github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3503] "ignore quiet" does not work in override (.local) files #2205

New issue

Open

opened 2026-05-05 08:53:03 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 08:53:03 -06:00

Owner

Originally created by @NetSysFire on GitHub (Jul 8, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3503

Steps to reproduce:

Find a profile that uses the quiet directive, for example youtube-dl
Create ~/.config/firejail/youtube-dl.local
Add ignore quiet to the override
Run firejail youtube-dl. The added ignore quiet gets silently ignored

--ignore=quiet works though.

Relates to:

#6537

Originally created by @NetSysFire on GitHub (Jul 8, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3503 Steps to reproduce: * Find a profile that uses the `quiet` directive, for example `youtube-dl` * Create `~/.config/firejail/youtube-dl.local` * Add `ignore quiet` to the override * Run `firejail youtube-dl`. The added `ignore quiet` gets silently ignored `--ignore=quiet` works though. Relates to: * #6537

gitea-mirror added the

bug

label 2026-05-05 08:53:03 -06:00

gitea-mirror commented

2026-05-05 08:53:05 -06:00

Author

Owner

@ghost commented on GitHub (Jul 8, 2020):

I can reproduce and confirm this is an issue in git master as well.

@ghost commented on GitHub (Jul 8, 2020): I can reproduce and confirm this is an issue in git master as well.

gitea-mirror commented

2026-05-05 08:53:06 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 9, 2020):

The reason is that we put the quiet above the include foo.local.

quiet
include foo.local

We can not fix this by changing this order, because we break quiet if it is not the first command.

IMHO this is expected behaviour.

@rusty-snake commented on GitHub (Jul 9, 2020): The reason is that we put the `quiet` above the `include foo.local`. ``` quiet include foo.local ``` We can not fix this by changing this order, because we break `quiet` if it is not the first command. IMHO this is expected behaviour.

gitea-mirror commented

2026-05-05 08:53:07 -06:00

Author

Owner

@ghost commented on GitHub (Jul 9, 2020):

The reason is that we put the quiet above the include foo.local.

That's correct.

We can not fix this by changing this order, because we break quiet if it is not the first command.

I thought so too. But it is NOT what I'm seeing. And according to my observations changing the order CAN fix it, but it's unreliable and inconsistent.

Example A: unchanged profiles --> 'quiet' works as expected (no firejail output)

$ head -n 8 /etc/firejail/curl.profile
# Firejail profile for curl
# Description: Command line tool for transferring data with URL syntax
# This file is overwritten after every install/update
quiet
# Persistent local customizations
include curl.local
# Persistent global definitions
include globals.local

$ cat /etc/firejail/curl.local
# Firejail profile for curl
# Persistent local customizations

$ firejail /usr/bin/curl --version
curl 7.71.1 (x86_64-pc-linux-gnu) libcurl/7.71.1 OpenSSL/1.1.1g zlib/1.2.11 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.2.0) libssh2/1.9.0 nghttp2/1.41.0
Release-Date: 2020-07-01
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS GSS-API HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets

Example B: 'quiet' placed below 'include foo.local' in foo.profile + foo.local contains 'ignore quiet' as first option --> works as expected (firejail output is shown)

$ head -n 8 /etc/firejail/curl.profile
# Firejail profile for curl
# Description: Command line tool for transferring data with URL syntax
# This file is overwritten after every install/update
# Persistent local customizations
include curl.local
quiet
# Persistent global definitions
include globals.local

$ cat /etc/firejail/curl.local
# Firejail profile for curl
# Persistent local customizations
ignore quiet

$ firejail /usr/bin/curl --version
Reading profile /etc/firejail/curl.profile
Reading profile /etc/firejail/curl.local
Reading profile /etc/firejail/globals.local
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 34736, child pid 34737

Blacklist violations are logged to syslog
Child process initialized in 311.14ms
curl 7.71.1 (x86_64-pc-linux-gnu) libcurl/7.71.1 OpenSSL/1.1.1g zlib/1.2.11 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.2.0) libssh2/1.9.0 nghttp2/1.41.0
Release-Date: 2020-07-01
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS GSS-API HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets

Parent is shutting down, bye...

Example C: 'quiet' placed below 'include foo.local' in foo.profile + foo.local does NOT contain 'ignore quiet' --> broken (firejail output is partly shown)

$ firejail /usr/bin/curl --version
Reading profile /etc/firejail/curl.profile
Reading profile /etc/firejail/curl.local
curl 7.71.1 (x86_64-pc-linux-gnu) libcurl/7.71.1 OpenSSL/1.1.1g zlib/1.2.11 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.2.0) libssh2/1.9.0 nghttp2/1.41.0
Release-Date: 2020-07-01
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS GSS-API HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets

I'm not saying this is easy to fix. But can we really expect users having to go through CLI hoops to override a firejail option, whether it be 'quiet' or any other?

@ghost commented on GitHub (Jul 9, 2020): > The reason is that we put the quiet above the include foo.local. That's correct. > We can not fix this by changing this order, because we break quiet if it is not the first command. I thought so too. But it is **NOT** what I'm seeing. And according to my observations changing the order **CAN** fix it, but it's unreliable and inconsistent. Example A: unchanged profiles --> 'quiet' works as expected (no firejail output) ``` $ head -n 8 /etc/firejail/curl.profile # Firejail profile for curl # Description: Command line tool for transferring data with URL syntax # This file is overwritten after every install/update quiet # Persistent local customizations include curl.local # Persistent global definitions include globals.local $ cat /etc/firejail/curl.local # Firejail profile for curl # Persistent local customizations $ firejail /usr/bin/curl --version curl 7.71.1 (x86_64-pc-linux-gnu) libcurl/7.71.1 OpenSSL/1.1.1g zlib/1.2.11 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.2.0) libssh2/1.9.0 nghttp2/1.41.0 Release-Date: 2020-07-01 Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp Features: AsynchDNS GSS-API HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets ``` Example B: 'quiet' placed _below_ 'include foo.local' in foo.profile + foo.local contains 'ignore quiet' as first option --> works as expected (firejail output is shown) ``` $ head -n 8 /etc/firejail/curl.profile # Firejail profile for curl # Description: Command line tool for transferring data with URL syntax # This file is overwritten after every install/update # Persistent local customizations include curl.local quiet # Persistent global definitions include globals.local $ cat /etc/firejail/curl.local # Firejail profile for curl # Persistent local customizations ignore quiet $ firejail /usr/bin/curl --version Reading profile /etc/firejail/curl.profile Reading profile /etc/firejail/curl.local Reading profile /etc/firejail/globals.local Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Warning: networking feature is disabled in Firejail configuration file Parent pid 34736, child pid 34737 Blacklist violations are logged to syslog Child process initialized in 311.14ms curl 7.71.1 (x86_64-pc-linux-gnu) libcurl/7.71.1 OpenSSL/1.1.1g zlib/1.2.11 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.2.0) libssh2/1.9.0 nghttp2/1.41.0 Release-Date: 2020-07-01 Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp Features: AsynchDNS GSS-API HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets Parent is shutting down, bye... ``` Example C: 'quiet' placed _below_ 'include foo.local' in foo.profile + foo.local does NOT contain 'ignore quiet' --> broken (firejail output is partly shown) ``` $ firejail /usr/bin/curl --version Reading profile /etc/firejail/curl.profile Reading profile /etc/firejail/curl.local curl 7.71.1 (x86_64-pc-linux-gnu) libcurl/7.71.1 OpenSSL/1.1.1g zlib/1.2.11 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.2.0) libssh2/1.9.0 nghttp2/1.41.0 Release-Date: 2020-07-01 Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp Features: AsynchDNS GSS-API HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets ``` I'm not saying this is easy to fix. But can we really expect users having to go through CLI hoops to override a firejail option, whether it be 'quiet' or any other?

gitea-mirror commented

2026-05-05 08:53:08 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 9, 2020):

I'm not saying this is easy to fix. But can we really expect users having to go through CLI hoops to override a firejail option, whether it be 'quiet' or any other?

Alternative they need to edit foo.profile after every update, or better copy foo.profile to their home. We have no full override support (yet). Disabling whitelisting meany add a ignore whitelist foobar for every whitelist (and a update which adds one lin to wc, enables it again). Include can not be ignored.

The best workaround ATM would be ~/.config/firejail/youtube-dl.profile:

ignore quiet
include ${CFG}/youtube-dl.profile

@rusty-snake commented on GitHub (Jul 9, 2020): > I'm not saying this is easy to fix. But can we really expect users having to go through CLI hoops to override a firejail option, whether it be 'quiet' or any other? Alternative they need to edit foo.profile after every update, or better copy foo.profile to their home. We have no full override support (yet). Disabling whitelisting meany add a `ignore whitelist foobar` for every whitelist (and a update which adds one lin to wc, enables it again). Include can not be ignored. The best workaround ATM would be `~/.config/firejail/youtube-dl.profile`: ``` ignore quiet include ${CFG}/youtube-dl.profile ```

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2205

No description provided.

Rows
Columns