[GH-ISSUE #2413] Warnings in firejail

gitea-mirror commented

2026-05-05 08:16:02 -06:00

Owner

Originally created by @ghost on GitHub (Feb 17, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2413

Hi I have 3 warnings when running firejail and was wondering if someone here got the info about them and how to resolv them.
I have arch linux with linux-hardened kernel

Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted

Warning: cannot create a new user namespace, going forward without it...

I read that user namespaces are disabled/restricted on arch linux but I also read that firejail should be able to use it anyway?

Thank you for taking your time! =)

Originally created by @ghost on GitHub (Feb 17, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2413 Hi I have 3 warnings when running firejail and was wondering if someone here got the info about them and how to resolv them. I have arch linux with linux-hardened kernel Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Warning: cannot create a new user namespace, going forward without it... I read that user namespaces are disabled/restricted on arch linux but I also read that firejail should be able to use it anyway? Thank you for taking your time! =)

gitea-mirror closed this issue

2026-05-05 08:16:03 -06:00

gitea-mirror commented

2026-05-05 08:16:05 -06:00

Author

Owner

@Vincent43 commented on GitHub (Feb 17, 2019):

Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted

Those are ok. In Arch they're symlinks to /usr/bin and can't be blacklisted.

Warning: cannot create a new user namespace, going forward without it...

I can't reproduce this one.

@Vincent43 commented on GitHub (Feb 17, 2019): > Warning: /sbin directory link was not blacklisted > Warning: /usr/sbin directory link was not blacklisted Those are ok. In Arch they're symlinks to `/usr/bin` and can't be blacklisted. > Warning: cannot create a new user namespace, going forward without it... I can't reproduce this one.

gitea-mirror commented

2026-05-05 08:16:06 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Feb 17, 2019):

Warning: cannot create a new user namespace, going forward without it...

relevant?
541891558d

@SkewedZeppelin commented on GitHub (Feb 17, 2019): > Warning: cannot create a new user namespace, going forward without it... relevant? https://github.com/anthraxx/linux-hardened/commit/541891558d4f4bcce4efd2489d1b447a4b44bee8

gitea-mirror commented

2026-05-05 08:16:07 -06:00

Author

Owner

@ghost commented on GitHub (Feb 17, 2019):

I read that user namespaces are disabled/restricted on arch linux but I also read that firejail should be able to use it anyway?

All Arch Linux kernels have support for CONFIG_USER_NS. However, due to more general security concerns, the default Arch kernel does ship with User Namespaces enabled only for the root user. Additional setup is required to use unprivileged containers as normal user.

@ghost commented on GitHub (Feb 17, 2019): > I read that user namespaces are disabled/restricted on arch linux but I also read that firejail should be able to use it anyway? All Arch Linux kernels have support for CONFIG_USER_NS. However, due to more general security concerns, the default Arch kernel does ship with User Namespaces enabled only for the `root` user. [Additional setup](https://wiki.archlinux.org/index.php/Linux_Containers) is required to use unprivileged containers as `normal` user.

gitea-mirror commented

2026-05-05 08:16:07 -06:00

Author

Owner

@Vincent43 commented on GitHub (Feb 17, 2019):

firejail runs as root so that restriction shouldn't apply to it (and it doesn't on my system). @anteg did you added some additional security options in system like user.max_user_namespaces = 0 sysctl?

@Vincent43 commented on GitHub (Feb 17, 2019): firejail runs as `root` so that restriction shouldn't apply to it (and it doesn't on my system). @anteg did you added some additional security options in system like `user.max_user_namespaces = 0` sysctl?

gitea-mirror commented

2026-05-05 08:16:08 -06:00

Author

Owner

@ghost commented on GitHub (Feb 17, 2019):

@Vincent43 No, its set to = 0. Could it be some issues with the permissions? Since it is root that is the user that soulndnt be the case?

@ghost commented on GitHub (Feb 17, 2019): @Vincent43 No, its set to = 0. Could it be some issues with the permissions? Since it is root that is the user that soulndnt be the case?

gitea-mirror commented

2026-05-05 08:16:09 -06:00

Author

Owner

@ghost commented on GitHub (Feb 18, 2019):

@anteg Wait, are you confirming user.max_user_namespaces = 0 while running linux-hardened? Just so we're all on the same page as to your exact issue, would you paste the output of the following commands here please?

$ sysctl user.max_user_namespaces
$ grep userns /etc/firejail/firejail.config

Also, are you seeing the same firejail behavior when running the linux and/or linux-lts kernels on Arch Linux?

@ghost commented on GitHub (Feb 18, 2019): @anteg Wait, are you confirming `user.max_user_namespaces` = 0 while running linux-hardened? Just so we're all on the same page as to your exact issue, would you paste the output of the following commands here please? $ sysctl user.max_user_namespaces $ grep userns /etc/firejail/firejail.config Also, are you seeing the same firejail behavior when running the `linux` and/or `linux-lts` kernels on Arch Linux?

gitea-mirror commented

2026-05-05 08:16:10 -06:00

Author

Owner

@ghost commented on GitHub (Feb 18, 2019):

@glitsj16
After running the the commands I can confirm the outputs being
user.max_user_namespaces = 0
userns yes

I will try with other kernels today and see but I posted this in the meanwhile.

Thanks for taking your time to help

@ghost commented on GitHub (Feb 18, 2019): @glitsj16 After running the the commands I can confirm the outputs being user.max_user_namespaces = 0 userns yes I will try with other kernels today and see but I posted this in the meanwhile. Thanks for taking your time to help

gitea-mirror commented

2026-05-05 08:16:10 -06:00

Author

Owner

@ghost commented on GitHub (Feb 18, 2019):

@glitsj16
I just tried to change the user.max_user_namespaces = 1 and then the warning in firejail disappeared. Is this something I want have set to 0 or other value?
This is the info text from the sysctl
Disable User Namespaces as it opens up a large attack surface to unprivileged users

I am a bit confused if I really want namespaces or not.

@ghost commented on GitHub (Feb 18, 2019): @glitsj16 I just tried to change the user.max_user_namespaces = 1 and then the warning in firejail disappeared. Is this something I want have set to 0 or other value? This is the info text from the sysctl **Disable User Namespaces as it opens up a large attack surface to unprivileged users** I am a bit confused if I really want namespaces or not.

gitea-mirror commented

2026-05-05 08:16:11 -06:00

Author

Owner

@ghost commented on GitHub (Feb 18, 2019):

@anteg Good question. Before Arch Linux added in support for CONFIG_USER_NS I was just as confused and posed a question here and added a link to it on the Arch Wiki page on firejail. Maybe those were what you refered to in your original question.

Historically there have always been arguments made pro and contra user namespaces in Linux. Either way, firejail is only issueing a warning here. It's up to you to decide whether or not you need userns support in firejail. Personally I have been running Arch Linux for a long time now with support for it enabled. Haven't seen an issue yet. Your mileage may vary.

@ghost commented on GitHub (Feb 18, 2019): @anteg Good question. Before Arch Linux added in support for CONFIG_USER_NS I was just as confused and posed a question [here](https://github.com/netblue30/firejail/issues/1347) and added a link to it on the [Arch Wiki page on firejail](https://wiki.archlinux.org/index.php/Firejail). Maybe those were what you refered to in your original question. Historically there have always been arguments made pro and contra user namespaces in Linux. Either way, firejail is only issueing a warning here. It's up to you to decide whether or not you need userns support in firejail. Personally I have been running Arch Linux for a long time now with support for it enabled. Haven't seen an issue yet. Your mileage may vary.

gitea-mirror commented

2026-05-05 08:16:12 -06:00

Author

Owner

@ghost commented on GitHub (Feb 18, 2019):

@glitsj16 Big thanks for your input!! So I have a bit of deciding if I am to use namespaces or not then =)
Thanks for your time!! Appreciate it

@ghost commented on GitHub (Feb 18, 2019): @glitsj16 Big thanks for your input!! So I have a bit of deciding if I am to use namespaces or not then =) Thanks for your time!! Appreciate it

gitea-mirror commented

2026-05-05 08:16:13 -06:00

Author

Owner

@Vincent43 commented on GitHub (Feb 18, 2019):

@anteg

I just tried to change the user.max_user_namespaces = 1 and then the warning in firejail disappeared. Is this something I want have set to 0 or other value?

The default value on my system is 30808.

This is the info text from the sysctl
Disable User Namespaces as it opens up a large attack surface to unprivileged users

If you have a file on your system with that comment then it means you created it by yourself because this isn't part of default config in Arch. As it was mentioned above Arch already restricts USER_NS to root user and further restriction isn't needed. Getting rid of that sysctl config should be safe for you.

@Vincent43 commented on GitHub (Feb 18, 2019): @anteg > I just tried to change the user.max_user_namespaces = 1 and then the warning in firejail disappeared. Is this something I want have set to 0 or other value? The default value on my system is `30808`. > This is the info text from the sysctl > Disable User Namespaces as it opens up a large attack surface to unprivileged users If you have a file on your system with that comment then it means you created it by yourself because this isn't part of default config in Arch. As it was mentioned above Arch already restricts `USER_NS` to root user and further restriction isn't needed. Getting rid of that sysctl config should be safe for you.

Rows
Columns

[GH-ISSUE #2413] Warnings in firejail #1609