#1366 - [GH-ISSUE #2030] Snapper - **/.snapshots - github-starred/firejail

gitea-mirror commented

2026-05-05 07:56:50 -06:00

Owner

Originally created by @Saren-Arterius on GitHub (Jul 5, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2030

I am using default rules for firefox and I discovered that Snapper+btrfs's /.snapshots is unmasked, which means firefox can access it, also the files intended to protect (ssh keys...)

Please blacklist /.snapshots or even blacklist **/.snapshots if possible in disable-common.inc.

Originally created by @Saren-Arterius on GitHub (Jul 5, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2030 I am using default rules for firefox and I discovered that Snapper+btrfs's /.snapshots is unmasked, which means firefox can access it, also the files intended to protect (ssh keys...) Please `blacklist /.snapshots` or even `blacklist **/.snapshots` if possible in `disable-common.inc`.

gitea-mirror closed this issue

2026-05-05 07:56:54 -06:00

gitea-mirror commented

2026-05-05 07:56:57 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 9, 2018):

Heh. This is why I usually have my own set of profiles with whitelists rather than blacklists. I'll put it in and see what @netblue30 and others think.

@chiraag-nataraj commented on GitHub (Jul 9, 2018): Heh. This is why I usually have my own set of profiles with whitelists rather than blacklists. I'll put it in and see what @netblue30 and others think.

gitea-mirror commented

2026-05-05 07:56:59 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 11, 2018):

@Saren-Arterius Since I don't user snapper at all and don't really know how the layout works (one .snapshots directory per filesystem? one per mountpoint? one global one?), I just blacklisted /.snapshots for now. Honestly, this tells me we should be working towards a generic whitelist-based system in terms of firejail defaults (right now, you can only whitelist stuff with a top directory of ~/, /dev, /etc, /media, /mnt, /opt, /srv, /sys/module, /usr/share, /var, and /tmp). I'm not quite sure why we don't allow a whitelist of arbitrary paths (maybe @netblue30 can answer that?), but that is something I'd like to see (basically, let's give whitelist the same level of generality as blacklist).

@chiraag-nataraj commented on GitHub (Jul 11, 2018): @Saren-Arterius Since I don't user snapper at all and don't really know how the layout works (one `.snapshots` directory per filesystem? one per mountpoint? one global one?), I just blacklisted `/.snapshots` for now. Honestly, this tells me we should be working towards a generic whitelist-based system in terms of firejail defaults (right now, you can only whitelist stuff with a top directory of `~/`, `/dev`, `/etc`, `/media`, `/mnt`, `/opt`, `/srv`, `/sys/module`, `/usr/share`, `/var`, and `/tmp`). I'm not quite sure why we don't allow a whitelist of arbitrary paths (maybe @netblue30 can answer that?), but that is something I'd like to see (basically, let's give `whitelist` the same level of generality as `blacklist`).

gitea-mirror commented

2026-05-05 07:57:04 -06:00

Author

Owner

@Saren-Arterius commented on GitHub (Jul 11, 2018):

Hi, .snapshots is per filesystem or subvolumes for btrfs. I dont know about
LVM.

在 2018年7月11日週三 15:47，ಚಿರಾಗ್ ನಟರಾಜ್ notifications@github.com 寫道：

@Saren-Arterius https://github.com/Saren-Arterius Since I don't user
snapper at all and don't really know how the layout works (one .snapshots
directory per filesystem? one per mountpoint? one global one?), I just
blacklisted /.snapshots for now. Honestly, this tells me we should be
working towards a generic whitelist-based system in terms of firejail
defaults (right now, you can only whitelist stuff with a top directory of
~/, /dev, /etc, /media, /mnt, /opt, /srv, /sys/module, /usr/share, /var,
and /tmp). I'm not quite sure why we don't allow a whitelist of arbitrary
paths (maybe @netblue30 https://github.com/netblue30 can answer that?),
but that is something I'd like to see (basically, let's give whitelist
the same level of generality as blacklist).

—
You are receiving this because you were mentioned.

Reply to this email directly, view it on GitHub
https://github.com/netblue30/firejail/issues/2030#issuecomment-404175697,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AEuDt_EeHe_ZTWJ4Iw-1UYckI5MPUQNsks5uFgH_gaJpZM4VEa5A
.

@Saren-Arterius commented on GitHub (Jul 11, 2018): Hi, .snapshots is per filesystem or subvolumes for btrfs. I dont know about LVM. 在 2018年7月11日週三 15:47，ಚಿರಾಗ್ ನಟರಾಜ್ <notifications@github.com> 寫道： > @Saren-Arterius <https://github.com/Saren-Arterius> Since I don't user > snapper at all and don't really know how the layout works (one .snapshots > directory per filesystem? one per mountpoint? one global one?), I just > blacklisted /.snapshots for now. Honestly, this tells me we should be > working towards a generic whitelist-based system in terms of firejail > defaults (right now, you can only whitelist stuff with a top directory of > ~/, /dev, /etc, /media, /mnt, /opt, /srv, /sys/module, /usr/share, /var, > and /tmp). I'm not quite sure why we don't allow a whitelist of arbitrary > paths (maybe @netblue30 <https://github.com/netblue30> can answer that?), > but that is something I'd like to see (basically, let's give whitelist > the same level of generality as blacklist). > > — > You are receiving this because you were mentioned. > > > Reply to this email directly, view it on GitHub > <https://github.com/netblue30/firejail/issues/2030#issuecomment-404175697>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/AEuDt_EeHe_ZTWJ4Iw-1UYckI5MPUQNsks5uFgH_gaJpZM4VEa5A> > . >

gitea-mirror commented

2026-05-05 07:57:05 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 11, 2018):

谢谢! Actually, in this case, an apparmor profile addition may be more warranted, since I'm not entirely certain how globbing works with blacklist in firejail. That is, I'm not sure if e.g. **/.snapshots would match any .snapshots directory on the system or whether it would only match .snapshots directories below a top-level directory. With AppArmor, the globbing itself is fairly well documented (as well as with a couple of examples). So we can definitely block /.snapshots by default (as I put in), but something more dynamic like what you are looking for may be better served through AppArmor.

@chiraag-nataraj commented on GitHub (Jul 11, 2018): 谢谢! Actually, in this case, an apparmor profile addition may be more warranted, since I'm not _entirely_ certain how globbing works with `blacklist` in firejail. That is, I'm not sure if e.g. `**/.snapshots` would match any `.snapshots` directory on the system or whether it would only match `.snapshots` directories below a top-level directory. With AppArmor, the globbing itself is fairly well documented (as well as with a couple of examples). So we can definitely block `/.snapshots` by default (as I put in), but something more dynamic like what you are looking for may be better served through AppArmor.

gitea-mirror commented

2026-05-05 07:57:07 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 11, 2018):

I could also be entirely mistaken and **/.snapshots would match any .snapshots directory on the system... 😂

@chiraag-nataraj commented on GitHub (Jul 11, 2018): I could also be entirely mistaken and `**/.snapshots` would match any `.snapshots` directory on the system... :joy:

gitea-mirror commented

2026-05-05 07:57:09 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 11, 2018):

I'll change it to **/.snapshots and close this for now.

@chiraag-nataraj commented on GitHub (Jul 11, 2018): I'll change it to `**/.snapshots` and close this for now.

gitea-mirror commented

2026-05-05 07:57:12 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 11, 2018):

So...**/.snapshots will not do what you want. Leaving this open for now until I find a resolution.

@chiraag-nataraj commented on GitHub (Jul 11, 2018): So...`**/.snapshots` will _not_ do what you want. Leaving this open for now until I find a resolution.

gitea-mirror commented

2026-05-05 07:57:14 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 11, 2018):

It will only block .snapshots directories at most one level below / (e.g. /home/.snapshots is blocked, but /home/<user>/.snapshots is not). I will look into putting in an AppArmor rule.

@chiraag-nataraj commented on GitHub (Jul 11, 2018): It will only block `.snapshots` directories at most one level below `/` (e.g. `/home/.snapshots` is blocked, but `/home/<user>/.snapshots` is not). I will look into putting in an AppArmor rule.

gitea-mirror commented

2026-05-05 07:57:16 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 11, 2018):

Okay, the AppArmor glob does what you want - it blocks all .snapshots directories no matter how deep they go. See 6108f459e3.

@chiraag-nataraj commented on GitHub (Jul 11, 2018): Okay, the AppArmor glob does what you want - it blocks all .snapshots directories no matter how deep they go. See 6108f459e375151e95bedf7090eb9b84169479e8.

gitea-mirror referenced this issue

2026-05-05 10:22:52 -06:00

[PR #2926] [MERGED] Allow exceptions to seccomp lists #4586

Rows
Columns

[GH-ISSUE #2030] Snapper - **/.snapshots #1366