firefox: cannot launch the open file dialog (AppImage/dbus)

[Alex-Farol]

Hi everyone!

I perceived that Firefox Appimages from srevinsaju (https://github.com/srevinsaju/Firefox-Appimage) can't launch the open file dialog until I comment the "ignore dbus-user none". I would like to know if there are any security concerns implied by that.

Thanks in advance

[glitsj16]

When you comment ignore dbus-user none you actually improve the strength of the sandbox in this case. It keeps the dbus-user none from firefox-common.profile intact and that's always more secure than allowing access to the D-Bus user bus. Having said that though, Firejail's D-Bus filtering has improved considerably and adding some of these rules can enhance functionality quite securely. What specific functionalities can be safely gained/lost by enabling/disabling D-Bus user filtering is not the easiest of topics to grok. But reading the comments inside our firefox profiles for more detailed info is always good practice.

Opening the file dialog when using an AppImage might need some additional configuration on your system, relating to FUSE. Check this link and do some experimenting.

In any case, IMO you're not doing anything that compromises your Firefox sandbox. Always wise to double-check and ask when unsure, so 👍 for doing so.

[rusty-snake]

File dialog sounds more like adding

dbus-user.filter org.freedesktop.portal.Document
# or
dbus-user.filter org.freedesktop.portal.*

[Alex-Farol]

Adding each of these lines yields a message saying the profile is invalid. What could I be missing?

[kmk3]

Adding each of these lines yields a message saying the profile is invalid.
What could I be missing?

What is the output of firejail --version?

[rusty-snake]

Who ate my reply? Anyway, filter -> talk.

[Alex-Farol]

Adding each of these lines yields a message saying the profile is invalid.
What could I be missing?

What is the output of firejail --version?

firejail version 0.9.72

Compile time support:
- always force nonewprivs support is disabled
- AppArmor support is enabled
- AppImage support is enabled
- chroot support is enabled
- D-BUS proxy support is enabled
- file transfer support is enabled
- firetunnel support is disabled
- IDS support is disabled
- networking support is enabled
- output logging is enabled
- overlayfs support is disabled
- private-home support is enabled
- private-cache and tmpfs as user enabled
- SELinux support is disabled
- user namespace support is enabled
- X11 sandboxing support is enabled

[glitsj16]

Who ate my reply? Anyway, filter -> talk.

@Alex-Farol A hungry AI ate @rusty-snake's reply and something might have been lost in translation. Try:

dbus-user.talk org.freedesktop.portal.Document
or
dbus-user.talk org.freedesktop.portal.*

[Alex-Farol]

Hi!

dbus-user.talk org.freedesktop.portal.Document didn't work, but dbus-user.talk org.freedesktop.portal.* did the trick.

Thanks a lot!