github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3245] How to blacklist specific drive or partition #2035

New issue

Closed

opened 2026-05-05 08:42:23 -06:00 by gitea-mirror · 11 comments

gitea-mirror commented

2026-05-05 08:42:23 -06:00

Owner

Originally created by @CodeArtisan00 on GitHub (Feb 24, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3245

I'm trying to blacklist certain partition but unable to do so. I tried to blacklist /run/media/user/partition's name , but that didn't pay off. As of now, I don't know what do. disable-mnt won't help me as I need access to other drives. Any help would be appreciated.

Spec: Manjaro (KDE), Kernel: 5.5.x, Firejail ver: 0.9.62

Originally created by @CodeArtisan00 on GitHub (Feb 24, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3245 I'm trying to blacklist certain partition but unable to do so. I tried to blacklist /run/media/user/partition's name , but that didn't pay off. As of now, I don't know what do. disable-mnt won't help me as I need access to other drives. Any help would be appreciated. Spec: Manjaro (KDE), Kernel: 5.5.x, Firejail ver: 0.9.62

gitea-mirror closed this issue

2026-05-05 08:42:24 -06:00

gitea-mirror commented

2026-05-05 08:42:26 -06:00

Author

Owner

@arrowgent commented on GitHub (Feb 25, 2020):

where are your mounted files actually at?

in /mnt
or /media
?

@arrowgent commented on GitHub (Feb 25, 2020): where are your mounted files actually at? in /mnt or /media ?

gitea-mirror commented

2026-05-05 08:42:27 -06:00

Author

Owner

@CodeArtisan00 commented on GitHub (Feb 26, 2020):

where are your mounted files actually at?

in /mnt
or /media
?

/media

@CodeArtisan00 commented on GitHub (Feb 26, 2020): > where are your mounted files actually at? > > in /mnt > or /media > ? /media

gitea-mirror commented

2026-05-05 08:42:28 -06:00

Author

Owner

@smitsohu commented on GitHub (Feb 26, 2020):

Do you try to blacklist inside a FUSE mount?

If yes, you somehow need to add allow_root to the FUSE mount options.

@smitsohu commented on GitHub (Feb 26, 2020): Do you try to blacklist inside a FUSE mount? If yes, you somehow need to add `allow_root` to the FUSE mount options.

gitea-mirror commented

2026-05-05 08:42:30 -06:00

Author

Owner

@CodeArtisan00 commented on GitHub (Feb 27, 2020):

Do you try to blacklist inside a FUSE mount?

If yes, you somehow need to add allow_root to the FUSE mount options.

not necessarily inside a FUSE mount. What I want is close to disable-mnt but for specific drives.

@CodeArtisan00 commented on GitHub (Feb 27, 2020): > Do you try to blacklist inside a FUSE mount? > > If yes, you somehow need to add `allow_root` to the FUSE mount options. not necessarily inside a FUSE mount. What I want is close to disable-mnt but for specific drives.

gitea-mirror commented

2026-05-05 08:42:31 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 28, 2020):

I think the issue is that blacklist/whitelist has only an effect if the directory/file is already present when the sandbox is started.

@rusty-snake commented on GitHub (Feb 28, 2020): I think the issue is that `blacklist`/`whitelist` has only an effect if the directory/file is already present when the sandbox is started.

gitea-mirror commented

2026-05-05 08:42:32 -06:00

Author

Owner

@CodeArtisan00 commented on GitHub (Feb 28, 2020):

I think the issue is that blacklist/whitelist has only an effect if the directory/file is already present when the sandbox is started.

yes... is there any workaround?

@CodeArtisan00 commented on GitHub (Feb 28, 2020): > I think the issue is that `blacklist`/`whitelist` has only an effect if the directory/file is already present when the sandbox is started. yes... is there any workaround?

gitea-mirror commented

2026-05-05 08:42:33 -06:00

Author

Owner

@smitsohu commented on GitHub (Feb 29, 2020):

Firejail first configures the sandbox and then drops all privileges in order to start the application. At this point the sandbox is basically set in stone, at least for a regular user.

Talking about workarounds, one could in theory somehow detect the mount event and then join the sandbox as root user and modify the mount namespace of the sandbox manually, but this suffers from all kinds of race conditions. This means there would be always short time spans where the sandbox has full access to the paths that you want blacklisted.

So no, unfortunately there is no workaround.

@smitsohu commented on GitHub (Feb 29, 2020): Firejail first configures the sandbox and then drops all privileges in order to start the application. At this point the sandbox is basically set in stone, at least for a regular user. Talking about workarounds, one could in theory somehow detect the mount event and then `join` the sandbox as root user and modify the mount namespace of the sandbox manually, but this suffers from all kinds of race conditions. This means there would be always short time spans where the sandbox has full access to the paths that you want blacklisted. So no, unfortunately there is no workaround.

gitea-mirror commented

2026-05-05 08:42:34 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 29, 2020):

IDK what your targeted workflow is but this works:

mkdir /media/foo # create mountpoint
firejail --whitelist=/media/foo --blacklist=/run/media --blacklist=/mnt … app
# mount anything to /media/bar, app can't see it
# mount anything to /media/foo, app can see it

@rusty-snake commented on GitHub (Feb 29, 2020): IDK what your targeted workflow is but this works: ``` mkdir /media/foo # create mountpoint firejail --whitelist=/media/foo --blacklist=/run/media --blacklist=/mnt … app # mount anything to /media/bar, app can't see it # mount anything to /media/foo, app can see it ```

gitea-mirror commented

2026-05-05 08:42:35 -06:00

Author

Owner

@smitsohu commented on GitHub (Feb 29, 2020):

@rusty-snake Right, thanks!

@smitsohu commented on GitHub (Feb 29, 2020): @rusty-snake Right, thanks!

gitea-mirror commented

2026-05-05 08:42:36 -06:00

Author

Owner

@CodeArtisan00 commented on GitHub (Feb 29, 2020):

IDK what your targeted workflow is but this works:

mkdir /media/foo # create mountpoint
firejail --whitelist=/media/foo --blacklist=/run/media --blacklist=/mnt … app
# mount anything to /media/bar, app can't see it
# mount anything to /media/foo, app can see it

thanks.
For some reason, it never occurs to me to mount it in different location.

@CodeArtisan00 commented on GitHub (Feb 29, 2020): > IDK what your targeted workflow is but this works: > > ``` > mkdir /media/foo # create mountpoint > firejail --whitelist=/media/foo --blacklist=/run/media --blacklist=/mnt … app > # mount anything to /media/bar, app can't see it > # mount anything to /media/foo, app can see it > ``` thanks. For some reason, it never occurs to me to mount it in different location.

gitea-mirror commented

2026-05-05 08:42:37 -06:00

Author

Owner

@ghost commented on GitHub (Apr 5, 2020):

Closing here, as a viable workaround is available. Feel free to re-open at your discretion.

@ghost commented on GitHub (Apr 5, 2020): Closing here, as a viable workaround is available. Feel free to re-open at your discretion.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2035

No description provided.

Rows
Columns