Does firejail rely on file hierarchy standard?

[amano-kenji]

There are some linux distributions like nix os and gnu guix system that deviate from file hierarchy stndard.

[rusty-snake]

There are two things we need to consider here, firejail and firejail-profiles.

For profiles the answer is simple: yes

For firejail (the binary) it is more complex. Some basic requirements like procfs being mounted at /proc will likely always being depended on. Path specific commands such as private-etc will of course also depend on these paths. Otherwise it does not have to depend on it but does more than necessary ATM.

---

General, as IDK the layout of nix: If you use a sandbox unfriendly filesystem layout, you have to decide between tight sandboxes and working features.

---

Note that FHS isn't the only thing. Besides it there are hier(7), XDG specs and file-hierarchy(7).

[Praetoriam]

Have you checked pkgs.apparmorRulesFromClosure?. This thread helped me out a bit https://discourse.nixos.org/t/what-is-pkgs-apparmorrulesfromclosure/39423/2. Alas, documentation is pretty scarce when it comes to AppArmor.

[amano-kenji]

Where is that documented?

[amano-kenji]

Can firejail do a similar thing for guix and nix?

[topimiettinen]

Probably with some effort. Deep support for Nix paths could also be used to select allowed components based on the package contents, so instead of listing file names etc. in private-etc, indirection with packages could be specified. So for example, instead of private-etc firefox, there could be something like private-etc @nixpkg:firefox. This would result in allowing something like /nix/store/gsbl1123dy7dil3vayj0w9irn0f2d4rf-firefox-124.0.2/etc (guess, I don't know Nix). The same idea could apply also to traditional distros but it's less useful since the paths won't change. Perhaps a basic profile could be synthesized for any package out there with just standard templates like private-etc @pkg:xyz + private-bin @pkg:xyz + private-lib @pkg:xyz @deps:pkg:xyz?

[amano-kenji]

For nix and guix, private-etc, private-lib, and other private directives don't make sense. Just whitelisting all necessary store directories is more than sufficient.

Only strictly necessary files are symlinked in store directories.