github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

Clarify that file globbing occurs only at start

Browse source 
firejail can blacklist (and now also whitelist) files based on glob
pattern.  This pattern is evaluated at firejail start, and not updated
at run time.  This patch documents this behavior.
This commit is contained in:
Antonio Russo 2020-04-11 14:12:53 -06:00
parent 3e2347451c
commit 73525015e1
2 changed files with 13 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/man/firejail-profile.txt
View file

@ -165,8 +165,9 @@ host filesystem. Each line describes a file/directory that is inaccessible
(\fBblacklist\fR), a read-only file or directory (\fBread-only\fR),
a tmpfs mounted on top of an existing directory (\fBtmpfs\fR),
or mount-bind a directory or file on top of another directory or file (\fBbind\fR).
Use \fBprivate\fR to set private mode.
File globbing is supported, and PATH and HOME directories are searched.
Use \fBprivate\fR to set private mode. File globbing is supported, and PATH and
HOME directories are searched, see the \fBfirejail\f(1) \fBFILE GLOBBING\fR section
for more details.
Examples:
.TP
\fBblacklist file_or_directory

13
src/man/firejail.txt
View file

@ -2835,7 +2835,11 @@ List all sandboxed processes.
.SH FILE GLOBBING
.TP
Globbing is the operation that expands a wildcard pattern into the list of pathnames matching the pattern. Matching is defined by:
Globbing is the operation that expands a wildcard pattern into the
list of pathnames matching the pattern. This pattern is matched at
firejail \fBstart\fR, and is NOT UPDATED at runtime. \fBFiles matching
a blacklist, but created after firejail start will be accessible within
the jail.\fR Matching is defined by:
.br
.br
@ -2846,12 +2850,15 @@ Globbing is the operation that expands a wildcard pattern into the list of pathn
- '[' denotes a range of characters
.br
.TP
The globbing feature is implemented using glibc glob command. For more information on the wildcard syntax see man 7 glob.
The globbing feature is implemented using glibc glob command. For
more information on the wildcard syntax see man 7 glob.
.br
.br
.TP
The following command line options are supported: \-\-blacklist, \-\-private-bin, \-\-noexec, \-\-read-only, \-\-read-write, \-\-tmpfs, and \-\-whitelist.
The following command line options are supported: \-\-blacklist,
\-\-private-bin, \-\-noexec, \-\-read-only, \-\-read-write,
\-\-tmpfs, and \-\-whitelist.
.br
.br