines to your firefox.local for plasma browser integration.
#dbus-user.own org.mpris.MediaPlayer2.plasma-browser-integration
#dbus-user.talk org.kde.JobViewServer
#dbus-user.talk org.kde.kuiserver
# Add the next line to your firefox.local to allow screen sharing under wayland.
#dbus-user.talk org.freedesktop.portal.Desktop
# Add the next line to your firefox.local if screen sharing sharing still does not work
# with the above lines (might depend on the portal implementation).
#ignore noroot
ignore dbus-user none

# Redirect
include firefox-common.profile

By default I can't access anything that is stored on the Desktop folder, but I can access Downloads folder.

What is preventing me from not being able to access Destkop but can access Downloads. I need to know so that I can then tweak whatever I need to allow firefox to be able to access.

Edit/Update:

It seems like inside firefox-common.profile it has whitelist to Downloads:

whitelist ${DOWNLOADS}

However still not sure how Desktop is being blocked?

[kmk3]

What is the version of firejail?

By default I can't access anything that is stored on the Desktop folder,
but I can access Downloads folder.

What is preventing me from not being able to access Destkop but can access
Downloads. I need to know so that I can then tweak whatever I need to allow
firefox to be able to access.

Edit/Update:

It seems like inside firefox-common.profile it has whitelist to Downloads:

whitelist ${DOWNLOADS}

That is working as intended.

If any path is whitelisted in the base path (such as in ${HOME}), then only
whitelisted paths are shown below the base path.

Does it work when adding the following work to
~/.config/firejail/firefox.local?

whitelist ${DESKTOP}

[kmk3]

That is working as intended.

Yes but I am trying to understand what is blocking the Desktop folder in
the first place.

whitelist ${HOME}/... means to hide all paths in ${HOME} except for the
whitelisted paths.

You can add whitelist ${DESKTOP} (or whitelist ${HOME}/Desktop) to
firefox.local to whitelist the desktop directory as well.

To undo whitelisting in ${HOME}, you would have to add ignore whitelist ${HOME}/... in firefox.local for every whitelist ${HOME}/... entry in
firefox.profile and its includes.

In this case, it would be something like:

ignore whitelist ${DOWNLOADS}
ignore whitelist ${HOME}/.cache/mozilla/firefox
ignore whitelist ${HOME}/.local/share/pki
ignore whitelist ${HOME}/.mozilla
ignore whitelist ${HOME}/.pki
ignore whitelist-common.inc

Though using whitelisting is much safer, as only specific paths are allowed.
Not all dangerous files are known/blocked by the included profiles, so
disabling whitelisting in ${HOME} is not recommended.

Does firejail work by blocking everything by default and then we have these
profiles to whitelist certain directories such as Downloads?

Almost is nothing is blocked by default; try exploring the sandbox without a
profile:

firejail --noprofile /bin/bash
cd
ls -al

Most of the blocking in ${HOME} is done by disable-common.inc and similar
profiles.

Copy /etc/firejail/firefox.profile to ~/.config/firejail/firefox.profile (which
overrides the former) and comment parts of it to see what changes in the
sandbox.

[Raj2032]

@kmk3 Hey so

firefox.local to whitelist the desktop directory as well.

Where is this file located? I am inside /etc/firejail and ls -l *.local returns nothing. Or I am supposed to create this inside /home/test/.config/firejail instead of cp the firefox.profile from this directory /etc/firejail to this: /home/test/.config/firejail ?

Though using whitelisting is much safer, as only specific paths are allowed.

I also noticed noblacklist what is the difference between that and whitelist?

[kmk3]

firefox.local to whitelist the desktop directory as well.

Where is this file located? I am inside /etc/firejail and ls -l *.local
returns nothing. Or I am supposed to create this inside
/home/test/.config/firejail instead of cp the firefox.profile from this
directory /etc/firejail to this: /home/test/.config/firejail ?

See the first reply:

Does it work when adding the following work to
~/.config/firejail/firefox.local?

whitelist ${DESKTOP}

Though using whitelisting is much safer, as only specific paths are
allowed.

I also noticed noblacklist what is the difference between that and
whitelist?

A noblacklist foo just ignores any following blacklist foo commands.

See man firejail.

[rusty-snake]

previous -> following

[Raj2032]

@kmk3 ok thanks