Firejail: Difference between revisions

imported>Onny
mNo edit summary
imported>Onny
Fix installation instruction, restructure
Line 3: Line 3:
== Installation ==
== Installation ==


Add following line to your system configuration to install Firejail globally
Add following line to your system configuration to install and enable Firejail globally


<syntaxhighlight lang="nix">
<syntaxhighlight lang="nix">
environment.systemPackages = with pkgs; [ firejail ];
services.firejail.enable = true;
</syntaxhighlight>
</syntaxhighlight>
== Usage ==
To start an application in a sandboxed enviroment use Firejail like this
<syntaxhighlight lang="bash">
firejail bash
</syntaxhighlight>
For a graphical application like [[Firefox]] web browser, it is recommended to also use a profile
<syntaxhighlight lang="bash">
firejail --profile=$(nix --extra-experimental-features nix-command --extra-experimental-features flakes eval -f '<nixpkgs>' --raw 'firejail')/etc/firejail/firefox.profile firefox
</syntaxhighlight>
== Configuration ==


You can also use the Firejail NixOS module for a persistent usage of specific applications which should always run in Firejail. The following example wraps the browser Librewolf and the messenger Signal in a Firejail environment. The usual program path to <code>librewolf</code> and <code>signal-desktop</code> will be overwritten by the Firejail-wrapper.
You can also use the Firejail NixOS module for a persistent usage of specific applications which should always run in Firejail. The following example wraps the browser Librewolf and the messenger Signal in a Firejail environment. The usual program path to <code>librewolf</code> and <code>signal-desktop</code> will be overwritten by the Firejail-wrapper.
Line 32: Line 48:
   };
   };
};
};
</syntaxhighlight>
== Usage ==
To start an application in a sandboxed enviroment use Firejail like this
<syntaxhighlight lang="bash">
firejail bash
</syntaxhighlight>
For a graphical application like [[Firefox]] web browser, it is recommended to also use a profile
<syntaxhighlight lang="bash">
firejail --profile=$(nix --extra-experimental-features nix-command --extra-experimental-features flakes eval -f '<nixpkgs>' --raw 'firejail')/etc/firejail/firefox.profile firefox
</syntaxhighlight>
</syntaxhighlight>