github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2128] Jailing system services #1442

New issue

Closed

opened 2026-05-05 08:06:23 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 08:06:23 -06:00

Owner

Originally created by @Artefact2 on GitHub (Sep 30, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2128

It seems firejail will not work with system users, even if they are explicitely added to /etc/firejail/firejail.users. This makes jailing system services (like tor, i2pd, etc.) that run as their own user problematic.

One workaround is using firejail sudo -u i2pd i2pd but that requires weakening a lot of directives (allowing root, setuid, access to the sudo binary, etc). I am also having a hard time getting it to work.

One other workaround is changing the uid of these users to something above 1000, but that sounds like an even worse idea.

Can firejail be made to work for system users at all?

Originally created by @Artefact2 on GitHub (Sep 30, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2128 It seems firejail will not work with system users, even if they are explicitely added to `/etc/firejail/firejail.users`. This makes jailing system services (like tor, i2pd, etc.) that run as their own user problematic. One workaround is using `firejail sudo -u i2pd i2pd` but that requires weakening a lot of directives (allowing root, setuid, access to the sudo binary, etc). I am also having a hard time getting it to work. One other workaround is changing the uid of these users to something above 1000, but that sounds like an even worse idea. Can firejail be made to work for system users at all?

gitea-mirror closed this issue

2026-05-05 08:06:24 -06:00

gitea-mirror commented

2026-05-05 08:06:26 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Sep 30, 2018):

If you are running systemd, I would just use the built in hardening capabilities. See https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Sandboxing for a rundown

@SkewedZeppelin commented on GitHub (Sep 30, 2018): If you are running systemd, I would just use the built in hardening capabilities. See https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Sandboxing for a rundown

gitea-mirror commented

2026-05-05 08:06:27 -06:00

Author

Owner

@Vincent43 commented on GitHub (Sep 30, 2018):

What firejail version do you use? It should be fixed in 0.9.56 with 95deecf1f3 , see https://github.com/netblue30/firejail/issues/2088

@Vincent43 commented on GitHub (Sep 30, 2018): What firejail version do you use? It should be fixed in 0.9.56 with https://github.com/netblue30/firejail/commit/95deecf1f3128c2fd6984c6b6f4a8f540441188b , see https://github.com/netblue30/firejail/issues/2088

gitea-mirror commented

2026-05-05 08:06:28 -06:00

Author

Owner

@Artefact2 commented on GitHub (Sep 30, 2018):

I am still running 0.9.54. I will play with asp to try out the latest version then. Thanks!

@Artefact2 commented on GitHub (Sep 30, 2018): I am still running `0.9.54`. I will play with `asp` to try out the latest version then. Thanks!

gitea-mirror referenced this issue

2026-05-05 10:11:19 -06:00

[PR #1442] [MERGED] various little profile fixes and enhancements #3967

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1442

No description provided.

Rows
Columns