github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3222] allow firejail home tmp overlay to be fuse mounted outside #2020

New issue

Closed

opened 2026-05-05 08:41:32 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 08:41:32 -06:00

Owner

Originally created by @jonleivent on GitHub (Feb 12, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3222

I thought of this enhancement when dealing with firejail --get vs. a file with spaces and other unusual characters in its name - which doesn't work well. I had to --join the jail and rename the file, then exit and --get.

Instead, suppose that a firejail's tmp overlay is fuse mountable outside the jail. This would allow standard file managers to have read and write access to that overlay from outside. Which would be much easier than dealing with --ls, --get and --put.

Originally created by @jonleivent on GitHub (Feb 12, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3222 I thought of this enhancement when dealing with firejail --get vs. a file with spaces and other unusual characters in its name - which doesn't work well. I had to --join the jail and rename the file, then exit and --get. Instead, suppose that a firejail's tmp overlay is fuse mountable outside the jail. This would allow standard file managers to have read and write access to that overlay from outside. Which would be much easier than dealing with --ls, --get and --put.

gitea-mirror closed this issue

2026-05-05 08:41:33 -06:00

gitea-mirror commented

2026-05-05 08:41:34 -06:00

Author

Owner

@jonleivent commented on GitHub (Feb 12, 2020):

Just tried another workaround for --get's inability to deal with problematic filenames - I tried firejail --get=jail ~/Downloads to get the whole Downloads folder from a jail, which contains files with problematic names. That doesn't work - the --get produces a non-folder 0-length file named Downloads. Maybe the above enhancement of having an outside mountable home tmp overlay would eliminate the need to fix these other bugs in the file transfer protocol.

@jonleivent commented on GitHub (Feb 12, 2020): Just tried another workaround for --get's inability to deal with problematic filenames - I tried `firejail --get=jail ~/Downloads` to get the whole Downloads folder from a jail, which contains files with problematic names. That doesn't work - the --get produces a non-folder 0-length file named Downloads. Maybe the above enhancement of having an outside mountable home tmp overlay would eliminate the need to fix these other bugs in the file transfer protocol.

gitea-mirror commented

2026-05-05 08:41:35 -06:00

Author

Owner

@jonleivent commented on GitHub (Feb 12, 2020):

I'm guessing it would be easiest to first mount a tmpfs over a mountpoint like /run/firejail/home/$PID, then bind mount that as the overlay for home within the jail started with that pid.

@jonleivent commented on GitHub (Feb 12, 2020): I'm guessing it would be easiest to first mount a tmpfs over a mountpoint like /run/firejail/home/$PID, then bind mount that as the overlay for home within the jail started with that pid.

gitea-mirror commented

2026-05-05 08:41:36 -06:00

Author

Owner

@jonleivent commented on GitHub (Feb 12, 2020):

I found a workaround that works:
firejail --quiet --join=jail tar cf - Downloads | tar xvf -

@jonleivent commented on GitHub (Feb 12, 2020): I found a workaround that works: `firejail --quiet --join=jail tar cf - Downloads | tar xvf -`

gitea-mirror commented

2026-05-05 08:41:37 -06:00

Author

Owner

@smitsohu commented on GitHub (Feb 15, 2020):

There is a sandbox filesystem and you want an easier and more direct way to access it from the sandbox host, right?

I think you may want to have a look at Firejail's --private= option.
Or, for example, in a profile:

mkdir ${HOME}/.local/share/firejail/appname
private ${HOME}/.local/share/firejail/appname

This way you create a new subtree in ~/.local/share/firejail which is trivially accessible from outside the sandbox. It is a bit like what Flatpak does, but in a different location.

As almost all code exists already in Firejail, implementing it as a new option shouldn't be a big deal, just in case that's what's desired.

@smitsohu commented on GitHub (Feb 15, 2020): There is a sandbox filesystem and you want an easier and more direct way to access it from the sandbox host, right? I think you may want to have a look at Firejail's `--private=` option. Or, for example, in a profile: ``` mkdir ${HOME}/.local/share/firejail/appname private ${HOME}/.local/share/firejail/appname ``` This way you create a new subtree in ~/.local/share/firejail which is trivially accessible from outside the sandbox. It is a bit like what Flatpak does, but in a different location. As almost all code exists already in Firejail, implementing it as a new option shouldn't be a big deal, just in case that's what's desired.

gitea-mirror commented

2026-05-05 08:41:38 -06:00

Author

Owner

@jonleivent commented on GitHub (Feb 15, 2020):

Yes, I use the --private= option quite a bit, but in this case I really don't want disk persistence (SSD in this case, so secure delete afterwards is out of the question) for anything other than a carefully selected file downloaded in the jail. But, a variation of what you suggest should work:

mkdir /tmp/tmphome
firejail --private=/tmp/tmphome ...

@jonleivent commented on GitHub (Feb 15, 2020): Yes, I use the --private= option quite a bit, but in this case I really don't want disk persistence (SSD in this case, so secure delete afterwards is out of the question) for anything other than a carefully selected file downloaded in the jail. But, a variation of what you suggest should work: ``` mkdir /tmp/tmphome firejail --private=/tmp/tmphome ... ```

gitea-mirror referenced this issue

2026-05-05 10:14:45 -06:00

[PR #2020] [MERGED] Fix Gajim 1.0.3 startup on Fedora 28. #4154

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2020

No description provided.

Rows
Columns