{"action":"created","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/1988","repository_url":"https://api.github.com/repos/netblue30/firejail","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/1988/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/1988/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/1988/events","html_url":"https://github.com/netblue30/firejail/issues/1988","id":331062564,"node_id":"MDU6SXNzdWUzMzEwNjI1NjQ=","number":1988,"title":"Profile option to access files in CLI arguments","user":{"login":"nikolay-turpitko","id":1192730,"node_id":"MDQ6VXNlcjExOTI3MzA=","avatar_url":"https://avatars3.githubusercontent.com/u/1192730?v=4","gravatar_id":"","url":"https://api.github.com/users/nikolay-turpitko","html_url":"https://github.com/nikolay-turpitko","followers_url":"https://api.github.com/users/nikolay-turpitko/followers","following_url":"https://api.github.com/users/nikolay-turpitko/following{/other_user}","gists_url":"https://api.github.com/users/nikolay-turpitko/gists{/gist_id}","starred_url":"https://api.github.com/users/nikolay-turpitko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikolay-turpitko/subscriptions","organizations_url":"https://api.github.com/users/nikolay-turpitko/orgs","repos_url":"https://api.github.com/users/nikolay-turpitko/repos","events_url":"https://api.github.com/users/nikolay-turpitko/events{/privacy}","received_events_url":"https://api.github.com/users/nikolay-turpitko/received_events","type":"User","site_admin":false},"labels":[{"id":245694821,"node_id":"MDU6TGFiZWwyNDU2OTQ4MjE=","url":"https://api.github.com/repos/netblue30/firejail/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-06-11T06:42:31Z","updated_at":"2018-06-11T12:31:52Z","closed_at":null,"author_association":"NONE","body":"Please add (or suggest if can be achieved with existing features) an option to enable in the profile config an access to the all files, listed in the command's CLI arguments. For example, i use such programs as `Midnight Commander` and `mutt`, which are configured to invoke certain commands to preview files (`pdftotext`, `lynx`, ...). Those commands are sandboxed and have no access to files they are invoked with. Say, `lynx` can be invoked with temporary file in the `/tmp`, or with file in the `/home` dir as an argument:\r\n\r\n        firejail /usr/bin/lynx -dump -force_html /home/some-sub-dir/index.html .\r\n\r\nIt's perfectly OK to give it access to any file, provided as it's command line argument. I assume, that I tell it explicit enough that I want it to be able to access this file. It's not desirable to give command access to all other files in the `/home` directory via profile, if they are not listed on the command line. It's not desirable to whitelist this file via `firejail` CLI argument, because I'll need to change config of every tool so that every tool be aware about `firejail`. I mean, I'll need to change configs of `mc`, `mutt`,  `vfm` and whatever tool I may use to invoke those sandboxed programs.\r\n\r\nWhat I'd prefer is to put some option in my custom firejail config, to say it what I want to do with files on the command line. Something like: `cli-args: no-blacklist,read-only`, `cli-args: whitelist`, `cli-args: mkfile` (copy), or other way around - add special notation for `cli-args` to be added to existing options. Like: `read-only: <cli-args>`."},"comment":{"url":"https://api.github.com/repos/netblue30/firejail/issues/comments/396227158","html_url":"https://github.com/netblue30/firejail/issues/1988#issuecomment-396227158","issue_url":"https://api.github.com/repos/netblue30/firejail/issues/1988","id":396227158,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NjIyNzE1OA==","user":{"login":"nikolay-turpitko","id":1192730,"node_id":"MDQ6VXNlcjExOTI3MzA=","avatar_url":"https://avatars3.githubusercontent.com/u/1192730?v=4","gravatar_id":"","url":"https://api.github.com/users/nikolay-turpitko","html_url":"https://github.com/nikolay-turpitko","followers_url":"https://api.github.com/users/nikolay-turpitko/followers","following_url":"https://api.github.com/users/nikolay-turpitko/following{/other_user}","gists_url":"https://api.github.com/users/nikolay-turpitko/gists{/gist_id}","starred_url":"https://api.github.com/users/nikolay-turpitko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikolay-turpitko/subscriptions","organizations_url":"https://api.github.com/users/nikolay-turpitko/orgs","repos_url":"https://api.github.com/users/nikolay-turpitko/repos","events_url":"https://api.github.com/users/nikolay-turpitko/events{/privacy}","received_events_url":"https://api.github.com/users/nikolay-turpitko/received_events","type":"User","site_admin":false},"created_at":"2018-06-11T12:31:52Z","updated_at":"2018-06-11T12:31:52Z","author_association":"NONE","body":"Hmm... Can I invoke some script from within firejail profile then? I don't want `mc` be aware even about my own script. It has a bunch of it's own scripts for many file types, supported by the community. I don't want to mangle them. They can be updated with package manager, for example. Also, there can be a lot individual commands to change. Though, I think I understood your idea, thanks. I'll see if I can do something like that. But if firejail profile allows some dynamic, it can be helpful too. And my first idea about profile option for cli arguments - please consider it too."}}
{"actor":{"display_login":"nikolay-turpitko"}}