Specify UID/GID for files downloaded via Firefox

[therealkitman]

Hi,
I run Transmission in Podman and have the ability to specify a UID/GID for downloaded files. For example I have a special folder that has owner/group = 'transmission/transmission' with R/W permissions only. Later I run clamscan on that folder before I change ownership and move those files to my NAS .

Can Firejail do something similar when I run Firefox and download files? That is run firejail firefox as myself but any downloaded files to ~./Downloads are saved as another user with restricted permissions?

Thanks.

[rusty-snake]

Note for reader:

• UID = owning user of a file
• GID = owning group of a file

[rusty-snake]

That is run firejail firefox as myself but any downloaded files to ~./Downloads are saved as another user with restricted permissions?

That would be a privilege escalation, wouldn't it?

Do you specify that in a transmission config or in podman? If podman does this, we might can do something similar but if transmission chowns the files then Firefox would need to do so.

[therealkitman]

Do you specify that in a transmission config or in podman?

It's specified in the docker/podman compose file docker hub

[rusty-snake]

How do you specify it? Is there a special option in all compose files for that? I don't use compose. Since you linked a transmission image with PUID/PGID environment variables, I assume you mean them. But you should give more details in future reports, no one can read your though - if you talk with people from other projects.

B2T, PUID/PGID have no meaning to docker and are understand by the entrypoint script of the image. So for your Firefox usecase you would need to (monkey/hot/live)patch Firefox or write a wrapper around it.

[glitsj16]

You can use the inotify-tools in a shell script for stuff like this. Very likely these are packaged and available in your OS. No need to alter anything in Firejail IMO.

[rusty-snake]

inotify is racey by design and might not work depending on the threat-model. Maybe fanotify can be used IDK.

[glitsj16]

@rusty-snake @therealkitman inotify indeed is racey. I was actually referring to the whole set of commands available in the package. Both fsnotifywait and fsnotifywatch use Linux's fanotify interface by default. According to man inotifywait fanotify support was added in kernel v5.9. But as of kernel v5.12, fanotify requires admin privileges. The latter might complicate things in this context, IDK.

[therealkitman]

You can use the inotify-tools in a shell script for stuff like this.

OK thanks. I'll check that out.