[GH-ISSUE #2942] tar profile needs firejail in private-bin for xz support #1834

New issue

Closed

opened 2026-05-05 08:30:16 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 08:30:16 -06:00

Owner

Originally created by @ghost on GitHub (Sep 6, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2942

Due to profile inheritance the tar profile fails when handling tar.xz archives, because it can't find the firejail command:

$ cat "${HOME}/bin/xz"

#!/bin/sh
#
## wrapper for xz
#+ sandbox support via firejail

### vars
_app="xz"
_bin="/usr/bin/${_app}"

# sandboxing
_sbox_mode="quiet"
[ "$_sbox_mode" = "quiet" ] && _bin="firejail --quiet ${_bin}"
[ "$_sbox_mode" = "verbose" ] && _bin="firejail --ignore=quiet ${_bin}"


### logic
# don't background or redirect
${_bin} "$@"

$ grep private-bin /etc/firejail/tar.profile
private-bin bash,bzip2,compress,gtar,gzip,lbzip2,lzip,lzma,lzop,sh,tar,xz

$ firejail /usr/bin/tar -xJf data.tar.xz -C .
/home/glitsj16/bin/xz: line 18: firejail: command not found

We need to add firejail to private-bin:

$ firejail --private-bin=firejail /usr/bin/tar -xJf data.tar.xz -C .
-- no output, all good --

Originally created by @ghost on GitHub (Sep 6, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2942 Due to profile inheritance the tar profile fails when handling tar.xz archives, because it can't find the firejail command: $ cat "${HOME}/bin/xz" ``` #!/bin/sh # ## wrapper for xz #+ sandbox support via firejail ### vars _app="xz" _bin="/usr/bin/${_app}" # sandboxing _sbox_mode="quiet" [ "$_sbox_mode" = "quiet" ] && _bin="firejail --quiet ${_bin}" [ "$_sbox_mode" = "verbose" ] && _bin="firejail --ignore=quiet ${_bin}" ### logic # don't background or redirect ${_bin} "$@" ``` $ grep private-bin /etc/firejail/tar.profile `private-bin bash,bzip2,compress,gtar,gzip,lbzip2,lzip,lzma,lzop,sh,tar,xz ` $ firejail /usr/bin/tar -xJf data.tar.xz -C . `/home/glitsj16/bin/xz: line 18: firejail: command not found ` We need to add `firejail` to `private-bin`: $ firejail --private-bin=firejail /usr/bin/tar -xJf data.tar.xz -C . `-- no output, all good --`