[GH-ISSUE #157] opsec: Wipe tmpfs on program exit #107

New issue

Closed

opened 2026-05-05 05:03:21 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 05:03:21 -06:00

Owner

Originally created by @ghost on GitHub (Nov 25, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/157

An option to wipe files created by the user, on tmpfs filesystems, to avoid leaving traces in memory. Or wipe the whole tmpfs, because then also "normally" deleted files will be wiped.

Also disable swapping to HDD (--private-dev seems to already be doing this, but maybe make it explicit).

Originally created by @ghost on GitHub (Nov 25, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/157 An option to wipe files created by the user, on tmpfs filesystems, to avoid leaving traces in memory. Or wipe the whole tmpfs, because then also "normally" deleted files will be wiped. Also disable swapping to HDD (--private-dev seems to already be doing this, but maybe make it explicit).

gitea-mirror closed this issue

2026-05-05 05:03:24 -06:00

gitea-mirror commented

2026-05-05 05:03:27 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 26, 2015):

I cannot find any way to disable swap memory for tmpfs. The only way to do it is to disable swapping for all the system.

The filesystem of the processes running in the sandbox is exposed in /proc/PID/root to anybody already inside the system with enough privileges. /proc also exposes the memory of the running processes. I'll have to reject it for now, until some idea how to do it comes along.

@netblue30 commented on GitHub (Nov 26, 2015): I cannot find any way to disable swap memory for tmpfs. The only way to do it is to disable swapping for all the system. The filesystem of the processes running in the sandbox is exposed in /proc/PID/root to anybody already inside the system with enough privileges. /proc also exposes the memory of the running processes. I'll have to reject it for now, until some idea how to do it comes along.

gitea-mirror referenced this issue

2026-05-05 09:07:51 -06:00

[GH-ISSUE #3892] Option to launch firejailed program as a different user #2444

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#107

No description provided.

Rows
Columns