github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1534] nginx problem in 0.9.50 #1023

New issue

Closed

opened 2026-05-05 07:19:00 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 07:19:00 -06:00

Owner

Originally created by @cjconstante on GitHub (Sep 6, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1534

Hi. I am using firejail version 0.9.8.1 on debian 8 64 bits and try to do the next:

I just tried to start firejail with (default) server profile and it appears this error:
Error: line 4 in the custom profile is invalid

That line says:
noblacklist /sbin

I changed by
read-only /sbin

And works.
Then, i got the same error in other line.
That line says:
read-write /var/lib/mysql/mysql.sock
I changed by:
whitelist /var/lib/mysql/mysql.sock
And does not work.

Which option should i work here?

Thanks.

Originally created by @cjconstante on GitHub (Sep 6, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1534 Hi. I am using firejail version 0.9.8.1 on debian 8 64 bits and try to do the next: I just tried to start firejail with (default) server profile and it appears this error: Error: line 4 in the custom profile is invalid That line says: noblacklist /sbin I changed by read-only /sbin And works. Then, i got the same error in other line. That line says: read-write /var/lib/mysql/mysql.sock I changed by: whitelist /var/lib/mysql/mysql.sock And does not work. Which option should i work here? Thanks.

gitea-mirror

2026-05-05 07:19:00 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 07:19:05 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 14, 2017):

You need to update to version 0.9.50. There have been a lot of bug fixes since 0.9.8. The deb package I have on https://sourceforge.net/projects/firejail/files/firejail/ will work fine on debian 8.

@netblue30 commented on GitHub (Sep 14, 2017): You need to update to version 0.9.50. There have been a lot of bug fixes since 0.9.8. The deb package I have on https://sourceforge.net/projects/firejail/files/firejail/ will work fine on debian 8.

gitea-mirror commented

2026-05-05 07:19:06 -06:00

Author

Owner

@cjconstante commented on GitHub (Sep 22, 2017):

I just tried with this new version to run a nginx and i got this:
/bin/bash: /etc/init.d/nginx start: No such file or directory
I have tried several ways. I run just firejail and i check and the file is in there. I run with no blacklist, whitelist, with/without profile, etc, and always get the same...

@cjconstante commented on GitHub (Sep 22, 2017): I just tried with this new version to run a nginx and i got this: /bin/bash: /etc/init.d/nginx start: No such file or directory I have tried several ways. I run just firejail and i check and the file is in there. I run with no blacklist, whitelist, with/without profile, etc, and always get the same...

gitea-mirror commented

2026-05-05 07:19:09 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 25, 2017):

/etc/init.d/nginx file should be there in your filesystem, it is coming from nginx-common package. Without any sandbox, do a ls /etc/init.d and see if it is there.

There is another problem, introduced by us in 0.9.50. You have to go with a text editor in /etc/firejail/disable-common.inc and remove "blacklist /var/log" line. I put a fix in on mainline: 94bb78856b

@netblue30 commented on GitHub (Sep 25, 2017): /etc/init.d/nginx file should be there in your filesystem, it is coming from nginx-common package. Without any sandbox, do a ls /etc/init.d and see if it is there. There is another problem, introduced by us in 0.9.50. You have to go with a text editor in /etc/firejail/disable-common.inc and remove "blacklist /var/log" line. I put a fix in on mainline: https://github.com/netblue30/firejail/commit/94bb78856bb3f953fc79684622a28552d02b9d11

gitea-mirror commented

2026-05-05 07:19:10 -06:00

Author

Owner

@cjconstante commented on GitHub (Sep 25, 2017):

Sure, nginx is installed. I can run it without firejail. I have noted that if i run: firejail /etc/init.d/nginx it works, but, when i try to personalize with private, profile, etc, n it doesn't work. Even, after i run that command, i go to sandbox filesystem and its in there.

@cjconstante commented on GitHub (Sep 25, 2017): Sure, nginx is installed. I can run it without firejail. I have noted that if i run: firejail /etc/init.d/nginx it works, but, when i try to personalize with private, profile, etc, n it doesn't work. Even, after i run that command, i go to sandbox filesystem and its in there.

gitea-mirror commented

2026-05-05 07:19:12 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 25, 2017):

What profile are you using? Print it here. Also make sure you delete "balcklist /var/log" line from /etc/firejail/disable-common.inc.

@netblue30 commented on GitHub (Sep 25, 2017): What profile are you using? Print it here. Also make sure you delete "balcklist /var/log" line from /etc/firejail/disable-common.inc.

gitea-mirror commented

2026-05-05 07:19:14 -06:00

Author

Owner

@cjconstante commented on GitHub (Sep 25, 2017):

If i run this the nginx server works:
firejail /etc/init.d/nginx start &
[2] 55831
root@web:/etc# Reading profile /etc/firejail/nginx.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Parent pid 55831, child pid 55832
The new log directory is /proc/55832/root/var/log
Child process initialized in 63.49 ms

I used the server profile and i create a new one called nginx.profile:

# Firejail profile for server
# This file is overwritten after every install/update
# Persistent local customizations
#include /etc/firejail/server.local
# Persistent global definitions
#include /etc/firejail/globals.local

# generic server profile
# it allows /sbin and /usr/sbin directories - this is where servers are installed
# depending on your usage, you can enable some of the commands below:

blacklist /tmp/.X11-unix

noblacklist /sbin
noblacklist /usr/sbin
noblacklist /etc/init.d/nginx
read-write /var/log/nginx/access.log
read-write /var/log/nginx/error.log
read-write /run/nginx.pid
read-write /var/run/php5-fpm.sock
read-write /run/php5-fpm.pid
read-write /var/log/php5-fpm.log

noblacklist /var/log
# noblacklist /var/opt

include /etc/firejail/disable-common.inc
# include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

caps
no3d
nodvd
nosound
notv
novideo
seccomp

# disable-mnt
private
# private-bin program
private-dev
# private-etc none
# private-lib
private-tmp

@cjconstante commented on GitHub (Sep 25, 2017): If i run this the nginx server works: firejail /etc/init.d/nginx start & [2] 55831 root@web:/etc# Reading profile /etc/firejail/nginx.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Parent pid 55831, child pid 55832 The new log directory is /proc/55832/root/var/log Child process initialized in 63.49 ms I used the server profile and i create a new one called nginx.profile: ````` # Firejail profile for server # This file is overwritten after every install/update # Persistent local customizations #include /etc/firejail/server.local # Persistent global definitions #include /etc/firejail/globals.local # generic server profile # it allows /sbin and /usr/sbin directories - this is where servers are installed # depending on your usage, you can enable some of the commands below: blacklist /tmp/.X11-unix noblacklist /sbin noblacklist /usr/sbin noblacklist /etc/init.d/nginx read-write /var/log/nginx/access.log read-write /var/log/nginx/error.log read-write /run/nginx.pid read-write /var/run/php5-fpm.sock read-write /run/php5-fpm.pid read-write /var/log/php5-fpm.log noblacklist /var/log # noblacklist /var/opt include /etc/firejail/disable-common.inc # include /etc/firejail/disable-devel.inc include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-programs.inc caps no3d nodvd nosound notv novideo seccomp # disable-mnt private # private-bin program private-dev # private-etc none # private-lib private-tmp `````

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1023

No description provided.

Rows
Columns