[GH-ISSUE #3072] Question about OverlayFS #1925

New issue

Closed

opened 2026-05-05 08:35:35 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 08:35:35 -06:00

Owner

Originally created by @Futureknows on GitHub (Dec 4, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3072

I am looking for a certain functionality as follows: Allow a FJ sandbox to write files to a folder without being able to view or access any of the preexisting contents of the folder. Then when sandbox is closed "flatten" the folder so that all the new and old contents are retained.

Is this possible with the overlayfs or other arguments?

Originally created by @Futureknows on GitHub (Dec 4, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/3072 I am looking for a certain functionality as follows: Allow a FJ sandbox to write files to a folder without being able to view or access any of the preexisting contents of the folder. Then when sandbox is closed "flatten" the folder so that all the new and old contents are retained. Is this possible with the overlayfs or other arguments?

gitea-mirror closed this issue

2026-05-05 08:35:36 -06:00

gitea-mirror commented

2026-05-05 08:35:37 -06:00

Author

Owner

@ghost commented on GitHub (Dec 14, 2019):

Personally I've never had the need for such a use-case, so this is untested, but I think you can use the --overlay-named=name in combination with the --put options.

Quoting from man firejail:

Mount a filesystem overlay on top of the current filesystem. Unlike the regular filesystem container, the system directories are mounted read-write. All filesystem modifications go into the overlay. Directories /run, /tmp and /dev are not covered by the overlay. The overlay is stored in $HOME/.firejail/ directory. The created overlay can be reused between multiple sessions. If the sandbox is started as a regular user, nonewprivs and a default capabilities filter are enabled.

You can drop files into any noblacklisted/whitelisted directory using --put once the relevant sandbox is active (started with an additional --name=foo for ease-of-use):

firejail --put=foo ~/my_special_file ~/my_special_folder/my_special_file

You'll need to do the above for each file you want to transfer into the sandbox. See the FILE TRANSFER section in man firejail for more details. I do recommend experimenting/testing with a small sample of test files before committing such a scripted approach. HTH.

@ghost commented on GitHub (Dec 14, 2019): Personally I've never had the need for such a use-case, so this is untested, but I think you can use the `--overlay-named=name` in combination with the `--put` options. Quoting from `man firejail`: _Mount a filesystem overlay on top of the current filesystem. Unlike the regular filesystem container, the system directories are mounted read-write. All filesystem modifications go into the overlay. Directories /run, /tmp and /dev are not covered by the overlay. The overlay is stored in $HOME/.firejail/<NAME> directory. The created overlay can be reused between multiple sessions. If the sandbox is started as a regular user, nonewprivs and a default capabilities filter are enabled._ You can drop files into any noblacklisted/whitelisted directory using --put once the relevant sandbox is active (started with an additional --name=foo for ease-of-use): `firejail --put=foo ~/my_special_file ~/my_special_folder/my_special_file` You'll need to do the above for each file you want to transfer into the sandbox. See the FILE TRANSFER section in `man firejail` for more details. I do recommend experimenting/testing with a small sample of test files before committing such a scripted approach. HTH.

gitea-mirror commented

2026-05-05 08:35:38 -06:00

Author

Owner

@Futureknows commented on GitHub (Jan 7, 2020):

Thanks it looks like a good solution. I settled on a script that moves the files above the folder on each launch so the jail just gets the empty directory and I can access all the files outside.

@Futureknows commented on GitHub (Jan 7, 2020): Thanks it looks like a good solution. I settled on a script that moves the files above the folder on each launch so the jail just gets the empty directory and I can access all the files outside.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1925

No description provided.

Rows
Columns