[GH-ISSUE #1632] private-bin and symlinks to non-standard paths

gitea-mirror commented

2026-05-05 07:26:56 -06:00

Owner

Originally created by @aayla-secura on GitHub (Nov 5, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1632

It's kind of common for applications to place their executables in /usr/lib/ and install a symlink in /usr/bin (or another location in PATH). Firejail however refuses to use these when private-bin is in force: firejail/fs_bin.c takes the basename of given and looks for such a file in a set of hardcoded paths, resulting in Warning: file <abs path> not found. The real executable is present in the sandbox, so it can be called. follow-symlink-private-bin yes does not affect this.

Is there a way to make such symlinks work, other than writing a dummy wrapper script that calls the true executable and giving that to private-bin, rather than the symlink?

Originally created by @aayla-secura on GitHub (Nov 5, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1632 It's kind of common for applications to place their executables in /usr/lib/<program> and install a symlink in /usr/bin (or another location in PATH). Firejail however refuses to use these when private-bin is in force: firejail/fs_bin.c takes the basename of <abs-path> given and looks for such a file in a set of hardcoded paths, resulting in `Warning: file <abs path> not found`. The real executable is present in the sandbox, so it can be called. `follow-symlink-private-bin yes` does not affect this. Is there a way to make such symlinks work, other than writing a dummy wrapper script that calls the true executable and giving that to private-bin, rather than the symlink?

gitea-mirror

2026-05-05 07:26:56 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 07:27:02 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Nov 6, 2017):

Hmm...on my system, /usr/bin/firefox is a symlink to /usr/lib/firefox/firefox, and firejail firefox with private-bin works just fine.

@chiraag-nataraj commented on GitHub (Nov 6, 2017): Hmm...on my system, `/usr/bin/firefox` is a symlink to `/usr/lib/firefox/firefox`, and `firejail firefox` with `private-bin` works just fine.

gitea-mirror commented

2026-05-05 07:27:05 -06:00

Author

Owner

@aayla-secura commented on GitHub (Nov 6, 2017):

Exactly, on my system /usr/bin/firefox points to /usr/lib/firefox/firefox, but firejail fails to copy the symlink...

@aayla-secura commented on GitHub (Nov 6, 2017): Exactly, on my system `/usr/bin/firefox` points to `/usr/lib/firefox/firefox`, but firejail fails to copy the symlink...

gitea-mirror commented

2026-05-05 07:27:07 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Nov 6, 2017):

Huh that's weird. You're using the default profile?

@chiraag-nataraj commented on GitHub (Nov 6, 2017): Huh that's weird. You're using the default profile?

gitea-mirror commented

2026-05-05 07:27:08 -06:00

Author

Owner

@aayla-secura commented on GitHub (Nov 6, 2017):

No, I have a custom profile, which is mostly similar to the default firefox's with the major differences being

whitelist /tmp/runtime-<user>
whitelist /tmp/firefox-esr_<user>
private-tmp
private-etc alternatives,chromium.d,debian_version,firefox,fonts,ld.so.cache,localtime,machine-id,mailcap,mime.types,nsswitch.conf,resolv.conf,ssl
private-bin sh,bash,ls,expr,tempfile,rm,rmdir,mkdir,chmod,install,python,python2,python3,python2.7,python3.5,firefox

@aayla-secura commented on GitHub (Nov 6, 2017): No, I have a custom profile, which is mostly similar to the default firefox's with the major differences being ``` whitelist /tmp/runtime-<user> whitelist /tmp/firefox-esr_<user> private-tmp private-etc alternatives,chromium.d,debian_version,firefox,fonts,ld.so.cache,localtime,machine-id,mailcap,mime.types,nsswitch.conf,resolv.conf,ssl private-bin sh,bash,ls,expr,tempfile,rm,rmdir,mkdir,chmod,install,python,python2,python3,python2.7,python3.5,firefox ```

gitea-mirror commented

2026-05-05 07:27:10 -06:00

Author

Owner

@aayla-secura commented on GitHub (Nov 6, 2017):

Ok, I figured out that if I give the absolute path to the link as in private-bin ...,/usr/bin/firefox, it does not copy it. The function responsible in firejail/fs_bin.c is valid_full_path_file and I missed a detail when I was first looking at it. So it uses realpath to get the canonical path (which would be the link's target in /usr/lib), then searches through the standard path for a file with the same basename as the link (which happens to have the same basename as its target, but this is irrelevant here), and finally compares the full path of the file found in one of the standard locations with the path returned by realpath... which of course fails.
So with symlinks, I have to give only the basename to private-bin. Probably easy to fix this and allow full paths for symlinks, but I don't have time to write a patch at the moment.

@aayla-secura commented on GitHub (Nov 6, 2017): Ok, I figured out that if I give the absolute path to the link as in `private-bin ...,/usr/bin/firefox`, it does not copy it. The function responsible in `firejail/fs_bin.c` is `valid_full_path_file` and I missed a detail when I was first looking at it. So it uses `realpath` to get the canonical path (which would be the link's target in `/usr/lib`), then searches through the standard path for a file with the same basename as the link (which happens to have the same basename as its target, but this is irrelevant here), and finally compares the full path of the file found in one of the standard locations with the path returned by `realpath`... which of course fails. So with symlinks, I have to give only the basename to `private-bin`. Probably easy to fix this and allow full paths for symlinks, but I don't have time to write a patch at the moment.

gitea-mirror commented

2026-05-05 07:27:11 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 7, 2017):

You need to install the latest version here in git - there was a fix earlier regarding symlinks handling in private-bin. For firefox you need the real executable to be under /usr/lib/firefox, otherwise firefox will not work.

A short example for Debian 9:

$ ls -l /usr/bin/firefox*
-rwxr-xr-x 1 root root 113 Sep 28 17:02 /usr/bin/firefox
lrwxrwxrwx 1 root root  30 Sep 28 17:02 /usr/bin/firefox-esr -> ../lib/firefox-

/usr/bin/firefox is a shell script (/bin/sh). The script calls "which" and /usr/bin/firefox-esr. firefox-esr is the symlink pointing to the real executable. This is how I start the sandbox:

$ firejail --private-bin=firefox,firefox-esr,sh,which firefox

You can check your private-bin setup by adding bash and ls and running it like this:

$ firejail --quiet --private-bin=firefox,firefox-esr,sh,which,bash,ls ls -l /usr/bin
total 1328
-rwxr-xr-x 1 nobody nogroup 1099016 Nov  6 20:15 bash
-rwxr-xr-x 1 nobody nogroup  117208 Nov  6 20:15 dash
-rwxr-xr-x 1 nobody nogroup     113 Nov  6 20:15 firefox
lrwxrwxrwx 1 nobody nogroup      32 Nov  6 20:15 firefox-esr -> /usr/lib/firefox-esr/firefox-esr
-rwxr-xr-x 1 nobody nogroup  130736 Nov  6 20:15 ls
lrwxrwxrwx 1 nobody nogroup       9 Nov  6 20:15 sh -> /bin/dash
-rwxr-xr-x 1 nobody nogroup     946 Nov  6 20:15 which
$

@netblue30 commented on GitHub (Nov 7, 2017): You need to install the latest version here in git - there was a fix earlier regarding symlinks handling in private-bin. For firefox you need the real executable to be under /usr/lib/firefox, otherwise firefox will not work. A short example for Debian 9: ````` $ ls -l /usr/bin/firefox* -rwxr-xr-x 1 root root 113 Sep 28 17:02 /usr/bin/firefox lrwxrwxrwx 1 root root 30 Sep 28 17:02 /usr/bin/firefox-esr -> ../lib/firefox- ````` /usr/bin/firefox is a shell script (/bin/sh). The script calls "which" and /usr/bin/firefox-esr. firefox-esr is the symlink pointing to the real executable. This is how I start the sandbox: ````` $ firejail --private-bin=firefox,firefox-esr,sh,which firefox ````` You can check your private-bin setup by adding bash and ls and running it like this: ````` $ firejail --quiet --private-bin=firefox,firefox-esr,sh,which,bash,ls ls -l /usr/bin total 1328 -rwxr-xr-x 1 nobody nogroup 1099016 Nov 6 20:15 bash -rwxr-xr-x 1 nobody nogroup 117208 Nov 6 20:15 dash -rwxr-xr-x 1 nobody nogroup 113 Nov 6 20:15 firefox lrwxrwxrwx 1 nobody nogroup 32 Nov 6 20:15 firefox-esr -> /usr/lib/firefox-esr/firefox-esr -rwxr-xr-x 1 nobody nogroup 130736 Nov 6 20:15 ls lrwxrwxrwx 1 nobody nogroup 9 Nov 6 20:15 sh -> /bin/dash -rwxr-xr-x 1 nobody nogroup 946 Nov 6 20:15 which $ `````

gitea-mirror commented

2026-05-05 07:27:13 -06:00

Author

Owner

@aayla-secura commented on GitHub (Nov 7, 2017):

Yes, as I mentioned in my previous comment, passing a relative name to private-bin does copy the symlink, but using the full path fails, i.e. (just tested with the latest commit 82f373dea7)

# firejail --quiet --private-bin=/usr/bin/firefox,sh,bash,ls ls -l /usr/bin
-rwxr-xr-x 1 root root 1099016 Nov  7 13:38 bash
-rwxr-xr-x 1 root root  134792 Nov  7 13:38 ls
lrwxrwxrwx 1 root root       9 Nov  7 13:38 sh -> /bin/bash

when /usr/bin/firefox does exist:

# ls -l /usr/bin/firefox
lrwxrwxrwx 1 root root 22 Oct 18 13:02 /usr/bin/firefox -> ../lib/firefox/firefox

@aayla-secura commented on GitHub (Nov 7, 2017): Yes, as I mentioned in my previous comment, passing a relative name to `private-bin` does copy the symlink, but using the full path fails, i.e. (just tested with the latest commit 82f373dea7247cc96b91a8e079e2aff852713841) ``` # firejail --quiet --private-bin=/usr/bin/firefox,sh,bash,ls ls -l /usr/bin -rwxr-xr-x 1 root root 1099016 Nov 7 13:38 bash -rwxr-xr-x 1 root root 134792 Nov 7 13:38 ls lrwxrwxrwx 1 root root 9 Nov 7 13:38 sh -> /bin/bash ``` when `/usr/bin/firefox` does exist: ``` # ls -l /usr/bin/firefox lrwxrwxrwx 1 root root 22 Oct 18 13:02 /usr/bin/firefox -> ../lib/firefox/firefox ```

gitea-mirror commented

2026-05-05 07:27:14 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 9, 2017):

I have a fix in, you can give it a try.

@netblue30 commented on GitHub (Nov 9, 2017): I have a fix in, you can give it a try.

gitea-mirror commented

2026-05-05 07:27:16 -06:00

Author

Owner

@aayla-secura commented on GitHub (Nov 9, 2017):

Yes, commit b1b1e774a1 seems to fix it.

@aayla-secura commented on GitHub (Nov 9, 2017): Yes, commit b1b1e774a175fe2ee35aa22d02c097e13873a5a9 seems to fix it.

gitea-mirror commented

2026-05-05 07:27:18 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 10, 2017):

cool! thanks for the bug.

@netblue30 commented on GitHub (Nov 10, 2017): cool! thanks for the bug.

Rows
Columns

[GH-ISSUE #1632] private-bin and symlinks to non-standard paths #1096