github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1635] Allow passing in a netfilter configuration via the command line #1100

New issue

Closed

opened 2026-05-05 07:27:19 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 07:27:19 -06:00

Owner

Originally created by @legoktm on GitHub (Nov 7, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1635

Please correct me if I'm wrong, but as I understand it from the man page, currently the netfilter configuration has to be saved in a file, and that is provided as a command-line argument.

For my use in MediaWiki, I'd like to be able to create dynamic netfilter configurations based on different configuration settings the user has provided (port numbers). Ideally I'd be able to pass in the configuration as a command-line option to firejail - is that something that would be possible? I'd like to avoid writing a file with dynamic contents at run time to avoid problems with webapps being able to write to the filesystem.

Originally created by @legoktm on GitHub (Nov 7, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1635 Please correct me if I'm wrong, but as I understand it from the man page, currently the netfilter configuration has to be saved in a file, and that is provided as a command-line argument. For my use in MediaWiki, I'd like to be able to create dynamic netfilter configurations based on different configuration settings the user has provided (port numbers). Ideally I'd be able to pass in the configuration as a command-line option to firejail - is that something that would be possible? I'd like to avoid writing a file with dynamic contents at run time to avoid problems with webapps being able to write to the filesystem.

gitea-mirror

2026-05-05 07:27:19 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 07:27:23 -06:00

Author

Owner

@reinerh commented on GitHub (Nov 7, 2017):

I don't think the firejail command line is the right interface to pass in iptables rules.
Is it really better to allow webapps influencing the commandline instead of files?

@reinerh commented on GitHub (Nov 7, 2017): I don't think the firejail command line is the right interface to pass in iptables rules. Is it really better to allow webapps influencing the commandline instead of files?

gitea-mirror commented

2026-05-05 07:27:25 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 9, 2017):

I think I can bring in something generic. It will allow you to set port numbers, IP addresses etc. from the command line.

@netblue30 commented on GitHub (Nov 9, 2017): I think I can bring in something generic. It will allow you to set port numbers, IP addresses etc. from the command line.

gitea-mirror commented

2026-05-05 07:27:26 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 18, 2017):

I added template support for netfilter. You start as usual and pass some arguments on the command line after the filter file:

--netfilter=filter-file,arg1,arg2,arg3

Firejail will replace $ARG1, $ARG2 and $ARG3 in your filter file with arg1, arg2, and arg3. Up to 16 arguments are allowed. There is a small example in /etc/firejail/tcpserver.net file. Let me know if you run into problems.

@netblue30 commented on GitHub (Nov 18, 2017): I added template support for netfilter. You start as usual and pass some arguments on the command line after the filter file: ````` --netfilter=filter-file,arg1,arg2,arg3 ````` Firejail will replace $ARG1, $ARG2 and $ARG3 in your filter file with arg1, arg2, and arg3. Up to 16 arguments are allowed. There is a small example in /etc/firejail/tcpserver.net file. Let me know if you run into problems.

gitea-mirror referenced this issue

2026-05-05 10:08:58 -06:00

[PR #1100] [CLOSED] Rewrite X11 handling and add --x11=xvfb mode. #3846

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1100

No description provided.

Rows
Columns