github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2414] Feh: Standard config does not allow internet access #1611

New issue

Closed

opened 2026-05-05 08:16:02 -06:00 by gitea-mirror · 11 comments

gitea-mirror commented

2026-05-05 08:16:02 -06:00

Owner

Originally created by @pianoslum on GitHub (Feb 17, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2414

The image viewer feh can access pictures in the internet if you pass a url. E.g.:
feh https://i.imgur.com/FzdARaX.jpg
However, the current standard config blocks internet access; I found that you have to uncomment
net none,
protocol unix and
private-etc feh
in order to make it work again.

I am not sure what a good standard would be (options in or out), but either way, we should add a comment explaining that these options are needed for web access.
What do you think?

Originally created by @pianoslum on GitHub (Feb 17, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2414 The image viewer feh can access pictures in the internet if you pass a url. E.g.: `feh https://i.imgur.com/FzdARaX.jpg` However, the current standard config blocks internet access; I found that you have to uncomment `net none`, `protocol unix` and `private-etc feh` in order to make it work again. I am not sure what a good standard would be (options in or out), but either way, we should add a comment explaining that these options are needed for web access. What do you think?

gitea-mirror closed this issue

2026-05-05 08:16:03 -06:00

gitea-mirror commented

2026-05-05 08:16:05 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Feb 17, 2019):

I found that you have to uncomment

I think you meant comment.

In my opinion, there is absolutely no reason an image viewer(!) should have access to the internet by default.

[...] we should add a comment explaining that these options are needed for web access.

Sure. I would actually go so far as to make a feh-relaxed.inc file which isn't included by default. Then, if people want to allow this, they can simply include feh-relaxed.inc in their feh.local file (even if you want it to have internet access, you don't need to allow access to all of /etc).

@chiraag-nataraj commented on GitHub (Feb 17, 2019): > I found that you have to uncomment I think you meant comment. In my opinion, there is absolutely _no_ reason an image viewer(!) should have access to the internet by default. > [...] we should add a comment explaining that these options are needed for web access. Sure. I would actually go so far as to make a `feh-relaxed.inc` file which isn't included by default. Then, if people want to allow this, they can simply include `feh-relaxed.inc` in their `feh.local` file (even if you want it to have internet access, you don't need to allow access to _all_ of `/etc`).

gitea-mirror commented

2026-05-05 08:16:06 -06:00

Author

Owner

@pianoslum commented on GitHub (Feb 17, 2019):

Yeah you're right :-)
Regarding private-etc: I agree with you, but there seems to be something that feh needs to access; is there an easy way how to find which this is?

@pianoslum commented on GitHub (Feb 17, 2019): Yeah you're right :-) Regarding private-etc: I agree with you, but there seems to be something that feh needs to access; is there an easy way how to find which this is?

gitea-mirror commented

2026-05-05 08:16:06 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Feb 17, 2019):

Try adding private-etc hosts,resolv.conf,ssl as another line (they're additive, which means this will be done in addition to private-etc feh).

@chiraag-nataraj commented on GitHub (Feb 17, 2019): Try adding `private-etc hosts,resolv.conf,ssl` as another line (they're additive, which means this will be done _in addition_ to `private-etc feh`).

gitea-mirror commented

2026-05-05 08:16:07 -06:00

Author

Owner

@pianoslum commented on GitHub (Feb 17, 2019):

I tried that, unfortunately it's not enough apparently :-(

@pianoslum commented on GitHub (Feb 17, 2019): I tried that, unfortunately it's not enough apparently :-(

gitea-mirror commented

2026-05-05 08:16:08 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Feb 17, 2019):

So it looks like it needs whatever curl needs (they list libcurl4, on Debian anyway, as a dependency). Aaaand it looks like we commented out private-etc in curl.profile (probably because something broke lol). But maybe the private-etc line there is a starting point?

@chiraag-nataraj commented on GitHub (Feb 17, 2019): So it looks like it needs whatever `curl` needs (they list `libcurl4`, on Debian anyway, as a dependency). Aaaand it looks like we commented out `private-etc` in `curl.profile` (probably because something broke lol). But maybe the `private-etc` line there is a starting point?

gitea-mirror commented

2026-05-05 08:16:09 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Feb 17, 2019):

I just tried it and private-etc feh,resolv.conf,ssl worked for me. What error does feh give you when you try that private-etc line?

@chiraag-nataraj commented on GitHub (Feb 17, 2019): I just tried it and `private-etc feh,resolv.conf,ssl` worked for me. What error does `feh` give you when you try that `private-etc` line?

gitea-mirror commented

2026-05-05 08:16:10 -06:00

Author

Owner

@pianoslum commented on GitHub (Feb 17, 2019):

There was a symlink in ssl to /etc/certificates, so adding this did the trick:
private-etc feh,resolv.conf,ca-certificates,ssl

This might depend on the distribution, I use Arch x64

@pianoslum commented on GitHub (Feb 17, 2019): There was a symlink in ssl to /etc/certificates, so adding this did the trick: `private-etc feh,resolv.conf,ca-certificates,ssl` This might depend on the distribution, I use Arch x64

gitea-mirror commented

2026-05-05 08:16:10 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Feb 17, 2019):

I'm happy to add your line along with ignore net none into a feh-networked.inc file which people can include if they so choose.

@chiraag-nataraj commented on GitHub (Feb 17, 2019): I'm happy to add your line along with `ignore net none` into a `feh-networked.inc` file which people can include if they so choose.

gitea-mirror commented

2026-05-05 08:16:11 -06:00

Author

Owner

@pianoslum commented on GitHub (Feb 18, 2019):

Thanks for that - I still need to comment protocol unix, otherwise it doesn't work .-(

@pianoslum commented on GitHub (Feb 18, 2019): Thanks for that - I still need to comment `protocol unix`, otherwise it doesn't work .-(

gitea-mirror commented

2026-05-05 08:16:12 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 18, 2019):

@pianoslum or better: protocol unix,inet,inet6

@rusty-snake commented on GitHub (Feb 18, 2019): @pianoslum or better: `protocol unix,inet,inet6`

gitea-mirror commented

2026-05-05 08:16:13 -06:00

Author

Owner

@pianoslum commented on GitHub (Mar 10, 2019):

@chiraag-nataraj I would add a PR, but I do not know how to "whitelist" protocol unix. Could you give me a hint here?
Otherwise, feh-networkingis still not working :-|

@pianoslum commented on GitHub (Mar 10, 2019): @chiraag-nataraj I would add a PR, but I do not know how to "whitelist" `protocol unix`. Could you give me a hint here? Otherwise, feh-networkingis still not working :-|

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1611

No description provided.

Rows
Columns