{"action":"created","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/1261","repository_url":"https://api.github.com/repos/netblue30/firejail","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/1261/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/1261/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/1261/events","html_url":"https://github.com/netblue30/firejail/issues/1261","id":225862676,"number":1261,"title":"File Manager Sandboxing","user":{"login":"SpotComms","id":8296104,"avatar_url":"https://avatars0.githubusercontent.com/u/8296104?v=3","gravatar_id":"","url":"https://api.github.com/users/SpotComms","html_url":"https://github.com/SpotComms","followers_url":"https://api.github.com/users/SpotComms/followers","following_url":"https://api.github.com/users/SpotComms/following{/other_user}","gists_url":"https://api.github.com/users/SpotComms/gists{/gist_id}","starred_url":"https://api.github.com/users/SpotComms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SpotComms/subscriptions","organizations_url":"https://api.github.com/users/SpotComms/orgs","repos_url":"https://api.github.com/users/SpotComms/repos","events_url":"https://api.github.com/users/SpotComms/events{/privacy}","received_events_url":"https://api.github.com/users/SpotComms/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-05-03T01:06:56Z","updated_at":"2017-05-03T17:12:45Z","closed_at":null,"body":"> Symlinks for the common file managers are installed in /usr/local/bin by firecfg. File managers are usually started by default at login time, and will be sandboxed. Clicking on a file in the file manager will start the corresponding program in the same sandbox as the file manager. For example, clicking on a video file will start a sandboxed VLC running the video. \r\n\r\nDoes that not defeat the purpose of Firejail? Any sandboxed program spawned under an already existing sandbox will not have its profile set, correct? So then won't that give programs more permissions then they'd normally have? And at the same time falsely leading users to believe that their apps are sandboxed?\r\n\r\nFor example gedit has 'net none', but if you open up a txt file from within Thunar, it'll end up with networking access. This issue becomes even worse when you end up spawning an application with a whitelist only profile which then ends up with full access to your files. Demonstration here: https://gist.github.com/SpotComms/55c8372cef381439cd9a90476e175f93\r\n\r\nThis point was clearly brought up in #1178 so I don't understand how this happened."},"comment":{"url":"https://api.github.com/repos/netblue30/firejail/issues/comments/298975410","html_url":"https://github.com/netblue30/firejail/issues/1261#issuecomment-298975410","issue_url":"https://api.github.com/repos/netblue30/firejail/issues/1261","id":298975410,"user":{"login":"SYN-cook","id":16857278,"avatar_url":"https://avatars1.githubusercontent.com/u/16857278?v=3","gravatar_id":"","url":"https://api.github.com/users/SYN-cook","html_url":"https://github.com/SYN-cook","followers_url":"https://api.github.com/users/SYN-cook/followers","following_url":"https://api.github.com/users/SYN-cook/following{/other_user}","gists_url":"https://api.github.com/users/SYN-cook/gists{/gist_id}","starred_url":"https://api.github.com/users/SYN-cook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SYN-cook/subscriptions","organizations_url":"https://api.github.com/users/SYN-cook/orgs","repos_url":"https://api.github.com/users/SYN-cook/repos","events_url":"https://api.github.com/users/SYN-cook/events{/privacy}","received_events_url":"https://api.github.com/users/SYN-cook/received_events","type":"User","site_admin":false},"created_at":"2017-05-03T17:12:45Z","updated_at":"2017-05-03T17:12:45Z","body":"If a new user was presented a choice, there would be nothing wrong with it, I guess. Maybe there could be a dialog in firecfg making it opt-in?"}}
{"actor":{"display_login":"SYN-cook"}}