github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2153] noinclude directive #1460

New issue

Closed

opened 2026-05-05 08:07:31 -06:00 by gitea-mirror · 9 comments

gitea-mirror commented

2026-05-05 08:07:31 -06:00

Owner

Originally created by @chiraag-nataraj on GitHub (Oct 9, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2153

Originally assigned to: @startx2017 on GitHub.

So in light of discussions like #2147, we should probably introduce a noinclude option that prevents loading of an include specified in another included file. Yes, I realize that's confusing, so let me illustrate scenarios in which this may be useful.

The aforementioned scenario with an automatic include that you want to prevent (noinclude whitelist-appimage.inc).
firefox.profile includes firefox-common.profile which includes ${CFG}/disable-common.inc. This directive would be useful to disable the include ${CFG}/disable-common.inc in firefox.profile.

What do people think? Should we do this?

Originally created by @chiraag-nataraj on GitHub (Oct 9, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2153 Originally assigned to: @startx2017 on GitHub. So in light of discussions like #2147, we should probably introduce a `noinclude` option that prevents loading of an `include` specified in another included file. Yes, I realize that's confusing, so let me illustrate scenarios in which this may be useful. 1. The aforementioned scenario with an automatic include that you want to prevent (`noinclude whitelist-appimage.inc`). 2. `firefox.profile` includes `firefox-common.profile` which includes `${CFG}/disable-common.inc`. This directive would be useful to disable the `include ${CFG}/disable-common.inc` in `firefox.profile`. What do people think? Should we do this?

gitea-mirror

2026-05-05 08:07:31 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 08:07:35 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Oct 9, 2018):

Alternatively, conditional commands: if(appimage) include whitelist-appimage.inc (for example). The syntax is up for debate, of course.

@chiraag-nataraj commented on GitHub (Oct 9, 2018): Alternatively, conditional commands: `if(appimage) include whitelist-appimage.inc` (for example). The syntax is up for debate, of course.

gitea-mirror commented

2026-05-05 08:07:36 -06:00

Author

Owner

@startx2017 commented on GitHub (Oct 9, 2018):

--noinclude=file is easier to implement for now.

I'll also look into if(condition) ...

@startx2017 commented on GitHub (Oct 9, 2018): --noinclude=file is easier to implement for now. I'll also look into if(condition) ...

gitea-mirror commented

2026-05-05 08:07:37 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 19, 2019):

Is there a specific barrier to using the conditional support to allow conditional includes?

@chiraag-nataraj commented on GitHub (May 19, 2019): Is there a specific barrier to using the conditional support to allow conditional includes?

gitea-mirror commented

2026-05-05 08:07:38 -06:00

Author

Owner

@Vincent43 commented on GitHub (May 20, 2019):

What about ignore include xxx.inc?

@Vincent43 commented on GitHub (May 20, 2019): What about `ignore include xxx.inc`?

gitea-mirror commented

2026-05-05 08:07:39 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 20, 2019):

It doesn't work.

$ firejail --ignore='include ${HOME}/.config/firejail/common.inc' --profile=.config/firejail/x-terminal-emulator.profile x-terminal-emulator
Reading profile .config/firejail/x-terminal-emulator.profile
Reading profile /home/chiraag/.config/firejail/common.inc
Parent pid 25214, child pid 25215
Warning: skipping emp for private /opt
Private /opt installed in 0.17 ms
Warning: skipping emp for private /srv
Private /srv installed in 0.08 ms
Child process initialized in 55.38 ms
urxvt: unable to register '""' as scrollback search start hotkey

where ~/.config/firejail/x-terminal-emulator is:

ignore nodbus
ignore private-tmp
ignore private-dev
ignore memory-deny-write-execute
ignore noexec ${HOME}
ignore blacklist /usr/local/bin

include ${HOME}/.config/firejail/common.inc

whitelist /tmp/user/1000
whitelist /tmp/.X11-unix/

writable-run-user
keep-dev-shm

@chiraag-nataraj commented on GitHub (May 20, 2019): It doesn't work. ``` $ firejail --ignore='include ${HOME}/.config/firejail/common.inc' --profile=.config/firejail/x-terminal-emulator.profile x-terminal-emulator Reading profile .config/firejail/x-terminal-emulator.profile Reading profile /home/chiraag/.config/firejail/common.inc Parent pid 25214, child pid 25215 Warning: skipping emp for private /opt Private /opt installed in 0.17 ms Warning: skipping emp for private /srv Private /srv installed in 0.08 ms Child process initialized in 55.38 ms urxvt: unable to register '""' as scrollback search start hotkey ``` where `~/.config/firejail/x-terminal-emulator` is: ``` ignore nodbus ignore private-tmp ignore private-dev ignore memory-deny-write-execute ignore noexec ${HOME} ignore blacklist /usr/local/bin include ${HOME}/.config/firejail/common.inc whitelist /tmp/user/1000 whitelist /tmp/.X11-unix/ writable-run-user keep-dev-shm ```

gitea-mirror commented

2026-05-05 08:07:39 -06:00

Author

Owner

@Vincent43 commented on GitHub (May 20, 2019):

I meant making ignore include xxx.inc work instead of introducing noinclude.

@Vincent43 commented on GitHub (May 20, 2019): I meant making `ignore include xxx.inc` work instead of introducing `noinclude`.

gitea-mirror commented

2026-05-05 08:07:40 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 4, 2020):

I'm not a C developer so no idea what I am doing, but this works.

--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -1606,7 +1606,7 @@ void profile_read(const char *fname) {
                }
 
                // process include
-               if (strncmp(ptr, "include ", 8) == 0) {
+               if (strncmp(ptr, "include ", 8) == 0 && !is_in_ignore_list(ptr)) {
                        include_level++;
 
                        // expand macros in front of the include profile file

@rusty-snake commented on GitHub (Apr 4, 2020): I'm not a C developer so no idea what I am doing, but this works. ```diff --- a/src/firejail/profile.c +++ b/src/firejail/profile.c @@ -1606,7 +1606,7 @@ void profile_read(const char *fname) { } // process include - if (strncmp(ptr, "include ", 8) == 0) { + if (strncmp(ptr, "include ", 8) == 0 && !is_in_ignore_list(ptr)) { include_level++; // expand macros in front of the include profile file ```

gitea-mirror commented

2026-05-05 08:07:40 -06:00

Author

Owner

@smitsohu commented on GitHub (Aug 4, 2020):

@rusty-snake can you send a pull request (or commit right away?)

@smitsohu commented on GitHub (Aug 4, 2020): @rusty-snake can you send a pull request (or commit right away?)

gitea-mirror commented

2026-05-05 08:07:40 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 4, 2020):