sudo add-apt-repository ppa:deki/firejail
sudo apt-get update
sudo apt-get install firejail firejail-profiles

sudo apt-get update -qy
sudo apt-get install -qy \
  git build-essential fakeroot lintian libapparmor-dev pkg-config gawk
git clone 'https://github.com/netblue30/firejail.git' &&
cd firejail &&
./configure &&
make dist &&
./mkdeb.sh &&
sudo dpkg -i ./*.deb &&
make installcheck

sudo dnf update -y
sudo dnf install -y rpm-build gcc make
git clone 'https://github.com/netblue30/firejail.git' &&
cd firejail &&
./configure &&
make dist &&
./platform/rpm/mkrpm.sh &&
sudo rpm -i ./*.rpm &&
make installcheck

git clone 'https://github.com/netblue30/firejail.git' &&
cd firejail &&
./configure &&
make -j "$(nproc)" &&
sudo make install-strip &&
make installcheck

sudo apt-get install git build-essential libapparmor-dev pkg-config gawk

firejail /usr/bin/firefox            # starting Mozilla Firefox
firejail /usr/bin/transmission-gtk   # starting Transmission BitTorrent
firejail /usr/bin/vlc                # starting VideoLAN Client
sudo firejail /etc/init.d/nginx start

$ firejail --list
1617:netblue:/usr/bin/firejail /usr/bin/firefox-esr
7719:netblue:/usr/bin/firejail /usr/bin/transmission-qt
7779:netblue:/usr/bin/firejail /usr/bin/galculator
7874:netblue:/usr/bin/firejail /usr/bin/vlc --started-from-file file:///home/netblue/firejail-whitelist.mp4
7916:netblue:firejail --list

firecfg --fix-sound
sudo firecfg

Applications that use glycin 2.0.0 or later via gdk-pixbuf2
(examples: Firefox, Thunderbird, GIMP) crash.

The library glycin provides a set of "safe" image format loaders
to gdk-pixbuf2, another library which is widely used in GTK-based
applications for loading images.

As of gdk-pixbuf2 2.44.1, the calls to glycin loaders are wrapped in
bubblewrap.

      --profile=filename|appname
              Load a custom security profile from filename, or use the name  of
              a specific application.

              If  the  command  line option --profile is not provided, Firejail
              will attempt to extract the appname from the target program file‐
              name. It will then  search  ~/.config/firejail  directory  for  a
              suitable  profile,  followed  by a search in /etc/firejail/direc‐
              tory.

              Example:
              $ firejail firefox
              Reading profile /home/netblue/.config/firejail/firefox.profile
              Reading profile /etc/firejail/firefox.profile
              Reading profile /etc/firejail/firefox-common.profile
              [...]

              When using a filename, please include a full path or  a  relative
              path.

              $ firejail --profile=./firefox.profile firefox
              Reading profile ./firefox.profile
              Reading profile /etc/firejail/firefox.profile
              Reading profile /etc/firejail/firefox-common.profile
              [...]

              --profile=appname comes in handy when running appimages:

              $      firejail     --appimage     --profile=firefox     firefox-
              nightly-148.0.r20260103-x86_64.AppImage
              Reading profile /home/netblue/.config/firejail/firefox.profile
              Reading profile /etc/firejail/firefox.profile
              Reading profile /etc/firejail/firefox-common.profile
              [...]

              See man 5 firejail-profile for profile file  syntax  information.
              For   profile  resolution   details  see  https://github.com/net‐
              blue30/firejail/wiki/Creating-Profiles.

      --unhide-pid1
              Pid  1  is always present inside Firejail sandbox. By restricting
              access to /proc kernel interface, general tools like ps  are  un‐
              able to view and access  this process.  --unhide-pid1 option dis‐
              ables this functionality. Example:

              $ firejail --name=test    ### by default pid 1 is not visible
              [...]
              Child process initialized in 59.41 ms
              $  ps a
                  PID TTY      STAT   TIME COMMAND
                    4 ?        S      0:00 /bin/bash
                    5 ?        R+     0:00 ps a
              $ exit
              Parent is shutting down, bye…

              $ firejail --name=test --unhide-pid1  ### pid 1 is visible
              [...]
              Child process initialized in 58.29 ms
              $ ps a
                 PID TTY      STAT   TIME COMMAND
                    1 ?        S      0:00 firejail --name=test --unhide-pid1
                    4 ?        S      0:00 /bin/bash
                    6 ?        R+     0:00 ps a
              $ exit
              Parent is shutting down, bye…

       --keep-hostname
              By default, the hostname is replaced by a random  name  generated
              by firejail at startup. Use this option to disable this feature.

              Example:
              $ firejail --keep-hostname

LANDLOCK
       Landlock is a Linux security module first introduced in version 5.13 of
       the  Linux  kernel.  It allows unprivileged processes to restrict their
       access to the filesystem.  Once imposed, these restrictions  can  never
       be  removed,  and  all child processes created by a Landlock-restricted
       processes inherit these restrictions.  Firejail supports Landlock as an
       additional  sandboxing  feature.  It can be used to ensure that a sand‐
       boxed application can only access files and directories that it was ex‐
       plicitly  allowed  to access.  Firejail supports populating the ruleset
       with both a basic set of rules (see --landlock) and with a  custom  set
       of rules.

       Important notes:

              - A process can install a Landlock ruleset only if it has either
              CAP_SYS_ADMIN in its effective capability set, or  the  "No  New
              Privileges"  restriction enabled.  Because of this, enabling the
              Landlock feature will also cause Firejail to enable the "No  New
              Privileges"  restriction,  regardless  of  the  profile  or  the
              --nonewprivs command line option.

              - Access to the /proc directory is managed through  the  --land‐
              lock.proc command line option.

              -  Access  to  the  /etc directory is automatically allowed.  To
              override this, use the --writable-etc command line option.   You
              can  also use the --private-etc option to restrict access to the
              /etc directory.

       To enable Landlock self-restriction on top of your current Firejail se‐
       curity  features,  pass  --landlock flag to Firejail command line.  You
       can also use --landlock.read, --landlock.write, --landlock.special  and
       --landlock.execute  options  together with --landlock or instead of it.
       Example:

       $ firejail --landlock --landlock.read=/media --landlock.proc=ro /usr/bin/mc

$ /usr/lib/firejail/profstats /etc/firejail/*.profile
No include .local found in /etc/firejail/noprofile.profile
Warning: multiple caps in /etc/firejail/tidal-hifi.profile
Warning: multiple caps in /etc/firejail/tqemu.profile
Warning: multiple caps in /etc/firejail/transmission-daemon.profile
Warning: multiple caps in /etc/firejail/trivalent.profile

Stats:
    profiles			1336
    include local profile	1335   (include profile-name.local)
    include globals		1301   (include globals.local)
    blacklist ~/.ssh		1195   (include disable-common.inc)
    seccomp			1207
    capabilities		1329
    noexec			1208   (include disable-exec.inc)
    noroot			1099
    memory-deny-write-execute	321
    restrict-namespaces		1045
    apparmor			860
    private-bin			814
    private-dev			1169
    private-etc			837
    private-cache		861
    private-lib			86
    private-tmp			1030
    whitelist home directory	656
    whitelist var		969   (include whitelist-var-common.inc)
    whitelist run/user		1299   (include whitelist-runuser-common.inc
					or blacklist ${RUNUSER})
    whitelist usr/share		755   (include whitelist-usr-share-common.inc
    net none			452
    dbus-user none 		761
    dbus-user filter 		202
    dbus-system none 		964
    dbus-system filter 		13