github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1902] firecfg and user restrictions #1279

New issue

Closed

opened 2026-05-05 07:46:54 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 07:46:54 -06:00

Owner

Originally created by @reinerh on GitHub (Apr 22, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1902

Installing firejail symlinks in /usr/local/bin with firecfg and having user restrictions does not play well together.
/usr/local/bin is normally in the PATH of every user, so if there is a symlink to a firejailed program, this program is started through firejail.
But if also a user restriction is active and the user is not in the allowed list, the programs refuse to start.

(For example someone upgrades firejail from the previous version and already has symlinks installed and allows a single user for firejail usage, the other system users have to workaround calling firejail by removing /usr/local/bin from their PATH (which might be undesirable because of other legitimate programs in there).)

To make this more graceful, could firejail instead of denying to run the program just drop all privileges and run the program unjailed, if it's called via symlinks and the user is not in the whitelist (and maybe also print a warning that the program is run unjailed)?
Or otherwise at least print a noticable warning when running firecfg that users not in the whitelist will have issues running the symlinked programs.

Originally created by @reinerh on GitHub (Apr 22, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1902 Installing firejail symlinks in /usr/local/bin with firecfg and having user restrictions does not play well together. /usr/local/bin is normally in the PATH of every user, so if there is a symlink to a firejailed program, this program is started through firejail. But if also a user restriction is active and the user is not in the allowed list, the programs refuse to start. (For example someone upgrades firejail from the previous version and already has symlinks installed and allows a single user for firejail usage, the other system users have to workaround calling firejail by removing /usr/local/bin from their PATH (which might be undesirable because of other legitimate programs in there).) To make this more graceful, could firejail instead of denying to run the program just drop all privileges and run the program unjailed, if it's called via symlinks and the user is not in the whitelist (and maybe also print a warning that the program is run unjailed)? Or otherwise at least print a noticable warning when running firecfg that users not in the whitelist will have issues running the symlinked programs.

gitea-mirror closed this issue

2026-05-05 07:47:02 -06:00

gitea-mirror commented

2026-05-05 07:47:05 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Apr 22, 2018):

Yes, my only concern is that a user won't notice the warning resulting in them thinking their programs are sandboxed. How would we ensure the user knows when launching through their DE and not a terminal?

@SkewedZeppelin commented on GitHub (Apr 22, 2018): Yes, my only concern is that a user won't notice the warning resulting in them thinking their programs are sandboxed. How would we ensure the user knows when launching through their DE and not a terminal?

gitea-mirror commented

2026-05-05 07:47:07 -06:00

Author

Owner

@reinerh commented on GitHub (Apr 22, 2018):

I agree it's not the best solution.
And now that you mention it, what about users that have private symlinks in their home directory to firejail? They might not notice that the firejail protection is suddenly no longer there.

@reinerh commented on GitHub (Apr 22, 2018): I agree it's not the best solution. And now that you mention it, what about users that have private symlinks in their home directory to firejail? They might not notice that the firejail protection is suddenly no longer there.

gitea-mirror commented

2026-05-05 07:47:08 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 23, 2018):

I have a fix in: 90877c63ee

It will attempt to run the program without sandboxing if the user is not in the list.

@netblue30 commented on GitHub (Apr 23, 2018): I have a fix in: https://github.com/netblue30/firejail/commit/90877c63eecf5e161c86df6b0c62006029e2677e It will attempt to run the program without sandboxing if the user is not in the list.

gitea-mirror referenced this issue

2026-05-05 10:10:10 -06:00

[PR #1279] [MERGED] Fix VLC GUI artifacts #1277 #3908

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1279

No description provided.

Rows
Columns