Firejail - Revision history

Klinger: /* Torify application traffic */

2024-06-25T21:01:21Z

Torify application traffic

← Older revision		Revision as of 21:01, 25 June 2024
Line 137:		Line 137:
	You can use a custom DNS server if you don't want to use the one of your system. In this example, it's a server by the German privacy NGO [https://digitalcourage.de/support/zensurfreier-dns-server Digitalcourage].		You can use a custom DNS server if you don't want to use the one of your system. In this example, it's a server by the German privacy NGO [https://digitalcourage.de/support/zensurfreier-dns-server Digitalcourage].

	Using [[networkd-dispatcher]] it is possible to restart the Tor daemon every time network reconnect is performaed. This avoids having to wait for Tor network timeouts and reastablishes a new connection faster.		Using [[Systemd/networkd/dispatcher]] it is possible to restart the Tor daemon every time network reconnect is performaed. This avoids having to wait for Tor network timeouts and reastablishes a new connection faster.

	For a detailed explanation on this setup refer the [https://www.void.gr/kargig/blog/2016/12/12/firejail-with-tor-howto original guide]. Please note that this is a experimental setup which doesn't guarantee anonymity or security in any circumstances.		For a detailed explanation on this setup refer the [https://www.void.gr/kargig/blog/2016/12/12/firejail-with-tor-howto original guide]. Please note that this is a experimental setup which doesn't guarantee anonymity or security in any circumstances.

	=== Add Desktop Icons to Firejailed Apps ===		=== Add Desktop Icons to Firejailed Apps ===

Onny: /* Configuration */ Update signal-desktop example

2024-05-03T10:22:01Z

Configuration: Update signal-desktop example

← Older revision		Revision as of 10:22, 3 May 2024
Line 44:		Line 44:
	};		};
	signal-desktop = {		signal-desktop = {
	executable = "${pkgs.signal-desktop}/bin/signal-desktop --~~enable~~-~~features=UseOzonePlatform --ozone~~-~~platform=wayland~~";		# Enable tray icon otherwise Signal window might be hidden
			executable = "${pkgs.signal-desktop}/bin/signal-desktop --use-tray-icon";
	profile = "${pkgs.firejail}/etc/firejail/signal-desktop.profile";		profile = "${pkgs.firejail}/etc/firejail/signal-desktop.profile";
	extraArgs = [ "--env=GTK_THEME=Adwaita:dark" ];		extraArgs = [
			# Enforce dark mode
			"--env=GTK_THEME=Adwaita:dark"
			# Enable Wayland mode
			"--env=NIXOS_OZONE_WL=1"
			# Allow tray icon (should be upstreamed into signal-desktop.profile)
			"--dbus-user.talk=org.kde.StatusNotifierWatcher"
			];
	};		};
	};		};

imported>Kugland at 02:01, 29 December 2023

2023-12-29T02:01:16Z

← Older revision		Revision as of 02:01, 29 December 2023
Line 169:		Line 169:
	let		let
	packages = with pkgs; [		packages = with pkgs; [
			electrum
	firefox		firefox
			mpv
			gajim
			tor-browser
	vlc		vlc
	];		];
Line 180:		Line 184:
	}		}
	''		''
			mkdir -p "$out/share/icons"
	${lib.concatLines (map (pkg: ''		${lib.concatLines (map (pkg: ''
	tar -C "${pkg}" -c share/icons~~/hicolor~~ -h --mode 0755 -f - \| tar -C "$out" -xf -		tar -C "${pkg}" -c share/icons -h --mode 0755 -f - \| tar -C "$out" -xf -
	'') packages)}		'') packages)}
	find "$out/" -type f -print0 \| xargs -0 chmod 0444		find "$out/" -type f -print0 \| xargs -0 chmod 0444

imported>Kugland at 21:07, 28 December 2023

2023-12-28T21:07:04Z

← Older revision		Revision as of 21:07, 28 December 2023
Line 181:		Line 181:
	''		''
	${lib.concatLines (map (pkg: ''		${lib.concatLines (map (pkg: ''
	tar -C "${pkg}" -c share/icons/hicolor -h --mode 0755 -f - \| tar -C "$out" -~~xvf~~ -		tar -C "${pkg}" -c share/icons/hicolor -h --mode 0755 -f - \| tar -C "$out" -xf -
	'') packages)}		'') packages)}
	find "$out/" -type f -print0 \| xargs -0 chmod 0444		find "$out/" -type f -print0 \| xargs -0 chmod 0444

imported>Kugland at 21:01, 28 December 2023

2023-12-28T21:01:13Z

← Older revision		Revision as of 21:01, 28 December 2023
Line 169:		Line 169:
	let		let
	packages = with pkgs; [		packages = with pkgs; [
	~~electrum~~
	firefox		firefox
	~~mpv~~
	~~gajim~~
	~~tor-browser~~
	vlc		vlc
	];		];

imported>Kugland: Added another way of restoring the icons of firejailed applications, without home manager.

2023-12-28T20:59:55Z

Added another way of restoring the icons of firejailed applications, without home manager.

@@ Line 160: / Line 160: @@
 home.file.".local/share/icons/hicolor/128x128/apps/google-chrome.png".source = "${pkgs.google-chrome}/share/icons/hicolor/128x128/apps/google-chrome.png";
 home.file.".local/share/icons/hicolor/256x256/apps/google-chrome.png".source = "${pkgs.google-chrome}/share/icons/hicolor/256x256/apps/google-chrome.png";
 </syntaxhighlight>
 [[Category:Applications]]
 [[Category:Security]]

imported>Onny: Remove unneeded workaorund in Signal-Desktop example

2023-12-15T08:05:56Z

Remove unneeded workaorund in Signal-Desktop example

← Older revision		Revision as of 08:05, 15 December 2023
Line 46:		Line 46:
	executable = "${pkgs.signal-desktop}/bin/signal-desktop --enable-features=UseOzonePlatform --ozone-platform=wayland";		executable = "${pkgs.signal-desktop}/bin/signal-desktop --enable-features=UseOzonePlatform --ozone-platform=wayland";
	profile = "${pkgs.firejail}/etc/firejail/signal-desktop.profile";		profile = "${pkgs.firejail}/etc/firejail/signal-desktop.profile";
	extraArgs = [ ~~"--env=LC_ALL=C"~~ "--env=GTK_THEME=Adwaita:dark" ];		extraArgs = [ "--env=GTK_THEME=Adwaita:dark" ];
	};		};
	};		};

imported>Onny: Remove unstable notice

2023-11-18T08:23:43Z

Remove unstable notice

← Older revision		Revision as of 08:23, 18 November 2023
Line 55:		Line 55:

	=== Torify application traffic ===		=== Torify application traffic ===

	~~{{Note\|Parts of this instruction are not yet stable and will be available in the upcoming NixOS 23.05 release.}}~~

	The following example configuration creates a virtual network bridge which can be used in Firejail as an isolated network namespace. All traffic originating from this interface will be routed through a local [[Tor]] service which will therefore anonymize your internet traffic.		The following example configuration creates a virtual network bridge which can be used in Firejail as an isolated network namespace. All traffic originating from this interface will be routed through a local [[Tor]] service which will therefore anonymize your internet traffic.

imported>Ljlapierre: I wrote a small section on my solution for getting app icons working with Firejail

2023-08-03T03:20:26Z

I wrote a small section on my solution for getting app icons working with Firejail

@@ Line 134: / Line 134: @@
 For a detailed explanation on this setup refer the [https://www.void.gr/kargig/blog/2016/12/12/firejail-with-tor-howto original guide]. Please note that this is a experimental setup which doesn't guarantee anonymity or security in any circumstances.
 [[Category:Applications]]
 [[Category:Security]]

imported>Onny: Update Tor instructions

2023-03-12T22:17:48Z

Update Tor instructions

@@ Line 72: / Line 72: @@
 networking = {
    bridges."tornet".interfaces = [];
    nftables = {
      enable = true;
@@ Line 105: / Line 102: @@
        allowedUDPPorts = [ 5353 ];
      };
    };
 };