Easy way to transfer files from temporary sandboxed ~/Download directory?

[enoryw]

I often run temporary sandboxed (--private) instances of Firefox in quick one-off workflows in addition to your normal persistent sandboxed Firefox instances.

However, retrieving downloaded files is a pain--the process is like this: firejail --list, look for the id (often times you have to guess, if there are several involved), then firejail --get=<id> ~/Downloads/<this is the most annoying part> where <this is the most annoying part> is the part you have to type out manually because wildcards or tab completion isn't supported. If the filename you downloaded on the browser is something like "fQiY3jq8Cs9m-3940132471.pdf", it seems you have to manually read and type all that out and hope there isn't a typo.

Am I missing something? Can this be automated/scripted to make it a more seamless process? IIRC, downloaded files in a --private instance aren't directly accessible by your filesystem so I can't just go there and mv it for retrieval.

Much appreciated.

Relates to:

• firejail download folder #6090

[rusty-snake]

often times you have to guess, if there are several involved

Start them like firejail --private --name=umbrella /usr/bin/firefox.

firejail --ls=<name|pid> ~/Downloads and then double-click+middle-click the filename.
You cpuld even parse firejail --ls=<name|pid> in a custom bash-completions script.

Can this be automated/scripted to make it a more seamless process?

Yes (click me)

#!/bin/bash

# SPDX-License-Identifier: ISC

# Copyright © 2021 rusty-snake
#
# Permission to use, copy, modify, and/or distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
# AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
# OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE

get_sandbox() {
	local radiolist=(--radiolist "firejail --list" 0 0 0)
	while read -r sandbox; do
		radiolist+=("${sandbox%%:*}" "${sandbox#*:}" off)
	done < <(firejail --list)
	# FIXME: reject empty selection
	SBOXPID=$(dialog "${radiolist[@]}" 2>&1 >/dev/tty)
}

list_files() {
	local checklist=(--checklist "ls ~/Downloads" 0 0 0)
	while read -r file; do
		[[ $file == . || $file == .. ]] && continue
		checklist+=("$file" "" on)
	# FIXME: Handle --ls failures (e.g. EACESS)
	done < <(firejail --ls="$SBOXPID" ~/Downloads | awk '{ print $5 }')
	# FIXME: What the hell!!!
	eval "SELECTED_FILES=($(dialog "${checklist[@]}" 2>&1 >/dev/tty))"
}

get_files() {
	for file in "${SELECTED_FILES[@]}"; do
		firejail --get="$SBOXPID" "$HOME/Downloads/$file"
	done
}

get_sandbox
list_files
get_files

IIRC, downloaded files in a --private instance aren't directly accessible by your filesystem so I can't just go there and mv it for retrieval.

root can: sudo ls /proc/<child pid>/root/$HOME
note: <child pid> is the pid of the process running in the sandbox not firejail. Get it from firejail --tree.

[rusty-snake]

Ok, here's a second one, this time with zenity.

click me

#!/bin/bash

# SPDX-License-Identifier: ISC

# Copyright © 2021 rusty-snake
#
# Permission to use, copy, modify, and/or distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
# AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
# OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE

radiolist=(--list --radiolist --column "" --column "pid" --column "firejail --list")
while read -r sandbox; do
	radiolist+=(FALSE "${sandbox%%:*}" "${sandbox#*:}")
done < <(firejail --list)
SBOXPID=$(zenity "${radiolist[@]}")

while read -r file; do
	firejail --get="$SBOXPID" "$file"
done < <(
	firejail --join="$SBOXPID" /proc/self/fd/3 \
		--file-selection \
		--filename=~/ \
		--multiple \
		--separator=$'\n' \
		3</usr/bin/zenity 2>/dev/null
	)

[kmk3]

@enoryw on Dec 7:

I often run temporary sandboxed (--private) instances of Firefox in quick
one-off workflows in addition to your normal persistent sandboxed Firefox
instances.

However, retrieving downloaded files is a pain--the process is like this:
firejail --list, look for the id (often times you have to guess, if there
are several involved), then firejail --get=<id> ~/Downloads/<this is the most annoying part> where <this is the most annoying part> is the part you
have to type out manually because wildcards or tab completion isn't
supported. If the filename you downloaded on the browser is something like
"fQiY3jq8Cs9m-3940132471.pdf", it seems you have to manually read and type
all that out and hope there isn't a typo.

As @rusty-snake mentioned, instead of trying to find its id, you can give
the sandbox instance a name with --name:

firejail --name=firefox1 --private firefox
# on another shell/terminal
firejail --get=firefox1 ~/Downloads/foo.pdf

because wildcards or tab completion isn't supported

In this case, it's probably simpler to just join the sandbox and use shell
commands:

firejail --name=firefox1 --private firefox
# on another shell/terminal
firejail --quiet --profile=tar --join=firefox1 sh -c \
  'cd ~/Downloads && tar c ./*.pdf' | tar x

The above should copy all pdf files in ~/Downloads to the current directory.
Note that there may be issues with shell wildcards if e.g.: a filename has
spaces in it, so it's probably safer to just copy all files in the directory:

firejail --quiet --profile=tar --join=firefox1 sh -c \
  'cd ~/Downloads && tar c .' | tar x

Or to copy the directory itself:

firejail --quiet --join=firefox1 tar c Downloads | tar x

Note: The first tar above runs inside the sandbox and the second one runs
outside of it.

[glitsj16]

@rusty-snake @kmk3 Maybe we could look into adding/coding a new option for this use-case, e.g. --private-transfer, which automagically transfers out all files in ~/Downloads (and only those) prior to discarding all modifications on sandbox closure.

[rusty-snake]

Maybe just bind mount a folder inside --private like --shared-folder=~/Downloads or --share=~/Downloads:~/Downlodas/private-sandbox-foo.

[kmk3]

@glitsj16 on Dec 7:

@rusty-snake @kmk3 Maybe we could look into adding/coding a new option for
this use-case, e.g. --private-transfer, which automagically transfers out
all files in ~/Downloads (and only those) prior to discarding all
modifications on sandbox closure.

Sounds interesting, though considering that it would only happen after closing
the program, this could be affected by data loss if the sandbox is terminated
before firejail has a chance to transfer things (e.g.: computer crash).

@rusty-snake on Dec 7:

Maybe just bind mount a folder inside --private like
--shared-folder=~/Downloads or
--share=~/Downloads:~/Downlodas/private-sandbox-foo.

I like how simple and flexible this is and that it's similar to Virtualbox
shared folders. However, I think that allowing arbitrary paths to be specified
on the mount source and destination (even if intended to only allow paths from
${HOME}) may be a bit too risky.

Since we are only talking about the Downloads dir and considering that similar
functionality already exists for other directories in ${HOME} (like
private-cache) and that there is private DIR, how about adding a
private-downloads DIR command? Example:

private-downloads ${HOME}/Downloads/foo

It would persist the changes normally like any other directory and could work
like a standard shared folder path to/from the sandbox.

Though one concern would be that it might complicate the code of private DIR.

And another would be that profiles which allow access to other common user
paths (e.g.: Music) but not Downloads might require additional commands. Maybe
it could also imply noblacklist ${HOME}/Downloads or something like that.

[glitsj16]

@kmk3 I really like your private-downloads idea, pretty straightforward to grasp from a user standpoint.