github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1649] Folder /files is Accessible in Chrome #1111

New issue

Closed

opened 2026-05-05 07:28:10 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 07:28:10 -06:00

Owner

Originally created by @cryptogun on GitHub (Nov 16, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1649

Isn't whitelist mode the default mode and block anything in the list?
I created a folder files under Linux root directory / and stored all organized files in it.
Now I found that besides ~/Downloads, I can access the new folder /files in Chrome.
I'd prefer a whitelist mode for all applications.
Tried re-clone and install, no help.

Originally created by @cryptogun on GitHub (Nov 16, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1649 Isn't whitelist mode the default mode and block anything in the list? I created a folder `files` under Linux root directory `/` and stored all organized files in it. Now I found that besides `~/Downloads`, I can access the new folder `/files` in Chrome. I'd prefer a whitelist mode for all applications. Tried re-clone and install, no help.

gitea-mirror

2026-05-05 07:28:10 -06:00

closed this issue
added the
question_old
label

gitea-mirror commented

2026-05-05 07:28:14 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Nov 16, 2017):

The easiest way to resolve this is to create local profiles in ~/.config/firejail, which will then take precedent. Recently the default profiles were strengthened considerably, especially when it comes to access to files in the home directory. If you want to set up a whitelist mode, you could create /etc/firejail/globals.local (which I believe is sourced by most/all profiles) or /etc/firejail/default.local (which is sourced by the default profile only). I think the reason this isn't the default is that it has the potential to break many more things by default (right @netblue30?) and the idea is that firejail should be easy and painless to use.

@chiraag-nataraj commented on GitHub (Nov 16, 2017): The easiest way to resolve this is to create local profiles in `~/.config/firejail`, which will then take precedent. Recently the default profiles were strengthened considerably, especially when it comes to access to files in the home directory. If you want to set up a whitelist mode, you could create `/etc/firejail/globals.local` (which I believe is sourced by most/all profiles) or `/etc/firejail/default.local` (which is sourced by the default profile only). I think the reason this isn't the default is that it has the potential to break many more things by default (right @netblue30?) and the idea is that firejail should be easy and painless to use.

gitea-mirror commented

2026-05-05 07:28:16 -06:00

Author

Owner

@curiosity-seeker commented on GitHub (Nov 16, 2017):

I created a folder files under Linux root directory / and stored all organized files in it.
Now I found that besides ~/Downloads, I can access the new folder /files in Chrome.

Yes, this is expected. The whitelist switch does not apply to that new folder. man firejail explicitly says:

The top directory could be user home, /dev, /media, /mnt, /opt, /srv, /var, and /tmp.

So to prevent any access to that folder you should create this rule:

blacklist /files

in /etc/firejail/globals.local as suggested by @chiraag-nataraj

@curiosity-seeker commented on GitHub (Nov 16, 2017): > I created a folder files under Linux root directory / and stored all organized files in it. Now I found that besides ~/Downloads, I can access the new folder /files in Chrome. Yes, this is expected. The `whitelist` switch does not apply to that new folder. `man firejail` explicitly says: > The top directory could be user home, /dev, /media, /mnt, /opt, /srv, /var, and /tmp. So to prevent any access to that folder you should create this rule: `blacklist /files` in `/etc/firejail/globals.local` as suggested by @chiraag-nataraj

gitea-mirror commented

2026-05-05 07:28:18 -06:00

Author

Owner

@cryptogun commented on GitHub (Nov 17, 2017):

Got it. My globals is under /usr/local/etc/firejail/

Maybe I should move my folders to home directory. Because Dropbox failed to start today...

Error: only directories in user home or /tmp are supported by mkdir
Error: invalid whitelist path /files/secret__dropbox/Dropbox

@cryptogun commented on GitHub (Nov 17, 2017): Got it. My `globals` is under `/usr/local/etc/firejail/` Maybe I should move my folders to home directory. Because Dropbox failed to start today... `Error: only directories in user home or /tmp are supported by mkdir` `Error: invalid whitelist path /files/secret__dropbox/Dropbox`

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1111

No description provided.

Rows
Columns