github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3126] cannot combine --private with --private= #1960

New issue

Closed

opened 2026-05-05 08:37:32 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 08:37:32 -06:00

Owner

Originally created by @jonleivent on GitHub (Jan 5, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3126

The options --private to remove all persistence and --private=dir to set the home dir could be combined. Currently, regardless of their order on the command line, combining them results in the normal --private=dir behavior with persistence. Furthermore, firejail does not currently print anything to stderr saying that the two settings are in conflict. And the doc (man page) doesn't say anything about which private-like features can or cannot be combined.

Originally created by @jonleivent on GitHub (Jan 5, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3126 The options `--private` to remove all persistence and `--private=dir` to set the home dir could be combined. Currently, regardless of their order on the command line, combining them results in the normal `--private=dir` behavior with persistence. Furthermore, firejail does not currently print anything to stderr saying that the two settings are in conflict. And the doc (man page) doesn't say anything about which private-like features can or cannot be combined.

gitea-mirror

2026-05-05 08:37:32 -06:00

closed this issue
added the
question_old
label

gitea-mirror commented

2026-05-05 08:37:35 -06:00

Author

Owner

@jonleivent commented on GitHub (Jan 5, 2020):

Oops - forgot. Firejail 0.9.58.2 in Debian buster.

@jonleivent commented on GitHub (Jan 5, 2020): Oops - forgot. Firejail 0.9.58.2 in Debian buster.

gitea-mirror commented

2026-05-05 08:37:36 -06:00

Author

Owner

@jonleivent commented on GitHub (Jan 5, 2020):

Elaborating on the use case: I've set up a home dir for an app, and typically run it with just --private=that-home-dir, but in some cases would like the same configuration without persistence. In those cases, the jailed app should see the same home, with all of its config, but with no persistence.

@jonleivent commented on GitHub (Jan 5, 2020): Elaborating on the use case: I've set up a home dir for an app, and typically run it with just --private=that-home-dir, but in some cases would like the same configuration without persistence. In those cases, the jailed app should see the same home, with all of its config, but with no persistence.

gitea-mirror commented

2026-05-05 08:37:37 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jan 6, 2020):

The assumptions behind --private is that app won't know of any existing user data which prevent leaking it so it's not valid option for your usecase. I think what you want is --overlay-tmpfs however I'm not sure if it works alongside --private=dir, please try to test it.

I agree that incompatibility between --private and --private=dir should be documented.

@Vincent43 commented on GitHub (Jan 6, 2020): The assumptions behind `--private` is that app won't know of any existing user data which prevent leaking it so it's not valid option for your usecase. I think what you want is `--overlay-tmpfs` however I'm not sure if it works alongside `--private=dir`, please try to test it. I agree that incompatibility between `--private` and `--private=dir` should be documented.

gitea-mirror commented

2026-05-05 08:37:37 -06:00

Author

Owner

@jonleivent commented on GitHub (Jan 7, 2020):

I tried --overlay-tmpfs with --private=dir and got:

Warning: private=directory feature is disabled in overlay

and it put me in an overlay without the private dir.

BTW: I was playing with --overlay-tmpfs to see if I could work with it in other ways, and noticed that it blocks out other mount points. Specifically, I had something fuse mounted, and in the overlay, the mount point appeared empty.

@jonleivent commented on GitHub (Jan 7, 2020): I tried --overlay-tmpfs with --private=dir and got: > Warning: private=directory feature is disabled in overlay and it put me in an overlay without the private dir. BTW: I was playing with --overlay-tmpfs to see if I could work with it in other ways, and noticed that it blocks out other mount points. Specifically, I had something fuse mounted, and in the overlay, the mount point appeared empty.

gitea-mirror commented

2026-05-05 08:37:38 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 10, 2020):

--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1442,6 +1442,7 @@ $ firejail \-\-private firefox
 .TP
 \fB\-\-private=directory
 Use directory as user home.
+--private and --private=directory cannot be used together.
 .br
 
 .br

@rusty-snake commented on GitHub (Feb 10, 2020): ```patch --- a/src/man/firejail.txt +++ b/src/man/firejail.txt @@ -1442,6 +1442,7 @@ $ firejail \-\-private firefox .TP \fB\-\-private=directory Use directory as user home. +--private and --private=directory cannot be used together. .br .br ```

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1960

No description provided.

Rows
Columns