[discussion] discord.profile: Doesn't need access to the entirety of /tmp about firejail-profiles HOT 4 CLOSED

It'd be nice if there was a way to allow discord to only access /tmp/discord.sock, while leaving the rest of /tmp hidden. Right now, discord.profile ignores the private-tmp command, exposing the host's /tmp folder.

Actually, I just found that removing ignore private-tmp seems to let discord work just fine. I'll tenatively comment out that line and mark this as solved, but let me know if it breaks on your end (it seems to work just fine on mine).

from firejail-profiles.

Also, the whitelist lines mean that it only has access to /tmp/.X11-unix and /tmp/user/1000. Not the best, but not exactly the worst either. As you said, it's not really possible right now to deal with this since discord doesn't support passing an existing socket (otherwise, writing a wrapper script would be easy).

from firejail-profiles.

Ooh! One way around this is to do the following:

1. Make a directory /tmp/user/1000/discord1000
2. Pass TMPDIR=/tmp/user/1000/discord1000 as an environment variable.
3. Make sure that directory is whitelisted in your firejail profile.
4. Now it should be able to do this without needing access to anything else!

Off to try this now.

from firejail-profiles.

That's a perfect solution. Thanks!

from firejail-profiles.