[GH-ISSUE #306] security: wrong behaviour of firejail for an empty `whitelist` #212

New issue

Closed

opened 2026-05-05 05:19:59 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 05:19:59 -06:00

Owner

Originally created by @vn971 on GitHub (Feb 19, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/306

firejail does NOT enable its filesystem sandboxing mechanism if a whitelist filter does not correspond to already-existing files.

Steps to reproduce:

create a profile with whitelist ${HOME}/abcd1234
launch firejail --profile=new.profile ls -al /home/user
observe all files being visible to the sandboxed process

Expected:

the last command should only return .bashrc and .Xauthority. Because there are no matches between whitelist and files an the real FS, the expected behavior is to start with --private.

Originally created by @vn971 on GitHub (Feb 19, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/306 firejail does NOT enable its filesystem sandboxing mechanism if a `whitelist` filter does not correspond to already-existing files. Steps to reproduce: - create a profile with `whitelist ${HOME}/abcd1234` - launch `firejail --profile=new.profile ls -al /home/user` - observe all files being visible to the sandboxed process Expected: - the last command should only return .bashrc and .Xauthority. Because there are no matches between `whitelist` and files an the real FS, the expected behavior is to start with `--private`.

gitea-mirror closed this issue

2026-05-05 05:20:02 -06:00

gitea-mirror commented

2026-05-05 05:20:05 -06:00

Author

Owner

@manevich commented on GitHub (Feb 20, 2016):

Looks like you are using old version, try one from git.
This behaviour already fixed, see issue #276.

@manevich commented on GitHub (Feb 20, 2016): Looks like you are using old version, try one from git. This behaviour already fixed, see issue #276.

gitea-mirror commented

2026-05-05 05:20:08 -06:00

Author

Owner

@vn971 commented on GitHub (Feb 20, 2016):

Indeed, I'm using the last stable release (.38). Will update. Thanks!

@vn971 commented on GitHub (Feb 20, 2016): Indeed, I'm using the last stable release (.38). Will update. Thanks!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#212

No description provided.

Rows
Columns

[GH-ISSUE #306] security: wrong behaviour of firejail for an empty whitelist #212

[GH-ISSUE #306] security: wrong behaviour of firejail for an empty `whitelist` #212