github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2867] Can't seem to stop .Xauthority or .asound from being created/copied #1789

New issue

Closed

opened 2026-05-05 08:27:42 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 08:27:42 -06:00

Owner

Originally created by @slackhead on GitHub (Jul 22, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2867

firejail 0.9.60

I would like to run shell scripts that don't require network, X11 or sound

firejail --x11=none --net=none --nosound --private=./ sh

Originally created by @slackhead on GitHub (Jul 22, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2867 firejail 0.9.60 I would like to run shell scripts that don't require network, X11 or sound firejail --x11=none --net=none --nosound --private=./ sh <script> However I can't stop .asound or .Xauthority being made in current directory. I tried blacklisting ${HOME}/.Xauthority etc. in disable-common.inc and default.profile but it didn't have any effect. I also tried with --noprofile too but it didn't help. Any ideas?

gitea-mirror

2026-05-05 08:27:42 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 08:27:45 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 22, 2019):

--private=./ for what?
firejail --x11=none --net=none --nosound ls -l .Xauthority should show you r-------- and owner: nobody => firejail --x11=none --net=none --nosound cat .Xauthority ends in Permission denied
If you want that they don't exist, you need to use whitelist.
EDIT:
To deny access to .asound you need --blacklist=${HOME}/.asound.

@rusty-snake commented on GitHub (Jul 22, 2019): 1. `--private=./` for what? 2. `firejail --x11=none --net=none --nosound ls -l .Xauthority` should show you `r--------` and owner: `nobody` => `firejail --x11=none --net=none --nosound cat .Xauthority` ends in `Permission denied` 3. If you want that they don't exist, you need to use `whitelist`. EDIT: To deny access to `.asound` you need `--blacklist=${HOME}/.asound`.

gitea-mirror commented

2026-05-05 08:27:46 -06:00

Author

Owner

@slackhead commented on GitHub (Jul 22, 2019):

1 I need to block any writing to filesystem except for the current directory and /tmp. --chroot seems to want the cwd to be owned by root.

2 The current directory is a build directory whch will be synced with a git repo after each shell script has been tested, so I don't want any extra files created.

I have tried to whitelist them but it makes no difference:

whitelist ${HOME}/.asoundrc
whitelist ${HOME}/.Xauthority

in both default.profile and whitelist-common.inc.

Thanks

EDIT

It seems --chroot wants a real chroot with /proc etc. anyway.

@slackhead commented on GitHub (Jul 22, 2019): Hi 1 I need to block any writing to filesystem except for the current directory and /tmp. --chroot seems to want the cwd to be owned by root. 2 The current directory is a build directory whch will be synced with a git repo after each shell script has been tested, so I don't want any extra files created. I have tried to whitelist them but it makes no difference: whitelist ${HOME}/.asoundrc whitelist ${HOME}/.Xauthority in both default.profile and whitelist-common.inc. Thanks EDIT It seems --chroot wants a real chroot with /proc etc. anyway.

gitea-mirror commented

2026-05-05 08:27:47 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 22, 2019):

Well, now I get you setup and intend.

I have tried to whitelist them but it makes no difference:

whitelisting the files you want, not the files you don't want. Anyway.

I need to block any writing to filesystem except for the current directory and /tmp.

--private=. will only protect ${HOME}.
You can use --read-only=PATH to mount PATH ro.

@rusty-snake commented on GitHub (Jul 22, 2019): Well, now I get you setup and intend. > I have tried to whitelist them but it makes no difference: `whitelist`ing the files you want, not the files you don't want. Anyway. > I need to block any writing to filesystem except for the current directory and /tmp. `--private=.` will only protect `${HOME}`. You can use `--read-only=PATH` to mount PATH `ro`.

gitea-mirror commented

2026-05-05 08:27:48 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 22, 2019):

@slackhead can you try firejail --x11=none --net=none --nosound --whitelist=${HOME}/GIT_REPO bash SCRIPT

@rusty-snake commented on GitHub (Jul 22, 2019): @slackhead can you try `firejail --x11=none --net=none --nosound --whitelist=${HOME}/GIT_REPO bash SCRIPT`

gitea-mirror commented

2026-05-05 08:27:48 -06:00

Author

Owner

@slackhead commented on GitHub (Jul 22, 2019):

Thanks, that helps a lot. I have a couple of different ideas. This one blacklists /tmp too:

firejail \
  --shell=none \
  --net=none \
  --x11=none \
  --nosound \
  --blacklist=/tmp \
  --whitelist=`pwd` \
  --noprofile $@

I also will need to run some scripts as root and be able to use ccache. I think something like this should work if I set the ccache directory to a named overlay in /root/.firejail/sbo/odiff/root/.ccache

firejail \
--net=none \
--shell=none \
--nosound \
--x11=none \
--noprofile \
--read-only=`pwd` \
--overlay-named=sbo \
sh <script>

Hopefully that leaves only /tmp writeable, and I should be able to find /root/.firejail to see if anything tried write anywhere else.

@slackhead commented on GitHub (Jul 22, 2019): Thanks, that helps a lot. I have a couple of different ideas. This one blacklists /tmp too: ``` firejail \ --shell=none \ --net=none \ --x11=none \ --nosound \ --blacklist=/tmp \ --whitelist=`pwd` \ --noprofile $@ ``` I also will need to run some scripts as root and be able to use ccache. I think something like this should work if I set the ccache directory to a named overlay in /root/.firejail/sbo/odiff/root/.ccache ``` firejail \ --net=none \ --shell=none \ --nosound \ --x11=none \ --noprofile \ --read-only=`pwd` \ --overlay-named=sbo \ sh <script> ``` Hopefully that leaves only /tmp writeable, and I should be able to find /root/.firejail to see if anything tried write anywhere else.

gitea-mirror commented

2026-05-05 08:27:49 -06:00

Author

Owner

@smitsohu commented on GitHub (Jul 26, 2019):

IMHO it would be "more right" to indeed not copy these files if there is a nosound or x11 none option.

@smitsohu commented on GitHub (Jul 26, 2019): IMHO it would be "more right" to indeed not copy these files if there is a `nosound` or `x11 none` option.

gitea-mirror commented

2026-05-05 08:27:50 -06:00

Author

Owner

@smitsohu commented on GitHub (Aug 7, 2019):

Should be fixed.

@smitsohu commented on GitHub (Aug 7, 2019): Should be fixed.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1789

No description provided.

Rows
Columns