github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2882] Nowhitelist option does not disable whitelisting entirely #1801

New issue

Open

opened 2026-05-05 08:28:29 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 08:28:29 -06:00

Owner

Originally created by @jose1711 on GitHub (Jul 31, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2882

Say I have a profile shipped with firejail that enables whitelisting of $DOWNLOADS. Something like this:

# cat /etc/firejail/foo.profile
include foo.local
whitelist ${DOWNLOADS}

Let's assume we want to disable whitelisting so we create a foo.local file and add nowhitelist:

nowhitelist ${DOWNLOADS}

One would expect that whitelisting is effectively disabled but this is not true:

~ ls -l random_file                                                
-rw-r--r-- 1 jose users 7 Jul 31 22:41 random_file
~ firejail --profile=/etc/firejail/foo.profile ls -la ~/random_file      
Reading profile /etc/firejail/foo.profile
Reading profile /etc/firejail/foo.local
Parent pid 15790, child pid 15791
Child process initialized in 62.67 ms
ls: cannot access '/home/jose/random_file': No such file or directory

Parent is shutting down, bye...

Originally created by @jose1711 on GitHub (Jul 31, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2882 Say I have a profile shipped with `firejail` that enables whitelisting of `$DOWNLOADS`. Something like this: ``` # cat /etc/firejail/foo.profile include foo.local whitelist ${DOWNLOADS} ``` Let's assume we want to disable whitelisting so we create a `foo.local` file and add `nowhitelist`: ``` nowhitelist ${DOWNLOADS} ``` One would expect that `whitelisting` is effectively disabled but this is not true: ``` ~ ls -l random_file -rw-r--r-- 1 jose users 7 Jul 31 22:41 random_file ~ firejail --profile=/etc/firejail/foo.profile ls -la ~/random_file Reading profile /etc/firejail/foo.profile Reading profile /etc/firejail/foo.local Parent pid 15790, child pid 15791 Child process initialized in 62.67 ms ls: cannot access '/home/jose/random_file': No such file or directory Parent is shutting down, bye... ```

gitea-mirror added the

bug

label 2026-05-05 08:28:29 -06:00

gitea-mirror commented

2026-05-05 08:28:32 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 31, 2019):

As soon as it runs into a whitelist statement, firejail will mount a temporary filesystem on top of your directory. It doesn't matter if you already unwhitelisted the file.

@netblue30 commented on GitHub (Jul 31, 2019): As soon as it runs into a whitelist statement, firejail will mount a temporary filesystem on top of your directory. It doesn't matter if you already unwhitelisted the file.

gitea-mirror commented

2026-05-05 08:28:32 -06:00

Author

Owner

@jose1711 commented on GitHub (Aug 1, 2019):

Note that here whitelist and nowhitelist both mention the same directory. So my understanding of this would be:

firejail builds a list of files/directories to be whitelisted
${DOWNLOADS} enters this list but is shortly removed from it by nowhitelist option
at the end there are no files/dirs to be whitelisted hence the mounting over tempfs does not occur

@jose1711 commented on GitHub (Aug 1, 2019): Note that here `whitelist` and `nowhitelist` both mention the same directory. So my understanding of this would be: - `firejail` builds a list of files/directories to be whitelisted - `${DOWNLOADS}` enters this list but is shortly removed from it by `nowhitelist` option - at the end there are no files/dirs to be whitelisted hence the mounting over tempfs does not occur

gitea-mirror commented

2026-05-05 08:28:33 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 1, 2019):

@jose1711 Not looked in the code, but I think @netblue30 mean that firejail do the mount on top of $HOME (or what every) once it finds a whitelist and then check which files need to be bind-mounted.

Here firejail see a whitelist ${HOME}/something and mount a new empty fs on top of $HOME then it see it has do be bind-mount ${DOWNLOADS} but Uhh wait there was prevouisly a nowhitelist ${DOWNLOADS}. So it skip the bind-mount of DOWNLOADS and go ahead (to the next whitelist ~/some).

@rusty-snake commented on GitHub (Aug 1, 2019): @jose1711 Not looked in the code, but I think @netblue30 mean that firejail do the mount on top of $HOME (or what every) once it finds a `whitelist` and then check which files need to be bind-mounted. Here firejail see a `whitelist ${HOME}/something` and mount a new empty fs on top of $HOME then it see it has do be bind-mount `${DOWNLOADS}` but Uhh wait there was prevouisly a `nowhitelist ${DOWNLOADS}`. So it skip the bind-mount of DOWNLOADS and go ahead (to the next whitelist ~/some).

gitea-mirror commented

2026-05-05 08:28:34 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 10, 2019):

How to proceed?

@rusty-snake commented on GitHub (Sep 10, 2019): How to proceed?

gitea-mirror commented

2026-05-05 08:28:36 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 4, 2019):

If there is no whitelist ${HOME} after nowhitelist the whitelisting of ${HOME} should IMHO be disabled, because it will break disabling whitelist in .local files and force users to copy .profile or edit in etc.

@rusty-snake commented on GitHub (Oct 4, 2019): If there is no `whitelist ${HOME}` after `nowhitelist` the whitelisting of `${HOME}` should IMHO be disabled, because it will break disabling whitelist in .local files and force users to copy .profile or edit in etc.

gitea-mirror commented

2026-05-05 08:28:37 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 14, 2019):

@smitsohu this get fixed once or new whitelist implementation gets merged, right?

@rusty-snake commented on GitHub (Dec 14, 2019): @smitsohu this get fixed once or new whitelist implementation gets merged, right?

gitea-mirror commented

2026-05-05 08:28:38 -06:00

Author

Owner

@smitsohu commented on GitHub (Dec 16, 2019):

@rusty-snake the alternative whitelist implementation would fix it, yes.

@smitsohu commented on GitHub (Dec 16, 2019): @rusty-snake the alternative whitelist implementation would fix it, yes.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1801

No description provided.

Rows
Columns