github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #261] On older kernels, file blacklisted in running jail can't be removed (from outside of jail) #185

New issue

Closed

opened 2026-05-05 05:16:20 -06:00 by gitea-mirror · 8 comments

gitea-mirror commented

2026-05-05 05:16:20 -06:00

Owner

Originally created by @manevich on GitHub (Jan 26, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/261

File blacklisted in running jail can't be removed (from outside of jail).
This causes serious inconvenience when using firejail with long running (eg. server) processes.
For example, preventing user from updating system normally, as files like /bin/su, /bin/mount, /usr/bin/sudo are blacklisted by default.

Steps to reproduce:

OS: Debian Jessie, with stock kernel.
Create file that will be blacklisted in jail, file must be created before running firejail:

$touch ~/.netrc

Run firejail:

$firejail firefox

From outside of jail, run

$rm ~/.netrc
rm: cannot remove ‘/home/user/.netrc’: Device or resource busy

Originally created by @manevich on GitHub (Jan 26, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/261 File blacklisted in running jail can't be removed (from outside of jail). This causes serious inconvenience when using firejail with long running (eg. server) processes. For example, preventing user from updating system normally, as files like `/bin/su`, `/bin/mount`, `/usr/bin/sudo` are blacklisted by default. Steps to reproduce: - OS: Debian Jessie, with stock kernel. - Create file that will be blacklisted in jail, **file must be created before running firejail**: ``` shell $touch ~/.netrc ``` - Run firejail: ``` shell $firejail firefox ``` - From outside of jail, run ``` shell $rm ~/.netrc rm: cannot remove ‘/home/user/.netrc’: Device or resource busy ```

gitea-mirror

2026-05-05 05:16:20 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:16:25 -06:00

Author

Owner

@genodeftest commented on GitHub (Jan 26, 2016):

I cannot reproduce this issue. Which version are you using? I am running version 59f6010 and cea5874 from git. Not with a user-local ~/.netrc file nor with a global file like /usr/bin/su.

@genodeftest commented on GitHub (Jan 26, 2016): I cannot reproduce this issue. Which version are you using? I am running version 59f6010 and cea5874 from git. Not with a user-local `~/.netrc` file nor with a global file like /usr/bin/su.

gitea-mirror commented

2026-05-05 05:16:27 -06:00

Author

Owner

@manevich commented on GitHub (Jan 26, 2016):

Well, I was wrong closing this issue.
Reproduced it with cea58747d6 version.

File must be created before running firejail, missed this when closed bug.
I am using Debian Jessie with stock kernel:

$ cat /etc/debian_version
8.3
$ uname -a
Linux localhost 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt20-1+deb8u3 (2016-01-17) x86_64 GNU/Linux

Updating description with some clarifications.

@manevich commented on GitHub (Jan 26, 2016): Well, I was wrong closing this issue. Reproduced it with https://github.com/netblue30/firejail/commit/cea58747d61dc56ff8bb57aa02786cd8cc423bca version. File must be created before running firejail, missed this when closed bug. I am using Debian Jessie with stock kernel: ``` $ cat /etc/debian_version 8.3 $ uname -a Linux localhost 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt20-1+deb8u3 (2016-01-17) x86_64 GNU/Linux ``` Updating description with some clarifications.

gitea-mirror commented

2026-05-05 05:16:29 -06:00

Author

Owner

@manevich commented on GitHub (Jan 26, 2016):

Looks like issue with old kernel, on same system with newer kernel everything fine.

$ uname -a
Linux localhost 4.3.0-0.bpo.1-amd64 #1 SMP Debian 4.3.3-7~bpo8+1 (2016-01-19) x86_64 GNU/Linux

@manevich commented on GitHub (Jan 26, 2016): Looks like issue with old kernel, on same system with newer kernel everything fine. ``` $ uname -a Linux localhost 4.3.0-0.bpo.1-amd64 #1 SMP Debian 4.3.3-7~bpo8+1 (2016-01-19) x86_64 GNU/Linux ```

gitea-mirror commented

2026-05-05 05:16:32 -06:00

Author

Owner

@genodeftest commented on GitHub (Jan 26, 2016):

That's a good explanation. I was running a 4.3.x kernel when unable to reproduce.

@genodeftest commented on GitHub (Jan 26, 2016): That's a good explanation. I was running a 4.3.x kernel when unable to reproduce.

gitea-mirror commented

2026-05-05 05:16:36 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 27, 2016):

I'm surprised this didn't come earlier. Blacklisting is implementing by mounting an empty, read-only file or directory on top of the original file. The kernel, at least the older kernels, will refuse to delete the file because it is a mount point in some other place in the system. There is nothing we can do about it at application level.

@netblue30 commented on GitHub (Jan 27, 2016): I'm surprised this didn't come earlier. Blacklisting is implementing by mounting an empty, read-only file or directory on top of the original file. The kernel, at least the older kernels, will refuse to delete the file because it is a mount point in some other place in the system. There is nothing we can do about it at application level.

gitea-mirror commented

2026-05-05 05:16:39 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 1, 2016):

I documented the problem on project page: https://firejail.wordpress.com/support/known-problems/

@netblue30 commented on GitHub (Feb 1, 2016): I documented the problem on project page: https://firejail.wordpress.com/support/known-problems/

gitea-mirror commented

2026-05-05 05:16:41 -06:00

Author

Owner

@david-drinn commented on GitHub (May 27, 2016):

Does someone know the specific kernel fix/change that resolved this in Linux kernel 3.18 or newer? I'm at a slightly older kernel, and don't currently have the option to update the kernel to 3.18+, but can request fixes. EDIT: Oh, is it due to the 3.18 OverlayFS feature mentioned elsewhere in the firejail docs?

@david-drinn commented on GitHub (May 27, 2016): Does someone know the specific kernel fix/change that resolved this in Linux kernel 3.18 or newer? I'm at a slightly older kernel, and don't currently have the option to update the kernel to 3.18+, but can request fixes. EDIT: Oh, is it due to the 3.18 OverlayFS feature mentioned elsewhere in the firejail docs?

gitea-mirror commented

2026-05-05 05:16:44 -06:00

Author

Owner

@netblue30 commented on GitHub (May 31, 2016):

No, it has nothing do with OverlayFS. I think it was just on of those small kernel fixes that never get mentioned as a feature.

@netblue30 commented on GitHub (May 31, 2016): No, it has nothing do with OverlayFS. I think it was just on of those small kernel fixes that never get mentioned as a feature.

gitea-mirror referenced this issue

2026-05-05 10:03:38 -06:00

[PR #185] [CLOSED] blacklist recently-used.xbel* #3557

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#185

No description provided.

Rows
Columns