[GH-ISSUE #2874] Write to console error message when trying to rename a whitelisted file #1797

New issue

Open

opened 2026-05-05 08:28:15 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 08:28:15 -06:00

Owner

Originally created by @crass on GitHub (Jul 27, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2874

Since the issue where rename fails on whitelisted files is somewhat common. I suggest that we try to actively notify the user when this issue is triggered. I think we can actively enable this notification only for selected profiles by adding a config option (eg. notify-rename-whitelist).

For such profiles, we could hook rename with LD_PRELOAD library. When a rename fails with EBUSY, check that the file is a mountpoint, and then write to the console a glaring message saying something to the effect that this is a known issue and to go to a url in our wiki explaining the issue and potential work arounds.

For extra points, we could detect that a program is a graphical one and also popup the message in a popup box (using our own custom program or something like xmessage, but prettier, on the host system).

Using LD_PRELOAD won't work for programs that bypass glibc for syscalls, but I'd expect that to be a rare situation.

For reference, see:

Originally created by @crass on GitHub (Jul 27, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2874 Since the issue where rename fails on whitelisted files is somewhat common. I suggest that we try to actively notify the user when this issue is triggered. I think we can actively enable this notification only for selected profiles by adding a config option (eg. `notify-rename-whitelist`). For such profiles, we could hook `rename` with `LD_PRELOAD` library. When a `rename` fails with `EBUSY`, check that the file is a mountpoint, and then write to the console a glaring message saying something to the effect that this is a known issue and to go to a url in our wiki explaining the issue and potential work arounds. For extra points, we could detect that a program is a graphical one and also popup the message in a popup box (using our own custom program or something like xmessage, but prettier, on the host system). Using `LD_PRELOAD` won't work for programs that bypass glibc for syscalls, but I'd expect that to be a rare situation. For reference, see: * #2071 * #1355 * #1793 * #2873

gitea-mirror added the

enhancement

label 2026-05-05 08:28:15 -06:00

gitea-mirror commented

2026-05-05 08:28:17 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jul 27, 2019):

Why not add this into whitelist option?

@Vincent43 commented on GitHub (Jul 27, 2019): Why not add this into `whitelist` option?

gitea-mirror commented

2026-05-05 08:28:18 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 31, 2019):

I would say let's try it out. We are already doing something similar to LD_PRELOAD for --trace and --tracelog. Also seccomp ends up there in some cases.

It's not a pure LD_PRELOAD, more like a global one based on /etc/ld.preload file. So we generate a new /etc/ld.preload file and we place in it some of our libraries (src/libtrace, src/libtracelog, src/libpostexec). When the sandboxed program starts, it will load the .so libraries. The code to build the new /etc/ld.preload is in fs_trace,c.

@netblue30 commented on GitHub (Jul 31, 2019): I would say let's try it out. We are already doing something similar to LD_PRELOAD for --trace and --tracelog. Also seccomp ends up there in some cases. It's not a pure LD_PRELOAD, more like a global one based on /etc/ld.preload file. So we generate a new /etc/ld.preload file and we place in it some of our libraries (src/libtrace, src/libtracelog, src/libpostexec). When the sandboxed program starts, it will load the .so libraries. The code to build the new /etc/ld.preload is in fs_trace,c.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1797

No description provided.

Rows
Columns