Make File Browser official

[nephros]

@rainemak

Let’s honestly and together think whether this kind of special profile would be good for special needs. How much we should grant permissions and so on. As an example, File Browser could gain more permissions, let’s contribute if needed. Sailjail sandbox itself is to protect the end user herself from the malicious apps / actions. The question is completely different when asking the same from the end-user e.g. how much she can do harm on own?

I guess the first set of things would be:

• read-write access^[1] to everything under $HOME
• NO access to $HOME of other user accounts
• read-only access to / (root partition) and most subdirs
  • are there any that should deserve special “protection”, so be explicitly hidden? For example, somewhere where per-user secrets (like WLAN passwords) are stored?
• probably no access to any of the other mounts, i.e. all the Android apex/vendor/… stuff
• NO access to /sys/kernel, especially not /sys/kernel/debug (accessing files there is known to sometimes cause a device hang, or even crash).
• Probably no access to other special locations, like /proc, and /dev

Simple enough for a start. I know that’s basically “unjailed” plus some things.

Luckily, upstream Firejail has profiles which can serve as a template:

• firejail/etc/profile-a-l/file-manager-common.profile at master · netblue30/firejail · GitHub
• firejail/etc/profile-a-l/dolphin.profile at master · netblue30/firejail · GitHub
• firejail/etc/profile-m-z/nautilus.profile at master · netblue30/firejail · GitHub

---

1. as permitted by regular user permissions ↩︎