How can I configure Firejail to use Thunderbird profiles from a non-default location?

[Snake883]

How can I configure Firejail to use Mozilla Thunderbird profiles from a non-default location?

Without Firejail, Thunderbird would open my default Thunderbird profile.

Using Firejail, Thunderbird does not open my default Thunderbird profile, and does not recognize it exists:

Here is where my profile is located (notice it is a symbolic link):
/home/{user}/.thunderbird -> /media/sf_share/.thunderbird

[rusty-snake]

Add ignore disable-mnt to your thunderbird.local (~/.config/firejail/thunderbird.local).

[Snake883]

No success: "Error: Can't find profile directory"

$ cat ~/.config/firejail/thunderbird.local 
ignore disable-mnt

$ thunderbird
Reading profile /etc/firejail/thunderbird.profile
Reading profile /home/jake/.config/firejail/thunderbird.local
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/firefox-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-proc.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 15588, child pid 15589
Warning: logind not detected, nogroups command ignored
Warning: cleaning all supplementary groups
Warning: logind not detected, nogroups command ignored
Warning: cleaning all supplementary groups
Warning: logind not detected, nogroups command ignored
Warning: cleaning all supplementary groups
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: logind not detected, nogroups command ignored
Warning: cleaning all supplementary groups
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Warning: logind not detected, nogroups command ignored
Warning: cleaning all supplementary groups
Warning: Cannot confine the application using AppArmor.
Maybe firejail-default AppArmor profile is not loaded into the kernel.
As root, run "aa-enforce firejail-default" to load it.
Child process initialized in 442.25 ms
JavaScript error: resource:https://gre/modules/XULStore.jsm, line 66: Error: Can't find profile directory.

[glitsj16]

Here is where my profile is located (notice it is a symbolic link):
/home/{user}/.thunderbird -> /media/sf_share/.thunderbird

Symlinks in whitelisting profiles (like our thunderbird profile) might need both locations whitelisted. Besides ignoring disable-mnt, have you tried adding whitelist /media/sf_share/.thunderbird yet?

[Snake883]

Same problem:

...
JavaScript error: resource:https://gre/modules/XULStore.jsm, line 66: Error: Can't find profile directory.

Thunderbird profile:

$ cat /home/jake/.config/firejail/thunderbird.local
ignore disable-mnt
whitelist /media/sf_share/.thunderbird
whitelist ~/.thunderbird

Other Info:
I also tried this, and noticed I get a firejail permission problem...

$ firejail ls /media/sf_share/.thunderbird
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc

** Note: you can use --noprofile to disable default.profile **

Parent pid 145465, child pid 145468
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: cleaning all supplementary groups
Child process initialized in 427.68 ms
ls: cannot access '/media/sf_share/.thunderbird': Permission denied

Folder permissions:

$ ls -la .thunderbird
lrwxrwxrwx 1 jake jake 28 Jan 19 16:42 .thunderbird -> /media/sf_share/.thunderbird

[rusty-snake]

• Did you set disable-mnt yes in firejail.config?
• What does ls -l /media/sf_share/.thunderbird show without firejail?
• Which firejail version and distro do you use?
• Does it work with --noprofile?

[Snake883]

Thank you for the --noprofile hint. I believe I have the solution:

$ cat ~/.config/firejail/thunderbird.local
ignore nogroups
ignore noroot

[kmk3]

@snakyjake1 on Feb 10:

Folder permissions:

$ ls -la .thunderbird
lrwxrwxrwx 1 jake jake 28 Jan 19 16:42 .thunderbird -> /media/sf_share/.thunderbird

@snakyjake1 on Feb 10:

Thank you for the --noprofile hint. I believe I have the solution:

$ cat ~/.config/firejail/thunderbird.local
ignore nogroups
ignore noroot

This should probably only be needed if the ownership of
/media/sf_share/.thunderbird (or of any parent directory) is different from
jake:jake.

[simon-liebehenschel]

I do not know how and why this works (can someone explain?) but I solved the problem in another way:

• Put your thunderbird (or betterbird) in any location you want (e.g. in /opt).
• You do not need to edit the default firejail profile.
• Create a desktop shortcut as described in Sandboxing Binary Software.
  I use betterbird, so you will need to change the example below to thunderbird:

  [Desktop Entry]
  Name=betterbird
  Exec=firejail /opt/betterbird/betterbird --profile=/etc/firejail/thunderbird.profile
  Terminal=false
  Type=Application

• Run in your terminal bash ~/Desktop/thunderbird.desktop

Congratulations! No "choose your profile" anymore!

[rusty-snake]

Because there is no betterbird.profile and firejail uses default.profile which is rather weak.

Note: The --profile=/etc/firejail/thunderbird.profile is passed as is to betterbird. It is not a firejail argument in that position.

[simon-liebehenschel]

Because there is no betterbird.profile and firejail uses default.profile which is rather weak.

I know that there is no "betterbird" profile and I am not trying to pass it. I use --profile=/etc/firejail/thunderbird.profile inside my desktop shortcut.

Note: The --profile=/etc/firejail/thunderbird.profile is passed as is to betterbird. It is not a firejail argument in that position.

...or I did not understand what you was trying to say. Is calling bash ~/Desktop/thunderbird.desktop turns into something like calling betterbird without a profile or with a default profile?

PS: Sorry for a newbie question.