docs: clarify to run "sudo firecfg" as a normal (desktop) user

[kmk3]

End users following the steps for desktop integration may end up running
sudo firecfg as root (or as a similar account) rather than as a normal
desktop user.

In that case, programs opened through a desktop launcher would still not
be running under firejail, which might surprise users.

So clarify that sudo firecfg should be executed as a normal (desktop)
user for desktop integration.

Relates to #6657.

Kind of relates to #5812.

Reported-by: @ginto37

[rusty-snake]

The alternatives is

# firecfg
# firecfg --add-users YOUR_USER
$ firecfg --fix

[rusty-snake]

In that case, programs opened through a desktop launcher would still not
be running under firejail, which might surprise users.

Half the story.

• if the .desktop file has the program name in the Exec= key rather than the absolute path and does not use DBusActivatable=true, then it works.
• if the .desktop file has an absolute path in the Exec= key or uses DBusActivatable=true, then it does not work.
• if the .desktop file has the wrong name ...
• if the program does autostart, dbus, systemd, ...

[ginto37]

I'm not sure the phrase "normal (desktop) user" really helps here, and I'd suggest not going with that. My admin account, the one with sudo privileges, is a normal, desktop user, and so is my standard user account, the one without the sudo privileges and the one I work in 90% of the time. But only the admin account can run sudo firecfg. Also, most desktop users won't have direct access to root - Fedora, Ubuntu and Debian don't even enable it by default. So the average user will be working with just the admin account and the standard account, only one of which will work with that command.

I feel like there's a fundamental difference in views here regarding the use of accounts on Linux. Basically I feel like you're looking at this from a different angle and it's leading you to write up the instructions from a slightly unhelpful viewpoint that's going to confuse users rather than help them.

For that reason, Rusty-snake's suggestion should be the default method, not the alternative, IMO, otherwise users like myself are going to wonder why sudo firecfg won't work when run in an account which doesn't have sudo privileges for firecfg.

Rusty-snake's method doesn't involve modifying the sudoers file - which would be necessary for a non-admin account, and which you don't cover in the steps, despite it being crucial and capable of breaking the system if performed incorrectly - and encourages separation of admin and standard user accounts, which is good security practice.

In essence,

# firecfg
# firecfg --add-users <EACH USER WHO NEEDS TO USE FIREJAIL>
As each of those users, for those who want desktop integration:
$ firecfg --fix

OOC, where would firecfg --fix-sound come in that list? Does it also have to be run for each user intending to use Firejail?

[rusty-snake]

sudoers file

I still don't get why you want to modify it.

OOC, where would firecfg --fix-sound come in that list? Does it also have to be run for each user intending to use Firejail?

Each user.

Keep in mind that firejails primary target are single user desktop systems.