[SOLVED] firejail fails with --net

[dpaddy]

I tried to follow https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Sandboxing_the_Firefox_Browser_with_Firejail#setup_networking_openrc but when executing

[Hu]

What is the output of emerge --verbose --info sys-apps/firejail? As I read the equery use output, your results would be expected if you built with USE=network-restricted.

For search, I often see people suggest using a search engine (such as Google or DuckDuckGo) with a site-qualifier site:forums.gentoo.org to restrict the results to only this domain.

[dpaddy]

Yes that flag was set (these tired old eyes are nearly useless).

Much appreciated

[Hu]

In fairness to your eyesight, it would be nice if the error message (Error: only --net=none is allowed to non-root users) had mentioned that the restriction is compile-time configurable. As currently phrased, it sounds like this is a hard technical limitation that would require source code improvements to fix. In truth, it's a policy decision that is set at compile-time. Perhaps if it had said Error: this build of Firejail only allows non-root users to set --net=none or to omit --net. To allow non-root users to use other forms of --net, rebuild Firejail without the configure flag --enable-network=restricted., you would have gone looking and found the answer without a forum post.

If you have a good way to report an issue to the Firejail developer, you might be able to save other people from this problem by asking the developer to improve the message. I am obviously partial to the phrasing I proposed above, but anything that clearly tells the user that this is a compile-time policy would be a nice improvement.