[GH-ISSUE #3303] noroot removes all user groups, nogroups redundant #2073

New issue

Open

opened 2026-05-05 08:44:27 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 08:44:27 -06:00

Owner

Originally created by @neirenoir on GitHub (Mar 27, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3303

I'm not sure if it is intended behaviour, but setting noroot as an option will remove all of the user's groups, regardless of whether nogroups is present or not. Right now, I had to configure the profile of a program to ignore both nogroups and noroot, but I could have done away ignoring only nogroups: I need some of my user's groups, but I don't need the program knowing about the existence of users other than mine, including root.

Could noroot be implemented in such a way that it does not overlap with nogroups, so I can set them both independently, or does noroot necessarily require the removal of other groups?

Originally created by @neirenoir on GitHub (Mar 27, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3303 I'm not sure if it is intended behaviour, but setting `noroot` as an option will remove all of the user's groups, regardless of whether `nogroups` is present or not. Right now, I had to configure the profile of a program to ignore both `nogroups` and `noroot`, but I could have done away ignoring only `nogroups`: I need some of my user's groups, but I don't need the program knowing about the existence of users other than mine, including root. Could `noroot` be implemented in such a way that it does not overlap with `nogroups`, so I can set them both independently, or does `noroot` necessarily require the removal of other groups?

gitea-mirror added the

enhancement

label 2026-05-05 08:44:28 -06:00

gitea-mirror commented

2026-05-05 08:44:29 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 28, 2020):

$ groups
rusty-snake wheel games wireshark
$ firejail --noprofile groups
rusty-snake wheel games wireshark
$ firejail --noprofile --nogroups groups
rusty-snake
$ firejail --noprofile --noroot groups
rusty-snake games

😕 , there are exceptions for tty, audio, video, games.
ec0a097a07/src/firejail/util.c (L63)

IMHO the best would be that #2042 also applies to noroot.

@rusty-snake commented on GitHub (Mar 28, 2020): ``` $ groups rusty-snake wheel games wireshark $ firejail --noprofile groups rusty-snake wheel games wireshark $ firejail --noprofile --nogroups groups rusty-snake $ firejail --noprofile --noroot groups rusty-snake games ``` :confused: , there are exceptions for tty, audio, video, games. https://github.com/netblue30/firejail/blob/ec0a097a07a6d80b2f7aa336c63bf292e946e26d/src/firejail/util.c#L63 IMHO the best would be that #2042 also applies to noroot.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2073

No description provided.

Rows
Columns