Custom Firejail profile as security increase

[henrythebuilder]

Hi,
Following the latest problems detected with marketplace ( #746 ), I tried to use Firejail to increase security but in my computer the default profile does not work, so I tried to create a new local profile following information/instructions on how to manage Chromium/Electron applications. Referring especially on firejail repo (issue 2949 > netblue30/firejail#2946 ) I created the profile I attach stored locally at ~/.config/firejail/codium.profile
I use it from my shell through an alias for the executable codium (./bin/codium) as:

alias codium='firejail /my/local/installation/path/vscodium/bin/codium'

Not knowing how to share it I used this channel hoping to have help to correct/extend it to get best result
Enrico

codium.profile:

# Firejail profile for codium
# Description: main entry point for VSCodium from shell (./bin/codium)

# Persistent local customizations
include codium.local

noblacklist ${HOME}/.VSCodium
noblacklist ${HOME}/.config/VSCodium
noblacklist ${HOME}/.vscode-oss

### from https://github.com/netblue30/firejail/issues/2946
#seccomp !chroot
#ignore seccomp
seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice

# Redirect
include ${CFG}/code.profile

[kmk3]

@henrythebuilder on Jul 26:

Hi,

Following the latest problems detected with marketplace ( #746 ), I tried to
use Firejail to increase security but in my computer the default profile does
not work, so I tried to create a new local profile following
information/instructions on how to manage Chromium/Electron applications.
Referring especially on firejail repo (issue 2949 > netblue30/firejail#2946 )
I created the profile I attach stored locally at
~/.config/firejail/codium.profile

I use it from my shell through an alias for the executable codium
(./bin/codium) as:

alias codium='firejail /my/local/installation/path/vscodium/bin/codium'

Not knowing how to share it I used this channel hoping to have help to
correct/extend it to get best result

Hello, the firejail profiles are maintained directly in the firejail
repository.

Please search for/report any issues with firejail profiles directly in there:

• https://github.com/netblue30/firejail/issues

As for the upstream vscodium profile not working, this has been reported in the
following issue:

• vscodium: missing profile redirect: vscodium was renamed to codium netblue30/firejail#3871

So I quoted your comment in the above; let's continue this over there.

[henrythebuilder]

Thanks for the reply.
As soon as updates will be available for my system I will try the changes introduced to the profiles.
I will refer to the Firejail repo for any comments to VSCODIUM / VSCODE profiles
👍

[henrythebuilder]

As a trace in this discussion I confirm that with the update of @kmk3 (PR #4587 -> Fix vscodium ) and using the latest profiles, those who include the changes related to 'Electron' (from 'Refactor code.profile as electron redirect' onwards), no changes on local profiles are needed at less for special cases such a local/portable installation where you need to enable access to the installation directory through the directive read-write ${HOME}/bin/vscode.
Thanks again for the support !