github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #278] unexpected behaviour of whitelist on filesystem different from the one of $HOME #194

New issue

Closed

opened 2026-05-05 05:17:29 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 05:17:29 -06:00

Owner

Originally created by @wcat on GitHub (Feb 4, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/278

I think this is not the expected behaviour (/media/data is the mount point of a filesystem that I mount on boot):

touch /media/data/some-file /media/data/foo/some-file
firejail --blacklist=/media/data find / -name some-file 2> /dev/null
no file is found
firejail ---blacklist=/media/data --whitelist=/media/data/some-dir find / -name some-file 2> /dev/null
finds: /run/firejail/mnt/orig-media/data/some-file and /run/firejail/mnt/orig-media/data/foo/some-file

Basically if I whitelist something on /media/data then everything is accessible.

firejail version: 0.9.36
os: Fedora 23 x86_64

Originally created by @wcat on GitHub (Feb 4, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/278 I think this is not the expected behaviour (/media/data is the mount point of a filesystem that I mount on boot): `touch /media/data/some-file /media/data/foo/some-file` `firejail --blacklist=/media/data find / -name some-file 2> /dev/null` no file is found `firejail ---blacklist=/media/data --whitelist=/media/data/some-dir find / -name some-file 2> /dev/null` finds: /run/firejail/mnt/orig-media/data/some-file and /run/firejail/mnt/orig-media/data/foo/some-file Basically if I whitelist something on /media/data then everything is accessible. firejail version: 0.9.36 os: Fedora 23 x86_64

gitea-mirror

2026-05-05 05:17:29 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:17:34 -06:00

Author

Owner

@manevich commented on GitHub (Feb 4, 2016):

Unable to reproduce on Debian Jessie with stock kernel, both with 0.9.36 and 19afadb5e9.

Also, you are misusing --whitelist option, it's not opposite to --blacklist, with firejail --whitelist=/media/data/some-dir you should get /media/data/ containing only some-dir directory.

@manevich commented on GitHub (Feb 4, 2016): Unable to reproduce on Debian Jessie with stock kernel, both with 0.9.36 and https://github.com/netblue30/firejail/commit/19afadb5e95cb6c2ede60e80b81f662beb6eb899. Also, you are misusing `--whitelist` option, it's not opposite to `--blacklist`, with `firejail --whitelist=/media/data/some-dir` you should get `/media/data/` containing only `some-dir` directory.

gitea-mirror commented

2026-05-05 05:17:36 -06:00

Author

Owner

@wcat commented on GitHub (Feb 5, 2016):

ok by using only --whitelist it works as expected (only /media/data/some-dir is visible).

Blacklisting a directory and then whitelisting a directory (or file) inside it leads to different behaviors on my system:

on $HOME everything is blacklisted and I can't see any file.
on some other mount point (I've tried on /media/data and /data) whitelisting any file (or directory) completely remove the effects of the blacklisting. If possible I think that firejail in this situation should at least fail with some error message instead of whitelisting everything. Even if this is a misuse of firejail it could leads to a security problem if someone do this by mistake and didn't notice what have just happened.

@wcat commented on GitHub (Feb 5, 2016): ok by using only --whitelist it works as expected (only /media/data/some-dir is visible). Blacklisting a directory and then whitelisting a directory (or file) inside it leads to different behaviors on my system: - on $HOME everything is blacklisted and I can't see any file. - on some other mount point (I've tried on /media/data and /data) whitelisting any file (or directory) completely remove the effects of the blacklisting. If possible I think that firejail in this situation should at least fail with some error message instead of whitelisting everything. Even if this is a misuse of firejail it could leads to a security problem if someone do this by mistake and didn't notice what have just happened.

gitea-mirror commented

2026-05-05 05:17:39 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 6, 2016):

There is a more general bug here: https://github.com/netblue30/firejail/issues/276

Let me fix 276, and will take it from there. Thanks for the bug.

@netblue30 commented on GitHub (Feb 6, 2016): There is a more general bug here: https://github.com/netblue30/firejail/issues/276 Let me fix 276, and will take it from there. Thanks for the bug.

gitea-mirror commented

2026-05-05 05:17:41 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 9, 2016):

276 fixed, give it another try.

@netblue30 commented on GitHub (Feb 9, 2016): 276 fixed, give it another try.

gitea-mirror commented

2026-05-05 05:17:44 -06:00

Author

Owner

@wcat commented on GitHub (Feb 18, 2016):

yes it doesn't happen no more on 0.9.38.

Thanks

@wcat commented on GitHub (Feb 18, 2016): yes it doesn't happen no more on 0.9.38. Thanks

gitea-mirror referenced this issue

2026-05-05 10:03:39 -06:00

[PR #194] [MERGED] Fix typos #3561

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#194

No description provided.

Rows
Columns