skypeforlinux: deny access to the Home directory and subfolders

[yderi]

Hello everyone

Currently in use:
firejail version 0.9.66
skypeforlinux version: 8.77
Ubuntu 21.10

Current "skypeforlinux.profile" allows sneaking the Home folder and all other subfolders that are not a system like Video, Pictures, Music etc.
If I comment out the line "ignore whitelist ${DOWNLOADS}" it limits access to Downloads only, but requires authentication every time you quit the Skype.

How to restrict to ~/Downloads only (and other relative stuff that it may require)?

Will appreciate any help on this.

[rusty-snake]

Actually it would be the best if you could try to use (i.e. remove the line) this hole block:

firejail/etc/profile-m-z/skypeforlinux.profile

Lines 8 to 18 in 57b9ff0

	# Disabled until someone reported positive feedback
	ignore whitelist ${DOWNLOADS}
	ignore include whitelist-common.inc
	ignore include whitelist-runuser-common.inc
	ignore include whitelist-usr-share-common.inc
	ignore include whitelist-var-common.inc
	ignore nou2f
	ignore novideo
	ignore private-dev
	ignore dbus-user none
	ignore dbus-system none

• Instead of dbus-user none, use the policy from skypeforlinux - systray icon not shown #4494.
• novideo is oblivious wrong.
• nou2f maybe too.
• Regarding whitelist ${DOWNLODAS}, also use include whitelist-common.inc and follow these steps
  (or just look for ~/.skype*, ~/.config/skype* ...)
  

  firejail/etc/templates/profile.template

  Lines 62 to 73 in 57b9ff0

  	# It is common practice to add files/dirs containing program-specific configuration
  	# (often ${HOME}/PROGRAMNAME or ${HOME}/.config/PROGRAMNAME) into disable-programs.inc
  	# (keep list sorted) and then disable blacklisting below.
  	# One way to retrieve the files a program uses is:
  	# - launch binary with --private naming a sandbox
  	# `firejail --name=test --ignore=private-bin [--profile=PROFILE] --private BINARY`
  	# - work with the program, make some configuration changes and save them, open new documents,
  	# install plugins if they exists, etc.
  	# - join the sandbox with bash:
  	# `firejail --join=test bash`
  	# - look what has changed and use that information to populate blacklist and whitelist sections
  	# `ls -aR`

• wusc (whitelist-usr-share-common) might need whitelist /usr/share/skype or so in addition.