Frequently Asked Questions

[rusty-snake]

Discussion for discussions about https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions.

Predecessor: #2792

[rusty-snake]

• Migrate matching parts to Troubleshooting and use this chance to review.

[rusty-snake]

✔️ Done

---

3D acceleration with nVidia-Hardware

Users with NVIDIA hardware may need to add ignore nogroups to globals.local, see #3144.

@kmk3 Should this be changed to "Before firejail 0.9.68 users with ..."?

edit also

If you are using NVIDIA proprietary drivers, you must also set ignore noroot in your firefox.local.

[kmk3]

@rusty-snake on Feb 15:

3D acceleration with nVidia-Hardware

Users with NVIDIA hardware may need to add ignore nogroups to
globals.local, see #3144.

@kmk3 Should this be changed to "Before firejail 0.9.68 users with ..."?

Done (moved to Troubleshooting.md).

edit also

If you are using NVIDIA proprietary drivers, you must also set ignore
noroot in your firefox.local.

Done.

[rusty-snake]

Cannot open hyperlink with web browser using another application

Update with information from #3919 (comment)

[rusty-snake]

@glitsj16 https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#how-do-i-sandbox-applications-started-via-systemd-d-bus-services is a mixup of systemd and dbus. Although systemd depends on dbus and make heavy usage of it, both have distinct configurations.

D-Bus

/usr/share/dbus-1/services/*.service and ~/.local/share/dbus-1/services/*.service are used by dbus (dbus-deamon or dbus-broker, whichever implementation is installed by your distribution). To "fix" them, you copy from the system directory to the user directory, adjust the Exec line and restart your dbus-deamon/dbus-broker (e.g. systemctl --user restart dbus.service, the dbus.service alias should work for both implementations; IDK if a reload works too). This can all be done in the absence of systemd like on runit systems.

systemd --user

/usr/lib/systemd/user/*.service and ~/.config/systemd/user/*.service are used by systemd --user. To "fix" them, you copy from the system directory to the user directory, adjust the Exec line and systemctl --user daemon-reload. The path in /usr/share/dbus-1/services/foobar.service does not matter unless it is a Type=DBus service.

[glitsj16]

Reworked the FAQ entree, including the now working uri-fragment. Thanks again for sharing your excellent insights!

[curiosityseeker]

Thanks for this! However, I'm pretty sure that most users (myself included) do not know what this "fix" actually means. What exactly is "fixed" and to what purpose? I suggest to clarify this in the wiki.

[glitsj16]

@curiosityseeker

By default these kind of service files start applications non-sandboxed, due to using full paths that bypass those created via firecfg (or otherwise). The purpose of creating local copy's and editing those is to force the applications in question running via firejail. In the 'heat' of the moment I forgot to add this. Will "fix" the "fixes" :D shortly.

[glitsj16]

@curiosityseeker

I've added some context. HTH. Please report back if it's still unclear.

[curiosityseeker]

@glitsj16
Thanks a lot for these additional remarks which clarify things!

Note, though (and just nickpitting), that at the bottom it says "Currently the firecfg command doesn't do any of this automatically. For an alternative implementation that supports these features, see firecfg.py."

However, the firecfg.py site says:

TODO: Firejail systemd --user
TODO: Firejail dbus-system-service

So it seems that firecfg.py is not yet a fully comprehensive alternative. But I'm absolutely confident that @rusty-snake will add this before long. 👍