How to permanently open browsers in firejail?

Question

I've edited /usr/share/applications/firefox.desktop in the past to use firejail when running firefox, but it seems like this was removed during an update.

How can I permanently open browsers in Firefox without needing to update .desktop files whenever they're updated?

.desktop files in ~/.local/share/applications

These files still exist, they're unchanged from when I created them months ago. The system just isn't picking them up for some reason, and seems to be prioritising the ones in /usr/share/applications instead.

Some of this is redacted due to extraneous content (language specs, etc).

firefox.desktop

[Desktop Entry]
Version=1.0
Name=Firefox Web Browser
Keywords=Internet;WWW;Browser;Web;Explorer
Exec=firejail firefox %u
Terminal=false
X-MultipleArgs=false
Type=Application
Icon=firefox
Categories=GNOME;GTK;Network;WebBrowser;
MimeType=text/html;text/xml;application/xhtml+xml;application/xml;application/rss+xml;application/rdf+xml;image/gif;image/jpeg;image/png;x-scheme-handler/http;x-scheme-handler/https;x-scheme-handler/ftp;x-scheme-handler/chrome;video/webm;application/x-xpinstall;
StartupNotify=true
Actions=new-window;new-private-window;
[Desktop Action new-window]
Name=Open a New Window
Name[ar]=افتح نافذة جديدة
Exec=firefox -new-window
[Desktop Action new-private-window]
Name=Open a New Private Window
Exec=firefox -private-window

brave-browser.desktop

[Desktop Entry]
Version=1.0
Name=Brave Web Browser
GenericName=Web Browser
# Gnome and KDE 3 uses Comment.
Comment=Access the Internet
Exec=firejail /usr/bin/brave-browser-stable %U
StartupNotify=true
Terminal=false
Icon=brave-browser
Type=Application
Categories=Network;WebBrowser;
MimeType=application/pdf;application/rdf+xml;application/rss+xml;application/xhtml+xml;application/xhtml_xml;application/xml;image/gif;image/jpeg;image/png;image/webp;text/html;text/xml;x-scheme-handler/ftp;x-scheme-handler/http;x-scheme-handler/https;
Actions=new-window;new-private-window;
[Desktop Action new-window]
Name=New Window
Exec=/usr/bin/brave-browser-stable
[Desktop Action new-private-window]
Name=New Incognito Window
Exec=/usr/bin/brave-browser-stable --incognito

.desktop files in /usr/share/applications

They're identical to the ones in ~/.local/share/applications.

I just added firejail to the front of the Exec command in each .desktop file. These commands work fine when manually executed in the terminal.

Further debugging info

I think this may have started happening after I updated from Ubuntu 20.04.1 LTS to Ubuntu 20.04.2 LTS. I'm not sure, though.

I haven't changed anything besides updating system packages with apt. I'm not aware of anything that could've caused this problem.

I know when it's working, because when it is, I can only access the ~/Downloads folder when uploading files in the browser. And if I'm running it from the command line, I'll get output from firejail.

Answer 1

If I understand correctly, you want to open Firefox in a Firejail sandboxed environment every time a web page is opened (by whichever means). How to achieve this will vary depending on the method you use to start firefox:

1. Command line
2. A launcher in dash
3. A launcher in the desktop

For method 1 above, you can set an alias in your ~/.bashrc (assuming you use bash)

alias firefox='firejail firefox'

For method 2 above, the option you posted in the question should work. I suggest you repeat that, and if the change in /usr/share/applications/firefox.desktop you perform is ever reverted, you check the date of the change. Then compare with e.g. less /var/log/apt/history.log what could have been the update that caused the change (sources: 1, 2). You can actually try this in your current state.

You can also create your own .desktop as you mention in your answer. Then drag it to the dash (I am not sure you did that). Same as above, I suggest you repeat the operation, and check whenever this stops working for the possible cause.

---

EDIT

In addition, I suggest you post the following detailed information:

1. The commands you use to verify when "it is working" and "when it is not", and the output that shows it. It is better if you copy this verbatim (instead of "explaining" what you did).
2. The location and full contents of your .desktop files, after you changed them, and after the system changed them.

You did not specify:

1. In your question, what action you performed that reverted your changes in /usr/share/applications/firefox.desktop. "An update" is quite loose... did you update firefox, or some other application?
2. In your answer, what action you performed that made your ~/.local/share/applications/firefox.desktop inoperative. "doesn't seem to have worked long-term" is again loose. Plus, is your .desktop file is still there and with its contents the same as when it worked, but now simply not working? Or was it somehow modified?

Getting your feedback on this will help a lot.

Related:

1. How do I change the launcher commands?

Answer 2

Looks like you can copy the .desktop file from its original location into ~/.local/share/applications and it will use this instead. During updates, your changes won't be overwritten.

Update: this doesn't seem to have worked long-term.

Answer 3

As I know you haven't to do anything because:

$ which firefox
/usr/local/bin/firefox
$ ls -l /usr/local/bin/firefox 
/usr/local/bin/firefox -> /usr/bin/firejail