github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1769] How to globally block networking, camera, microphone, etc. and allow by exception? #1198

New issue

Closed

opened 2026-05-05 07:38:35 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 07:38:35 -06:00

Owner

Originally created by @ghost on GitHub (Feb 8, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1769

Originally created by @ghost on GitHub (Feb 8, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1769

gitea-mirror

2026-05-05 07:38:35 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 07:38:39 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Feb 8, 2018):

Add the following lines to /etc/firejail/globals.local

net none
nosound
novideo
protocol unix

then in all the profiles you don't want it you can either comment out include /etc/firejail/globals.local in /etc/firejail/[program].profile
or
individually using ignore [option] eg. ignore novideo in /etc/firejail/[program].local.

Be warned that net none will prevent apps from saving settings with D-Conf, however protocol unix will still block network access.

@SkewedZeppelin commented on GitHub (Feb 8, 2018): Add the following lines to /etc/firejail/globals.local ``` net none nosound novideo protocol unix ``` then in all the profiles you don't want it you can either comment out `include /etc/firejail/globals.local` in `/etc/firejail/[program].profile` or individually using `ignore [option]` eg. `ignore novideo` in `/etc/firejail/[program].local`. Be warned that `net none` will prevent apps from saving settings with D-Conf, however `protocol unix` will still block network access.

gitea-mirror commented

2026-05-05 07:38:40 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Feb 8, 2018):

I guess I overlooked that part, I do no think there is currently a way to achieve that then.

@SkewedZeppelin commented on GitHub (Feb 8, 2018): I guess I overlooked that part, I do no think there is currently a way to achieve that then.

gitea-mirror commented

2026-05-05 07:38:42 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 9, 2018):

I wonder if it would be easier to basically allow mixing whitelist and blacklist in the same directive (as systemd does) - for example, if this were implemented, you could just do protocol unix,~tcp (meaning whitelist unix and blacklist tcp) or something to override whatever is in globals.local.

@chiraag-nataraj commented on GitHub (Jul 9, 2018): I wonder if it would be easier to basically allow mixing whitelist and blacklist in the same directive (as `systemd` does) - for example, if this were implemented, you could just do `protocol unix,~tcp` (meaning whitelist `unix` and blacklist `tcp`) or something to override whatever is in `globals.local`.

gitea-mirror commented

2026-05-05 07:38:43 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 24, 2018):

@rekixex The solution I came up with worked when I was designing my own profiles, and I guess it might be useful for you as well. I split up the specific predicates I might need to undo later into different files. In my case, I wanted to be able to independently use noexec on ~ and /tmp. But yeah, right now it's tedious. I think we should move discussion of the issues with ignore to #2039. Seeing as how the original question was answered (how to block stuff by default), I'm going to close this.

@chiraag-nataraj commented on GitHub (Jul 24, 2018): @rekixex The solution I came up with worked when I was designing my own profiles, and I guess it might be useful for you as well. I split up the specific predicates I might need to undo later into different files. In my case, I wanted to be able to independently use `noexec` on `~` and `/tmp`. But yeah, right now it's tedious. I think we should move discussion of the issues with `ignore` to #2039. Seeing as how the original question was answered (how to block stuff by default), I'm going to close this.

gitea-mirror referenced this issue

2026-05-05 10:09:36 -06:00

[PR #1198] [MERGED] Okular and Gwenview profiles, Baloo blacklist #3878

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1198

No description provided.

Rows
Columns