github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1628] Should noexec ${HOME} be changed to noexec ${HOME}/* ? #1093

New issue

Closed

opened 2026-05-05 07:26:31 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 07:26:31 -06:00

Owner

Originally created by @dkwls on GitHub (Nov 2, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1628

I have noticed that many profiles contain

noexec /tmp
noexec ${HOME}

noexec /tmp appears to apply recursively but noexec ${HOME} does not.

Should noexec ${HOME} be changed to noexec ${HOME}/* ?
Also is there any difference between noexec ${HOME} and noexec ~ ?

Originally created by @dkwls on GitHub (Nov 2, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1628 I have noticed that many profiles contain `noexec /tmp` `noexec ${HOME}` `noexec /tmp` appears to apply recursively but `noexec ${HOME}` does not. Should `noexec ${HOME}` be changed to `noexec ${HOME}/*` ? Also is there any difference between `noexec ${HOME}` and `noexec ~` ?

gitea-mirror

2026-05-05 07:26:31 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 07:26:36 -06:00

Author

Owner

@smitsohu commented on GitHub (Nov 3, 2017):

Hey @dkwls!

noexec /tmp appears to apply recursively but noexec ${HOME} does not.

Can I ask which observation led you to this conclusion?

Also is there any difference between noexec ${HOME} and noexec ~?

No, they are the same.

@smitsohu commented on GitHub (Nov 3, 2017): Hey @dkwls! > noexec /tmp appears to apply recursively but noexec ${HOME} does not. Can I ask which observation led you to this conclusion? > Also is there any difference between noexec ${HOME} and noexec ~? No, they are the same.

gitea-mirror commented

2026-05-05 07:26:38 -06:00

Author

Owner

@dkwls commented on GitHub (Nov 3, 2017):

Thanks for your reply @smitsohu.

I found that I was able to run scripts contained in ~/bin despite the profile containing noexec ${HOME}.

Eventually I was able to isolate the problem. /etc/firejail/vlc.profile contains the following:

...
include /etc/firejail/disable-common.inc
...
noexec ${HOME}
noexec /tmp

/etc/firejail/disable-common.inc contains:

...
read-only ${HOME}/bin
...

When read-only ${HOME}/bin appears before noexec ${HOME} as is the case in the default vlc profile (and presumably others) scripts can be executed from ~/bin. If the order is swapped firejail appears to work as expected.

@dkwls commented on GitHub (Nov 3, 2017): Thanks for your reply @smitsohu. I found that I was able to run scripts contained in ~/bin despite the profile containing `noexec ${HOME}`. Eventually I was able to isolate the problem. /etc/firejail/vlc.profile contains the following: `...` `include /etc/firejail/disable-common.inc` `...` `noexec ${HOME}` `noexec /tmp` /etc/firejail/disable-common.inc contains: `...` `read-only ${HOME}/bin` `...` When `read-only ${HOME}/bin` appears before `noexec ${HOME}` as is the case in the default vlc profile (and presumably others) scripts can be executed from ~/bin. If the order is swapped firejail appears to work as expected.

gitea-mirror commented

2026-05-05 07:26:39 -06:00

Author

Owner

@dkwls commented on GitHub (Nov 3, 2017):

It looks like the root cause is a duplicate of bug #839 but the question about changing noexec ${HOME} to noexec ${HOME}/* remains.

@dkwls commented on GitHub (Nov 3, 2017): It looks like the root cause is a duplicate of [bug #839](https://github.com/netblue30/firejail/issues/839) but the question about changing `noexec ${HOME}` to `noexec ${HOME}/*` remains.

gitea-mirror commented

2026-05-05 07:26:40 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 6, 2017):

Leave it as noexec ${HOME}, I'll try to bring in a fix for it, thanks for the bug.

@netblue30 commented on GitHub (Nov 6, 2017): Leave it as noexec ${HOME}, I'll try to bring in a fix for it, thanks for the bug.

gitea-mirror commented

2026-05-05 07:26:41 -06:00

Author

Owner

@dkwls commented on GitHub (Nov 6, 2017):

Thank you.

@dkwls commented on GitHub (Nov 6, 2017): Thank you.

gitea-mirror commented

2026-05-05 07:26:42 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 23, 2018):

Let's move the discussion of this issue to #2029.

@chiraag-nataraj commented on GitHub (Jul 23, 2018): Let's move the discussion of this issue to #2029.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1093

No description provided.

Rows
Columns