I want to run Firefox fully sandboxed ....No access to even ~/Downloads but with addons

[firejailaddssecuirty]

I want to run Firefox fully sandboxed. No access to even ~/Downloads but with my installed addons like uBlock Origin & Noscript.
I don't want this to be the default configuration. This is for browsing specific websites only.
When I use --private Firefox starts without any addons. How do I do this ?

[rusty-snake]

I want to run Firefox fully sandboxed.

https://www.tecmint.com/install-and-configure-kvm-in-linux/

I don't want this to be the default configuration. This is for browsing specific websites only.

Rethink your thread model. If you use the same firefox profile for the "normal" and the "secure" mode, where's the hole?

No access to even ~/Downloads but with my installed addons like uBlock Origin & Noscript.

firejail --nowhitelist='${DOWNLOADS}' /usr/bin/firefox

[rusty-snake]

You need to specify a existing directory.

[firejailaddssecuirty]

$ pwd
/home/home/.two

$ firejail --private=${HOME}/home/home/.two /usr/bin/firefox
Error: invalid private directory

[rusty-snake]

~/home/home/.two is not a existing directory (or maybe it exists but has wrong permissions).

If you want to use /home/home/.two, then you need to specify it (--private=/home/home/.two).

[firejailaddssecuirty]

firejail --private=/home/home/.two /usr/bin/firefox

^^ This worked but there is one issue. When my regular Firefox is running inside firejail if I use that command its launching the same profile which is already running. I see the same bookmarks & everything else. When I close my regular Firefox window & then use that command I see a brand new profile to which I added uBlock origin. I guess this is limitation of firejail & nothing can be done.

Note that there is no full isolation if with --private from above you can escape the sandbox.

When you have time please explain what you mean by "you can escape the sandbox".

[rusty-snake]

When my regular Firefox is running inside firejail if I use that command its launching the same profile which is already running. I see the same bookmarks & everything else. When I close my regular Firefox window & then use that command I see a brand new profile to which I added uBlock origin. I guess this is limitation of firejail & nothing can be done.

firejail --private=/home/home/.two /usr/bin/firefox --no-remote

When you have time please explain what you mean by "you can escape the sandbox".

If you can execute arbitrary code inside the sandbox, you can (in theory) if a way out of it.
Since I (and others) already wrote about this multiple times, here are a few links:

• Firejail safe enough to deliberately execute malware ? #3082
• Email part (2) #3849 (comment)
• "Warning: cannot find /var/run/utmp" but looks for "/dev/null/utmp" instead #4210 (comment)
• [Question] SkypeforLinux - or General .deb Security #3527 (comment)
• Does firejail worsen security? #3046