github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1823] disable-devel.inc does not blacklist python and node #1241

New issue

Closed

opened 2026-05-05 07:42:58 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 07:42:58 -06:00

Owner

Originally created by @punksta on GitHub (Mar 22, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1823

firejail --profile="/etc/firejail/disable-devel.inc" node
firejail --profile="/etc/firejail/disable-devel.inc" npm
firejail --profile="/etc/firejail/disable-devel.inc" yarn
firejail --profile="/etc/firejail/disable-devel.inc" python
firejail --profile="/etc/firejail/disable-devel.inc" python3
firejail --profile="/etc/firejail/disable-devel.inc" javac
firejail --profile="/etc/firejail/disable-devel.inc" java

I think there is a lot languages which are missing there. Does it give any security when we have only few of them?

also: there is an option to disable bash?

Originally created by @punksta on GitHub (Mar 22, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1823 ``` firejail --profile="/etc/firejail/disable-devel.inc" node firejail --profile="/etc/firejail/disable-devel.inc" npm firejail --profile="/etc/firejail/disable-devel.inc" yarn firejail --profile="/etc/firejail/disable-devel.inc" python firejail --profile="/etc/firejail/disable-devel.inc" python3 firejail --profile="/etc/firejail/disable-devel.inc" javac firejail --profile="/etc/firejail/disable-devel.inc" java ``` I think there is a lot languages which are missing there. Does it give any security when we have only few of them? also: there is an option to disable `bash`?

gitea-mirror

2026-05-05 07:42:58 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 07:43:05 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Mar 22, 2018):

For python, we tried enabling it in d287140250, but disabled it in f374c79aa7. The issue with including it in disable-devel.inc is that lots of applications - hexchat, for instance - often need a python shell but don't need access to compilers like gcc, which are also blacklisted in disable-devel.inc.

Possibly we could consider a new disable-interpreters.inc or something like that with python, ruby, perl, node, and so on. Any thoughts @netblue30 @SkewedZeppelin @smitsohu ?

Anything with a private-bin filter that doesn't include bash will disable it. You could also do something like:
--blacklist=/bin/bash --blacklist=/usr/bin/bash but you'd need to make sure you blacklist all the paths to bash.

@Fred-Barclay commented on GitHub (Mar 22, 2018): For python, we tried enabling it in d287140250544a15b07fe2e13e8cd45f398e0d1e, but disabled it in f374c79aa7d8248cc8a44d773f140966030f30a8. The issue with including it in disable-devel.inc is that lots of applications - hexchat, for instance - often need a python shell but **don't** need access to compilers like gcc, which are also blacklisted in disable-devel.inc. Possibly we could consider a new `disable-interpreters.inc` or something like that with python, ruby, perl, node, and so on. Any thoughts @netblue30 @SkewedZeppelin @smitsohu ? Anything with a private-bin filter that doesn't include bash will disable it. You could also do something like: `--blacklist=/bin/bash --blacklist=/usr/bin/bash` but you'd need to make sure you blacklist all the paths to bash.

gitea-mirror commented

2026-05-05 07:43:06 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Mar 22, 2018):

We should add javac, npm, and yarn to disable-devel.inc.

And a disable-interpreters.inc would be nice with ~~java~~, python, and node. We should be able to add it to most profiles.

@SkewedZeppelin commented on GitHub (Mar 22, 2018): We should add javac, npm, and yarn to disable-devel.inc. And a disable-interpreters.inc would be nice with ~~java~~, python, and node. We should be able to add it to most profiles.

gitea-mirror commented

2026-05-05 07:43:09 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Mar 23, 2018):

@SkewedZeppelin ruby, perl, php in disable-interpreters? Php I'm least sure about.

@Fred-Barclay commented on GitHub (Mar 23, 2018): @SkewedZeppelin ruby, perl, php in disable-interpreters? Php I'm least sure about.

gitea-mirror commented

2026-05-05 07:43:11 -06:00

Author

Owner

@punksta commented on GitHub (Mar 23, 2018):

java isn't interpretable, maybe it'd better to name it disable-computer-languages?

@punksta commented on GitHub (Mar 23, 2018): java isn't interpretable, maybe it'd better to name it `disable-computer-languages`?

gitea-mirror commented

2026-05-05 07:43:14 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Mar 23, 2018):

Or maybe disable-compilers (to replace disable-devel) and disable-interpreters. But then java is a bit of a hybrid... I'm going to give myself a headache from overthinking. 😄

I'm thinking perl, python, ruby, php, node??? in disable-interpreters.
Gcc and all other c or c++ stuff, java, go, rust, openSSL, npm, node??? in disable-devel.

@SkewedZeppelin I'll try and submit a PR for review soon.

@Fred-Barclay commented on GitHub (Mar 23, 2018): Or maybe `disable-compilers` (to replace `disable-devel`) and `disable-interpreters`. But then java is a bit of a hybrid... I'm going to give myself a headache from overthinking. :smile: I'm thinking perl, python, ruby, php, node??? in disable-interpreters. Gcc and all other c or c++ stuff, java, go, rust, openSSL, npm, node??? in disable-devel. @SkewedZeppelin I'll try and submit a PR for review soon.

gitea-mirror commented

2026-05-05 07:43:15 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Mar 23, 2018):

Also is there a reason that we generally blacklist full paths to compilers and interpreters instead of using ${PATH}? We're already using ${PATH} in disable-common, and I suspect we should be using it in disable-devel/interpreters as well.

@Fred-Barclay commented on GitHub (Mar 23, 2018): Also is there a reason that we generally blacklist full paths to compilers and interpreters instead of using ${PATH}? We're already using ${PATH} in disable-common, and I suspect we should be using it in disable-devel/interpreters as well.

gitea-mirror commented

2026-05-05 07:43:17 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Apr 4, 2018):

@punksta We've added disable-interpreters in #1837
Cheers!

@Fred-Barclay commented on GitHub (Apr 4, 2018): @punksta We've added disable-interpreters in #1837 Cheers!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1241

No description provided.

Rows
Columns