Add profile for npm

[aidalgol]

No description provided.

[rusty-snake]

Good work, some nitpicks to go trough. Furthermore, can we add

• disable-exec.inc (with exception for ${HOME})
• whitelist-runuser-common.inc
• whitelist-var-common.inc
  ?

[rusty-snake]

whitelisting in $HOME is likely too much, rest looks fine.

[glitsj16]

LGTM, added a few nitpicks.

I have been trying to create a profile for npm (npx & yarn) for a while now. I find it rather hard to have it cover several personal npm use-cases. Would it be possible to show a fully working example here? This is not a critique, sandboxing npm is a very welcome profile. I'm just wondering if it's not going to create a lot of confusion for users when things start to break due to the vast amount of varied implementations out there.

Example of a project that builds fine with a firejailed npm:
- https://github.com/mozilla/web-ext.git

Examples of projects that throw all kinds of obstacles in the firejail sandboxing of npm:
- https://github.com/bitwarden/browser.git
- https://github.com/minbrowser/min.git
- https://github.com/openstyles/stylus.git

[glitsj16]

Might be good to add quiet here to avoid making npm's already pretty verbose output even noisier.

[glitsj16]

Why only allow these from disable-shell.inc? IMHO it would make more sense to drop these individual paths and remove 'include disable-shell.inc' below.

[rusty-snake]

If just /bin/sh is needed?

[aidalgol]

In my use of this profile, /bin/sh was insufficient, as some packages seemed to use /bin/bash. The other shells do not seem to be used anywhere near as commonly for build scripts, if ever.

[glitsj16]

See earlier comment.

[rusty-snake]

I'm just wondering if it's not going to create a lot of confusion for users when things start to break due to the vast amount of varied implementations out there.

It's not in firecfg.config. So it just breaks if you add it and then you know enough to adapt your workflows. IMHO it's good to provide a strict template which can be relaxed from users as they need.

[glitsj16]

It's not in firecfg.config. So it just breaks if you add it and then you know enough to adapt your workflows. IMHO it's good to provide a strict template which can be relaxed from users as they need.

@rusty-snake Agreed.

In my use of this profile, /bin/sh was insufficient, as some packages seemed to use /bin/bash. The other shells do not seem to be used anywhere near as commonly for build scripts, if ever.

@aidalgol That's a fair point.

In the mean time I re-did some intensive testing of this profile and it looks fine. Had something in my globals.local that kept breaking npm so scratch my earlier examples. For the record, I could add tracelog too.

For using it as a whitelist profile though I needed to add our 'regular' mkdir/mkfile/whitelist foo routine. Without those my ${HOME}/.npmrc was not getting respected. So here's a suggestion to incorporate into this npm.profile:

# If you want whitelisting, change ${HOME}/Projects below to your npm projects directory
# and uncomment the lines below.
#mkdir ${HOME}/.npm
#mkfile ${HOME}/.npmrc
#whitelist ${HOME}/.npm
#whitelist ${HOME}/.npmrc
#whitelist ${DOWNLOADS}
#whitelist ${HOME}/Projects
#include whitelist-common.inc

[aidalgol]

I have been trying to create a profile for npm (npx & yarn) for a while now. I find it rather hard to have it cover several personal npm use-cases. Would it be possible to show a fully working example here? This is not a critique, sandboxing npm is a very welcome profile. I'm just wondering if it's not going to create a lot of confusion for users when things start to break due to the vast amount of varied implementations out there.

I can't provide a working example that would be easy for anyone to try out, but I have used my original profile (before the suggested changes were made) for gatsby projects, a web-extension project, and some miscellaneous frontend stuff.