github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #310] ecryptfs integration #218

New issue

Closed

opened 2026-05-05 05:20:34 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 05:20:34 -06:00

Owner

Originally created by @lalbers on GitHub (Feb 20, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/310

--overlay option does not work

sample output:

Warning: default profile disabled by --overlay option
Parent pid 19890, child pid 19891
Error mounting overlayfs:fs_overlayfs(748): Invalid argument
Error: cannot establish communication with the parent, exiting...

--overlay-tmpfs works fine
using ecryptfs for some filesystems

tested on:
3.19.0-32-generic

Originally created by @lalbers on GitHub (Feb 20, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/310 **--overlay option does not work** sample output: ``` Warning: default profile disabled by --overlay option Parent pid 19890, child pid 19891 Error mounting overlayfs:fs_overlayfs(748): Invalid argument Error: cannot establish communication with the parent, exiting... ``` - --overlay-tmpfs works fine - using ecryptfs for some filesystems tested on: 3.19.0-32-generic

gitea-mirror

2026-05-05 05:20:34 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 05:20:39 -06:00

Author

Owner

@Sidnioulz commented on GitHub (Feb 21, 2016):

For this kind of debugging I suspect it would help netblue30 a lot to provide a snapshot of the mount units you have on your system, with all the mount options and filesystem types. Pasting your /proc/mounts might be necessary.

I also had a lot of issues with --overlay that boiled down to some of my mount units not being mounted inside the OverlayFS upper layer (it's not recursive!) so I had to parse /proc/mounts and re-mount the units I wanted inside the upper layer. In my fork I now have multiple OverlayFS units, one for each persistent drive that I want to have (e.g. /, /home, /mnt/some/name).

@Sidnioulz commented on GitHub (Feb 21, 2016): For this kind of debugging I suspect it would help netblue30 a lot to provide a snapshot of the mount units you have on your system, with all the mount options and filesystem types. Pasting your /proc/mounts might be necessary. I also had a lot of issues with --overlay that boiled down to some of my mount units not being mounted inside the OverlayFS upper layer (it's not recursive!) so I had to parse /proc/mounts and re-mount the units I wanted inside the upper layer. In my fork I now have multiple OverlayFS units, one for each persistent drive that I want to have (e.g. /, /home, /mnt/some/name).

gitea-mirror commented

2026-05-05 05:20:42 -06:00

Author

Owner

@lalbers commented on GitHub (Feb 21, 2016):

The reason for this problem, seems to be an encrypted home dir. I created a user without an encrypted home dir and used 'firejail --overlay', now it worked.

however here's my output from "/proc/mounts":

sysfs /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0
proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0
udev /dev devtmpfs rw,relatime,size=16431924k,nr_inodes=4107981,mode=755 0 0
devpts /dev/pts devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0
tmpfs /run tmpfs rw,nosuid,noexec,relatime,size=3289596k,mode=755 0 0
/dev/disk/by-uuid/adcd2668-d8bc-4e40-98e5-b36e8cf87921 / ext4 rw,relatime,errors=remount-ro,data=ordered 0 0
none /sys/fs/cgroup tmpfs rw,relatime,size=4k,mode=755 0 0
none /sys/fs/fuse/connections fusectl rw,relatime 0 0
none /sys/kernel/debug debugfs rw,relatime 0 0
none /sys/kernel/security securityfs rw,relatime 0 0
none /sys/firmware/efi/efivars efivarfs rw,relatime 0 0
none /run/lock tmpfs rw,nosuid,nodev,noexec,relatime,size=5120k 0 0
none /run/shm tmpfs rw,nosuid,nodev,relatime 0 0
none /run/user tmpfs rw,nosuid,nodev,noexec,relatime,size=102400k,mode=755 0 0
none /sys/fs/pstore pstore rw,relatime 0 0
/dev/sdc1 /boot/efi vfat rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro 0 0
/dev/sdb2 /mnt/4TB fuseblk rw,nosuid,nodev,relatime,user_id=0,group_id=0,default_permissions,allow_other,blksize=4096 0 0
/dev/sda2 /mnt/3TB fuseblk rw,nosuid,nodev,relatime,user_id=0,group_id=0,default_permissions,allow_other,blksize=4096 0 0
binfmt_misc /proc/sys/fs/binfmt_misc binfmt_misc rw,nosuid,nodev,noexec,relatime 0 0
systemd /sys/fs/cgroup/systemd cgroup rw,nosuid,nodev,noexec,relatime,name=systemd 0 0
vmware-vmblock /run/vmblock-fuse fuse.vmware-vmblock rw,nosuid,nodev,relatime,user_id=0,group_id=0,default_permissions,allow_other 0 0
/home/user/.Private /home/user ecryptfs rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=8dea36051241bffe,ecryptfs_sig=9a03331d29e7777a,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs 0 0
gvfsd-fuse /run/user/1000/gvfs fuse.gvfsd-fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=1000 
```0 0

@lalbers commented on GitHub (Feb 21, 2016): **The reason for this problem, seems to be an encrypted home dir. I created a user without an encrypted home dir and used 'firejail --overlay', now it worked.** however here's my output from "/proc/mounts": `````` sysfs /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0 proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0 udev /dev devtmpfs rw,relatime,size=16431924k,nr_inodes=4107981,mode=755 0 0 devpts /dev/pts devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0 tmpfs /run tmpfs rw,nosuid,noexec,relatime,size=3289596k,mode=755 0 0 /dev/disk/by-uuid/adcd2668-d8bc-4e40-98e5-b36e8cf87921 / ext4 rw,relatime,errors=remount-ro,data=ordered 0 0 none /sys/fs/cgroup tmpfs rw,relatime,size=4k,mode=755 0 0 none /sys/fs/fuse/connections fusectl rw,relatime 0 0 none /sys/kernel/debug debugfs rw,relatime 0 0 none /sys/kernel/security securityfs rw,relatime 0 0 none /sys/firmware/efi/efivars efivarfs rw,relatime 0 0 none /run/lock tmpfs rw,nosuid,nodev,noexec,relatime,size=5120k 0 0 none /run/shm tmpfs rw,nosuid,nodev,relatime 0 0 none /run/user tmpfs rw,nosuid,nodev,noexec,relatime,size=102400k,mode=755 0 0 none /sys/fs/pstore pstore rw,relatime 0 0 /dev/sdc1 /boot/efi vfat rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro 0 0 /dev/sdb2 /mnt/4TB fuseblk rw,nosuid,nodev,relatime,user_id=0,group_id=0,default_permissions,allow_other,blksize=4096 0 0 /dev/sda2 /mnt/3TB fuseblk rw,nosuid,nodev,relatime,user_id=0,group_id=0,default_permissions,allow_other,blksize=4096 0 0 binfmt_misc /proc/sys/fs/binfmt_misc binfmt_misc rw,nosuid,nodev,noexec,relatime 0 0 systemd /sys/fs/cgroup/systemd cgroup rw,nosuid,nodev,noexec,relatime,name=systemd 0 0 vmware-vmblock /run/vmblock-fuse fuse.vmware-vmblock rw,nosuid,nodev,relatime,user_id=0,group_id=0,default_permissions,allow_other 0 0 /home/user/.Private /home/user ecryptfs rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=8dea36051241bffe,ecryptfs_sig=9a03331d29e7777a,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs 0 0 gvfsd-fuse /run/user/1000/gvfs fuse.gvfsd-fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=1000 ```0 0 ``````

gitea-mirror commented

2026-05-05 05:20:44 -06:00

Author

Owner

@zaldnoay commented on GitHub (Jun 22, 2016):

The problem happened in my computer. Like @twoDarkMessiah , i have a standalone home dir with LUKS encryption. dmesg show overlayfs: upper fs needs to support d_type. error at the same time.
Here is my output of mount

% >> mount
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
sys on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
dev on /dev type devtmpfs (rw,nosuid,relatime,size=4023084k,nr_inodes=1005771,mode=755)
run on /run type tmpfs (rw,nosuid,nodev,relatime,mode=755)
/dev/sdb3 on / type ext4 (rw,noatime,discard,data=ordered)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct)
cgroup on /sys/fs/cgroup/net_cls type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/pids type cgroup (rw,nosuid,nodev,noexec,relatime,pids)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=34,pgrp=1,timeout=0,minproto=5,maxproto=5,direct)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime)
mqueue on /dev/mqueue type mqueue (rw,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,relatime)
tmpfs on /tmp type tmpfs (rw,relatime,size=2097152k)
configfs on /sys/kernel/config type configfs (rw,relatime)
/dev/sdb2 on /boot type ext4 (rw,noatime,discard,data=ordered)
/dev/sdb1 on /boot/efi type vfat (rw,noatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/sda1 on /var type xfs (rw,relatime,attr2,inode64,noquota)
/dev/mapper/home on /home type xfs (rw,relatime,attr2,inode64,noquota)
tmpfs on /run/user/120 type tmpfs (rw,nosuid,nodev,relatime,size=805628k,mode=700,uid=120,gid=120)
gvfsd-fuse on /run/user/120/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=120,group_id=120)
fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=805628k,mode=700,uid=1000,gid=100)
gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=100)

Sample firejail error output

% >> firejail --overlay        
Warning: default profile disabled by --overlay option
Parent pid 18742, child pid 18743
Error mounting overlayfs:fs_overlayfs(886): Invalid argument
Error: cannot establish communication with the parent, exiting...

Enviroment:
Kernel 4.6.2
firejail 0.9.40

@zaldnoay commented on GitHub (Jun 22, 2016): The problem happened in my computer. Like @twoDarkMessiah , i have a standalone home dir with LUKS encryption. `dmesg` show `overlayfs: upper fs needs to support d_type.` error at the same time. Here is my output of `mount` ``` % >> mount proc on /proc type proc (rw,nosuid,nodev,noexec,relatime) sys on /sys type sysfs (rw,nosuid,nodev,noexec,relatime) dev on /dev type devtmpfs (rw,nosuid,relatime,size=4023084k,nr_inodes=1005771,mode=755) run on /run type tmpfs (rw,nosuid,nodev,relatime,mode=755) /dev/sdb3 on / type ext4 (rw,noatime,discard,data=ordered) securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime) tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev) devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000) tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,mode=755) cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd) pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime) efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime) cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct) cgroup on /sys/fs/cgroup/net_cls type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls) cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory) cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio) cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices) cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer) cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset) cgroup on /sys/fs/cgroup/pids type cgroup (rw,nosuid,nodev,noexec,relatime,pids) systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=34,pgrp=1,timeout=0,minproto=5,maxproto=5,direct) hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime) mqueue on /dev/mqueue type mqueue (rw,relatime) debugfs on /sys/kernel/debug type debugfs (rw,relatime) binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,relatime) tmpfs on /tmp type tmpfs (rw,relatime,size=2097152k) configfs on /sys/kernel/config type configfs (rw,relatime) /dev/sdb2 on /boot type ext4 (rw,noatime,discard,data=ordered) /dev/sdb1 on /boot/efi type vfat (rw,noatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro) /dev/sda1 on /var type xfs (rw,relatime,attr2,inode64,noquota) /dev/mapper/home on /home type xfs (rw,relatime,attr2,inode64,noquota) tmpfs on /run/user/120 type tmpfs (rw,nosuid,nodev,relatime,size=805628k,mode=700,uid=120,gid=120) gvfsd-fuse on /run/user/120/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=120,group_id=120) fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime) tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=805628k,mode=700,uid=1000,gid=100) gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=100) ``` Sample firejail error output ``` % >> firejail --overlay Warning: default profile disabled by --overlay option Parent pid 18742, child pid 18743 Error mounting overlayfs:fs_overlayfs(886): Invalid argument Error: cannot establish communication with the parent, exiting... ``` Enviroment: Kernel 4.6.2 firejail 0.9.40

gitea-mirror commented

2026-05-05 05:20:48 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 25, 2018):

Is this still an issue? I currently have a laptop with two hard drives, each independently encrypted with LVM groups inside:

$ lsblk -f
NAME                   FSTYPE      LABEL UUID                                   MOUNTPOINT
sda                                                                             
└─sda1                 crypto_LUKS       48ee753d-cb24-4c87-8495-5e014bc0cbc4   
  └─sda1_crypt         LVM2_member       L4ACzv-NYK0-4WZx-zED5-24aa-7qZR-6AiYvl 
    └─Crypto_Data-Home ext4              37ec9273-d4f8-493f-bd1c-c36469e17a04   /home
nvme0n1                                                                         
├─nvme0n1p1            vfat              5B1E-2A51                              /boot/efi
├─nvme0n1p2            crypto_LUKS       3670d3b4-0d04-46b9-90e1-113c7a1ddb0b   
│ └─nvme0n1p2_crypt    LVM2_member       OjWrMn-IRVr-mcya-U6tv-jnHN-8Hsw-ToNZp3 
│   ├─Crypto-Root      ext4              22f34f46-66d4-4ad7-bf8f-79274728599d   /
│   └─Crypto-Swap      swap              6852e23e-6195-4a85-98d5-115264842efd   [SWAP]
└─nvme0n1p3            ext4              12fcc3ad-6cfb-4e20-9262-6ade5fc68af3   /boot

and firejail --overlay works just fine. As you can see from the output above, my home drive is encrypted independently of the (root + swap) drive.

Maybe I misunderstood the exact scenario above though.

@chiraag-nataraj commented on GitHub (Jul 25, 2018): Is this still an issue? I currently have a laptop with two hard drives, each independently encrypted with LVM groups inside: ``` $ lsblk -f NAME FSTYPE LABEL UUID MOUNTPOINT sda └─sda1 crypto_LUKS 48ee753d-cb24-4c87-8495-5e014bc0cbc4 └─sda1_crypt LVM2_member L4ACzv-NYK0-4WZx-zED5-24aa-7qZR-6AiYvl └─Crypto_Data-Home ext4 37ec9273-d4f8-493f-bd1c-c36469e17a04 /home nvme0n1 ├─nvme0n1p1 vfat 5B1E-2A51 /boot/efi ├─nvme0n1p2 crypto_LUKS 3670d3b4-0d04-46b9-90e1-113c7a1ddb0b │ └─nvme0n1p2_crypt LVM2_member OjWrMn-IRVr-mcya-U6tv-jnHN-8Hsw-ToNZp3 │ ├─Crypto-Root ext4 22f34f46-66d4-4ad7-bf8f-79274728599d / │ └─Crypto-Swap swap 6852e23e-6195-4a85-98d5-115264842efd [SWAP] └─nvme0n1p3 ext4 12fcc3ad-6cfb-4e20-9262-6ade5fc68af3 /boot ``` and `firejail --overlay` works just fine. As you can see from the output above, my home drive is encrypted independently of the (root + swap) drive. Maybe I misunderstood the exact scenario above though.

gitea-mirror commented

2026-05-05 05:20:51 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 19, 2018):

Closing for inactivity. @twoDarkMessiah and @zaldnoay, please feel free to re-open if you still have the issue.

@chiraag-nataraj commented on GitHub (Aug 19, 2018): Closing for inactivity. @twoDarkMessiah and @zaldnoay, please feel free to re-open if you still have the issue.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#218

No description provided.

Rows
Columns