[GH-ISSUE #2023] Cannot whitelist path in /run #1362

New issue

Closed

opened 2026-05-05 07:55:44 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 07:55:44 -06:00

Owner

Originally created by @silbe on GitHub (Jul 3, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2023

Running into a similar issue as #739, only this time it's the /run directory that cannot be white-listed.

I've been forwarding the gpg-agent SSH socket into a particular jail environment so that I can use remote git repositories that are only accessible using a key located on my OpenPGP card (hardware token). This worked fine in Debian Jessie because the socket was located in the home directory, but with the Debian Stretch version of GnuPG the socket moved to somewhere below /run/user.

Is there any way to work around this issue (other than setting up elaborate socket forwarding chains using socat et al.)?

Originally created by @silbe on GitHub (Jul 3, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2023 Running into a similar issue as #739, only this time it's the `/run` directory that cannot be white-listed. I've been forwarding the `gpg-agent` SSH socket into a particular jail environment so that I can use remote git repositories that are only accessible using a key located on my OpenPGP card (hardware token). This worked fine in Debian Jessie because the socket was located in the home directory, but with the Debian Stretch version of GnuPG the socket moved to somewhere below `/run/user`. Is there any way to work around this issue (other than setting up elaborate socket forwarding chains using `socat` et al.)?

gitea-mirror closed this issue

2026-05-05 07:55:46 -06:00

gitea-mirror commented

2026-05-05 07:55:47 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Jul 3, 2018):

See writable-run-user, from the man page:

Disable the default blacklisting of run/user/$UID/systemd and /run/user/$UID/gnupg

It was added in 0.9.52

@SkewedZeppelin commented on GitHub (Jul 3, 2018): See `writable-run-user`, from the man page: > Disable the default blacklisting of run/user/$UID/systemd and /run/user/$UID/gnupg It was added in 0.9.52

gitea-mirror commented

2026-05-05 07:55:48 -06:00

Author

Owner

@silbe commented on GitHub (Jul 3, 2018):

Great, thanks! Updated to firejail 0.9.54 from Stretch backports, replaced --noblacklist="${SSH_AUTH_SOCK}" with --writable-run-user and tweaked the --noblacklist params (apparently all dot-files are blacklisted by default now). Now it works again.

@silbe commented on GitHub (Jul 3, 2018): Great, thanks! Updated to firejail 0.9.54 from Stretch backports, replaced `--noblacklist="${SSH_AUTH_SOCK}"` with `--writable-run-user` and tweaked the `--noblacklist` params (apparently all dot-files are blacklisted by default now). Now it works again.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1362

No description provided.

Rows
Columns