[GH-ISSUE #2609] vlc whitelist

gitea-mirror commented

2026-05-05 08:18:19 -06:00

Owner

Originally created by @Boruch-Baum on GitHub (Mar 19, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2609

I may be making a newbie error here, but it seems that the default profile for vlc (and I guess clvc) require two whitelist commands in addition to the noblacklist ones:

whitelist ${HOME}/.local/share/vlc
whitelist ${HOME}/.config/vlc

What happens without those commands are that settings aren't persistent, and vlc always opens with a nag screen.

In addition, I think most people would want the following:

whitelist ${HOME}/Videos

Originally created by @Boruch-Baum on GitHub (Mar 19, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2609 I may be making a newbie error here, but it seems that the default profile for vlc (and I guess clvc) require two whitelist commands in addition to the noblacklist ones: whitelist ${HOME}/.local/share/vlc whitelist ${HOME}/.config/vlc What happens without those commands are that settings aren't persistent, and vlc always opens with a nag screen. In addition, I think most people would want the following: whitelist ${HOME}/Videos

gitea-mirror

2026-05-05 08:18:19 -06:00

closed this issue
added the
invalid
label

gitea-mirror commented

2026-05-05 08:18:22 -06:00

Author

Owner

@Boruch-Baum commented on GitHub (Mar 19, 2019):

Actually, looking at the default profile a second time, ALL the noblacklist items there should also have corresponding whitelist ones, no? Like I said, I'm new at this. I tried firejail maybe a year or two ago, and am trying it again now.

@Boruch-Baum commented on GitHub (Mar 19, 2019): Actually, looking at the default profile a second time, **ALL** the `noblacklist` items there should also have corresponding `whitelist` ones, no? Like I said, I'm new at this. I tried firejail maybe a year or two ago, and am trying it again now.

gitea-mirror commented

2026-05-05 08:18:23 -06:00

Author

Owner

@Vincent43 commented on GitHub (Mar 19, 2019):

As you can see vlc doesn't enable whitelisting for $HOME so everything what isn't blacklisted is allowed. You may harden it additionally with various whitelist rules by adding them to /etc/firejail/vlc.local.

@Vincent43 commented on GitHub (Mar 19, 2019): As you can see [vlc](https://github.com/netblue30/firejail/blob/master/etc/vlc.profile) doesn't enable whitelisting for `$HOME` so everything what isn't blacklisted is allowed. You may harden it additionally with various whitelist rules by adding them to `/etc/firejail/vlc.local`.

gitea-mirror commented

2026-05-05 08:18:24 -06:00

Author

Owner

@Boruch-Baum commented on GitHub (Mar 19, 2019):

@Vincent43 : Really? What you write doesn't make sense. You want to say that adding a whitelist rule will provide additional hardening ?!?! It does just the opposite! Also, why are you telling me to add personal rules to /etc/firejail/vlc.local? Shouldn't it be ~/.config/vlc.profile? On a more fundamental level, what you're claiming about whitelist and blacklist is obviously wrong; you seem to have the language backwards. You're also not addressing the central point of this issue, which is that necessary configuration files for vlc are not by default available.

@Boruch-Baum commented on GitHub (Mar 19, 2019): @Vincent43 : Really? What you write doesn't make sense. You want to say that adding a `whitelist` rule will provide additional hardening ?!?! It does just the opposite! Also, why are you telling me to add personal rules to `/etc/firejail/vlc.local`? Shouldn't it be `~/.config/vlc.profile`? On a more fundamental level, what you're claiming about `whitelist` and `blacklist` is obviously wrong; you seem to have the language backwards. You're also not addressing the central point of this issue, which is that necessary configuration files for vlc are not by default available.

gitea-mirror commented

2026-05-05 08:18:25 -06:00

Author

Owner

@Vincent43 commented on GitHub (Mar 19, 2019):

You want to say that adding a whitelist rule will provide additional hardening ?!?!

Yes.

Also, why are you telling me to add personal rules to /etc/firejail/vlc.local? Shouldn't it be ~/.config/vlc.profile

Because ~/.config/vlc.profile will overwrite firejail profile completely while /etc/firejail/vlc.local will add those rules to existing profile.

You're also not addressing the central point of this issue, which is that necessary configuration files for vlc are not by default available.

Unfortunately, the central point of this issue is wrong because configuration files for vlc are available by default.

@Vincent43 commented on GitHub (Mar 19, 2019): > You want to say that adding a whitelist rule will provide additional hardening ?!?! Yes. > Also, why are you telling me to add personal rules to /etc/firejail/vlc.local? Shouldn't it be ~/.config/vlc.profile Because `~/.config/vlc.profile` will overwrite firejail profile completely while `/etc/firejail/vlc.local` will add those rules to existing profile. > You're also not addressing the central point of this issue, which is that necessary configuration files for vlc are not by default available. Unfortunately, the central point of this issue is wrong because configuration files for vlc **are** available by default.

gitea-mirror commented

2026-05-05 08:18:26 -06:00

Author

Owner

@Boruch-Baum commented on GitHub (Mar 19, 2019):

@Vincent43

Unfortunately, the central point of this issue is wrong because configuration files for vlc are available by default.

Well, if you want to ignore my report, that's certainly an option for you, but what I am reporting contradicts you.

Because ~/.config/vlc.profile will overwrite firejail profile completely while /etc/firejail/vlc.local will add those rules to existing profile.

The documentation says to place an include /etc/firejail/foo.profile at the beginning of one's personal ~/.config/firejail/foo.profile, no?

You want to say that adding a whitelist rule will provide additional hardening ?!?!

Yes.

A memorable response that I will relish sharing with ALL my friends...

@Boruch-Baum commented on GitHub (Mar 19, 2019): @Vincent43 > Unfortunately, the central point of this issue is wrong because configuration files for vlc are available by default. Well, if you want to ignore my report, that's certainly an option for you, but what I am reporting contradicts you. >Because ~/.config/vlc.profile will overwrite firejail profile completely while /etc/firejail/vlc.local will add those rules to existing profile. The documentation says to place an `include /etc/firejail/foo.profile` at the beginning of one's personal `~/.config/firejail/foo.profile`, no? >> You want to say that adding a whitelist rule will provide additional hardening ?!?! > Yes. A memorable response that I will relish sharing with ALL my friends...

gitea-mirror commented

2026-05-05 08:18:27 -06:00

Author

Owner

@curiosity-seeker commented on GitHub (Mar 19, 2019):

A memorable response that I will relish sharing with ALL my friends...

Please do so if you really want to make a fool of yourself. Instead of bashing @Vincent43 who knows exactly what he‘s talking about you should have read the Firejail documentation - and you would know that adding a whitelist command to a profile means that the respective application does not have access to anything that is not explicitly whitelisted.

@curiosity-seeker commented on GitHub (Mar 19, 2019): > A memorable response that I will relish sharing with ALL my friends... Please do so if you really want to make a fool of yourself. Instead of bashing @Vincent43 who knows exactly what he‘s talking about you should have read the Firejail documentation - and you would know that adding a whitelist command to a profile means that the respective application does **not** have access to anything that is **not** explicitly whitelisted.

gitea-mirror commented

2026-05-05 08:18:28 -06:00

Author

Owner

@Vincent43 commented on GitHub (Mar 19, 2019):

Well, if you want to ignore my report, that's certainly an option for you, but what I am reporting contradicts you.

I'm sorry but your report in not reproducible in current form. You may have something special in your system config or firejail config which causes this but I don't have the crystal ball to know it beforehand.

The documentation says to place an include /etc/firejail/foo.profile at the beginning of one's personal ~/.config/firejail/foo.profile, no?

That could be an option but certainly using /etc/firejail/foo.local or ~/.config/firejail/foo.local (in newer versions) is more appropriate.

A memorable response that I will relish sharing with ALL my friends...

What I can say... it's the simplest answer I could provide for your question and it's true. You said that you are new to firejail and I can say that I use it as long as it publicly exists and contributed many patches for it. Please consider this for further discussion.

@Vincent43 commented on GitHub (Mar 19, 2019): > Well, if you want to ignore my report, that's certainly an option for you, but what I am reporting contradicts you. I'm sorry but your report in not reproducible in current form. You may have something special in your system config or firejail config which causes this but I don't have the crystal ball to know it beforehand. > The documentation says to place an include /etc/firejail/foo.profile at the beginning of one's personal ~/.config/firejail/foo.profile, no? That could be an option but certainly using `/etc/firejail/foo.local` or `~/.config/firejail/foo.local` (in newer versions) is more appropriate. > A memorable response that I will relish sharing with ALL my friends... What I can say... it's the simplest answer I could provide for your question and it's true. You said that you are new to firejail and I can say that I use it as long as it publicly exists and contributed many patches for it. Please consider this for further discussion.

gitea-mirror commented

2026-05-05 08:18:28 -06:00

Author

Owner

@Vincent43 commented on GitHub (Mar 26, 2019):

Closing as it's not reproducible and no submitter feedback for a week.

@Vincent43 commented on GitHub (Mar 26, 2019): Closing as it's not reproducible and no submitter feedback for a week.

Rows
Columns

[GH-ISSUE #2609] vlc whitelist #1656