github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #149] Restrictive umask breaks subdirectory whitelisting #102

New issue

Closed

opened 2026-05-05 05:02:08 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 05:02:08 -06:00

Owner

Originally created by @ghost on GitHub (Nov 19, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/149

Allow me to reopen #121 (I don't know if you get notifications for closed issues, I'm new) as I have more info now.

Basically the problem is that when you whitelist a subdirectory, then the topmost directory is owned by root. When whitelisting the topmost directory only, it is owned by the user.
Now with a more restrictive umask, the directory becomes inaccessible, since owned by root and only root has the rights.

$ umask 0022
$ firejail --whitelist=.config/
[anon@jail ~]$ ls -ld .config/
drwx------ 22 anon anon 4096 Nov 18 22:20 .config/

$ firejail --whitelist=.config/deadbeef/
[anon@jail ~]$ ls -ld .config/
drwxr-xr-x 3 65534 anon 60 Nov 19 18:48 .config/


$ umask 0077
$ firejail --whitelist=.config/
[anon@jail ~]$ ls -ld .config/
drwx------ 22 anon anon 4096 Nov 18 22:20 .config/

$ firejail --whitelist=.config/deadbeef/
[anon@jail ~]$ ls -ld .config/
drwx------ 3 65534 anon 60 Nov 19 18:48 .config/

Originally created by @ghost on GitHub (Nov 19, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/149 Allow me to reopen #121 (I don't know if you get notifications for closed issues, I'm new) as I have more info now. Basically the problem is that when you whitelist a subdirectory, then the topmost directory is owned by root. When whitelisting the topmost directory only, it is owned by the user. Now with a more restrictive umask, the directory becomes inaccessible, since owned by root and only root has the rights. ``` $ umask 0022 $ firejail --whitelist=.config/ [anon@jail ~]$ ls -ld .config/ drwx------ 22 anon anon 4096 Nov 18 22:20 .config/ $ firejail --whitelist=.config/deadbeef/ [anon@jail ~]$ ls -ld .config/ drwxr-xr-x 3 65534 anon 60 Nov 19 18:48 .config/ $ umask 0077 $ firejail --whitelist=.config/ [anon@jail ~]$ ls -ld .config/ drwx------ 22 anon anon 4096 Nov 18 22:20 .config/ $ firejail --whitelist=.config/deadbeef/ [anon@jail ~]$ ls -ld .config/ drwx------ 3 65534 anon 60 Nov 19 18:48 .config/ ```

gitea-mirror

2026-05-05 05:02:08 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:02:13 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 19, 2015):

Yes, this is a bug. Thanks!

@netblue30 commented on GitHub (Nov 19, 2015): Yes, this is a bug. Thanks!

gitea-mirror commented

2026-05-05 05:02:18 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 19, 2015):

I think I've fixed it. Give it a try, and if necessary I'll reopen it. Thanks.

@netblue30 commented on GitHub (Nov 19, 2015): I think I've fixed it. Give it a try, and if necessary I'll reopen it. Thanks.

gitea-mirror commented

2026-05-05 05:02:20 -06:00

Author

Owner

@ghost commented on GitHub (Nov 19, 2015):

You did fix the bug, but now you ignore umask by setting perms to 0755 regardless. It was enough to just change the owner from root to user, which I think would be better that way. If you could only change the ownership and leave permissions alone, that would be great!

And thanks for the fix nonetheless. You're fast and I like what you do.

@ghost commented on GitHub (Nov 19, 2015): You did fix the bug, but now you ignore umask by setting perms to 0755 regardless. It was enough to just change the owner from root to user, which I think would be better that way. If you could only change the ownership and leave permissions alone, that would be great! And thanks for the fix nonetheless. You're fast and I like what you do.

gitea-mirror commented

2026-05-05 05:02:25 -06:00

Author

Owner

@ghost commented on GitHub (Nov 19, 2015):

I created a pull request. Hopefully I did it properly. If there's something I'm missing, or general notes, please tell me. It's my very first pull request and commit ever, ha.

@ghost commented on GitHub (Nov 19, 2015): I created a pull request. Hopefully I did it properly. If there's something I'm missing, or general notes, please tell me. It's my very first pull request and commit ever, ha.

gitea-mirror commented

2026-05-05 05:02:29 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 20, 2015):

All fine, I had to update the code again and set the "x" bit mode for directories.

@netblue30 commented on GitHub (Nov 20, 2015): All fine, I had to update the code again and set the "x" bit mode for directories.

gitea-mirror referenced this issue

2026-05-05 10:03:21 -06:00

[PR #102] [MERGED] Use configured libdir instead of $prefix/lib #3542

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#102

No description provided.

Rows
Columns