### Build and Install Firejail from Source

Source: https://github.com/netblue30/firejail/blob/master/README.md

Standard procedure for cloning the repository, configuring, compiling, and installing Firejail. Ensure you have git and a C compiler installed.

```sh
git clone 'https://github.com/netblue30/firejail.git' &&
cd firejail &&
./configure &&
make -j "$(nproc)" &&
sudo make install-strip &&
make installcheck
```

--------------------------------

### Build and Install Firejail on Debian/Ubuntu

Source: https://github.com/netblue30/firejail/blob/master/README.md

Steps to clone the Firejail repository, configure the build, create a .deb package, and install it on Debian, Ubuntu, and their derivatives. Any ./configure flags should be passed to mkdeb.sh.

```sh
sudo apt-get update -qy
sudo apt-get install -qy \
  git build-essential fakeroot lintian libapparmor-dev pkg-config gawk
git clone 'https://github.com/netblue30/firejail.git' &&
cd firejail &&
./configure &&
make dist &&
./mkdeb.sh &&
sudo dpkg -i ./*.deb &&
make installcheck
```

--------------------------------

### Install Firejail from Ubuntu PPA

Source: https://github.com/netblue30/firejail/blob/master/README.md

Use these commands to add the Firejail PPA and install Firejail and its profiles on Ubuntu and derivatives. This PPA is recommended for more up-to-date versions.

```sh
sudo add-apt-repository ppa:deki/firejail
sudo apt-get update
sudo apt-get install firejail firejail-profiles
```

--------------------------------

### Firejail RPM Spec File Example

Source: https://github.com/netblue30/firejail/wiki/Using-firejail-from-git

A sample spec file for building an RPM package of Firejail, including build requirements and file installations.

```spec
Name:           firejail
Version:        0.9.63
Release:        1.gitbc3f74f2%{?dist}
Summary:        Linux namespaces sandbox program

License:        GPLv2+
URL:            https://github.com/netblue30/firejail
Source0:        %{name}.tar.gz

Recommends:     xdg-dbus-proxy
BuildRequires:  libselinux-devel

%description
Firejail is a SUID sandbox program that reduces the risk of security
breaches by restricting the running environment of untrusted applications
using Linux namespaces. It includes a sandbox profile for Mozilla Firefox.

%prep
%autosetup -c

%build
%configure --enable-selinux
%make_build

%install
make install-strip DESTDIR=%{buildroot}

%files
%config(noreplace) %{_sysconfdir}/firejail/firejail.config
%config(noreplace) %{_sysconfdir}/firejail/login.users
%config %{_sysconfdir}/firejail/*.inc
%config %{_sysconfdir}/firejail/*.net
%config %{_sysconfdir}/firejail/*.profile
%{_bindir}/firecfg
%{_bindir}/firejail
%{_bindir}/firemon
%{_libdir}/firejail
%{_datadir}/bash-completion/completions/firejail
%{_datadir}/bash-completion/completions/firecfg
%{_datadir}/bash-completion/completions/firemon
%{_docdir}/firejail/COPYING
%{_docdir}/firejail/README
%{_docdir}/firejail/RELNOTES
%{_docdir}/firejail/profile.template
%{_docdir}/firejail/redirect_alias-profile.template
%{_docdir}/firejail/syscalls.txt
%{_mandir}/man1/firecfg.1.gz
%{_mandir}/man1/firejail.1.gz
%{_mandir}/man1/firemon.1.gz
%{_mandir}/man5/firejail-login.5.gz
%{_mandir}/man5/firejail-profile.5.gz
%{_mandir}/man5/firejail-users.5.gz
%{_datadir}/vim/vimfiles/ftdetect/firejail.vim
%{_datadir}/vim/vimfiles/syntax/firejail.vim
%license COPYING

```

--------------------------------

### Install build dependencies and clone Firejail repository

Source: https://github.com/netblue30/firejail/wiki/Using-firejail-from-git

Installs necessary packages for RPM building and SELinux development, then clones the Firejail source code from GitHub.

```sh
sudo install rpmbuild libselinux-devel
git clone "https://github.com/netblue30/firejail.git" firejail
```

--------------------------------

### Build and Install Firejail on Fedora

Source: https://github.com/netblue30/firejail/blob/master/README.md

Instructions to clone the Firejail repository, configure the build, create an RPM package, and install it on Fedora and its derivatives. Any ./configure flags should be passed to mkrpm.sh.

```sh
sudo dnf update -y
sudo dnf install -y rpm-build gcc make
git clone 'https://github.com/netblue30/firejail.git' &&
cd firejail &&
./configure &&
make dist &&
./platform/rpm/mkrpm.sh &&
sudo rpm -i ./*.rpm &&
make installcheck
```

--------------------------------

### Install the Firejail RPM package

Source: https://github.com/netblue30/firejail/wiki/Using-firejail-from-git

Installs the newly built Firejail RPM package using dnf.

```sh
sudo dnf install "$RPMDIR"/x86_64/firejail-*.rpm
```

--------------------------------

### Install youtube-dl Binary with Firejail

Source: https://github.com/netblue30/firejail/wiki/Sandboxing-Binary-Software

Copy the downloaded youtube-dl binary to /usr/bin and make it executable. This step is necessary before reconfiguring Firejail.

```shell
sudo cp youtube-dl /usr/bin/.
sudo chmod +x /usr/bin/youtube-dl
```

--------------------------------

### Install Development Tools for Debian/Ubuntu (SELinux)

Source: https://github.com/netblue30/firejail/wiki/Using-firejail-from-git

Install necessary packages for building Firejail with SELinux support on Debian/Ubuntu systems. This includes git, build-essential, libselinux1-dev, and pkg-config.

```sh
sudo apt-get install git build-essential libselinux1-dev pkg-config
```

--------------------------------

### Example of using parameters for temporary changes

Source: https://github.com/netblue30/firejail/wiki/Creating-overrides

Use parameters directly in the command line for temporary modifications to a profile. This is an alternative to creating override files for short-term needs.

```sh
firejail --net=none --x11=xephyr vlc
```

--------------------------------

### Install Build Dependencies for Debian/Ubuntu

Source: https://github.com/netblue30/firejail/blob/master/README.md

Installs necessary packages for building Firejail on Debian/Ubuntu systems, including git, build tools, and AppArmor development libraries.

```sh
sudo apt-get install git build-essential libapparmor-dev pkg-config gawk
```

--------------------------------

### Install Development Tools for Debian/Ubuntu (AppArmor)

Source: https://github.com/netblue30/firejail/wiki/Using-firejail-from-git

Install necessary packages for building Firejail with AppArmor support on Debian/Ubuntu systems. This includes git, build-essential, libapparmor-dev, and pkg-config.

```sh
sudo apt-get install git build-essential libapparmor-dev pkg-config
```

--------------------------------

### Clone and Build Firejail from Git

Source: https://github.com/netblue30/firejail/wiki/Using-firejail-from-git

Use this command to clone the Firejail repository and build it using the traditional configure, make, and install steps. Ensure you have the necessary development tools installed.

```sh
git clone https://github.com/netblue30/firejail.git
cd firejail
./configure --prefix=/usr
make
sudo make install-strip
```

--------------------------------

### Firejail Configuration for Xephyr Screen

Source: https://github.com/netblue30/firejail/wiki/X11-Guide

This example shows how to configure Firejail's internal settings for Xephyr, specifying screen dimensions and keyboard layout parameters. Adjust these according to your system's `setxkbmap -query` output.

```sh
xephyr-screen 950x1024
xephyr-extra-paramts -resizeable -keybd ephyr,xkbmodel=evdev,xkblayout=de
```

--------------------------------

### Run Profile Statistics Tool

Source: https://github.com/netblue30/firejail/blob/master/README.md

Compile and install the profile statistics tool, then run it to analyze Firejail profiles in /etc/firejail. The tool provides statistics on various profile configurations.

```console
$ /usr/lib/firejail/profstats /etc/firejail/*.profile
```

--------------------------------

### Configure Firejail for package manager integration (Fedora)

Source: https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions

For Fedora, integrate Firejail with DNF by installing `python3-dnf-plugin-post-transaction-actions` and creating a `firecfg.action` file in `/etc/dnf/plugins/post-transaction-actions.d/`.

```sh
/usr/bin/*:any:firecfg
/usr/sbin/*:any:firecfg
/usr/share/applications/*:any:firecfg
```

--------------------------------

### Install Firejail from AUR (Arch Linux)

Source: https://github.com/netblue30/firejail/blob/master/README.md

Install the firejail-git package from the Arch User Repository (AUR) using an AUR helper like yay. Note that the AUR package is not officially maintained by the Firejail team.

```sh
yay -S firejail-git
```

--------------------------------

### Build Firejail with SELinux on Debian/Ubuntu

Source: https://github.com/netblue30/firejail/wiki/Using-firejail-from-git

Clone the Firejail repository and build it with SELinux support enabled. This process uses the standard configure, make, and install commands, specifying the SELinux flag.

```sh
git clone https://github.com/netblue30/firejail.git
cd firejail
./configure --enable-selinux --prefix=/usr && make && sudo make install-strip
```

--------------------------------

### Automate Firejail RPM Build Script

Source: https://github.com/netblue30/firejail/wiki/Using-firejail-from-git

This script automates the creation of Firejail RPM packages. It determines the version and release number, sets up a temporary build directory, generates a Firejail .spec file, packages the source code into a tarball, builds the RPM using rpmbuild, installs the RPM, and cleans up the build artifacts.

```bash
#!/bin/bash

set -e

NAME=firejail
VERSION=$(grep "PACKAGE_VERSION=.*" configure | grep -oE "([[:digit:]]|\\.)*")
COMMIT=$(git rev-parse --short HEAD)

installed_release=$(rpm -q --qf="%{RELEASE}" $NAME ||:)
if [ -z "$installed_release" ]; then
        RELEASE=1
else
        RELEASE=$(($(grep -oE "^[[:digit:]]+" <<<"$installed_release") + 1))
fi

TOPDIR=$(mktemp -dt $NAME-build.XXXXXX)
BUILDDIR=$(rpm --define "_topdir $TOPDIR" --eval %_builddir)
RPMDIR=$(rpm --define "_topdir $TOPDIR" --eval %_rpmdir)
SOURCEDIR=$(rpm --define "_topdir $TOPDIR" --eval %_sourcedir)
SPECDIR=$(rpm --define "_topdir $TOPDIR" --eval %_specdir)
SRPMDIR=$(rpm --define "_topdir $TOPDIR" --eval %_srcrpmdir)

mkdir -p "$BUILDDIR" "$RPMDIR" "$SOURCEDIR" "$SPECDIR" "$SRPMDIR"

cleanup() {
        rm -rf "$TOPDIR"
}
trap cleanup EXIT

cat <<EOF > "$SPECDIR/$NAME.spec"
Name:           $NAME
Version:        $VERSION
Release:        $RELEASE.git$COMMIT%{?dist}
Summary:        Linux namespaces sandbox program

License:        GPLv2+
URL:            https://github.com/netblue30/firejail
Source0:        %{name}.tar.gz

Recommends:     xdg-dbus-proxy
BuildRequires:  libselinux-devel

%description
Firejail is a SUID sandbox program that reduces the risk of security
breaches by restricting the running environment of untrusted applications
using Linux namespaces. It includes a sandbox profile for Mozilla Firefox.

%prep
%autosetup -c

%build
%configure --enable-selinux
%make_build

%install
make install-strip DESTDIR=%{buildroot}

%files
%config(noreplace) %{_sysconfdir}/firejail/firejail.config
%config(noreplace) %{_sysconfdir}/firejail/login.users
%config %{_sysconfdir}/firejail/*.inc
%config %{_sysconfdir}/firejail/*.net
%config %{_sysconfdir}/firejail/*.profile
%{_bindir}/firecfg
%{_bindir}/firejail
%{_bindir}/firemon
%{_libdir}/firejail
%{_datadir}/bash-completion/completions/firejail
%{_datadir}/bash-completion/completions/firecfg
%{_datadir}/bash-completion/completions/firemon
%{_docdir}/firejail/COPYING
%{_docdir}/firejail/README
%{_docdir}/firejail/RELNOTES
%{_docdir}/firejail/profile.template
%{_docdir}/firejail/redirect_alias-profile.template
%{_docdir}/firejail/syscalls.txt
%{_mandir}/man1/firecfg.1.gz
%{_mandir}/man1/firejail.1.gz
%{_mandir}/man1/firemon.1.gz
%{_mandir}/man5/firejail-login.5.gz
%{_mandir}/man5/firejail-profile.5.gz
%{_mandir}/man5/firejail-users.5.gz
%{_datadir}/vim/vimfiles/ftdetect/firejail.vim
%{_datadir}/vim/vimfiles/syntax/firejail.vim
%license COPYING
EOF

tar --exclude-vcs-ignore --exclude="./.git" --exclude="./test" --create \
  --gzip --file "$SOURCEDIR/$NAME.tar.gz" .

rpmbuild --nodebuginfo --quiet --define "_topdir $TOPDIR" -bb \
  "$SPECDIR"/$NAME.spec

RPM="$NAME-$VERSION-$RELEASE.git$(rpm -E %{?dist}).$(rpm -E %_arch).rpm"

mv "$RPMDIR/$(rpm -E %_arch)/$RPM" .

sudo dnf install "$RPM"

rm "$RPM"

```

--------------------------------

### Build Firejail with AppArmor on Debian/Ubuntu

Source: https://github.com/netblue30/firejail/wiki/Using-firejail-from-git

Clone the Firejail repository and build it with AppArmor support enabled. This process uses the standard configure, make, and install commands, specifying the AppArmor flag.

```sh
git clone https://github.com/netblue30/firejail.git
cd firejail
./configure --enable-apparmor --prefix=/usr && make && sudo make install-strip
```

--------------------------------

### Create and Whitelist Program Directory

Source: https://github.com/netblue30/firejail/wiki/Creating-Profiles

This snippet demonstrates how to ensure a program's configuration directory is accessible by first creating it if it doesn't exist, then whitelisting it. This is useful when a profile needs to explicitly grant access to a specific directory that might otherwise be blocked.

```shell
noblacklist ${HOME}/.config/Wire
mkdir ${HOME}/.config/Wire
whitelist ${HOME}/.config/Wire
```

--------------------------------

### Set up custom RPM build directories

Source: https://github.com/netblue30/firejail/wiki/Using-firejail-from-git

Creates a temporary directory structure for building RPM packages, mimicking the standard rpmdev-setuptree layout.

```sh
TOPDIR=$(mktemp -dt firejail-build.XXXXXX)
BUILDDIR=$(rpm --define "_topdir $TOPDIR" --eval %_builddir)
RPMDIR=$(rpm --define "_topdir $TOPDIR" --eval %_rpmdir)
SOURCEDIR=$(rpm --define "_topdir $TOPDIR" --eval %_sourcedir)
SPECDIR=$(rpm --define "_topdir $TOPDIR" --eval %_specdir)
SRPMDIR=$(rpm --define "_topdir $TOPDIR" --eval %_srcrpmdir)

mkdir -p "$BUILDDIR" "$RPMDIR" "$SOURCEDIR" "$SPECDIR" "$SRPMDIR"
```

--------------------------------

### Copy Kdenlive AppImage to /opt

Source: https://github.com/netblue30/firejail/wiki/Sandboxing-Binary-Software

Copy the downloaded Kdenlive AppImage file to the /opt directory. Ensure the source path is correct.

```sh
sudo cp ~/bin/Kdenlive-17.12.0d-x86_64.AppImage /opt/.
```

--------------------------------

### Implement Hardening Measures

Source: https://github.com/netblue30/firejail/wiki/Using-firejail-from-git

Apply security hardening by enabling 'force-nonewprivs', creating a 'firejail' group, setting correct ownership and permissions for the firejail binary, and adding the user to the firejail group. Finally, run firecfg to apply configurations.

```sh
sudo sed -i 's/# force-nonewprivs no/force-nonewprivs yes/' \
  /etc/firejail/firejail.config

sudo groupadd firejail
sudo chown -c root:firejail /usr/bin/firejail
sudo chmod -c 4750 /usr/bin/firejail
sudo usermod -a -G firejail "$USER"

sudo firecfg
```

--------------------------------

### Update Firejail from Git

Source: https://github.com/netblue30/firejail/wiki/Using-firejail-from-git

After cloning, use git pull to fetch the latest changes and then repeat the configure, make, and install steps to update your Firejail installation. This ensures you have the latest features and profiles.

```sh
cd firejail
git pull
./configure --prefix=/usr
make
sudo make install-strip
```

--------------------------------

### Reconfigure Firejail

Source: https://github.com/netblue30/firejail/wiki/Sandboxing-Binary-Software

Run the firecfg command to reconfigure Firejail after installing or updating a sandboxed application. This ensures Firejail is aware of the new binary.

```shell
sudo firecfg
```

--------------------------------

### Run Firefox with custom seccomp configuration

Source: https://github.com/netblue30/firejail/wiki/Troubleshooting

Execute Firefox with the locally configured seccomp rules applied, without the seccomp logging enabled, to confirm that the program runs without crashing.

```shell
firejail /usr/bin/firefox
```

--------------------------------

### Create Firefox Desktop Entry

Source: https://github.com/netblue30/firejail/wiki/Sandboxing-Binary-Software

This is the content for a desktop entry file to launch Firefox with Firejail. Adjust the icon path if necessary.

```console
$ cat ~/Desktop/firefox.desktop
[Desktop Entry]
Name=Firefox
Exec=firejail firefox --no-remote
Icon=/opt/firefox/browser/chrome/icons/default/default48.png
Terminal=false
Type=Application
```

--------------------------------

### Configure Fcitx with Firejail (dbus-policy none)

Source: https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions

When the dbus-policy is set to `none`, enable Fcitx by adding `dbus-user filter`, `dbus-user.talk org.freedesktop.portal.Fcitx`, and `ignore dbus-user none` to the application's local Firejail configuration.

```sh
dbus-user filter
dbus-user.talk org.freedesktop.portal.Fcitx
ignore dbus-user none
```

--------------------------------

### Create Kdenlive AppImage Desktop Entry

Source: https://github.com/netblue30/firejail/wiki/Sandboxing-Binary-Software

Desktop entry for launching Kdenlive AppImage with Firejail, specifying a profile. Ensure the AppImage path and icon path are correct.

```console
$ cat ~/Desktop/kdenlive.desktop
[Desktop Entry]
Name=Kdenlive
Exec=firejail --profile=/etc/firejail/kdenlive.profile --appimage /opt/Kdenlive-17.12.0d-x86_64.AppImage
Terminal=false
Type=Application
Icon=/opt/kdenlive-icon.png
```

--------------------------------

### Configure Fcitx with Firejail (dbus-policy filter)

Source: https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions

When the dbus-policy is set to `filter`, enable Fcitx by adding `dbus-user.talk org.freedesktop.portal.Fcitx` to the application's local Firejail configuration.

```sh
dbus-user.talk org.freedesktop.portal.Fcitx
```

--------------------------------

### Configure Private Etc for Media Issues

Source: https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions

Add this configuration to a `.local` file in `~/.config/firejail/` to resolve media playback issues on Arch Linux with Firejail 0.9.62. It ensures necessary system files are included in the private etc directory.

```bash
private-etc ld.so.conf,ld.so.conf.d,ld.so.preload
```

--------------------------------

### Run Firefox with seccomp logging enabled

Source: https://github.com/netblue30/firejail/wiki/Troubleshooting

Execute Firefox with the `--seccomp-error-action=log` flag to capture seccomp violations in the audit log for debugging purposes.

```shell
firejail --seccomp-error-action=log /usr/bin/firefox
```

--------------------------------

### Allow access to a file or directory

Source: https://github.com/netblue30/firejail/wiki/Creating-overrides

Use `whitelist` to explicitly allow access to specific files or directories. Ensure the profile is a whitelisting profile; otherwise, this directive may break access to other parts of the home directory.

```firejail
whitelist ~/MyPictures
noblacklist ~/MyPictures
```

```firejail
whitelist /mydisk/videos
noblacklist /mydisk/videos
```

```firejail
whitelist /srv/myimportant.file
noblacklist /srv/myimportant.file
```

--------------------------------

### Attach to Existing X11 Server

Source: https://github.com/netblue30/firejail/wiki/X11-Guide

This command demonstrates how to attach an additional program to an already running X11 server managed by Firejail. Use the display number provided by `firemon --x11`.

```sh
DISPLAY=:150 PROGRAM
```

--------------------------------

### Configure Firejail with SELinux Support

Source: https://github.com/netblue30/firejail/blob/master/README.md

Configure Firejail to build with SELinux support. This is typically used on systems like Fedora and RHEL.

```sh
./configure --enable-selinux
```