github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

stdin unless there's a pseudo-terminal #1204

New issue

Closed

opened 2026-05-05 07:39:07 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 07:39:07 -06:00

Owner

Originally created by @maz on GitHub (Feb 17, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1778

/dev/stdin won't appear in /dev, even if whitelisted, unless there's a pseudo-terminal allocated.

I'm running Ubuntu 16.04.3 LTS with Linux kernel 4.13.0-32-generic

$ firejail --version
firejail version 0.9.52

Compile time support:
	- AppArmor support is disabled
	- AppImage support is enabled
	- bind support is enabled
	- chroot support is enabled
	- file and directory whitelisting support is enabled
	- file transfer support is enabled
	- git install support is disabled
	- networking support is enabled
	- overlayfs support is enabled
	- private-home support is enabled
	- seccomp-bpf support is enabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled

Test case:
In theory, /dev/stdin should be listed in all cases.

#!/bin/bash
set -e -x
firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev
ssh localhost 'firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev'
ssh -t localhost 'firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev'
ssh localhost 'firejail --noprofile --quiet --whitelist=/dev/stdin --whitelist=/dev/pts -c ls -l /dev'

Originally created by @maz on GitHub (Feb 17, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1778 `/dev/stdin` won't appear in `/dev`, even if whitelisted, unless there's a pseudo-terminal allocated. I'm running `Ubuntu 16.04.3 LTS` with Linux kernel `4.13.0-32-generic` ``` $ firejail --version firejail version 0.9.52 Compile time support: - AppArmor support is disabled - AppImage support is enabled - bind support is enabled - chroot support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - git install support is disabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - seccomp-bpf support is enabled - user namespace support is enabled - X11 sandboxing support is enabled ``` Test case: In theory, /dev/stdin should be listed in all cases. ``` #!/bin/bash set -e -x firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev ssh localhost 'firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev' ssh -t localhost 'firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev' ssh localhost 'firejail --noprofile --quiet --whitelist=/dev/stdin --whitelist=/dev/pts -c ls -l /dev' ```

gitea-mirror

2026-05-05 07:39:07 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 07:39:12 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 19, 2018):

It seems to be working from a regular xterm:

$ set -e -x
$ firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev
+ firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev
total 0
drwx-wx--x 2 root root 60 Feb 19 08:46 pts
lrwxrwxrwx 1 root root 10 Feb 19 08:46 stdin -> /dev/pts/3

We do miss them however in --private-dev, I'll add stdin, stdout and stderr.

@netblue30 commented on GitHub (Feb 19, 2018): It seems to be working from a regular xterm: ````` $ set -e -x $ firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev + firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev total 0 drwx-wx--x 2 root root 60 Feb 19 08:46 pts lrwxrwxrwx 1 root root 10 Feb 19 08:46 stdin -> /dev/pts/3 ````` We do miss them however in --private-dev, I'll add stdin, stdout and stderr.

gitea-mirror commented

2026-05-05 07:39:14 -06:00

Author

Owner

@maz commented on GitHub (Feb 21, 2018):

Try the ssh -t localhost 'firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev' command. I found that if I executed the command, from a process that didn't have a pseudoterminal allocated (e.g. using ssh with the -t option), then it wouldn't work. I think the problem is that, when there's no pseudoterminal, /dev/stdin is a symlink to /proc/self/fd/0, and not to /dev/pts/...

@maz commented on GitHub (Feb 21, 2018): Try the `ssh -t localhost 'firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev'` command. I found that if I executed the command, from a process that didn't have a pseudoterminal allocated (e.g. using ssh with the `-t` option), then it wouldn't work. I think the problem is that, when there's no pseudoterminal, `/dev/stdin` is a symlink to `/proc/self/fd/0`, and not to `/dev/pts/...`

gitea-mirror commented

2026-05-05 07:39:15 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 5, 2018):

At least under a regular terminal it is a link to /proc/self/fd/0, so whitelist should duplicate the link, not move it under /dev/pts. It looks like a bug!

@netblue30 commented on GitHub (Mar 5, 2018): At least under a regular terminal it is a link to /proc/self/fd/0, so whitelist should duplicate the link, not move it under /dev/pts. It looks like a bug!

gitea-mirror commented

2026-05-05 07:39:16 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 6, 2018):

I think I have a fix in (dda8b2dbaf):

$ ssh -t localhost 'firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev'
total 0
lrwxrwxrwx 1 root root 15 Mar  6 10:22 stdin -> /proc/self/fd/0
Connection to localhost closed.

You can give it a try, thanks.

@netblue30 commented on GitHub (Mar 6, 2018): I think I have a fix in (https://github.com/netblue30/firejail/commit/dda8b2dbaf85383c787b2e70982346779471a269): ````` $ ssh -t localhost 'firejail --noprofile --quiet --whitelist=/dev/stdin -c ls -l /dev' total 0 lrwxrwxrwx 1 root root 15 Mar 6 10:22 stdin -> /proc/self/fd/0 Connection to localhost closed. ````` You can give it a try, thanks.

gitea-mirror referenced this issue

2026-05-05 07:41:30 -06:00

[GH-ISSUE #1810] Firefox and Chromiun not taking input and not appearning in firejail --list #1228

gitea-mirror referenced this issue

2026-05-05 07:43:29 -06:00

[GH-ISSUE #1836] Keyboard input doesn't work #1248