[GH-ISSUE #158] read-only/whitelist bug #111

New issue

Closed

opened 2026-05-05 05:03:37 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 05:03:37 -06:00

Owner

Originally created by @ghost on GitHub (Nov 25, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/158

When I whitelist a subdirectory, --read-only=~/ now includes the parent of the subdirectory.

The example explains it better:

$ mkdir -p a b/c

$ firejail --whitelist=~/a/ --whitelist=~/b/ --read-only=~/
[anon@jail ~]$ touch f a/f b/f
touch: cannot touch ‘f’: Read-only file system
[anon@jail ~]$ rm a/f b/f 
[anon@jail ~]$ exit

$ firejail --whitelist=~/a/ --whitelist=~/b/c/ --read-only=~/
[anon@jail ~]$ touch f a/f b/f
touch: cannot touch ‘f’: Read-only file system
touch: cannot touch ‘b/f’: Read-only file system
[anon@jail ~]$ rm a/f 
[anon@jail ~]$ exit

Originally created by @ghost on GitHub (Nov 25, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/158 When I whitelist a subdirectory, --read-only=~/ now includes the parent of the subdirectory. The example explains it better: ``` $ mkdir -p a b/c $ firejail --whitelist=~/a/ --whitelist=~/b/ --read-only=~/ [anon@jail ~]$ touch f a/f b/f touch: cannot touch ‘f’: Read-only file system [anon@jail ~]$ rm a/f b/f [anon@jail ~]$ exit $ firejail --whitelist=~/a/ --whitelist=~/b/c/ --read-only=~/ [anon@jail ~]$ touch f a/f b/f touch: cannot touch ‘f’: Read-only file system touch: cannot touch ‘b/f’: Read-only file system [anon@jail ~]$ rm a/f [anon@jail ~]$ exit ```

gitea-mirror closed this issue

2026-05-05 05:03:40 -06:00

gitea-mirror commented

2026-05-05 05:03:44 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 26, 2015):

The reason for the problem is you have a tmpfs mounted on ~/ and ~/a and ~/b are bind-mounted as separate filesystems. Each filesystem will have to be made read-only independently, in your case:

$ firejail --whitelist=~/a/ --whitelist=~/b/ --read-only=~/ --read-only=~/a --read-only=~/b

A fix is possible, however, it will be very complicated. I documented the behavior in the man page in the upcoming version, maybe I'll revisit the issue in the feature. Thanks!

@netblue30 commented on GitHub (Nov 26, 2015): The reason for the problem is you have a tmpfs mounted on ~/ and ~/a and ~/b are bind-mounted as separate filesystems. Each filesystem will have to be made read-only independently, in your case: ``` $ firejail --whitelist=~/a/ --whitelist=~/b/ --read-only=~/ --read-only=~/a --read-only=~/b ``` A fix is possible, however, it will be very complicated. I documented the behavior in the man page in the upcoming version, maybe I'll revisit the issue in the feature. Thanks!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#111

No description provided.

Rows
Columns