What is fireurl?

[colons]

I think it'd be nice to have at least a sentence at the top of the readme that says, in brief, what this project is trying to do.

In netblue30/firejail#5364, you discuss what 'Level 0' and 'Level 1' are specifically (although it does not define 'unlocked'). Levels 2 and 3 are links to things that have a readme and comment that explain what they do pretty thoroughly. But here, there's a readme that just says 'Fixing the firejail URL open issue.', and then talks about how to build it and some implementation details. It takes some digging to learn what 'the firejail URL open issue' even is.

Maybe I'm missing something obvious here, but I don't know how to learn what fireurl actually is. What are its design goals, what is its security model, and how does it present itself to users?

[4parthy]

I agree the Readme is lacking but I guess fireurl is a kinda still in a concept state I think.
Nevertheless it is really useful already and I wouldn't want to miss it anymore, so I'd like to share my very limited knowledge.

Opening a link/url from a firejailed app opens a new browser instance in that same firejail. So we get a new browser instance for every fairejailed app we open urls in.

Fireurl makes it possible to open urls from firejailed application in the same browser instance in its own jail.

The fireurl client opens urls with $FIREURL_BROWSER for regular apps and for firejailed apps it passes the url to the fireurl daemon via socket, which then in turn is able to open the url with $FIREURLD_BROWSER since the daemon is not running in a firejail itself.

That way if FIREURL_BROWSER=firefox, FIREURLD_BROWSER=firefox and firefox is set to run through firejail by default, the url will be opened in the same firefox instance in its own firejail which might as well be already running.

This really only works if you configure firejailed apps to use fireurl to open urls.

For that I set env BROWSER=fireurl in ~/.config/firejail/globals.local and hope some firejailed apps will respect that.

Some profiles require to whitelist the socket like this whitelist ${RUNUSER}/fireurl for fireurl to work.

Many apps use xdg-open by default to open urls in their default app.
So I create a link for xdg-open to fireurl in a folder I can prepend to the PATH environment variable: ln -s /usr/bin/fireurl /usr/local/share/fireurl/bin/xdg-open. Then by setting env PATH=/usr/local/share/fireurl/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/bin in my globals.local, these apps will use fireurl through the xdg-open link instead to pass the url out of their jail to the daemon.

To makes this really convenient, I set FIREURL_BROWSER=/usr/bin/xdg-open, FIREURLD_BROWSER=/usr/bin/xdg-open so in the end the real xdg-open gets called by the daemon. This way xdg-open will not only open http(s) urls in my default browser, it will also handle app urls like steam://open/console for example and open them in a firejailed steam client for example.

Passing urls out to xdg-open is potentially really dangerous for apps you trust as much that you run them in firejail, so I cant really recommend doing this.

I learned all this from the code and tinkering around with firejail and fireurl.
Can't say much about the security model, apart from urls going through validation before they get opened in the console app and the daemon.

About how it presents itself to the user, at best fireurl won't and will just open urls seamlessly in the configured app. Although, there is text output for the console app and the daemon.

I hope my perspective can help with understanding what fireurl is trying to archive and I hope that this project will mature with time and maybe even get merged into the main firejail project, since it makes firejail much more usable.

[m2neral]

@4parthy I'm trying to use this with discord-canary atm. After setting env BROWSER=fireurl I get /usr/local/bin/xdg-open: line 1045: fireurl: command not found. After setting whitelist ${RUNUSER}/fireurl there's no audio in discord. If I instead set private-bin fireurl I get ERROR: Failed to send url: No such file or directory (os error 2). Do you have any ideas for how I could fix this?

[rusty-snake]

@m2neral Moved to #17