github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2194] add nou2f to all profiles with private-dev #1469

New issue

Closed

opened 2026-05-05 08:08:07 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 08:08:07 -06:00

Owner

Originally created by @smitsohu on GitHub (Oct 14, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2194

We punched a small hole in private-dev to get yubikeys and such working, but it hasn't been closed yet in the profiles that we ship.

I would propose to add nou2f to all profiles with private-dev, including the browsers and keepassxc. The reason is that /dev/usb can contain devices such as printers and keyboards, and exposing them in the sandbox is usually neither necessary nor desirable.
Imho users who own a yubikey and want to use it with firejail should rather opt-in and disable nou2f themselves.

Originally created by @smitsohu on GitHub (Oct 14, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2194 We punched a small hole in `private-dev` to get yubikeys and such working, but it hasn't been closed yet in the profiles that we ship. I would propose to add `nou2f` to all profiles with `private-dev`, including the browsers and keepassxc. The reason is that /dev/usb can contain devices such as printers and keyboards, and exposing them in the sandbox is usually neither necessary nor desirable. Imho users who own a yubikey and want to use it with firejail should rather opt-in and disable nou2f themselves.

gitea-mirror

2026-05-05 08:08:07 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 08:08:11 -06:00

Author

Owner

@reinerh commented on GitHub (Oct 15, 2018):

instead of touching every profile, why not make nou2f the default, and add an "u2f" option which allows it?

@reinerh commented on GitHub (Oct 15, 2018): instead of touching every profile, why not make nou2f the default, and add an "u2f" option which allows it?

gitea-mirror commented

2026-05-05 08:08:12 -06:00

Author

Owner

@smitsohu commented on GitHub (Oct 15, 2018):

@reinerh It would be way easier to maintain! But if I understand #1446 right, we are going to do this anyway at some point. To avoid confusing semantics, all private-dev related options should probably change behavior simultaneously.

@smitsohu commented on GitHub (Oct 15, 2018): @reinerh It would be way easier to maintain! But if I understand #1446 right, we are going to do this anyway at some point. To avoid confusing semantics, all `private-dev` related options should probably change behavior simultaneously.

gitea-mirror commented

2026-05-05 08:08:13 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Oct 15, 2018):

@smitsohu if you want to go the easy approach, here is a commit that adds nou2f to all profiles in the proper location
284e0750e5

@SkewedZeppelin commented on GitHub (Oct 15, 2018): @smitsohu if you want to go the easy approach, here is a commit that adds nou2f to all profiles in the proper location https://github.com/SkewedZeppelin/firejail/commit/284e0750e51bc9f9833b529eead37b42d1b223f0

gitea-mirror commented

2026-05-05 08:08:14 -06:00

Author

Owner

@smitsohu commented on GitHub (Oct 15, 2018):

@SkewedZeppelin Cool!

It is only me, but I would find "the easy approach" more suitable for what might be a "bugfix" release.

@smitsohu commented on GitHub (Oct 15, 2018): @SkewedZeppelin Cool! It is only me, but I would find "the easy approach" more suitable for what might be a "bugfix" release.

gitea-mirror referenced this issue

2026-05-05 10:11:31 -06:00

[PR #1469] [MERGED] Add novideo and noexec /tmp to Tor browsers #3981

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1469

No description provided.

Rows
Columns