[GH-ISSUE #280] read-only whitelists #193

New issue

Closed

opened 2026-05-05 05:17:29 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 05:17:29 -06:00

Owner

Originally created by @netblue30 on GitHub (Feb 8, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/280

From wordpress:

Is there any chance for read-only whitelisting? I would like to whitelist a certain file, but also to make sure the program can’t change that file. Right now, I try to make a copy of that file to a temporary private home, but some files are too large to do that with.

Originally created by @netblue30 on GitHub (Feb 8, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/280 From wordpress: Is there any chance for read-only whitelisting? I would like to whitelist a certain file, but also to make sure the program can’t change that file. Right now, I try to make a copy of that file to a temporary private home, but some files are too large to do that with.

gitea-mirror closed this issue

2026-05-05 05:17:30 -06:00

gitea-mirror commented

2026-05-05 05:17:34 -06:00

Author

Owner

@manevich commented on GitHub (Feb 8, 2016):

Unable to find original discussion on wordpress, so I may miss something,
but firejail --whitelist=some-file --read-only=some-file solves this problem, isn't it?
This can be improved a bit, by checking if file is also in read-only list when white-listing so it's mounted only once:

$firejail --whitelist=home/user/some-file --read-only=/home/user/some-file
$cat /proc/mounts | grep some-file
/dev/sda1 /home/user/some-file ext4 rw,relatime,data=ordered 0 0
/dev/sda1 /home/user/some-file ext4 ro,relatime,data=ordered 0 0

@manevich commented on GitHub (Feb 8, 2016): Unable to find original discussion on wordpress, so I may miss something, but `firejail --whitelist=some-file --read-only=some-file` solves this problem, isn't it? This can be improved a bit, by checking if file is also in read-only list when white-listing so it's mounted only once: ``` $firejail --whitelist=home/user/some-file --read-only=/home/user/some-file $cat /proc/mounts | grep some-file /dev/sda1 /home/user/some-file ext4 rw,relatime,data=ordered 0 0 /dev/sda1 /home/user/some-file ext4 ro,relatime,data=ordered 0 0 ```

gitea-mirror commented

2026-05-05 05:17:36 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 9, 2016):

The solution is to both --whitelist and --read-only. It is already implemented in 0.9.38

$ firejail --whitelist=~/.config --read-only=~/.config
Reading profile /etc/firejail/generic.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 26380, child pid 26381

Child process initialized

$ ls -al
total 12
drwx------  3 netblue netblue  100 Feb  8 11:43 .
drwxr-xr-x  3   65534   65534   60 Feb  8 11:43 ..
-rw-r--r--  1 netblue netblue 3515 Feb  8 11:43 .bashrc
drwx------ 27 netblue netblue 4096 Feb  7 22:29 .config
-rw-------  1 netblue netblue  154 Feb  8 11:43 .Xauthority

$ cd .config
$ touch zzz
touch: cannot touch ‘zzz’: Read-only file system

@netblue30 commented on GitHub (Feb 9, 2016): The solution is to both --whitelist and --read-only. It is already implemented in 0.9.38 ``` $ firejail --whitelist=~/.config --read-only=~/.config Reading profile /etc/firejail/generic.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc ** Note: you can use --noprofile to disable generic.profile ** Parent pid 26380, child pid 26381 Child process initialized $ ls -al total 12 drwx------ 3 netblue netblue 100 Feb 8 11:43 . drwxr-xr-x 3 65534 65534 60 Feb 8 11:43 .. -rw-r--r-- 1 netblue netblue 3515 Feb 8 11:43 .bashrc drwx------ 27 netblue netblue 4096 Feb 7 22:29 .config -rw------- 1 netblue netblue 154 Feb 8 11:43 .Xauthority $ cd .config $ touch zzz touch: cannot touch ‘zzz’: Read-only file system ```

gitea-mirror referenced this issue

2026-05-05 10:03:39 -06:00

[PR #193] [MERGED] Make the build reproducible #3560

gitea-mirror referenced this issue

2026-05-05 10:48:50 -06:00

[PR #6404] [MERGED] build: improve reliability/portability of date command usage #6000