[GH-ISSUE #263] --overlay mode has empty home dir

gitea-mirror commented

2026-05-05 05:16:20 -06:00

Owner

Originally created by @dshmgh on GitHub (Jan 27, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/263

I am using 0.9.36 tarball and building on a 32 bit Mageia 5 system kernel 4.1.15-desktop586-2.mga5
My setup has a separate mount point for /home. When the overlay is mounted (in fs.c in fs_overlayfs() function) the overlay home dir is empty, the overlay does not contain the original /home contents. I added code to create a second overlay for /home if the overlay home dir is empty and this seems to work. Not sure if a bind mount would work for /home as that might defeat the overlay. I also tried to add /home as a second lowerdir on the overlay mount, but that puts the user dirs at the / level which is not what we want. I can get code to you after I create a new cleaned up version.

Originally created by @dshmgh on GitHub (Jan 27, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/263 I am using 0.9.36 tarball and building on a 32 bit Mageia 5 system kernel 4.1.15-desktop586-2.mga5 My setup has a separate mount point for /home. When the overlay is mounted (in fs.c in fs_overlayfs() function) the overlay home dir is empty, the overlay does not contain the original /home contents. I added code to create a second overlay for /home if the overlay home dir is empty and this seems to work. Not sure if a bind mount would work for /home as that might defeat the overlay. I also tried to add /home as a second lowerdir on the overlay mount, but that puts the user dirs at the / level which is not what we want. I can get code to you after I create a new cleaned up version.

gitea-mirror

2026-05-05 05:16:20 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:16:25 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 27, 2016):

I'll look into it, thanks.

@netblue30 commented on GitHub (Jan 27, 2016): I'll look into it, thanks.

gitea-mirror commented

2026-05-05 05:16:27 -06:00

Author

Owner

@dshmgh commented on GitHub (Jan 27, 2016):

Should I clean up my code that seems to get around the issue and post it here?

@dshmgh commented on GitHub (Jan 27, 2016): Should I clean up my code that seems to get around the issue and post it here?

gitea-mirror commented

2026-05-05 05:16:28 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 28, 2016):

Yes, thanks!

@netblue30 commented on GitHub (Jan 28, 2016): Yes, thanks!

gitea-mirror commented

2026-05-05 05:16:32 -06:00

Author

Owner

@dshmgh commented on GitHub (Jan 29, 2016):

OK This version is from 0.9.36. I compared to the latest on github and at first glance
it does not look like the edits have any collisions. Does github really not allow .c files?
The site complained until I added .txt. Also am using firejail with the palemoon browser
(firefox fork).
fs_0.9.36_new.c.txt

@dshmgh commented on GitHub (Jan 29, 2016): OK This version is from 0.9.36. I compared to the latest on github and at first glance it does not look like the edits have any collisions. Does github really not allow .c files? The site complained until I added .txt. Also am using firejail with the palemoon browser (firefox fork). [fs_0.9.36_new.c.txt](https://github.com/netblue30/firejail/files/109197/fs_0.9.36_new.c.txt)

gitea-mirror commented

2026-05-05 05:16:36 -06:00

Author

Owner

@Sidnioulz commented on GitHub (Feb 21, 2016):

I'm going to state that dshmgh's code is likely infinitely cleaner to mines but I had to solve this issue too and decided to parse /proc/mounts on the system and apply rules to detect likely-persistent mount points (/mnt/..., /home*, /media/...) that require OverlayFS. I then place the odiff/owork folders differently from the original Firejail to make it easier for users to relate to where their data is likely to be.

Code is at ecdae3a50b and it IS dirty and it DOES NOT apply on any Firejail, my fork drifted too much and sadly I'm too busy to re-base and clean up

@Sidnioulz commented on GitHub (Feb 21, 2016): I'm going to state that dshmgh's code is likely infinitely cleaner to mines but I had to solve this issue too and decided to parse /proc/mounts on the system and apply rules to detect likely-persistent mount points (/mnt/..., /home*, /media/...) that require OverlayFS. I then place the odiff/owork folders differently from the original Firejail to make it easier for users to relate to where their data is likely to be. Code is at https://github.com/Sidnioulz/firejail/commit/ecdae3a50bb089dd869995f3871522298914b7be and it IS dirty and it DOES NOT apply on any Firejail, my fork drifted too much and sadly I'm too busy to re-base and clean up

gitea-mirror commented

2026-05-05 05:16:39 -06:00

Author

Owner

@Sidnioulz commented on GitHub (Feb 21, 2016):

It also becomes trivial with the current --overlay feature to make OverlayFS systems with a private persistent home. I've done that in ecdae3a50b and with my current setup one can alternate between a private and "classic" OverlayFS home directory when they re-run a sandbox (I use sandbox names rather than PIDs for their .firejail folder).

@Sidnioulz commented on GitHub (Feb 21, 2016): It also becomes trivial with the current --overlay feature to make OverlayFS systems with a private persistent home. I've done that in https://github.com/Sidnioulz/firejail/commit/ecdae3a50bb089dd869995f3871522298914b7be and with my current setup one can alternate between a private and "classic" OverlayFS home directory when they re-run a sandbox (I use sandbox names rather than PIDs for their .firejail folder).

gitea-mirror commented

2026-05-05 05:16:41 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 10, 2016):

@dshmgh - Merged, thanks!

@Sidnioulz - I think there is more to come, I've just got https://github.com/netblue30/firejail/issues/361
and ended up mount-binding /run. Overlayfs doesn't play nice with tmpfs mount points also. At some point I'll have to start parsing the /proc/mounts.

@netblue30 commented on GitHub (Mar 10, 2016): @dshmgh - Merged, thanks! @Sidnioulz - I think there is more to come, I've just got https://github.com/netblue30/firejail/issues/361 and ended up mount-binding /run. Overlayfs doesn't play nice with tmpfs mount points also. At some point I'll have to start parsing the /proc/mounts.

gitea-mirror commented

2026-05-05 05:16:43 -06:00

Author

Owner

@Sidnioulz commented on GitHub (Mar 10, 2016):

@netblue30 yes, I may be wrong but if I remember properly I do a direct
mount of /run/user/ since this hosts the DBus session and a few other
things. I would not label my approach as secure though, only testing for
usability and not for security at the moment.

On 10 March 2016 at 13:09, netblue30 notifications@github.com wrote:

@dshmgh https://github.com/dshmgh - Merged, thanks!

@Sidnioulz https://github.com/Sidnioulz - I think there is more to
come, I've just got #361
https://github.com/netblue30/firejail/issues/361
and ended up mount-binding /run. Overlayfs doesn't play nice with tmpfs
mount points also. At some point I'll have to start parsing the
/proc/mounts.

—
Reply to this email directly or view it on GitHub
https://github.com/netblue30/firejail/issues/263#issuecomment-194834724.

Steve Dodier-Lazaro
PhD Student
University College London
Free Software Developer

@Sidnioulz commented on GitHub (Mar 10, 2016): @netblue30 yes, I may be wrong but if I remember properly I do a direct mount of /run/user/<uid> since this hosts the DBus session and a few other things. I would _not_ label my approach as secure though, only testing for usability and not for security at the moment. On 10 March 2016 at 13:09, netblue30 notifications@github.com wrote: > @dshmgh https://github.com/dshmgh - Merged, thanks! > > @Sidnioulz https://github.com/Sidnioulz - I think there is more to > come, I've just got #361 > https://github.com/netblue30/firejail/issues/361 > and ended up mount-binding /run. Overlayfs doesn't play nice with tmpfs > mount points also. At some point I'll have to start parsing the > /proc/mounts. > > — > Reply to this email directly or view it on GitHub > https://github.com/netblue30/firejail/issues/263#issuecomment-194834724. ## Steve Dodier-Lazaro PhD Student University College London Free Software Developer

gitea-mirror commented

2026-05-05 05:16:45 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 10, 2016):

In my case it started with a user complaining about PulseAudio socket in /run/user, but when I looked at /run it was missing all kind of other files. So I just did a mount-bind on /run - basically /run runs outside the overlay, and it fixed the problem for now.

@netblue30 commented on GitHub (Mar 10, 2016): In my case it started with a user complaining about PulseAudio socket in /run/user, but when I looked at /run it was missing all kind of other files. So I just did a mount-bind on /run - basically /run runs outside the overlay, and it fixed the problem for now.

gitea-mirror referenced this issue

2026-05-05 10:03:38 -06:00

[PR #186] [MERGED] add parole.profile #3558

Rows
Columns

[GH-ISSUE #263] --overlay mode has empty home dir #186