[GH-ISSUE #307] do not allow to start with incompatible settings: `whitelist` and `private` #214

New issue

Closed

opened 2026-05-05 05:20:23 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 05:20:23 -06:00

Owner

Originally created by @vn971 on GitHub (Feb 19, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/307

The setting whitelist ${HOME}/*** is absolutely incompatible with private.

Please do not allow starting firejail with such a profile, possibly explaining the error. Reasoning: it's better to fail/stop fast for a security tool than to provide an "wrong"/strange behavior.

Originally created by @vn971 on GitHub (Feb 19, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/307 The setting `whitelist ${HOME}/***` is absolutely incompatible with `private`. Please do not allow starting firejail with such a profile, possibly explaining the error. Reasoning: it's better to fail/stop fast for a security tool than to provide an "wrong"/strange behavior.

gitea-mirror closed this issue

2026-05-05 05:20:24 -06:00

gitea-mirror commented

2026-05-05 05:20:28 -06:00

Author

Owner

@manevich commented on GitHub (Feb 20, 2016):

I think there no incompatibility, just --private option takes precedence, as more restricting one.
For example, you can use stock profile with whitelist, and --private option together to temporary get more restricting jail without rewriting profile.
Or even write new profile like this

include /etc/firejail/app.profile
private

to get everything from standard profile, but empty $HOME

@manevich commented on GitHub (Feb 20, 2016): I think there no incompatibility, just `--private` option takes precedence, as more restricting one. For example, you can use stock profile with `whitelist`, and `--private` option together to temporary get more restricting jail without rewriting profile. Or even write new profile like this ``` include /etc/firejail/app.profile private ``` to get everything from standard profile, but empty $HOME

gitea-mirror commented

2026-05-05 05:20:31 -06:00

Author

Owner

@vn971 commented on GitHub (Feb 20, 2016):

Hm. Ook, I think you're right, I was too quick with jumping to conclusions. The current behavior makes sense from that point of view.

@vn971 commented on GitHub (Feb 20, 2016): Hm. Ook, I think you're right, I was too quick with jumping to conclusions. The current behavior makes sense from that point of view.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#214

No description provided.

Rows
Columns

[GH-ISSUE #307] do not allow to start with incompatible settings: whitelist and private #214

[GH-ISSUE #307] do not allow to start with incompatible settings: `whitelist` and `private` #214