Questions[firejail](ubuntu)

I've edited /usr/share/applications/firefox.desktop in the past to use firejail when running firefox, but it seems like this was removed during an update.

How can I permanently open browsers in Firefox without needing to update .desktop files whenever they're updated?

.desktop files in ~/.local/share/applications

These files still exist, they're unchanged from when I created them months ago. The system just isn't picking them up for some reason, and seems to be prioritising the ones in /usr/share/applications instead.

Some of this is redacted due to extraneous content (language specs, etc).

firefox.desktop

[Desktop Entry]
Version=1.0
Name=Firefox Web Browser
Keywords=Internet;WWW;Browser;Web;Explorer
Exec=firejail firefox %u
Terminal=false
X-MultipleArgs=false
Type=Application
Icon=firefox
Categories=GNOME;GTK;Network;WebBrowser;
MimeType=text/html;text/xml;application/xhtml+xml;application/xml;application/rss+xml;application/rdf+xml;image/gif;image/jpeg;image/png;x-scheme-handler/http;x-scheme-handler/https;x-scheme-handler/ftp;x-scheme-handler/chrome;video/webm;application/x-xpinstall;
StartupNotify=true
Actions=new-window;new-private-window;

[Desktop Action new-window]
Name=Open a New Window
Name[ar]=افتح نافذة جديدة
Exec=firefox -new-window

[Desktop Action new-private-window]
Name=Open a New Private Window
Exec=firefox -private-window

brave-browser.desktop

[Desktop Entry]
Version=1.0
Name=Brave Web Browser
GenericName=Web Browser
# Gnome and KDE 3 uses Comment.
Comment=Access the Internet
Exec=firejail /usr/bin/brave-browser-stable %U
StartupNotify=true
Terminal=false
Icon=brave-browser
Type=Application
Categories=Network;WebBrowser;
MimeType=application/pdf;application/rdf+xml;application/rss+xml;application/xhtml+xml;application/xhtml_xml;application/xml;image/gif;image/jpeg;image/png;image/webp;text/html;text/xml;x-scheme-handler/ftp;x-scheme-handler/http;x-scheme-handler/https;
Actions=new-window;new-private-window;

[Desktop Action new-window]
Name=New Window
Exec=/usr/bin/brave-browser-stable

[Desktop Action new-private-window]
Name=New Incognito Window
Exec=/usr/bin/brave-browser-stable --incognito

.desktop files in /usr/share/applications

They're identical to the ones in ~/.local/share/applications.

I just added firejail to the front of the Exec command in each .desktop file. These commands work fine when manually executed in the terminal.

Further debugging info

I think this may have started happening after I updated from Ubuntu 20.04.1 LTS to Ubuntu 20.04.2 LTS. I'm not sure, though.

I haven't changed anything besides updating system packages with apt. I'm not aware of anything that could've caused this problem.

I know when it's working, because when it is, I can only access the ~/Downloads folder when uploading files in the browser. And if I'm running it from the command line, I'll get output from firejail.

I'm new to linux.

Out of curiosity, I run some commands as sudo to mess up with permissions. When I restarted my system, most of the apps give firejail error.

For Example If I run firefox then it says:

Error: cannot create /run/firejail/profile/3535

This same error appears in most of the apps like rhythombox, vlc, dolphin when i launch them in terminal by just typing their name. When I launch them directly, nothing happens after some loading. I hope I'm not the first one to get this error because of my stupidity. Please Help.

In Ubuntu 19.04, you can install Chromium using snap like this:

sudo snap install chromium

However, when installing Chromium via snap, you cannot sandbox it with firejail like this:

firejail chromium-browser

The command above runs the non-snap version of chromium in a sandbox where chromium only has access to the Downloads folder (and not your entire home folder).

However, when Chromium is install as a SNAP, firejail cannot achieve these file system restrictions. When you use Chromium installed via sudo apt install chromium-browser, firejail works, but it doesn't work with snap-installed chromium.

I understand that future versions of Ubuntu will only be offering the snap package of Chromium, so that's why I'm trying to address this issue right now in Ubuntu 19.04. See this as well.

I've requested an alternative snap installation method, that only gives Chromium access to the Downloads folder here.

Until then, how can I sandbox Chromium (installed via SNAP), in a manner like firejail sandboxes Chromium (installed via apt)?