github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3173] Directory read-only even after noblacklist/whitelist #1989

New issue

Closed

opened 2026-05-05 08:39:12 -06:00 by gitea-mirror · 9 comments

gitea-mirror commented

2026-05-05 08:39:12 -06:00

Owner

Originally created by @q3cpma on GitHub (Jan 20, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3173

Hello,

I'm trying to use emacs in qutebrowser, and to that end, I call qutebrowser that way:

exec firejail \
    --noblacklist=~/.config/mpv \
    --noblacklist=~/.emacs.d \
    --whitelist=~/.config/mpv \
    --whitelist=~/.emacs.d \
    --nodbus \
    qutebrowser "$@"

Everything works well until I try to close emacs, where it tells me that ~/.emacs.d/history is read-only. Using an eshell, I can't even touch a file inside ~/.emacs.d (I get /usr/bin/touch: cannot touch 'a': Read-only file system), but I can in my HOME. I tried adding a --read-write=~/.emacs.d to no avail.
What is even stranger is that ~/.config/mpv isn't RO.

This is on Gentoo with firejail 0.9.62

Originally created by @q3cpma on GitHub (Jan 20, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3173 Hello, I'm trying to use emacs in qutebrowser, and to that end, I call qutebrowser that way: ``` exec firejail \ --noblacklist=~/.config/mpv \ --noblacklist=~/.emacs.d \ --whitelist=~/.config/mpv \ --whitelist=~/.emacs.d \ --nodbus \ qutebrowser "$@" ``` Everything works well until I try to close emacs, where it tells me that `~/.emacs.d/history` is read-only. Using an eshell, I can't even touch a file inside `~/.emacs.d` (I get `/usr/bin/touch: cannot touch 'a': Read-only file system`), but I can in my HOME. I tried adding a `--read-write=~/.emacs.d` to no avail. What is even stranger is that `~/.config/mpv` isn't RO. This is on Gentoo with firejail 0.9.62

gitea-mirror

2026-05-05 08:39:12 -06:00

closed this issue
added the
question_old
label

gitea-mirror commented

2026-05-05 08:39:15 -06:00

Author

Owner

@reinerh commented on GitHub (Jan 20, 2020):

The qutebrowser profile includes disable-common.inc, which has this line:

read-only ${HOME}/.emacs.d

Does it work if you call it with --ignore='read-only ${HOME}/.emacs.d'?

@reinerh commented on GitHub (Jan 20, 2020): The qutebrowser profile includes disable-common.inc, which has this line: ``` read-only ${HOME}/.emacs.d ``` Does it work if you call it with `--ignore='read-only ${HOME}/.emacs.d'`?

gitea-mirror commented

2026-05-05 08:39:16 -06:00

Author

Owner

@q3cpma commented on GitHub (Jan 20, 2020):

It does, thanks. Strange that I was the first to be hit by this.

@q3cpma commented on GitHub (Jan 20, 2020): It does, thanks. Strange that I was the first to be hit by this.

gitea-mirror commented

2026-05-05 08:39:17 -06:00

Author

Owner

@reinerh commented on GitHub (Jan 20, 2020):

I can imagine the number of users of qutebrowser AND emacs AND firejail is quite small. :-)

@reinerh commented on GitHub (Jan 20, 2020): I can imagine the number of users of qutebrowser AND emacs AND firejail is quite small. :-)

gitea-mirror commented

2026-05-05 08:39:18 -06:00

Author

Owner

@q3cpma commented on GitHub (Jan 20, 2020):

Well, it work on the command line, but not in the profile. And ideally, I don't want the history to be overwritten, but I don't know how to do it.

@q3cpma commented on GitHub (Jan 20, 2020): Well, it work on the command line, but not in the profile. And ideally, I don't want the history to be overwritten, but I don't know how to do it.

gitea-mirror commented

2026-05-05 08:39:19 -06:00

Author

Owner

@reinerh commented on GitHub (Jan 20, 2020):

Adding ignore read-only ${HOME}/.emacs.d into the profile does not work?

@reinerh commented on GitHub (Jan 20, 2020): Adding `ignore read-only ${HOME}/.emacs.d` into the profile does not work?

gitea-mirror commented

2026-05-05 08:39:20 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 20, 2020):

Adding ignore read-only ${HOME}/.emacs.d before read-only ${HOME}/.emacs.d or read-write ${HOME}/.emacs.d after read-only ${HOME}/.emacs.d in the profile works.

To get this ordering on the command line you need to use --profile:

firejail '--noblacklist=${HOME}/.emacs.d' --profile=qutebrowser '--read-write=${HOME}/.emacs.d' qutebrowser

@rusty-snake commented on GitHub (Jan 20, 2020): Adding `ignore read-only ${HOME}/.emacs.d` **before** `read-only ${HOME}/.emacs.d` or `read-write ${HOME}/.emacs.d` **after** `read-only ${HOME}/.emacs.d` in the profile works. To get this ordering on the command line you need to use `--profile`: firejail '--noblacklist=${HOME}/.emacs.d' --profile=qutebrowser '--read-write=${HOME}/.emacs.d' qutebrowser

gitea-mirror commented

2026-05-05 08:39:20 -06:00

Author

Owner

@q3cpma commented on GitHub (Jan 20, 2020):

Indeed, it works well, but my original goal was to make it read-write while not merging back the changes. Something like --private for ~/.emacs.d, basically.
For now, I can live with a shared history, though.

@q3cpma commented on GitHub (Jan 20, 2020): Indeed, it works well, but my original goal was to make it read-write while not merging back the changes. Something like --private for ~/.emacs.d, basically. For now, I can live with a shared history, though.

gitea-mirror commented

2026-05-05 08:39:20 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 20, 2020):

Maybe emacs supports it to places the history file in a temp-dir such as /tmp (with private-tmp) or ~/.cache (with private-cache).

@rusty-snake commented on GitHub (Jan 20, 2020): Maybe emacs supports it to places the history file in a temp-dir such as `/tmp` (with `private-tmp`) or `~/.cache` (with `private-cache`).

gitea-mirror commented

2026-05-05 08:39:21 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 10, 2020):

I'm closing here due to inactivity, please fell free to reopen if you have more questions.

@rusty-snake commented on GitHub (Feb 10, 2020): I'm closing here due to inactivity, please fell free to reopen if you have more questions.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1989

No description provided.

Rows
Columns