github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2480] read-write does not work after read-only #1624

New issue

Closed

opened 2026-05-05 08:16:43 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 08:16:43 -06:00

Owner

Originally created by @odiferousmint on GitHub (Feb 26, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2480

Hello.

touch ~/.foobar
firejail --noprofile --read-only=~/ --read-write=~/.foobar test

I expect ~/.foobar to be writable by test, but it isn't (I get error Read-only file system). According to the man page, it should work:

       --read-write=dirname_or_filename
              Set directory or file  read-write.  Only  files  or  directories
              belonging  to  the  current user are allowed for this operation.
              File globbing is supported, see FILE GLOBBING section  for  more
              details.  Example:

              $ mkdir ~/test
              $ touch ~/test/a
              $ firejail --read-only=~/test --read-write=~/test/a

Version:

firejail version 0.9.58.2

Compile time support:
        - AppArmor support is disabled
        - AppImage support is enabled
        - chroot support is enabled
        - file and directory whitelisting support is enabled
        - file transfer support is enabled
        - networking support is enabled
        - overlayfs support is enabled
        - private-home support is enabled
        - seccomp-bpf support is enabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled

Originally created by @odiferousmint on GitHub (Feb 26, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2480 Hello. ``` touch ~/.foobar firejail --noprofile --read-only=~/ --read-write=~/.foobar test ``` I expect `~/.foobar` to be writable by `test`, but it isn't (I get error `Read-only file system`). According to the man page, it should work: ``` --read-write=dirname_or_filename Set directory or file read-write. Only files or directories belonging to the current user are allowed for this operation. File globbing is supported, see FILE GLOBBING section for more details. Example: $ mkdir ~/test $ touch ~/test/a $ firejail --read-only=~/test --read-write=~/test/a ``` Version: ``` firejail version 0.9.58.2 Compile time support: - AppArmor support is disabled - AppImage support is enabled - chroot support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - seccomp-bpf support is enabled - user namespace support is enabled - X11 sandboxing support is enabled ```

gitea-mirror

2026-05-05 08:16:43 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 08:16:46 -06:00

Author

Owner

@smitsohu commented on GitHub (Feb 26, 2019):

I cannot reproduce your issue with the example from the man page.

$ mkdir ~/test; touch ~/test/a
$ firejail --read-only=~/test --read-write=~/test/a
$ echo "Hello world" > ~/test/a
$ cat ~/test/a
Hello world

Still it can fail for many different reasons. For instance some programs try to create a lock-file before writing to the target, or they first write to a temporary file which is then renamed to the target. All of this is broken in a read-only directory.

@smitsohu commented on GitHub (Feb 26, 2019): I cannot reproduce your issue with the example from the man page. ``` $ mkdir ~/test; touch ~/test/a $ firejail --read-only=~/test --read-write=~/test/a $ echo "Hello world" > ~/test/a $ cat ~/test/a Hello world ``` Still it can fail for many different reasons. For instance some programs try to create a lock-file before writing to the target, or they first write to a temporary file which is then renamed to the target. All of this is broken in a read-only directory.

gitea-mirror commented

2026-05-05 08:16:47 -06:00

Author

Owner

@odiferousmint commented on GitHub (Feb 27, 2019):

Ah I see, that may be the issue. :/ Thanks!

@odiferousmint commented on GitHub (Feb 27, 2019): Ah I see, that may be the issue. :/ Thanks!

gitea-mirror commented

2026-05-05 08:16:48 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 21, 2019):

@odiferousmint, is this still an issue for you? Have you found a workaround?

@chiraag-nataraj commented on GitHub (May 21, 2019): @odiferousmint, is this still an issue for you? Have you found a workaround?

gitea-mirror commented

2026-05-05 08:16:49 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 26, 2019):

@odiferousmint I'm closing here due to inactivity, please fell free to reopen if you still have this issue.

@rusty-snake commented on GitHub (Jun 26, 2019): @odiferousmint I'm closing here due to inactivity, please fell free to reopen if you still have this issue.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1624

No description provided.

Rows
Columns