github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 22:01:33 -06:00

[GH-ISSUE #2310] Can't create run directory without suid-root #1540

New issue

Closed

opened 2026-05-05 08:12:13 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 08:12:13 -06:00

Owner

Originally created by @reinerh on GitHub (Dec 22, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2310

I compiled firejail with --disable-suid and tried running it, but it fails to start:

Error mkdir: util.c:1014 create_empty_dir_as_root: Permission denied

It tries to create its runtime hierarchy in /run/firejail, which is not possible as unprivileged user.
If this is not supported, it should check the uid and print a more friendly error message if the user is not root.
If an unprivileged user should be able to run it (without suid-root), maybe it can create required directories in the user's home directory.

Originally created by @reinerh on GitHub (Dec 22, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2310 I compiled firejail with `--disable-suid` and tried running it, but it fails to start: ``` Error mkdir: util.c:1014 create_empty_dir_as_root: Permission denied ``` It tries to create its runtime hierarchy in `/run/firejail`, which is not possible as unprivileged user. If this is not supported, it should check the uid and print a more friendly error message if the user is not root. If an unprivileged user should be able to run it (without suid-root), maybe it can create required directories in the user's home directory.

gitea-mirror

2026-05-05 08:12:13 -06:00

closed this issue
added the
enhancement

bug
labels

gitea-mirror commented

2026-05-05 08:12:16 -06:00

Author

Owner

@Vincent43 commented on GitHub (Dec 22, 2018):

I think --disable-suid is only for distros which don't allow packages with setuid binaries in their repos. In that case users are supposed to enable suid bit on firejail binary themselves. Otherwise --disable-suid works only when run as root user.

@Vincent43 commented on GitHub (Dec 22, 2018): I think `--disable-suid` is only for distros which don't allow packages with setuid binaries in their repos. In that case users are supposed to enable suid bit on firejail binary themselves. Otherwise `--disable-suid` works only when run as `root` user. See also https://github.com/netblue30/firejail/issues/1846#issuecomment-378348886

gitea-mirror commented

2026-05-05 08:12:17 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 22, 2019):

Seems like this was answered. @reinerh, I'll go ahead and close this, but please feel free to re-open if you have further questions.

@chiraag-nataraj commented on GitHub (May 22, 2019): Seems like this was answered. @reinerh, I'll go ahead and close this, but please feel free to re-open if you have further questions.

gitea-mirror commented

2026-05-05 08:12:18 -06:00

Author

Owner

@reinerh commented on GitHub (May 22, 2019):

It was actually more a bug report or feature request than a question...

If firejail does not support being run without suid-flag, then this should be checked and printed.
If only a subset of the features is working without suid, then it should give a better explanation what failed (other than "permission denied") and maybe workaround it if possbile (like falling back to a directory that is actually writable by the user).

@reinerh commented on GitHub (May 22, 2019): It was actually more a bug report or feature request than a question... If firejail does not support being run without suid-flag, then this should be checked and printed. If only a subset of the features is working without suid, then it should give a better explanation what failed (other than "permission denied") and maybe workaround it if possbile (like falling back to a directory that is actually writable by the user).

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1540

No description provided.

Rows
Columns