[GH-ISSUE #2269] For --private-tmp expose /tmp/.X11-unix as read-only #1517

Closed
opened 2026-05-05 08:10:49 -06:00 by gitea-mirror · 3 comments
Owner

Originally created by @Vincent43 on GitHub (Nov 22, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2269

Currently in case of private-tmp option we mount an empty /tmp with whitelisted /tmp/.X11-unix. Additionally we may expose it as read-only. The read-only mount flag does not prevent using connect() syscall on the socket.

Originally created by @Vincent43 on GitHub (Nov 22, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2269 Currently in case of `private-tmp` option we mount an empty `/tmp` with [whitelisted `/tmp/.X11-unix`](https://github.com/netblue30/firejail/blob/7c903b45c2f2c7ae2785deedfc03d76a0cda36fd/src/firejail/fs.c#L1564). Additionally we may expose it as read-only. [The read-only mount flag does not prevent using connect() syscall on the socket](https://wiki.archlinux.org/index.php/Systemd-nspawn#Use_an_X_environment).
Author
Owner

@chiraag-nataraj commented on GitHub (Dec 9, 2018):

@Vincent43 Is the easiest way to do this to build it in to --private-tmp or to just add it to the profiles directly?

<!-- gh-comment-id:445541382 --> @chiraag-nataraj commented on GitHub (Dec 9, 2018): @Vincent43 Is the easiest way to do this to build it in to `--private-tmp` or to just add it to the profiles directly?
Author
Owner

@Vincent43 commented on GitHub (Dec 10, 2018):

I think it should be built into --private-tmp directly to avoid cluttering profiles.

<!-- gh-comment-id:445786637 --> @Vincent43 commented on GitHub (Dec 10, 2018): I think it should be built into `--private-tmp` directly to avoid cluttering profiles.
Author
Owner

@chiraag-nataraj commented on GitHub (May 19, 2019):

Going to close this as this should now be implemented.

<!-- gh-comment-id:493800045 --> @chiraag-nataraj commented on GitHub (May 19, 2019): Going to close this as this should now be implemented.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1517
No description provided.