How to run a flatpak in firejail? [answer: you can not do this]

[tredondo]

I've installed QBittorrent via KDE's Discover, and it created a menu item with this command:

/usr/bin/flatpak run --branch=stable --arch=x86_64 --command=qbittorrent --file-forwarding org.qbittorrent.qBittorrent @@u %U @@

Should I force the qbittorrent.profile by prefixing that command with firejail --profile=bittorrent [/usr/bin/flatpak run ...]? Or should I use a flatpak profile (I don't see one in the repo, even though flatpak is popular), since this answer advised using the Electron profile for video editing Electron app, instead of a profile for similar video apps?

Or should I not bother, because Flatpak already does its own sandboxing, and it sufficient (hence no predefined flatpak.profile)?

[rusty-snake]

You can not firejail a flatpak.

Bubblewrap (the tool used by flatpak for sandboxing) does not work well/at all (depending on multiple conditions) inside firejail.

Flatpaks have its own sandbox, tweak this if necessary.
Usefull commands:

• flatpak info --show-metadata <APP-ID>
• flatpak info --show-permissions <APP-ID>
• flatpak override --user <OPTIONS> <APP-ID>

[tredondo]

$ flatpak info --show-permissions org.qbittorrent.qBittorrent
[Context]
shared=network;ipc;
sockets=x11;wayland;
devices=dri;
filesystems=xdg-config/kdeglobals:ro;host;

[Session Bus Policy]
com.canonical.AppMenu.Registrar=talk
org.kde.StatusNotifierWatcher=talk
org.freedesktop.Notifications=talk
org.gnome.SessionManager=talk
org.kde.StatusNotifierItem-2-2=own
org.freedesktop.PowerManagement=talk

[Environment]
TMPDIR=/var/tmp

filesystems=host means qBittorrent can access normal files on the host. Not good.

I've run sudo flatpak override --nofilesystem=host --filesystem=xdg-download org.qbittorrent.qBittorrent and now flatpak info --show-permissions shows

filesystems=xdg-download;xdg-config/kdeglobals:ro;!host;

But, I was still able to click "Open" and load a .torrent file from ~/.ssh. On the other hand, I could only select the Downloads directory as the save path, but that dialog is frozen so I'm not quite sure what's going on.

[rusty-snake]

filesystems=xdg-download;xdg-config/kdeglobals:ro;!host;

But, I was still able to click "Open" and load a .torrent file from ~/.ssh.

Is this a dialog from qBittorrent or from the portal?

Opening files with a native file chooser dialog

(https://docs.flatpak.org/en/latest/sandbox-permissions.html#portals)