#1112 - [GH-ISSUE #1650] Whitelist/Backlist with subfolders (mount points - ZFS) - github-starred/firejail

gitea-mirror commented

2026-05-05 07:28:10 -06:00

Owner

Originally created by @nicovs on GitHub (Nov 16, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1650

In my server setup I have a ZFS filesystem folder structure where each users has his own ZFS filesystem

/zfspool
/zfspool/config
/zfspool/userhomes
/zfspool/userhomes/user1
/zfspool/userhomes/user2
/zfspool/userhomes/user3
...

What I would like to achieve is that when a user logs in, he/she can see only his/her own homefolder (and mount point)
eg, when i ssh into the server as user user2, when the user does an ls on /zfspool/userhomes, he only see's /zfspool/userhomes/user2, but not the other folders.

What I've got this far, with blacklisting is that the users can see all home folders from other users, just not the content, like this:

user2@server:~$ ls /zfspool/userhomes
ls: cannot open directory '/zfspool/userhomes/user1': Permission denied
/zfspool/userhomes/user2:
anotherfile.txt file.log folder1 folder2 morefolders morefiles.sh
ls: cannot open directory '/zfspool/userhomes/user3': Permission denied
ls: cannot open directory '/zfspool/userhomes/user4': Permission denied

So, how can I achieve only seeing:

user2@server:~$ ls /zfspool/userhomes
/zfspool/userhomes/user2:
anotherfile.txt file.log folder1 folder2 morefolders morefiles.sh

My login.users:

user*:--profile=/etc/firejail/shared_ssh_jail.profile --x11=none --rmenv=PROMPT_COMMAND --shell=/bin/bash -- /bin/bash --login

My profile /etc/firejail/shared_ssh_jail.profile:

quiet

include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-programs.inc

caps.drop all
netfilter
nodvd
nogroups
nonewprivs
noroot
nosound
notv

private
noblacklist ${HOME}/
blacklist /zfspool/c*
blacklist/zfspool/userhomes/*

private-bin sh,bash,mesg,ls,nano,git,git-core,mysql,echo,cp,rm,mv,ln,date,grep,egrep,fgrep,dir,vdir,groups,df,du,python,python3,cat,ps,tail,ping,hostwget,curl,drush,env,wp,which,less,more,tail,head,dig,touch,vi,vim,vim-basic
private-etc group,hostname,localtime,nsswitch.conf,passwd,resolv.conf
private-tmp

Originally created by @nicovs on GitHub (Nov 16, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1650 In my server setup I have a ZFS filesystem folder structure where each users has his own ZFS filesystem - /zfspool - /zfspool/config - /zfspool/userhomes - /zfspool/userhomes/user1 - /zfspool/userhomes/user2 - /zfspool/userhomes/user3 - ... What I would like to achieve is that when a user logs in, he/she can see only his/her own homefolder (and mount point) eg, when i ssh into the server as user user2, when the user does an ls on /zfspool/userhomes, he only see's /zfspool/userhomes/user2, but not the other folders. What I've got this far, with blacklisting is that the users can see all home folders from other users, just not the content, like this: ``` user2@server:~$ ls /zfspool/userhomes ls: cannot open directory '/zfspool/userhomes/user1': Permission denied /zfspool/userhomes/user2: anotherfile.txt file.log folder1 folder2 morefolders morefiles.sh ls: cannot open directory '/zfspool/userhomes/user3': Permission denied ls: cannot open directory '/zfspool/userhomes/user4': Permission denied ``` So, how can I achieve only seeing: ``` user2@server:~$ ls /zfspool/userhomes /zfspool/userhomes/user2: anotherfile.txt file.log folder1 folder2 morefolders morefiles.sh ``` My login.users: ``` user*:--profile=/etc/firejail/shared_ssh_jail.profile --x11=none --rmenv=PROMPT_COMMAND --shell=/bin/bash -- /bin/bash --login ``` My profile /etc/firejail/shared_ssh_jail.profile: ``` quiet include /etc/firejail/disable-common.inc include /etc/firejail/disable-devel.inc include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-programs.inc caps.drop all netfilter nodvd nogroups nonewprivs noroot nosound notv private noblacklist ${HOME}/ blacklist /zfspool/c* blacklist/zfspool/userhomes/* private-bin sh,bash,mesg,ls,nano,git,git-core,mysql,echo,cp,rm,mv,ln,date,grep,egrep,fgrep,dir,vdir,groups,df,du,python,python3,cat,ps,tail,ping,hostwget,curl,drush,env,wp,which,less,more,tail,head,dig,touch,vi,vim,vim-basic private-etc group,hostname,localtime,nsswitch.conf,passwd,resolv.conf private-tmp ```

gitea-mirror

2026-05-05 07:28:10 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 07:28:14 -06:00

Author

Owner

@smitsohu commented on GitHub (Nov 16, 2017):

If I understand it correctly, would it help to --whitelist=/zfspool/userhomes/$USER? This will not work in the profile, only on the commandline.

Edit: Sorry, this is only possible if zfspool is in a whitelistable path, i.e. /home, /dev, /media, /mnt, /opt, /srv, /var or /tmp

@smitsohu commented on GitHub (Nov 16, 2017): If I understand it correctly, would it help to `--whitelist=/zfspool/userhomes/$USER`? This will not work in the profile, only on the commandline. Edit: Sorry, this is only possible if zfspool is in a whitelistable path, i.e. /home, /dev, /media, /mnt, /opt, /srv, /var or /tmp

gitea-mirror commented

2026-05-05 07:28:16 -06:00

Author

Owner

@nicovs commented on GitHub (Nov 16, 2017):

Hi @smitsohu, i might be able to change my zfspool to /srv eg.
no option to add /data as a whitelistable path? :) (my actual location os /data, not /zfspool. this was as an example.

@nicovs commented on GitHub (Nov 16, 2017): Hi @smitsohu, i might be able to change my zfspool to /srv eg. no option to add /data as a whitelistable path? :) (my actual location os /data, not /zfspool. this was as an example.

gitea-mirror commented

2026-05-05 07:28:18 -06:00

Author

Owner

@nicovs commented on GitHub (Nov 17, 2017):

To give more feedback @smitsohu:

Changed my /etc/passwd from:

myusername:1001:1001::/data/userhomes/myusername:bin/bash
to:
myusername:1001:1001::/srv/myusername/:/usr/bin/firejail

Mind the / after the homedir /srv/myusername/, if not, you'll get the error:

Error: file /srv/sitepro.nicovs.com is not in the whitelisted directory
Error: proc 7177 cannot sync with peer: unexpected EOF
Peer 7178 unexpectedly exited with status 1

login.users:

myusername:--profile=/etc/firejail/shared_ssh_jail.profile --whitelist=/srv/myusername --x11=none --rmenv=PROMPT_COMMAND --shell=/bin/bash -- /bin/bash --login
username2:--profile=/etc/firejail/shared_ssh_jail.profile --whitelist=/srv/username2 --x11=none --rmenv=PROMPT_COMMAND --shell=/bin/bash -- /bin/bash --login
anotheruser:--profile=/etc/firejail/shared_ssh_jail.profile --whitelist=/srv/anotheruser --x11=none --rmenv=PROMPT_COMMAND --shell=/bin/bash -- /bin/bash --login

the profile:

blacklist /data*

private-bin sh,bash,mesg,ls,nano,git,git-core,mysql,echo,cp,rm,mv,ln,date,grep,egrep,fgrep,dir,vdir,groups,df,du,python,python3,cat,ps,tail,ping,host,php7.0,php5.6,php7.1,wget,curl,drush,env,wp,which,php,less,more,tail,head,dig,touch,vi,vim,vim-basic,find
private-etc group,hostname,localtime,nsswitch.conf,passwd,resolv.conf
private-opt ls
private-tmp

# Miscellaneous options
seccomp

Together with my good old friend autofs :)

/etc/auto.master:

+auto.master
/srv     autofs.sshjail

/etc/autofs.sshjail

* -fstype=bind :/data/userhomes/&

Yes, this is some funky workaround: I cannot just change the zfs mountpoints. Too much hardcoded stuff inside the folders

@nicovs commented on GitHub (Nov 17, 2017): To give more feedback @smitsohu: Changed my /etc/passwd from: ```myusername:1001:1001::/data/userhomes/myusername:bin/bash``` to: ```myusername:1001:1001::/srv/myusername/:/usr/bin/firejail``` - Mind the / after the homedir `/srv/myusername/`, if not, you'll get the error: ``` Error: file /srv/sitepro.nicovs.com is not in the whitelisted directory Error: proc 7177 cannot sync with peer: unexpected EOF Peer 7178 unexpectedly exited with status 1 ``` login.users: ``` myusername:--profile=/etc/firejail/shared_ssh_jail.profile --whitelist=/srv/myusername --x11=none --rmenv=PROMPT_COMMAND --shell=/bin/bash -- /bin/bash --login username2:--profile=/etc/firejail/shared_ssh_jail.profile --whitelist=/srv/username2 --x11=none --rmenv=PROMPT_COMMAND --shell=/bin/bash -- /bin/bash --login anotheruser:--profile=/etc/firejail/shared_ssh_jail.profile --whitelist=/srv/anotheruser --x11=none --rmenv=PROMPT_COMMAND --shell=/bin/bash -- /bin/bash --login ``` the profile: ``` blacklist /data* private-bin sh,bash,mesg,ls,nano,git,git-core,mysql,echo,cp,rm,mv,ln,date,grep,egrep,fgrep,dir,vdir,groups,df,du,python,python3,cat,ps,tail,ping,host,php7.0,php5.6,php7.1,wget,curl,drush,env,wp,which,php,less,more,tail,head,dig,touch,vi,vim,vim-basic,find private-etc group,hostname,localtime,nsswitch.conf,passwd,resolv.conf private-opt ls private-tmp # Miscellaneous options seccomp ``` Together with my good old friend autofs :) /etc/auto.master: ``` +auto.master /srv autofs.sshjail ``` /etc/autofs.sshjail ``` * -fstype=bind :/data/userhomes/& ``` Yes, this is some funky workaround: I cannot just change the zfs mountpoints. Too much hardcoded stuff inside the folders

gitea-mirror commented

2026-05-05 07:28:20 -06:00

Author

Owner

@smitsohu commented on GitHub (Nov 17, 2017):

Cool! But it works :) I guess this can be closed then?

@smitsohu commented on GitHub (Nov 17, 2017): Cool! But it works :) I guess this can be closed then?

gitea-mirror commented

2026-05-05 07:28:21 -06:00

Author

Owner

@nicovs commented on GitHub (Nov 17, 2017):

just checking some more stuff.... seems it's not 100% yet 🗡

@nicovs commented on GitHub (Nov 17, 2017): just checking some more stuff.... seems it's not 100% yet 🗡

gitea-mirror commented

2026-05-05 07:28:22 -06:00

Author

Owner

@nicovs commented on GitHub (Nov 17, 2017):

Ok, all checked out and working. Changed the login.users in my comment above. Seems you cannot user --whitelist=${HOME} or --whitelist=~/ but you need to use the full path.

Can be closed

@nicovs commented on GitHub (Nov 17, 2017): Ok, all checked out and working. Changed the login.users in my comment above. Seems you cannot user `--whitelist=${HOME}` or `--whitelist=~/` but you need to use the full path. Can be closed

gitea-mirror commented

2026-05-05 07:28:25 -06:00

Author

Owner

@smitsohu commented on GitHub (Nov 17, 2017):

Closed. Thanks for sharing.

@smitsohu commented on GitHub (Nov 17, 2017): Closed. Thanks for sharing.

Rows
Columns

[GH-ISSUE #1650] Whitelist/Backlist with subfolders (mount points - ZFS) #1112