github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2039] [enhancement] Allow more fine-grained ignore predicates #1377

New issue

Closed

opened 2026-05-05 07:58:43 -06:00 by gitea-mirror · 8 comments

gitea-mirror commented

2026-05-05 07:58:43 -06:00

Owner

Originally created by @chiraag-nataraj on GitHub (Jul 14, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2039

So right now, the way ignore works is that you use ignore <predicate> and it ignores all predicates of that type. I'm wondering if we can fine-tune this a bit to select which specific instance of the predicate to ignore. As an example, in my profiles, I have a common.inc which does most of the common stuff. But occasionally, I need to ignore one or two predicates (otherwise the program will break). Two predicates I have in this file are noexec ${HOME} and noexec /tmp. I want to ignore noexec /tmp while preserving noexec ${HOME}. Of course, one way would be to split this up into two different files (or more) to allow more granularity in my imports. But the nice thing about the current system is that I just have one import command which is easy to remember. @netblue30, what would it take to ignore a specific instance of a predicate instead of every instance?

Originally created by @chiraag-nataraj on GitHub (Jul 14, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2039 So right now, the way ignore works is that you use `ignore <predicate>` and it ignores all predicates of that type. I'm wondering if we can fine-tune this a bit to select which specific instance of the predicate to ignore. As an example, in my profiles, I have a `common.inc` which does most of the common stuff. But occasionally, I need to ignore one or two predicates (otherwise the program will break). Two predicates I have in this file are `noexec ${HOME}` and `noexec /tmp`. I want to ignore `noexec /tmp` while preserving `noexec ${HOME}`. Of course, one way would be to split this up into two different files (or more) to allow more granularity in my imports. But the nice thing about the current system is that I just have one import command which is easy to remember. @netblue30, what would it take to ignore a specific instance of a predicate instead of every instance?

gitea-mirror

2026-05-05 07:58:43 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 07:58:50 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 15, 2018):

I kind of run into this problem all the time with the networking commands when I move profiles from one computer to another. The code for ignore is in profile.c. It is something very simple in this moment, if you have an idea we can expand it.

@netblue30 commented on GitHub (Jul 15, 2018): I kind of run into this problem all the time with the networking commands when I move profiles from one computer to another. The code for ignore is in profile.c. It is something very simple in this moment, if you have an idea we can expand it.

gitea-mirror commented

2026-05-05 07:58:52 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 15, 2018):

@netblue30 How about matching the full line rather than just the predicate itself? That way, you can select specific instances of the predicate to ignore. If only the predicate is given, all instances are ignored (as is the current behavior).

@chiraag-nataraj commented on GitHub (Jul 15, 2018): @netblue30 How about matching the full line rather than just the predicate itself? That way, you can select specific instances of the predicate to ignore. If only the predicate is given, all instances are ignored (as is the current behavior).

gitea-mirror commented

2026-05-05 07:58:57 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 17, 2018):

What if we add another option, --ignore-match? We can add it on top of the regular ignore code, and if we need we can always add more similar options.

@netblue30 commented on GitHub (Jul 17, 2018): What if we add another option, --ignore-match? We can add it on top of the regular ignore code, and if we need we can always add more similar options.

gitea-mirror commented

2026-05-05 07:58:58 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 21, 2018):

That seems like an okay idea. Personally, I don't see why we can't change the behavior of the current ignore predicate, but if this seems like a better idea to you, let's go with it :)

@chiraag-nataraj commented on GitHub (Jul 21, 2018): That seems like an okay idea. Personally, I don't see why we can't change the behavior of the current ignore predicate, but if this seems like a better idea to you, let's go with it :)

gitea-mirror commented

2026-05-05 07:59:00 -06:00

Author

Owner

@startx2017 commented on GitHub (Jul 26, 2018):

I'll take over and implement it, unless you guys have already something going.

@startx2017 commented on GitHub (Jul 26, 2018): I'll take over and implement it, unless you guys have already something going.

gitea-mirror commented

2026-05-05 07:59:03 -06:00

Author

Owner

@startx2017 commented on GitHub (Aug 3, 2018):

Funny, the current code already allows ignoring full profile lines. Example:

firejail --ignore="net eth0" program
firejail --ignore="blacklist /dev/null" program

In profile file use

ignore net eth0
ignore blacklist /dev/null

I'll modify man pages.

@startx2017 commented on GitHub (Aug 3, 2018): Funny, the current code already allows ignoring full profile lines. Example: ````` firejail --ignore="net eth0" program firejail --ignore="blacklist /dev/null" program ````` In profile file use ````` ignore net eth0 ignore blacklist /dev/null ````` I'll modify man pages.

gitea-mirror commented

2026-05-05 07:59:06 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 6, 2018):

@startx2017 Oh man...let me try this now.

@chiraag-nataraj commented on GitHub (Aug 6, 2018): @startx2017 Oh man...let me try this now.

gitea-mirror commented

2026-05-05 07:59:07 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 6, 2018):

Oh man, it does work! Awesome.

@chiraag-nataraj commented on GitHub (Aug 6, 2018): Oh man, it _does_ work! Awesome.

gitea-mirror referenced this issue

2026-05-05 10:10:38 -06:00

[PR #1377] [MERGED] Fix .java after e2449ae7d25925cec444ac08bbfb9cbc7199e647 #3933

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1377

No description provided.

Rows
Columns