Has anyone managed to get Firejail / Firefox KeepassXC browser integration working?

Nathan · October 31, 2022, 7:23pm

I feel like I’ve tried absolutely everything; every option in the firefox.profile config, every suggestion on github & stack exchange, even a custom config directory in KeepassXC, but nothing I try seems to enable the KeepassXC extension in firejailed firefox to connect to my KeepassXC database. I am also using GTK_USE_PORTAL=1, if that matters.

I switched to EndeavourOS recently from Manjaro; my config there worked perfectly, but I managed to lose it while distro-hopping, and I’m sure I’ve tried everything contained in it anyway.

All suggestions are welcome; I’m truly at a loss here. This is my firefox.local:

# Enable KeepassXC plugin support
whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer
whitelist ${RUNUSER}/kpxc_server

mkfile ${HOME}/.config/mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json
whitelist ${HOME}/.config/mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json

noblacklist ${HOME}/.config/mozilla
whitelist ${HOME}/.config/mozilla

# Enable private bin on Arch
private-bin bash,dbus-launch,dbus-send,env,firefox,sh,which,keepassxc-proxy

# Enable private-etc support
private-etc firefox

# Enable native notifications
dbus-user.talk org.freedesktop.Notifications

# Allow inhibiting screensavers
dbus-user.talk org.freedesktop.ScreenSaver

# Enable plasma browser integration
dbus-user.own org.mpris.MediaPlayer2.plasma-browser-integration
dbus-user.talk org.kde.JobViewServer
dbus-user.talk org.kde.kuiserver

# Enable screen sharing under wayland
dbus-user.talk org.freedesktop.portal.Desktop

# Uncomment the following line if screensharing isn't working
# ignore noroot

# Enable saving to / uploading from desktop
noblacklist ${HOME}/Desktop
whitelist ${HOME}/Desktop

Also, echo $RUNUSER returns nothing, which I think may be related, but I don’t know what this environment variable is / does.

badplugin · October 31, 2022, 8:03pm

I don’t use firefox atm, but this thread may help you :

github.com/netblue30/firejail

KeepassXC browser integration with Firefox on Manjaro not working correctly even with fixes from #3952

opened 03:12PM - 14 May 21 UTC

closed 01:56PM - 15 May 21 UTC

bardacuda

``` $ firejail --version firejail version 0.9.64.4 ``` ``` $ cat /etc/*-rel…ease Manjaro Linux DISTRIB_ID=ManjaroLinux DISTRIB_RELEASE=21.0.4 DISTRIB_CODENAME=Ornara DISTRIB_DESCRIPTION="Manjaro Linux" Manjaro Linux NAME="Manjaro Linux" ID=manjaro ID_LIKE=arch BUILD_ID=rolling PRETTY_NAME="Manjaro Linux" ANSI_COLOR="32;1;24;144;200" HOME_URL="https://manjaro.org/" DOCUMENTATION_URL="https://wiki.manjaro.org/" SUPPORT_URL="https://manjaro.org/" BUG_REPORT_URL="https://bugs.manjaro.org/" LOGO=manjarolinux ``` ``` $ hostnamectl | grep 'Operating System' -A 2 Operating System: Manjaro Linux Kernel: Linux 5.12.1-2-MANJARO Architecture: x86-64 ``` ``` $ cat /proc/version Linux version 5.12.1-2-MANJARO (builduser@LEGION) (gcc (GCC) 10.2.0, GNU ld (GNU Binutils) 2.36.1) #1 SMP PREEMPT Sun May 2 13:56:40 UTC 2021 ``` The browser integration broke 2 or 3 months ago. ~~The issue is still present when running `firejail --noprofile firefox`~~ The issue isn't present when running `firejail --noprofile firefox` I did not try disabling various options in `/etc/firejail/firefox.profile` as I don't really know what I'm doing and don't want to break things further. What I did to was add this line to my `/etc/firejail/firefox.local` file `whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer` This restored partial functionality, where if keepassxc was running before starting firefox, then communication/key exchange between the two will work as expected. However, if firefox was running first (the more common scenario for me; as I tend to keep my browser open; but close keepass, and unmount the drive the database is stored on when I'm not using it), then no communication/key exchange is possible. I have also tried adding the following two lines to my `/etc/firejail/firefox.local` as seems to be suggested in https://github.com/netblue30/firejail/issues/3952 (although I'm not clear if `firefox.local` is the file I'm supposed to be adding those lines to): `private-bin bash,dbus-launch,dbus-send,env,firefox,sh,which,keepassxc-proxy` `ignore include whitelist-runuser-common.inc` Doing so does not allow key exchange to work when firefox was running before starting keepassxc. Currently I have those 2 lines commented out though, and I'm at a loss for what to try next. When running firefox outside of firejail the keepassxc browser integration works as intended.

anon11595408 · October 31, 2022, 9:34pm

A contradiction where adjective contradicts its noun (e.g., a square triangle).

Nathan · October 31, 2022, 9:36pm

Cheers, that gave me a few things to try, but no luck unfortunately.

anon11595408 · October 31, 2022, 9:38pm

Why would you be running firejail? It shouldn’t be a problem without it. Ever thought of using apparmor instead?
The idea of firejail is strict sandboxing of apps, such as firefox. Wanting to open this sandbox seems a bit awkward to me in your use-case, and in general.

Nathan · October 31, 2022, 10:00pm

I just like to increase security where I can, so I’ve been running a sandboxed browser for some time now; it just seems like a a good idea. I haven’t looked into configuring apparmor, but firejail has settings in the default firefox profile that (usually) make this a fairly simple process, while preserving the integrity of the sandbox as much as possible.

anon11595408 · October 31, 2022, 10:29pm

If you’re interested in security, it may not be a good idea to share clipboard contents of passwords between apps in general. If a password managing app stores passwords (hopefully encrypted) on your local drive, there are multiple caveats and steps involved to enable your firefox firejail profile to let it communicate around the sandbox. This is named as “creating overrides”, and I guess your endeavour is more easily helped by creating an issue on the firejail-page, since the web seems to be full of questions, the same as yours.

Nathan · October 31, 2022, 10:55pm

This is a compromise between usability and security that I like, understand the implications of, and will continue to employ.

I am aware that others have asked similar questions; I have done a search myself, and gone through every solution I could find. I asked here because this set up worked well on Manjaro; I thought that perhaps there was something EOS-specific that someone might know about.

I had also heard about the friendly EOS community; had I known to expect to be given a lecture on my use-case and sent away with a LMGTFY, I may have reconsidered posting here.

anon11595408 · October 31, 2022, 11:01pm

Without any expectations, you can’t be disappointed, the wise ones keep saying. Your demeanor tells us quite a different story.

I tried to be friendly and helpful to you by responding to what you asked, the way you asked, considering the infos you gave.

If you want to appear unfriendly the way you clearly and openly do, just disregard my postings in response to your apparently flawed reasoning and have a nice one!