Fixing applications opening other applications

[gcb]

Can i have applications that open other applications work with firejail?

for example, gimp print preview opens /usr/share/applications/okularApplication_pdf.desktop which have the line Exec=okular %U yet firejail --list do not list that okular started it's firejail'ed instance.

$ firejail --list
1629:gcb::/usr/bin/firejail /usr/bin/firefox 
12657:gcb::/usr/bin/firejail /usr/bin/gimp-2.10

and i get "Configuration file "/home/gcb/.config/okularrc" not writable. Please contact your system administrator." Because I assume okular just started in the gimp profile?

having the Exec without a path should be all that is needed right? that's what firecfg --fix do?

[rusty-snake]

Can i have applications that open other applications work with firejail?

There is no profile transition feature. However, you can create a profile that works with both applications (at the cost of using a "lowest common denominator" approach, I.e. if one needs a permission both get it because they share the same sandbox).

[gcb]

I assumed because it's suid it could fork the /usr/bin/ call into another sandbox even from within one.

I see. the common denominator approach makes sense.