[GH-ISSUE #1877] CRONTABS for user #1266

New issue

Closed

opened 2026-05-05 07:44:55 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 07:44:55 -06:00

Owner

Originally created by @Gimly86 on GitHub (Apr 10, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1877

Hello All,

Firejail version :

~# dpkg -l|grep firejail
ii firejail 0.9.52-2~bpo9+2 amd64 sandbox to restrict the application environment

I use Firejail to made SSH jail and it work fine.
But I want to know how I can allow user to use their own CRONTAB.

I use a custom profile :
private-bin crontab
noblacklist /var/spool/cron/crontabs/

But, when I test the command crontab in shell, I've this error :

:~$ crontab -e
crontabs/testuser/: fdopen: Permission denied

What I have to do to allow the using of CRONTAB command, please ?

Thanks in advance :)

Originally created by @Gimly86 on GitHub (Apr 10, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1877 Hello All, Firejail version : `~# dpkg -l|grep firejail` `ii firejail 0.9.52-2~bpo9+2 amd64 sandbox to restrict the application environment ` I use Firejail to made SSH jail and it work fine. But I want to know how I can allow user to use their own CRONTAB. I use a custom profile : ` private-bin crontab` `noblacklist /var/spool/cron/crontabs/ ` But, when I test the command crontab in shell, I've this error : `:~$ crontab -e` `crontabs/testuser/: fdopen: Permission denied` What I have to do to allow the using of CRONTAB command, please ? Thanks in advance :)

gitea-mirror

2026-05-05 07:44:55 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 07:45:00 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 15, 2018):

I have here a profile that works (Debian stable):

quiet
noblacklist ${PATH}/crontab
noblacklist /var/spool/cron
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-devel.inc

caps.drop all
private-dev
private-tmp

private-bin and seccomp seem to kill it. At least on Debian crontab seems to be SUID group, it needs to elevate privileges.

@netblue30 commented on GitHub (Apr 15, 2018): I have here a profile that works (Debian stable): ````` quiet noblacklist ${PATH}/crontab noblacklist /var/spool/cron include /etc/firejail/disable-common.inc include /etc/firejail/disable-programs.inc include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-interpreters.inc include /etc/firejail/disable-devel.inc caps.drop all private-dev private-tmp ````` private-bin and seccomp seem to kill it. At least on Debian crontab seems to be SUID group, it needs to elevate privileges.

gitea-mirror referenced this issue

2026-05-05 10:10:05 -06:00

[PR #1266] [MERGED] harden baloo_file #3903

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1266

No description provided.

Rows
Columns