updating firejail execution to have parity with bubblewrap

Author: leafo

README.md

@@ -32,7 +32,7 @@ Three sandbox backends are supported. `GetRunner()` selects one automatically wh
 
 2. **Bubblewrap** — chosen when `BubblewrapParams.BinaryPath` is set (and not inside a Flatpak). Uses [bubblewrap](https://github.com/containers/bubblewrap) to create a lightweight user-namespace sandbox. Mounts system directories read-only, bind-mounts the game's install folder read-write, and forwards display/audio sockets (X11, Wayland, PulseAudio, PipeWire). Namespace isolation covers user, PID, and UTS; IPC stays shared for X11 MIT-SHM compatibility. Network access is shared by default, with optional isolation via `BubblewrapParams.NoNetwork`.
 
-3. **Firejail** — the fallback when neither of the above apply. Uses [firejail](https://firejail.wordpress.com/) with a generated profile at `{InstallFolder}/.itch/isolate-app.profile` that blacklists sensitive directories and whitelists the game's install folder and temp directory. Per-game local overrides can be placed in `/etc/firejail/` (e.g. `itch_game_{name}.local`), and a global override file `itch_games_globals.local` is also included if present.
+3. **Firejail** — the fallback when neither of the above apply. Uses [firejail](https://firejail.wordpress.com/) with a generated profile at `{InstallFolder}/.itch/isolate-app.profile` that blacklists sensitive directories and whitelists the game's install folder and temp directory. Environment forwarding follows the same allowlist baseline as bubblewrap (including itch launch vars and temp vars), and network access can be disabled with `FirejailParams.NoNetwork`. Per-game local overrides can be placed in `/etc/firejail/` (e.g. `itch_game_{name}.local`), and a global override file `itch_games_globals.local` is also included if present.
 
 Selection priority: **Flatpak-spawn > Bubblewrap > Firejail**.
 

runner/bubblewrap_linux.go

@@ -194,14 +194,7 @@ func (br *bubblewrapRunner) Run() error {
 	args = append(args, "--clearenv")
 
 	// Environment passthrough
-	envVarsToForward := []string{
-		"DISPLAY", "XAUTHORITY", "WAYLAND_DISPLAY", "XDG_RUNTIME_DIR",
-		"PULSE_SERVER", "DBUS_SESSION_BUS_ADDRESS",
-		"HOME", "USER", "LANG", "PATH",
-		"TMP", "TEMP", "TMPDIR",
-	}
-	envVarsToForward = append(envVarsToForward, ItchioLaunchEnvVars...)
-	for _, key := range envVarsToForward {
+	for _, key := range SandboxEnvAllowlist() {
 		if val := envLookup(params.Env, key); val != "" {
 			args = append(args, "--setenv", key, val)
 		} else if val := os.Getenv(key); val != "" {

runner/env_allowlist_linux.go

@@ -0,0 +1,42 @@
+//go:build linux
+
+package runner
+
+// BaseSandboxEnvVars are platform/session vars required by sandboxed games.
+var BaseSandboxEnvVars = []string{
+	"DISPLAY",
+	"XAUTHORITY",
+	"WAYLAND_DISPLAY",
+	"XDG_RUNTIME_DIR",
+	"PULSE_SERVER",
+	"DBUS_SESSION_BUS_ADDRESS",
+	"HOME",
+	"USER",
+	"LANG",
+	"PATH",
+	"TMP",
+	"TEMP",
+	"TMPDIR",
+}
+
+func SandboxEnvAllowlist() []string {
+	allowlist := make([]string, 0, len(BaseSandboxEnvVars)+len(ItchioLaunchEnvVars))
+	allowlist = append(allowlist, BaseSandboxEnvVars...)
+	allowlist = append(allowlist, ItchioLaunchEnvVars...)
+	return allowlist
+}
+
+func collectAllowedEnv(paramsEnv []string, hostEnv []string) []string {
+	allowlist := SandboxEnvAllowlist()
+	out := make([]string, 0, len(allowlist))
+	for _, key := range allowlist {
+		if val := envLookup(paramsEnv, key); val != "" {
+			out = append(out, key+"="+val)
+			continue
+		}
+		if val := envLookup(hostEnv, key); val != "" {
+			out = append(out, key+"="+val)
+		}
+	}
+	return out
+}

runner/firejail_linux.go

@@ -17,6 +17,7 @@ type firejailRunner struct {
 }
 
 var _ Runner = (*firejailRunner)(nil)
+var firejailCommand = exec.Command
 
 func newFirejailRunner(params RunnerParams) (Runner, error) {
 	if params.FirejailParams.BinaryPath == "" {
@@ -67,13 +68,16 @@ func (fr *firejailRunner) Run() error {
 
 	var args []string
 	args = append(args, fmt.Sprintf("--profile=%s", sandboxProfilePath))
+	if params.FirejailParams.NoNetwork {
+		args = append(args, "--net=none")
+	}
 	args = append(args, "--")
 	args = append(args, params.FullTargetPath)
 	args = append(args, params.Args...)
 
-	cmd := exec.Command(firejailPath, args...)
+	cmd := firejailCommand(firejailPath, args...)
 	cmd.Dir = params.Dir
-	cmd.Env = params.Env
+	cmd.Env = collectAllowedEnv(params.Env, os.Environ())
 	cmd.Stdout = params.Stdout
 	cmd.Stderr = params.Stderr
 

runner/firejail_linux_test.go

@@ -0,0 +1,151 @@
+//go:build linux
+
+package runner
+
+import (
+	"bytes"
+	"context"
+	"os/exec"
+	"strings"
+	"testing"
+
+	"github.com/itchio/headway/state"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newFirejailTestConsumer(t *testing.T) *state.Consumer {
+	t.Helper()
+	return &state.Consumer{
+		OnMessage: func(lvl string, msg string) {
+			t.Logf("[%s] %s", lvl, msg)
+		},
+	}
+}
+
+func newFirejailTestRunner(t *testing.T, noNetwork bool) *firejailRunner {
+	t.Helper()
+	return &firejailRunner{
+		params: RunnerParams{
+			Consumer: newFirejailTestConsumer(t),
+			Ctx:      context.Background(),
+			Name:     "test-game",
+			FullTargetPath: "/bin/true",
+			InstallFolder:  t.TempDir(),
+			TempDir:        t.TempDir(),
+			FirejailParams: FirejailParams{
+				BinaryPath: "/fake/firejail",
+				NoNetwork:  noNetwork,
+			},
+		},
+	}
+}
+
+func parseEnvironmentOutput(output string) map[string]string {
+	out := make(map[string]string)
+	for _, line := range strings.Split(strings.TrimSpace(output), "\n") {
+		if line == "" {
+			continue
+		}
+		key, value, ok := strings.Cut(line, "=")
+		if !ok {
+			continue
+		}
+		out[key] = value
+	}
+	return out
+}
+
+func TestFirejailNoNetworkAddsNetNone(t *testing.T) {
+	origCommand := firejailCommand
+	t.Cleanup(func() {
+		firejailCommand = origCommand
+	})
+
+	var gotName string
+	var gotArgs []string
+	firejailCommand = func(name string, args ...string) *exec.Cmd {
+		gotName = name
+		gotArgs = append([]string{}, args...)
+		return exec.Command("sh", "-c", "true")
+	}
+
+	fr := newFirejailTestRunner(t, true)
+	require.NoError(t, fr.Run())
+	assert.Equal(t, "/fake/firejail", gotName)
+	assert.Contains(t, gotArgs, "--net=none")
+}
+
+func TestFirejailNoNetworkDisabledOmitsNetNone(t *testing.T) {
+	origCommand := firejailCommand
+	t.Cleanup(func() {
+		firejailCommand = origCommand
+	})
+
+	var gotArgs []string
+	firejailCommand = func(name string, args ...string) *exec.Cmd {
+		gotArgs = append([]string{}, args...)
+		return exec.Command("sh", "-c", "true")
+	}
+
+	fr := newFirejailTestRunner(t, false)
+	require.NoError(t, fr.Run())
+	assert.NotContains(t, gotArgs, "--net=none")
+}
+
+func TestFirejailUsesAllowlistedEnvironment(t *testing.T) {
+	origCommand := firejailCommand
+	t.Cleanup(func() {
+		firejailCommand = origCommand
+	})
+
+	firejailCommand = func(name string, args ...string) *exec.Cmd {
+		return exec.Command("sh", "-c", "env")
+	}
+
+	var stdout bytes.Buffer
+	fr := newFirejailTestRunner(t, false)
+	fr.params.Stdout = &stdout
+	fr.params.Env = []string{
+		"OPENAI_API_KEY=super-secret",
+		"USER=sandbox-user",
+		"ITCHIO_SANDBOX=1",
+		"TMP=/game/.itch/temp",
+	}
+
+	require.NoError(t, fr.Run())
+
+	gotEnv := parseEnvironmentOutput(stdout.String())
+	assert.Equal(t, "sandbox-user", gotEnv["USER"])
+	assert.Equal(t, "1", gotEnv["ITCHIO_SANDBOX"])
+	assert.Equal(t, "/game/.itch/temp", gotEnv["TMP"])
+	_, hasSecret := gotEnv["OPENAI_API_KEY"]
+	assert.False(t, hasSecret, "unlisted variables must not be forwarded")
+}
+
+func TestFirejailEnvironmentPrefersParamsAndFallsBackToHost(t *testing.T) {
+	origCommand := firejailCommand
+	t.Cleanup(func() {
+		firejailCommand = origCommand
+	})
+
+	firejailCommand = func(name string, args ...string) *exec.Cmd {
+		return exec.Command("sh", "-c", "env")
+	}
+
+	t.Setenv("USER", "host-user")
+	t.Setenv("LANG", "host-lang")
+
+	var stdout bytes.Buffer
+	fr := newFirejailTestRunner(t, false)
+	fr.params.Stdout = &stdout
+	fr.params.Env = []string{
+		"USER=params-user",
+	}
+
+	require.NoError(t, fr.Run())
+
+	gotEnv := parseEnvironmentOutput(stdout.String())
+	assert.Equal(t, "params-user", gotEnv["USER"])
+	assert.Equal(t, "host-lang", gotEnv["LANG"])
+}

runner/runner.go

@@ -42,6 +42,8 @@ type RunnerParams struct {
 
 type FirejailParams struct {
 	BinaryPath string
+	// NoNetwork disables network access in the sandbox (--net=none flag)
+	NoNetwork bool
 }
 
 type BubblewrapParams struct {