Support for Firejail

[flingr]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem? Please describe.

Took me a while to notice that applications/processess using Firejail go completely undetected. IMO this presents a confusing picture of the system resources.

Describe the solution you'd like

Add support for Firejail. Something similar to what #567 did for AppImages could resolve this. I'm willing to help bring this is, but wanted to discuss this first and get opinions.

Describe alternatives you've considered

No response

Additional context

No response

[nokyan]

Hi, thanks for the issue.
Sounds like a good idea. I've never used Firejail before, so I'd need to look up it first to see if there's anything to reliably detect Firejail processes.

[flingr]

@nokyan

Basically firejail wraps applications/commands with /usr/bin/firejail. E.g. to sandbox ('containerize') firefox it runs /usr/bin/firejail /usr/bin/firefox (leaving out optional parameters for brevity here). So that should offer one (and IMO the most reliable) way of detecting its processes.

The project also takes care of desktop integration via firecfg. The latter manipulates dektop files in the standard XDG locations (/usr/share/applications & ~/.local/share/applications) and changes the Exec line to point to a reference in /usr/local/bin (which is symlinked to /usr/bin/firejail). Currently it does not add any easily detected identifier (like for example X-Firejail=foo). But it does place a oneliner comment at the very top of generated/edited desktop files: # converted by firecfg. Opening a PR for adding such a more elegantly parseable identifier is something I'd be willing to do.

Hopefully this info offers a starting point. I sure realize familiarizing yourself with the Firejail codebase isn't a small ask.

Regards

[nokyan]

Basically firejail wraps applications/commands with /usr/bin/firejail. E.g. to sandbox ('containerize') firefox it runs /usr/bin/firejail /usr/bin/firefox (leaving out optional parameters for brevity here). So that should offer one (and IMO the most reliable) way of detecting its processes.

The project also takes care of desktop integration via firecfg. The latter manipulates dektop files in the standard XDG locations (/usr/share/applications & ~/.local/share/applications) and changes the Exec line to point to a reference in /usr/local/bin (which is symlinked to /usr/bin/firejail). Currently it does not add any easily detected identifier (like for example X-Firejail=foo). But it does place a oneliner comment at the very top of generated/edited desktop files: # converted by firecfg. Opening a PR for adding such a more elegantly parseable identifier is something I'd be willing to do.

Hopefully this info offers a starting point. I sure realize familiarizing yourself with the Firejail codebase isn't a small ask.

Regards

Thank you for you info :)

Using the firejail commandline to detect firejail sounds good and relatively easy.

Resources parses .desktop files completely and I believe it's not possible to read comments that way. I could make Resources look for this comment though after reading the .desktop file and before parsing it.