firefox: file picker is not sandboxed

[rieje]

I set up Firefox to use a terminal file picker (Alacritty terminal + Yazi file manager via xdg-desktop-portal-termfilechooser) as the XDG file picker. works fine when Firefox is run without firejail, but with firejail the file picker still sees my filesystem and not the sandboxed filesystem. This means no matter which file I select, Firefox gives the error "no read permissions" because the sandboxed Firefox is passed files from outside the filesystem it cannot see.

The default GTK file picker for Firefox doesn't have this problem. I assume the issue is Alacritty/Yazi is not launched as a sub process by the sandboxed Firefox but I'm not sure why. How can I get Alacrity/Yazi to launch as a sub process so that it runs in the same Firefox sandbox and selecting files actually get passed appropriately?

I believe the following configs/scripts are involved and I'm not sure how to whitelist them if that's the approach to make this work:

• ~/.config/xdg-desktop-portal-termfilechooser/config
• ~/.config/xdg-desktop-portal-termfilechooser/yazi-wrapper.sh
• ~/.config/xdg-desktop-portal/portals.conf
• executables under /usr/share/xdg-desktop-portal-termfilechooser/

Changes to the config above requires restarting the services:

systemctl --user restart xdg-desktop-portal-termfilechooser.service
systemctl --user restart xdg-desktop-portal.service

With Firefox this about:config setting needs to be set: widget.use-xdg-desktop-portal.file-picker to 1 to use the XDG file picker

[kmk3]

GitHub Discussions has a poor UX for triaging bugs.

Also, basic debugging information is missing.

Please use the following link to report a bug and follow the template:

• https://github.com/netblue30/firejail/issues/new?template=bug_report.md

Edit: Moved to:

• firefox: file picker is not sandboxed #6927