github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #3580] Question: Firefox - How do i allow an external storage path? #2243

New issue
Closed
opened 2026-05-05 08:56:10 -06:00 by gitea-mirror · 12 comments
gitea-mirror commented 2026-05-05 08:56:10 -06:00
Owner
Copy link

Originally created by @svc88 on GitHub (Aug 9, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3580

Using the default profile for Firefox in 0.9.62

I would like to allow Firefox access to a specific path under /media/drive/bla/bla/bla
What do i need to put under firefox.local ?

I tried noblacklist and whitelist but it doesnt work for /media/xxx

Originally created by @svc88 on GitHub (Aug 9, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3580 Using the default profile for Firefox in 0.9.62 I would like to allow Firefox access to a specific path under /media/drive/bla/bla/bla What do i need to put under firefox.local ? I tried noblacklist and whitelist but it doesnt work for /media/xxx
gitea-mirror commented 2026-05-05 08:56:13 -06:00
Author
Owner
Copy link

@smitsohu commented on GitHub (Aug 9, 2020):

Try --noblacklist=/media or --ignore=disable-mnt

<!-- gh-comment-id:671094292 --> @smitsohu commented on GitHub (Aug 9, 2020): Try `--noblacklist=/media` or `--ignore=disable-mnt`
gitea-mirror commented 2026-05-05 08:56:13 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Aug 9, 2020):

ignore disable-mnt

Edit: smitsohu was 1 second faster 🤣

smitsohu: 2020-08-09T19:57:32Z
rusty-snake: 2020-08-09T19:57:33Z

<!-- gh-comment-id:671094295 --> @rusty-snake commented on GitHub (Aug 9, 2020): `ignore disable-mnt` --- Edit: smitsohu was 1 second faster :rofl: smitsohu: 2020-08-09T19:57:32Z rusty-snake: 2020-08-09T19:57:33Z
gitea-mirror commented 2026-05-05 08:56:15 -06:00
Author
Owner
Copy link

@svc88 commented on GitHub (Aug 9, 2020):

Thanks guys.

Try --noblacklist=/media or --ignore=disable-mnt

If i try either only --noblacklist=/media OR only --ignore=disable-mnt - this allows it but at the same time, it allows ALL drives to be accessed and obviously i dont want to allow other drives to be compromised/visible, however if i try only a complete specific path such as /media/dir1/dir2/dir3/dir4 it doesnt allow it as i originally mentioned.

So what i did was (as @rusty-snake also mentioned):

ignore disable-mnt
noblacklist /media/dir1/dir2/dir3/dir4
whitelist /media/dir1/dir2/dir3/dir4

This allowed Firefox the specific device's dir path but at the same time disallows all other drives mounted which is great, so is this the correct way to go about this?

<!-- gh-comment-id:671102112 --> @svc88 commented on GitHub (Aug 9, 2020): Thanks guys. > Try `--noblacklist=/media` or `--ignore=disable-mnt` If i try either only `--noblacklist=/media` OR only `--ignore=disable-mnt` - this allows it but at the same time, it allows ALL drives to be accessed and obviously i dont want to allow other drives to be compromised/visible, however if i try only a complete specific path such as `/media/dir1/dir2/dir3/dir4` it doesnt allow it as i originally mentioned. So what i did was (as @rusty-snake also mentioned): ``` ignore disable-mnt noblacklist /media/dir1/dir2/dir3/dir4 whitelist /media/dir1/dir2/dir3/dir4 ``` This allowed Firefox the specific device's dir path but at the same time disallows all other drives mounted which is great, so is this the correct way to go about this?
gitea-mirror commented 2026-05-05 08:56:16 -06:00
Author
Owner
Copy link

@svc88 commented on GitHub (Aug 9, 2020):

Is there no other way besides ignore disable-mnt ?

<!-- gh-comment-id:671102176 --> @svc88 commented on GitHub (Aug 9, 2020): Is there no other way besides `ignore disable-mnt` ?
gitea-mirror commented 2026-05-05 08:56:17 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Aug 9, 2020):

#3245

<!-- gh-comment-id:671104707 --> @rusty-snake commented on GitHub (Aug 9, 2020): #3245
gitea-mirror commented 2026-05-05 08:56:17 -06:00
Author
Owner
Copy link

@svc88 commented on GitHub (Aug 9, 2020):

@rusty-snake your comment here, i tried it, but firstly i get the error Error: only directories in user home or /tmp are supported by mkdir

<!-- gh-comment-id:671107270 --> @svc88 commented on GitHub (Aug 9, 2020): @rusty-snake [your comment](https://github.com/netblue30/firejail/issues/3245#issuecomment-592920834) here, i tried it, but firstly i get the error `Error: only directories in user home or /tmp are supported by mkdir`
gitea-mirror commented 2026-05-05 08:56:18 -06:00
Author
Owner
Copy link

@svc88 commented on GitHub (Aug 9, 2020):

It seems i cant get this to work. I dont want to blacklist specific drives. i actually want to blacklist or disable-mnt on all drives but one.
Is there another way to do this?

<!-- gh-comment-id:671107661 --> @svc88 commented on GitHub (Aug 9, 2020): It seems i cant get this to work. I dont want to blacklist specific drives. i actually want to blacklist or disable-mnt on all drives but one. Is there another way to do this?
gitea-mirror commented 2026-05-05 08:56:19 -06:00
Author
Owner
Copy link

@svc88 commented on GitHub (Aug 9, 2020):

Basically since the below works and disallows the rest of the drives but with disable-mnt ignored, my question is, is this ok or is there a way the app could still get into the rest of the drives somehow?

ignore disable-mnt
noblacklist /media/dir1/dir2/dir3/dir4
whitelist /media/dir1/dir2/dir3/dir4
<!-- gh-comment-id:671108007 --> @svc88 commented on GitHub (Aug 9, 2020): Basically since the below works and disallows the rest of the drives but with disable-mnt ignored, my question is, is this ok or is there a way the app could **still** get into the rest of the drives somehow? ``` ignore disable-mnt noblacklist /media/dir1/dir2/dir3/dir4 whitelist /media/dir1/dir2/dir3/dir4 ```
gitea-mirror commented 2026-05-05 08:56:19 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Aug 10, 2020):

is there a way the app could still get into the rest of the drives somehow

noblacklist /media/dir1/dir2/dir3/dir4 this line is redundant, since there is no such backlist.
whitelist /media/dir1/dir2/dir3/dir4 this makes /media containing only dir1 or if dir1 is not present when the sandbox is started /media empty. However using gio/gvfs/kio over D-Bus may allow the app to see more drivers (but I don't believe that D-Bus is used to access files, this is very likely still done with open).

<!-- gh-comment-id:671186459 --> @rusty-snake commented on GitHub (Aug 10, 2020): > is there a way the app could still get into the rest of the drives somehow `noblacklist /media/dir1/dir2/dir3/dir4` this line is redundant, since there is no such `backlist`. `whitelist /media/dir1/dir2/dir3/dir4` this makes `/media` containing only `dir1` or if dir1 is not present when the sandbox is started `/media` empty. However using gio/gvfs/kio over D-Bus may allow the app to see more drivers (but I don't believe that D-Bus is used to access files, this is very likely still done with `open`).
gitea-mirror commented 2026-05-05 08:56:20 -06:00
Author
Owner
Copy link

@svc88 commented on GitHub (Aug 17, 2020):

@rusty-snake thanks, noted.
Can you please explain what you mean its likely done with open ?

<!-- gh-comment-id:675031422 --> @svc88 commented on GitHub (Aug 17, 2020): @rusty-snake thanks, noted. Can you please explain what you mean its likely done with `open` ?
gitea-mirror commented 2026-05-05 08:56:20 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Aug 24, 2020):

https://www.man7.org/linux/man-pages/man2/open.2.html

<!-- gh-comment-id:679415155 --> @rusty-snake commented on GitHub (Aug 24, 2020): https://www.man7.org/linux/man-pages/man2/open.2.html
gitea-mirror commented 2026-05-05 08:56:20 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Oct 1, 2020):

I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.

<!-- gh-comment-id:702308029 --> @rusty-snake commented on GitHub (Oct 1, 2020): I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2243
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?