github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1812] What is the best way to move a file outside a private jail ? #1231

New issue

Closed

opened 2026-05-05 07:41:51 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 07:41:51 -06:00

Owner

Originally created by @thiswillbeyourgithub on GitHub (Mar 12, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1812

Hi,

Here's the situation : I occasionnaly create private jails to run firefox using firejail --private firefox -no-remote -private, this way it is in no way altered by the amount of extensions and addons I have normally running ^^.

The issue is that sometimes I end up having to download a file using this instance of firefox and I can't access it with the rest of the system. Sure using firejail --join=XXXX I can see it in the terminal but I can't seem to move it anywhere outside the chroot. Which in a way is good, it shows great security.

So here's my question : what is the best way to access a file downloaded in a private jail and move it outside the jail ? if there's any.

Your lights on this would really help :)

Thanks !

Originally created by @thiswillbeyourgithub on GitHub (Mar 12, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1812 Hi, Here's the situation : I occasionnaly create private jails to run firefox using `firejail --private firefox -no-remote -private`, this way it is in no way altered by the amount of extensions and addons I have normally running ^^. The issue is that sometimes I end up having to download a file using this instance of firefox and I can't access it with the rest of the system. Sure using `firejail --join=XXXX` I can see it in the terminal but I can't seem to move it anywhere outside the chroot. Which in a way is good, it shows great security. So here's my question : what is the best way to access a file downloaded in a private jail and move it outside the jail ? if there's any. Your lights on this would really help :) Thanks !

gitea-mirror

2026-05-05 07:41:51 -06:00

closed this issue
added the
question_old
label

gitea-mirror commented

2026-05-05 07:41:55 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Mar 12, 2018):

You can switch to using --private=directory, but if you goal is to prevent writing to disk that wouldn't work.
You can use mkdir /tmp/xyz, --private=/tmp/xyz and later rm -rf but it'd be a bit tedious.

I guess you could make a bash script like

#!/bin/bash
fjdir=$(mktemp -d)
echo "Saving files to $fjdir, please copy them out before exiting"
firejail --private=$fjdir $1
rm -rf $fjdir

save somewhere and just invoke it like "./fjtmp firefox"
you can also substitute rm -rf with srm -rfv

be warned there are a few distros in which /tmp is written to disk and not simply in ram

@SkewedZeppelin commented on GitHub (Mar 12, 2018): You can switch to using `--private=directory`, but if you goal is to prevent writing to disk that wouldn't work. You can use `mkdir /tmp/xyz`, `--private=/tmp/xyz` and later `rm -rf` but it'd be a bit tedious. I guess you could make a bash script like ``` #!/bin/bash fjdir=$(mktemp -d) echo "Saving files to $fjdir, please copy them out before exiting" firejail --private=$fjdir $1 rm -rf $fjdir ``` save somewhere and just invoke it like "./fjtmp firefox" you can also substitute `rm -rf` with `srm -rfv` be warned there are a few distros in which /tmp **is** written to disk and not simply in ram

gitea-mirror commented

2026-05-05 07:41:57 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 13, 2018):

You can grab them with --get=XXXX - in the man page:

FILE TRANSFER
       These features allow the user to inspect the filesystem  container  of
       an  existing sandbox and transfer files from the container to the host
       filesystem.

       --get=name|pid filename
              Retrieve the container file and store it on  the  host  in  the
              current  working directory.  The container is specified by name
              or PID.

       --ls=name|pid dir_or_filename
              List container files. The container is  specified  by  name  or
              PID.

       --put=name|pid src-filename dest-filename
              Put src-filename in sandbox container.  The container is speci‐
              fied by name or PID.

       Examples:

              $ firejail --name=mybrowser --private firefox

              $ firejail --ls=mybrowser ~/Downloads
              drwxr-xr-x netblue  netblue         4096 .
              drwxr-xr-x netblue  netblue         4096 ..
              -rw-r--r-- netblue  netblue         7847 x11-x305.png
              -rw-r--r-- netblue  netblue         6800 x11-x642.png
              -rw-r--r-- netblue  netblue        34139 xpra-clipboard.png

              $ firejail --get=mybrowser ~/Downloads/xpra-clipboard.png

              $ firejail --put=mybrowser xpra-clipboard.png ~/Downloads/xpra-
              clipboard.png

@netblue30 commented on GitHub (Mar 13, 2018): You can grab them with --get=XXXX - in the man page: ````` FILE TRANSFER These features allow the user to inspect the filesystem container of an existing sandbox and transfer files from the container to the host filesystem. --get=name|pid filename Retrieve the container file and store it on the host in the current working directory. The container is specified by name or PID. --ls=name|pid dir_or_filename List container files. The container is specified by name or PID. --put=name|pid src-filename dest-filename Put src-filename in sandbox container. The container is speci‐ fied by name or PID. Examples: $ firejail --name=mybrowser --private firefox $ firejail --ls=mybrowser ~/Downloads drwxr-xr-x netblue netblue 4096 . drwxr-xr-x netblue netblue 4096 .. -rw-r--r-- netblue netblue 7847 x11-x305.png -rw-r--r-- netblue netblue 6800 x11-x642.png -rw-r--r-- netblue netblue 34139 xpra-clipboard.png $ firejail --get=mybrowser ~/Downloads/xpra-clipboard.png $ firejail --put=mybrowser xpra-clipboard.png ~/Downloads/xpra- clipboard.png `````

gitea-mirror commented

2026-05-05 07:42:00 -06:00

Author

Owner

@thiswillbeyourgithub commented on GitHub (Mar 13, 2018):

Oh no I totally missed this in the manual :(. Thanks a lot I'm really sorry for the trouble ! I'll close this.

@thiswillbeyourgithub commented on GitHub (Mar 13, 2018): Oh no I totally missed this in the manual :(. Thanks a lot I'm really sorry for the trouble ! I'll close this.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1231

No description provided.

Rows
Columns