yay -S firejail-git

sudo apt-get update -qy
sudo apt-get install -qy \
  git build-essential fakeroot lintian libapparmor-dev pkg-config gawk
git clone 'https://github.com/netblue30/firejail.git' &&
cd firejail &&
./configure &&
make dist &&
./mkdeb.sh &&
sudo dpkg -i ./*.deb &&
make installcheck

sudo dnf update -y
sudo dnf install -y rpm-build gcc make
git clone 'https://github.com/netblue30/firejail.git' &&
cd firejail &&
./configure &&
make dist &&
./platform/rpm/mkrpm.sh &&
sudo rpm -i ./*.rpm &&
make installcheck

git clone 'https://github.com/netblue30/firejail.git' &&
cd firejail &&
./configure &&
make -j "$(nproc)" &&
sudo make install-strip &&
make installcheck

sudo apt-get install git build-essential libapparmor-dev pkg-config gawk

firejail /usr/bin/firefox            # starting Mozilla Firefox
firejail /usr/bin/transmission-gtk   # starting Transmission BitTorrent
firejail /usr/bin/vlc                # starting VideoLAN Client
sudo firejail /etc/init.d/nginx start

$ firejail --list
1617:netblue:/usr/bin/firejail /usr/bin/firefox-esr
7719:netblue:/usr/bin/firejail /usr/bin/transmission-qt
7779:netblue:/usr/bin/firejail /usr/bin/galculator
7874:netblue:/usr/bin/firejail /usr/bin/vlc --started-from-file file:///home/netblue/firejail-whitelist.mp4
7916:netblue:firejail --list

firecfg --fix-sound
sudo firecfg

sudo firecfg --clean

LANDLOCK
       Landlock is a Linux security module first introduced in version 5.13 of
       the  Linux  kernel.  It allows unprivileged processes to restrict their
       access to the filesystem.  Once imposed, these restrictions  can  never
       be  removed,  and  all child processes created by a Landlock-restricted
       processes inherit these restrictions.  Firejail supports Landlock as an
       additional  sandboxing  feature.  It can be used to ensure that a sand‐
       boxed application can only access files and directories that it was ex‐
       plicitly  allowed  to access.  Firejail supports populating the ruleset
       with both a basic set of rules (see --landlock) and with a  custom  set
       of rules.

       Important notes:

              - A process can install a Landlock ruleset only if it has either
              CAP_SYS_ADMIN in its effective capability set, or  the  "No  New
              Privileges"  restriction enabled.  Because of this, enabling the
              Landlock feature will also cause Firejail to enable the "No  New
              Privileges"  restriction,  regardless  of  the  profile  or  the
              --nonewprivs command line option.

              - Access to the /proc directory is managed through  the  --land‐
              lock.proc command line option.

              -  Access  to  the  /etc directory is automatically allowed.  To
              override this, use the --writable-etc command line option.   You
              can  also use the --private-etc option to restrict access to the
              /etc directory.

       To enable Landlock self-restriction on top of your current Firejail se‐
       curity  features,  pass  --landlock flag to Firejail command line.  You
       can also use --landlock.read, --landlock.write, --landlock.special  and
       --landlock.execute  options  together with --landlock or instead of it.
       Example:

       $ firejail --landlock --landlock.read=/media --landlock.proc=ro /usr/bin/mc

$ /usr/lib/firejail/profstats /etc/firejail/*.profile
No include .local found in /etc/firejail/noprofile.profile
Warning: multiple caps in /etc/firejail/tidal-hifi.profile
Warning: multiple caps in /etc/firejail/tqemu.profile
Warning: multiple caps in /etc/firejail/transmission-daemon.profile
Warning: multiple caps in /etc/firejail/trivalent.profile

Stats:
    profiles			1342
    include local profile	1341   (include profile-name.local)
    include globals		1307   (include globals.local)
    blacklist ~/.ssh		1201   (include disable-common.inc)
    seccomp			1213
    capabilities		1335
    noexec			1214   (include disable-exec.inc)
    noroot			1105
    memory-deny-write-execute	320
    restrict-namespaces		1048
    apparmor			869
    private-bin			817
    private-dev			1172
    private-etc			842
    private-cache		865
    private-lib			86
    private-tmp			1036
    whitelist home directory	662
    whitelist var		975   (include whitelist-var-common.inc)
    whitelist run/user		1305   (include whitelist-runuser-common.inc
					or blacklist ${RUNUSER})
    whitelist usr/share		760   (include whitelist-usr-share-common.inc
    net none			452
    dbus-user none 		766
    dbus-user filter 		206
    dbus-system none 		970
    dbus-system filter 		13