Add a profile for freetuxtv

[Rosika2]

Hi all, 👋

info:
System: Linux Lite 6.2.
firejail version 0.9.72

I haven´t installed freetuxtv yet. But I have a preliminary query that needs to be addressed first.

I´m using Linux Lite as operating system and I tend to sandbox as many processes as possible with the help of firejail. Especially those processes that connect to the internet.

firejail comes with dedicated profiles for many applications but freetuxtv is not among them.
Based on the assumption that freetuxtv uses vlc under the hood, would I be able to sandbox the freetuxtv process using firejail´s vlc.profile ❓
Or would it be a bit more complicated than that?

Thanks a lot in advance.

Many greetings from Rosika 🙂

[kmk3]

Duplicate of #1139.

firejail comes with dedicated profiles for many applications but
freetuxtv is not among them. Based on the assumption that freetuxtv uses
vlc under the hood, would I be able to sandbox the freetuxtv process
using firejail´s vlc.profile ❓ Or would it be a bit more complicated than
that?

You can try and see if it works:

firejail --profile=vlc /usr/bin/freetuxtv # or whatever the path is

But in general unfortunately creating profiles is not trivial; it is based on
trial and error.

See also:

• https://github.com/netblue30/firejail/blob/master/CONTRIBUTING.md
• https://github.com/netblue30/firejail/wiki/Creating-Profiles

[Rosika2]

@kmk3 :

Hi Kelvin, 👋

thanks a lot for your reply. ❤️

O.K., First I´ll have to install freetuxtv and then I´ll try firejail --profile=vlc /usr/bin/freetuxtv.
If it doesn´t work as expected I´ll be glad to use the links you kindly provided to see if I can create/tweak a profile for it.

Thanks again and many greetings from Rosika 🙂

[Rosika2]

@kmk3 :

Hi Kelvin; 👋

O.K., I installed freetuxtv now.
As expected firejail --profile=/etc/firejail/vlc.profile freetuxtv didn´t work:
Error: no suitable freetuxtv executable found

So I decided to give tweaking the vlc.profile a try:

1. cp /etc/firejail/vlc.profile /home/rosika/.config/firejail/freetuxtv.profile
2. then I edited the freetuxtv.profile as best I could.

Here´s what it looks like now:

# Firejail profile for FreeTuxTV
# Description: Internet TV and radio player
# This file is overwritten after every install/update
# Persistent local customizations
include vlc.local
# Persistent global definitions
include globals.local

noblacklist ${HOME}/.cache/freetuxtv
noblacklist ${HOME}/.config/freetuxtv
noblacklist ${HOME}/.config/aacs
noblacklist ${HOME}/.local/share/freetuxtv

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc

read-only ${DESKTOP}
mkdir ${HOME}/.cache/freetuxtv
mkdir ${HOME}/.config/freetuxtv
mkdir ${HOME}/.local/share/freetuxtv
whitelist ${HOME}/.cache/freetuxtv
whitelist ${HOME}/.config/freetuxtv
whitelist ${HOME}/.config/aacs
whitelist ${HOME}/.local/share/freetuxtv
include whitelist-common.inc
include whitelist-player-common.inc
include whitelist-run-common.inc
include whitelist-runuser-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
netfilter
nogroups
noinput
nonewprivs
noroot
nou2f
protocol unix,inet,inet6,netlink
seccomp

private-bin freetuxtv,vlc
private-dev
private-tmp

dbus-user filter
dbus-user.own org.mpris.MediaPlayer2.freetuxtv
dbus-user.talk org.freedesktop.Notifications
dbus-user.talk org.freedesktop.ScreenSaver
?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
dbus-user.talk org.mpris.MediaPlayer2.Player
dbus-system none

restrict-namespaces

It works as desired. Yet I´ve no idea whether it´s good enough.
What might be your opinion on it ❓

Thanks a lot in advance.

Many greetings from Rosika 🙂