Is it possible to start off testing with absolutely no restrictions whatsoever?

[Babber]

Hi,
I am relatively new to Firejail.

I was considering setting up a profile for the file manager I use: Double Commander. I wanted to start with a blank sheet that is no restrictions and then more or less guided by file-manager-common.profile I planned to gradually add more and more to test what restrictions I can live with. Right at the beginning however, I bumped into an issue: how do I even start with no restrictions? Because apparently firejail --noprofile doublecmd still imposes some. The program already looks different if I start it this way (as opposed to doublecmd), and in the terminal, I can see e.g. the error message Error: pixmap [/usr/lib/doublecmd/doublecmd] not loaded!

So my question#1: is it possible to start something within a completely unrestricted sandbox, where is should function just like out in the wild, without Firejail? If it is possible, how to do it? If not, how do I know, what exact restrictions are imposed if I start something as firejail --noprofile doublecmd? Where is it set or documented?

Related question#2: under what exact circumstances are the settings in /etc/firejail/firejail.config applied? Because when I started firejail --noprofile doublecmd and tested it with sudo jailcheck, I got the warnings AppArmor not enabled and seccomp not enabled even though in the above config file both features are explicitly enabled.

Your help is much appreciated, many thanks in advance!

[rusty-snake]

1. There will always be restriction. Be it with --noprofile or --profile=noprofile (even less, contains useful comments).
2. There are are lot of different options in there with different semantics. For AA and seccomp they just say whether these "firejail modules" _{technically incorrect but for understanding} are loaded by firejail and commands like --seccomp can be used.

completely unrestricted sandbox

😆

[Babber]

Thanks for the extremely rapid response! 👍

Just out of academic curiosity (because of the amusement over my "completely unrestricted sandbox" ;-) Is it not possible to set up the framework or infrastructure of a sandbox but with so-to-speak all the shields down? Where everything or most things are already in place just not turned on? After all, --noprofile and --profile=noprofile are fairly close, aren't they? Granted, I still have quite a naive picture about how all this works, but I am willing to learn. :)

[rusty-snake]

Just out of academic curiosity

Depends on how long you are willing to call it sandbox.
If you have a runtime component like flatpak/podman you can setup this runtime without adding security restrictions such as seccomp. However some things (e.g. mount namespace) have to be restricted in order to setup all this.
If you have a wrapper sandbox for host programs like firejail, you can bring it down to the equivalent of bash -c program. But is this a "sandbox".

After all, --noprofile and --profile=noprofile are fairly close, aren't they?

I guess unshared pid-namespace and possible NNP are the biggest parts of restricting actions.

[Babber]

Alright, I see.
Thank you for your time!