[GH-ISSUE #249] firejail --zsh complains about insecure directories #175

New issue

Closed

opened 2026-05-05 05:15:12 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 05:15:12 -06:00

Owner

Originally created by @balkierode on GitHub (Jan 21, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/249

➜  ~  firejail --zsh
Reading profile /etc/firejail/generic.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 6033, child pid 6034
Child process initialized
zsh compinit: insecure directories and files, run compaudit for list.
Ignore insecure directories and files and continue [y] or abort compinit [n]? y%                                                                                         ➜  ~
➜  ~  compaudit
There are insecure directories and files:
/usr/share/zsh/functions/Calendar
/usr/share/zsh/functions/Chpwd
/usr/share/zsh/functions/Completion
/usr/share/zsh/functions/Completion/AIX

I guess most likely this has to be fixed in zsh. However I may be wrong. I think the problem is because the files are not owned by root inside the jail. Can it be made to appear as if they are owned by root inside the jail?

➜  ~  ls -ld /usr/share/zsh/functions/Calendar
drwxr-xr-x 2 root root 4096 Nov  4 11:46 /usr/share/zsh/functions/Calendar
➜  ~  firejail
Reading profile /etc/firejail/generic.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 8791, child pid 8792
Child process initialized
groups: cannot find name for group ID 65534
[bala@superadmin-OptiPlex-7010 ~]$ ls -ld /usr/share/zsh/functions/Calendar
drwxr-xr-x 2 65534 65534 4096 Nov  4 11:46 /usr/share/zsh/functions/Calendar
[bala@superadmin-OptiPlex-7010 ~]$

Originally created by @balkierode on GitHub (Jan 21, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/249 ``` ➜ ~ firejail --zsh Reading profile /etc/firejail/generic.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc ** Note: you can use --noprofile to disable generic.profile ** Parent pid 6033, child pid 6034 Child process initialized zsh compinit: insecure directories and files, run compaudit for list. Ignore insecure directories and files and continue [y] or abort compinit [n]? y% ➜ ~ ➜ ~ compaudit There are insecure directories and files: /usr/share/zsh/functions/Calendar /usr/share/zsh/functions/Chpwd /usr/share/zsh/functions/Completion /usr/share/zsh/functions/Completion/AIX ``` I guess most likely this has to be fixed in zsh. However I may be wrong. I think the problem is because the files are not owned by root inside the jail. Can it be made to appear as if they are owned by root inside the jail? ``` ➜ ~ ls -ld /usr/share/zsh/functions/Calendar drwxr-xr-x 2 root root 4096 Nov 4 11:46 /usr/share/zsh/functions/Calendar ➜ ~ firejail Reading profile /etc/firejail/generic.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc ** Note: you can use --noprofile to disable generic.profile ** Parent pid 8791, child pid 8792 Child process initialized groups: cannot find name for group ID 65534 [bala@superadmin-OptiPlex-7010 ~]$ ls -ld /usr/share/zsh/functions/Calendar drwxr-xr-x 2 65534 65534 4096 Nov 4 11:46 /usr/share/zsh/functions/Calendar [bala@superadmin-OptiPlex-7010 ~]$ ```

gitea-mirror closed this issue

2026-05-05 05:15:15 -06:00

gitea-mirror commented

2026-05-05 05:15:19 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 21, 2016):

The files are indeed owned by root, however the default profile installs a user namespace without root user (--noroot) - this is why root files appear to be owned by that fake user 65534. I think it is a zsh problem.

@netblue30 commented on GitHub (Jan 21, 2016): The files are indeed owned by root, however the default profile installs a user namespace without root user (--noroot) - this is why root files appear to be owned by that fake user 65534. I think it is a zsh problem.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#175

No description provided.

Rows
Columns