Add profile for mega cloud backup app

[merrpink]

I would like to run mega cloud backup app in firejail. I'm on Fedora37. This app is an rpm and will be installed by dnf. This app is not on Firejail's list so I am not sure how to do this correctly. I want to give this app access to only one directory (the one it will be backing up). I don't want it poking around my system further than that. From what I have been able to understand from the docs, using --private=directory is how I would achieve this. My question is, will Firejail automatically include config files and whatever else the app needs to work correctly or do I need to add these manually? Also, will the app be able to see the files to be backed up in the same directory with it? How do I point to these directories in the app's settings? Is there maybe a better way to set this up?
Thanks

[glitsj16]

Here are some general pointers on creating profiles:

• creating profiles
• request new profile

Will Firejail automatically include config files and whatever else the app needs
or do I need to add these manually?

You will have to add these manually. The workflow goes like this: add blacklists to disable-common.local or disable-programs.local (so other sandboxes can't see them) and noblacklist/whitelist in the app's profile.

Will the app be able to see the files to be backed up in the same directory with it?

Not sure I understand correctly. Obviously the app will need to be able to see its configuration data, plus the backup dir. Usually these are different locations in the filesystem.

How do I point to these directories in the app's settings?

When creating a new profile it's common practice to either get the needed info from available documentation and/or running it unsandboxed once to check what directories it creates/accesses so you know what paths are the bare minimum to have a working sandbox.

Is there maybe a better way to set this up?

In cases like this it can be very insightful to check whether there are existing profiles for applications offering similar functionality. Peeking inside our dropbox.profile for example could be a good start.

[rusty-snake]

The reason I am trying to run it in a sandbox is because I don't trust it. If I trust it once, and it is malicious, the damage is already done.

If you can not trust it once because you expect the program itself to be actively harmful, firejail is the wrong tool for you. You should run it on a decidate computer in a strict confined network. My two cents.

[merrpink]

@rusty-snake
You're right. This app is most probably fine and I'm just being a little paranoid, but being a backup tool, I don't want it poking around my filesystem. I tried running it as another user which worked well until I realized the app couldn't write to my backup directory and I couldn't get the directory to maintain group permissions. In addition to chmoding and chowning, I set ACL and umask but it seems that when I use nautilus for copying files, permissions get screwed.

Firejail looks like it could solve my issues so I guess I'll have to sit down and try to work out the profile...

[rusty-snake]

If you only care about messing up $HOME, firejail --private --profile=<foobar> /path/to/program while developing the profile.

[merrpink]

@rusty-snake
Thanks. --profile=<foobar> being the profile I am working on or some other default one?

[kmk3]

@merrpink on Dec 8:

--profile=<foobar> being the profile I am working on or some other default
one?

The profile you're working on.