Prior to this fix, was configuration in /etc/firejail not being picked up? I'm not really sure with how firejail handles includes like these, but this actually broke local profile handling for me from 19.09 to nixos-unstable. I put my customization files in ~/.config/firejail and that used to work, but now with includes hardcoded to /etc/firejail, they don't anymore and I have to move my configuration there instead.

Looking at the firejail code, https://github.com/netblue30/firejail/blob/e4cb6b42743ad18bd11d07fd32b51e8576239318/src/firejail/profile.c#L68-L83

It only looks in either SYSCONFDIR, which in this case is the nix store, and the user configuration ~/.config/firejail directories. So to preserve the original behavior of supporting both /etc/firejail and ~/.config/firejail, it would be necessary to either patch the code or symlink the main files into /etc

Aaah, damn, I didn't even realize that this piece of code handling ~/.config/firejail is there :/ Wanted to put my local customizations into /etc/firejail as they seem easier to manage this way. No idea how to easily make both of these folders work in parallel, patching firejail in the NixOS build seems a bit over the top, would rather push it to the firejail upstream if anything but not sure that I can justify it.

What do you think?

We can also try duplicating each include .*.local line so that it tries bots /etc/firejail as well as the relative path (which will end up looking in ~/.config/firejail). The disadvantage is that when you will be adding your own includes you will still need to be specific.

Oh, if it looks in the nix store by default instead of /etc/firejail what about creating a corresponding program.local file inside the nix store that includes /etc/firejail/program.local? That way we don't have to modify the existing files and it should be able to find both maybe?

Yeah, that could work! So you are suggesting automatically generating a set of program.local files in the firejail derivation?

Yes, if we can support both locations, that would be ideal.

@thatsmydoing I think this should fix your problem #83515, I have checked that it still uses local profiles from /etc/firejail. Would be great if you could confirm that it fixes the problem for you.