It's not immediate obvious what the default MW firejail config does, nor is that /etc/firejail/mediawiki.local should be created (and potentially what should be in it, beyond saying to look at https://firejail.wordpress.com/features-3/man-firejail-profile/ for docs)
This applies both to MW and its documentation in the repo and also https://www.mediawiki.org/wiki/Manual:Shell_framework
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | tstarling | T257066 Extension:Score / Lilypond is disabled on all wikis | |||
| Open | None | T259208 PDF export should render music scores natively, i.e. not as images | |||
| Resolved | Security | tstarling | T257091 Re-enable the Score extension in safe mode | ||
| Resolved | Security | Legoktm | T257207 Document MW Firejail config/profile |
https://gerrit.wikimedia.org/r/c/mediawiki/core/+/609842
I'll work on the on-wiki docs later today.