github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #2282] Can't access /mnt despite ignore disable-mnt and whitelists #1521

New issue
Closed
opened 2026-05-05 08:10:57 -06:00 by gitea-mirror · 14 comments
gitea-mirror commented 2026-05-05 08:10:57 -06:00
Owner
Copy link

Originally created by @seonwoolee on GitHub (Nov 29, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2282

I'm trying to set up Firejail for VLC. I have media files under /mnt/NAS that I want it to access.

Here's the profile I created:

ignore disable-mnt
whitelist /mnt/NAS
whitelist /mnt/NAS/replicate
whitelist /mnt/NAS/replicate/TV
whitelist /mnt/NAS/replicate/Movies
whitelist /mnt/NAS/local/TV
whitelist /mnt/NAS/local/Movies
whitelist /mnt/NAS/local/Plex

I get the following output when I use --debug-whitelists

Reading profile /home/seonwoo/.config/firejail/vlc.profile
Parent pid 9359, child pid 9360
Debug 405: new_name #/mnt/NAS#, whitelist
Removed whitelist/nowhitelist path: whitelist /mnt/NAS
	expanded: /mnt/NAS
	real path: (null)
	realpath: Permission denied
Debug 405: new_name #/mnt/NAS/replicate#, whitelist
Removed whitelist/nowhitelist path: whitelist /mnt/NAS/replicate
	expanded: /mnt/NAS/replicate
	real path: (null)
	realpath: Permission denied
Debug 405: new_name #/mnt/NAS/replicate/TV#, whitelist
Removed whitelist/nowhitelist path: whitelist /mnt/NAS/replicate/TV
	expanded: /mnt/NAS/replicate/TV
	real path: (null)
	realpath: Permission denied
Debug 405: new_name #/mnt/NAS/replicate/Movies#, whitelist
Removed whitelist/nowhitelist path: whitelist /mnt/NAS/replicate/Movies
	expanded: /mnt/NAS/replicate/Movies
	real path: (null)
	realpath: Permission denied
Debug 405: new_name #/mnt/NAS/local/TV#, whitelist
Removed whitelist/nowhitelist path: whitelist /mnt/NAS/local/TV
	expanded: /mnt/NAS/local/TV
	real path: (null)
	realpath: Permission denied
Debug 405: new_name #/mnt/NAS/local/Movies#, whitelist
Removed whitelist/nowhitelist path: whitelist /mnt/NAS/local/Movies
	expanded: /mnt/NAS/local/Movies
	real path: (null)
	realpath: Permission denied
Debug 405: new_name #/mnt/NAS/local/Plex#, whitelist
Removed whitelist/nowhitelist path: whitelist /mnt/NAS/local/Plex
	expanded: /mnt/NAS/local/Plex
	real path: (null)
	realpath: Permission denied
Mounting tmpfs on /mnt directory

I don't know why VLC still can't access /mnt/NAS (it can access /mnt, shown as an empty directory).

If it matters, /mnt/NAS is shared over NFS

Originally created by @seonwoolee on GitHub (Nov 29, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2282 I'm trying to set up Firejail for VLC. I have media files under /mnt/NAS that I want it to access. Here's the profile I created: ``` ignore disable-mnt whitelist /mnt/NAS whitelist /mnt/NAS/replicate whitelist /mnt/NAS/replicate/TV whitelist /mnt/NAS/replicate/Movies whitelist /mnt/NAS/local/TV whitelist /mnt/NAS/local/Movies whitelist /mnt/NAS/local/Plex ``` I get the following output when I use `--debug-whitelists` ``` Reading profile /home/seonwoo/.config/firejail/vlc.profile Parent pid 9359, child pid 9360 Debug 405: new_name #/mnt/NAS#, whitelist Removed whitelist/nowhitelist path: whitelist /mnt/NAS expanded: /mnt/NAS real path: (null) realpath: Permission denied Debug 405: new_name #/mnt/NAS/replicate#, whitelist Removed whitelist/nowhitelist path: whitelist /mnt/NAS/replicate expanded: /mnt/NAS/replicate real path: (null) realpath: Permission denied Debug 405: new_name #/mnt/NAS/replicate/TV#, whitelist Removed whitelist/nowhitelist path: whitelist /mnt/NAS/replicate/TV expanded: /mnt/NAS/replicate/TV real path: (null) realpath: Permission denied Debug 405: new_name #/mnt/NAS/replicate/Movies#, whitelist Removed whitelist/nowhitelist path: whitelist /mnt/NAS/replicate/Movies expanded: /mnt/NAS/replicate/Movies real path: (null) realpath: Permission denied Debug 405: new_name #/mnt/NAS/local/TV#, whitelist Removed whitelist/nowhitelist path: whitelist /mnt/NAS/local/TV expanded: /mnt/NAS/local/TV real path: (null) realpath: Permission denied Debug 405: new_name #/mnt/NAS/local/Movies#, whitelist Removed whitelist/nowhitelist path: whitelist /mnt/NAS/local/Movies expanded: /mnt/NAS/local/Movies real path: (null) realpath: Permission denied Debug 405: new_name #/mnt/NAS/local/Plex#, whitelist Removed whitelist/nowhitelist path: whitelist /mnt/NAS/local/Plex expanded: /mnt/NAS/local/Plex real path: (null) realpath: Permission denied Mounting tmpfs on /mnt directory ``` I don't know why VLC still can't access /mnt/NAS (it can access /mnt, shown as an empty directory). If it matters, /mnt/NAS is shared over NFS
gitea-mirror commented 2026-05-05 08:11:00 -06:00
Author
Owner
Copy link

@SkewedZeppelin commented on GitHub (Nov 29, 2018):

Version? Distro? Full command? Full profile?

also you do not need these

whitelist /mnt/NAS
whitelist /mnt/NAS/replicate
<!-- gh-comment-id:442667155 --> @SkewedZeppelin commented on GitHub (Nov 29, 2018): Version? Distro? Full command? Full profile? also you do not need these ``` whitelist /mnt/NAS whitelist /mnt/NAS/replicate ```
gitea-mirror commented 2026-05-05 08:11:01 -06:00
Author
Owner
Copy link

@seonwoolee commented on GitHub (Nov 29, 2018):

Firejail version 0.9.56
Arch Linux
Full command is firejail vlc --debug-whitelists

If I don't include

whitelist /mnt/NAS
whitelist /mnt/NAS/replicate

then I can't even access /mnt

<!-- gh-comment-id:442670684 --> @seonwoolee commented on GitHub (Nov 29, 2018): Firejail version 0.9.56 Arch Linux Full command is `firejail vlc --debug-whitelists` If I don't include ``` whitelist /mnt/NAS whitelist /mnt/NAS/replicate ``` then I can't even access /mnt
gitea-mirror commented 2026-05-05 08:11:02 -06:00
Author
Owner
Copy link

@smitsohu commented on GitHub (Dec 2, 2018):

Is /mnt a mountpoint (what does mountpoint /mnt say?)

If it is, could you share some more information about it? For example something like findmnt | grep /mnt | grep -v /mnt/

<!-- gh-comment-id:443538333 --> @smitsohu commented on GitHub (Dec 2, 2018): Is /mnt a mountpoint (what does `mountpoint /mnt` say?) If it is, could you share some more information about it? For example something like `findmnt | grep /mnt | grep -v /mnt/`
gitea-mirror commented 2026-05-05 08:11:03 -06:00
Author
Owner
Copy link

@seonwoolee commented on GitHub (Dec 2, 2018):

No it is not. /mnt/NAS is though.

Output of findmnt | grep /mnt/NAS | grep -v /mnt/NAS/

rw,relatime,vers=4.2,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=14,retrans=2,sec=sys,clientaddr=192.168.1.4,local_lock=none,addr=192.168.1.2
<!-- gh-comment-id:443538630 --> @seonwoolee commented on GitHub (Dec 2, 2018): No it is not. `/mnt/NAS` is though. Output of `findmnt | grep /mnt/NAS | grep -v /mnt/NAS/` ``` rw,relatime,vers=4.2,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=14,retrans=2,sec=sys,clientaddr=192.168.1.4,local_lock=none,addr=192.168.1.2 ```
gitea-mirror commented 2026-05-05 08:11:04 -06:00
Author
Owner
Copy link

@smitsohu commented on GitHub (Dec 2, 2018):

Maybe related to #2114.
Scratch that.

<!-- gh-comment-id:443539354 --> @smitsohu commented on GitHub (Dec 2, 2018): ~~Maybe related to #2114.~~ Scratch that.
gitea-mirror commented 2026-05-05 08:11:04 -06:00
Author
Owner
Copy link

@smitsohu commented on GitHub (Dec 2, 2018):

I don't know much about NFS, so this is kind of speculative, but if you mount the NFS with no_root_squash option, would it fix the issue?

Note however that this option has own security implications.

<!-- gh-comment-id:443541349 --> @smitsohu commented on GitHub (Dec 2, 2018): I don't know much about NFS, so this is kind of speculative, but if you mount the NFS with `no_root_squash` option, would it fix the issue? Note however that this option has [own security implications](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-securing_nfs-do_not_use_the_no_root_squash_option).
gitea-mirror commented 2026-05-05 08:11:05 -06:00
Author
Owner
Copy link

@seonwoolee commented on GitHub (Dec 2, 2018):

Trying sudo mount 192.168.1.2:/mnt/master /mnt/NAS -t nfs4 -o no_root_squash results in mount.nfs4: an incorrect mount option was specified

<!-- gh-comment-id:443542291 --> @seonwoolee commented on GitHub (Dec 2, 2018): Trying `sudo mount 192.168.1.2:/mnt/master /mnt/NAS -t nfs4 -o no_root_squash` results in `mount.nfs4: an incorrect mount option was specified`
gitea-mirror commented 2026-05-05 08:11:05 -06:00
Author
Owner
Copy link

@smitsohu commented on GitHub (Dec 2, 2018):

It seems it has to go into /etc/exports

<!-- gh-comment-id:443545069 --> @smitsohu commented on GitHub (Dec 2, 2018): [It seems](https://linux.die.net/man/5/exports) it has to go into /etc/exports
gitea-mirror commented 2026-05-05 08:11:06 -06:00
Author
Owner
Copy link

@seonwoolee commented on GitHub (Dec 2, 2018):

Ahhh gotcha.

Nope, that didn't change anything.

<!-- gh-comment-id:443547916 --> @seonwoolee commented on GitHub (Dec 2, 2018): Ahhh gotcha. Nope, that didn't change anything.
gitea-mirror commented 2026-05-05 08:11:06 -06:00
Author
Owner
Copy link

@chiraag-nataraj commented on GitHub (May 19, 2019):

Is this still an issue? If so, can you check if you have disable-mnt enabled in /etc/firejail/firejail.config?

<!-- gh-comment-id:493800574 --> @chiraag-nataraj commented on GitHub (May 19, 2019): Is this still an issue? If so, can you check if you have `disable-mnt` enabled in `/etc/firejail/firejail.config`?
gitea-mirror commented 2026-05-05 08:11:06 -06:00
Author
Owner
Copy link

@seonwoolee commented on GitHub (May 21, 2019):

Yes, disable-mnt is enabled in /etc/firejail/firejail.config. But despite having ignore disable-mnt in vlc.profile, I still can't access /mnt/NAS when I open VLC with firejail.

If I disable disable-mnt in /etc/firejail/firejail.config then it works, but as I understand it ignore disable-mnt in vlc.profile should be taking care of that.

<!-- gh-comment-id:494364294 --> @seonwoolee commented on GitHub (May 21, 2019): Yes, `disable-mnt` is enabled in `/etc/firejail/firejail.config`. But despite having `ignore disable-mnt` in `vlc.profile`, I still can't access `/mnt/NAS` when I open VLC with firejail. If I disable `disable-mnt` in `/etc/firejail/firejail.config` then it works, but as I understand it `ignore disable-mnt` in `vlc.profile` should be taking care of that.
gitea-mirror commented 2026-05-05 08:11:07 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (May 21, 2019):

@seonwoolee nope, if you set this in firejail.config you can not ignore it by ignore, you need to revert this in firejail.config and add disable-mnt to your globals.local, because then you can do ignore disable-mnt in your vlc.local.

# Disable /mnt, /media, /run/mount and /run/media access. By default access
# to these directories is enabled. Unlike --disable-mnt profile option this
# cannot be overridden by --noblacklist.
# disable-mnt no

I think we should add that --ignore also didn't work.

<!-- gh-comment-id:494366050 --> @rusty-snake commented on GitHub (May 21, 2019): @seonwoolee nope, if you set this in firejail.config you can not ignore it by `ignore`, you need to revert this in `firejail.config` and add `disable-mnt` to your `globals.local`, because then you can do `ignore disable-mnt` in your `vlc.local`. ``` # Disable /mnt, /media, /run/mount and /run/media access. By default access # to these directories is enabled. Unlike --disable-mnt profile option this # cannot be overridden by --noblacklist. # disable-mnt no ``` I think we should add that `--ignore` also didn't work.
gitea-mirror commented 2026-05-05 08:11:07 -06:00
Author
Owner
Copy link

@seonwoolee commented on GitHub (May 21, 2019):

Gotcha. Thanks.

<!-- gh-comment-id:494370525 --> @seonwoolee commented on GitHub (May 21, 2019): Gotcha. Thanks.
gitea-mirror commented 2026-05-05 08:11:08 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (May 21, 2019):

I think we should add that --ignore also didn't work.

done via 903adee.

<!-- gh-comment-id:494380586 --> @rusty-snake commented on GitHub (May 21, 2019): > I think we should add that --ignore also didn't work. done via 903adee.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1521
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?