Firejail profile for CalyxOS' device flasher

[lucasmz-dev]

Warning

I am not experienced with sandboxing, this profile is probably holey.

I wanted to see if I could get CalyxOS' device flasher to work in firejail, and I came up with this profile:

https://gist.github.com/lucasmz-dev/5fd814fe521a052fc072ab3c9d5b94cd

What doesn't work:

• Flashing the device without booting into bootloader (AKA fastboot) mode first doesn't work (ADB doesn't work, but only fastboot is truly needed for the flashing process)
• It's assumed you have a folder under ${HOME}/Downloads/CalyxOS where device-flasher.linux and the factory image are.

Tested on:

• Moto G32 "devon"

[lucasmz-dev]

Modified it a bit and moved to: https://gist.github.com/lucasmz-dev/5fd814fe521a052fc072ab3c9d5b94cd

[lucasmz-dev]

Logs of a successful installation: https://pad.riseup.net/p/vx0_Kg0_bgIBZ0VPima_-keep

[kmk3]

I wanted to see if I could get CalyxOS' device flasher to work in firejail,
and I came up with this profile:

https://gist.github.com/lucasmz-dev/5fd814fe521a052fc072ab3c9d5b94cd

Hello, if the profile works well enough, I'd suggest removing all of the noise
from profile.template (for example, see mpv.profile) to make it easier to
review and then submitting it in a PR.

What doesn't work:

• Flashing the device without booting into bootloader (AKA fastboot) mode
  first doesn't work (ADB doesn't work, but only fastboot is truly needed for
  the flashing process)

Does it work with adb in private-bin?

• It's assumed you have a folder under ${HOME}/Downloads/CalyxOS where
  device-flasher.linux and the factory image are.

If that path is not used by the program itself (and if this profile is intended
for a PR), remove the mkdir and use just whitelist ${DOWNLOADS} for
simplicity/usability.

[lucasmz-dev]

Not entirely sure if I want to send a PR for this, not sure if it's in-scope, I'm not very familiar with firejail, but I could if you think it makes sense, sure! I just kind of wanted to share this :P

Does it work with adb in private-bin?

Nah, that's not the issue, ADB doesn't see devices, not sure what'd fix it or if what'd fix it would be considered a sandbox escape. The device-flasher program also just gets the platform tools and downloads them for kind of a "reproducible" envo.
It's not a big deal, ADB is only used for rebooting the device into bootloader mode, once it's there, it's all fastboot.

Should quiet be on? I suppose that'd hide the firejail messages?

[lucasmz-dev]

Eh, whatever: #6616