Sandboxing Chromium Snap without FireJail
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
chromium-browser (Ubuntu) |
Triaged
|
Low
|
Unassigned |
Bug Description
I'm a Firefox user who uses Chromium for certain google websites.
I like to run Chromium in a sandbox so that the "Downloads" folder is the only file system location Chromium can see.
In Ubuntu 19.04, I could achieve this with:
sudo apt install chromium-browser firejail ; firejail chromium-browser
In Ubuntu 19.10, Chromium is only offered as a snap package:
https:/
Firejail, doesn't work with Chromium's snap package installation:
https:/
The snap installation's degree of isolation seems to be controlled by the developer of snap package.
Since firejail no longer works for achieving this degree of isolation, I'm requesting that the Snap Package Maintainer (of Chromium), provide an alternative installation that only gives Chromium access to the "Downloads" folder exclusively.
ProblemType: Bug
DistroRelease: Ubuntu 19.10
Package: chromium-browser (not installed)
ProcVersionSign
Uname: Linux 5.3.0-13-generic x86_64
NonfreeKernelMo
ApportVersion: 2.20.11-0ubuntu7
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Mon Oct 7 08:15:38 2019
InstallationDate: Installed on 2019-10-06 (0 days ago)
InstallationMedia: Ubuntu 19.10 "Eoan Ermine" - Beta amd64 (20191001.2)
ProcEnviron:
TERM=xterm-
PATH=(custom, no user)
XDG_RUNTIME_
LANG=en_US.UTF-8
SHELL=/bin/bash
SourcePackage: chromium-browser
UpgradeStatus: No upgrade log present (probably fresh install)
As suggested by user ajgringo619 on askubuntu, disconnecting the home interface would get you close to what you're after. However to my knowledge there's no way to selectively connect certain folders in the home directory, such as ~/Downloads.
Note that if you disconnect the home interface, you will need to tell chromium where to store downloaded files, by configuring this in chrome: //settings/ downloads.